Trace back which function called the message box in x64dbg?

Question

I have an error message pop up on the screen every few seconds on a program. I would like to trace it back as to which function is calling the message box and why.

I found the referenced string but how do I trace it back to who called the function?

Answer 1

You can find this out by first running the program to the entry point to skip all of the boilerplate code, then go to the Symbols tab in x64Dbg, going to User32.dll and then filtering for the MessageBox functions. Place breakpoints on any functions with MessageBox in them and then run the program. Now, when MessageBox is called, the program will break and you can see where execution is.

You can trace the caller by going to your CPU tab and right-clicking in there, now go to Search For -> All Modules -> Intermodules References.

Now, you will see a bunch of function calls and at the bottom is a box where you can enter a filter term. Type in MessageBox and you will see where the program calls MessageBox and you can then double-click to jump there or right click for more options, place a breakpoint, etc...

I've attached an example using printf but in your case, you will use MessageBox. Note, this will only be correct if the MessageBox function is the function being used to display the message. If there is another library imported, it could be another function but the process is still similar.