My setup:

- Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001
- Debuggee: Win7 Pro (running in a VM using VMWare Workstation)

I'm trying to follow the `SendMessage` call from the user space:

[![enter image description here][1]][1]

Into the kernel, by setting a conditional breakpoint on `win32k!NtUserMessageCall`:

[![enter image description here][2]][2]

If we take the declaration of the `NtUserMessageCall` function:

    NTSTATUS NtUserMessageCall(
        HWND hWnd,
        UINT uMsg,
        WPARAM wParam,
        LPARAM lParam,
        ULONG_PTR ResultInfo,
        DWORD dwWndProcType,
        BOOL bAnsi);

The condition for the breakpoint is for `uMsg == WM_SYSCOMMAND` (or 0x112). I set it as such:

    ba e 1 fffff960`00163318 "j (@rdx=0x112) ''; 'gc'"

I can then check that it was set up alright:

[![enter image description here][3]][3]

But when I then "Go" the OS:

[![enter image description here][4]][4]

The debuggee OS literally grids to a halt. I can't do anything. I can see some "life" in there by seeing the clock widget jumping by 20 second intervals but it is impossible to interact with windows or do anything. Note that if I disable the breakpoint above, everything starts working smoothly.

Can someone explain what am I doing wrong there? And how can I make it work?


  [1]: https://i.sstatic.net/blgb5.png
  [2]: https://i.sstatic.net/1GUDq.png
  [3]: https://i.sstatic.net/v7nBp.png
  [4]: https://i.sstatic.net/FauOa.png