0

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA )


The first problem is to get the ntdll!NtCreateFile address Tried to do it like this get_name_ea_simple('ntdll_NtCreateFile') but "module 'ntdll' has no names"

Although the call get_name_ea_simple('kernel32_CreateFileW') works just fine: 0x770d08d0 (if debugger paused on executable EP)

And here is second problem - exec script commands after debugger loads all modules info. If I do something like:

run_to(get_inf_attr(INF_MIN_EA)) # start the debugger and execute to the entry point
CreateFileW = get_name_ea_simple('kernel32_CreateFileW')
    if CreateFileW == BADADDR:
        warning('kernel32_CreateFileW is null')
        return

I'll get my warning. So how to do it right?


IDA 7.5

Added

I found out that if we stop at the entry point and manually load symbols for ntdll, then the following command works get_name_ea_simple('ZwCreateFile')

2
  • ntddl typo ? .....
    – blabb
    Feb 5 at 20:57
  • Thx. Yes 'ntdll' has no names
    – A-off
    Feb 5 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.