1

I am trying to learn to get around Ollydbg, using Lena's tutorial. The latter is based on v.1.10 but I'm using 2.01. So far that went ok.

However, I now find myself in a situation where my result differs a lot from the tutorial (no 4).

I'm trying to catch the call for a messagebox in the code. The tutorial describes I should, with the messagebox open, pause Ollydbg, then return to the application and close the messagebox. This would make Ollydbg break after I clicked the box away and I would land right after the messagebox call in the code.

In my case though, as soon as I click pause, Olly leaves the main application module, landing on RETN in a subroutine of USER32.GetMessageA

Now I can't get back to the application at all, it's blocked. I have to continue the debugger in order to be able to get back to it again but this way I get no info about the messagebox.

Any tips how to proceed in order to get the expected result? I guess in this specific example I could just search for all messagebox calls in the code but that's hardly a good way, especially with large apps.

A related question, is there a possibility to "look back" on what happened, as in which code was called up to a certain moment?

Apologies if any of this doesn't make much sense.

Improve this question
2
  • Have you tried searching for all intermodular calls and breaking on all calls to message box?
    – Viktor
    Nov 6, 2015 at 18:43
  • Hi namesake :) yes, I did that, that works, too, of course. But I wanted to know how I could use that in situations when I don't know the name of the window (or other function) called.
    – vic
    Nov 6, 2015 at 19:17

2 Answers 2

Reset to default
4

alt + k to view or look back

here is a f9-> f12 -> alk + k output on a simple message box

Call stack of main thread
Stack     Data      Procedure                                     Called from                  Frame
0013FA78  7E419418   ???                                          USER32.WaitMessage+0A
0013FAB0  7E4249C4  /USER32.DialogBox2                            USER32.InternalDialogBox+0B1
0013FAB4  00A20142  |  Arg1 = 0A20142
0013FAB8  00000000  |  Arg2 = 0
0013FABC  00000001  |  Arg3 = 1
0013FAC0  00000000  \  Arg4 = 0
0013FAD8  7E43A956  /USER32.InternalDialogBox                     USER32.SoftModalMessageBox+6>
0013FADC  7E410000  |  Arg1 = USER32.<STRUCT IMAGE_DOS_HEADER>
0013FAE0  00152F38  |  Arg2 = 152F38
0013FAE4  00000000  |  Arg3 = 0
0013FAE8  7E43A016  |  Arg4 = USER32.MB_DlgProc
0013FAEC  0013FEF0  |  Arg5 = 13FEF0
0013FAF0  00000000  \  Arg6 = 0
0013FD98  7E43A2BC  /USER32.SoftModalMessageBox                   USER32.MessageBoxWorker+170
0013FD9C  0013FEF0  \  Arg1 = 13FEF0
0013FEE8  7E4663FD  /USER32.MessageBoxWorker                      USER32.MessageBoxTimeoutW+75
0013FEEC  0013FEF0  \  Arg1 = 13FEF0
0013FF40  7E4664A2  /USER32.MessageBoxTimeoutW                    USER32.MessageBoxTimeoutA+97
0013FF44  00000000  |  Arg1 = 0
0013FF48  001529C8  |  Arg2 = UNICODE "Multi-line text for a simp>
0013FF4C  00152AB0  |  Arg3 = UNICODE "Caption For A Simple And P>
0013FF50  00000000  |  Arg4 = 0
0013FF54  00000000  |  Arg5 = 0
0013FF58  FFFFFFFF  \  Arg6 = -1
0013FF74  7E450877  /USER32.MessageBoxTimeoutA                    USER32.MessageBoxExA+16
0013FF78  00000000  |  Arg1 = 0
0013FF7C  00401008  |  Arg2 = ASCII "Multi-line text for a simple>
0013FF80  00401070  |  Arg3 = ASCII "Caption For A Simple And Pla>
0013FF84  00000000  |  Arg4 = 0
0013FF88  00000000  |  Arg5 = 0
0013FF8C  FFFFFFFF  \  Arg6 = -1
0013FF94  7E45082F  /USER32.MessageBoxExA                         USER32.MessageBoxA+40
0013FF98  00000000  |  hOwner = NULL
0013FF9C  00401008  |  Text = "Multi-line text for a simple and p>
0013FFA0  00401070  |  Caption = "Caption For A Simple And Plain >
0013FFA4  00000000  |  Type = MB_OK|MB_DEFBUTTON1|MB_APPLMODAL
0013FFA8  00000000  \  LanguageID = LANG_NEUTRAL
0013FFB0  004010AE  /USER32.MessageBoxA                           msgbox.004010A8
0013FFB4  00000000  |  hOwner = NULL
0013FFB8  00401008  |  Text = "Multi-line text for a simple and p>
0013FFBC  00401070  |  Caption = "Caption For A Simple And Plain >
0013FFC0  00000000  \  Type = MB_OK|MB_DEFBUTTON1|MB_APPLMODAL

no you cant close a paused MessageBox not in v 1.10 or not in v 2.01
it is simply not possible period
you must be misreading or misunderstanding the tutorial

you need to set a breakpoint some where on any of the return address and continue execution or you can select a return address in call stack and hit f4 to execute until return

enter image description here

Improve this answer
7
  • I don't think I misread, maybe I misunderstood. I quote from the tut: "Use this simple trick: Pause Olly first, now press Alt-F9 (return to user), and notice that Olly promises he will return to user as soon as you let him. [...] (Video goes back to App, closes the messagebox) Olly kept his promise, breaks right after the messagebox."
    – vic
    Nov 6, 2015 at 18:13
  • yep alt+f9 is return to user code that sets a breakpoint on a return in call stack no problems there after you hit alt+f9 you cna notice the breakpoint ollydbg set in the list alt+k -> select a call retun and f4 -> f9 -> close ollydbg will break on the break
    – blabb
    Nov 6, 2015 at 18:16
  • No, that's what I described, that doesn't work for me. No breakpoint is set, and I cannot return to the application window.
    – vic
    Nov 6, 2015 at 18:22
  • 1
    i just checked it sets an internal hardware breakpoint here and the status bar show till user code and closing the msg box it breaks on user code Hardware breakpoints, item 0 Slot = 4 Type = Internal <---------------- Address = 7E42770A Module = USER32 Status = Active Disassembly = JMP USER32.7E42764D Comment = Log data, item 0 Address = 004010AE Message = User code reached
    – blabb
    Nov 6, 2015 at 18:36
  • I am really confused now. It works. Well, it works now, for some reason, most of the times. The other times I still get the behavior I described in my question. It seem that when I switch back rather quickly using Alt-Tab after Alt-F9, it doesn't work. But that's not always reproducible. I had a streak of 6 times when it blocked, and after that I just couldn't get it to block again. I wish I could understand what's happening here.
    – vic
    Nov 6, 2015 at 19:13
0

Have you tried in 1.10? I have and have no issue. Make sure you leave the dialog opened, and instead of hitting Alt-F9 I found the option in the menu.

It's possible but unlikely that this feature is broken in Olly 2

Improve this answer
1
  • Thanks Gdogg. As I mentioned, it does work, just not consistently. Otherwise v2 was treating me well so far.
    – vic
    Nov 10, 2015 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.