View Full Version : How to put breakpoint on NtCreateFile
fundoo
September 7th, 2009, 05:23
I am using OllyDbg 1.10. When I try to put breakpoint on NtCreateFile or NtOpenFile, it says unknown identifier. Also, I do not see these functions in the export list. Can someone help how can i debug into these functions?
squidge
September 7th, 2009, 07:20
NtCreateFile is part of ntdll.dll. The app most likely dynamically links to it via LoadLibrary/GetProcAddress.
disavowed
September 7th, 2009, 16:59
It's because NtCreateFile and NtOpenFile are exported as ZwCreateFile and ZwOpenFile, respectively.
squidge
September 7th, 2009, 17:23
Really? I thought they were both exported, but ZwCreateFile, etc was only callable from kernel mode drivers, whilst NtCreateFile can be called by userland apps, and does more security checking.
disavowed
September 9th, 2009, 08:11
They're both in the Export Address Table, but since they both point to the same function address in code, OllyDbg will only show one of them: ZwCreateFile
Powered by vBulletin® Version 4.2.2 Copyright © 2020 vBulletin Solutions, Inc. All rights reserved.