debugging - Watch a value instead of an address? -


i'm new reverse-engineering in , been having real difficulty find makes message box appears in application don't have source code for.

i tried using slow search text see if find "error when trying download (...)". looks message text received wire and, therefore, not const string inside binary.

i have absolutely no clue of function because can't "instantly break" when message pops up, know if there way create watch value kind of thing?

the idea make ida prepared break if address has int32 value 65000 (decimal) assigned it.

if want "watch value 'error when trying download (...)'" - you'd find out complicated, resource heavy, although possible. you'd have "trace" every opcode processor executes , check ever need (e.g - stack) value (or pointer it), can done pin tools. tool allows efficiently execute assembly code wish between each opcode, function call or "block" (as represented in ida), manipulating surrounding opcodes won't affected. it's interesting thing try.

however, want break on messageboxw or messageboxa. navigate there (press g , write messageboxw , place breakpoint). break when application call messageboxw, , can inspect stack see called from.


Comments

Popular posts from this blog

Magento/PHP - Get phones on all members in a customer group -

php - Bypass Geo Redirect for specific directories -

php - .htaccess mod_rewrite for dynamic url which has domain names -