which command in windbg to use to display the struct in function argument

Question

The struct looks like this.

typedef struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR { 
struct _RTL_DYNAMIC_HASH_TABLE_ENTRY HashEntry; 
struct _LIST_ENTRY* CurEntry; 
struct _LIST_ENTRY* ChainHead; 
ULONG BucketIndex;// start from 0 to tablesize - 1
};

typedef struct _RTL_DYNAMIC_HASH_TABLE_ENTRY { struct _LIST_ENTRY Linkage; ULONG64 Signature; };

The function I'm interested in is nt!RtlInitEnumerationHashTable

BOOLEAN __stdcall RtlInitEnumerationHashTable(PRTL_DYNAMIC_HASH_TABLE HashTable, PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR Enumerator)

I set a bp at the function and got this

kv
 # Child-SP          RetAddr               : Args to Child                                                           : Call Site
00 ffff888e`d3bbf1c8 fffff80a`d2e72de4     : ffff8a83`e35e0d30 00000000`00000000 ffffb08f`74f38d70 00000000`00000000 : nt!RtlEnumerateEntryHashTable
01 ffff888e`d3bbf1d0 fffff80a`d261b740     : 00000000`00000000 fffff80a`d2fc9828 fffff80a`d2fc7930 ffff8a83`e9218000 : tcpip!Ipv4EnumerateAllPaths+0x2c4
02 ffff888e`d3bbf3b0 fffff80a`d3ab290e     : ffff8a83`e9218000 ffff8a83`00000070 0000000c`840ff690 ffff8a83`e2802340 : NETIO!NsiEnumerateObjectsAllParametersEx+0x240

db 0xffff8a83e35e0d30
ffff8a83`e35e0d30  00 00 00 00 00 00 00 00-00 20 00 00 00 00 00 00  ......... ......
ffff8a83`e35e0d40  ff 1f 00 00 66 00 00 00-4b 00 00 00 01 00 00 00  ....f...K.......
ffff8a83`e35e0d50  60 99 6d e3 83 8a ff ff-00 00 00 00 00 00 00 00  `.m.............
ffff8a83`e35e0d60  00 00 00 00 00 00 00 00-03 00 00 00 00 00 00 00  ................

1: kd> kP
 # Child-SP          RetAddr               Call Site
00 ffff888e`d3bbf1c8 fffff80a`d2e72de4     nt!RtlEnumerateEntryHashTable
01 ffff888e`d3bbf1d0 fffff80a`d261b740     tcpip!Ipv4EnumerateAllPaths+0x2c4
02 ffff888e`d3bbf3b0 fffff80a`d3ab290e     NETIO!NsiEnumerateObjectsAllParametersEx+0x240

I want to display the struct of the function argument Enumerator. I also want to look into the struct to get the Signature in the HashEntry. Any tips?Thanks

Answer 1

you are checking the contents of callstack which would be meaningless in an x64 application

in x64 calling convention windows passes first four arguments in registers

use dt command to view the structures

dt foo!blah @rcx