SHELL32!CNewMenu::InvokeCommand函数分析双机调试判断是否是check模式

sitelist

于 2025-07-15 17:42:47 发布

阅读量277

点赞数 5

CC 4.0 BY-SA版权

分类专栏： nt4源代码分析文章标签： InvokeCommand CNewMenu check

本文链接：https://blog.csdn.net/oldlinux/article/details/149361881

nt4源代码分析专栏收录该内容

276 篇文章

订阅专栏

0: kd> kc
#
00 SHELL32!CNewMenu::InvokeCommand
01 SHELL32!HDXA_LetHandlerProcessCommandEx
02 SHELL32!CDefFolderMenu::InvokeCommand
03 SHELL32!CContextMenuOnContextMenuArray::InvokeCommand
04 SHELL32!CDefView::_InvokeContextMenu
05 SHELL32!CDefView::_DoContextMenuPopup
06 SHELL32!CDefView::ContextMenu
07 SHELL32!CDefView::WndProc
08 SHELL32!CDefView::s_WndProc
09 USER32!InternalCallWinProc
0a USER32!UserCallWinProcCheckWow
0b USER32!DispatchClientMessage
0c USER32!__fnDWORD
0d ntdll!KiUserCallbackDispatcher
0e nt!KiCallUserMode
0f nt!KeUserModeCallback
10 win32k!SfnDWORD
11 win32k!xxxSendMessageToClient
12 win32k!xxxSendMessageTimeout
13 win32k!xxxSendMessage
14 win32k!xxxRealDefWindowProc
15 win32k!xxxWrapRealDefWindowProc
16 win32k!NtUserfnDWORD
17 win32k!NtUserMessageCall
18 nt!_KiSystemService
19 SharedUserData!SystemCallStub
1a ntdll!KiUserCallbackDispatcher
1b USER32!NtUserMessageCall
1c ntdll!RtlCaptureStackBackTrace
1d ntdll!RtlActivateActivationContextEx
1e USER32!VTagOutput
1f USER32!SendMessageW_wrapper
20 comctl32!SendMessageD
21 comctl32!ListView_HandleMouse
22 comctl32!ListView_OnButtonDown
23 comctl32!ListView_WndProc
24 USER32!InternalCallWinProc
25 USER32!UserCallWinProcCheckWow
26 USER32!DispatchMessageWorker
27 USER32!DispatchMessageW
28 BROWSEUI!TimedDispatchMessage
29 BROWSEUI!BrowserThreadProc
2a BROWSEUI!BrowserProtectedThreadProc
2b kernel32!BaseThreadStart
0: kd> kv
# ChildEBP RetAddr Args to Child
00 017be5d0 772f57e0 00113430 017be5ec 00116a38 SHELL32!CNewMenu::InvokeCommand (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\shell32\unicpp\sendto.cpp @ 1060]
01 017be630 772f6b7f 0010f1d0 017be650 00000000 SHELL32!HDXA_LetHandlerProcessCommandEx+0xa3 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\shell32\defcm.cpp @ 2341]
02 017beaf0 773e1c7b 00116a38 017bee84 20000000 SHELL32!CDefFolderMenu::InvokeCommand+0x191 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\shell32\defcm.cpp @ 1666]
03 017beb0c 773083bb 00112e48 017bee84 017beec4 SHELL32!CContextMenuOnContextMenuArray::InvokeCommand+0x42 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\shell32\contextmenu.cpp @ 314]
04 017bee38 7730d8a5 00112e48 017bee84 00000000 SHELL32!CDefView::_InvokeContextMenu+0xa2 (FPO: [Non-Fpo]) (CONV: thiscall) [d:\srv03rtm\shell\shell32\defview.cpp @ 1771]
05 017bf18c 77310724 00112e48 00000000 000000dc SHELL32!CDefView::_DoContextMenuPopup+0x3ba (FPO: [Non-Fpo]) (CONV: thiscall) [d:\srv03rtm\shell\shell32\defview.cpp @ 1495]
06 017bf1d8 773146f2 02bb00dc 00000000 00116c38 SHELL32!CDefView::ContextMenu+0x1e0 (FPO: [Non-Fpo]) (CONV: thiscall) [d:\srv03rtm\shell\shell32\defview.cpp @ 1615]
07 017bf394 77315392 000200da 0000007b 000100dc SHELL32!CDefView::WndProc+0x873 (FPO: [Non-Fpo]) (CONV: thiscall) [d:\srv03rtm\shell\shell32\defview.cpp @ 9711]
08 017bf3d8 77ce7ee3 000200da 0000007b 000100dc SHELL32!CDefView::s_WndProc+0x6a (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\shell32\defview.cpp @ 9389]
09 017bf404 77cf2bff 77315328 000200da 0000007b USER32!InternalCallWinProc+0x1b [d:\srv03rtm\windows\core\ntuser\client\i386\callproc.asm @ 102]
0a 017bf47c 77cbe5f7 0008574c 77315328 000200da USER32!UserCallWinProcCheckWow+0x151 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clmsg.c @ 165]
0b 017bf4d8 77cbe80c 0061102c 0000007b 000100dc USER32!DispatchClientMessage+0x166 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\client.c @ 3037]
0c 017bf500 77f5448f 017bf510 00000018 0061102c USER32!__fnDWORD+0x22 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\inc\ntcb.h @ 639]
0d 017bf500 80a3f168 017bf510 00000018 0061102c ntdll!KiUserCallbackDispatcher+0x13 (FPO: [0,0,0]) [d:\srv03rtm\base\ntos\rtl\i386\userdisp.asm @ 153]
0e f586ea54 80cc5b26 f586eb1c f586eb20 e1157bc8 nt!KiCallUserMode+0x4 (FPO: [2,3,4]) [d:\srv03rtm\base\ntos\ke\i386\callout.asm @ 109]
0f f586eaac bf807bfa 00000002 f586eafc 00000018 nt!KeUserModeCallback+0xc6 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ke\i386\callback.c @ 127]
10 f586eb44 bf8fa60b bc69102c 0000007b 000100dc win32k!SfnDWORD+0x121 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\inc\ntcb.h @ 618]
11 f586eb9c bf804176 0069102c 0000007b 000100dc win32k!xxxSendMessageToClient+0x151 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\sendmsg.c @ 839]
12 f586ebec bf80edea bc69102c 0000007b 000100dc win32k!xxxSendMessageTimeout+0x22d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\sendmsg.c @ 1039]
13 f586ec10 bf8f9c2e bc69102c 0000007b 000100dc win32k!xxxSendMessage+0x19 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\sendmsg.c @ 760]
14 f586eca8 bf8a1521 bc6922f4 0000007b 000100dc win32k!xxxRealDefWindowProc+0xc52 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\dwp.c @ 1951]
15 f586ecc0 bf807854 bc6922f4 0000007b 000100dc win32k!xxxWrapRealDefWindowProc+0x14 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\server.c @ 777]
16 f586ece8 bf89ea7f bc6922f4 0000007b 000100dc win32k!NtUserfnDWORD+0x9f (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\ntstubs.c @ 10395]
17 f586ed34 80afbcb2 bc6922f4 0000007b 000100dc win32k!NtUserMessageCall+0x132 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\ntstubs.c @ 10374]
18 f586ed34 7ffe0304 bc6922f4 0000007b 000100dc nt!_KiSystemService+0x13f (FPO: [0,3] TrapFrame @ f586ed64) (CONV: cdecl) [d:\srv03rtm\base\ntos\ke\i386\trap.asm @ 1328]
19 017bf500 77f5448f 017bf510 00000018 0061102c SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
1a 017bf524 77d20696 77cf3710 000100dc 0000007b ntdll!KiUserCallbackDispatcher+0x13 (FPO: [0,0,0]) [d:\srv03rtm\base\ntos\rtl\i386\userdisp.asm @ 153]
1b 017bf55c 77f6d3a9 77f4c5a0 77f4ccb3 77e71cf6 USER32!NtUserMessageCall+0xc (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\umode\daytona\obj\i386\usrstubs.c @ 3779]
1c 017bf660 77f4c5a0 0000000b 00000008 00104960 ntdll!RtlCaptureStackBackTrace+0x41 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\rtl\i386\getcalr.c @ 218]
1d 017bf698 77d2470f 017bf508 00000000 7ffaa000 ntdll!RtlActivateActivationContextEx+0xf8 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntdll\sxsctxact.c @ 434]
1e 017bf8b8 77cf1522 000100dc 0000007b 000100dc USER32!VTagOutput+0xf4 (FPO: [Non-Fpo]) (CONV: cdecl) [d:\srv03rtm\windows\core\rtl\debug.c @ 604]
1f 017bf8dc 6f62c6cb 000100dc 0000007b 000100dc USER32!SendMessageW_wrapper+0x54 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\cltxt.h @ 755]
20 017bf918 6f67dcfd 000100dc 0000007b 000100dc comctl32!SendMessageD+0x66 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\comctl32\v6\commctrl.c @ 442]
21 017bf998 6f67dd2e 000100dc 00000000 000000da comctl32!ListView_HandleMouse+0x58f (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\comctl32\v6\listview.c @ 8396]
22 017bf9b8 6f67e7b9 00117278 00000000 000000da comctl32!ListView_OnButtonDown+0x19 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\comctl32\v6\listview.c @ 8403]
23 017bfb74 77ce7ee3 000100dc 00000204 00000002 comctl32!ListView_WndProc+0x8c2 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\comctl32\v6\listview.c @ 4089]
24 017bfba0 77cf2bff 6f67def7 000100dc 00000204 USER32!InternalCallWinProc+0x1b [d:\srv03rtm\windows\core\ntuser\client\i386\callproc.asm @ 102]
25 017bfc18 77cbe3db 0008574c 6f67def7 000100dc USER32!UserCallWinProcCheckWow+0x151 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clmsg.c @ 165]
26 017bfc80 77cc4014 017bfcc0 00000000 017bfca8 USER32!DispatchMessageWorker+0x3e3 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clmsg.c @ 2497]
27 017bfc90 758a8c49 017bfcc0 00103b70 00008000 USER32!DispatchMessageW+0xd (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\cltxt.h @ 1046]
28 017bfca8 758b0ecc 017bfcc0 00000000 00000000 BROWSEUI!TimedDispatchMessage+0x31 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\browseui\shbrows2.cpp @ 9239]
29 017bff2c 758b103d 001040f0 00000000 00000000 BROWSEUI!BrowserThreadProc+0x3c2 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\browseui\shbrows2.cpp @ 9454]
2a 017bffb8 77e41be7 001040f0 00000000 00000000 BROWSEUI!BrowserProtectedThreadProc+0x5c (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\browseui\shbrows2.cpp @ 9541]
2b 017bffec 00000000 758b0fe1 001040f0 0000