3

I need the CONTROL_AREA Windows SDK structure to reverse fltMgr.sys. I see it in my ntoskrnl.i64 but not my fltMgr.i64 despite the fact they both only have ntddk64_win7 type library loaded. Why does my ntoskrnl project have 2500 types when my fltMgr.sys only has 400?

1 Answer 1

3

I needed to load the types from ntoskrnl.exe into fltMgr.sys using File -> Load File -> Load PDB File.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.