In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG?
Thanks
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communitysearch for pattern in windbg
to find all the intermodular calls
0:000> # ff15 calc l?c40
calc!TtoL+0x1a:
0100164a ff151c110001 call dword ptr [calc!_imp__CharNextW (0100111c)]
calc!ParseCmdLine+0x2:
01001667 ff158c100001 call dword ptr [calc!_imp__GetCommandLineW (0100108c)]
calc!InitializeWindowClass+0x37:
010017fe ff152c110001 call dword ptr [calc!_imp__LoadIconW (0100112c)]
calc!InitializeWindowClass+0x46:
0100180d ff1528110001 call dword ptr [calc!_imp__LoadCursorW (01001128)]
calc!InitializeWindowClass+0x51:
01001818 ff1524110001 call dword ptr [calc!_imp__GetSysColorBrush (01001124)]
calc!InitializeWindowClass+0x6f:
01001836 ff1520110001 call dword ptr [calc!_imp__RegisterClassExW (01001120)]
calc!EverythingResettingNumberSetup+0x1ab:
010019f8 ff1580100001 call dword ptr [calc!_imp__LocalAlloc (01001080)]
calc!EverythingResettingNumberSetup+0x1c3:
01001a10 ff1590100001 call dword ptr [calc!_imp__lstrcpyW (01001090)]
calc!InitSciCalc+0xec:
01001b03 ff1584110001 call dword ptr [calc!_imp__SystemParametersInfoW (01001184)]
0:000> # ffd6 calc l?c40
calc!ParseCmdLine+0x1d:
01001682 ffd6 call esi
calc!ParseCmdLine+0x55:
010016ba ffd6 call esi
calc!ParseCmdLine+0xae:
01001713 ffd6 call esi
calc!ParseCmdLine+0xdb:
01001740 ffd6 call esi
calc!ParseCmdLine+0x126:
0100178b ffd6 call esi
calc!ParseCmdLine+0x14f:
010017b4 ffd6 call esi
calc!InitSciCalc+0x5d:
01001a74 ffd6 call esi
calc!InitSciCalc+0x71:
01001a88 ffd6 call esi
calc!InitSciCalc+0x8e:
01001aa5 ffd6 call esi