3

I'm learning lena151's materials and in 4 lesson she uses Olly's Back-to-user feature to find where the MassegeBox is creating.

enter image description here

It works fine under x32 windows server 2003.

But what about nowadays?!

Is there similar option in IDA+WINDBG for x64 apps? Coz I've tried setting BP to the .text section but I faced the message of IDA 'BP set is failed coz of break point overlapping' (so you should delete all previous if some was set)

Improve this question

1 Answer 1

Reset to default
2

I've got found incredibly good plugin for IDA.

The tools:

  1. PixtopianBook.exe (lena151's 4th tutorial).

  2. IDA 7.6 x86.

  3. Funcap python script for ida.

The task: Do any action and find out which function was called.

The recipe:

1. Get the script by typing git clone https://github.com/deresz/funcap.git

2. Run IDA and select the Local Windows debugger (Windbg froze up when launch with lots of breakpoints).

enter image description here

3. Run process as usual, right till the exe fully loads up.

enter image description here

4. Pause process, hold ALT+F7 and select funcap.py script

enter image description here

5. Now type in command line d.hookSeg('.text') and run process.

enter image description here

6. Now just click the interesting button and wait till it fully drawn.

enter image description here

7. You will see a lot of logs in the IDA output, select and copy whole text to some notepad and search for MessageBox. Here we go :з

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.