一直想对消息机制感兴趣.doc

1、一直想对消息机制感兴趣用一个小对话框来看看代码#include stdafx.hLRESULT CALLBACKPwdWindow(HWND, UINT, WPARAM, LPARAM);int APIENTRY _tWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPTSTR lpCmdLine, int nCmdShow)MSG msg;WNDCLASSEX wcex;HWND hWnd = NULL;HWND hEdit = NULL;(void) memset( &wcex, 0x00, sizeof(WNDCLASSEX)

2、);wcex.cbSize= sizeof(WNDCLASSEX);wcex.style= CS_HREDRAW | CS_VREDRAW;wcex.lpfnWndProc= PwdWindow;wcex.hCursor= LoadCursor(NULL, IDC_ARROW);wcex.hbrBackground = (HBRUSH)(COLOR_WINDOW+2);wcex.lpszClassName = PWDWIN;RegisterClassEx(&wcex);hWnd = CreateWindow( PWDWIN, Type the password .,WS_OVERLAPPED,

3、 GetSystemMetrics(SM_CXSCREEN)/2-100, GetSystemMetrics(SM_CYSCREEN)/2-75, 200, 150,NULL, NULL, NULL, NULL);if (!hWnd)return 0;CreateWindow(BUTTON, OK, WS_CHILD | WS_VISIBLE | BS_TEXT, 10, 80, 70, 30, hWnd, (HMENU)10123, NULL, NULL);CreateWindow(BUTTON, Cancel, WS_CHILD | WS_VISIBLE | BS_TEXT, 110, 8

4、0, 70, 30, hWnd, (HMENU)10456, NULL, NULL);hEdit = CreateWindow(EDIT, NULL, WS_CHILD | WS_VISIBLE | WS_BORDER | ES_PASSWORD | ES_AUTOHSCROLL, 10, 20, 170, 25, hWnd, (HMENU)10789, NULL, NULL);ShowWindow(hWnd, SW_SHOW);UpdateWindow(hWnd);SetFocus(hEdit);while ( GetMessage(&msg, NULL, 0, 0) )TranslateM

5、essage(&msg);DispatchMessage(&msg);if ( (int)msg.wParam = 0 )exit(0);DestroyWindow(hWnd);return 0;LRESULT CALLBACK PwdWindow(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam) int wmId = -1;char pwd32;switch (message)case WM_COMMAND:wmId = LOWORD(wParam);switch (wmId)case 10123:(void) memset( pw

6、d, 0x00, sizeof(pwd) );GetWindowText( GetDlgItem(hWnd, 10789), pwd, 32 );if ( strcmp( pwd, 123456 ) )MessageBox( hWnd, Sorry! Wrong password., Password, MB_ICONERROR );else:MessageBoxA(hWnd, Right password., Password,MB_OK);break;case 10456:PostQuitMessage(0);break;default:break;break;default:return

7、 DefWindowProc(hWnd, message, wParam, lParam);return 0;GetMessage TranslateMessage DispatchMessage取数据放入 &msg取 &msg 进行一下处理取 &msg 发送给处理循环消息PwdWindow如图1Msg 结构为tagMSG00000000 hwnd00000004 message00000008 wParam0000000C lParam00000010 time00000014 pt0000001C tagMSGstruc ; (sizeof=0x1C)dd ?dd ?dd ?dd ?dd

8、?POINT ?ends; offset我们实际操作验证一下1）对 DispatchMessageA 下条件记录断点如图 2dispatchMessageA log F9log 窗口观察生成很多记录如下Log data地址消息77D196B8COND:77D196B8CALL 到 DispatchMessageA 来自 pwddlgmo.0042D858 pMsg = MSG(C0C1) wParam = 11 lParam = 1009EA77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = MSG(C0C

9、C) hw = 1B097C (CicMarshalWndMOKB) wParam = 0 lParam = 0 77D196B8 COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 103. Y =92.77D196B8COND:77D196B8CALL 到 DispatchMessageA 来自 pwddlgmo.0042D858 pMsg = WM_PAINT hw = 100AA8 ( Type

10、 the password .)77D196B8COND:77D196B8CALL 到 DispatchMessageA 来自 pwddlgmo.0042D858 pMsg = WM_PAINT hw = F0A0A (OK)77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_PAINT hw = F0A22 (Cancel)77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = MSG(C0C6) hw = 1B09

11、7C (CicMarshalWndMOKB) wParam = F8 lParam = 28 77D196B8 COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = MSG(C0C6) hw = 1B097C (CicMarshalWndMOKB) wParam = F8 lParam = 28 77D196B8 COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = MSG(C0C6) hw = 1B097C (CicMarshalWndMOKB) wPa

12、ram = F8 lParam = 28 77D196B8 COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 103. Y =91.77D196B8COND:77D196B8CALL 到 DispatchMessageA 来自 pwddlgmo.0042D858 pMsg = WM_PAINT hw = F0A94 (class=Edit)77D196B8COND:77D196B8 CALL 到 Di

13、spatchMessageA 来自 pwddlgmo.0042D858 pMsg = WM_TIMER hw = F0A60 (M) ID = 1 Callback = 077D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 102. Y =91.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM

14、_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 98. Y = 90.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 87. Y = 91.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw =

15、100AA8 ( Type the password .) Keys = 0 X = 83. Y = 91.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 82. Y = 91.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type th

16、e password .) Keys = 0 X = 81. Y = 91.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 68. Y = 12.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 66. Y = 12.77D196B8COND:77D

17、196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 64. Y = 12.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 63. Y = 12.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg =

18、WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 62. Y = 12.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 61. Y = 12.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 60. Y = 12.7

19、7D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 61. Y = 12.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 66. Y = 11.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.

20、0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 80. Y = 91.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 82. Y = 91.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = W

21、M_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 87. Y = 91.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 89. Y = 91.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw =

22、 100AA8 ( Type the password .) Keys = 0 X = 95. Y = 92.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 98. Y = 92.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type t

23、he password .) Keys = 0 X = 100. Y =92.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 103. Y =92.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) K

24、eys = 0 X = 105. Y =92.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 109. Y =92.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 2. Y = 12.77D196B8C

25、OND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 7. Y = 12.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 9. Y = 12.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.00

26、42D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 10. Y = 11.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 13. Y = 11.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel)

27、Keys = 0 X = 18. Y = 11.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 19. Y = 11.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 20. Y = 11.77D196B8COND:77D196B8C

28、ALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 21. Y = 11.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 22. Y = 11.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg

29、= WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 21. Y = 11.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 19. Y = 11.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X

30、= 13. Y = 13.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A22 (Cancel) Keys = 0 X = 2. Y = 14.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 103. Y =94.77D196B8COND:77D196

31、B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 94. Y = 94.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 88. Y = 94.77D196B8COND:77D196B8CALL到 Dispatch

32、MessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = 100AA8 ( Type the password .) Keys = 0 X = 83. Y = 94.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 68. Y = 14.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg =

33、WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 64. Y = 15.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 62. Y = 16.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 56. Y = 15.7

34、7D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 53. Y = 15.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 48. Y = 16.77D196B8COND:77D196B8CALL到 DispatchMessageA 来自pwddlgmo.

35、0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 47. Y = 16.77D196B8COND:77D196B8CALL到 DispatchMessageA来自 pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 46. Y = 16.77D196B8COND:77D196B8CALL到 DispatchMessageA来自 pwddlgmo.0042D858pMsg = WM_LBUTTONDOWN hw = F0A0A (OK) Keys = M

36、K_LBUTTON X = 46. Y = 16.77D196B8COND:77D196B8CALL到 DispatchMessageA来自 pwddlgmo.0042D858pMsg = MSG(C0C1) wParam = 11 lParam = F0A0A77D196B8COND:77D196B8CALL到 DispatchMessageA来自 pwddlgmo.0042D858pMsg = MSG(C0CC) hw = 1B097C (CicMarshalWndMOKB) wParam = 0 lParam = 077D196B8COND:77D196B8CALL到 DispatchM

37、essageA来自 pwddlgmo.0042D858pMsg = MSG(C0C6) hw = 1B097C (CicMarshalWndMOKB) wParam = F8 lParam = 2877D196B8COND:77D196B8CALL到 DispatchMessageA来自 pwddlgmo.0042D858pMsg = MSG(C0C6) hw = 1B097C (CicMarshalWndMOKB) wParam = F8 lParam = 2877D196B8COND:77D196B8CALL到 DispatchMessageA来自 pwddlgmo.0042D858pMs

38、g = MSG(C0C6) hw = 1B097C (CicMarshalWndMOKB) wParam = F8 lParam = 2877D196B8COND:77D196B8CALL到 DispatchMessageA来自 pwddlgmo.0042D858pMsg = WM_LBUTTONUP hw = F0A0A (OK) Keys = 0 X = 46. Y = 16.观察到77D196B8CALL到 DispatchMessageA来自 pwddlgmo.0042D858pMsg = MSG(C0C6) hw = 1B097C (CicMarshalWndMOKB) wParam

39、 = F877D196B8CALL到 DispatchMessageA来自 pwddlgmo.0042D858pMsg = WM_MOUSEMOVE hw = F0A0A (OK) Keys = 0 X = 46. Y = 16.77D196B8COND:77D196B8CALL到 DispatchMessageA来自 pwddlgmo.0042D858pMsg = WM_LBUTTONDOWN hw = F0A0A (OK) Keys = MK_LBUTTONLog data, 条目3消息 =pMsg = WM_LBUTTONUP hw = F0A0A (OK) Keys = 0 X = 5

40、1. Y = 17.0042D857|.50|push eax; /pMsg0042D858|.FF15 BC744900 |calldword ptr esp+4 指向 tagMSG放系统中受到的消息esp+4+4含义为 message 代码因此将表达式改为esp+4+4 再运行; DispatchMessageALog 中图 4上图的 00000202 是不是很眼熟啊对了，就是WM_LBUTTONUP2)最终改记录条件断点图 5结果如下图 6输入密码后按下ok 键断在 是 user32 领空77D196B8 8BFFmovedi, edi; ntdll.7C92E92077D196BA55

41、pushebp77D196BB8BECmovebp, esp77D196BD6A 01push177D196BFFF75 08pushdword ptr ebp+877D196C2E8 2AF2FFFFcall77D188F177D196C75Dpopebp77D196C8C2 0400retn4堆栈内容为0012FE500042D85E/CALL 到 DispatchMessageA 来自 pwddlgmo.0042D8580012FE540012FEDCpMsg = WM_LBUTTONUP hw = 120616 (OK) Keys = 0 X = 55. Y = 17.可以看到 Dis

42、patchMessageA 发送量 WM_LBUTTONUP ，句柄 hw = 120616 (OK)即 ok 按钮这个句柄值不固定，什么原因我就不说了。有兴趣可以看看msg 结构在内存中的情况怎么看呢0012FE540012FEDCpMsg = WM_LBUTTONUP hw = 120616 (OK) Keys = 0 X = 55. Y = 17.0012FEDC 即 msg 结构在内存中得首地址Dd 0012FEDC图 70012FEDC00120616- hwnd=1206160012FEE000000202- message=202= WM_LBUTTONUP0012FEE4000

43、00000 .- wParam0012FEE8001100377.- lParam0012FEEC01AEB9FD? - time0012FEF0000001E0?.- POINT4 要返回代码Alt+m 对 00400000 到 00498000 下 F2 再按 F9断在 42c2f2Jmp 42d8f00042D8F0即消息处理函数的后面我就不多说了0042D8F0/ 55pushebp; winmain0042D8F1|.8BECmovebp, esp0042D8F3|.83EC 6Csubesp, 6C0042D8F6|.A1 10304900moveax, dword ptr 493

44、0100042D8FB|.33C5xoreax, ebp0042D8FD|.8945 FCmovdword ptr ebp-4, eax0042D900|.53pushebx0042D901|.56pushesi0042D902|.57pushedi0042D903|.C745 F8 FFFFFmovdword ptr ebp-8, -10042D90A|.8B45 0Cmoveax, dword ptr ebp+C0042D90D|.8945 94movdword ptr ebp-6C, eax0042D910|.817D 94 11010cmpdword ptr ebp-6C, 11100

45、42D917|.74 05jeshort 0042D91E0042D919|.E9 AE000000jmp0042D9CC0042D91E|8B45 10moveax, dword ptr ebp+100042D921|.25 FFFF0000andeax, 0FFFF0042D926|.0FB7C8movzxecx, ax0042D929|.894D F8movdword ptr ebp-8, ecx0042D92C|.8B45 F8moveax, dword ptr ebp-80042D92F|.8945 94movdword ptr ebp-6C, eax0042D932|.817D 9

46、4 8B270cmpdword ptr ebp-6C, 278B0042D939|.74 0Ejeshort 0042D9490042D93B|.817D 94 D8280cmpdword ptr ebp-6C, 28D80042D942|.74 7Ejeshort 0042D9C20042D944|.E9 81000000jmp0042D9CA0042D949|6A 20push200042D94B|.6A 00push00042D94D|.8D45 D8leaeax, dword ptr ebp-280042D950|.50pusheax0042D951|.E8 F5DBFFFFcall0042B54B0042D956|.83C4 0Caddesp, 0C0042D959|.6A 20push20; /Count = 20 (32.)0042D95B|.8D45 D8leaeax, dword ptrebp-28; |0042D95E|.50pusheax; |Buffer0042D95F|.68 252A0000push2A25; |/ControlID = 2A25 (10789.)0042D964|.8B4D 08movecx, dword ptrebp+8; |0042D967|.51pushecx; |hWnd0042D96