shellassemblyreverse-engineeringcreatefileollydbg

CreateFile function fail reading a file even if it exists, error code -1


Trying to reverse a windows executable, I found the function creatfile that tries to open a file in read only mode,

enter image description here

I create the file in the very same directory with the same name given to the function, but it always fail with a error code -1, and I'd like to figure out why.

enter image description here

The value of the eax register after the function call is -1, here is the output of dir command from the very same directory

enter image description here

Any idea why it fails?


Solution

  • The \\.\ notation is not used for ordinary files. It is used for devices. So creating a regular file will not work here. Instead you need to create a device with that name. Those names are also common in device drivers - hence probably the naming of this task.

    Refer to section "Win32 Device Namespaces" in Naming Files, Paths, and Namespaces for more info.