J
john
Hi
I set a breakpoint at Ntdll!NtCreateFile when I open a file from
notepad, and it breaks, however, the instruction displayed is "mov
eax, 25h", i simply don't why, and shouldn't it be something like
"push eax....", the whole thing is like this:
ntdll!NtCreateFile:
7c90d682 b825000000 mov eax,25h
7c90d687 ba0003fe7f mov edx,offset SharedUserData!
SystemCallStub (7ffe0300)
7c90d68c ff12 call dword ptr [edx]
7c90d68e c22c00 ret 2Ch
Can anybody explain, thanks.
Peace.
I set a breakpoint at Ntdll!NtCreateFile when I open a file from
notepad, and it breaks, however, the instruction displayed is "mov
eax, 25h", i simply don't why, and shouldn't it be something like
"push eax....", the whole thing is like this:
ntdll!NtCreateFile:
7c90d682 b825000000 mov eax,25h
7c90d687 ba0003fe7f mov edx,offset SharedUserData!
SystemCallStub (7ffe0300)
7c90d68c ff12 call dword ptr [edx]
7c90d68e c22c00 ret 2Ch
Can anybody explain, thanks.
Peace.