1

I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this?

.text:00000001C00218C2                 call    cs:wcsnlen
.text:00000001C00218C9                 nop     dword ptr [rax+rax+00h]
.text:00000001C00218CE                 mov     rdx, r15
.text:00000001C00218D1                 mov     ecx, ebx
.text:00000001C00218D3                 lea     r8d, [rax+rax]
.text:00000001C00218D7                 call    RtlCompute37Hash
.text:00000001C00218DC                 bts     eax, 1Fh
.text:00000001C00218E0                 lea     r8, [rsp+0B8h+Context] ; Context
.text:00000001C00218E5                 xorps   xmm0, xmm0
.text:00000001C00218E8                 mov     edx, eax        ; Signature
.text:00000001C00218EA                 lea     rcx, stru_1C0077988 ; HashTable
.text:00000001C00218F1                 mov     ebx, eax
.text:00000001C00218F3                 movdqu  xmmword ptr [rsp+0B8h+Context.ChainHead], xmm0
.text:00000001C00218F9                 call    cs:RtlLookupEntryHashTable
.text:00000001C0021900                 nop     dword ptr [rax+rax+00h]

When I double clicked it, I got this

.idata:00000001C007E378                                         ; sub_1C0014BCC+107↑p ...
.idata:00000001C007E380 ; PRTL_DYNAMIC_HASH_TABLE_ENTRY __stdcall RtlLookupEntryHashTable(PRTL_DYNAMIC_HASH_TABLE HashTable, ULONG_PTR Signature, PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context)
.idata:00000001C007E380                 extrn RtlLookupEntryHashTable:qword
.idata:00000001C007E380                                         ; CODE XREF: KfdAleRemoveFlowContextTable+102↑p
.idata:00000001C007E380                                         ; KfdAleAcquireEndpointContextFromFlow+92↑p ...
.idata:00000001C007E388 ; BOOLEAN __stdcall KeTestSpinLock(PKSPIN_LOCK SpinLock)
.idata:00000001C007E388                 extrn KeTestSpinLock:qword
Improve this question
3
  • 3
    Hi and welcome to RE.SE. It's not quite clear what you want. What's your question? If you want to see pseudo-code for a function imported from elsewhere, you'll have to open that elsewhere location (in this case likely ntoskrnl.exe) and find the function there and throw a decompiler at that.
    – 0xC0000022L ♦
    Aug 1, 2022 at 7:30
  • Like 0xC0000022L said, it's a function from ntoskrnl.exe that your .sys file imported and used. If you just want to know that that function does, you can search on Google. If you want to know the pseudo-code, you can decompile ntoskrnl.exe or you can view the (clone) source code of that function from ReactOS project
    – raspiduino
    Aug 1, 2022 at 13:16
  • I found it in the import finally. Thx
    – anonymous bear
    Aug 2, 2022 at 22:27

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.