I am following this tutorial: enter link description here
Though it uses Olly I am following with IDA.
Basically i am tying to catch where a popup decision is taking place in the program. I though i placed a BP on the right spot. What I don't understand is this: When I placed only one BP on this location: and I run the debugger, it stops on this BP. I press F8 and it continues to "push esi", F8 and I get the pop up message I was looking for.
However, when I place another BP on this location - this one was deducted from the tutorial which uses Olly. And i follow the same debugging procedure; I press F8 and it continues to "push esi", F8 and It stoops on the new BP @0043F812 and only after pressing F8 again i get the popup after it calls "DialogBoxParamA".
So my question is why do I not get to DialogBoxParamA @43F818 when i obly place 1 BP? How can i jump from "DispatchMessageA" which is an external all to @43F818 ?
I'll try to visualize this:
Should not I be able to follow the same trace regardless on the number of BPs?
Below are the 2 trace logs. 1 - trace log with only 1 BP, this one is very
Thread Address Instruction Result
00002378 .text:sub_442C44+2D4 Memory layout changed: 505 segments Memory layout changed: 505 segments
00002378 ST0=FFFFFFFFFFFFFFFF ST1=FFFFFFFFFFFFFFFF ST2=FFFFFFFFFFFFFFFF ST3=FFFFFFFFFFFFFFFF ST4=FFFFFFFFFFFFFFFF ST5=FFFFFFFFFFFFFFFF ST6=FFFFFFFFFFFFFFFF ST7=FFFFFFFFFFFFFFFF CTRL=FFFF CS=0023 DS=002B ES=002B FS=0053 GS=002B SS=002B EAX=00000000 EBX=00000000 ECX=741B2E09 EDX=00000000 ESI=0018E6C0 EDI=00000000 EBP=00000000 ESP=0018E6BC EFL=00200246 XMM0= XMM1= XMM2= XMM3= XMM4= XMM5= XMM6= XMM7= MXCSR=FFFFFFFF MM0= MM1= MM2= MM3=
00002378 .text:sub_442C44+2D4 call TranslateMessage; Call Procedure ECX=0018E6C0 EDX=0000000F ESP=0018E6C0 EFL=00200244
00002378 .text:sub_442C44+2D9 Memory layout changed: 522 segments Memory layout changed: 522 segments
00002378 .text:sub_442C44+2D9 push esi; lpMsg ESP=0018E6BC EFL=00200246
************* 2nd TRACE with 2 BP ****************
Thread Address Instruction Result
00002280 .text:sub_442C44+2D4 Memory layout changed: 505 segments Memory layout changed: 505 segments
00002280 ST0=FFFFFFFFFFFFFFFF ST1=FFFFFFFFFFFFFFFF ST2=FFFFFFFFFFFFFFFF ST3=FFFFFFFFFFFFFFFF ST4=FFFFFFFFFFFFFFFF ST5=FFFFFFFFFFFFFFFF ST6=FFFFFFFFFFFFFFFF ST7=FFFFFFFFFFFFFFFF CTRL=FFFF CS=0023 DS=002B ES=002B FS=0053 GS=002B SS=002B EAX=00000000 EBX=00000000 ECX=741B2E09 EDX=00000000 ESI=0018E6C0 EDI=00000000 EBP=00000000 ESP=0018E6BC EFL=00200246 XMM0= XMM1= XMM2= XMM3= XMM4= XMM5= XMM6= XMM7= MXCSR=FFFFFFFF MM0= MM1= MM2= MM3=
00002280 .text:sub_442C44+2D4 call TranslateMessage; Call Procedure ECX=0018E6C0 EDX=0000000F ESP=0018E6C0 EFL=00200244
00002280 .text:sub_442C44+2D9 push esi; lpMsg ESP=0018E6BC EFL=00200246
00002280 .text:sub_442C44+2DA call DispatchMessageA; Call Procedure ESP=0018E6B8
00002280 .text:DispatchMessageA jmp ds:__imp_DispatchMessageA; Indirect Near Jump
00002280 75FC7BBB
00002280 75FC7BBD Memory layout changed: 522 segments Memory layout changed: 522 segments
00002280 75FC7BBD ESP=0018E6B4
00002280 75FC7BBE EBP=0018E6B4
00002280 75FC7BC0 ESP=0018E6B0
00002280 75FC7BC2 ESP=0018E6AC
00002280 75FC7BC5 ESP=0018E6A8
00002280 75FC76D7 ESP=0018E6A4
00002280 75FC76D9 ESP=0018E6A0
00002280 75FC76DE EAX=0018E694 EBP=0018E6A4 ESP=0018E66C EFL=00200280 PF=0 ZF=0 SF=1
00002280 75FC76E3 EFL=00200246 PF=1 ZF=1 SF=0
00002280 75FC76E5
00002280 75FC76E8
00002280 75FC76EB
00002280 75FC76F2
00002280 75FC76F8 ECX=00B123FC
00002280 75FC76FA ZF=0
00002280 75FC76FC
00002280 75FC7702 EAX=00BB6A10 ECX=C0540000 EDX=00000000 EFL=00200200 PF=0
00002280 75FC7707 EBX=00BB6A10 EFL=00200202
00002280 75FC7709
00002280 75FC770B
00002280 75FC770D
00002280 75FC7713 EAX=00B123FC
00002280 75FC7715
00002280 75FC7717 EAX=00000113
00002280 75FC771A Memory layout changed: 527 segments Memory layout changed: 527 segments
00002280 75FC771A CF=1 SF=1
00002280 75FC771F
00002280 75FC788E CF=0 PF=1 ZF=1 SF=0
00002280 75FC7895
00002280 75FC789B CF=1 AF=1 ZF=0 SF=1
00002280 75FC78A0
00002280 75FC78A6 PF=0
00002280 75FC78AB
00002280 75FC7725 EDX=00000113
00002280 75FC7728 CF=0 PF=1 AF=0 ZF=1 SF=0
00002280 75FC772E
00002280 75FC792D EAX=00000000
00002280 75FC7930
00002280 75FC7932
00002280 75FC7740 EAX=00BB6A10
00002280 75FC7742 PF=0 ZF=0
00002280 75FC7744
00002280 75FC774A EDI=0018E6C8
00002280 75FC774D ECX=0000000A
00002280 75FC774F
00002280 75FC7752 EAX=0043F070
00002280 75FC7758 Memory layout changed: 527 segments Memory layout changed: 527 segments
00002280 75FC7758
00002280 75FC775B PF=1 ZF=1
00002280 75FC775F
00002280 75FC7765 PF=0 AF=1 ZF=0
00002280 75FC7768
00002280 75FC776E EAX=FFFFFED3
00002280 75FC7774 SF=1
00002280 75FC7777
00002280 75FC777D EAX=00000119
00002280 75FC7782 CF=1 PF=1
00002280 75FC7784
00002280 75FC778A EAX=0000000A
00002280 75FC778E EAX=00000001 CF=0 PF=0 AF=0 SF=0
00002280 75FC7791 EAX=FFFFFFFE
00002280 75FC7793 EAX=00000000 PF=1 ZF=1
00002280 75FC7796 ECX=00000000
00002280 75FC7798 PF=0 ZF=0
00002280 75FC779B
00002280 75FC779E PF=1 ZF=1
00002280 75FC77A0
00002280 75FC77A6 ESP=0018E668
00002280 75FC77A8 EAX=00BB6A38
00002280 75FC77AB ESP=0018E664
00002280 75FC77AC ESP=0018E660
00002280 75FC77AF ESP=0018E65C
00002280 75FC77B1 ESP=0018E658
00002280 75FC77B4 ESP=0018E654
00002280 75FC77B6 ESP=0018E650
00002280 75FC77B9 ESP=0018E64C
00002280 75FC77BF EAX=000B3E35 EBX=00000113 ECX=EED71FD0 EDX=00000072 ESI=00B123FC EDI=00000000 EBP=0018E5A0 ESP=0018C1C4 PF=0 AF=1 ZF=0
00002280 .text:sub_43F070+7A8 call **DialogBoxParamA**; Call Procedure EAX=0018BA94 ECX=00000000 EDX=00000001 EBP=0018BFF0 ESP=00189C28 EFL=00200200 AF=0
00002280 .text:sub_43F070:loc_43F81D Memory layout changed: 532 segments Memory layout changed: 532 segments
00002280 .text:sub_43F070:loc_43F81D cmp byte_4A6894, 0; Compare Two Operands