Hello,

Is it possible to set a breakpoint whenever a file tries to open/access/close a file?

Thanks in advance!

yes.

oh, you want to know how? Press ALT+F1 and type "bp CreateFileA".

Nah, didn't wanna know how ;-)

But anyway: works great! I inmediately found where I was looking for!

And if someone feels like to answer another question: is it also possible for in the future to set a breakpoint on a particular filename? (and if so, how it is done ;-) )
(Maybe this is possible, cause I noticed that the filename is the first parameter in the call...)

Thanks again!

Look before CreateFileA, it PUSHes variables onto the stack. If you look in WinAPI help file, the first parameter is the filename, in assembly, parameter order is reversed, so your last PUSH before CreateFileA is the address of the filename. In command line type d ADDRESS to see the string. Not sure if you can break point specifically on filename. You could use a script or some shit in softice.

or you can use a conditional breakpoint on CreateFile APi. read the help

I press Alt+F1 on olly debugger. it does nothing... any idea why?

install the commandline plugin

i need a breakpoint when the WORD in memory address at 12AE74 is equal to $FFFF

help help thx

easy,try it by your'self!

--- select on line to break( alway above createfileA )look memory reference
such as when you select line that $ffff is a arg---
push [dd ds+4b] now right click select bp -> contition bp ,in text box

fill [dd ds+4b]==a value that true ,ollydbg break
or [dd ds+4b]=="string" yeah,you can play with this for any api call.