1

I am using x32dbg to debug a program. I want to find the line which corresponds to a pop up message in my program to put a Break point. But everytime that I set "Pause" after the pop up window's opening the program stops in Kifastsystemcallret in ntdll module. I succeed one time to set a Break point and to work it fine, but I can't do it anymore... I don't understand... Thanks for advance for answering and sorry for my bad english and capacities in debugging...


enter image description hereThanks for your answer... I've uploaded two photos... The first shows the call stacks ; the second the KiFastSystemCallRet... I don't know where down the line I will return. I've tried to type all the expression adresses without any success...

enter image description here

1
  • If you are trying to backtrace where the pop up message was called, you can try to set a breakpoint in MessageBoxA if it uses that WinAPI and check the call stack. Jun 19, 2020 at 8:10

1 Answer 1

1

when any app is performing a system call it is normal to pause on KiFastSystemCallRet ( windbg callstack for 4 threads when application is paused windbg uses a seperate thread to breakin so the current thread is paused at DoDebugBreak

0:003> ~*k2

   0  Id: da4.a8c Suspend: 1 Teb: 7ffdf000 Unfrozen
ChildEBP RetAddr
0019ead4 75c1cde0 ntdll!KiFastSystemCallRet
0019ead8 75c1ce13 USER32!NtUserGetMessage+0xc

   1  Id: da4.a24 Suspend: 1 Teb: 7ffde000 Unfrozen
ChildEBP RetAddr
00b6fce8 77456a44 ntdll!KiFastSystemCallRet
00b6fcec 755e6a36 ntdll!NtWaitForMultipleObjects+0xc

   2  Id: da4.ce8 Suspend: 1 Teb: 7ffdd000 Unfrozen
ChildEBP RetAddr
029ffec0 77456a44 ntdll!KiFastSystemCallRet
029ffec4 73e5a41c ntdll!NtWaitForMultipleObjects+0xc

#  3  Id: da4.d8c Suspend: 1 Teb: 7ffdc000 Unfrozen
ChildEBP RetAddr
02b9f7f8 774af20f ntdll!DbgBreakPoint
02b9f828 75a1ed6c ntdll!DbgUiRemoteBreakin+0x3c
0:003>

a system call is a call which transitions from user mode to kernel mode

using sysenter instruction normally

when you issue a pause (f12 , esc) and when paused in that function take a look at call stack to see where down the line you will return

(you can type printstack in x64dbg commandline also to dump the call stack to log window)

17 call stack frames (EIP = 774570F4 , ESP = 000AE8EC , EBP = 000AE8FC ):
000AE900 ntdll._KiFastSystemCallRet@0
000AE910 uxtheme.74371A62
000AE920 uxtheme.74371A2F
000AE970 uxtheme.74371D38
000AE98C uxtheme.74371F20
000AE9D4 user32._GetRealWindowOwner@4+78
000AEE60 calc.00F51F4F
000AEE8C user32._InternalCallWinProc@20+23
000AEF04 user32._UserCallWinProcCheckWow@32+B3
000AEF60 user32._DispatchClientMessage@20+4B
000AEF88 user32.___fnDWORD@4+24
000AEFD4 ntdll._KiUserCallbackDispatcher@12+2E
000AFD50 calc.00F51CBC
000AFDE0 calc.00F6219A
000AFDEC kernel32.75A1ED6C
000AFE2C ntdll.___RtlUserThreadStart@8+27
000AFE44 ntdll.__RtlUserThreadStart@8+1B

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.