I want to find out what certain buttons do on a 64 bit application, x64dbg is the debugger I have available to me, can anyone help me out? I read that ollydbg has an option to break on user input, such as a button, but since the application is question is 64 bit that's not an option. Any help on where to go from here?
2 Answers
Yes, you can use the enhanced x64dbg feature for placing BP on any window of the debugged app and hence intercept any message being sent to any of them.
After running the exe, go to Handles tab > Right-click >Refresh -and watch over Windows widget and locate the window you want to put the BP on. Then Right click->Message breakpoint, a window will pop up, now select the desired window message based on what you want to pause your program after. In case of a button, WM_LBUTTONUP would do it, in case of an editbox WM_KEYUP will also work and so on, you got a ton of messages to choose from. Then you got a couple more checkboxes, select "...current window" to pause only when the message is passed to the selected window.
Now, sometimes these windows procs BPs won't work or even pause as expected, in this case, try checking Use TranslateMessage option and that would do it.
I did it in the following way:
1 go to the window "resources" 2 choose the button corresponding to the application 3 right click and message breakpoint 4 choose "WM_LBUTTONUP"
