{"id":1631,"date":"2015-05-14T18:10:19","date_gmt":"2015-05-14T22:10:19","guid":{"rendered":"http:\/\/www.ikriv.com\/blog\/?p=1631"},"modified":"2015-05-14T18:10:19","modified_gmt":"2015-05-14T22:10:19","slug":"how-to-break-into-debugger-when-specific-windows-message-is-sent-or-posted","status":"publish","type":"post","link":"https:\/\/ikriv.com\/blog\/?p=1631","title":{"rendered":"How to break into debugger when specific Windows message is sent or posted"},"content":{"rendered":"<p><a style=\"display:none\" href=\"http:\/\/www.codeproject.com\/script\/Articles\/BlogFeedList.aspx?amid=1181663\" rel=\"tag\">CodeProject<\/a><br \/>\nWe have recently been fighting a weird problem in our .NET application that was caused by a duplicate WM_KEYDOWN message. It relatively is easy to figure out who receives the message (Spy++ helps a lot), but how to find out who sends it?<\/p>\n<p>If you know (or suspect) the process that sends your message, here&#8217;s how to debug it in Visual Studio 2013:<\/p>\n<p>1. Run the program you want to debug.<br \/>\n2. Attach debugger, make sure native debugger is selected.<br \/>\n3. Break into debugger, if it\u2019s not there already.<br \/>\n4. Open window Debug->Windows->Modules, load symbols for user32.dll<br \/>\n5. Open BreakPoints window.<br \/>\n6. Add new break point at each of the functions below. IMPORTANT: set language to C++ (does not seem to work otherwise).<br \/>\n7. Functions: _PostMessageA@16, _PostMessageW@16, _SendMessageA@16, SendMessageW@16.<br \/>\n8. For each breakpoint set the following condition: <code>*(int*)(esp+8) == 0x100<\/code><br \/>\n9. Resume the app and enjoy.<\/p>\n<p>Explanation of the condition:<\/p>\n<p>ESP is the stack pointer<br \/>\n*ESP is the return address<br \/>\n*(ESP+4) is the first parameter, hWnd<br \/>\n*(ESP+8) is the second parameter, uMsg<\/p>\n<p>So, our condition basically amounts to uMsg == WM_KEYDOWN.<br \/>\nIf you want to break on sending a WM_KEYDOWN message to a specific window handle, you can set the condition like so:<br \/>\n<code>*(int*)(esp+4) == 0x<i>myhandlehere<\/i> && *(int*)(esp+8) == 0x100<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>CodeProject We have recently been fighting a weird problem in our .NET application that was caused by a duplicate WM_KEYDOWN message. It relatively is easy to figure out who receives <a href=\"https:\/\/ikriv.com\/blog\/?p=1631\" class=\"more-link\">[&hellip;]<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"Layout":"","footnotes":""},"categories":[7,4,18],"tags":[],"class_list":["entry","author-ikriv","post-1631","post","type-post","status-publish","format-standard","category-cpp","category-hack","category-win32"],"_links":{"self":[{"href":"https:\/\/ikriv.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1631","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ikriv.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ikriv.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ikriv.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ikriv.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1631"}],"version-history":[{"count":0,"href":"https:\/\/ikriv.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1631\/revisions"}],"wp:attachment":[{"href":"https:\/\/ikriv.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1631"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ikriv.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1631"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ikriv.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1631"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}