0

I'm searching for function NdisMoveMemory in my kernel. The function is defined in ndis.h. According to the interpretation of header file and library. The ndis.h provides the interface while ndis.sys and other libs provide the implementation. So the implementation should be in lib. However, the function couldn't be found in my dbg.

I tried some other functions defined in ndis.h and found their symbols. IDA also showed nothing(IDA loaded pdb successfully). Without the symbol, I can't set break points and perform the analysis. What might be the problem?

2: kd> x *!NdisCompleteBindAdapterEx
fffff805`510bddb0 NDIS!NdisCompleteBindAdapterEx (NdisCompleteBindAdapterEx)
2: kd> x *!NdisMOidRequestComplete
fffff805`510a3090 NDIS!NdisMOidRequestComplete (NdisMOidRequestComplete)
2: kd> x *!NdisMoveMemory
2: kd> x *!NdisMPauseComplete
fffff805`510736f0 NDIS!NdisMPauseComplete (void)
2: kd> g
anonymous bear
  • 35
  • 5
  • 3
    [documentation](https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ndis/nf-ndis-ndismovememory) clearly states it's a macro. [Source](https://github.com/tpn/winsdk-10/blob/master/Include/10.0.16299.0/km/ndis.h#L1146) shows that it boils down to `RtlCopyMemory`, so it's totally expected that you didn't find a symbol for it. – Neitsa Jul 25 '23 at 20:10

0 Answers0