Skip to main content
2 of 2
edited title
c00000fd
  • 1.8k
  • 3
  • 27
  • 42

Setting a conditional kernel breakpoint in WinDbg grinds the debuggee OS to a halt

My setup:

  • Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001
  • Debuggee: Win7 Pro (running in a VM using VMWare Workstation)

I'm trying to follow the SendMessage call from the user space:

enter image description here

Into the kernel, by setting a conditional breakpoint on win32k!NtUserMessageCall:

enter image description here

If we take the declaration of the NtUserMessageCall function:

NTSTATUS NtUserMessageCall(
    HWND hWnd,
    UINT uMsg,
    WPARAM wParam,
    LPARAM lParam,
    ULONG_PTR ResultInfo,
    DWORD dwWndProcType,
    BOOL bAnsi);

The condition for the breakpoint is for uMsg == WM_SYSCOMMAND (or 0x112). I set it as such:

ba e 1 fffff960`00163318 "j (@rdx=0x112) ''; 'gc'"

I can then check that it was set up alright:

enter image description here

But when I then "Go" the OS:

enter image description here

The debuggee OS literally grinds to a halt. I can't do anything. I can see some "life" in there by seeing the clock widget jumping by 20 second intervals but it is impossible to interact with windows or do anything. Note that if I disable the breakpoint above, everything starts working smoothly.

Can someone explain what am I doing wrong there? And how can I make it work?

c00000fd
  • 1.8k
  • 3
  • 27
  • 42