Cheat Engine

Deine Mutter · Last edited by Deine Mutter on Mon Jul 07, 2008 6:36 am; edited 1 time in total

Hello,
When I disassemble win32k.sys with IDA I can't really search for function names (such as NtUserSendInput, NtUserGetWindowThreadProcessId...). It shows me only some function names properly, but most functions show up as "sub_STARTADDRESS".

In another forum I read that I should accept this message

But it didn't help.

Noz3001 · Posted: Mon Jul 07, 2008 6:36 am Post subject:

Works fine for me:

Are you loading it up with these options?:

Deine Mutter · Posted: Mon Jul 07, 2008 2:00 pm Post subject:

Yes I loaded it up with these options but what you showed are the "Names" and "Exports". Those are looking the same for me and I can't find the NtUser* Apis there. What i mean is the "Functions"-window (I think they should be listed there) and there is the majority showed up as "sub_STARTADDRESS".

Deine Mutter · Posted: Mon Jul 07, 2008 4:55 pm Post subject:

I am loading the debug symbols (if you mean the pdb file(s)), but the apis still don't appear (I loaded the current Windows xp sp3 debug symbols, but it didn't help either ..)

lurc · Posted: Mon Jul 07, 2008 5:04 pm Post subject: