Search code examples
debuggingreverse-engineeringdisassemblyida

Watch a value instead of an address?


I'm new to reverse-engineering all in all and been having real difficulty to find exactly what makes a message box appears in the application which I don't have the source code for.

I tried using the very slow search for text to see if it would find the "Error when trying to download (...)". But looks like the message text is received from the wire and, therefore, is not a const string inside the binary.

I also have absolutely no clue of where the function is because I can't "instantly break" when the message pops up, so I would like to know if is there a way to create a watch for value kind of thing?

The idea is to make IDA be prepared to break if any address has the int32 value 65000 (decimal) assigned to it.


Solution

  • If you want to "watch for the value 'Error when trying to download (...)'" - then you'd probably find out that it is very complicated, resource heavy, although possible. You'd have to "trace" into every opcode that the processor executes and check where ever you need (e.g - the stack) for that value (or a pointer to it), which can be done with PIN Tools. This tool allows you to efficiently execute any assembly code you wish between each opcode, function call or "block" (as represented in IDA), by manipulating surrounding opcodes so they won't get affected. It's a really interesting thing to try.

    However, what you probably want to do is break on MessageBoxW or MessageBoxA. Simply navigate there (press G and write MessageBoxW and place a breakpoint). This will break when the application will call MessageBoxW, and you can then inspect the stack to see where it was called from.