Right after our breakpoint is set we click the button in the crackme and soon after that we step in our breakpoint.Īt this point we achieved what we wanted.

We are specifying that the execution is stopping as soon as a WM_LBUTTONUP (left mouse click is up) message is sent to our button control. In this case the configuration I am going to use is something like this: Now we are given a window with some options to choose from in order to set a specific message breakpoint in our button control. We can then see the button there so we right click over it and select the option to set a message breakpoint on it: At this point we could get creative and start looking for other alternatives to locate the exact location where our serial is processed and yes, we would probably succeed, but what if I tell you that there is an easier way for us to land just after the press of that button? Just like we would with any Delphi, Visual Basic or any other event-driven language? Let us find out how it works.Īfter loading and executing the file in 圆4dbg, we go and enter some text and just before pressing the Check! button we go to the Handles tab and refresh the view to obtain a window list of the debuggee.

If we try to enter a text and click on the Check! button nothing is happening, not a text message, no nothing. In this case we have a simple executable coded in Visual C++: Let us take a look at a sample crackme for demonstration purposes. What can you do in that case to obtain those addresses in a similar approach with the least effort? Using Windows Messages Sometimes it is not that easy, whether a packer or anti-decompiler technique is involved, or just for the simple reason that the application is not an event-driven one. With certain applications (Delphi, CBuilder, Visual Basic, etc) it is as easy as dropping the executable inside a decompiler and locating the corresponding events/addresses in a matter of seconds. Have you ever been trying to reverse a specific function in an application, but cannot really find it? For instance, let us assume you want to locate the code that is being called right after a click on a button or a keystroke. Messages Breakpoints in 圆4dbg, by ThunderCls Introduction

Xdbg64