windbg脚本

1. 修改函数返回值

File must be ${/v:$xx} format and start with upper case
@"" is literal string identifier;
pt can't work with gc;

bp kernel32!CreateFileW "		
	aS /mu ${/v:$File} poi(@esp+4);
	.block{					
		.if($spat(@\"${$File}\",\"*1.txt*\")){
			ad ${/v:$File};						
			pt \"r @eax = -1;g\";
		}.else{			
			ad ${/v:$File};
			gc;
		}
	}
"