How to search for intermodular calls in WinDBG

Question

In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG?

Thanks

Answer 1

search for pattern in windbg to find all the intermodular calls

0:000> # ff15 calc l?c40
calc!TtoL+0x1a:
0100164a ff151c110001    call    dword ptr [calc!_imp__CharNextW (0100111c)]
calc!ParseCmdLine+0x2:
01001667 ff158c100001    call    dword ptr [calc!_imp__GetCommandLineW (0100108c)]
calc!InitializeWindowClass+0x37:
010017fe ff152c110001    call    dword ptr [calc!_imp__LoadIconW (0100112c)]
calc!InitializeWindowClass+0x46:
0100180d ff1528110001    call    dword ptr [calc!_imp__LoadCursorW (01001128)]
calc!InitializeWindowClass+0x51:
01001818 ff1524110001    call    dword ptr [calc!_imp__GetSysColorBrush (01001124)]
calc!InitializeWindowClass+0x6f:
01001836 ff1520110001    call    dword ptr [calc!_imp__RegisterClassExW (01001120)]
calc!EverythingResettingNumberSetup+0x1ab:
010019f8 ff1580100001    call    dword ptr [calc!_imp__LocalAlloc (01001080)]
calc!EverythingResettingNumberSetup+0x1c3:
01001a10 ff1590100001    call    dword ptr [calc!_imp__lstrcpyW (01001090)]
calc!InitSciCalc+0xec:
01001b03 ff1584110001    call    dword ptr [calc!_imp__SystemParametersInfoW (01001184)]
0:000> # ffd6 calc l?c40
calc!ParseCmdLine+0x1d:
01001682 ffd6            call    esi
calc!ParseCmdLine+0x55:
010016ba ffd6            call    esi
calc!ParseCmdLine+0xae:
01001713 ffd6            call    esi
calc!ParseCmdLine+0xdb:
01001740 ffd6            call    esi
calc!ParseCmdLine+0x126:
0100178b ffd6            call    esi
calc!ParseCmdLine+0x14f:
010017b4 ffd6            call    esi
calc!InitSciCalc+0x5d:
01001a74 ffd6            call    esi
calc!InitSciCalc+0x71:
01001a88 ffd6            call    esi
calc!InitSciCalc+0x8e:
01001aa5 ffd6            call    esi