I need the CONTROL_AREA
Windows SDK structure to reverse fltMgr.sys
. I see it in my ntoskrnl.i64
but not my fltMgr.i64
despite the fact they both only have ntddk64_win7
type library loaded. Why does my ntoskrnl
project have 2500 types when my fltMgr.sys
only has 400?
1 Answer
I needed to load the types from ntoskrnl.exe
into fltMgr.sys
using File -> Load File -> Load PDB File.