title: Finding out the messages count in thread message queue from a memory dump
body: <p>I aware of the fact that it’s not possible to determine how many messages are in the thread queue at any given time with any sort of Win API calls. I’ve an application that doesn’t work because PostMessage fails sometimes (possibly due to the queue growing to 10000, although I don’t see how could it grow so big). It’s an intermittent issue and I have several memory dumps taken at exactly the moment when it happens.
  Obviously the queue has to be somewhere and this article explains how to get it <a href="http://moyix.blogspot.com/2008_09_01_archive.html">http://moyix.blogspot.com/2008_09_01_archive.html</a></p>
  
  <blockquote>
    <p>Each thread in Windows (represented by the _ETHREAD strucutre) has a
    field in its Thread Control Block (or Tcb, which is a _KTHREAD) called
    Win32Thread. This field points to a data structure, _W32THREAD, which
    is defined in the kernel-mode portion of the Windows graphical
    subsystem, win32k.sys. You can actually examine the _W32THREAD
    structure by issuing "dt win32k!_W32THREAD" in WinDbg; however, if you
    start reverse engineering win32k.sys, you'll quickly find that the
    information given there is far from complete. In fact, _W32THREAD is a
    much larger data structure, which includes information about the
    current desktop, keyboard layout, installed window hooks, and, most
    importantly for us, the input message queue. In Windows XP SP2, the
    message queue is found at offset 0xD0 of _W32THREAD, and looks like:</p>
  
  <pre><code>typedef struct _MSG_QUEUE  {   PMSG_QUEUE_ENTRY Head; 
  PMSG_QUEUE_ENTRY Tail;  unsigned long NumberOfMessages;   } MSG_QUEUE;
  </code></pre>
  </blockquote>
  
  <p>Basically I’m trying to find a pointer MSG_QUEUE (which will give me NumberOfMessages, plus I can enumerate them starting from Head). However it doesn't look I can find pointers to any of _ETHREAD, _KTHREAD and _W32THREAD by analyzing memory dump. Where exactly are they stored, are they in process memory space? Do I have to run in kernel mode? Do I need to load symbols for win32k.sys? Anything else I need to do? Thanks.</p>