Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA )
The first problem is to get the
Tried to do it like this
"module 'ntdll' has no names"
Although the call
get_name_ea_simple('kernel32_CreateFileW') works just fine:
(if debugger paused on executable EP)
And here is second problem - exec script commands after debugger loads all modules info. If I do something like:
run_to(get_inf_attr(INF_MIN_EA)) # start the debugger and execute to the entry point CreateFileW = get_name_ea_simple('kernel32_CreateFileW') if CreateFileW == BADADDR: warning('kernel32_CreateFileW is null') return
I'll get my warning. So how to do it right?
I found out that if we stop at the entry point and manually load symbols for
ntdll, then the following command works