debugging - Watch a value instead of an address? -
i'm new reverse-engineering in , been having real difficulty find makes message box appears in application don't have source code for.
i tried using slow search text see if find "error when trying download (...)". looks message text received wire and, therefore, not const
string inside binary.
i have absolutely no clue of function because can't "instantly break" when message pops up, know if there way create watch value kind of thing?
the idea make ida prepared break if address has int32
value 65000 (decimal) assigned it.
if want "watch value 'error when trying download (...)'" - you'd find out complicated, resource heavy, although possible. you'd have "trace" every opcode processor executes , check ever need (e.g - stack) value (or pointer it), can done pin tools. tool allows efficiently execute assembly code wish between each opcode, function call or "block" (as represented in ida), manipulating surrounding opcodes won't affected. it's interesting thing try.
however, want break on messageboxw or messageboxa. navigate there (press g , write messageboxw
, place breakpoint). break when application call messageboxw
, , can inspect stack see called from.
Comments
Post a Comment