// 線程參數結構
typedef struct _tagCreateParam {
    HWND hParent;
    HANDLE hEvent;
    HWND hBtn;
} CREATEPARAM, *PCREATEPARAM;
 
// 按鈕線程
DWORD WINAPI BtnThread(PVOID param)
{
    PCREATEPARAM p = (PCREATEPARAM)param;
    p->hBtn = CreateWindow(WC_BUTTON, _T("Button"), WS_CHILD | WS_VISIBLE,
        10, 10, 100, 50, p->hParent, (HMENU)1000, g_hInst, NULL);
    SetEvent(p->hEvent);
 
    MSG msg;
    while (GetMessage(&msg, NULL, 0, 0))
    {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }
    return 0;
}
 
// 父窗口的 WM_CREATE 處理器
BOOL OnCreate(HWND hwnd, LPCREATESTRUCT lpCreateStruct)
{
    CREATEPARAM cp = { 0 };
    cp.hParent = hwnd;
    cp.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
    g_hBtnThread = CreateThread(NULL, 0, BtnThread, &cp, 0, NULL);
    WaitForSingleObject(cp.hEvent, INFINITE);
 
    return TRUE;
}

PROCESS 8846b3a0  SessionId: 0  Cid: 19a0    Peb: 7ffd4000  ParentCid: 0a68
DirBase: 0ac802e0  ObjectTable: e729e9f0  HandleCount:  48.
Image: CreateWindowDeadLock.exe

0: kd> !process 8846b3a0
PROCESS 8846b3a0  SessionId: 0  Cid: 19a0    Peb: 7ffd4000  ParentCid: 0a68
DirBase: 0ac802e0  ObjectTable: e729e9f0  HandleCount:  48.
Image: CreateWindowDeadLock.exe
VadRoot 883463d0 Vads 53 Clone 0 Private 153. Modified 5. Locked 0.
DeviceMap e2ece800
Token                             e51e7d20
ElapsedTime                       00:07:34.421
UserTime                          00:00:00.046
KernelTime                        00:00:00.828
QuotaPoolUsage[PagedPool]         51068
QuotaPoolUsage[NonPagedPool]      2120
Working Set Sizes (now,min,max)  (745, 50, 345) (2980KB, 200KB, 1380KB)
PeakWorkingSetSize                749
VirtualSize                       19 Mb
PeakVirtualSize                   23 Mb
PageFaultCount                    769
MemoryPriority                    BACKGROUND
BasePriority                      8
CommitCharge                      247
DebugPort                         87e47780
 
THREAD 8a3d8020  Cid 19a0.1e68  Teb: 7ffdf000 Win32Thread: e4934a30 WAIT: (UserRequest) UserMode Non-Alertable
87fda2b8  NotificationEvent
Not impersonating
DeviceMap                 e2ece800
Owning Process            0       Image:
Attached Process          8846b3a0       Image:         CreateWindowDeadLock.exe
Wait Start TickCount      2036366        Ticks: 26911 (0:00:07:00.484)
Context Switch Count      305                 LargeStack
UserTime                  00:00:00.031
KernelTime                00:00:00.000
Win32 Start Address 0x004111ef
Start Address kernel32!BaseProcessStartThunk (0x7c810705)
Stack Init a5d0c740 Current a5d0c3e0 Base a5d0d000 Limit a5d09000 Call a5d0c74c
Priority 9 BasePriority 8 PriorityDecrement 0 DecrementCount 16
Kernel stack not resident.
ChildEBP RetAddr
a5d0c3f8 80504850 nt!KiSwapContext+0x2f (FPO: [Uses EBP] [0,0,4])
a5d0c404 804fc078 nt!KiSwapThread+0x8a (FPO: [0,0,0])
a5d0c42c 805c176c nt!KeWaitForSingleObject+0x1c2 (FPO: [5,5,4])
a5d0c490 8054263c nt!NtWaitForSingleObject+0x9a (FPO: [Non-Fpo])
a5d0c490 7c92e514 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ a5d0c4a4)
0012f480 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
 
THREAD 87fac560  Cid 19a0.1844  Teb: 7ffde000 Win32Thread: e726aeb0 WAIT: (WrUserRequest) UserMode Non-Alertable
884d66b0  SynchronizationEvent
Not impersonating
DeviceMap                 e2ece800
Owning Process            0       Image:
Attached Process          8846b3a0       Image:         CreateWindowDeadLock.exe
Wait Start TickCount      2038243        Ticks: 25034 (0:00:06:31.156)
Context Switch Count      41  NoStackSwap    LargeStack
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x00411226
Start Address kernel32!BaseThreadStartThunk (0x7c8106f9)
Stack Init a5a72000 Current a5a719f0 Base a5a72000 Limit a5a6e000 Call 0
Priority 10 BasePriority 8 PriorityDecrement 0 DecrementCount 16
ChildEBP RetAddr
a5a71a08 80504850 nt!KiSwapContext+0x2f (FPO: [Uses EBP] [0,0,4])
a5a71a14 804fc078 nt!KiSwapThread+0x8a (FPO: [0,0,0])
a5a71a3c bf802f45 nt!KeWaitForSingleObject+0x1c2 (FPO: [5,5,4])
a5a71a78 bf840f3c win32k!xxxSleepThread+0x192 (FPO: [3,5,4])
a5a71b14 bf8141ba win32k!xxxInterSendMsgEx+0x7f6 (FPO: [Non-Fpo])
a5a71b60 bf80ecc1 win32k!xxxSendMessageTimeout+0x11f (FPO: [7,7,0])
a5a71b84 bf83e1d0 win32k!xxxSendMessage+0x1b (FPO: [4,0,0]) ; <-- 注意這里
a5a71c6c bf834af7 win32k!xxxCreateWindowEx+0xd0d (FPO: [15,49,0])
a5a71d20 8054263c win32k!NtUserCreateWindowEx+0x1c1 (FPO: [Non-Fpo])
a5a71d20 7c92e514 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ a5a71d64)
00abfd98 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])

0: kd> dd a5a71b84 l6
a5a71b84  a5a71c6c bf83e1d0 bbf44570 00000210 ; <-- 注意這里
a5a71b94  03e80001 00101100