windows消息从User32 内核出来之后逆向过程

最新推荐文章于 2023-03-18 23:49:54 发布
最新推荐文章于 2023-03-18 23:49:54 发布
阅读量2.5k 收藏 1
点赞数
分类专栏： MFC 逆向工程
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/jiangdf/article/details/9004410
版权

消息从User32 内核出来之后，应该是由Windows 系统自动发往各个窗口的消息处理函数，但这里
怎么会全部进入了AfxWndProc()函数

USER32 内核 -> AfxWndProcBase -> AfxWndProc -> AfxCallWndProc -> CWnd::WindowProc ->
CWnd::OnWndMsg -> CWnd::OnCommand -> CDialog::OnCmdMsg -> CCmdTarget::OnCmdMsg -> _AfxDispatchCmdMsg ->
CD1Dlg::OnButton1()

LRESULT CALLBACK
AfxWndProcBase(HWND hWnd, UINT nMsg, WPARAM wParam, LPARAM lParam)
{
AFX_MANAGE_STATE(_afxBaseModuleState.GetData());
return AfxWndProc(hWnd, nMsg, wParam, lParam);
}

AfxWndProcBase 汇编代码：

73DC8444 >/$  B8 F9EEDC73   MOV EAX,MFC42.73DCEEF9
73DC8449  |.  E8 2AA8FFFF   CALL MFC42.73DC2C78
73DC844E  |.  51            PUSH ECX
73DC844F  |.  51            PUSH ECX
73DC8450  |.  68 3B9FDC73   PUSH MFC42.#2188_?CreateObject@?$CProcessLocal@V_AFX_BASE_MODULE_STAT>
73DC8455  |.  B9 10E6E073   MOV ECX,MFC42.73E0E610
73DC845A  |.  E8 A2FEFFFF   CALL MFC42.#3028_?GetData@CProcessLocalObject@@QAEPAVCNoTrackObject@@>
73DC845F  |.  50            PUSH EAX
73DC8460  |.  8D4D EC       LEA ECX,DWORD PTR SS:[EBP-14]
73DC8463  |.  E8 AEFFFFFF   CALL MFC42.#6467_??0AFX_MAINTAIN_STATE2@@QAE@PAVAFX_MODULE_STATE@@@Z
73DC8468  |.  FF75 14       PUSH DWORD PTR SS:[EBP+14]
73DC846B  |.  8365 FC 00    AND DWORD PTR SS:[EBP-4],0
73DC846F  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]
73DC8472  |.  FF75 0C       PUSH DWORD PTR SS:[EBP+C]
73DC8475  |.  FF75 08       PUSH DWORD PTR SS:[EBP+8]
73DC8478  |.  E8 A595F6FF   CALL MFC42.#1578_?AfxWndProc@@YGJPAUHWND__@@IIJ@Z
73DC847D  |.  8B4D F0       MOV ECX,DWORD PTR SS:[EBP-10]
73DC8480  |.  8B55 EC       MOV EDX,DWORD PTR SS:[EBP-14]
73DC8483  |.  8951 04       MOV DWORD PTR DS:[ECX+4],EDX
73DC8486  |.  8B4D F4       MOV ECX,DWORD PTR SS:[EBP-C]
73DC8489  |.  64:890D 00000>MOV DWORD PTR FS:[0],ECX
73DC8490  |.  C9            LEAVE
73DC8491  \.  C2 1000       RETN 10

LRESULT CALLBACK
AfxWndProc(HWND hWnd, UINT nMsg, WPARAM wParam, LPARAM lParam)
{
// special message which identifies the window as using AfxWndProc
if (nMsg == WM_QUERYAFXWNDPROC)
return 1;


// all other messages route through message map
CWnd* pWnd = CWnd::FromHandlePermanent(hWnd);
ASSERT(pWnd != NULL);
ASSERT(pWnd->m_hWnd == hWnd);
return AfxCallWndProc(pWnd, hWnd, nMsg, wParam, lParam);
}


AfxWndProc反汇编代码：

73D31A22 >/$  8BFF          MOV EDI,EDI
73D31A24  |.  55            PUSH EBP
73D31A25  |.  8BEC          MOV EBP,ESP
73D31A27  |.  817D 0C 60030>CMP DWORD PTR SS:[EBP+C],360
73D31A2E  |.  75 05         JNZ SHORT MFC42.73D31A35
73D31A30  |.  33C0          XOR EAX,EAX
73D31A32  |.  40            INC EAX
73D31A33  |.  EB 36         JMP SHORT MFC42.73D31A6B
73D31A35  |>  56            PUSH ESI
73D31A36  |.  8B75 08       MOV ESI,DWORD PTR SS:[EBP+8]
73D31A39  |.  56            PUSH ESI
73D31A3A  |.  E8 C3F7FFFF   CALL MFC42.#2867_?FromHandlePermanent@CWnd@@SGPAV1@PAUHWND__@@@Z
73D31A3F  |.  85C0          TEST EAX,EAX
73D31A41  |.  74 17         JE SHORT MFC42.73D31A5A
73D31A43  |.  3970 20       CMP DWORD PTR DS:[EAX+20],ESI
73D31A46  |.  75 12         JNZ SHORT MFC42.73D31A5A
73D31A48  |.  FF75 14       PUSH DWORD PTR SS:[EBP+14]
73D31A4B  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]
73D31A4E  |.  FF75 0C       PUSH DWORD PTR SS:[EBP+C]
73D31A51  |.  56            PUSH ESI
73D31A52  |.  50            PUSH EAX
73D31A53  |.  E8 1C000000   CALL MFC42.#1109_?AfxCallWndProc@@YGJPAVCWnd@@PAUHWND__@@IIJ@Z
73D31A58  |.  EB 10         JMP SHORT MFC42.73D31A6A
73D31A5A  |>  FF75 14       PUSH DWORD PTR SS:[EBP+14]                                            ; /lParam
73D31A5D  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]                                            ; |wParam
73D31A60  |.  FF75 0C       PUSH DWORD PTR SS:[EBP+C]                                             ; |Message
73D31A63  |.  56            PUSH ESI                                                              ; |hWnd
73D31A64  |.  FF15 6C65DD73 CALL DWORD PTR DS:[<&USER32.DefWindowProcA>]                          ; \假定的 WinProc
73D31A6A  |>  5E            POP ESI
73D31A6B  |>  5D            POP EBP
73D31A6C  \.  C2 1000       RETN 10

LRESULT AFXAPI AfxCallWndProc(CWnd* pWnd, HWND hWnd, UINT nMsg,
WPARAM wParam = 0, LPARAM lParam = 0)
{
_AFX_THREAD_STATE* pThreadState = _afxThreadState.GetData();
MSG oldState = pThreadState->m_lastSentMsg;   // save for nesting
pThreadState->m_lastSentMsg.hwnd = hWnd;
pThreadState->m_lastSentMsg.message = nMsg;
pThreadState->m_lastSentMsg.wParam = wParam;
pThreadState->m_lastSentMsg.lParam = lParam;


#ifdef _DEBUG
if (afxTraceFlags & traceWinMsg)
_AfxTraceMsg(_T("WndProc"), &pThreadState->m_lastSentMsg);
#endif


// Catch exceptions thrown outside the scope of a callback
// in debug builds and warn the user.
LRESULT lResult;
TRY
{
#ifndef _AFX_NO_OCC_SUPPORT
// special case for WM_DESTROY
if ((nMsg == WM_DESTROY) && (pWnd->m_pCtrlCont != NULL))
pWnd->m_pCtrlCont->OnUIActivate(NULL);
#endif


// special case for WM_INITDIALOG
CRect rectOld;
DWORD dwStyle = 0;
if (nMsg == WM_INITDIALOG)
_AfxPreInitDialog(pWnd, &rectOld, &dwStyle);


// delegate to object's WindowProc
lResult = pWnd->WindowProc(nMsg, wParam, lParam);


// more special case for WM_INITDIALOG
if (nMsg == WM_INITDIALOG)
_AfxPostInitDialog(pWnd, rectOld, dwStyle);
}
CATCH_ALL(e)
{
lResult = AfxGetThread()->ProcessWndProcException(e, &pThreadState->m_lastSentMsg);
TRACE1("Warning: Uncaught exception in WindowProc (returning %ld).\n",
lResult);
DELETE_EXCEPTION(e);
}
END_CATCH_ALL


pThreadState->m_lastSentMsg = oldState;
return lResult;
}

AfxCallWndProc的反汇编代码:

73D31A74 > $  B8 A4EFDC73   MOV EAX,MFC42.73DCEFA4
73D31A79   .  E8 FA110900   CALL MFC42.73DC2C78
73D31A7E   .  83EC 34       SUB ESP,34
73D31A81   .  53            PUSH EBX
73D31A82   .  56            PUSH ESI
73D31A83   .  57            PUSH EDI
73D31A84   .  8965 F0       MOV DWORD PTR SS:[EBP-10],ESP
73D31A87   .  68 DB88DC73   PUSH MFC42.#2202_?CreateObject@?$CThreadLocal@V_AFX_THREAD_STATE@@@@S>
73D31A8C   .  B9 0CE6E073   MOV ECX,MFC42.73E0E60C
73D31A91   .  E8 DF670900   CALL MFC42.#3030_?GetData@CThreadLocalObject@@QAEPAVCNoTrackObject@@P>
73D31A96   .  8BD8          MOV EBX,EAX
73D31A98   .  8D43 34       LEA EAX,DWORD PTR DS:[EBX+34]
73D31A9B   .  8BF0          MOV ESI,EAX
73D31A9D   .  6A 07         PUSH 7
73D31A9F   .  59            POP ECX
73D31AA0   .  8D7D C0       LEA EDI,DWORD PTR SS:[EBP-40]
73D31AA3   .  F3:A5         REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
73D31AA5   .  8B4D 0C       MOV ECX,DWORD PTR SS:[EBP+C]
73D31AA8   .  8B75 10       MOV ESI,DWORD PTR SS:[EBP+10]
73D31AAB   .  8B7D 08       MOV EDI,DWORD PTR SS:[EBP+8]
73D31AAE   .  8908          MOV DWORD PTR DS:[EAX],ECX
73D31AB0   .  8B45 14       MOV EAX,DWORD PTR SS:[EBP+14]
73D31AB3   .  8943 3C       MOV DWORD PTR DS:[EBX+3C],EAX
73D31AB6   .  8B45 18       MOV EAX,DWORD PTR SS:[EBP+18]
73D31AB9   .  8943 40       MOV DWORD PTR DS:[EBX+40],EAX
73D31ABC   .  33C0          XOR EAX,EAX
73D31ABE   .  83FE 02       CMP ESI,2
73D31AC1   .  895D EC       MOV DWORD PTR SS:[EBP-14],EBX
73D31AC4   .  8973 38       MOV DWORD PTR DS:[EBX+38],ESI
73D31AC7   .  8945 FC       MOV DWORD PTR SS:[EBP-4],EAX
73D31ACA   .  75 0E         JNZ SHORT MFC42.73D31ADA
73D31ACC   .  3947 38       CMP DWORD PTR DS:[EDI+38],EAX
73D31ACF   .  74 09         JE SHORT MFC42.73D31ADA
73D31AD1   .  8B4F 38       MOV ECX,DWORD PTR DS:[EDI+38]
73D31AD4   .  8B11          MOV EDX,DWORD PTR DS:[ECX]
73D31AD6   .  50            PUSH EAX
73D31AD7   .  FF52 64       CALL DWORD PTR DS:[EDX+64]
73D31ADA   >  8365 0C 00    AND DWORD PTR SS:[EBP+C],0
73D31ADE   .  81FE 10010000 CMP ESI,110
73D31AE4   .  75 0E         JNZ SHORT MFC42.73D31AF4
73D31AE6   .  8D45 0C       LEA EAX,DWORD PTR SS:[EBP+C]
73D31AE9   .  50            PUSH EAX
73D31AEA   .  8D45 DC       LEA EAX,DWORD PTR SS:[EBP-24]
73D31AED   .  50            PUSH EAX
73D31AEE   .  57            PUSH EDI
73D31AEF   .  E8 51880100   CALL MFC42.73D4A345
73D31AF4   >  FF75 18       PUSH DWORD PTR SS:[EBP+18]
73D31AF7   .  8B07          MOV EAX,DWORD PTR DS:[EDI]
73D31AF9   .  FF75 14       PUSH DWORD PTR SS:[EBP+14]
73D31AFC   .  8BCF          MOV ECX,EDI
73D31AFE   .  56            PUSH ESI
73D31AFF   .  FF90 A0000000 CALL DWORD PTR DS:[EAX+A0]      ;  <JMP.&MFC42.#6374_?WindowProc@CWnd@@MAEJIIJ@Z>
73D31B05   .  81FE 10010000 CMP ESI,110
73D31B0B   .  8945 08       MOV DWORD PTR SS:[EBP+8],EAX
73D31B0E   .  75 43         JNZ SHORT MFC42.73D31B53
73D31B10   .  FF75 0C       PUSH DWORD PTR SS:[EBP+C]
73D31B13   .  8D45 DC       LEA EAX,DWORD PTR SS:[EBP-24]
73D31B16   .  50            PUSH EAX
73D31B17   .  57            PUSH EDI
73D31B18   .  E8 52880100   CALL MFC42.73D4A36F
73D31B1D   .  EB 34         JMP SHORT MFC42.73D31B53
73D31B1F   .  E8 E1F4FFFF   CALL MFC42.#1175_?AfxGetThread@@YGPAVCWinThread@@XZ
73D31B24   .  85C0          TEST EAX,EAX
73D31B26   .  74 16         JE SHORT MFC42.73D31B3E
73D31B28   .  8B4D EC       MOV ECX,DWORD PTR SS:[EBP-14]
73D31B2B   .  8B10          MOV EDX,DWORD PTR DS:[EAX]
73D31B2D   .  83C1 34       ADD ECX,34
73D31B30   .  51            PUSH ECX
73D31B31   .  FF75 10       PUSH DWORD PTR SS:[EBP+10]
73D31B34   .  8BC8          MOV ECX,EAX
73D31B36   .  FF52 74       CALL DWORD PTR DS:[EDX+74]
73D31B39   .  8945 08       MOV DWORD PTR SS:[EBP+8],EAX
73D31B3C   .  EB 04         JMP SHORT MFC42.73D31B42
73D31B3E   >  8365 08 00    AND DWORD PTR SS:[EBP+8],0
73D31B42   >  8B4D 10       MOV ECX,DWORD PTR SS:[EBP+10]
73D31B45   .  E8 69A70500   CALL MFC42.#2393_?Delete@CException@@QAEXXZ
73D31B4A   .  B8 501BD373   MOV EAX,MFC42.73D31B50
73D31B4F   .  C3            RETN
73D31B50   .  8B5D EC       MOV EBX,DWORD PTR SS:[EBP-14]
73D31B53   >  8B45 08       MOV EAX,DWORD PTR SS:[EBP+8]
73D31B56   .  6A 07         PUSH 7
73D31B58   .  59            POP ECX
73D31B59   .  8D7B 34       LEA EDI,DWORD PTR DS:[EBX+34]
73D31B5C   .  8D75 C0       LEA ESI,DWORD PTR SS:[EBP-40]
73D31B5F   .  F3:A5         REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
73D31B61   .  8B4D F4       MOV ECX,DWORD PTR SS:[EBP-C]
73D31B64   .  5F            POP EDI
73D31B65   .  5E            POP ESI
73D31B66   .  64:890D 00000>MOV DWORD PTR FS:[0],ECX
73D31B6D   .  5B            POP EBX
73D31B6E   .  C9            LEAVE
73D31B6F   .  C2 1400       RETN 14

/

LRESULT CWnd::WindowProc(UINT message, WPARAM wParam, LPARAM lParam)
{
// OnWndMsg does most of the work, except for DefWindowProc call
LRESULT lResult = 0;
if (!OnWndMsg(message, wParam, lParam, &lResult))
lResult = DefWindowProc(message, wParam, lParam);
return lResult;
}

WindowProc反汇编代码：

73D31B77 >/$  8BFF          MOV EDI,EDI
73D31B79  |.  55            PUSH EBP
73D31B7A  |.  8BEC          MOV EBP,ESP
73D31B7C  |.  51            PUSH ECX
73D31B7D  |.  8365 FC 00    AND DWORD PTR SS:[EBP-4],0
73D31B81  |.  56            PUSH ESI
73D31B82  |.  8BF1          MOV ESI,ECX
73D31B84  |.  8B06          MOV EAX,DWORD PTR DS:[ESI]
73D31B86  |.  8D4D FC       LEA ECX,DWORD PTR SS:[EBP-4]
73D31B89  |.  51            PUSH ECX
73D31B8A  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]
73D31B8D  |.  8BCE          MOV ECX,ESI
73D31B8F  |.  FF75 0C       PUSH DWORD PTR SS:[EBP+C]
73D31B92  |.  FF75 08       PUSH DWORD PTR SS:[EBP+8]
73D31B95  |.  FF90 A4000000 CALL DWORD PTR DS:[EAX+A4]     ; <JMP.&MFC42.#5163_?OnWndMsg@CWnd@@MAEHIIJPAJ@Z>
73D31B9B  |.  85C0          TEST EAX,EAX
73D31B9D  |.  75 16         JNZ SHORT MFC42.73D31BB5
73D31B9F  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]
73D31BA2  |.  8B06          MOV EAX,DWORD PTR DS:[ESI]
73D31BA4  |.  FF75 0C       PUSH DWORD PTR SS:[EBP+C]
73D31BA7  |.  8BCE          MOV ECX,ESI
73D31BA9  |.  FF75 08       PUSH DWORD PTR SS:[EBP+8]
73D31BAC  |.  FF90 A8000000 CALL DWORD PTR DS:[EAX+A8]     ; <JMP.&MFC42.#2385_?DefWindowProcA@CWnd@@MAEJIIJ@Z>
73D31BB2  |.  8945 FC       MOV DWORD PTR SS:[EBP-4],EAX
73D31BB5  |>  8B45 FC       MOV EAX,DWORD PTR SS:[EBP-4]
73D31BB8  |.  5E            POP ESI
73D31BB9  |.  C9            LEAVE
73D31BBA  \.  C2 0C00       RETN 0C

/

BOOL CWnd::OnWndMsg(UINT message, WPARAM wParam, LPARAM lParam, LRESULT* pResult)
{
LRESULT lResult = 0;


// special case for commands
if (message == WM_COMMAND)
{
if (OnCommand(wParam, lParam))
{
lResult = 1;
goto LReturnTrue;
}
return FALSE;
}


// special case for notifies
if (message == WM_NOTIFY)
{
NMHDR* pNMHDR = (NMHDR*)lParam;
if (pNMHDR->hwndFrom != NULL && OnNotify(wParam, lParam, &lResult))
goto LReturnTrue;
return FALSE;
}

................

}


CWnd::OnWndMsg的部分汇编代码：

73D31BC2 >/$  B8 F1EFDC73   MOV EAX,MFC42.73DCEFF1
73D31BC7  |.  E8 AC100900   CALL MFC42.73DC2C78
73D31BCC  |.  83EC 58       SUB ESP,58
73D31BCF  |.  8365 F0 00    AND DWORD PTR SS:[EBP-10],0
73D31BD3  |.  53            PUSH EBX
73D31BD4  |.  8B5D 08       MOV EBX,DWORD PTR SS:[EBP+8]
73D31BD7  |.  81FB 11010000 CMP EBX,111                                                           ;  Switch (cases 6..111)
73D31BDD  |.  56            PUSH ESI
73D31BDE  |.  57            PUSH EDI
73D31BDF  |.  8BF9          MOV EDI,ECX
73D31BE1  |.  75 1B         JNZ SHORT MFC42.73D31BFE
73D31BE3  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]                                            ;  Case 111 (WM_COMMAND) of switch 73D31BD7
73D31BE6  |.  8B07          MOV EAX,DWORD PTR DS:[EDI]
73D31BE8  |.  FF75 0C       PUSH DWORD PTR SS:[EBP+C]
73D31BEB  |.  FF90 80000000 CALL DWORD PTR DS:[EAX+80]
73D31BF1  |.  85C0          TEST EAX,EAX
73D31BF3  |.  0F84 CA000000 JE MFC42.73D31CC3
73D31BF9  |.  E9 04040000   JMP MFC42.73D32002
73D31BFE  |>  83FB 4E       CMP EBX,4E
73D31C01  |.  75 23         JNZ SHORT MFC42.73D31C26
73D31C03  |.  8B45 10       MOV EAX,DWORD PTR SS:[EBP+10]                                         ;  Case 4E (WM_NOTIFY) of switch 73D31BD7
73D31C06  |.  8338 00       CMP DWORD PTR DS:[EAX],0
73D31C09  |.  0F84 B4000000 JE MFC42.73D31CC3
73D31C0F  |.  8B17          MOV EDX,DWORD PTR DS:[EDI]
73D31C11  |.  8D4D F0       LEA ECX,DWORD PTR SS:[EBP-10]
73D31C14  |.  51            PUSH ECX
73D31C15  |.  50            PUSH EAX
73D31C16  |.  FF75 0C       PUSH DWORD PTR SS:[EBP+C]
73D31C19  |.  8BCF          MOV ECX,EDI
73D31C1B  |.  FF92 84000000 CALL DWORD PTR DS:[EDX+84]


 /

BOOL CWnd::OnCommand(WPARAM wParam, LPARAM lParam)
// return TRUE if command invocation was attempted
{
UINT nID = LOWORD(wParam);
HWND hWndCtrl = (HWND)lParam;
int nCode = HIWORD(wParam);


// default routing for command messages (through closure table)


if (hWndCtrl == NULL)
{
// zero IDs for normal commands are not allowed
if (nID == 0)
return FALSE;


// make sure command has not become disabled before routing
CTestCmdUI state;
state.m_nID = nID;
OnCmdMsg(nID, CN_UPDATE_COMMAND_UI, &state, NULL);
if (!state.m_bEnabled)
{
TRACE1("Warning: not executing disabled command %d\n", nID);
return TRUE;
}


// menu or accelerator
nCode = CN_COMMAND;
}
else
{
// control notification
ASSERT(nID == 0 || ::IsWindow(hWndCtrl));


if (_afxThreadState->m_hLockoutNotifyWindow == m_hWnd)
return TRUE;        // locked out - ignore control notification


// reflect notification to child window control
if (ReflectLastMsg(hWndCtrl))
return TRUE;    // eaten by child


// zero IDs for normal commands are not allowed
if (nID == 0)
return FALSE;
}


#ifdef _DEBUG
if (nCode < 0 && nCode != (int)0x8000)
TRACE1("Implementation Warning: control notification = $%X.\n",
nCode);
#endif


return OnCmdMsg(nID, nCode, NULL, NULL);
}


OnCommand汇编代码：

73D331F1 >/$  8BFF          MOV EDI,EDI
73D331F3  |.  55            PUSH EBP
73D331F4  |.  8BEC          MOV EBP,ESP
73D331F6  |.  83EC 2C       SUB ESP,2C
73D331F9  |.  8B45 08       MOV EAX,DWORD PTR SS:[EBP+8]
73D331FC  |.  53            PUSH EBX
73D331FD  |.  56            PUSH ESI
73D331FE  |.  57            PUSH EDI
73D331FF  |.  0FB7F8        MOVZX EDI,AX
73D33202  |.  C1E8 10       SHR EAX,10
73D33205  |.  33DB          XOR EBX,EBX
73D33207  |.  395D 0C       CMP DWORD PTR SS:[EBP+C],EBX
73D3320A  |.  8BF1          MOV ESI,ECX
73D3320C  |.  8945 08       MOV DWORD PTR SS:[EBP+8],EAX
73D3320F  |.  75 3A         JNZ SHORT MFC42.73D3324B
73D33211  |.  3BFB          CMP EDI,EBX
73D33213  |.  74 66         JE SHORT MFC42.73D3327B
73D33215  |.  8D4D D4       LEA ECX,DWORD PTR SS:[EBP-2C]
73D33218  |.  E8 DE2A0000   CALL MFC42.#545_??0CTestCmdUI@@QAE@XZ
73D3321D  |.  8B06          MOV EAX,DWORD PTR DS:[ESI]
73D3321F  |.  53            PUSH EBX
73D33220  |.  8D4D D4       LEA ECX,DWORD PTR SS:[EBP-2C]
73D33223  |.  51            PUSH ECX
73D33224  |.  6A FF         PUSH -1
73D33226  |.  57            PUSH EDI
73D33227  |.  8BCE          MOV ECX,ESI
73D33229  |.  897D D8       MOV DWORD PTR SS:[EBP-28],EDI
73D3322C  |.  FF50 14       CALL DWORD PTR DS:[EAX+14]
73D3322F  |.  395D FC       CMP DWORD PTR SS:[EBP-4],EBX
73D33232  |.  74 3E         JE SHORT MFC42.73D33272
73D33234  |.  895D 08       MOV DWORD PTR SS:[EBP+8],EBX
73D33237  |>  8B06          MOV EAX,DWORD PTR DS:[ESI]
73D33239  |.  53            PUSH EBX
73D3323A  |.  53            PUSH EBX
73D3323B  |.  FF75 08       PUSH DWORD PTR SS:[EBP+8]
73D3323E  |.  8BCE          MOV ECX,ESI
73D33240  |.  57            PUSH EDI
73D33241  |.  FF50 14       CALL DWORD PTR DS:[EAX+14]      ;  <JMP.&MFC42.#4425_?OnCmdMsg@CDialog@@UAEHIHPAXPAUAFX_CMDHANDLERINFO@@@Z>
73D33244  |>  5F            POP EDI
73D33245  |.  5E            POP ESI
73D33246  |.  5B            POP EBX
73D33247  |.  C9            LEAVE
73D33248  |.  C2 0800       RETN 8

///


 BOOL CDialog::OnCmdMsg(UINT nID, int nCode, void* pExtra,
AFX_CMDHANDLERINFO* pHandlerInfo)
{
if (CWnd::OnCmdMsg(nID, nCode, pExtra, pHandlerInfo))
return TRUE;


if ((nCode != CN_COMMAND && nCode != CN_UPDATE_COMMAND_UI) ||
!IS_COMMAND_ID(nID) || nID >= 0xf000)
{
// control notification or non-command button or system command
return FALSE;       // not routed any further
}


// if we have an owner window, give it second crack
CWnd* pOwner = GetParent();
if (pOwner != NULL)
{
#ifdef _DEBUG
if (afxTraceFlags & traceCmdRouting)
TRACE1("Routing command id 0x%04X to owner window.\n", nID);
#endif
ASSERT(pOwner != this);
if (pOwner->OnCmdMsg(nID, nCode, pExtra, pHandlerInfo))
return TRUE;
}


// last crack goes to the current CWinThread object
CWinThread* pThread = AfxGetThread();
if (pThread != NULL)
{
#ifdef _DEBUG
if (afxTraceFlags & traceCmdRouting)
TRACE1("Routing command id 0x%04X to app.\n", nID);
#endif
if (pThread->OnCmdMsg(nID, nCode, pExtra, pHandlerInfo))
return TRUE;
}


#ifdef _DEBUG
if (afxTraceFlags & traceCmdRouting)
{
TRACE2("IGNORING command id 0x%04X sent to %hs dialog.\n", nID,
GetRuntimeClass()->m_lpszClassName);
}
#endif
return FALSE;
}


CDialog::OnCmdMsg汇编代码：

73D9DE90 >    8BFF          MOV EDI,EDI
73D9DE92  /.  55            PUSH EBP
73D9DE93  |.  8BEC          MOV EBP,ESP
73D9DE95  |.  53            PUSH EBX
73D9DE96  |.  8B5D 08       MOV EBX,DWORD PTR SS:[EBP+8]
73D9DE99  |.  56            PUSH ESI
73D9DE9A  |.  57            PUSH EDI
73D9DE9B  |.  FF75 14       PUSH DWORD PTR SS:[EBP+14]
73D9DE9E  |.  8B7D 0C       MOV EDI,DWORD PTR SS:[EBP+C]
73D9DEA1  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]
73D9DEA4  |.  8BF1          MOV ESI,ECX
73D9DEA6  |.  57            PUSH EDI
73D9DEA7  |.  53            PUSH EBX
73D9DEA8  |.  E8 0844F9FF   CALL MFC42.#4424_?OnCmdMsg@CCmdTarget@@UAEHIHPAXPAUAFX_CMDHANDLERINFO@@@Z
73D9DEAD  |.  85C0          TEST EAX,EAX
73D9DEAF  |.  75 57         JNZ SHORT MFC42.73D9DF08
73D9DEB1  |.  85FF          TEST EDI,EDI
73D9DEB3  |.  74 05         JE SHORT MFC42.73D9DEBA
73D9DEB5  |.  83FF FF       CMP EDI,-1
73D9DEB8  |.  75 53         JNZ SHORT MFC42.73D9DF0D
73D9DEBA  |>  84FF          TEST BH,BH
73D9DEBC  |.  79 4F         JNS SHORT MFC42.73D9DF0D
73D9DEBE  |.  81FB 00F00000 CMP EBX,0F000
73D9DEC4  |.  73 47         JNB SHORT MFC42.73D9DF0D
73D9DEC6  |.  FF76 20       PUSH DWORD PTR DS:[ESI+20]                                                                    ; /hWnd
73D9DEC9  |.  FF15 A865DD73 CALL DWORD PTR DS:[<&USER32.GetParent>]                                                       ; \GetParent
73D9DECF  |.  50            PUSH EAX
73D9DED0  |.  E8 4A31F9FF   CALL MFC42.#2864_?FromHandle@CWnd@@SGPAV1@PAUHWND__@@@Z
73D9DED5  |.  85C0          TEST EAX,EAX
73D9DED7  |.  74 13         JE SHORT MFC42.73D9DEEC
73D9DED9  |.  FF75 14       PUSH DWORD PTR SS:[EBP+14]
73D9DEDC  |.  8B10          MOV EDX,DWORD PTR DS:[EAX]
73D9DEDE  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]
73D9DEE1  |.  8BC8          MOV ECX,EAX
73D9DEE3  |.  57            PUSH EDI
73D9DEE4  |.  53            PUSH EBX
73D9DEE5  |.  FF52 14       CALL DWORD PTR DS:[EDX+14]
73D9DEE8  |.  85C0          TEST EAX,EAX
73D9DEEA  |.  75 1C         JNZ SHORT MFC42.73D9DF08
73D9DEEC  |>  E8 1431F9FF   CALL MFC42.#1175_?AfxGetThread@@YGPAVCWinThread@@XZ
73D9DEF1  |.  85C0          TEST EAX,EAX
73D9DEF3  |.  74 18         JE SHORT MFC42.73D9DF0D
73D9DEF5  |.  FF75 14       PUSH DWORD PTR SS:[EBP+14]
73D9DEF8  |.  8B10          MOV EDX,DWORD PTR DS:[EAX]
73D9DEFA  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]
73D9DEFD  |.  8BC8          MOV ECX,EAX
73D9DEFF  |.  57            PUSH EDI
73D9DF00  |.  53            PUSH EBX
73D9DF01  |.  FF52 14       CALL DWORD PTR DS:[EDX+14]
73D9DF04  |.  85C0          TEST EAX,EAX
73D9DF06  |.  74 05         JE SHORT MFC42.73D9DF0D
73D9DF08  |>  33C0          XOR EAX,EAX
73D9DF0A  |.  40            INC EAX
73D9DF0B  |.  EB 02         JMP SHORT MFC42.73D9DF0F
73D9DF0D  |>  33C0          XOR EAX,EAX
73D9DF0F  |>  5F            POP EDI
73D9DF10  |.  5E            POP ESI
73D9DF11  |.  5B            POP EBX
73D9DF12  |.  5D            POP EBP
73D9DF13  \.  C2 1000       RETN 10

///

BOOL CCmdTarget::OnCmdMsg(UINT nID, int nCode, void* pExtra,
AFX_CMDHANDLERINFO* pHandlerInfo)
{
#ifndef _AFX_NO_OCC_SUPPORT
// OLE control events are a special case
if (nCode == CN_EVENT)
{
ASSERT(afxOccManager != NULL);
return afxOccManager->OnEvent(this, nID, (AFX_EVENT*)pExtra, pHandlerInfo);
}
#endif // !_AFX_NO_OCC_SUPPORT


// determine the message number and code (packed into nCode)
const AFX_MSGMAP* pMessageMap;
const AFX_MSGMAP_ENTRY* lpEntry;
UINT nMsg = 0;


#ifndef _AFX_NO_DOCOBJECT_SUPPORT
if (nCode == CN_OLECOMMAND)
{
BOOL bResult = FALSE;


const AFX_OLECMDMAP* pOleCommandMap;
const AFX_OLECMDMAP_ENTRY* pEntry;


COleCmdUI* pUI = (COleCmdUI*) pExtra;
const GUID* pguidCmdGroup = pUI->m_pguidCmdGroup;


#ifdef _AFXDLL
for (pOleCommandMap = GetCommandMap(); pOleCommandMap != NULL && !bResult;
pOleCommandMap = pOleCommandMap->pfnGetBaseMap())
#else
for (pOleCommandMap = GetCommandMap(); pOleCommandMap != NULL && !bResult;
pOleCommandMap = pOleCommandMap->pBaseMap)
#endif
{
for (pEntry = pOleCommandMap->lpEntries;
pEntry->cmdID != 0 && pEntry->nID != 0 && !bResult;
pEntry++)
{
if (nID == pEntry->cmdID &&
IsEqualNULLGuid(pguidCmdGroup, pEntry->pguid))
{
pUI->m_nID = pEntry->nID;
bResult = TRUE;
}
}
}


return bResult;
}
#endif


if (nCode != CN_UPDATE_COMMAND_UI)
{
nMsg = HIWORD(nCode);
nCode = LOWORD(nCode);
}


// for backward compatibility HIWORD(nCode)==0 is WM_COMMAND
if (nMsg == 0)
nMsg = WM_COMMAND;


// look through message map to see if it applies to us
#ifdef _AFXDLL
for (pMessageMap = GetMessageMap(); pMessageMap != NULL;
 pMessageMap = (*pMessageMap->pfnGetBaseMap)())
#else
for (pMessageMap = GetMessageMap(); pMessageMap != NULL;
 pMessageMap = pMessageMap->pBaseMap)
#endif
{
// Note: catches BEGIN_MESSAGE_MAP(CMyClass, CMyClass)!
#ifdef _AFXDLL
ASSERT(pMessageMap != (*pMessageMap->pfnGetBaseMap)());
#else
ASSERT(pMessageMap != pMessageMap->pBaseMap);
#endif


lpEntry = AfxFindMessageEntry(pMessageMap->lpEntries, nMsg, nCode, nID);
if (lpEntry != NULL)
{
// found it
#ifdef _DEBUG
if (afxTraceFlags & traceCmdRouting)
{
if (nCode == CN_COMMAND)
{
TRACE2("SENDING command id 0x%04X to %hs target.\n", nID,
GetRuntimeClass()->m_lpszClassName);
}
else if (nCode > CN_COMMAND)
{
if (afxTraceFlags & traceWinMsg)
{
TRACE3("SENDING control notification %d from control id 0x%04X to %hs window.\n",
nCode, nID, GetRuntimeClass()->m_lpszClassName);
}
}
}
#endif //_DEBUG
return _AfxDispatchCmdMsg(this, nID, nCode,
lpEntry->pfn, pExtra, lpEntry->nSig, pHandlerInfo);
}
}
return FALSE;   // not handled
}


CCmdTarget::OnCmdMsg汇编代码:

73D322B5 >/$  8BFF          MOV EDI,EDI
73D322B7  |.  55            PUSH EBP
73D322B8  |.  8BEC          MOV EBP,ESP
73D322BA  |.  8B45 0C       MOV EAX,DWORD PTR SS:[EBP+C]
73D322BD  |.  83F8 FE       CMP EAX,-2                                                                                    ;  Switch (cases FFFFFFFD..FFFFFFFF)
73D322C0  |.  57            PUSH EDI
73D322C1  |.  8BF9          MOV EDI,ECX
73D322C3  |.  75 21         JNZ SHORT MFC42.73D322E6
73D322C5  |.  E8 0C600900   CALL MFC42.#1168_?AfxGetModuleState@@YGPAVAFX_MODULE_STATE@@XZ                                ;  Case FFFFFFFE of switch 73D322BD
73D322CA  |.  FF75 14       PUSH DWORD PTR SS:[EBP+14]
73D322CD  |.  8B80 54100000 MOV EAX,DWORD PTR DS:[EAX+1054]
73D322D3  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]
73D322D6  |.  8B10          MOV EDX,DWORD PTR DS:[EAX]
73D322D8  |.  FF75 08       PUSH DWORD PTR SS:[EBP+8]
73D322DB  |.  8BC8          MOV ECX,EAX
73D322DD  |.  57            PUSH EDI
73D322DE  |.  FF52 04       CALL DWORD PTR DS:[EDX+4]
73D322E1  |.  E9 BC000000   JMP MFC42.73D323A2
73D322E6  |>  83F8 FD       CMP EAX,-3
73D322E9  |.  53            PUSH EBX
73D322EA  |.  56            PUSH ESI
73D322EB  |.  75 78         JNZ SHORT MFC42.73D32365
73D322ED  |.  8B5D 10       MOV EBX,DWORD PTR SS:[EBP+10]                                                                 ;  Case FFFFFFFD of switch 73D322BD
73D322F0  |.  8B43 30       MOV EAX,DWORD PTR DS:[EBX+30]
73D322F3  |.  8365 0C 00    AND DWORD PTR SS:[EBP+C],0
73D322F7  |.  8945 10       MOV DWORD PTR SS:[EBP+10],EAX
73D322FA  |.  8B07          MOV EAX,DWORD PTR DS:[EDI]
73D322FC  |.  8BCF          MOV ECX,EDI
73D322FE  |.  FF50 34       CALL DWORD PTR DS:[EAX+34]
73D32301  |.  EB 57         JMP SHORT MFC42.73D3235A
73D32303  |>  837D 0C 00    /CMP DWORD PTR SS:[EBP+C],0
73D32307  |.  75 57         |JNZ SHORT MFC42.73D32360
73D32309  |.  8B77 04       |MOV ESI,DWORD PTR DS:[EDI+4]
73D3230C  |.  EB 43         |JMP SHORT MFC42.73D32351
73D3230E  |>  837E 08 00    |/CMP DWORD PTR DS:[ESI+8],0
73D32312  |.  74 44         ||JE SHORT MFC42.73D32358
73D32314  |.  837D 0C 00    ||CMP DWORD PTR SS:[EBP+C],0
73D32318  |.  75 3E         ||JNZ SHORT MFC42.73D32358
73D3231A  |.  3945 08       ||CMP DWORD PTR SS:[EBP+8],EAX
73D3231D  |.  75 2F         ||JNZ SHORT MFC42.73D3234E
73D3231F  |.  837D 10 00    ||CMP DWORD PTR SS:[EBP+10],0
73D32323  |.  75 07         ||JNZ SHORT MFC42.73D3232C
73D32325  |.  833E 00       ||CMP DWORD PTR DS:[ESI],0
73D32328  |.  74 17         ||JE SHORT MFC42.73D32341
73D3232A  |.  EB 22         ||JMP SHORT MFC42.73D3234E
73D3232C  |>  8B06          ||MOV EAX,DWORD PTR DS:[ESI]
73D3232E  |.  85C0          ||TEST EAX,EAX
73D32330  |.  74 1C         ||JE SHORT MFC42.73D3234E
73D32332  |.  50            ||PUSH EAX
73D32333  |.  FF75 10       ||PUSH DWORD PTR SS:[EBP+10]
73D32336  |.  E8 38D30800   ||CALL MFC42.73DBF673
73D3233B  |.  85C0          ||TEST EAX,EAX
73D3233D  |.  59            ||POP ECX
73D3233E  |.  59            ||POP ECX
73D3233F  |.  74 0D         ||JE SHORT MFC42.73D3234E
73D32341  |>  8B46 08       ||MOV EAX,DWORD PTR DS:[ESI+8]
73D32344  |.  8943 04       ||MOV DWORD PTR DS:[EBX+4],EAX
73D32347  |.  C745 0C 01000>||MOV DWORD PTR SS:[EBP+C],1
73D3234E  |>  83C6 0C       ||ADD ESI,0C
73D32351  |>  8B46 04       | MOV EAX,DWORD PTR DS:[ESI+4]
73D32354  |.  85C0          ||TEST EAX,EAX
73D32356  |.^ 75 B6         |\JNZ SHORT MFC42.73D3230E
73D32358  |>  FF17          |CALL DWORD PTR DS:[EDI]
73D3235A  |>  8BF8           MOV EDI,EAX
73D3235C  |.  85FF          |TEST EDI,EDI
73D3235E  |.^ 75 A3         \JNZ SHORT MFC42.73D32303
73D32360  |>  8B45 0C       MOV EAX,DWORD PTR SS:[EBP+C]
73D32363  |.  EB 3B         JMP SHORT MFC42.73D323A0
73D32365  |>  83F8 FF       CMP EAX,-1
73D32368  |.  74 0D         JE SHORT MFC42.73D32377
73D3236A  |.  8BD8          MOV EBX,EAX                                                                                   ;  Default case of switch 73D322BD
73D3236C  |.  C1EB 10       SHR EBX,10
73D3236F  |.  0FB7C0        MOVZX EAX,AX
73D32372  |.  8945 0C       MOV DWORD PTR SS:[EBP+C],EAX
73D32375  |.  75 05         JNZ SHORT MFC42.73D3237C
73D32377  |>  BB 11010000   MOV EBX,111                                                                                   ;  Case FFFFFFFF of switch 73D322BD
73D3237C  |>  8B07          MOV EAX,DWORD PTR DS:[EDI]
73D3237E  |.  8BCF          MOV ECX,EDI
73D32380  |.  FF50 30       CALL DWORD PTR DS:[EAX+30]
73D32383  |.  EB 15         JMP SHORT MFC42.73D3239A
73D32385  |>  FF75 08       /PUSH DWORD PTR SS:[EBP+8]
73D32388  |.  FF75 0C       |PUSH DWORD PTR SS:[EBP+C]
73D3238B  |.  53            |PUSH EBX
73D3238C  |.  FF76 04       |PUSH DWORD PTR DS:[ESI+4]
73D3238F  |.  E8 DAFEFFFF   |CALL MFC42.#1145_?AfxFindMessageEntry@@YGPBUAFX_MSGMAP_ENTRY@@PBU1@III@Z
73D32394  |.  85C0          |TEST EAX,EAX
73D32396  |.  75 0F         |JNZ SHORT MFC42.73D323A7
73D32398  |.  FF16          |CALL DWORD PTR DS:[ESI]
73D3239A  |>  8BF0           MOV ESI,EAX
73D3239C  |.  85F6          |TEST ESI,ESI
73D3239E  |.^ 75 E5         \JNZ SHORT MFC42.73D32385
73D323A0  |>  5E            POP ESI
73D323A1  |.  5B            POP EBX
73D323A2  |>  5F            POP EDI
73D323A3  |.  5D            POP EBP
73D323A4  |.  C2 1000       RETN 10
73D323A7  |>  FF75 14       PUSH DWORD PTR SS:[EBP+14]
73D323AA  |.  FF70 10       PUSH DWORD PTR DS:[EAX+10]
73D323AD  |.  FF75 10       PUSH DWORD PTR SS:[EBP+10]
73D323B0  |.  FF70 14       PUSH DWORD PTR DS:[EAX+14]
73D323B3  |.  FF75 0C       PUSH DWORD PTR SS:[EBP+C]
73D323B6  |.  FF75 08       PUSH DWORD PTR SS:[EBP+8]
73D323B9  |.  57            PUSH EDI
73D323BA  |.  E8 7F000000   CALL MFC42.73D3243E                     ;调用_AfxDispatchCmdMsg 这个函数
73D323BF  \.^ EB DF         JMP SHORT MFC42.73D323A0


 

AFX_STATIC BOOL AFXAPI _AfxDispatchCmdMsg(CCmdTarget* pTarget, UINT nID, int nCode,
AFX_PMSG pfn, void* pExtra, UINT nSig, AFX_CMDHANDLERINFO* pHandlerInfo)
// return TRUE to stop routing
{
ASSERT_VALID(pTarget);
UNUSED(nCode);   // unused in release builds


union MessageMapFunctions mmf;
mmf.pfn = pfn;
BOOL bResult = TRUE; // default is ok


if (pHandlerInfo != NULL)
{
// just fill in the information, don't do it
pHandlerInfo->pTarget = pTarget;
pHandlerInfo->pmf = mmf.pfn;
return TRUE;
}


switch (nSig)
{
case AfxSig_vv:
// normal command or control notification
ASSERT(CN_COMMAND == 0);        // CN_COMMAND same as BN_CLICKED
ASSERT(pExtra == NULL);
(pTarget->*mmf.pfn_COMMAND)();
break;


case AfxSig_bv:
// normal command or control notification
ASSERT(CN_COMMAND == 0);        // CN_COMMAND same as BN_CLICKED
ASSERT(pExtra == NULL);
bResult = (pTarget->*mmf.pfn_bCOMMAND)();
break;


case AfxSig_vw:
// normal command or control notification in a range
ASSERT(CN_COMMAND == 0);        // CN_COMMAND same as BN_CLICKED
ASSERT(pExtra == NULL);
(pTarget->*mmf.pfn_COMMAND_RANGE)(nID);
break;


case AfxSig_bw:
// extended command (passed ID, returns bContinue)
ASSERT(pExtra == NULL);
bResult = (pTarget->*mmf.pfn_COMMAND_EX)(nID);
break;


case AfxSig_vNMHDRpl:
{
AFX_NOTIFY* pNotify = (AFX_NOTIFY*)pExtra;
ASSERT(pNotify != NULL);
ASSERT(pNotify->pResult != NULL);
ASSERT(pNotify->pNMHDR != NULL);
(pTarget->*mmf.pfn_NOTIFY)(pNotify->pNMHDR, pNotify->pResult);
}
break;
case AfxSig_bNMHDRpl:
{
AFX_NOTIFY* pNotify = (AFX_NOTIFY*)pExtra;
ASSERT(pNotify != NULL);
ASSERT(pNotify->pResult != NULL);
ASSERT(pNotify->pNMHDR != NULL);
bResult = (pTarget->*mmf.pfn_bNOTIFY)(pNotify->pNMHDR, pNotify->pResult);
}
break;
case AfxSig_vwNMHDRpl:
{
AFX_NOTIFY* pNotify = (AFX_NOTIFY*)pExtra;
ASSERT(pNotify != NULL);
ASSERT(pNotify->pResult != NULL);
ASSERT(pNotify->pNMHDR != NULL);
(pTarget->*mmf.pfn_NOTIFY_RANGE)(nID, pNotify->pNMHDR,
pNotify->pResult);
}
break;
case AfxSig_bwNMHDRpl:
{
AFX_NOTIFY* pNotify = (AFX_NOTIFY*)pExtra;
ASSERT(pNotify != NULL);
ASSERT(pNotify->pResult != NULL);
ASSERT(pNotify->pNMHDR != NULL);
bResult = (pTarget->*mmf.pfn_NOTIFY_EX)(nID, pNotify->pNMHDR,
pNotify->pResult);
}
break;
case AfxSig_cmdui:
{
// ON_UPDATE_COMMAND_UI or ON_UPDATE_COMMAND_UI_REFLECT case
ASSERT(CN_UPDATE_COMMAND_UI == (UINT)-1);
ASSERT(nCode == CN_UPDATE_COMMAND_UI || nCode == 0xFFFF);
ASSERT(pExtra != NULL);
CCmdUI* pCmdUI = (CCmdUI*)pExtra;
ASSERT(!pCmdUI->m_bContinueRouting);    // idle - not set
(pTarget->*mmf.pfn_UPDATE_COMMAND_UI)(pCmdUI);
bResult = !pCmdUI->m_bContinueRouting;
pCmdUI->m_bContinueRouting = FALSE;     // go back to idle
}
break;


case AfxSig_cmduiw:
{
// ON_UPDATE_COMMAND_UI case
ASSERT(nCode == CN_UPDATE_COMMAND_UI);
ASSERT(pExtra != NULL);
CCmdUI* pCmdUI = (CCmdUI*)pExtra;
ASSERT(pCmdUI->m_nID == nID);           // sanity assert
ASSERT(!pCmdUI->m_bContinueRouting);    // idle - not set
(pTarget->*mmf.pfn_UPDATE_COMMAND_UI_RANGE)(pCmdUI, nID);
bResult = !pCmdUI->m_bContinueRouting;
pCmdUI->m_bContinueRouting = FALSE;     // go back to idle
}
break;


// general extensibility hooks
case AfxSig_vpv:
(pTarget->*mmf.pfn_OTHER)(pExtra);
break;
case AfxSig_bpv:
bResult = (pTarget->*mmf.pfn_OTHER_EX)(pExtra);
break;


default:    // illegal
ASSERT(FALSE);
return 0;
}
return bResult;
}


_AfxDispatchCmdMsg汇编代码：

73D3243E  /$  8BFF          MOV EDI,EDI
73D32440  |.  55            PUSH EBP
73D32441  |.  8BEC          MOV EBP,ESP
73D32443  |.  8B45 20       MOV EAX,DWORD PTR SS:[EBP+20]
73D32446  |.  53            PUSH EBX
73D32447  |.  33DB          XOR EBX,EBX
73D32449  |.  43            INC EBX
73D3244A  |.  85C0          TEST EAX,EAX
73D3244C  |.  74 12         JE SHORT MFC42.73D32460
73D3244E  |.  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]
73D32451  |.  8908          MOV DWORD PTR DS:[EAX],ECX
73D32453  |.  8B4D 14       MOV ECX,DWORD PTR SS:[EBP+14]
73D32456  |.  8948 04       MOV DWORD PTR DS:[EAX+4],ECX
73D32459  |.  8BC3          MOV EAX,EBX
73D3245B  |.  E9 E4000000   JMP MFC42.73D32544
73D32460  |>  8B45 1C       MOV EAX,DWORD PTR SS:[EBP+1C]
73D32463  |.  83F8 28       CMP EAX,28                                                                                    ;  Switch (cases 2..2F)
73D32466  |.  56            PUSH ESI
73D32467  |.  77 71         JA SHORT MFC42.73D324DA
73D32469  |.  74 5C         JE SHORT MFC42.73D324C7
73D3246B  |.  48            DEC EAX
73D3246C  |.  48            DEC EAX
73D3246D  |.  74 53         JE SHORT MFC42.73D324C2
73D3246F  |.  83E8 0A       SUB EAX,0A
73D32472  |.  74 46         JE SHORT MFC42.73D324BA
73D32474  |.  48            DEC EAX
73D32475  |.  74 3E         JE SHORT MFC42.73D324B5
73D32477  |.  83E8 16       SUB EAX,16
73D3247A  |.  74 2E         JE SHORT MFC42.73D324AA
73D3247C  |.  83E8 03       SUB EAX,3
73D3247F  |.  74 16         JE SHORT MFC42.73D32497
73D32481  |.  48            DEC EAX
73D32482  |.  75 69         JNZ SHORT MFC42.73D324ED
73D32484  |.  8B45 18       MOV EAX,DWORD PTR SS:[EBP+18]                                                                 ;  Case 27 of switch 73D32463
73D32487  |.  FF30          PUSH DWORD PTR DS:[EAX]
73D32489  |.  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]
73D3248C  |.  FF70 04       PUSH DWORD PTR DS:[EAX+4]
73D3248F  |.  FF55 14       CALL DWORD PTR SS:[EBP+14]
73D32492  |.  E9 A8000000   JMP MFC42.73D3253F
73D32497  |>  8B45 18       MOV EAX,DWORD PTR SS:[EBP+18]                                                                 ;  Case 26 of switch 73D32463
73D3249A  |.  FF30          PUSH DWORD PTR DS:[EAX]
73D3249C  |.  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]
73D3249F  |.  FF70 04       PUSH DWORD PTR DS:[EAX+4]
73D324A2  |.  FF55 14       CALL DWORD PTR SS:[EBP+14]
73D324A5  |.  E9 97000000   JMP MFC42.73D32541
73D324AA  |>  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]                                                                  ;  Case 23 of switch 73D32463
73D324AD  |.  FF55 14       CALL DWORD PTR SS:[EBP+14]
73D324B0  |.  E9 8A000000   JMP MFC42.73D3253F
73D324B5  |>  FF75 0C       PUSH DWORD PTR SS:[EBP+C]                                                                     ;  Case D of switch 73D32463
73D324B8  |.  EB 45         JMP SHORT MFC42.73D324FF
73D324BA  |>  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]                                                                  ;  Case C of switch 73D32463
73D324BD      FF55 14       CALL DWORD PTR SS:[EBP+14]
73D324C0  |.  EB 7F         JMP SHORT MFC42.73D32541
73D324C2  |>  FF75 0C       PUSH DWORD PTR SS:[EBP+C]                                                                     ;  Case 2 of switch 73D32463
73D324C5  |.  EB 2D         JMP SHORT MFC42.73D324F4
73D324C7  |>  8B45 18       MOV EAX,DWORD PTR SS:[EBP+18]                                                                 ;  Case 28 of switch 73D32463
73D324CA  |.  FF30          PUSH DWORD PTR DS:[EAX]
73D324CC  |.  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]
73D324CF  |.  FF70 04       PUSH DWORD PTR DS:[EAX+4]
73D324D2  |.  FF75 0C       PUSH DWORD PTR SS:[EBP+C]
73D324D5  |.  FF55 14       CALL DWORD PTR SS:[EBP+14]
73D324D8  |.  EB 67         JMP SHORT MFC42.73D32541
73D324DA  |>  83E8 29       SUB EAX,29
73D324DD  |.  74 4F         JE SHORT MFC42.73D3252E
73D324DF  |.  83E8 03       SUB EAX,3
73D324E2  |.  74 3E         JE SHORT MFC42.73D32522
73D324E4  |.  48            DEC EAX
73D324E5  |.  74 20         JE SHORT MFC42.73D32507
73D324E7  |.  48            DEC EAX
73D324E8  |.  74 12         JE SHORT MFC42.73D324FC
73D324EA  |.  48            DEC EAX
73D324EB  |.  74 04         JE SHORT MFC42.73D324F1
73D324ED  |>  33C0          XOR EAX,EAX                                                                                   ;  Default case of switch 73D32463
73D324EF  |.  EB 52         JMP SHORT MFC42.73D32543
73D324F1  |>  FF75 18       PUSH DWORD PTR SS:[EBP+18]                                                                    ;  Case 2F of switch 73D32463
73D324F4  |>  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]
73D324F7  |.  FF55 14       CALL DWORD PTR SS:[EBP+14]
73D324FA  |.  EB 43         JMP SHORT MFC42.73D3253F
73D324FC  |>  FF75 18       PUSH DWORD PTR SS:[EBP+18]                                                                    ;  Case 2E of switch 73D32463
73D324FF  |>  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]
73D32502  |.  FF55 14       CALL DWORD PTR SS:[EBP+14]
73D32505  |.  EB 3A         JMP SHORT MFC42.73D32541
73D32507  |>  FF75 0C       PUSH DWORD PTR SS:[EBP+C]                                                                     ;  Case 2D of switch 73D32463
73D3250A  |.  8B75 18       MOV ESI,DWORD PTR SS:[EBP+18]
73D3250D  |.  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]
73D32510  |.  56            PUSH ESI
73D32511  |.  FF55 14       CALL DWORD PTR SS:[EBP+14]
73D32514  |>  33DB          XOR EBX,EBX
73D32516  |.  395E 1C       CMP DWORD PTR DS:[ESI+1C],EBX
73D32519  |.  0F94C3        SETE BL
73D3251C  |.  8366 1C 00    AND DWORD PTR DS:[ESI+1C],0
73D32520  |.  EB 1F         JMP SHORT MFC42.73D32541
73D32522  |>  8B75 18       MOV ESI,DWORD PTR SS:[EBP+18]                                                                 ;  Case 2C of switch 73D32463
73D32525  |.  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]
73D32528  |.  56            PUSH ESI
73D32529  |.  FF55 14       CALL DWORD PTR SS:[EBP+14]
73D3252C  |.^ EB E6         JMP SHORT MFC42.73D32514
73D3252E  |>  8B45 18       MOV EAX,DWORD PTR SS:[EBP+18]                                                                 ;  Case 29 of switch 73D32463
73D32531  |.  FF30          PUSH DWORD PTR DS:[EAX]
73D32533  |.  8B4D 08       MOV ECX,DWORD PTR SS:[EBP+8]
73D32536  |.  FF70 04       PUSH DWORD PTR DS:[EAX+4]
73D32539  |.  FF75 0C       PUSH DWORD PTR SS:[EBP+C]
73D3253C  |.  FF55 14       CALL DWORD PTR SS:[EBP+14]
73D3253F  |>  8BD8          MOV EBX,EAX
73D32541  |>  8BC3          MOV EAX,EBX
73D32543  |>  5E            POP ESI
73D32544  |>  5B            POP EBX
73D32545  |.  5D            POP EBP
73D32546  \.  C2 1C00       RETN 1C


 
 
 
 




jiangdf
关注
专栏目录
Windows环境下32位汇编语言程序第一版程序
10-04
在Windows环境下，32位汇编语言程序设计是一项复杂而精细的工作，涉及到计算机体系结构、操作系统接口以及编程技术等多个方面。罗云彬所著的《Windows环境下32位汇编程序设计》一书，深入浅出地介绍了如何在Windows...
win10 tagWnd部分成员逆向(窗口隐藏,窗口保护)
zhuhuibeishadiao
06-04 6071
题外话:窗口隐藏:效果就是spy++ 彗星小助手发现不了窗口,但是窗口确实存在.(副作用:不透明窗口,鼠标不穿透窗口白屏或无反应,进程退出蓝屏(如果恢复了就不会)) 一大波黑产在路上了??? 怎么隐藏呢? 跟断链一致,前一个的下一个等于当前的下一个,后一个的前一个等于当前的前一个.已经说的很明白了! 另外在17763及以上,在你内核修改是木有效果的哦.具体可以自己研究一下应用层的tagWn...
Gloomy对Windows内核的分析(内核反汇编技术)
峥嵘岁月
01-31 3035
内核反汇编技术===============================Windows  NT主要是由C写成的，所以总的来说进程本身的反汇编不是很复杂。通常对局部变量和参数的使用是通过地址和用EBP形成的stack frame来进行的。例如：PAGE:801932D4    mov     eax, large fs:0PAGE:801932DA    push    ebpPAGE:
（笔记）逆向工程核心原理——内核6会话
qq_30101409的博客
09-13 117
windows会话隔离机制学习记录
滴水逆向——Win32_杂项
sunr.
04-27 833
1、什么是Win32 API？有哪些？在哪里？ 主要是存放在 C : \WINDOWS\system32 下面所有的dll 2、非常重要的几个DLL Kernel32.dll:最核心的功能模块，比如管理内存、进程和线程相关的函数等. User32.dll : 是Windows用户界面相关应用程序接口, 如创建窗口和发送消息等. GDI32.dll : 全称是Graphical Device In...
游戏窗口化的逆向分析
陈子青的博客
07-22 928
2）如果游戏不支持命令行参数，如何对窗口化进行逆向？找到游戏使用的显示库，并定位设置窗口化的api函数进行逆向分析。方法打开OD——>插件——>超级字符串查找——>查找window——跟随代码快速定位.如图。（1）因为游戏是通过命令行参数来比较的，可以“window”字符串常量，来快速定位函数位置。有很多游戏本身不支持用户设置窗口化，本文通过逆向分析，完成游戏的窗口化设置。本文以Sword2游戏为例，该游戏内不支持用户设置窗口化。由此次经验，可以预见，当程序接受命令行参数时，我们就可以对。.........
MFC 消息逆向分析.pdf
08-06
8. Windows系统内核(`USER32`) 9. `AfxWndProcBase` 10. `AfxWndProc` 11. `AfxCallWndProc` 12. `CWnd::WindowProc` 13. `CWnd::OnWndMsg` 14. `CWnd::OnCommand` 15. `CDialog::OnCmdMsg` 16. `_AfxDispatchCmdMsg...
Windows环境下32位汇编程序设计(附书代码)
05-26
5. **Windows API调用**：使用汇编语言调用Windows API函数，如kernel32.dll和user32.dll中的函数，如CreateProcess、WriteFile、ExitProcess等，需要了解stdcall调用约定和参数传递规则。 6. **内存管理**：了解...
AFXRootkit2005_delphi_user-mode_
10-03
在描述中提到的 "advanced windows user mode rootkit" 强调了这款 Rootkit 是针对 Windows 操作系统的高级用户模式技术。这意味着它利用了 Windows API 和用户权限来隐藏其存在和活动，可能包括隐藏进程、文件、...
AFXRootkit2005_delphi_windows_rootkit_
10-01
标题 "AFXRootkit2005_delphi_windows_rootkit_" 暗示我们正在讨论一个由 Delphi 编程语言构建的 Windows 操作系统下的 Rootkit。Delphi 是一种流行的面向对象的编程环境，它基于 Pascal 语言，常用于开发高性能的...
逆向面试常见问题（陆续更新ing）
JiangBuLiu的博客
03-14 6495
资料收集与网络（点击对应标题有原帖地址）PE怎么判断PE是DLL,还是EXE文件值属性加载基址怎么判断PE文件是32位还是64位PE加载过程基础Windows下的调用约定通用寄存器有哪些？段存器怎么找到函数地址调试与反调试INT3INT 3 指令Intel的手册INT 3 中断调试处理流程Windows反调试有哪些?反调试技术总结一、探测Windows调试器1.使用Windows API2.手动检...
Windows逆向学习提纲
最新发布
于高山之巅，方见大河奔涌；于群峰之上，更觉长风浩荡。
03-18 884
Windows逆向学习提纲
CResourceException Warning: Uncaught exception in WindowProc (returning 0).
成都大学 luohy(嵌入式)
05-05 4275
Warning: Uncaught exception in WindowProc (returning 0). ElectronicFence.exe 中的 0x762ec42d 处最可能的异常: Microsoft C++ 异常: 内存位置 0x0015f134 处的 CResourceException。 Warning: Uncaught exception in WindowProc
如何找到MFC中的消息处理函数（2）
weixin_33895516的博客
07-13 111
上篇讲的是对程序的定时器消息下断点，如果要拦截用户消息，比如点击按钮等，则需要对消息WM_COMMAND下条件断点，下断点的位置与定时器消息相同，步骤如下： 1 首先找到CWnd::WindowProc函数，进入这个函数以后在函数OnWndMsg前下条件断点，条件为[ebp+8]==WM_COMMAND，代码如下 Code73D31B77>8BFFmov...
使IE8以下的IE浏览器也支持图片的data协议
Less is More
11-06 516
参见[url]http://www.phpied.com/mhtml-when-you-need-data-uris-in-ie7-and-under/[/url] 测试页面：[url]http://phpied.com/files/mhtml/mhtml.html[/url] 原理是使用MHTML（Multipurpose Internet Mail Extensions HyperTe...
OD调试MFC程序按钮事件的捕捉
热门推荐
ccnyou的专栏
06-07 1万+
经常在调试程序中需要捕捉某一按钮事件，分析按钮对应的代码（如“登陆”，“注册”等） 近来无事，自己写个程序来看看MFC的消息分发流程，然后总结地写了这文章：   示例程序MfcTest，下载链接：http://download.csdn.net/detail/ccnyou/4358961 编译环境VC6+WinXP 使用工具：OD(OllyDbg) 程序截图
OllyDbg 使用笔记 （六）
billvsme的专栏
08-11 1504
OllyDbg 使用笔记 （六） 参考 书：《加密与解密》 视频：小甲鱼 解密系列 视频 去除NAG以及运行次数限制 方法1： 去除NAG窗口的方法是：F8运行程序，碰到出现NAG的CALL就下断点，重新运行按F7进入此CALL，直到找到用户领空“真正“CALL出NAG窗口的CALL。观察此CALL前后的代码。 按照前面说的，找到这个CALL在 00489912 可以发现这个CALL返回eax=1，而且下面的一句是判断cmp是否是1，是1就正常运行。所以这个CALL的
MFC学习小记(1) MFC的入口点与消息循环，消息映射
sryan的专栏
03-25 4323
以前一直用的Qt，最近找工作后，基本就定在windows平台上了，无聊之中研究了下以前没怎么学的MFC。现在看看没有以前那么深奥了。 1.MFC的入口点与简单的执行过程 MFC隐藏了windows程序的入口点winMain，其实是在appmodule.cpp文件下，该入口点调用MFC的全局函数AfxWinMain作为MFC的入口点 然后AfxWinMain会进行一些初
深入理解Windows消息机制：窗口过程与消息类型解析
"Windows消息机制是Windows编程中的核心概念，涉及到窗口过程、消息类型、消息队列、消息发送与接收函数、消息处理以及潜在的问题如消息死锁等。这一机制确保了应用程序对用户输入和其他事件的有序响应。" 在...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值