'WINAPI' 태그의 글 목록

WINAPI +4

Loading..NtUserMessageCall 내부에서의 메세지 처리4
2010.02.23

뷰어로 보기
Loading..Windows Controls ( User Interface )
2009.02.21

뷰어로 보기
Loading..Windows Message Notifications
2009.02.18

뷰어로 보기
Loading..윈도우 스타일
2009.02.18

뷰어로 보기

NtUserMessageCall 내부에서의 메세지 처리

MYDN2010. 2. 23. 14:15

뷰어
댓글로
이전글
다음글

함수원형

__declspec(naked) LRESULT __stdcall NtUserMessageCall(

HWND hwnd,

UINT msg,

WPARAM wParam,

LPARAM lParam,

ULONG_PTR xParam,

DWORD xpfnProc,

BOOL bAnsi )

NtUserMessageCall 은… SendMessage 에 해당하는 시스템 서비스던가…? 기억력 감퇴;;

어찌되었든, NtUserMessageCall 에서의 메시지 처리는 xpfnProc 인자를 통해 이뤄집니다.

해당 인자는 Message를 처리해야 하는 win32k 의 처리 procedure 를 가리킵니다.

확인을 해보면,

가령 NtUserMessageCall 을 호출하는 RealDefWindowProcWorker 의 경우

.text:77D7AEB2 loc_77D7AEB2: ; CODE XREF: RealDefWindowProcWorker(x,x,x,x,x)-81C1j

.text:77D7AEB2 ; RealDefWindowProcWorker(x,x,x,x,x)+B2C9j ...

.text:77D7AEB2 push [ebp+lpMultiByteStr]

.text:77D7AEB5 push 2B0h // FNID_SENDMESSAGEEX

.text:77D7AEBA push 0

.text:77D7AEBC push 0

.text:77D7AEBE push [ebp+hMem]

.text:77D7AEC1 push 128h

.text:77D7AEC6

.text:77D7AEC6 loc_77D7AEC6: ; CODE XREF: RealDefWindowProcWorker(x,x,x,x,x)-81CAj

.text:77D7AEC6 ; RealDefWindowProcWorker(x,x,x,x,x)+3029Fj

.text:77D7AEC6 push ebx

.text:77D7AEC7 jmp loc_77D4C756

.text:77D4C756 loc_77D4C756: ; CODE XREF: RealDefWindowProcWorker(x,x,x,x,x)+2FE07j

.text:77D4C756 call ds:_gapfnScSendMessage ; NtUserMessageCall(x,x,x,x,x,x,x)

xpfnProc 에 0x2B0h 값

.text:77D4B2A5 loc_77D4B2A5: ; CODE XREF: RealDefWindowProcWorker(x,x,x,x,x)+38j

.text:77D4B2A5 cmp edi, 400h

.text:77D4B2AB push [ebp+lpMultiByteStr] ; int

.text:77D4B2AE push 29Eh // FNID_DEFWINDOWPROC

.text:77D4B2B3 push 0 ; int

.text:77D4B2B5 push [ebp+hMem] ; hMem

.text:77D4B2B8 push dword ptr [ebp+WideCharStr] ; int

.text:77D4B2BB push edi ; int

.text:77D4B2BC push eax ; int

.text:77D4B2BD jnb loc_77D7AB10

.text:77D4B2C3 xor ecx, ecx

.text:77D4B2C5 mov cl, ds:_MessageTable[edi]

.text:77D4B2CB and ecx, 3Fh ; int

.text:77D4B2CE call ds:_gapfnScSendMessage[ecx*4] ; NtUserMessageCall(x,x,x,x,x,x,x)

xpfnProc 에 0x29Eh 값

위의 두 부분에서 NtUserMessageCall 을 호출하고 있으며,

이때, NtUserMessageCall 에서는 이를 다음과 같이 처리합니다.

bf834b50 8b4d1c mov ecx,dword ptr [ebp+1Ch] // xpfnProc

bf834b53 83c106 add ecx,6

bf834b56 83e11f and ecx,1Fh

bf834b59 ff7518 push dword ptr [ebp+18h]

bf834b5c 50 push eax

bf834b5d ff7510 push dword ptr [ebp+10h]

bf834b60 ff750c push dword ptr [ebp+0Ch]

bf834b63 ff7508 push dword ptr [ebp+8]

bf834b66 a158859abf mov eax,dword ptr [win32k!gpsi (bf9a8558)]

bf834b6b ff54880c call dword ptr [eax+ecx*4+0Ch]

위의 어셈 코드에서, 호출되는 procedure 의 주소를 보면,

bc5d0650 00200031

bc5d0654 00000000

bc5d0658 00000155

bc5d065c bf90ade2 win32k!xxxWrapSBWnd16Proc

bc5d0660 bf80f420 win32k!xxxWrapRealDefWindowProc

bc5d0664 bf86a712 win32k!xxxWrapMenuWindowProc

bc5d0668 bf915448 win32k!xxxWrapDesktopWndProc

bc5d066c bf80f420 win32k!xxxWrapRealDefWindowProc >> (29E+6) & 1F

bc5d0670 bf80f420 win32k!xxxWrapRealDefWindowProc

bc5d0674 bf8cb6f2 win32k!xxxWrapSwitchWndProc

bc5d0678 bf942a7c win32k!xxxUnusedFunctionId

bc5d067c bf942a7c win32k!xxxUnusedFunctionId

bc5d0680 bf942a7c win32k!xxxUnusedFunctionId

bc5d0684 bf942a7c win32k!xxxUnusedFunctionId

bc5d0688 bf942a7c win32k!xxxUnusedFunctionId

bc5d068c bf942a7c win32k!xxxUnusedFunctionId

bc5d0690 bf942a7c win32k!xxxUnusedFunctionId

bc5d0694 bf942a7c win32k!xxxUnusedFunctionId

bc5d0698 bf942a7c win32k!xxxUnusedFunctionId

bc5d069c bf90b699 win32k!fnHkINLPCWPEXSTRUCT

bc5d06a0 bf92f155 win32k!fnHkINLPCWPRETEXSTRUCT

bc5d06a4 bf942a7c win32k!xxxUnusedFunctionId

bc5d06a8 bf942a7c win32k!xxxUnusedFunctionId

bc5d06ac bf942a7c win32k!xxxUnusedFunctionId

bc5d06b0 bf942a7c win32k!xxxUnusedFunctionId

bc5d06b4 bf831785 win32k!xxxWrapSendMessage >> (2B0+6) & 1F

bc5d06b8 bf8a003f win32k!xxxSendMessageFF

bc5d06bc bf82eedc win32k!xxxSendMessageEx

bc5d06c0 bf89ef23 win32k!xxxWrapCallWindowProc

bc5d06c4 bf8622d9 win32k!xxxWrapSendMessageBSM

bc5d06c8 bf942a7c win32k!xxxUnusedFunctionId

bc5d06cc bf942a7c win32k!xxxUnusedFunctionId

bc5d06d0 bf82f3dd win32k!xxxWrapSendNotifyMessage

bc5d06d4 bf82f461 win32k!xxxWrapSendMessageCallback

bc5d06d8 bf942a7c win32k!xxxUnusedFunctionId

bc5d06dc bf90a41b win32k!xxxSBWndProc

bc5d06e0 bf80d027 win32k!xxxDefWindowProc

bc5d06e4 bf865f56 win32k!xxxMenuWindowProc

bc5d06e8 bf87fac4 win32k!xxxDesktopWndProc

bc5d06ec bf80d027 win32k!xxxDefWindowProc

bc5d06f0 bf80d027 win32k!xxxDefWindowProc

위와 같이 메시지를 처리하는 실제 procedure 들의 주소가 담긴 테이블을 확인할 수 있으며,

RealDefWindowProcWorker 가 호출하는 0x2B0, 0x29E 인자에 대응하는 실제 procedure 를 찾을 수 있습니다.

다음은 xpfnProc에 대응하는 FNID 값입니다.

#define FNID_START 0x0000029A

#define FNID_WNDPROCSTART 0x0000029A

#define FNID_SCROLLBAR 0x0000029A // xxxSBWndProc;

#define FNID_ICONTITLE 0x0000029B // xxxDefWindowProc;

#define FNID_MENU 0x0000029C // xxxMenuWindowProc;

#define FNID_DESKTOP 0x0000029D // xxxDesktopWndProc;

#define FNID_DEFWINDOWPROC 0x0000029E // xxxDefWindowProc;

#define FNID_WNDPROCEND 0x0000029E // see PatchThreadWindows

#define FNID_CONTROLSTART 0x0000029F

#define FNID_BUTTON 0x0000029F // No server side proc

#define FNID_COMBOBOX 0x000002A0 // No server side proc

#define FNID_COMBOLISTBOX 0x000002A1 // No server side proc

#define FNID_DIALOG 0x000002A2 // No server side proc

#define FNID_EDIT 0x000002A3 // No server side proc

#define FNID_LISTBOX 0x000002A4 // No server side proc

#define FNID_MDICLIENT 0x000002A5 // No server side proc

#define FNID_STATIC 0x000002A6 // No server side proc

#define FNID_IME 0x000002A7 // No server side proc

#define FNID_CONTROLEND 0x000002A7

#define FNID_HKINLPCWPEXSTRUCT 0x000002A8

#define FNID_HKINLPCWPRETEXSTRUCT 0x000002A9

#define FNID_DEFFRAMEPROC 0x000002AA // No server side proc

#define FNID_DEFMDICHILDPROC 0x000002AB // No server side proc

#define FNID_MB_DLGPROC 0x000002AC // No server side proc

#define FNID_MDIACTIVATEDLGPROC 0x000002AD // No server side proc

#define FNID_SENDMESSAGE 0x000002AE

#define FNID_SENDMESSAGEFF 0x000002AF

#define FNID_SENDMESSAGEEX 0x000002B0

#define FNID_CALLWINDOWPROC 0x000002B1

#define FNID_SENDMESSAGEBSM 0x000002B2

#define FNID_SWITCH 0x000002B3 // Just used by GetTopMostInserAfter

#define FNID_TOOLTIP 0x000002B4

#define FNID_END 0x000002B4

Windows Controls ( User Interface )

MSDN2009. 2. 21. 13:41

뷰어
댓글로
이전글
다음글

http://msdn.microsoft.com/en-us/library/bb773173(VS.85).aspx

Windows Controls

A control is a child window that an application uses in conjunction with another window to enable user interaction. Controls are most often used within dialog boxes, but they can also be used in other windows. Controls within dialog boxes provide the user with a way to type text, choose options, and initiate actions. Controls in other windows provide a variety of services, such as letting the user choose commands, view status, and view and edit text.

The common controls overview documentation describes the common controls delivered in Microsoft Windows and the programming elements used to create and manipulate them.

The following table lists the Windows controls.

Control	Description
Animation	A window that displays an Audio-Video Interleaved (AVI) clip.
Button	Notifies the parent window when the user selects the control.
Combo Box	A combination of a list box and an edit control, enabling the user to select or add items.
ComboBoxEx	An extension of the combo box control that provides native support for item images.
Date and Time Picker	A simple and intuitive interface through which to exchange date and time information with a user.
Drag List Box	A type of list box that enables the user to drag items from one position to another.
Edit	A window within the user can view and edit text.
Flat Scroll Bar	A scroll bar with a more customizable appearance than standard scroll bars.
Header	A window that is usually positioned above columns of text or numbers. It contains a title for each column, and it can be divided into parts.
Hot Key	A window that enables the user to enter a combination of keystrokes to be used as a hot key.
Image Lists	A collection of images of the same size, each of which can be referred to by its index.
IP Address	A window in which the user can enter an Internet Protocol (IP) address in an easily understood format.
List Box	A simple list from which the user can select one or more items.
List-View	A list box that provides several ways to arrange and display the items.
Month Calendar	A calendar that enables the user to select a date or dates.
Pager	A set of arrow buttons that enable the contents of a control window to be scrolled.
Progress Bar	An animated control that indicates the progress of a lengthy operation.
Property Sheet	A dialog box that enables the user to view and edit the properties of an item. Pages may be viewed as tabs, or in succession as a wizard.
ReBar	A container for child windows. An application assigns child windows, which are often other controls, to a rebar control band.
Rich Edit	A window in which the user can view and edit text with character and paragraph formatting. It can also contain embedded COM objects.
Scroll Bar	A control that enables the user to choose the direction and distance to scroll information in a related window.
Static	Non-interactive text, including labels for other controls.
Status Bar	A horizontal window at the bottom of a parent window in which an application can display various kinds of status information.
SysLink	A hypertext link.
Tab	A selectable page, analogous to a divider in a notebook. By using a tab control, an application can define multiple pages for the same area of a window or dialog box.
Task Dialog	A more powerful alternative to simple message boxes, incorporating elements such as custom buttons, radio buttons, hyperlinks, and progress bars.
Toolbar	A window that contains one or more buttons and possibly other controls.
ToolTip	A message that appears automatically when the mouse pointer hovers over a tool.
Trackbar	A slider with optional tick marks, used to set a value within a range.
Tree-View	A hierarchical list of items, such as the headings in a document or the files and directories on a disk.
Up-Down	A pair of arrow buttons that the user can click to increment or decrement a value, such as a scroll position or a number displayed in a companion control.

Windows Message Notifications

MSDN2009. 2. 18. 15:29

뷰어
댓글로
이전글
다음글

http://msdn.microsoft.com/en-us/library/ms632595(VS.85).aspx

WM_ACTIVATEAPP

The WM_ACTIVATEAPP message is sent when a window belonging to a different application than the active window is about to be activated. The message is sent to the application whose window is being activated and to the application whose window is being deactivated.