I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux).

The problem now is on a Windows program. I start it up but after a few seconds a popup appears with the message "You are not connected to the Internet", although I am regularly connected to the Internet. I am trying to parse the assembly code and debug with OllyDbg. First I searched for the string "You are not connected" but I didn't find it anywhere. On closer analysis, I found that the error popup appears when the eip is inside the ntdll dll library and sometimes win32u. I am attaching two screenshots to explain myself better. How do I know where the problem lies? Is it correct to say that the problem lies within a dll? Thank youenter image description hereenter image description here

With your help, I found the function that calls the MessageBox. But unfortunately I think it is part of a very long loop and it is difficult for me to be able to identify the problem. I was noticing, that when the program starts, the ASCII string "Error writing temporary file .." is loaded. Does it correspond to an allocated variable or is it a message I should see when I start the program? Maybe that's the problem

enter image description here

  • How did you search for the string? Remember it can be in Unicode.
    – bart1e
    Mar 10, 2021 at 13:13
  • I've searched the strings in Ollygdb and I have also tried with utility "Strings".. there is no "You are not connected to the Internet".. Maybe is it a message in some dll library ?
    – LucaG
    Mar 10, 2021 at 14:09
  • Definitely not in any system dll. If you put breakpoint on MessageBoxW, is it triggered?
    – bart1e
    Mar 10, 2021 at 14:14
  • I've not "MessageBoxW" but I've "MessageBoxIndirectA" and it's triggered and I think it is the function that brings up the message.what advice do you give me now? Thanks (Edit: now I can also see the string on the stack)
    – LucaG
    Mar 10, 2021 at 15:31
  • You can do View->Call stack and you will see window showing you function calls that led to the current one. Just double click on the first address from this list belonging to your exe and you will be redirected to the point where the messagebox function was originally called.
    – bart1e
    Mar 10, 2021 at 15:40


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.