Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Debug userland call

1 view
Skip to first unread message

BobS0327

unread,
Oct 20, 2009, 7:14:08 PM10/20/09
to
How would I debug a userland api call such as CreateFile to trace its
calling of the native NtCreateFile?

I'm assuming I can do this using kd.exe.

Kerem Gümrükcü

unread,
Oct 21, 2009, 2:11:49 AM10/21/09
to
Hi Stranger (Whats your name?),

well from where do you want to intercept the call,
from usermode or from kernelmode, e.g. do you
run your debugger in usermode or in kernelmode?
Generally you set a breakpoint for the function call,
see the WinDbg Documentation for the
Topic "Using Breakpoints".

If you do not run WinDbg, then your debugger mostly
will have the same option to set a breakpoint on some
function you want to catch,...


Regards

Kerem

--
-----------------------
Beste Gr�sse / Best regards / Votre bien devoue
Kerem G�mr�kc�
Latest Project: http://www.pro-it-education.de/software/deviceremover
Latest Open-Source Projects: http://entwicklung.junetz.de
-----------------------

"BobS0327" <BobS...@ptdprolog.net> schrieb im Newsbeitrag
news:hblg72$u48$1...@aioe.org...

Le Chaud Lapin

unread,
Nov 2, 2009, 10:44:43 PM11/2/09
to

1. Write tiny program that invokes CreateFile().
2. Set breakpoint at invocation of CreateFile().
3. Run program.
4. When break point hits, go into assembly-language mode.
5. Enjoy. :)

-Le Chaud Lapin-

0 new messages