0

I'm debugging windows server 2019 in windbg and I want to find function IppInitializePathSet. However, I can't find the function in IDA but I can find the symbol named tcpip!IppInitializePathSet. How to find the target function?

2
  • Set a breakpoint at the call to that function, and press F7 to step into the function. Or maybe you can load tcpip.sys to IDA and look in the function list.
    – raspiduino
    Aug 12, 2022 at 5:33
  • 1
    @raspiduino I did load the tcpip.sys file into IDA but there is no such function. I also use the relative address computed in windbg and add the base address in IDA but ended in some unknown function. Can you give some tips? I want to find it in IDA because I want to see the pseudocode BTW. Aug 12, 2022 at 6:49

1 Answer 1

0
0: kd> .reload /f tcpip.sys
0: kd> lm m tcp*
start             end                 module name
fffff803`575f0000 fffff803`578dc000   tcpip      (pdb symbols)          f:\symbols\tcpip.pdb\F733C426A17672D6B1CD7EFD711F586C1\tcpip.pdb

it is a public function is the pdbg loaded in ida ?

0: kd> x /v tcpip!IppInitializePathSet
pub func   fffff803`57748790    0 tcpip!IppInitializePathSet (IppInitializePathSet)

you can find the function by using the relative address from module base

0: kd> ? tcpip!IppInitializePathSet-tcpip
Evaluate expression: 1410960 = 00000000`00158790

the function as is doesnt appear to be complicated this is not from 2019 but winx

0: kd> uf tcpip!IppInitializePathSet
tcpip!IppInitializePathSet:
fffff803`57748790 48895c2410      mov     qword ptr [rsp+10h],rbx
fffff803`57748795 4889742418      mov     qword ptr [rsp+18h],rsi
fffff803`5774879a 57              push    rdi
fffff803`5774879b 4883ec20        sub     rsp,20h
fffff803`5774879f 448b05c2ba0a00  mov     r8d,dword ptr [tcpip!IppDefaultMemoryLimitOfBuffers (fffff803`577f4268)]
fffff803`577487a6 488d8190010000  lea     rax,[rcx+190h]
fffff803`577487ad 4889442430      mov     qword ptr [rsp+30h],rax
fffff803`577487b2 8bfa            mov     edi,edx
fffff803`577487b4 48b8abaaaaaaaaaaaaaa mov rax,0AAAAAAAAAAAAAAABh
fffff803`577487be 488bf1          mov     rsi,rcx
fffff803`577487c1 49f7e0          mul     rax,r8
fffff803`577487c4 48c1ea07        shr     rdx,7
fffff803`577487c8 85d2            test    edx,edx
fffff803`577487ca 7405            je      tcpip!IppInitializePathSet+0x41 (fffff803`577487d1)

tcpip!IppInitializePathSet+0x3c:
fffff803`577487cc 3bfa            cmp     edi,edx
fffff803`577487ce 0f47fa          cmova   edi,edx

tcpip!IppInitializePathSet+0x41:
fffff803`577487d1 8a05a9e50a00    mov     al,byte ptr [tcpip!TcpipIsServerSKU (fffff803`577f6d80)]
fffff803`577487d7 41b8c0010000    mov     r8d,1C0h
fffff803`577487dd f6d8            neg     al
fffff803`577487df 1bdb            sbb     ebx,ebx
fffff803`577487e1 33d2            xor     edx,edx
fffff803`577487e3 81e3801f0000    and     ebx,1F80h
fffff803`577487e9 e8d295f4ff      call    tcpip!memset (fffff803`57691dc0)
fffff803`577487ee 4533c9          xor     r9d,r9d
fffff803`577487f1 89be4c010000    mov     dword ptr [rsi+14Ch],edi
fffff803`577487f7 4533c0          xor     r8d,r8d
fffff803`577487fa 8d9380000000    lea     edx,[rbx+80h]
fffff803`57748800 488d4c2430      lea     rcx,[rsp+30h]
fffff803`57748805 4c8b1524760c00  mov     r10,qword ptr [tcpip!_imp_RtlCreateHashTableEx (fffff803`5780fe30)]
fffff803`5774880c e89f0425f9      call    nt!RtlCreateHashTableEx (fffff803`50998cb0)
fffff803`57748811 84c0            test    al,al
fffff803`57748813 7533            jne     tcpip!IppInitializePathSet+0xb8 (fffff803`57748848)

tcpip!IppInitializePathSet+0x85:
fffff803`57748815 833d88640a0001  cmp     dword ptr [tcpip!MICROSOFT_TCPIP_PROVIDER_Context+0x24 (fffff803`577eeca4)],1
fffff803`5774881c 7523            jne     tcpip!IppInitializePathSet+0xb1 (fffff803`57748841)

tcpip!IppInitializePathSet+0x8e:
fffff803`5774881e f6057ee40a0008  test    byte ptr [tcpip!Microsoft_Windows_TCPIPEnableBits+0x3 (fffff803`577f6ca3)],8
fffff803`57748825 741a            je      tcpip!IppInitializePathSet+0xb1 (fffff803`57748841)

tcpip!IppInitializePathSet+0x97:
fffff803`57748827 4c8d0d22e50700  lea     r9,[tcpip!`string' (fffff803`577c6d50)]
fffff803`5774882e 488d15331e0700  lea     rdx,[tcpip!TCPIP_MEMORY_FAILURES (fffff803`577ba668)]
fffff803`57748835 488d0d44640a00  lea     rcx,[tcpip!MICROSOFT_TCPIP_PROVIDER_Context (fffff803`577eec80)]
fffff803`5774883c e8e323faff      call    tcpip!McTemplateK0z_EtwWriteTransfer (fffff803`576eac24)

tcpip!IppInitializePathSet+0xb1:
fffff803`57748841 b89a0000c0      mov     eax,0C000009Ah
fffff803`57748846 eb0a            jmp     tcpip!IppInitializePathSet+0xc2 (fffff803`57748852)

tcpip!IppInitializePathSet+0xb8:
fffff803`57748848 488bce          mov     rcx,rsi
fffff803`5774884b e88491faff      call    tcpip!RtlInitializeScalableMrswLock (fffff803`576f19d4)
fffff803`57748850 33c0            xor     eax,eax

tcpip!IppInitializePathSet+0xc2:
fffff803`57748852 488b5c2438      mov     rbx,qword ptr [rsp+38h]
fffff803`57748857 488b742440      mov     rsi,qword ptr [rsp+40h]
fffff803`5774885c 4883c420        add     rsp,20h
fffff803`57748860 5f              pop     rdi
fffff803`57748861 c3              ret
0: kd>

pseudocode from ghidra 1015

undefined8 IppInitializePathSet(void *param_1,uint param_2)

{
  char cVar1;
  NTSTATUS uVar2;
  uint uVar3;
  bool bVar4;
  longlong local_res8;
  
  local_res8 = (longlong)param_1 + 400;
  uVar3 = IppDefaultMemoryLimitOfBuffers / 0xc0;
  if ((uVar3 != 0) && (uVar3 < param_2)) {
    param_2 = uVar3;
  }
  bVar4 = TcpipIsServerSKU != '\0';
  memset(param_1,0,0x1c0);
  *(uint *)((longlong)param_1 + 0x14c) = param_2;
  _uVar2 = 0;
  cVar1 = RtlCreateHashTableEx(&local_res8,(-(uint)bVar4 & 0x1f80) + 0x80,0,0);
  if (cVar1 == '\0') {
    if ((DAT_1c01feca4 == 1) && ((DAT_1c0206ca3 & 8) != 0)) {
      McTemplateK0z_EtwWriteTransfer
                (&MICROSOFT_TCPIP_PROVIDER_Context,&TCPIP_MEMORY_FAILURES,_uVar2,
                 L"path hash table (IPNG)");
    }
    _uVar2 = 0xc000009a;
  }
  else {
    RtlInitializeScalableMrswLock(param_1);
    _uVar2 = 0;
  }
  return _uVar2;
}
1
  • Thanks for the answer. I appreciate it! Aug 17, 2022 at 6:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.