9

I have an error message pop up on the screen every few seconds on a program. I would like to trace it back as to which function is calling the message box and why.

I found the referenced string but how do I trace it back to who called the function?

1

1 Answer 1

10

You can find this out by first running the program to the entry point to skip all of the boilerplate code, then go to the Symbols tab in x64Dbg, going to User32.dll and then filtering for the MessageBox functions. Place breakpoints on any functions with MessageBox in them and then run the program. Now, when MessageBox is called, the program will break and you can see where execution is.

You can trace the caller by going to your CPU tab and right-clicking in there, now go to Search For -> All Modules -> Intermodules References.

Now, you will see a bunch of function calls and at the bottom is a box where you can enter a filter term. Type in MessageBox and you will see where the program calls MessageBox and you can then double-click to jump there or right click for more options, place a breakpoint, etc...

I've attached an example using printf but in your case, you will use MessageBox. Note, this will only be correct if the MessageBox function is the function being used to display the message. If there is another library imported, it could be another function but the process is still similar.

enter image description here

1
  • Thank you! This was really helpful. :) Mar 16, 2020 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.