1

Came across this while debugging a exe. Cant find much on it anywhere so thought I'll put it up here. Any ideas as to what this could be used for?

CPU Disasm Address Hex dump Command Comments 77887F10 . 64 3A 5C 77 3 ASCII "d:\w7rtm\minkern" ; ASCII "d:\w7rtm\minkernel\ntdll\ldrinit.c"

|improve this question
  • 1
    how is it a duplicate? completely different path... – Chuck Nurit Jul 23 at 22:58
  • This is not malware. That is most certainly a path to the Windows source code files where that build of Windows was compiled from. For instance in the symbols for ntdll.dll for Windows 10 now, there's a lot of debugging strings that give the following folder as the location of their source files: "minkernel\ntdll\*****" – c00000fd Oct 22 at 3:35
0

Looks like a path that you might find in a checked (== with assertions) build of Windows 7 as a source path in the output of failed assertions. However, it could be a fake to make something appear more legit. You're tagging the question as but I don't quite see the connection.

Given the path it would not be inconceivable to think that this is some code that uses an older version of ntdll.dll loaded by another name. Stranger things have happened, such as loading a second ntoskrnl.exe to dodge a possibly patched running kernel.

Anyway the RTM in w7rtm means release to manufacturer and refers to the very first release version of a Windows. And given that this refers to Windows 7, this is several years old by now.

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.