0

I can't find strings from message boxes.

Questions:

  1. How do i find the strings?
  2. What are these strange symbols? enter image description here
  3. Is it possible to transform them into readable ones? how?

Detailed information:

  1. I open the exe file on exeinfoPE (see picture). enter image description here
  2. x64dbg don't show error messages from textboxes when i search them into strings. enter image description here enter image description here enter image description here
  3. ResourceHacker don't show tables (just informing). ResourceHacker

Purposes and other:

  1. I am trying to crack this program.
  2. I'm newbie in this journey - like 1 week, not much progress.

1 Answer 1

2

You can put a breakpoint on the 'MessageBox' syscall, and inspect it's arguments. From the MSDN the arguments are:

int MessageBox(hWnd, lpText, lpCaption, uType);

And you are interessted in 'lpText':

The message to be displayed. If the string consists of more than one line, you can separate the lines using a carriage return and/or linefeed character between each line.

You can do this by doing the following:

  • Open your file in x64dg, and in the command prompt at the bottom type 'bp MessageBox'. You can also break on 'MessageBoxA', 'MessageBoxW', 'MessageBoxExA', 'MessageBoxExW', 'MessageBoxIndirectA' and 'MessageBoxIndirectW'
  • Run your binary (first 'run' bring you to the entrypoint, second one run the program).
  • Deal with any exceptions or condition in order to go to the part of the code that displays your message box.
  • When you break on one of the message box API, press 'return to user code' in order to inspect the application's code, and not the message box API itself.
  • Finally you can inspect which arguments where passed to that function
  • When you see the second argument ('lpText'), right clic on it, 'follow in memory dump' and you should see the message you are viewing !
  1. Those are not strings. What you are seeing is a bunch of pointers to the header of your program. Take a look at your binary header. You will see the magic byte 'MZ' at the start. x64dg think this is a string, but it's not.

  2. Oh, and by the way, you are looking at an 'AutoHotKey' binary. Make some research on how to reverse this. It is a by different than usual.

1
  • Regarding your top bullet point: wouldn't you even have to set a breakpoint on individual functions rather than MessageBox? Also, it's not a syscall by a long shot.
    – 0xC0000022L
    Commented Apr 26, 2021 at 12:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.