windbg command to search all functions that take in certain arguments

Question

I want to use the x command to search for functions that take _NET_BUFFER_LIST as an argument(maybe they will take more than one argument). Its symbol is ndis!_NET_BUFFER_LIST. The command I use

0:000> x /s module!module+0x1000 L?0xffffffff "ndis!_NET_BUFFER_LIST"
Couldn't resolve error at 'tcpip!tcpip+0x1000 L?0xffffffff "ndis!_NET_BUFFER_LIST"'

0:000> x /s module!module+0x1000 L?0xffffffff ndis!_NET_BUFFER_LIST
Couldn't resolve error at 'tcpip!tcpip+0x1000 L?0xffffffff ndis!_NET_BUFFER_LIST'

How should I change my command to achieve my goal?

I have tried commands in various forms. Some of them may not qualify the syntax. I thought add 'L?0xffffffff' could make sure dbg only walk through one module. But like blabb said, I should use another method instead and x doesn't support offset.

Answer 1

why using switch s ? switch s takes a size parameter and you do not give it ?

you are looking for a symbol from ndis on a module named tcpip ?

what is the L?0xffffxxxx doing there ?

are you sure symbol name takes the form of string with enclosed double quotes ?

Have you referred the documentation ?

x examines symbols and it takes a symbol name not a string
x does not use module start len format it either takes a complete symbol name or a wild card with partial symbol name

arguments are available only if the pdb has full type information

most of the public pdbs availabe in ms symbol store are stripped of type information
so there is no way you can find the function arguments

in your case ndis has type information but tcpip does not

if there is type information you can use .shell command

redirect the output to be parsed with external utility like grep sed awk find findstr etc

0: kd> .shell -ci "x ndis!*" grep  _NET_BUFFER_LIST
fffff805`79a45d64 ndis!ndisPendWorkOnSetBusyAsyncLocked (void __cdecl ndisPendWorkOnSetBusyAsyncLocked(struct _NDIS_SELECTIVE_SUSPEND *,enum _NDIS_SS_BUSY_REASON,void *,unsigned long,struct _NET_BUFFER_LIST * *,struct _LIST_ENTRY *,unsigned char *))
fffff805`79a4bed0 ndis!ndisVerifierNdisFSendNetBufferListsComplete (void __cdecl ndisVerifierNdisFSendNetBufferListsComplete(void *,struct _NET_BUFFER_LIST *,unsigned long))
fffff805`79a46374 ndis!ndisReplaySendNbls (void __cdecl ndisReplaySendNbls(struct _NDIS_MINIPORT_BLOCK *,struct _NET_BUFFER_LIST *,unsigned char))
fffff805`79a5c250 ndis!ndisMCoSendNetBufferListsCompleteToNetBufferLists (void __cdecl ndisMCoSendNetBufferListsCompleteToNetBufferLists(void *,struct _NET_BUFFER_LIST *,unsigned long))
fffff805`79a461f8 ndis!ndisRemoveFromNblQueueByCancelId (struct _NET_BUFFER_LIST * __cdecl ndisRemoveFromNblQueueByCancelId(struct _NBL_QUEUE *,void *))

tcpip does not have type information

0: kd> .shell -ci "x tcpip!en*" grep -i no.*type.*inf.*
fffff805`79df45e0 tcpip!EndpointSessionState = <no type information>
fffff805`79dfbb58 tcpip!endpointPPLookasideList = <no type information>
fffff805`79df55f0 tcpip!engineData = <no type information>
fffff805`79dfbd88 tcpip!endpointLruLookasideList = <no type information>
fffff805`79dfbc80 tcpip!endpointHandleTable = <no type information>
fffff805`79df5820 tcpip!endpointCleanupWorkQueue = <no type information>
.shell: Process exited