I'm debugging windows server 2019 in windbg and I want to find function IppInitializePathSet. However, I can't find the function in IDA but I can find the symbol named tcpip!IppInitializePathSet. How to find the target function?
1 Answer
0: kd> .reload /f tcpip.sys
0: kd> lm m tcp*
start end module name
fffff803`575f0000 fffff803`578dc000 tcpip (pdb symbols) f:\symbols\tcpip.pdb\F733C426A17672D6B1CD7EFD711F586C1\tcpip.pdb
it is a public function is the pdbg loaded in ida ?
0: kd> x /v tcpip!IppInitializePathSet
pub func fffff803`57748790 0 tcpip!IppInitializePathSet (IppInitializePathSet)
you can find the function by using the relative address from module base
0: kd> ? tcpip!IppInitializePathSet-tcpip
Evaluate expression: 1410960 = 00000000`00158790
the function as is doesnt appear to be complicated this is not from 2019 but winx
0: kd> uf tcpip!IppInitializePathSet
tcpip!IppInitializePathSet:
fffff803`57748790 48895c2410 mov qword ptr [rsp+10h],rbx
fffff803`57748795 4889742418 mov qword ptr [rsp+18h],rsi
fffff803`5774879a 57 push rdi
fffff803`5774879b 4883ec20 sub rsp,20h
fffff803`5774879f 448b05c2ba0a00 mov r8d,dword ptr [tcpip!IppDefaultMemoryLimitOfBuffers (fffff803`577f4268)]
fffff803`577487a6 488d8190010000 lea rax,[rcx+190h]
fffff803`577487ad 4889442430 mov qword ptr [rsp+30h],rax
fffff803`577487b2 8bfa mov edi,edx
fffff803`577487b4 48b8abaaaaaaaaaaaaaa mov rax,0AAAAAAAAAAAAAAABh
fffff803`577487be 488bf1 mov rsi,rcx
fffff803`577487c1 49f7e0 mul rax,r8
fffff803`577487c4 48c1ea07 shr rdx,7
fffff803`577487c8 85d2 test edx,edx
fffff803`577487ca 7405 je tcpip!IppInitializePathSet+0x41 (fffff803`577487d1)
tcpip!IppInitializePathSet+0x3c:
fffff803`577487cc 3bfa cmp edi,edx
fffff803`577487ce 0f47fa cmova edi,edx
tcpip!IppInitializePathSet+0x41:
fffff803`577487d1 8a05a9e50a00 mov al,byte ptr [tcpip!TcpipIsServerSKU (fffff803`577f6d80)]
fffff803`577487d7 41b8c0010000 mov r8d,1C0h
fffff803`577487dd f6d8 neg al
fffff803`577487df 1bdb sbb ebx,ebx
fffff803`577487e1 33d2 xor edx,edx
fffff803`577487e3 81e3801f0000 and ebx,1F80h
fffff803`577487e9 e8d295f4ff call tcpip!memset (fffff803`57691dc0)
fffff803`577487ee 4533c9 xor r9d,r9d
fffff803`577487f1 89be4c010000 mov dword ptr [rsi+14Ch],edi
fffff803`577487f7 4533c0 xor r8d,r8d
fffff803`577487fa 8d9380000000 lea edx,[rbx+80h]
fffff803`57748800 488d4c2430 lea rcx,[rsp+30h]
fffff803`57748805 4c8b1524760c00 mov r10,qword ptr [tcpip!_imp_RtlCreateHashTableEx (fffff803`5780fe30)]
fffff803`5774880c e89f0425f9 call nt!RtlCreateHashTableEx (fffff803`50998cb0)
fffff803`57748811 84c0 test al,al
fffff803`57748813 7533 jne tcpip!IppInitializePathSet+0xb8 (fffff803`57748848)
tcpip!IppInitializePathSet+0x85:
fffff803`57748815 833d88640a0001 cmp dword ptr [tcpip!MICROSOFT_TCPIP_PROVIDER_Context+0x24 (fffff803`577eeca4)],1
fffff803`5774881c 7523 jne tcpip!IppInitializePathSet+0xb1 (fffff803`57748841)
tcpip!IppInitializePathSet+0x8e:
fffff803`5774881e f6057ee40a0008 test byte ptr [tcpip!Microsoft_Windows_TCPIPEnableBits+0x3 (fffff803`577f6ca3)],8
fffff803`57748825 741a je tcpip!IppInitializePathSet+0xb1 (fffff803`57748841)
tcpip!IppInitializePathSet+0x97:
fffff803`57748827 4c8d0d22e50700 lea r9,[tcpip!`string' (fffff803`577c6d50)]
fffff803`5774882e 488d15331e0700 lea rdx,[tcpip!TCPIP_MEMORY_FAILURES (fffff803`577ba668)]
fffff803`57748835 488d0d44640a00 lea rcx,[tcpip!MICROSOFT_TCPIP_PROVIDER_Context (fffff803`577eec80)]
fffff803`5774883c e8e323faff call tcpip!McTemplateK0z_EtwWriteTransfer (fffff803`576eac24)
tcpip!IppInitializePathSet+0xb1:
fffff803`57748841 b89a0000c0 mov eax,0C000009Ah
fffff803`57748846 eb0a jmp tcpip!IppInitializePathSet+0xc2 (fffff803`57748852)
tcpip!IppInitializePathSet+0xb8:
fffff803`57748848 488bce mov rcx,rsi
fffff803`5774884b e88491faff call tcpip!RtlInitializeScalableMrswLock (fffff803`576f19d4)
fffff803`57748850 33c0 xor eax,eax
tcpip!IppInitializePathSet+0xc2:
fffff803`57748852 488b5c2438 mov rbx,qword ptr [rsp+38h]
fffff803`57748857 488b742440 mov rsi,qword ptr [rsp+40h]
fffff803`5774885c 4883c420 add rsp,20h
fffff803`57748860 5f pop rdi
fffff803`57748861 c3 ret
0: kd>
pseudocode from ghidra 1015
undefined8 IppInitializePathSet(void *param_1,uint param_2)
{
char cVar1;
NTSTATUS uVar2;
uint uVar3;
bool bVar4;
longlong local_res8;
local_res8 = (longlong)param_1 + 400;
uVar3 = IppDefaultMemoryLimitOfBuffers / 0xc0;
if ((uVar3 != 0) && (uVar3 < param_2)) {
param_2 = uVar3;
}
bVar4 = TcpipIsServerSKU != '\0';
memset(param_1,0,0x1c0);
*(uint *)((longlong)param_1 + 0x14c) = param_2;
_uVar2 = 0;
cVar1 = RtlCreateHashTableEx(&local_res8,(-(uint)bVar4 & 0x1f80) + 0x80,0,0);
if (cVar1 == '\0') {
if ((DAT_1c01feca4 == 1) && ((DAT_1c0206ca3 & 8) != 0)) {
McTemplateK0z_EtwWriteTransfer
(&MICROSOFT_TCPIP_PROVIDER_Context,&TCPIP_MEMORY_FAILURES,_uVar2,
L"path hash table (IPNG)");
}
_uVar2 = 0xc000009a;
}
else {
RtlInitializeScalableMrswLock(param_1);
_uVar2 = 0;
}
return _uVar2;
}
tcpip.sys
to IDA and look in the function list.