Window postmessage

Download demo - 84.4 KB Download source - 136.2 KBIntroductionThis topic focuses on two things: What is the difference between SendMessage and PostMessage How to use SendMessage, PostMessage with WM_KEYDOWN. The way to find LParam and RParam parametersTo understand what is the difference between SendMessage and PostMessage, please look at the below table.What is the Difference between SendMessage, PostMessage SendMessage PostMessage Sends the specified message to a window or windows. The SendMessage function calls the window procedure for the specified window and does not return until the window procedure has processed the message (from MSDN) Places (posts) a message in the message queue associated with the thread that created the specified window and returns without waiting for the thread to process the message (from MSDN) Sequentially Not sequentially synchronous asynchronous How to Use SendMessage, PostMessage?Parameters? HWND is a handle you want to seed message to this window WPARAM, you can view here: The virtual-key code of the nonsystem key. LPARAM, you can know through Notepad program and Microsoft spy++How to Find LParam First, you must download Microsoft spy++. If you install Microsoft Visual 2012, Microsoft spy ++ will be integrated I will demo how to get LParam with VK_KEYDOWN, value through some basic steps (Same as, you can do it with VK_DOWN, VK_LEFT, .... key) Now open Notepad by run -> notepad Open your Microsoft Spy ++ (Built-in Microsoft Visual Studio 2012 ++) Next, Click to menu Spy -> FindWindows, using cross circle on the red frame. Drag this cross circle to Notepad on this edit area: Click choose Messages properties same as the below picture. Then click ok. Let's press RETURN key to Edit Area, you can easily see WM_KEYDOWN message on Microsoft Spy++ Dash Broad. Then, right click to that message and choose properties, you can easily know

LPARAM and WPARAM value. My LPARAM value found: 0x0001C001 and RPARAM value: 0x0000000D::PostMessage(hHandle, WM_KEYDOWN, VK_RETURN, 0x001C0001);::SendMessage(hHandle, WM_KEYDOWN, VK_RETURN, 0x001C0001);Using the Source CodeUsing FindWindowA and FindWindowExAPI for get window handle:HWND hwnd = FindWindowA("Notepad", NULL );HWND hWndChild = ::FindWindowEx(hwnd, NULL, L"Edit", NULL);BOOL CReadInfomationGameDlg::OnInitDialog(){ CDialog::OnInitDialog(); ASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX); ASSERT(IDM_ABOUTBOX 0xF000); CMenu* pSysMenu = GetSystemMenu(FALSE); if (pSysMenu != NULL) { CString strAboutMenu; strAboutMenu.LoadString(IDS_ABOUTBOX); if (!strAboutMenu.IsEmpty()) { pSysMenu->AppendMenu(MF_SEPARATOR); pSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu); } } SetIcon(m_hIcon, TRUE); SetIcon(m_hIcon, FALSE); CString strCommand[] = { L"learn-tech-tips", L" L"huuvi168@gmail.com", L"zidane" L" }; int length = sizeof(strCommand) / sizeof(strCommand[0]); for (int i=0; ilength; i++) m_cbCommand.AddString(strCommand[i]); return TRUE; }HWND CReadInfomationGameDlg::GetHandleOfWindow(void){ HWND hwnd = FindWindowA("Windows abc Class", NULL ); if (!hwnd) { MessageBox(_T("Window abc not found"), _T("Message"), MB_OK | MB_ICONINFORMATION); return NULL; } return hwnd;}void CReadInfomationGameDlg::OnBnClickedButtonAddmessage(){ HWND hHandle = GetHandleOfWindow(); CString strCBText; int nIndex = m_cbCommand.GetCurSel(); if (nIndex == -1) { TCHAR strTemp[255]; memset(strTemp, 0x00, sizeof(strTemp)); GetDlgItemText(IDC_COMBO_COMMAND, strTemp, sizeof(strTemp)); PostChatMessage(hHandle, strTemp); } else { m_cbCommand.GetLBText(nIndex, strCBText); PostChatMessage(hHandle, strCBText); }}void CReadInfomationGameDlg::PostChatMessage(HWND hHandle, LPCTSTR szChatMsg){ ::PostMessage(hHandle, WM_KEYDOWN, VK_RETURN, 0x001C0001); ::PostMessage(hHandle, WM_KEYDOWN, VK_DOWN, 0x00500001); while (szChatMsg[0]) { ::PostMessage(hHandle, WM_CHAR, LOBYTE(szChatMsg[0]),0); szChatMsg++; } ::PostMessage(hHandle, WM_KEYDOWN, VK_RETURN, 0x001C0001);}Points of InterestI like coding, I like researching new technology.My tech blog is blog sharing experiences about technology tips and trick include: language programming: C+, C#, ....Design skills: photoshop, Office: Excel, Outlook and .... other things!If you have any feedback about this topic, please leave your comment, we can discuss about it.

Your add-on bythe same user.There are two potential uses for the login_hint parameter:Pass the login_hint value during the authentication flow so that theuser doesn't need to enter their credentials when the sign-in dialogappears. The user is not automatically signed-in.After the user has been signed-in, use this parameter to compare thevalue to any users you might already have signed-in to the add-on. Ifyou find a match, you can leave the user signed-in and avoid showing asign-in flow. If the parameter doesn't match any of your signed-inusers, prompt the user to sign-in with a Google branded sign-inbutton.Included with all iframes.Attachment Discovery iframeDimensionDescriptionRequiredYesURIProvided in the add-on metadataQuery ParamscourseId, itemId, itemType,addOnToken, and login_hint.Height80% window height minus 60px for the top headerWidthMaximum of 1600px 90% window width when window 80% window width when window > 600px wideExample Attachment Discovery scenarioA Classroom add-on is registered in Google WorkspaceMarketplace with an Attachment Discovery URI of teacher installs this add-on and creates a new announcement, assignment ormaterial within one of their courses. For example, itemId=234,itemType=courseWork and courseId=123.While configuring that item, the teacher chooses the newly installed add-onas an attachment.Classroom creates an iframe with the src URL set to performs work within the iframe to make an attachment selection.On attachment selection, the add-on sends a postMessage toClassroom to close the iframe.teacherViewUri and studentViewUri iframesDimensionDescriptionRequiredYesURIteacherViewUri or studentViewUriQuery ParamscourseId, itemId, itemType,attachmentId, and login_hint.Height100% window height minus 140px for the top headerWidth100% window widthstudentWorkReviewUri iframeDimensionDescriptionRequiredNo (Determines whether this is an activity-type attachment)URIstudentWorkReviewUriQuery ParamscourseId, itemId, itemType,attachmentId, submissionId, and login_hint.Height100% window height minus 168px for the top headerWidth100% window width minus sidebar width sidebar is 312pxwhen expanded and 56px when collapsedLink Upgrade iframeDimensionDescriptionRequiredYes, if upgrading links to add-on attachments issupported by your add-on.URIProvided in the add-on metadataQuery ParamscourseId, itemId, itemType,addOnToken, urlToUpgrade, and login_hint.Height80% window height minus 60px for the top headerWidthMaximum of 1600px 90% window width when window 80% window width when window > 600px wideExample Link Upgrade scenarioA Classroom add-on is registered with a Link Upgrade URI of You have provided the following host and pathprefix patterns for Link attachments that Classroom shouldattempt to upgrade to an add-on attachment:The host is example.com and the path prefix is /quiz.A teacher creates a new announcement, assignment or material within one oftheir courses. For example, itemId=234, itemType=courseWork andcourseId=123.A teacher pastes a link, in the Linkattachment dialog that matches a URL pattern you provided. The teacher isthen prompted to upgrade the Link to an add-on attachment.Classroom launches the Link Upgrade iframe with the URL setto evaluate the query parameters passed on the iframe and make a call tothe CreateAddOnAttachment endpoint. Note that the urlToUpgrade queryparameter is URI encoded when passed on the iframe. You need to decode theparameter to obtain it in its original form. JavaScript, for example, offersthe decodeURIComponent() function.On successful creation of an add-on attachment from a Link, you send apostMessage to Classroom to close the iframe.Close the iframeThe iframe may be closed from the learning tool by sending a postMessage withthe payload {type: 'Classroom', action: 'closeIframe'}.Classroom only accepts this postMessage from the host_name+portcorresponding to

PwnFoxPwnFox is a Firefox/Burp extension that provide usefull tools for your security audit.If you are a chrome user you can check click BurpProxyContainers ProfilesPostMessage LoggerToolboxSecurity header removerInstallationBuildAllFirefoxBurpChangelogFeaturesSingle click BurpProxyConnect to Burp with a simple click, this will probably remove the need for other addons like foxyProxy. However if you need the extra features provided by foxyProxy you can leave this unchecked.Containers ProfilesPwnFox give you fast access to the Firefox containers. This allow you to have multiple identities in the same browser.When PwnFox and the Add container header option are enabled, PwnFox will automatically add a X-PwnFox-Color header to hightlight the query in Burp.PwnFoxBurp will automatically highlight and strip the header, but you can also specify your own behavior with addons like logger++.PostMessage LoggerPwnFox add a new message tab in you devtool. This allow you to quickly visualize all postMessage between frames.You can also provide your own function to parse/filter the messages.You get access to 3 arguments:data -> the message dataorigin -> the window object representing the origindestion -> the window object representing the destinationYou can return a string or a JSON serializable object.ToolboxInject you own javascript code on page load. The code will be loaded as soon as possible. This can used to add dangerous behavior detection, or just to add extra function to your js console.Be carefull, the injected toolbox will run in the window context. Do not inject secret in untrusted domain.I will publish some of my toolbox soon (ENOTIME)Security header removerSometime it's easier to work with security header disabled. You can now do it with a single button press. Don't forget to reenable them before testing your final payload.Headers stripped:Content-Security-PolicyX-XSS-ProtectionX-Frame-OptionsX-Content-Type-OptionsInstallationYou can find the latest build here: about:addons and choose install from file, then select PwnFox-$version.xpior install from to extender and add PwnFox-Burp.jar as a java extension.BuildFirefoxcd firefoxweb-ext

That got recalculated during a performance recording:In the Performance tool, click the Capture settings () button, and then select the Enable advanced rendering instrumentation (slow) checkbox.DevTools displays aggregate information about the selectors of the CSS rules that were recalculated during the recording in the Selector Stats tab:In the Main section, select a Recalculate Style event. In the Selector Stats tab, DevTools displays information about the selectors of the CSS rules that were recalculated during that event.View messages between windows, iframes, and dedicated workersThe DevTools experiment Timeline: Show postMessage dispatch and handling flows improves the Performance tool's Main section to help you quickly identify postMessage events and handlers, by distinguishing events that are triggered by the postMessage method from other events that are displayed in the Performance tool. This experiment helps you investigate performance issues that are related to posting messages across various threads of an application.Without this experiment, events that are triggered by dispatching and handling messages between threads of an application appear as generic scripting function-call events. With this experiment enabled:postMessage dispatch events appear as Schedule postMessage.postMessage handler events appear as On Message:This experiment helps you investigate when a postMessage call occurred, and how long the message was queued before the postMessage handler starts. The dispatch events are linked to handler events by initiator arrows that appear when you click on either type of event:To use this feature, in DevTools, select Customize and control DevTools () > Settings > Experiments, select the checkbox Timeline: Show postMessage dispatch and handling flows, click the Close (X) button, and then click the Reload DevTools button.See also:Performance recording event referencepostMessage Trace Events demo (rendered)postMessage Trace Events demo (source code)Use the Rendering tool to help visualize the rendering performance of your page.To open the Rendering tool:To open DevTools, right-click the webpage, and then select Inspect. Or, press Ctrl+Shift+I (Windows, Linux) or Command+Option+I (macOS). DevTools opens.In DevTools, on the Activity Bar, click the More tools () button.Click Rendering in the dropdown menu. The Rendering tool appears:View frames per second in realtime with the FPS meterThe FPS meter is an overlay that appears in the top-left