1

I am following this tutorial: enter link description here

Though it uses Olly I am following with IDA.

Basically i am tying to catch where a popup decision is taking place in the program. I though i placed a BP on the right spot. What I don't understand is this: When I placed only one BP on this location: enter image description here and I run the debugger, it stops on this BP. I press F8 and it continues to "push esi", F8 and I get the pop up message I was looking for.

However, when I place another BP on this location - this one was deducted from the tutorial which uses Olly. enter image description here And i follow the same debugging procedure; I press F8 and it continues to "push esi", F8 and It stoops on the new BP @0043F812 and only after pressing F8 again i get the popup after it calls "DialogBoxParamA".

So my question is why do I not get to DialogBoxParamA @43F818 when i obly place 1 BP? How can i jump from "DispatchMessageA" which is an external all to @43F818 ?

I'll try to visualize this:

enter image description here

Should not I be able to follow the same trace regardless on the number of BPs?

Below are the 2 trace logs. 1 - trace log with only 1 BP, this one is very

Thread  Address Instruction Result
00002378    .text:sub_442C44+2D4    Memory layout changed: 505 segments Memory layout changed: 505 segments
00002378            ST0=FFFFFFFFFFFFFFFF ST1=FFFFFFFFFFFFFFFF ST2=FFFFFFFFFFFFFFFF ST3=FFFFFFFFFFFFFFFF ST4=FFFFFFFFFFFFFFFF ST5=FFFFFFFFFFFFFFFF ST6=FFFFFFFFFFFFFFFF ST7=FFFFFFFFFFFFFFFF CTRL=FFFF CS=0023 DS=002B ES=002B FS=0053 GS=002B SS=002B EAX=00000000 EBX=00000000 ECX=741B2E09 EDX=00000000 ESI=0018E6C0 EDI=00000000 EBP=00000000 ESP=0018E6BC EFL=00200246 XMM0= XMM1= XMM2= XMM3= XMM4= XMM5= XMM6= XMM7= MXCSR=FFFFFFFF MM0= MM1= MM2= MM3= 
00002378    .text:sub_442C44+2D4    call    TranslateMessage; Call Procedure    ECX=0018E6C0 EDX=0000000F ESP=0018E6C0 EFL=00200244 
00002378    .text:sub_442C44+2D9    Memory layout changed: 522 segments Memory layout changed: 522 segments
00002378    .text:sub_442C44+2D9    push    esi; lpMsg  ESP=0018E6BC EFL=00200246 

************* 2nd TRACE with 2 BP ****************


Thread  Address Instruction Result
00002280    .text:sub_442C44+2D4    Memory layout changed: 505 segments Memory layout changed: 505 segments
00002280            ST0=FFFFFFFFFFFFFFFF ST1=FFFFFFFFFFFFFFFF ST2=FFFFFFFFFFFFFFFF ST3=FFFFFFFFFFFFFFFF ST4=FFFFFFFFFFFFFFFF ST5=FFFFFFFFFFFFFFFF ST6=FFFFFFFFFFFFFFFF ST7=FFFFFFFFFFFFFFFF CTRL=FFFF CS=0023 DS=002B ES=002B FS=0053 GS=002B SS=002B EAX=00000000 EBX=00000000 ECX=741B2E09 EDX=00000000 ESI=0018E6C0 EDI=00000000 EBP=00000000 ESP=0018E6BC EFL=00200246 XMM0= XMM1= XMM2= XMM3= XMM4= XMM5= XMM6= XMM7= MXCSR=FFFFFFFF MM0= MM1= MM2= MM3= 
00002280    .text:sub_442C44+2D4    call    TranslateMessage; Call Procedure    ECX=0018E6C0 EDX=0000000F ESP=0018E6C0 EFL=00200244 
00002280    .text:sub_442C44+2D9    push    esi; lpMsg  ESP=0018E6BC EFL=00200246 
00002280    .text:sub_442C44+2DA    call    DispatchMessageA; Call Procedure    ESP=0018E6B8 
00002280    .text:DispatchMessageA  jmp     ds:__imp_DispatchMessageA; Indirect Near Jump   
00002280    75FC7BBB        
00002280    75FC7BBD    Memory layout changed: 522 segments Memory layout changed: 522 segments
00002280    75FC7BBD        ESP=0018E6B4 
00002280    75FC7BBE        EBP=0018E6B4 
00002280    75FC7BC0        ESP=0018E6B0 
00002280    75FC7BC2        ESP=0018E6AC 
00002280    75FC7BC5        ESP=0018E6A8 
00002280    75FC76D7        ESP=0018E6A4 
00002280    75FC76D9        ESP=0018E6A0 
00002280    75FC76DE        EAX=0018E694 EBP=0018E6A4 ESP=0018E66C EFL=00200280 PF=0 ZF=0 SF=1 
00002280    75FC76E3        EFL=00200246 PF=1 ZF=1 SF=0 
00002280    75FC76E5        
00002280    75FC76E8        
00002280    75FC76EB        
00002280    75FC76F2        
00002280    75FC76F8        ECX=00B123FC 
00002280    75FC76FA        ZF=0 
00002280    75FC76FC        
00002280    75FC7702        EAX=00BB6A10 ECX=C0540000 EDX=00000000 EFL=00200200 PF=0 
00002280    75FC7707        EBX=00BB6A10 EFL=00200202 
00002280    75FC7709        
00002280    75FC770B        
00002280    75FC770D        
00002280    75FC7713        EAX=00B123FC 
00002280    75FC7715        
00002280    75FC7717        EAX=00000113 
00002280    75FC771A    Memory layout changed: 527 segments Memory layout changed: 527 segments
00002280    75FC771A        CF=1 SF=1 
00002280    75FC771F        
00002280    75FC788E        CF=0 PF=1 ZF=1 SF=0 
00002280    75FC7895        
00002280    75FC789B        CF=1 AF=1 ZF=0 SF=1 
00002280    75FC78A0        
00002280    75FC78A6        PF=0 
00002280    75FC78AB        
00002280    75FC7725        EDX=00000113 
00002280    75FC7728        CF=0 PF=1 AF=0 ZF=1 SF=0 
00002280    75FC772E        
00002280    75FC792D        EAX=00000000 
00002280    75FC7930        
00002280    75FC7932        
00002280    75FC7740        EAX=00BB6A10 
00002280    75FC7742        PF=0 ZF=0 
00002280    75FC7744        
00002280    75FC774A        EDI=0018E6C8 
00002280    75FC774D        ECX=0000000A 
00002280    75FC774F        
00002280    75FC7752        EAX=0043F070 
00002280    75FC7758    Memory layout changed: 527 segments Memory layout changed: 527 segments
00002280    75FC7758        
00002280    75FC775B        PF=1 ZF=1 
00002280    75FC775F        
00002280    75FC7765        PF=0 AF=1 ZF=0 
00002280    75FC7768        
00002280    75FC776E        EAX=FFFFFED3 
00002280    75FC7774        SF=1 
00002280    75FC7777        
00002280    75FC777D        EAX=00000119 
00002280    75FC7782        CF=1 PF=1 
00002280    75FC7784        
00002280    75FC778A        EAX=0000000A 
00002280    75FC778E        EAX=00000001 CF=0 PF=0 AF=0 SF=0 
00002280    75FC7791        EAX=FFFFFFFE 
00002280    75FC7793        EAX=00000000 PF=1 ZF=1 
00002280    75FC7796        ECX=00000000 
00002280    75FC7798        PF=0 ZF=0 
00002280    75FC779B        
00002280    75FC779E        PF=1 ZF=1 
00002280    75FC77A0        
00002280    75FC77A6        ESP=0018E668 
00002280    75FC77A8        EAX=00BB6A38 
00002280    75FC77AB        ESP=0018E664 
00002280    75FC77AC        ESP=0018E660 
00002280    75FC77AF        ESP=0018E65C 
00002280    75FC77B1        ESP=0018E658 
00002280    75FC77B4        ESP=0018E654 
00002280    75FC77B6        ESP=0018E650 
00002280    75FC77B9        ESP=0018E64C 
00002280    75FC77BF        EAX=000B3E35 EBX=00000113 ECX=EED71FD0 EDX=00000072 ESI=00B123FC EDI=00000000 EBP=0018E5A0 ESP=0018C1C4 PF=0 AF=1 ZF=0 
00002280    .text:sub_43F070+7A8    call    **DialogBoxParamA**; Call Procedure EAX=0018BA94 ECX=00000000 EDX=00000001 EBP=0018BFF0 ESP=00189C28 EFL=00200200 AF=0 
00002280    .text:sub_43F070:loc_43F81D Memory layout changed: 532 segments Memory layout changed: 532 segments
00002280    .text:sub_43F070:loc_43F81D cmp     byte_4A6894, 0; Compare Two Operands
1
  • on the tutorial website it says: ...One note, if you are running these tutorials under 64-bit windows 7 (like I am), Olly 1.10, even my version, the call stack trick will not work....
    – dandan
    Aug 11, 2018 at 19:18

1 Answer 1

1

TranslateMessage & DispatchgMessage are the standard windows functions when you are dealing with WinAPI and messages loops.

When a DispatchMessage is called, the message stored in esi is processed by Windows and then the message handler in the application is called and this is where you see your DialogBoxParamA.

The windows handler is registered in one of the fields of the WNDCLASS structure, namely lpfnWndProc. When reversing WinAPI application the most obvious place to look for interesting code is to locate the message handler code.

So in summary, when you have your 2nd breakpoint in the windows handler code, when this messages is processed you end before DialogBoxParamA. If you don';t have it there , messages is processed, Popup displayed, and you continue where you were before.

5
  • thank you. is there a way to catch it by tracing with IDA? I mean to get to "DialogBoxParamA", if yes how?
    – dandan
    Aug 11, 2018 at 19:56
  • it's a bit strange that it's not detected but I have almost 0 knowledge about IDA's tracing. It might be that in the first scenario IDA thinks it's a windows code and does not trace that. I guess tracing is limited to the user code and not the whole system. Aug 12, 2018 at 4:32
  • Thanks, Which free debugger would you recommend that you think WOULD detect it? I would use it to get to the suspected area and carry on with IDA from there.
    – dandan
    Aug 12, 2018 at 5:50
  • Well, even if the debugger is not free i'd lie to know which one.
    – dandan
    Aug 12, 2018 at 5:54
  • I don;t think the problem is with the debugger - more like this tracing option. But for the windows debuggers there are numerous: Olly, x64dbg, WinDbg, radare2 Aug 12, 2018 at 6:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.