Trying to reverse a windows executable, I found the function creatfile
that tries to open a file in read only mode,
I create the file in the very same directory with the same name given to the function, but it always fail with a error code -1, and I'd like to figure out why.
The value of the eax
register after the function call is -1, here is the output of dir
command from the very same directory
Any idea why it fails?
The \\.\
notation is not used for ordinary files. It is used for devices. So creating a regular file will not work here. Instead you need to create a device with that name. Those names are also common in device drivers - hence probably the naming of this task.
Refer to section "Win32 Device Namespaces" in Naming Files, Paths, and Namespaces for more info.