MinHook 对.NET底层的 SendMessage 拦截真实案例反思

痕厄 · 2025-6-10 12:58:20

一：背景

1. 讲故事

上一篇我们说到了 minhook 的一个简单使用，这一篇给大家分享一个 minhook 在 dump 分析中的实战，先看下面的线程栈。

0:044> ~~[138c]s
win32u!NtUserMessageCall+0x14:
00007ffc`5c891184 c3 ret
0:061> k
# Child-SP RetAddr Call Site
00 0000008c`00ffec68 00007ffc`5f21bfbe win32u!NtUserMessageCall+0x14
01 0000008c`00ffec70 00007ffc`5f21be38 user32!SendMessageWorker+0x11e
02 0000008c`00ffed10 00007ffc`124fd4af user32!SendMessageW+0xf8
03 0000008c`00ffed70 00007ffc`125e943b cogxImagingDevice!DllUnregisterServer+0x3029f
04 0000008c`00ffeda0 00007ffc`125e9685 cogxImagingDevice!DllUnregisterServer+0x11c22b
05 0000008c`00ffede0 00007ffc`600b50e7 cogxImagingDevice!DllUnregisterServer+0x11c475
06 0000008c`00ffee20 00007ffc`60093ccd ntdll!LdrpCallInitRoutine+0x6f
07 0000008c`00ffee90 00007ffc`60092eef ntdll!LdrpProcessDetachNode+0xf5
08 0000008c`00ffef60 00007ffc`600ae319 ntdll!LdrpUnloadNode+0x3f
09 0000008c`00ffefb0 00007ffc`600ae293 ntdll!LdrpDecrementModuleLoadCountEx+0x71
0a 0000008c`00ffefe0 00007ffc`5cd7c00e ntdll!LdrUnloadDll+0x93
0b 0000008c`00fff010 00007ffc`5d47cf78 KERNELBASE!FreeLibrary+0x1e
0c 0000008c`00fff040 00007ffc`5d447aa3 combase!CClassCache::CDllPathEntry::CFinishObject::Finish+0x28 [onecore\com\combase\objact\dllcache.cxx @ 3420]
0d 0000008c`00fff070 00007ffc`5d4471a9 combase!CClassCache::CFinishComposite::Finish+0x4b [onecore\com\combase\objact\dllcache.cxx @ 3530]
0e 0000008c`00fff0a0 00007ffc`5d3f1499 combase!CClassCache::FreeUnused+0xdd [onecore\com\combase\objact\dllcache.cxx @ 6547]
0f 0000008c`00fff650 00007ffc`5d3f13c7 combase!CoFreeUnusedLibrariesEx+0x89 [onecore\com\combase\objact\dllapi.cxx @ 117]
10 (Inline Function) --------`-------- combase!CoFreeUnusedLibraries+0xa [onecore\com\combase\objact\dllapi.cxx @ 74]
11 0000008c`00fff690 00007ffc`6008a019 combase!CDllHost::MTADllUnloadCallback+0x17 [onecore\com\combase\objact\dllhost.cxx @ 929]
12 0000008c`00fff6c0 00007ffc`6008bec4 ntdll!TppTimerpExecuteCallback+0xa9
13 0000008c`00fff710 00007ffc`5f167e94 ntdll!TppWorkerThread+0x644
14 0000008c`00fffa00 00007ffc`600d7ad1 kernel32!BaseThreadInitThunk+0x14

复制代码

这是一个 .NET某工控自动化控制系统(https://www.cnblogs.com/huangxincheng/p/16544462.html) 的卡死故障，经过一顿分析之后，找到了最后的卡死原因，即 cogxImagingDevice.dll 中有一个 DllMain 的卸载通知，熟悉 win32 的朋友都知道，代码经过 DllMain 的时候会持有一个 LdrpAcquireLoaderLock 进程加载锁，在持锁过程中它突然向一个窗体发送 SendMessageW 消息，可惜的是这个窗体没有给予响应，一直卡死在这里，这就导致进程加载锁迟迟得不到释放，引发系统性卡死。。。
如果有朋友还是比较懵的话，我画一张图给大家看看，黑色加粗就是问题的核心所在。

二：寻找解决方案

1. 现有困境

我可以通过 windbg 提取到 SendMessageW 方法的窗口句柄 hWnd，通过这个 hWnd 找到创建它的 processID 和 ThreadID，但问题是这两个关键信息是存放在当前机器的内核态中，言外之意就是用户态dump没有这两个信息，所以关键信息的缺失导致无法有效的排查出问题。
解决办法有两个:

抓内核态dump：由于 win32u 模块是闭源的，要想从内核态dump中找出还得不断的参考 reactos，费时费力。
SendMessageW跟踪：这个相对来说轻量级，也是本篇重点说的，即 minhook。

2. 如何跟踪 SendMessageW

我的想法是这样的，对 SendMessageW 进行拦截来获取 hWnd 参数，然后通过 hWnd 参数找到对应的 processid 和 threadid，然后再通过 processid 获取 processname，有了这三个信息就可以让对方无所遁形。
为了让大家眼见为实，我们做一个例子，新建一个 WindowsProject1 的Win32窗体，在网关函数 WndProc 中故意让程序卡死，参考代码如下：

LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
if (message == WM_CLOSE) {
Sleep(1000 * 1000);
}
// todo....
return 0;
}

复制代码

接下来新建一个 ConsoleApplication 控制台程序，通过 SendMessage 给 WindowsProject1 打close消息，来演示无故卡死，完整的代码如下：

using System;
using System.Runtime.InteropServices;
using System.Text;
namespace ConsoleApplication
{
public static class Program
{
private const uint WM_CLOSE = 0x0010;
public static void Main()
{
// 安装 Hook
HookManager.InstallHook();
// 测试：发送 WM_CLOSE 消息（会触发 Hook）
IntPtr hWnd = FindWindow(null, "WindowsProject1");
if (hWnd != IntPtr.Zero)
{
SendMessage(hWnd, WM_CLOSE, IntPtr.Zero, IntPtr.Zero);
Console.WriteLine("Sent WM_CLOSE to target window.");
}
else
{
Console.WriteLine("Target window not found.");
}
Console.ReadKey();
// 卸载 Hook
HookManager.UninstallHook();
}
[DllImport("user32.dll", CharSet = CharSet.Unicode)]
private static extern IntPtr FindWindow(string lpClassName, string lpWindowName);
[DllImport("user32.dll", CharSet = CharSet.Unicode)]
private static extern IntPtr SendMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam);
}
public static class HookManager
{
// SendMessageW 的原始函数签名
[UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode)]
private delegate IntPtr SendMessageWDelegate(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam);
private static SendMessageWDelegate _originalSendMessageW;
private static IntPtr _sendMessageWPtr = IntPtr.Zero;
public static void InstallHook()
{
// 1. 获取 SendMessageW 的地址
_sendMessageWPtr = MinHook.GetProcAddress(
MinHook.GetModuleHandle("user32.dll"), "SendMessageW");
if (_sendMessageWPtr == IntPtr.Zero)
{
Console.WriteLine("Failed to find SendMessageW address.");
return;
}
// 2. 初始化 MinHook
var status = MinHook.MH_Initialize();
if (status != MinHook.MH_STATUS.MH_OK)
{
Console.WriteLine($"MH_Initialize failed: {status}");
return;
}
// 3. 创建 Hook
var detourPtr = Marshal.GetFunctionPointerForDelegate(
new SendMessageWDelegate(HookedSendMessageW));
status = MinHook.MH_CreateHook(_sendMessageWPtr, detourPtr, out var originalPtr);
if (status != MinHook.MH_STATUS.MH_OK)
{
Console.WriteLine($"MH_CreateHook failed: {status}");
return;
}
_originalSendMessageW = Marshal.GetDelegateForFunctionPointer<SendMessageWDelegate>(originalPtr);
// 4. 启用 Hook
status = MinHook.MH_EnableHook(_sendMessageWPtr);
if (status != MinHook.MH_STATUS.MH_OK)
{
Console.WriteLine($"MH_EnableHook failed: {status}");
return;
}
Console.WriteLine("SendMessageW hook installed successfully!");
}
public static void UninstallHook()
{
if (_sendMessageWPtr == IntPtr.Zero)
return;
// 1. 禁用 Hook
var status = MinHook.MH_DisableHook(_sendMessageWPtr);
if (status != MinHook.MH_STATUS.MH_OK)
Console.WriteLine($"MH_DisableHook failed: {status}");
// 2. 卸载 MinHook
status = MinHook.MH_Uninitialize();
if (status != MinHook.MH_STATUS.MH_OK)
Console.WriteLine($"MH_Uninitialize failed: {status}");
_sendMessageWPtr = IntPtr.Zero;
Console.WriteLine("Hook uninstalled.");
}
private static IntPtr HookedSendMessageW(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam)
{
Console.WriteLine($"[HOOK] SendMessageW: hWnd=0x{hWnd.ToInt64():X}, Msg=0x{Msg:X}");
// 获取窗口所属的线程和进程ID
uint processId = 0;
uint threadId = GetWindowThreadProcessId(hWnd, out processId);
// 使用 System.Diagnostics.Process 获取进程信息
string processName = "Unknown";
try
{
var targetProcess = System.Diagnostics.Process.GetProcessById((int)processId);
processName = targetProcess.ProcessName;
Console.WriteLine($"Window belongs to - ThreadID: {threadId}, ProcessID: {processId}, ProcessName: {processName}");
}
catch (Exception ex)
{
Console.WriteLine(ex.Message);
}
// 调用原始函数
return _originalSendMessageW(hWnd, Msg, wParam, lParam);
}
// 需要的Win32 API声明
[DllImport("user32.dll", SetLastError = true)]
static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint processId);
}
public static class MinHook
{
public enum MH_STATUS
{
MH_OK = 0,
MH_ERROR_ALREADY_INITIALIZED,
MH_ERROR_NOT_INITIALIZED,
// ... 其他状态码
}
[DllImport("MinHook.x86.dll", CallingConvention = CallingConvention.Cdecl)]
public static extern MH_STATUS MH_Initialize();
[DllImport("MinHook.x86.dll", CallingConvention = CallingConvention.Cdecl)]
public static extern MH_STATUS MH_Uninitialize();
[DllImport("MinHook.x86.dll", CallingConvention = CallingConvention.Cdecl)]
public static extern MH_STATUS MH_CreateHook(IntPtr pTarget, IntPtr pDetour, out IntPtr ppOriginal);
[DllImport("MinHook.x86.dll", CallingConvention = CallingConvention.Cdecl)]
public static extern MH_STATUS MH_EnableHook(IntPtr pTarget);
[DllImport("MinHook.x86.dll", CallingConvention = CallingConvention.Cdecl)]
public static extern MH_STATUS MH_DisableHook(IntPtr pTarget);
[DllImport("kernel32.dll", CharSet = CharSet.Unicode)]
public static extern IntPtr GetModuleHandle(string lpModuleName);
[DllImport("kernel32.dll", CharSet = CharSet.Ansi)]
public static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);
}
}

复制代码

最核心的代码是上面的 HookedSendMessageW，大家可以多品鉴品鉴，接下来依次运行 WindowsProject1 和 ConsoleApplication 程序，输出如下：

从输出看，是不是一下子就把排查范围缩小了很多，最起码我知道是一个叫 WindowsProject1 的进程坏了我的好事，后续就可以针对 WindowsProject1 深入探究为何方神物。。。
3. 还能更完美一点吗

虽然排查范围极大的缩小了，还但是有一点不完美，如果这个窗口是本进程创建的还好，如果不是本进程创建的，最好能抓到对方进程的dump那就真完美了。。。
接下来的问题是怎么抓对方进程的dump呢？为了确保通用性，我建议在本进程中调 procdump 自动捕获，参考代码如下：

namespace ConsoleApplication
{
public class DumpGen
{
// 生成进程 Dump 文件
public static void GenerateProcessDump(int processId, string dumpPath)
{
try
{
// ProcDump 命令行参数：
// -mm: 生成 MiniDump
// -accepteula: 自动接受许可协议（避免首次运行时弹出提示）
string procDumpPath = $@"{Environment.CurrentDirectory}\procdump.exe";
string arguments = $"-accepteula -mm {processId} "{dumpPath}"";
var startInfo = new ProcessStartInfo
{
FileName = procDumpPath,
Arguments = arguments,
UseShellExecute = false,
CreateNoWindow = true,
RedirectStandardOutput = true,
RedirectStandardError = true
};
using (var proc = new Process { StartInfo = startInfo })
{
proc.Start();
proc.WaitForExit();
Console.WriteLine("Dump captured successfully");
}
}
catch (Exception ex)
{
Console.WriteLine($"Failed to launch ProcDump: {ex.Message}");
}
}
}
}

复制代码

然后修改下 HookedSendMessageW 方法，如果 _originalSendMessageW 超时，将会自动抓取dump，当然这里只是一个简单的演示，更复杂的逻辑大家可以根据自己的情况编写，比如用一个字典来存放 hWnd，然后根据超时时间自动的抓取进程的dump，参考代码如下：

private static IntPtr HookedSendMessageW(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam)
{
Console.WriteLine($"[HOOK] SendMessageW: hWnd=0x{hWnd.ToInt64():X}, Msg=0x{Msg:X}");
// 获取窗口所属的线程和进程ID
uint processId = 0;
uint threadId = GetWindowThreadProcessId(hWnd, out processId);
// 使用 System.Diagnostics.Process 获取进程信息
string processName = "Unknown";
try
{
var targetProcess = System.Diagnostics.Process.GetProcessById((int)processId);
processName = targetProcess.ProcessName;
Console.WriteLine($"Window belongs to - ThreadID: {threadId}, ProcessID: {processId}, ProcessName: {processName}");
//定时检测代码：如果超时自动抓取dump
Task.Run(() =>
{
Thread.Sleep(3000);
if (Msg == 0x0010)
{
string dumpPath = Path.Combine(Environment.CurrentDirectory, $"ProcessDump_{processName}_{DateTime.Now:yyyyMMddHHmmss}.dmp");
DumpGen.GenerateProcessDump(targetProcess.Id, dumpPath);
Console.WriteLine($"Launching ProcDump to generate dump: {dumpPath}");
}
});
}
catch (Exception ex)
{
Console.WriteLine(ex.Message);
}
// 调用原始函数
return _originalSendMessageW(hWnd, Msg, wParam, lParam);
}

复制代码

一切都搞定之后，运行下程序，截图如下：

打开生成好的dump文件，找到目标线程，参考如下：

0:000> ~
. 0 Id: 4f34.338c Suspend: 0 Teb: 009c2000 Unfrozen
1 Id: 4f34.6470 Suspend: 0 Teb: 009d2000 Unfrozen
2 Id: 4f34.62a8 Suspend: 0 Teb: 009d6000 Unfrozen
0:000> ? 4f34 ; ? 338c; k
Evaluate expression: 20276 = 00004f34
Evaluate expression: 13196 = 0000338c
# ChildEBP RetAddr
00 00b3f910 77a23999 ntdll!NtDelayExecution+0xc
01 00b3f930 776a8760 ntdll!RtlDelayExecution+0xe9
02 00b3f998 776a86ff KERNELBASE!SleepEx+0x50
03 00b3f9a8 00f81be3 KERNELBASE!Sleep+0xf
04 00b3fae8 76b36d13 WindowsProject1!WndProc+0x43 [D:\sources\woodpecker\ConsoleApplication\WindowsProject1\WindowsProject1.cpp @ 127]
05 00b3fb14 76b2540d user32!_InternalCallWinProc+0x2b
06 00b3fc18 76b24eb0 user32!UserCallWinProcCheckWow+0x49d
07 00b3fc7c 76b31709 user32!DispatchClientMessage+0x190
08 00b3fcb8 77a0bb66 user32!__fnDWORD+0x39
09 00b3fcf0 76b33ef0 ntdll!KiUserCallbackDispatcher+0x36
0a 00b3fd2c 00f81e9b user32!GetMessageW+0x30
0b 00b3fe44 00f8273d WindowsProject1!wWinMain+0xbb [D:\sources\woodpecker\ConsoleApplication\WindowsProject1\WindowsProject1.cpp @ 46]
0c 00b3fe64 00f8258a WindowsProject1!invoke_main+0x2d [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 123]
0d 00b3fec0 00f8241d WindowsProject1!__scrt_common_main_seh+0x15a [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288]
0e 00b3fec8 00f827b8 WindowsProject1!__scrt_common_main+0xd [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 331]
0f 00b3fed0 76705d49 WindowsProject1!wWinMainCRTStartup+0x8 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_wwinmain.cpp @ 17]
10 00b3fee0 779fcebb kernel32!BaseThreadInitThunk+0x19
11 00b3ff38 779fce41 ntdll!__RtlUserThreadStart+0x2b
12 00b3ff48 00000000 ntdll!_RtlUserThreadStart+0x1b

复制代码

从卦中看，原来卡死是因为主线程正在 KERNELBASE!Sleep，无语了，到此为止，这次卡死事故真相大白于天下。
三：总结

再回头看文章开头的 cogxImagingDevice.dll 导致的程序卡死，如果用本篇的解决方案，是不是非常的轻量级，从此以后再也不需要抓内核的dump，也不需要在客户的电脑上用 spy++ 捣鼓来捣鼓去了。。。完美！

来源：程序园用户自行投稿发布，如果侵权，请联系站长删除
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！

账号		自动登录	找回密码
密码			立即注册

MinHook 对.NET底层的 SendMessage 拦截真实案例反思

浏览过的版块

签约作者