I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value for other use. So I guess I need to access the fifth argument through offset of rsp in prolog. I guess space is allocated for stack-based arguments and homing space in the following instruction.
My assumption is that the fifth argument is below the homing space if all 4 registers are passed to homing space. However, as you can see, only r8 and RCX are pushed on stack. I can understand that since that's how x64 works. But this makes me confused because I don't know which one is the fifth argument. I think the command should look like
dt typename @rsp+offset
I don't want to brute force by the way since it may be difficult for functions with many arguments and unknown types.
0: kd> uf tcpip!IppFindPath tcpip!IppFindPath: fffff806`b9b38494 48895c2420 mov qword ptr [rsp+20h],rbx fffff806`b9b38499 4c89442418 mov qword ptr [rsp+18h],r8 fffff806`b9b3849e 48894c2408 mov qword ptr [rsp+8],rcx fffff806`b9b384a3 55 push rbp fffff806`b9b384a4 56 push rsi fffff806`b9b384a5 57 push rdi fffff806`b9b384a6 4154 push r12 fffff806`b9b384a8 4155 push r13 fffff806`b9b384aa 4156 push r14 fffff806`b9b384ac 4157 push r15 fffff806`b9b384ae 4883ec60 sub rsp,60h fffff806`b9b384b2 488b4128 mov rax,qword ptr [rcx+28h] fffff806`b9b384b6 4d8bd0 mov r10,r8 fffff806`b9b384b9 418bd9 mov ebx,r9d fffff806`b9b384bc 4c8bea mov r13,rdx fffff806`b9b384bf 4c8bf1 mov r14,rcx fffff806`b9b384c2 498bd2 mov rdx,r10 fffff806`b9b384c5 8b0d61cc1f00 mov ecx,dword ptr [tcpip!g_37HashSeed (fffff806`b9d3512c)] fffff806`b9b384cb 4c8b4810 mov r9,qword ptr [rax+10h] fffff806`b9b384cf 410fb76906 movzx ebp,word ptr [r9+6] fffff806`b9b384d4 448bc5 mov r8d,ebp fffff806`b9b384d7 48ff1502832100 call qword ptr [tcpip!_imp_RtlCompute37Hash (fffff806`b9d507e0)] fffff806`b9b384de 0f1f440000 nop dword ptr [rax+rax] fffff806`b9b384e3 b102 mov cl,2 fffff806`b9b384e5 498db600030000 lea rsi,[r14+300h] fffff806`b9b384ec 448be0 mov r12d,eax fffff806`b9b384ef 410fbaec1f bts r12d,1Fh