Empty Parameter an MessagerBox

Question

I am trying to learn to reverse Engineering , i am very new and my English is very Poor... .I wanting to make this exercise , but can't it , because not receive the hWnd identified from the MessageBox ,it is empty ....

The screenshot from they

My screenshot

I have to want to make this exercise with Ollydbg and Immunty Debugger , but without result... .I working with a Windows 7 , inside a VirtualBox . Here Speak what HWND do , what i don't Understande because all crackme.exe which i Downloaded have this parameter NULL. Can Please anybody help me and with easy Words explain me how to solve this Problem , Thanks!

Answer 1

a hWnd to a MessageBox can be NULL

if you give NULL as an arg it measns the MessageBox is NonModal

NonModal means you can keep working with the parent application without having to dismiss the MessageBox

which version of ollydbg are you using if it was v 1.0 it came with a default commandline plugin (alt + f1) where you can type [ebp+8] and get the result

if you are using v 2.0 use ctrl+g on the respective panes

if you want to view in dump select dump pane first and then hit ctrl+g type in [ebp+8] and follow expression

or you can use the address relative to option in stack to have a visual

do not use the executable from octopuslabs it is probably trojanned the exe from crackmes.cf appears to be 1 kb less than that of octopuslabs exe

anyway at [ebp+8] you wont get the same handle as in the tutorial it will be different for each invocation just because you have a different handle does not matter

C:\lafarge2>ls -R
.:
crackme.exe  octo

./octo:
filehash.py  getoctocrackme.bat

C:\lafarge2>cat octo\getoctocrackme.bat
wget -c hxxp://BEWARE_MALWARE_octopuslabs.io/legend/files/tuts/R4ndom_tutorial_22.zip
C:\lafarge2>cd octo
C:\lafarge2\octo>getoctocrackme.bat

Length: 1555447 (1.5M) [application/zip]
Saving to: 'R4ndom_tutorial_22.zip'

C:\lafarge2\octo>e:\7z\7z.exe e R4ndom_tutorial_22.zip

Everything is Ok
Files: 7

C:\lafarge2>fc crackme.exe octo\crackme.exe
Comparing files crackme.exe and OCTO\CRACKME.EXE
000000CE: 04 05

0000095F: 79 C9
^C
C:\lafarge2>octo\filehash.py crackme.exe
2ef9a7504dddb18f0ecd7fce3a720dc131c6994d

C:\lafarge2>octo\filehash.py octo\crackme.exe
cdcf6fbbb70010f1c9d4e4b4d2f0dea60f61c50d

an extra section

C:\lafarge2>dumpbin /nologo octo\crackme.exe | tail -n 5 & dumpbin /nologo crackme.exe | tail -n 5
        8000 .data
        1000 .r4nd
        1000 .rdata
        B000 .rsrc
        4000 .text

        8000 .data
        1000 .rdata
        B000 .rsrc
        4000 .text