1

I'm new to reverse engineering, have been using olly and x64_dbg. I've ,to a degree, successfully reverse engineered and understood functions and parts of code of a couple applications. I cannot READ Asm or spot data structures quite yet. I recently tried peeking at a disassembled code of a new PE and it's obfuscated. So it's far over my head at this point but I continued to dig in. I came across a popup dialog created/initiated by the User32.CreateWindowExA function. Due to anti debugging code I cannot place any breakpoints in the actual executable.... well certain memory locations of the exe and dlls can have breakpoints. Anyway I narrowed things down to a DispatchMessageA function being called then the CreateWindowExA function. I can't find out what happens between the two or find the GetMessage funct. I believe I know the message being sent but my question is, how do I find the receiving message function for the appropriate message sent out. Let's say 3 different messages can be sent out how do I find out who collects them?

2

As it stands the query is too broad

to capture all the messages that are sent Via GetMessageX to a certain process A conditional log breakpoint similar to this can be employed

OS xpsp3 using windbg and Ken Johnsons sdbgext windbg extension

Demo Result

finding index of GetMessage

0:000> uf USER32!NtUserGetMessage
USER32!NtUserGetMessage:
7e4191b2 b8a5110000      mov     eax,11A5h
7e4191b7 ba0003fe7f      mov     edx,offset SharedUserData!SystemCallStub (7ffe0300)
7e4191bc ff12            call    dword ptr [edx]
7e4191be c21000          ret     10h

to know how many step over is required

0:000> uf ntdll!KiFastSystemCall
ntdll!KiFastSystemCall:
7c90e510 8bd4            mov     edx,esp
7c90e512 0f34            sysenter
7c90e514 c3              ret

setting a conditional log breakpoint using index and number of step overs

0:000> bp ntdll!KiFastSystemCall ".if(@eax == 11a5) {r $t0 = poi(@esp+8);p 2 \"!usermsg @$t0;g\";} .else {gc}"

confirming the breakpoint

0:000> .bpcmds
bp0 0x7c90e510  ".if(@eax == 11a5) {r $t0 = poi(@esp+8);p 2 \"!usermsg @$t0;g\";} .else {gc}";

executing

0:000> g

**log the voluminous spew to be parsed later **

eax=000011a5 ebx=00000000 ecx=00000000 edx=0007fde0 esi=0007fee8 edi=01014018
eip=7c90e512 esp=0007fde0 ebp=0007fdfc iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCall+0x2:
7c90e512 0f34            sysenter
hwnd:
Window    000a01d6
Name      C
Class     Button
WndProc   00000000
Style     WS_OVERLAPPED 
ExStyle   WS_EX_NOPARENTNOTIFY WS_EX_LEFT WS_EX_LTRREADING WS_EX_RIGHTSCROLLBAR 
HInstance 01000000
ParentWnd 001200e0
Id        00000088
UserData  00000000
Unicode   TRUE
ThreadId  00000be8
ProcessId 00000be0
Message: WM_PAINT
wParam: 0
lParam: 0
Time: 5bd026
pt: (1021, 413)
eax=000011a5 ebx=00000000 ecx=00000000 edx=0007fde0 esi=0007fee8 edi=01014018
eip=7c90e512 esp=0007fde0 ebp=0007fdfc iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCall+0x2:
7c90e512 0f34            sysenter
hwnd:
Window    00080186
Name      /
Class     Button
WndProc   00000000
Style     WS_OVERLAPPED 
ExStyle   WS_EX_NOPARENTNOTIFY WS_EX_LEFT WS_EX_LTRREADING WS_EX_RIGHTSCROLLBAR 
HInstance 01000000
ParentWnd 001200e0
Id        0000005a
UserData  00000000
Unicode   TRUE
ThreadId  00000be8
ProcessId 00000be0
Message: WM_PAINT
wParam: 0
lParam: 0
Time: 5bd14f
pt: (1021, 413)
eax=000011a5 ebx=00000000 ecx=00000000 edx=0007fde0 esi=0007fee8 edi=01014018
eip=7c90e512 esp=0007fde0 ebp=0007fdfc iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCall+0x2:
7c90e512 0f34            sysenter
hwnd:
Window    000a0160
Name      *
Class     Button
WndProc   00000000
Style     WS_OVERLAPPED 
ExStyle   WS_EX_NOPARENTNOTIFY WS_EX_LEFT WS_EX_LTRREADING WS_EX_RIGHTSCROLLBAR 
HInstance 01000000
ParentWnd 001200e0
Id        0000005b
UserData  00000000
Unicode   TRUE
ThreadId  00000be8
ProcessId 00000be0
Message: WM_PAINT
wParam: 0
lParam: 0
Time: 5bd249
pt: (1021, 413)
eax=000011a5 ebx=00000000 ecx=00000000 edx=0007fde0 esi=0007fee8 edi=01014018
eip=7c90e512 esp=0007fde0 ebp=0007fdfc iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCall+0x2:
7c90e512 0f34            sysenter
2
  • Wow thanks. It appears I have a lot to learn but not being able to see how deep the rabbit hole gets only makes me more excited. X64_dbg does not have conditional breakpoints yet. Their hardware breakpoints don't reliably work yet. It's a great program I look forward to its future but I'll give windgb a look at and hopefully things go well. Thanks for the advice. I plan to start reading. practical reverse engineering. this weekend. Hopefully that'll help with the obfuscation. – TurtleMan Jan 22 '15 at 3:02
  • @TurtleMan: Please, don't forget to tick the answer as correct ! And possibly vote for it if you think it deserve it. The principle of Stack-Exchange websites is based on the hypothesis that every should follow these simples rules. If nobody do it, it won't be possible to distinguish good answers from gibberish. – perror Feb 20 '15 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.