So i am reversing an app that pops up a message at some point, but its not doing this using messagebox

i also tried to pause and then run to user code but didn't work, so what are some of the other ways to trace back to where this "message box" was generated? sorry if this is a newbee question

i watched a lot of youtube videos but regarding this issue the only solution i found was pausing and going to user code but that doesn't work, for some reason sometimes the pause just doesn't even work (if anyone knows why please let me know) and sometimes when it does, and i go to user code its just gibberish code, nothing that caused the box ( i think maybe this is because multi threading, since when i check the threads there are like 12 threads running!, tried going to main thread and some of the non suspended ones and repeating this didnt work )

  • The Message Box may be a a Custom Window /Dialog use a spy utility /debuggers list of windows to ascertain the window type
    – blabb
    Oct 19 '19 at 20:19
  • 1
    Hi, this is a rather "coarse" description of the problem. You should give us some more here. There are no static or delayed imports of (user32) functions in question? There are no static or delayed imports of functions that can be used to dynamically load DLLs and fetch function pointers (e.g. LoadLibrary)? Is the executable packed or not? Does it have at least one import from user32 (if so, this would make it easy to use the TEB to find an exported function by hash)?
    – 0xC0000022L
    Oct 19 '19 at 20:20
  • MessageBox also has multiple variants - MessageBox, MessageBoxEx, MessageBoxIndirect, MessageBoxTimeout, all with 'A' and 'W' types. There are also DialogBox options, as blabb notes. It could be any of these, or even none. Oct 20 '19 at 4:38
  • @0xC0000022L yes it has many imports from user32, and its not packed, no dynamic loading either, it just pops up a message just like message box but its not that, i hooked all the functions starting with messagebox but still no luck
    – Mery Ted
    Oct 20 '19 at 5:34
  • @peterferrie i set bp on all the intermodule calls that started with messagebox or dialogbox and still no luck! no hit!!
    – Mery Ted
    Oct 20 '19 at 5:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.