Trace back function call

Question

I'm learning reverse engineering and I'm trying to find where an error message is called. I want to get in the part of the code, in the main module, where it decides to display the error message or the succeed message, but I'm having problems tracing back to the function call because I get in a point of nowhere. This is what I do:

• Set breakpoint on MessageBoxW
• Breakpoint on MessageBoxW
• See the stack for the return address or run till return

But the address I get is something like: system.windows.forms.ni.123456. If I keep tracing back I get in a point of nowhere (somewhere in user32.dll). Hopefully someone has a better way to trace back this function or its familiar with "system.windows.forms" and can explain me how it works.

Answer 1

It may be easily done using OllyDbg. Just load the executable and press F9 - execution should be passed to the main module of application. Then, in the panel where the instructions are displayed, right click, then select Search for->All intermodular calls like below:

You should see the window looking similar to this: After that click the Destination tab (that will sort the list alfabetically) and search for MessageBoxW function. Then choose any of the references to this function and double click on it - you will see a call to it in the main window highlighted on grey. Then press F2 to set a software breakpoint there, then click View->Call stack and finally F9 to continue execution to that breakpoint.

When the execution hits it, the Call stack window will contain the list of subsequent function calls that led to MessageBoxW call.