View Full Version : NtReadFile API
michelinok
December 27th, 2005, 14:56
To check how my application read infos from a file, i've seen that it uses the NtReadFile API.
When i set "bp NtReadFile" ollydbg says "Unknown module".
What's wrong?
gabri3l
December 27th, 2005, 15:38
NTReadFile and ZwReadFile are basically the same function. Try setting a BP on ZwReadFile.
Read this article for more information:
Nt vs. Zw - Clearing Confusion On The Native API
(i used google cache because you have to register to view article)
http://64.233.161.104/search?q=cache:e0zNVFXlsaMJ:www.osronline.com/ar ("http://64.233.161.104/search?q=cache:e0zNVFXlsaMJ:www.osronline.com/article.cfm%3Farticle%3D257++Nt+vs.+Zw+-+Clearing+Confusion+On+The+Native+API+&hl=en&client=firefox-a") ticle.cfm%3Farticle%3D257++Nt+vs.+Zw+-+Clearing+Confusion+On+The+Nativ e+API+&hl=en&client=firefox-a
Lord_Looser
December 27th, 2005, 15:39
I'm too late ;-)
Use ZwReadFile instead of NtReadFile.
NtReadFile links to ntdll.ZwReadFile, it's a forwarded function.
Powered by vBulletin® Version 4.2.2 Copyright © 2018 vBulletin Solutions, Inc. All rights reserved.