2

I am a newbie to reverse engineering. I am trying to reverse engineer an app that uses some form of internet explorer frame kind of thing because I could see use of mshtml.dll and jscript9.dll and with the help of some dynamic analysis with ProcMon I could guess that.

Now the thing is I want to know what code gets executed when I enter something in the textbox that the program has. I have tried many things like dll entry breakpoint, windows messages breakpoints, doing a trace into , trace over, string references, call stack method. But none helped me. The app does the check dynamically, there no need for you to press a button and since this is not a normal windows form I cannot set BP on messagebox API. If I could there is no message that gets displayed if there is an error.

Request you guys help me with some ideas as to how to tackle programs that use the internet explorer frame kind of stuff for desktop application with x64dbg

Improve this question
1
  • Type some unique string into the textbox that is unlikely to be anywhere else in memory. Then (in x64dbg) go to Memory tab and hit Ctrl + B to perform a memory search. Search for the string you put in the textbox before, because it has to now be in the program memory somewhere. Set hardware breakpoints on any results in memory where your string appears. Now any time code reads the value of the textbox, you get a breakpoint. If it shows up more than four times, try those on a restart
    – tomysshadow
    Commented Jun 12, 2023 at 6:17

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.