WCU / Cybersecurity
~/CSC 471/Class 07/KP 17
Class 07 · KP 17 / 19

Lab 3 Part B: Steps

# In x64dbg, on a 64-bit target:
bp MessageBoxW            # set breakpoint on the API
# run; when it hits:
#   RCX = hWnd
#   RDX -> lpText     (right-click RDX -> Follow in Dump, view as Unicode)
#   R8  -> lpCaption
#   R9  =  uType

# Demonstrate a "hook" by altering behavior at the breakpoint:
#   - edit the RDX/R8 target bytes to change the shown text, or
#   - patch uType (R9) to change which buttons appear, then continue.
  • A debugger breakpoint is a manual hook: you interpose, inspect the register-passed args, modify, and resume.
  • Deliverable: screenshot the recovered strings + your altered call.