The struct looks like this.
typedef struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR {
struct _RTL_DYNAMIC_HASH_TABLE_ENTRY HashEntry;
struct _LIST_ENTRY* CurEntry;
struct _LIST_ENTRY* ChainHead;
ULONG BucketIndex;// start from 0 to tablesize - 1
};
typedef struct _RTL_DYNAMIC_HASH_TABLE_ENTRY { struct _LIST_ENTRY Linkage; ULONG64 Signature; };
The function I'm interested in is nt!RtlInitEnumerationHashTable
BOOLEAN __stdcall RtlInitEnumerationHashTable(PRTL_DYNAMIC_HASH_TABLE HashTable, PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator)
I set a bp at the function and got this
kv
# Child-SP RetAddr : Args to Child : Call Site
00 ffff888e`d3bbf1c8 fffff80a`d2e72de4 : ffff8a83`e35e0d30 00000000`00000000 ffffb08f`74f38d70 00000000`00000000 : nt!RtlEnumerateEntryHashTable
01 ffff888e`d3bbf1d0 fffff80a`d261b740 : 00000000`00000000 fffff80a`d2fc9828 fffff80a`d2fc7930 ffff8a83`e9218000 : tcpip!Ipv4EnumerateAllPaths+0x2c4
02 ffff888e`d3bbf3b0 fffff80a`d3ab290e : ffff8a83`e9218000 ffff8a83`00000070 0000000c`840ff690 ffff8a83`e2802340 : NETIO!NsiEnumerateObjectsAllParametersEx+0x240
db 0xffff8a83e35e0d30
ffff8a83`e35e0d30 00 00 00 00 00 00 00 00-00 20 00 00 00 00 00 00 ......... ......
ffff8a83`e35e0d40 ff 1f 00 00 66 00 00 00-4b 00 00 00 01 00 00 00 ....f...K.......
ffff8a83`e35e0d50 60 99 6d e3 83 8a ff ff-00 00 00 00 00 00 00 00 `.m.............
ffff8a83`e35e0d60 00 00 00 00 00 00 00 00-03 00 00 00 00 00 00 00 ................
1: kd> kP
# Child-SP RetAddr Call Site
00 ffff888e`d3bbf1c8 fffff80a`d2e72de4 nt!RtlEnumerateEntryHashTable
01 ffff888e`d3bbf1d0 fffff80a`d261b740 tcpip!Ipv4EnumerateAllPaths+0x2c4
02 ffff888e`d3bbf3b0 fffff80a`d3ab290e NETIO!NsiEnumerateObjectsAllParametersEx+0x240
I want to display the struct of the function argument Enumerator. I also want to look into the struct to get the Signature in the HashEntry. Any tips?Thanks