Results 1 to 5 of 5

Thread: How to put breakpoint on NtCreateFile

  1. #1
    fundoo
    Guest

    How to put breakpoint on NtCreateFile

    I am using OllyDbg 1.10. When I try to put breakpoint on NtCreateFile or NtOpenFile, it says unknown identifier. Also, I do not see these functions in the export list. Can someone help how can i debug into these functions?
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    NtCreateFile is part of ntdll.dll. The app most likely dynamically links to it via LoadLibrary/GetProcAddress.

  3. #3
    <script>alert(0)</script> disavowed's Avatar
    Join Date
    Apr 2002
    Posts
    1,281
    It's because NtCreateFile and NtOpenFile are exported as ZwCreateFile and ZwOpenFile, respectively.

  4. #4
    Really? I thought they were both exported, but ZwCreateFile, etc was only callable from kernel mode drivers, whilst NtCreateFile can be called by userland apps, and does more security checking.

  5. #5
    <script>alert(0)</script> disavowed's Avatar
    Join Date
    Apr 2002
    Posts
    1,281
    They're both in the Export Address Table, but since they both point to the same function address in code, OllyDbg will only show one of them: ZwCreateFile

Similar Threads

  1. What's log breakpoint & how to use it?
    By achan in forum OllyDbg Support Forums
    Replies: 1
    Last Post: August 3rd, 2005, 11:06
  2. about conditional breakpoint?
    By mike in forum OllyDbg Support Forums
    Replies: 1
    Last Post: February 12th, 2004, 06:08
  3. Log conditional breakpoint API?
    By abs0 in forum Plugins (General)
    Replies: 3
    Last Post: February 6th, 2004, 15:06
  4. breakpoint a var ?
    By Anonymous in forum OllyDbg Support Forums
    Replies: 2
    Last Post: July 16th, 2003, 01:01
  5. breakpoint please help
    By Anonymous in forum OllyDbg Support Forums
    Replies: 1
    Last Post: July 14th, 2003, 13:10

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •