Finding out what calls win32u.dll functions

Question

There's a button which, when clicked, writes some data to the clipboard. I'm trying to call the function this button executes using DLL Injection. I managed to find the function in win32u.dll which accesses the clipboard, and I was able to set a breakpoint there which gets triggered. Obviously, I don't want to call this function directly, but the function that calls it (from the origin program). How do I figure this address out?

I can't use the buttons handle since the button doesn't show up in any UI spy tools and as it is a part of a context menu, it disappears as soon as the focus is lost.

I'm using x64dbg as a debugger, but if you know a solution in OllyDbg, that will be fine since I know how to use both.

Answer 1

OllyDbg

You can do it at least in two different ways. The first involves Call stack view (View->Call stack) that you can use when the breakpoint you set in that function from win32u.dll is triggered. The first one coming from your application's module will be the desired one.

Second approach is more static and takes advantage of Intermodular calls. Go to your application's module, right click -> "Search for" -> "All intermodular calls". You will get all external functions that your program calls and the places where they are called from. So, just search for that API function and you will get all places that it is called from in that module.

You can see answer for more details.