I'm learning reverse engineering and I'm trying to find where an error message is called. I want to get in the part of the code, in the main module, where it decides to display the error message or the succeed message, but I'm having problems tracing back to the function call because I get in a point of nowhere. This is what I do:

  • Set breakpoint on MessageBoxW
  • Breakpoint on MessageBoxW
  • See the stack for the return address or run till return

But the address I get is something like: system.windows.forms.ni.123456. If I keep tracing back I get in a point of nowhere (somewhere in user32.dll). Hopefully someone has a better way to trace back this function or its familiar with "system.windows.forms" and can explain me how it works.

  • system.windows.forms suggest that this is a .net executable. Maybe use dnSpy instead of x64dbg Commented Mar 4, 2019 at 16:03

1 Answer 1


It may be easily done using OllyDbg. Just load the executable and press F9 - execution should be passed to the main module of application. Then, in the panel where the instructions are displayed, right click, then select Search for->All intermodular calls like below:Olly-intermodular_calls

You should see the window looking similar to this: Olly-intermodular_calls_window After that click the Destination tab (that will sort the list alfabetically) and search for MessageBoxW function. Then choose any of the references to this function and double click on it - you will see a call to it in the main window highlighted on grey. Then press F2 to set a software breakpoint there, then click View->Call stack and finally F9 to continue execution to that breakpoint.

When the execution hits it, the Call stack window will contain the list of subsequent function calls that led to MessageBoxW call.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.