Came across this while debugging a exe. Cant find much on it anywhere so thought I'll put it up here. Any ideas as to what this could be used for?

CPU Disasm Address Hex dump Command Comments 77887F10 . 64 3A 5C 77 3 ASCII "d:\w7rtm\minkern" ; ASCII "d:\w7rtm\minkernel\ntdll\ldrinit.c"

marked as duplicate by 0xC0000022L Jul 18 '18 at 7:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Looks like a path that you might find in a checked (== with assertions) build of Windows 7 as a source path in the output of failed assertions. However, it could be a fake to make something appear more legit. You're tagging the question as but I don't quite see the connection.

Given the path it would not be inconceivable to think that this is some code that uses an older version of ntdll.dll loaded by another name. Stranger things have happened, such as loading a second ntoskrnl.exe to dodge a possibly patched running kernel.

Anyway the RTM in w7rtm means release to manufacturer and refers to the very first release version of a Windows. And given that this refers to Windows 7, this is several years old by now.

Not the answer you're looking for? Browse other questions tagged or ask your own question.