I'm learning reverse engineering and I'm trying to find where an error message is called. I want to get in the part of the code, in the main module, where it decides to display the error message or the succeed message, but I'm having problems tracing back to the function call because I get in a point of nowhere. This is what I do:
- Set breakpoint on MessageBoxW
- Breakpoint on MessageBoxW
- See the stack for the return address or run till return
But the address I get is something like: system.windows.forms.ni.123456. If I keep tracing back I get in a point of nowhere (somewhere in user32.dll). Hopefully someone has a better way to trace back this function or its familiar with "system.windows.forms" and can explain me how it works.