Skip to content

Instantly share code, notes, and snippets.

@nicoster
Created April 12, 2012 15:20
Show Gist options
  • Select an option

  • Save nicoster/2368129 to your computer and use it in GitHub Desktop.

Select an option

Save nicoster/2368129 to your computer and use it in GitHub Desktop.
monitor a posted window msg using windbg
.if (not(${/d:$arg1}))
{
.echo Usage:
.echo " $$>a<${$arg0} msg [hwnd]"
.echo " Specify the msg you want to check. You could specify the hwnd as well"
.echo ""
.echo Example:
.echo " $$>a<${$arg0} 400 1a0396 # monitor msg WM_USER (0x400) for window 0x1a0396"
.echo " $$>a<${$arg0} 1 # monitor msg WM_CREATE (0x1) for all windows in current process"
}
.else
{
.if (${/d:$arg2})
{
bp USER32!NtUserGetMessage+0xc "j(poi(poi(esp+4)+4)==${$arg1} & (poi(poi(esp+4))==${$arg2})) '.echo;kL;g';'g'"
bp USER32!NtUserPeekMessage+0xc "j(poi(poi(esp+4)+4)==${$arg1} & (poi(esp+14)&1) & (poi(poi(esp+4))==${$arg2})) '.echo;kL;g';'g'"
bp USER32!DispatchMessageW+0xc "j(poi(poi(esp+4)+4)==${$arg1} & (poi(poi(esp+4))==${$arg2})) '.echo;kL;g';'g'"
}
.else
{
bp USER32!NtUserGetMessage+0xc "j(poi(poi(esp+4)+4)==${$arg1}) '.echo;kL;g';'g'"
bp USER32!NtUserPeekMessage+0xc "j(poi(poi(esp+4)+4)==${$arg1} & (poi(esp+14)&1)) '.echo;kL;g';'g'"
bp user32!DispatchMessageW "j(poi(poi(esp+4)+4)==${$arg1}) '.echo;kL;g';'g'"
}
bl
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment