Symbol name tcpip!IppInitializePathSet found in windbg but unable to find function IppInitializePathSet in tcpip.sys

Question

I'm debugging windows server 2019 in windbg and I want to find function IppInitializePathSet. However, I can't find the function in IDA but I can find the symbol named tcpip!IppInitializePathSet. How to find the target function?

Answer 1

0: kd> .reload /f tcpip.sys
0: kd> lm m tcp*
start             end                 module name
fffff803`575f0000 fffff803`578dc000   tcpip      (pdb symbols)          f:\symbols\tcpip.pdb\F733C426A17672D6B1CD7EFD711F586C1\tcpip.pdb

it is a public function is the pdbg loaded in ida ?

0: kd> x /v tcpip!IppInitializePathSet
pub func   fffff803`57748790    0 tcpip!IppInitializePathSet (IppInitializePathSet)

you can find the function by using the relative address from module base

0: kd> ? tcpip!IppInitializePathSet-tcpip
Evaluate expression: 1410960 = 00000000`00158790

the function as is doesnt appear to be complicated this is not from 2019 but winx

0: kd> uf tcpip!IppInitializePathSet
tcpip!IppInitializePathSet:
fffff803`57748790 48895c2410      mov     qword ptr [rsp+10h],rbx
fffff803`57748795 4889742418      mov     qword ptr [rsp+18h],rsi
fffff803`5774879a 57              push    rdi
fffff803`5774879b 4883ec20        sub     rsp,20h
fffff803`5774879f 448b05c2ba0a00  mov     r8d,dword ptr [tcpip!IppDefaultMemoryLimitOfBuffers (fffff803`577f4268)]
fffff803`577487a6 488d8190010000  lea     rax,[rcx+190h]
fffff803`577487ad 4889442430      mov     qword ptr [rsp+30h],rax
fffff803`577487b2 8bfa            mov     edi,edx
fffff803`577487b4 48b8abaaaaaaaaaaaaaa mov rax,0AAAAAAAAAAAAAAABh
fffff803`577487be 488bf1          mov     rsi,rcx
fffff803`577487c1 49f7e0          mul     rax,r8
fffff803`577487c4 48c1ea07        shr     rdx,7
fffff803`577487c8 85d2            test    edx,edx
fffff803`577487ca 7405            je      tcpip!IppInitializePathSet+0x41 (fffff803`577487d1)

tcpip!IppInitializePathSet+0x3c:
fffff803`577487cc 3bfa            cmp     edi,edx
fffff803`577487ce 0f47fa          cmova   edi,edx

tcpip!IppInitializePathSet+0x41:
fffff803`577487d1 8a05a9e50a00    mov     al,byte ptr [tcpip!TcpipIsServerSKU (fffff803`577f6d80)]
fffff803`577487d7 41b8c0010000    mov     r8d,1C0h
fffff803`577487dd f6d8            neg     al
fffff803`577487df 1bdb            sbb     ebx,ebx
fffff803`577487e1 33d2            xor     edx,edx
fffff803`577487e3 81e3801f0000    and     ebx,1F80h
fffff803`577487e9 e8d295f4ff      call    tcpip!memset (fffff803`57691dc0)
fffff803`577487ee 4533c9          xor     r9d,r9d
fffff803`577487f1 89be4c010000    mov     dword ptr [rsi+14Ch],edi
fffff803`577487f7 4533c0          xor     r8d,r8d
fffff803`577487fa 8d9380000000    lea     edx,[rbx+80h]
fffff803`57748800 488d4c2430      lea     rcx,[rsp+30h]
fffff803`57748805 4c8b1524760c00  mov     r10,qword ptr [tcpip!_imp_RtlCreateHashTableEx (fffff803`5780fe30)]
fffff803`5774880c e89f0425f9      call    nt!RtlCreateHashTableEx (fffff803`50998cb0)
fffff803`57748811 84c0            test    al,al
fffff803`57748813 7533            jne     tcpip!IppInitializePathSet+0xb8 (fffff803`57748848)

tcpip!IppInitializePathSet+0x85:
fffff803`57748815 833d88640a0001  cmp     dword ptr [tcpip!MICROSOFT_TCPIP_PROVIDER_Context+0x24 (fffff803`577eeca4)],1
fffff803`5774881c 7523            jne     tcpip!IppInitializePathSet+0xb1 (fffff803`57748841)

tcpip!IppInitializePathSet+0x8e:
fffff803`5774881e f6057ee40a0008  test    byte ptr [tcpip!Microsoft_Windows_TCPIPEnableBits+0x3 (fffff803`577f6ca3)],8
fffff803`57748825 741a            je      tcpip!IppInitializePathSet+0xb1 (fffff803`57748841)

tcpip!IppInitializePathSet+0x97:
fffff803`57748827 4c8d0d22e50700  lea     r9,[tcpip!`string' (fffff803`577c6d50)]
fffff803`5774882e 488d15331e0700  lea     rdx,[tcpip!TCPIP_MEMORY_FAILURES (fffff803`577ba668)]
fffff803`57748835 488d0d44640a00  lea     rcx,[tcpip!MICROSOFT_TCPIP_PROVIDER_Context (fffff803`577eec80)]
fffff803`5774883c e8e323faff      call    tcpip!McTemplateK0z_EtwWriteTransfer (fffff803`576eac24)

tcpip!IppInitializePathSet+0xb1:
fffff803`57748841 b89a0000c0      mov     eax,0C000009Ah
fffff803`57748846 eb0a            jmp     tcpip!IppInitializePathSet+0xc2 (fffff803`57748852)

tcpip!IppInitializePathSet+0xb8:
fffff803`57748848 488bce          mov     rcx,rsi
fffff803`5774884b e88491faff      call    tcpip!RtlInitializeScalableMrswLock (fffff803`576f19d4)
fffff803`57748850 33c0            xor     eax,eax

tcpip!IppInitializePathSet+0xc2:
fffff803`57748852 488b5c2438      mov     rbx,qword ptr [rsp+38h]
fffff803`57748857 488b742440      mov     rsi,qword ptr [rsp+40h]
fffff803`5774885c 4883c420        add     rsp,20h
fffff803`57748860 5f              pop     rdi
fffff803`57748861 c3              ret
0: kd>

pseudocode from ghidra 1015

undefined8 IppInitializePathSet(void *param_1,uint param_2)

{
  char cVar1;
  NTSTATUS uVar2;
  uint uVar3;
  bool bVar4;
  longlong local_res8;
  
  local_res8 = (longlong)param_1 + 400;
  uVar3 = IppDefaultMemoryLimitOfBuffers / 0xc0;
  if ((uVar3 != 0) && (uVar3 < param_2)) {
    param_2 = uVar3;
  }
  bVar4 = TcpipIsServerSKU != '\0';
  memset(param_1,0,0x1c0);
  *(uint *)((longlong)param_1 + 0x14c) = param_2;
  _uVar2 = 0;
  cVar1 = RtlCreateHashTableEx(&local_res8,(-(uint)bVar4 & 0x1f80) + 0x80,0,0);
  if (cVar1 == '\0') {
    if ((DAT_1c01feca4 == 1) && ((DAT_1c0206ca3 & 8) != 0)) {
      McTemplateK0z_EtwWriteTransfer
                (&MICROSOFT_TCPIP_PROVIDER_Context,&TCPIP_MEMORY_FAILURES,_uVar2,
                 L"path hash table (IPNG)");
    }
    _uVar2 = 0xc000009a;
  }
  else {
    RtlInitializeScalableMrswLock(param_1);
    _uVar2 = 0;
  }
  return _uVar2;
}