View Single Post
  #3  
Old 07-18-2003, 15:49
xobor xobor is offline
Friend
 
Join Date: May 2002
Location: Slovakia
Posts: 115
Rept. Given: 6
Rept. Rcvd 4 Times in 4 Posts
Thanks Given: 2
Thanks Rcvd at 19 Times in 14 Posts
xobor Reputation: 5
Exactly as Squidge wrote

in last Olly press ALT+F1 (Plugins->Command Line->Command Line)

in editbox type bp CreateFileA, STRING [[ESP+4]]=="yourfilename"

press F9, when Olly breaks press CTRL+F9 (run until return), press F8 (one step) and read value at eax - it's handle for your file

so in Command Line plugin add new breakpoint

bp WriteFile, [[ESP+4]]==90

(of course you must replace value 90 by your eax value)

and go for debugging

hope this helps
Reply With Quote