winlogon源代码分析之win32k!xxxScanSysQueue函数对WM_LBUTTONDOWN消息的处理点击Logon Help对话框编辑区第五段焦点变为编辑区-MLMouseMotion

winlogon源代码分析之win32k!xxxScanSysQueue函数对WM_LBUTTONDOWN消息的处理点击Logon Help对话框编辑区第五段焦点变为编辑区USER32!MLMouseMotion

0: kd> kc
 #
00 MSGINA!HelpDlgProc
01 winlogon!RootDlgProc
02 USER32!InternalCallWinProc
03 USER32!UserCallDlgProcCheckWow
04 USER32!DefDlgProcWorker
05 USER32!__fnDWORD
06 ntdll!KiUserCallbackDispatcher
07 nt!KiCallUserMode
08 nt!KeUserModeCallback
09 win32k!SfnDWORD
0a win32k!xxxSendMessageToClient
0b win32k!xxxSendMessageTimeout
0c win32k!xxxSendMessage
0d win32k!xxxGetControlColor
0e win32k!xxxGetControlBrush
0f win32k!NtUserGetControlBrush
10 nt!_KiSystemService
11 SharedUserData!SystemCallStub
12 ntdll!KiUserCallbackDispatcher
13 nt!KiCallUserMode
14 nt!KeUserModeCallback
15 win32k!SfnDWORD
16 win32k!xxxSendMessageToClient
17 win32k!xxxSendMessageTimeout
18 win32k!xxxSendMessage
19 win32k!xxxSendFocusMessages
1a win32k!xxxSetFocus
1b win32k!NtUserSetFocus
1c nt!_KiSystemService
1d SharedUserData!SystemCallStub
1e ntdll!KiUserCallbackDispatcher
1f USER32!NtUserSetFocus
20 USER32!MLEditWndProc
21 USER32!EditWndProc
22 USER32!EditWndProcWorker
23 USER32!EditWndProcW
24 USER32!InternalCallWinProc
25 USER32!UserCallWinProcCheckWow
26 USER32!DispatchMessageWorker
27 USER32!DispatchMessageW
28 USER32!IsDialogMessageW
29 USER32!DialogBox2
2a USER32!InternalDialogBox
2b USER32!DialogBoxIndirectParamAorW
2c USER32!DialogBoxParamW
2d USER32!DialogBoxParamW_wrapper
2e winlogon!Fusion_DialogBoxParam
2f winlogon!TimeoutDialogBoxParam
30 winlogon!WlxDialogBoxParam
31 MSGINA!WelcomeDlgProc
32 winlogon!RootDlgProc
33 USER32!InternalCallWinProc
34 USER32!UserCallDlgProcCheckWow
35 USER32!DefDlgProcWorker
36 USER32!SendMessageWorker
37 USER32!SendMessageW
38 USER32!SendMessageW_wrapper
39 comctl32_6f610000!SendMessageD
3a comctl32_6f610000!CLink::SendNotify
3b comctl32_6f610000!CLink::Notify
3c comctl32_6f610000!CMarkup::DoNotify
3d comctl32_6f610000!CMarkup::OnButtonUp
3e comctl32_6f610000!CLink::WndProc
3f USER32!InternalCallWinProc
40 USER32!UserCallWinProcCheckWow
41 USER32!DispatchMessageWorker
42 USER32!DispatchMessageW
43 USER32!IsDialogMessageW
44 USER32!DialogBox2
45 USER32!InternalDialogBox
46 USER32!DialogBoxIndirectParamAorW
47 USER32!DialogBoxParamW
48 USER32!DialogBoxParamW_wrapper
49 winlogon!Fusion_DialogBoxParam
4a winlogon!TimeoutDialogBoxParam
4b winlogon!WlxDialogBoxParam
4c MSGINA!WlxDisplaySASNotice
4d winlogon!MainLoop
4e winlogon!WinMain
4f winlogon!WinMainCRTStartup

0: kd> kv
 # ChildEBP RetAddr  Args to Child              
00 0006dfb4 0102c2bd 00010046 00000135 01010055 MSGINA!HelpDlgProc (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\msgina\welcome.c @ 45]
01 0006dfd8 77ce7ee3 00010046 00000135 01010055 winlogon!RootDlgProc+0x8d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\winlogon\wlxutil.c @ 343]
02 0006e004 77cf2d66 0102c230 00010046 00000135 USER32!InternalCallWinProc+0x1b [d:\srv03rtm\windows\core\ntuser\client\i386\callproc.asm @ 102]
03 0006e080 77cd4af3 00000000 0102c230 00010046 USER32!UserCallDlgProcCheckWow+0x147 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clmsg.c @ 228]
04 0006e0c8 77cbe80c 00000000 00000135 01010055 USER32!DefDlgProcWorker+0x11f (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\dlgmgr.c @ 511]
05 0006e0f0 77f5448f 0006e100 00000018 007d4c2c USER32!__fnDWORD+0x22 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\inc\ntcb.h @ 639]
06 0006e0f0 80a3f168 0006e100 00000018 007d4c2c ntdll!KiUserCallbackDispatcher+0x13 (FPO: [0,0,0]) [d:\srv03rtm\base\ntos\rtl\i386\userdisp.asm @ 153]
07 f75b65ac 80cc5b26 f75b6674 f75b6678 e1401a68 nt!KiCallUserMode+0x4 (FPO: [2,3,4]) [d:\srv03rtm\base\ntos\ke\i386\callout.asm @ 109]
08 f75b6604 bf807bfa 00000002 f75b6654 00000018 nt!KeUserModeCallback+0xc6 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ke\i386\callback.c @ 127]
09 f75b669c bf8fa60b bc644c2c 00000135 01010055 win32k!SfnDWORD+0x121 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\inc\ntcb.h @ 618]
0a f75b66f4 bf804176 03644c2c 00000135 01010055 win32k!xxxSendMessageToClient+0x151 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\sendmsg.c @ 839]
0b f75b6744 bf80edea bc644c2c 00000135 01010055 win32k!xxxSendMessageTimeout+0x22d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\sendmsg.c @ 1039]
0c f75b6768 bf817ca4 bc644c2c 00000135 01010055 win32k!xxxSendMessage+0x19 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\sendmsg.c @ 760]
0d f75b6788 bf817d48 bc644c2c bc6455e4 01010055 win32k!xxxGetControlColor+0x4b (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\random.c @ 203]
0e f75b67c4 bf85053b bc6455e4 01010055 00000135 win32k!xxxGetControlBrush+0x43 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\random.c @ 255]
0f f75b6804 80afbcb2 e1401a68 01010055 00000135 win32k!NtUserGetControlBrush+0x9e (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\ntstubs.c @ 5191]
10 f75b6804 7ffe0304 e1401a68 01010055 00000135 nt!_KiSystemService+0x13f (FPO: [0,3] TrapFrame @ f75b6824) (CONV: cdecl) [d:\srv03rtm\base\ntos\ke\i386\trap.asm @ 1328]
11 0006e0f0 77f5448f 0006e100 00000018 007d4c2c SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
12 0006e0f0 80a3f168 0006e100 00000018 007d4c2c ntdll!KiUserCallbackDispatcher+0x13 (FPO: [0,0,0]) [d:\srv03rtm\base\ntos\rtl\i386\userdisp.asm @ 153]
13 f75b6ae4 80cc5b26 f75b6bac f75b6bb0 e1401a68 nt!KiCallUserMode+0x4 (FPO: [2,3,4]) [d:\srv03rtm\base\ntos\ke\i386\callout.asm @ 109]
14 f75b6b3c bf807bfa 00000002 f75b6b8c 00000018 nt!KeUserModeCallback+0xc6 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ke\i386\callback.c @ 127]
15 f75b6bd4 bf8fa60b bc6455e4 00000008 0001004a win32k!SfnDWORD+0x121 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\inc\ntcb.h @ 618]
16 f75b6c2c bf804176 026455e4 00000008 0001004a win32k!xxxSendMessageToClient+0x151 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\sendmsg.c @ 839]
17 f75b6c7c bf80edea bc6455e4 00000008 0001004a win32k!xxxSendMessageTimeout+0x22d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\sendmsg.c @ 1039]
18 f75b6ca0 bf820af1 bc6455e4 00000008 0001004a win32k!xxxSendMessage+0x19 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\sendmsg.c @ 760]
19 f75b6ce0 bf820d52 bc6455e4 bc64574c bf820ed3 win32k!xxxSendFocusMessages+0x14f (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\focusact.c @ 273]
1a f75b6d1c bf820f0f bc64574c f75b6d58 0006e228 win32k!xxxSetFocus+0x201 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\focusact.c @ 1928]
1b f75b6d4c 80afbcb2 0001004a 80afbbec 00000000 win32k!NtUserSetFocus+0x3c (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\kernel\ntstubs.c @ 6006]
1c f75b6d4c 7ffe0304 0001004a 80afbbec 00000000 nt!_KiSystemService+0x13f (FPO: [0,3] TrapFrame @ f75b6d64) (CONV: cdecl) [d:\srv03rtm\base\ntos\ke\i386\trap.asm @ 1328]
1d 0006e1f4 77f5448f 0006e204 00000018 007d55e4 SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
1e 0006e218 77cc1d48 77d02d38 0001004a 00000201 ntdll!KiUserCallbackDispatcher+0x13 (FPO: [0,0,0]) [d:\srv03rtm\base\ntos\rtl\i386\userdisp.asm @ 153]
1f 0006e244 77ce20dc 000000d6 00000201 00000001 USER32!NtUserSetFocus+0xc (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\umode\daytona\obj\i386\usrstubs.c @ 4203]
20 0006e2b8 77cc192e 0001004a 012425ec 00000201 USER32!MLEditWndProc+0x5e5 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\editml.c @ 3685]
21 0006e2fc 77cc0f49 007d574c 00000201 00000001 USER32!EditWndProc+0x9de (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\editec.c @ 3655]
22 0006e320 77d012b6 0001004a 00000201 00000001 USER32!EditWndProcWorker+0x1c2 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\editec.c @ 2888]
23 0006e340 77ce7ee3 0001004a 00000201 00000001 USER32!EditWndProcW+0x4a (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\editec.c @ 2847]
24 0006e36c 77cf2bff 77d0126c 0001004a 00000201 USER32!InternalCallWinProc+0x1b [d:\srv03rtm\windows\core\ntuser\client\i386\callproc.asm @ 102]
25 0006e3e4 77cbe3db 00000000 77d0126c 0001004a USER32!UserCallWinProcCheckWow+0x151 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clmsg.c @ 165]
26 0006e44c 77cc4014 0006e49c 00000000 0006e480 USER32!DispatchMessageWorker+0x3e3 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clmsg.c @ 2497]
27 0006e45c 77cdb482 0006e49c 00000000 007d4c2c USER32!DispatchMessageW+0xd (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\cltxt.h @ 1046]
28 0006e480 77cdff3d 00010046 007d574c 00020020 USER32!IsDialogMessageW+0x39b (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\dlgmgr2.c @ 739]
29 0006e4bc 77cff459 00010046 00020020 00000001 USER32!DialogBox2+0x142 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\dlgmgr.c @ 1181]
2a 0006e4e4 77ce5e58 75080000 750b8688 00020020 USER32!InternalDialogBox+0x108 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\dlgmgr.c @ 1353]
2b 0006e504 77ce76e7 75080000 750b8688 00020020 USER32!DialogBoxIndirectParamAorW+0x67 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clres.c @ 806]
2c 0006e528 77cf607b 75080000 0000006d 00020020 USER32!DialogBoxParamW+0x3d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clres.c @ 954]
2d 0006e550 0102e8fc 75080000 0000006d 00020020 USER32!DialogBoxParamW_wrapper+0x5a (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clres.c @ 933]
2e 0006e574 010221e2 75080000 0000006d 00020020 winlogon!Fusion_DialogBoxParam+0x22 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\winlogon\fusion.cpp @ 39]
2f 0006e5b8 0102c860 00077418 75080000 0000006d winlogon!TimeoutDialogBoxParam+0x36 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\winlogon\timeout.c @ 1092]
30 0006e5f0 7509ee0a 00077418 75080000 0000006d winlogon!WlxDialogBoxParam+0xb7 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\winlogon\wlxutil.c @ 898]
31 0006e870 0102c2bd 00020020 0000004e 0000096a MSGINA!WelcomeDlgProc+0x1e0 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\msgina\welcome.c @ 786]
32 0006e894 77ce7ee3 00020020 0000004e 0000096a winlogon!RootDlgProc+0x8d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\winlogon\wlxutil.c @ 343]
33 0006e8c0 77cf2d66 0102c230 00020020 0000004e USER32!InternalCallWinProc+0x1b [d:\srv03rtm\windows\core\ntuser\client\i386\callproc.asm @ 102]
34 0006e93c 77cd4af3 00000000 0102c230 00020020 USER32!UserCallDlgProcCheckWow+0x147 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clmsg.c @ 228]
35 0006e984 77cbf87c 00000000 0000004e 0000096a USER32!DefDlgProcWorker+0x11f (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\dlgmgr.c @ 511]
36 0006e9b4 77cc0743 007d3aac 007d241c 0000096a USER32!SendMessageWorker+0x367 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clmsg.c @ 648]
37 0006e9d4 77cf1522 00020020 0000004e 0000096a USER32!SendMessageW+0x70 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\cltxt.h @ 809]
38 0006e9f8 6f62c6cb 00020020 0000004e 0000096a USER32!SendMessageW_wrapper+0x54 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\cltxt.h @ 755]
39 0006ea34 6f6a6633 00020020 0000004e 0000096a comctl32_6f610000!SendMessageD+0x66 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\comctl32\v6\commctrl.c @ 442]
3a 0006fb1c 6f6a6c23 00000000 00000000 00000001 comctl32_6f610000!CLink::SendNotify+0xb2 (FPO: [Non-Fpo]) (CONV: thiscall) [d:\srv03rtm\shell\comctl32\v6\link.cpp @ 539]
3b 0006fb30 6f6ba321 01239bb4 00000001 00000000 comctl32_6f610000!CLink::Notify+0x3d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\comctl32\v6\link.cpp @ 315]
3c 0006fb44 6f6ba530 00000001 00000000 00000202 comctl32_6f610000!CMarkup::DoNotify+0x12 (FPO: [Non-Fpo]) (CONV: thiscall) [d:\srv03rtm\shell\comctl32\v6\markup.cpp @ 2029]
3d 0006fb5c 6f6a739c 00000000 0000000e 00000008 comctl32_6f610000!CMarkup::OnButtonUp+0x4a (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\comctl32\v6\markup.cpp @ 738]
3e 0006fc1c 77ce7ee3 00010038 00000202 00000000 comctl32_6f610000!CLink::WndProc+0x4ea (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\shell\comctl32\v6\link.cpp @ 710]
3f 0006fc48 77cf2bff 6f6a6eb2 00010038 00000202 USER32!InternalCallWinProc+0x1b [d:\srv03rtm\windows\core\ntuser\client\i386\callproc.asm @ 102]
40 0006fcc0 77cbe3db 00000000 6f6a6eb2 00010038 USER32!UserCallWinProcCheckWow+0x151 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clmsg.c @ 165]
41 0006fd28 77cc4014 0006fd78 00000000 0006fd5c USER32!DispatchMessageWorker+0x3e3 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clmsg.c @ 2497]
42 0006fd38 77cdb482 0006fd78 00000000 007d3aac USER32!DispatchMessageW+0xd (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\cltxt.h @ 1046]
43 0006fd5c 77cdff3d 00020020 007d4214 00000000 USER32!IsDialogMessageW+0x39b (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\dlgmgr2.c @ 739]
44 0006fd98 77cff459 00020020 00000000 00000010 USER32!DialogBox2+0x142 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\dlgmgr.c @ 1181]
45 0006fdc0 77ce5e58 75080000 750b6958 00000000 USER32!InternalDialogBox+0x108 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\dlgmgr.c @ 1353]
46 0006fde0 77ce76e7 75080000 750b6958 00000000 USER32!DialogBoxIndirectParamAorW+0x67 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clres.c @ 806]
47 0006fe04 77cf607b 75080000 00000578 00000000 USER32!DialogBoxParamW+0x3d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clres.c @ 954]
48 0006fe2c 0102e8fc 75080000 00000578 00000000 USER32!DialogBoxParamW_wrapper+0x5a (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\clres.c @ 933]
49 0006fe50 010221e2 75080000 00000578 00000000 winlogon!Fusion_DialogBoxParam+0x22 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\winlogon\fusion.cpp @ 39]
4a 0006fe94 0102c860 00077418 75080000 00000578 winlogon!TimeoutDialogBoxParam+0x36 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\winlogon\timeout.c @ 1092]
4b 0006fecc 7509223d 00077418 75080000 00000578 winlogon!WlxDialogBoxParam+0xb7 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\winlogon\wlxutil.c @ 898]
4c 0006fef4 01029744 00155f70 00077418 00000004 MSGINA!WlxDisplaySASNotice+0x43 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\msgina\msgina.c @ 778]
4d 0006ff14 01026637 00077418 ffffffff 00000000 winlogon!MainLoop+0x19d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\winlogon\wlx.c @ 3332]
4e 0006ff50 0102edc6 000a7cb0 00000000 00072f0c winlogon!WinMain+0x4c7 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\ds\security\gina\winlogon\winlogon.c @ 1350]
4f 0006fff4 00000000 7ffdf000 0000018a 000001e4 winlogon!WinMainCRTStartup+0x182 (FPO: [Non-Fpo]) (CONV: cdecl) [d:\srv03rtm\base\crts\crtw32\dllstuff\crtexe.c @ 493]

1f  0006e244 77ce20dc 000000d6 00000201 00000001 USER32!NtUserSetFocus+0xc (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\umode\daytona\obj\i386\usrstubs.c @ 4203]
20 0006e2b8 77cc192e 0001004a 012425ec 00000201 USER32!MLEditWndProc+0x5e5 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\editml.c @ 3685]
21 0006e2fc 77cc0f49 007d574c 00000201 00000001 USER32!EditWndProc+0x9de (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\editec.c @ 3655]
22 0006e320 77d012b6 0001004a 00000201 00000001 USER32!EditWndProcWorker+0x1c2 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\windows\core\ntuser\client\editec.c @ 2888]

LRESULT MLEditWndProc(
    HWND hwnd,
    PED ped,
    UINT message,
    WPARAM wParam,
    LPARAM lParam)
{

        /*
         * FALL THROUGH
         */
    case WM_LBUTTONDBLCLK:
    case WM_LBUTTONDOWN:
    case WM_LBUTTONUP:
        /*
         * wParam - contains a value that indicates which virtual keys are down
           lParam - contains x and y coords of the mouse cursor
         */
        POINTSTOPOINT(pt, lParam);
        MLMouseMotion(ped, message, (UINT)wParam, &pt);
        break;

void MLMouseMotion(
    PED ped,
    UINT message,
    UINT virtKeyDown,
    LPPOINT mousePt)
{

    case WM_LBUTTONDOWN:
        ll = lh = mouseCch;

        if (!(virtKeyDown & MK_SHIFT)) {
            // If shift key isn't down, move caret to mouse point and clear
            // old selection
            ichMinSel = ichMaxSel = ped->ichCaret = mouseCch;
        } else {
            // Shiftkey is down so we want to maintain the current selection
            // (if any) and just extend or reduce it
            if (ped->ichMinSel == ped->ichCaret)
                ichMinSel = ped->ichCaret = mouseCch;
            else
                ichMaxSel = ped->ichCaret = mouseCch;
        }

        ped->ichStartMinSel = ped->ichStartMaxSel = 0;

    if (!ped->fFocus && (message == WM_LBUTTONDOWN)) {

        /*
         * If we don't have the focus yet, get it
         */
        NtUserSetFocus(ped->hwnd);
    }
}

PWND xxxSetFocus(
    PWND pwnd)
{

    if (pwnd != ptiCurrent->pq->spwndFocus) {
        if (IsHooked(ptiCurrent, WHF_CBT) && xxxCallHook(HCBT_SETFOCUS, (WPARAM)HWq(pwnd),
                (LPARAM)HW(ptiCurrent->pq->spwndFocus), WH_CBT)) {
            ThreadUnlock(&tlpwndTemp);
            return NULL;
        }

        /*
         * Activation must follow the focus.  That is, setting the focus to
         * a particualr window means that the top-level parent of this window
         * must be the active window (top-level parent is determined by
         * following the parent chain until you hit a top-level guy).  So,
         * we must activate this top-level parent if it is different than
         * the current active window.
         *
         * Only change activation if top-level parent is not the currently
         * active window.
         */
        if (pwndTemp != ptiCurrent->pq->spwndActive) {

            /*
             * If this app is not in the foreground, see if foreground
             * activation is allowed.
             */
            if (ptiCurrent->pq != gpqForeground && FAllowForegroundActivate(ptiCurrent->pq, pwndTemp)) {
                /*
                 * If the process lost the foreground activation right by giving
                 * focus to a hidden window, then give it the right back. See
                 * bug #401932 for how this might affect an app
                 */
                if (!TestWF(pwndTemp, WFVISIBLE)){
                    ptiCurrent->ppi->W32PF_Flags |= W32PF_ALLOWFOREGROUNDACTIVATE;
                }
                if (!xxxSetForegroundWindow2(pwndTemp, ptiCurrent, SFW_SETFOCUS)) {
                    ThreadUnlock(&tlpwndTemp);
                    return NULL;
                }
            }

            /*
             * This will return FALSE if something goes wrong.
             */
            if (pwndTemp != ptiCurrent->pq->spwndActive) {
                if (!xxxActivateThisWindow(pwndTemp, 0, 0)) {
                    ThreadUnlock(&tlpwndTemp);
                    return NULL;
                }
            }
        }

        /*
         * Save current pwndFocus since we must return this.
         */
        pwndTemp = ptiCurrent->pq->spwndFocus;
        ThreadUnlock(&tlpwndTemp);
        ThreadLockWithPti(ptiCurrent, pwndTemp, &tlpwndTemp);

        /*
         * Change the global pwndFocus and send the WM_{SET/KILL}FOCUS
         * messages.
         */
        xxxSendFocusMessages(ptiCurrent, pwnd);

0: kd> dv
           hDlg = 0x00010046
        message = 0x135
         wParam = 0x1010055
         lParam = 0n65608
      hBoldFont = 0x020a0165
      hbrWindow = 0x07100162
          Value = 0
       hwndAnim = 0x00000000
  hwndHelpTitle = 0x00000000
             lf = struct tagLOGFONTW
             rc = {LT(0, 0) RB(0, 39)  [0 x 39]}

0: kd> dx -id 0,0,894d43e0 -r1 ((win32k!tagQ *)0xe13d2de0)
((win32k!tagQ *)0xe13d2de0)                 : 0xe13d2de0 [Type: tagQ *]
    [+0x000] mlInput          [Type: tagMLIST]
    [+0x00c] ptiSysLock       : 0xe1401a68 [Type: tagTHREADINFO *]
    [+0x010] idSysLock        : 0x1 [Type: unsigned long]
    [+0x014] idSysPeek        : 0x0 [Type: unsigned long]
    [+0x018] ptiMouse         : 0xe1401a68 [Type: tagTHREADINFO *]
    [+0x01c] ptiKeyboard      : 0xe1401a68 [Type: tagTHREADINFO *]
    [+0x020] spwndCapture     : 0xbc64574c [Type: tagWND *]
    [+0x024] spwndFocus       : 0xbc64574c [Type: tagWND *]
    [+0x028] spwndActive      : 0xbc644c2c [Type: tagWND *]