{"id":116,"date":"2009-03-05T00:08:18","date_gmt":"2009-03-05T00:08:18","guid":{"rendered":"http:\/\/entrian.com\/blog\/?p=116"},"modified":"2021-07-15T08:29:33","modified_gmt":"2021-07-15T08:29:33","slug":"setting-a-visual-studio-breakpoint-on-a-win32-api-function-in-user32dll","status":"publish","type":"post","link":"https:\/\/entrian.com\/blog\/setting-a-visual-studio-breakpoint-on-a-win32-api-function-in-user32dll\/","title":{"rendered":"Setting a Visual Studio breakpoint on a Win32 API function in user32.dll"},"content":{"rendered":"

I recently had a problem with my Windows application causing the desktop icons to flicker.  I knew that the LockWindowUpdate<\/code> API could cause that, but I also knew I didn’t use it.  Maybe one of the libraries I use (MFC?) was doing it.<\/p>\n

So I wanted to set a Visual Studio breakpoint on that API’s location.  I tried
\n{,,user32.dll}_LockWindowUpdate@4<\/code> but that didn’t work.  I knew that {,,user32.dll}_SendMessageA@16<\/code> works for setting a breakpoint on SendMessage<\/code> (which is also in user32.dll), so why doesn’t the same thing work for LockWindowUpdate<\/code>?<\/p>\n

It turns out that the function is called NtUserLockWindowUpdate<\/code> as far as the debugger is concerned, so you need to use {,,user32.dll}_NtUserLockWindowUpdate@4<\/code><\/p>\n

I don’t know which other APIs have that NtUser<\/code> prefix, but I bet there are some.<\/p>\n

Interestingly, the exported symbol as reported by Dependency Walker<\/a> is called LockWindowUpdate<\/code> – it’s only in the debug symbols that it’s NtUserLockWindowUpdate<\/code>.  I used Dependency Walker to find the symbol’s address: my breakpoint for SendMessage<\/code> was at 7D94B5BA and Dependency Walker told me that its export address was 1b5ba.  LockWindowUpdate<\/code> was exported at 27d5c, so a quick bit of maths pointed me to 7D957D5C, and hence the real name of the function:<\/p>\n

\"NtUserLockWindowUpdate\"<\/p>\n

(By the way, Raymond Chen’s series of posts on LockWindowUpdate<\/code> are required reading for anyone thinking of using it: What does LockWindowUpdate do?<\/a>)<\/p>\n","protected":false},"excerpt":{"rendered":"

How to set a breakpoint in a user32.dll function when Microsoft’s debug symbols give it an unexpected name.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-116","post","type-post","status-publish","format-standard","hentry","category-30days"],"_links":{"self":[{"href":"https:\/\/entrian.com\/blog\/wp-json\/wp\/v2\/posts\/116","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/entrian.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/entrian.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/entrian.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/entrian.com\/blog\/wp-json\/wp\/v2\/comments?post=116"}],"version-history":[{"count":1,"href":"https:\/\/entrian.com\/blog\/wp-json\/wp\/v2\/posts\/116\/revisions"}],"predecessor-version":[{"id":1161,"href":"https:\/\/entrian.com\/blog\/wp-json\/wp\/v2\/posts\/116\/revisions\/1161"}],"wp:attachment":[{"href":"https:\/\/entrian.com\/blog\/wp-json\/wp\/v2\/media?parent=116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/entrian.com\/blog\/wp-json\/wp\/v2\/categories?post=116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/entrian.com\/blog\/wp-json\/wp\/v2\/tags?post=116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}