My setup:
- Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001
- Debuggee: Win7 Pro (running in a VM using VMWare Workstation)
I'm trying to follow the SendMessage
call from the user space:
Into the kernel, by setting a conditional breakpoint on win32k!NtUserMessageCall
:
If we take the declaration of the NtUserMessageCall
function:
NTSTATUS NtUserMessageCall(
HWND hWnd,
UINT uMsg,
WPARAM wParam,
LPARAM lParam,
ULONG_PTR ResultInfo,
DWORD dwWndProcType,
BOOL bAnsi);
The condition for the breakpoint is for uMsg == WM_SYSCOMMAND
(or 0x112). I set it as such:
ba e 1 fffff960`00163318 "j (@rdx=0x112) ''; 'gc'"
I can then check that it was set up alright:
But when I then "Go" the OS:
The debuggee OS literally grinds to a halt. I can't do anything. I can see some "life" in there by seeing the clock widget jumping by 20 second intervals but it is impossible to interact with windows or do anything. Note that if I disable the breakpoint above, everything starts working smoothly.
Can someone explain what am I doing wrong there? And how can I make it work?