Class 07 · KP 17 / 19
Lab 3 Part B: Steps
# In x64dbg, on a 64-bit target:
bp MessageBoxW # set breakpoint on the API
# run; when it hits:
# RCX = hWnd
# RDX -> lpText (right-click RDX -> Follow in Dump, view as Unicode)
# R8 -> lpCaption
# R9 = uType
# Demonstrate a "hook" by altering behavior at the breakpoint:
# - edit the RDX/R8 target bytes to change the shown text, or
# - patch uType (R9) to change which buttons appear, then continue.
- A debugger breakpoint is a manual hook: you interpose, inspect the register-passed args, modify, and resume.
- Deliverable: screenshot the recovered strings + your altered call.