I have an error message pop up on the screen every few seconds on a program. I would like to trace it back as to which function is calling the message box and why.
I found the referenced string but how do I trace it back to who called the function?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityI have an error message pop up on the screen every few seconds on a program. I would like to trace it back as to which function is calling the message box and why.
I found the referenced string but how do I trace it back to who called the function?
You can find this out by first running the program to the entry point to skip all of the boilerplate code, then go to the Symbols tab in x64Dbg, going to User32.dll and then filtering for the MessageBox
functions. Place breakpoints on any functions with MessageBox
in them and then run the program. Now, when MessageBox is called, the program will break and you can see where execution is.
You can trace the caller by going to your CPU tab and right-clicking in there, now go to Search For -> All Modules -> Intermodules References.
Now, you will see a bunch of function calls and at the bottom is a box where you can enter a filter term. Type in MessageBox
and you will see where the program calls MessageBox
and you can then double-click to jump there or right click for more options, place a breakpoint, etc...
I've attached an example using printf
but in your case, you will use MessageBox
. Note, this will only be correct if the MessageBox function is the function being used to display the message. If there is another library imported, it could be another function but the process is still similar.