QMSG

The QMSG structure (formally tagQMSG) is how WIN32K.SYS—and before it, WINSRV.DLL—dresses up a window message while it’s in a message queue. If you like, it is the internal wrapper around the documented MSG structure.

Documentation Status

The QMSG is not documented. Though symbol files for WIN32K.SYS in Windows 8 and higher name the QMSG in the C++ decorations of internal routines, type information for the structure is present only in symbol files for Windows 7—not before and not since.

Layout

The symbol files for Windows 7 are anyway incorrect. Windows 7 appended a MSGPPINFO which the symbol files have as four bytes even though the matching executable plainly understands the structure to be eight bytes. The size of the QMSG as given in the symbol file for the 32-bit WIN32K is thus wrong by four bytes. For the 64-bit build, the extra four bytes are covered by the QMSG structure’s eight-byte alignment. Over the whole history, the following changes of size are known:

For versions other than 6.1, these sizes, and the offsets that the next table shows for members, are obtained by inspecting the executable for correspondences with the executable from version 6.1 and assuming as much continuity as possible for the names or types. Microsoft’s names and types for members that have been added since version 6.1 may never be known.

QMSG *pqmsgNext;

QMSG *pqmsgPrev;

MSG msg;

LONG_PTR ExtraInfo;

POINT ptMouseReal;

DWORD dwQEvent;

struct {
    /*  bit fields, see below  */
};

DWORD dwQEvent;

struct {
    /*  bit fields, see below  */
};

THREADINFO *pti;

MSGPPINFO MsgPPInfo;

Description of the two sets of bit flags is a little complicated by their not being in union with an integral member for accessing them all together. The chronologically first flags were squeezed in as high bits of what had been the dwQEvent member as a DWORD—and later is because these high bits soon became the low bits of a new set of purposely designed bit fields.

DWORD dwQEvent : 31;

DWORD dwQEvent : 30;

DWORD Wow64Message : 1;

DWORD NoCoalesce : 1;

DWORD Padding : 2;

For the second set of flags, the following are known to be defined:

INT Wow64Message : 1;

INT NoCoalesce : 1;

INT FromTouch : 1;

INT FromPen : 1;

More have been defined since version 6.1, inevitably, but Microsoft’s names are not known.