1

let's say, I am debugging (with x64dbg) a specific program (in Windows, native programs, probably they are called standard MFC-kind programs ):

enter image description here

that program has a button xyz:

enter image description here

1) how to find out which line/command is executed by clicking on that button?
2) if that's possible to know that line before I click that button, it would be excellent.

I'd like a small "how-to" or steps what to do to get that.

T.Todua
  • 643
  • 2
  • 9
  • 20
  • 2
    This might be very specific to the GUI toolkit the program is using. Some prefer overriding virtual functions, some use events/messages and they all use their own structures and tables and setup code. Are you interested in MFC on Windows only or in general? – zxxc Nov 19 '18 at 10:58
  • @T.Todua you were missing the point zxxc was making. Consider something like Chromium-based browsers. The canvas on which the websites are being rendered will be a single window in terms of how Windows (user32.dll) looks at it. Everything inside is drawn by the application. However, something like MFC or WTL makes use of the native windowing capabilities built into Windows and that involves sending/receiving so-called window messages. These two extremes require completely different approaches even though both can run on Windows. – 0xC0000022L Nov 20 '18 at 08:27
  • 1
    Use AU3_Spy.exe tool in AutoHotKey. It shows many useful info about Window buttons. Also executable may have some resource file, use Resource Hacker. – Biswapriyo Nov 20 '18 at 10:06
  • @0xC0000022L thanks for explanation! I completely understand now. Yes, I meant for typical windows application with native window (MFC mostly as i think) – T.Todua Nov 20 '18 at 10:27
  • @Biswapriyo can it be done with x64dbg debugger or like that? I want a small 'how-to'. – T.Todua Nov 20 '18 at 10:30
  • 2
    @Biswapriyo you may find this helpful as well. And of course there is Spy++ which comes with Visual C++. – 0xC0000022L Nov 20 '18 at 11:55
  • @0xC0000022L I've found another list here - https://alternativeto.net/software/winspy-/ will try them in virtualbox to avoid any possible malware. – T.Todua Nov 20 '18 at 21:52

0 Answers0