Finding an SMS From an MQ

##dw smqsyslock l1
fd9f:000003d4  e55f
##dw e55f:0
e55f:00000000  e567 001a 0000 000a 0082 0186 0082 0082
e55f:00000010  a400 0006 0006 0006 003d 0009 001e 072a
e55f:00000020  08b3 db25 2549 00f5 0000 005d 0000 0001
e55f:00000030  0094 0000 0010 0000 0000 0000 0000 0000
e55f:00000040  0000 0000 0000 0000 0000 0000 0000 0000
e55f:00000050  0000 0000 0000 0000 0000 0000 4d24 0000
e55f:00000060  0000 0000 ec37 5453 061c 0000 0000 6c4c
e55f:00000070  ec6f 0002 0bff 0000 0000 0001 0000 0048
##.s 48
##.p 48
 Slot  Pid  Ppid Csid Ord  Sta Pri  pTSD     pPTDA    pTCB     Disp SG Name
 0048# 003d 0006 003d 0009 blk 0500 7b9b6000 7bb51cc4 7bb2f758 1eb8 1e turkey
##dw selsms l1
fd9f:00001c2a  ec5f
##dw ec5f:94
ec5f:00000094  0000 0094 0000 0000 db25 2549 e55f e557
ec5f:000000a4  0000 0000 0020 0000 0000 0023 002b 0071
ec5f:000000b4  6d2c ec6f 0001 0024 0000 0000 3ae8 253a
ec5f:000000c4  e8df ebe7 0000 0000 0002 1b70 0410 0005
ec5f:000000d4  0000 0051 156c ec6f 0001 0038 01a8 0008
ec5f:000000e4  003c 003c 0082 0172 0000 0000 712c 1ec0
ec5f:000000f4  0172 0082 003c 003c 0172 0082 01ae 00be
ec5f:00000104  0000 0000 0000 0000 0002 0045 0003 0000

##dw e557:0
e557:00000000  e55f 001a 0000 000a 0082 0186 0082 0082
e557:00000010  2fff 0400 0400 0400 003d 000a 001e 072e
e557:00000020  08b3 98f9 2529 0000 0000 0000 0000 0000
e557:00000030  0000 0000 0010 0000 0000 0000 0000 0000
e557:00000040  0000 0000 0000 0000 0000 0000 0000 0000
e557:00000050  0000 0000 0000 0000 0000 0000 4dc0 0000
e557:00000060  0000 0000 ec37 5453 061c 0000 0000 6ce0
e557:00000070  ec6f 0002 0bff 0000 0094 0001 0000 0049

The thread with the system queue locked is waiting for a response to WinSendMsg. MQ+0x30 has the sent SMS offset.

The SMS selector is found from selsms.

The key fields in the SMS are:

Offset

Description
+0x0
Chain pointer offset
+0xc
Sending MQ selector
+0xe
Receiving MQ selector
+0x1a
Message Parameter 2
+0x1c
Message Parameter 1
+0x1e
Message Id
+0x20
Offset to WND
+0x22
Selector to WND

In this example the message has been sent to slot 49.

We see that the message has yet to be dispatched since it is still queued on the receive list (MQ+0x78).

---

[Back: Finding an MQ and AAB Registers]
[Next: Finding a WND From an HWND]