0

I think I have a massive understanding problem with the following issue:

Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on CreateFileW the debugger can just follow the Import Table address and do so.

However, I've been watching some tutorials lately and often they set breakpoints on e.g. CreateFileW for modules that have been loaded dynamically e.g. LoadLibaryA (while themself are at the entry point of the program).

I'm unable to understand how the debugger can set a breakpoint for a module that yet has not been loaded into the memory?

1 Answer 1

0

The debugging API provides a notification for newly loaded libraries so the debugger can inspect their export table and set breakpoints on matching symbols.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.