# http.sys KB5074109 vs KB5077181 (CVE-2026-21232, CVE-2026-21240, CVE-2026-21250) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [UxQuicConnectionGetCipherInfo](#uxquicconnectiongetcipherinfo) * [FUN_140156b71](#fun_140156b71) * [FUN_14015cda4](#fun_14015cda4) * [Added](#added) * [UxAllocateRefBlob](#uxallocaterefblob) * [UxpSslIncrementHandshakeFailuresCounter](#uxpsslincrementhandshakefailurescounter) * [Modified](#modified) * [UlExtractAndAppendAuthenticationResponseInfo](#ulextractandappendauthenticationresponseinfo) * [UlpRebuildResponseHeaders](#ulprebuildresponseheaders) * [UxQuicConnectionGetPeerIssuerListClient](#uxquicconnectiongetpeerissuerlistclient) * [UxSslGetTlsCipherInfo](#uxsslgettlscipherinfo) * [UlpSetUrlInfo](#ulpseturlinfo) * [UlpRejectFlushedRequests](#ulprejectflushedrequests) * [UxTlGetTcpInitialPacketTtl](#uxtlgettcpinitialpacketttl) * [UxSslConnectionControl](#uxsslconnectioncontrol) * [UlSetConfigGroupProperty](#ulsetconfiggroupproperty) * [UxQuicCreateConnection](#uxquiccreateconnection) * [UlHkeBuilderCopyFixedHeaders](#ulhkebuildercopyfixedheaders) * [UxQuicStreamConnectionControl](#uxquicstreamconnectioncontrol) * [UlpCompleteSendCacheEntryWorker](#ulpcompletesendcacheentryworker) * [UlpGenerateRangeResponseHeaders](#ulpgeneraterangeresponseheaders) * [UlpCheckIfBypassRangeProcessing](#ulpcheckifbypassrangeprocessing) * [UlQueryUrlGroupIoctl](#ulqueryurlgroupioctl) * [UlCopyRequestToIrp](#ulcopyrequesttoirp) * [UlPrepareParsedHeaderRangeResponse](#ulprepareparsedheaderrangeresponse) * [UlQueryConfigGroupProperty](#ulqueryconfiggroupproperty) * [UcQueryClientConnectionProperty](#ucqueryclientconnectionproperty) * [UcCaptureConnectionParameters](#uccaptureconnectionparameters) * [UxQuicConnectionCopyBindings](#uxquicconnectioncopybindings) * [UlSetUrlGroupIoctl](#ulseturlgroupioctl) * [UxpQuicQueryConnectionInfo](#uxpquicqueryconnectioninfo) * [UlpCopyRequestInformation](#ulpcopyrequestinformation) * [UxpSslQuerySslConnectionInfo](#uxpsslquerysslconnectioninfo) * [UlGenerateTrailers](#ulgeneratetrailers) * [UxpQuicConnectionCopyCertBlob](#uxpquicconnectioncopycertblob) * [UxpSslInitiateAscHandler](#uxpsslinitiateaschandler) * [UlpCompleteSendToExtensionWorker](#ulpcompletesendtoextensionworker) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [UxpSslWaitForAscHandler](#uxpsslwaitforaschandler) * [UlCopyRequestToBuffer](#ulcopyrequesttobuffer) * [UlSetRequestProperty](#ulsetrequestproperty) * [UlpCopyInitialPacketTtl](#ulpcopyinitialpacketttl) * [UxTlConnectionControl](#uxtlconnectioncontrol) * [UlQueryRequestFastIo](#ulqueryrequestfastio) * [UlQueryRequestProperty](#ulqueryrequestproperty) * [UlGenerateDateHeader](#ulgeneratedateheader) * [UlFeatureSupportedFastIo](#ulfeaturesupportedfastio) * [UlCopyGlobalCounters](#ulcopyglobalcounters) * [UlCopyUrlGroupCounters](#ulcopyurlgroupcounters) * [WPP_SF_dlllll](#wpp_sf_dlllll) * [memcpy](#memcpy) * [UlCopyGlobalCounters](#ulcopyglobalcounters) * [UlCopyUrlGroupCounters](#ulcopyurlgroupcounters) * [Modified (No Code Changes)](#modified-no-code-changes) * [WPP_SF_qLqqqq](#wpp_sf_qlqqqq) * [UlThreadPoolEnqueueWorkItem](#ulthreadpoolenqueueworkitem) * [WPP_SF_qDL](#wpp_sf_qdl) * [UxpPktMonNtStatusToDropReason](#uxppktmonntstatustodropreason) * [NTOSKRNL.EXE::KeSetEvent](#ntoskrnlexekesetevent) * [UlProbeForRead](#ulprobeforread) * [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache) * [memcpy](#memcpy) * [UxPktMonTraceDropSslWithNtStatus](#uxpktmontracedropsslwithntstatus) * [memset](#memset) * [NTOSKRNL.EXE::ExpInterlockedPushEntrySList](#ntoskrnlexeexpinterlockedpushentryslist) * [UxPodReferenceSilo](#uxpodreferencesilo) * [UlProbeAnsiString](#ulprobeansistring) * [UxpQuicGetTlsParam](#uxpquicgettlsparam) * [UlpActivateThreadPoolQueue](#ulpactivatethreadpoolqueue) * [UxSslMapSecurityStatusToErrorNtStatus](#uxsslmapsecuritystatustoerrorntstatus) * [WPP_SF_iq](#wpp_sf_iq) * [WPP_SF_id](#wpp_sf_id) * [UlpAssignThreadPoolWork](#ulpassignthreadpoolwork) * [NTOSKRNL.EXE::KeGetCurrentProcessorNumberEx](#ntoskrnlexekegetcurrentprocessornumberex) * [NTOSKRNL.EXE::PsGetCurrentServerSilo](#ntoskrnlexepsgetcurrentserversilo) * [UxpPktMonTraceSslDropInternal](#uxppktmontracessldropinternal) * [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache) * [WPP_SF_](#wpp_sf_) * [UlpFlushPendingRequests](#ulpflushpendingrequests) * [UlBugCheckEx](#ulbugcheckex) * [WPP_SF_L](#wpp_sf_l) * [KSECDD.SYS::SspiCreateAsyncContext](#ksecddsyssspicreateasynccontext) * [NTOSKRNL.EXE::KeGetCurrentNodeNumber](#ntoskrnlexekegetcurrentnodenumber) * [KSECDD.SYS::SspiSetAsyncNotifyCallback](#ksecddsyssspisetasyncnotifycallback) * [NTOSKRNL.EXE::ExAllocatePool3](#ntoskrnlexeexallocatepool3) # Visual Chart Diff ```mermaid flowchart LR UlExtractAndAppendAuthenticationResponseInfo-6-old<--Match 94%-->UlExtractAndAppendAuthenticationResponseInfo-6-new UlpRebuildResponseHeaders-4-old<--Match 28%-->UlpRebuildResponseHeaders-4-new UxQuicConnectionGetPeerIssuerListClient-5-old<--Match 90%-->UxQuicConnectionGetPeerIssuerListClient-5-new UxSslGetTlsCipherInfo-4-old<--Match 92%-->UxSslGetTlsCipherInfo-4-new UlpSetUrlInfo-4-old<--Match 5%-->UlpSetUrlInfo-4-new UlpRejectFlushedRequests-4-old<--Match 56%-->UlpRejectFlushedRequests-4-new UxTlGetTcpInitialPacketTtl-1-old<--Match 81%-->UxTlGetTcpInitialPacketTtl-1-new UxSslConnectionControl-6-old<--Match 99%-->UxSslConnectionControl-6-new UlSetConfigGroupProperty-6-old<--Match 48%-->UlSetConfigGroupProperty-6-new UxQuicCreateConnection-5-old<--Match 91%-->UxQuicCreateConnection-5-new UlHkeBuilderCopyFixedHeaders-5-old<--Match 99%-->UlHkeBuilderCopyFixedHeaders-5-new UxQuicStreamConnectionControl-5-old<--Match 99%-->UxQuicStreamConnectionControl-5-new UlpCompleteSendCacheEntryWorker-4-old<--Match 57%-->UlpCompleteSendCacheEntryWorker-4-new UlpGenerateRangeResponseHeaders-10-old<--Match 91%-->UlpGenerateRangeResponseHeaders-10-new UlpCheckIfBypassRangeProcessing-3-old<--Match 19%-->UlpCheckIfBypassRangeProcessing-3-new UlQueryUrlGroupIoctl-2-old<--Match 90%-->UlQueryUrlGroupIoctl-2-new UlCopyRequestToIrp-5-old<--Match 81%-->UlCopyRequestToIrp-5-new UlPrepareParsedHeaderRangeResponse-2-old<--Match 16%-->UlPrepareParsedHeaderRangeResponse-2-new UlQueryConfigGroupProperty-8-old<--Match 40%-->UlQueryConfigGroupProperty-8-new UcQueryClientConnectionProperty-6-old<--Match 95%-->UcQueryClientConnectionProperty-6-new UcCaptureConnectionParameters-4-old<--Match 46%-->UcCaptureConnectionParameters-4-new UxQuicConnectionCopyBindings-5-old<--Match 88%-->UxQuicConnectionCopyBindings-5-new UlSetUrlGroupIoctl-2-old<--Match 97%-->UlSetUrlGroupIoctl-2-new UxpQuicQueryConnectionInfo-1-old<--Match 72%-->UxpQuicQueryConnectionInfo-1-new UlpCopyRequestInformation-8-old<--Match 59%-->UlpCopyRequestInformation-8-new UxpSslQuerySslConnectionInfo-4-old<--Match 96%-->UxpSslQuerySslConnectionInfo-4-new http-10.0.26100.7309.sys<--21ommited-->http-10.0.26100.7824.sys subgraph http-10.0.26100.7824.sys UlExtractAndAppendAuthenticationResponseInfo-6-new UlpRebuildResponseHeaders-4-new UxQuicConnectionGetPeerIssuerListClient-5-new UxSslGetTlsCipherInfo-4-new UlpSetUrlInfo-4-new UlpRejectFlushedRequests-4-new UxTlGetTcpInitialPacketTtl-1-new UxSslConnectionControl-6-new UlSetConfigGroupProperty-6-new UxQuicCreateConnection-5-new UlHkeBuilderCopyFixedHeaders-5-new UxQuicStreamConnectionControl-5-new UlpCompleteSendCacheEntryWorker-4-new UlpGenerateRangeResponseHeaders-10-new UlpCheckIfBypassRangeProcessing-3-new UlQueryUrlGroupIoctl-2-new UlCopyRequestToIrp-5-new UlPrepareParsedHeaderRangeResponse-2-new UlQueryConfigGroupProperty-8-new UcQueryClientConnectionProperty-6-new UcCaptureConnectionParameters-4-new UxQuicConnectionCopyBindings-5-new UlSetUrlGroupIoctl-2-new UxpQuicQueryConnectionInfo-1-new UlpCopyRequestInformation-8-new UxpSslQuerySslConnectionInfo-4-new subgraph Added direction LR UxAllocateRefBlob UxpSslIncrementHandshakeFailuresCounter end end subgraph http-10.0.26100.7309.sys UlExtractAndAppendAuthenticationResponseInfo-6-old UlpRebuildResponseHeaders-4-old UxQuicConnectionGetPeerIssuerListClient-5-old UxSslGetTlsCipherInfo-4-old UlpSetUrlInfo-4-old UlpRejectFlushedRequests-4-old UxTlGetTcpInitialPacketTtl-1-old UxSslConnectionControl-6-old UlSetConfigGroupProperty-6-old UxQuicCreateConnection-5-old UlHkeBuilderCopyFixedHeaders-5-old UxQuicStreamConnectionControl-5-old UlpCompleteSendCacheEntryWorker-4-old UlpGenerateRangeResponseHeaders-10-old UlpCheckIfBypassRangeProcessing-3-old UlQueryUrlGroupIoctl-2-old UlCopyRequestToIrp-5-old UlPrepareParsedHeaderRangeResponse-2-old UlQueryConfigGroupProperty-8-old UcQueryClientConnectionProperty-6-old UcCaptureConnectionParameters-4-old UxQuicConnectionCopyBindings-5-old UlSetUrlGroupIoctl-2-old UxpQuicQueryConnectionInfo-1-old UlpCopyRequestInformation-8-old UxpSslQuerySslConnectionInfo-4-old subgraph Deleted direction LR UxQuicConnectionGetCipherInfo FUN_140156b71 FUN_14015cda4 end end ``` ```mermaid pie showData title Function Matches - 99.9461% "unmatched_funcs_len" : 5 "matched_funcs_len" : 9265 ``` ```mermaid pie showData title Matched Function Similarity - 99.0610% "matched_funcs_with_code_changes_len" : 46 "matched_funcs_with_non_code_changes_len" : 41 "matched_funcs_no_changes_len" : 9178 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21232\ghidra_projects --project-name CVE-2026-21232 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21232\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title http.sys KB5074109 vs KB5077181 (CVE-2026-21232, CVE-2026-21240, CVE-2026-21250) http-10.0.26100.7309.sys http-10.0.26100.7824.sys ``` #### Verbose Args
``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2026-21232\\http-10.0.26100.7309.sys'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2026-21232\\http-10.0.26100.7824.sys']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21232\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21232\ghidra_projects --project-name CVE-2026-21232 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21232\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title http.sys KB5074109 vs KB5077181 (CVE-2026-21232, CVE-2026-21240, CVE-2026-21250) ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/http.sys/1B17F0491F2000/http.sys -O http.sys.x64.10.0.26100.7309 wget https://msdl.microsoft.com/download/symbols/http.sys/0CE3E4D81F2000/http.sys -O http.sys.x64.10.0.26100.7824 ``` ## Binary Metadata Diff ```diff --- http-10.0.26100.7309.sys Meta +++ http-10.0.26100.7824.sys Meta @@ -1,44 +1,44 @@ -Program Name: http-10.0.26100.7309.sys +Program Name: http-10.0.26100.7824.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 2043336 +# of Bytes: 2043272 # of Memory Blocks: 17 -# of Instructions: 359408 -# of Defined Data: 25606 -# of Functions: 4634 -# of Symbols: 49960 -# of Data Types: 375 +# of Instructions: 359628 +# of Defined Data: 25623 +# of Functions: 4636 +# of Symbols: 49982 +# of Data Types: 381 # of Data Type Categories: 31 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Fri Jul 24 23:01:17 SGT 2026 +Date Created: Fri Jul 24 23:01:22 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21232/http-10.0.26100.7309.sys -Executable MD5: 283347dda46632525550bffce85b7804 -Executable SHA256: 947d4fda08c346fde0841ecd15e31933679c59e3a9740b1733fa21c8677aa665 -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21232/http-10.0.26100.7309.sys?MD5=283347dda46632525550bffce85b7804 +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21232/http-10.0.26100.7824.sys +Executable MD5: a498eaa71479eda08a5327fb32b98331 +Executable SHA256: 9aaf384a747e9ce98f5d49765d2bbecd57fff7b55175c8fb20203935ae51cd39 +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21232/http-10.0.26100.7824.sys?MD5=a498eaa71479eda08a5327fb32b98331 PDB Age: 1 PDB File: http.pdb -PDB GUID: abf7059a-1cd0-ecdc-8e58-44d1e6663728 +PDB GUID: e3932b66-dae3-c067-0163-48aed0f21952 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: HTTP Protocol Stack -PE Property[FileVersion]: 10.0.26100.7309 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.7824 (WinBuild.160101.0800) PE Property[InternalName]: http.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: http.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7309 +PE Property[ProductVersion]: 10.0.26100.7824 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra http-10.0.26100.7309.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra http-10.0.26100.7309.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra http-10.0.26100.7309.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra http-10.0.26100.7824.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra http-10.0.26100.7824.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra http-10.0.26100.7824.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|3| |modified_funcs_len|87| |added_symbols_len|48| |deleted_symbols_len|49| |diff_time|29.4819815158844| |deleted_strings_len|0| |added_strings_len|3| |match_types|Counter({'SymbolsHash': 4243, 'ExternalsName': 440, 'ExactInstructionsFunctionHasher': 262, 'StructuralGraphHash': 158, 'BulkBasicBlockMnemonicHash': 72, 'BSIM': 47, 'ExactBytesFunctionHasher': 8, 'SigCallingCalledHasher': 5, 'StrUniqueFuncRefsHasher': 4, 'Implied Match': 3, 'StructuralGraphExactHash': 2})| |items_to_process|189| |diff_types|Counter({'address': 76, 'length': 51, 'code': 46, 'refcount': 46, 'calling': 33, 'called': 20, 'sig': 14, 'name': 6, 'fullname': 6})| |unmatched_funcs_len|5| |total_funcs_len|9270| |matched_funcs_len|9265| |matched_funcs_with_code_changes_len|46| |matched_funcs_with_non_code_changes_len|41| |matched_funcs_no_changes_len|9178| |match_func_similarity_percent|99.0610%| |func_match_overall_percent|99.9461%| |first_matches|Counter({'SymbolsHash': 4243, 'ExactInstructionsFunctionHasher': 262, 'StructuralGraphHash': 158, 'BulkBasicBlockMnemonicHash': 72, 'BSIM': 47, 'ExactBytesFunctionHasher': 8, 'SigCallingCalledHasher': 5, 'StrUniqueFuncRefsHasher': 4, 'Implied Match': 3, 'StructuralGraphExactHash': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 4243 "ExternalsName" : 440 "ExactBytesFunctionHasher" : 8 "ExactInstructionsFunctionHasher" : 262 "StructuralGraphExactHash" : 2 "BSIM" : 47 "SigCallingCalledHasher" : 5 "StrUniqueFuncRefsHasher" : 4 "StructuralGraphHash" : 158 "BulkBasicBlockMnemonicHash" : 72 "Implied-Match" : 3 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 4243 "ExactBytesFunctionHasher" : 8 "ExactInstructionsFunctionHasher" : 262 "StructuralGraphExactHash" : 2 "BSIM" : 47 "SigCallingCalledHasher" : 5 "StrUniqueFuncRefsHasher" : 4 "StructuralGraphHash" : 158 "BulkBasicBlockMnemonicHash" : 72 "Implied-Match" : 3 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 3 "modified_funcs_len" : 87 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 48 "deleted_symbols_len" : 49 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 3 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,3 @@ +s_/?:@&=+$,[] +s_hmjklkl> +s_}|\^` ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_hmjklkl>_14016f288|6|UlpBuildMultiRangeMdlChainFromSlices,UlPrepareCacheMissRangeResponse,UlpGenerateTerminatingChunk,UlpGenerateBoundaryChunk| |s_}\|\^`_14016bd69|1|HttpCmnInitializeDynamicHttpCharsTable| |s_/?:@&=+$,[]_14016bd59|1|HttpCmnInitializeDynamicHttpCharsTable| # Deleted ## UxQuicConnectionGetCipherInfo ### Function Meta |Key|http-10.0.26100.7309.sys| | :---: | :---: | |name|UxQuicConnectionGetCipherInfo| |fullname|UxQuicConnectionGetCipherInfo| |refcount|2| |length|211| |called|| |calling|UcQueryClientConnectionProperty| |paramcount|2| |address|1400e239c| |sig|undefined __fastcall UxQuicConnectionGetCipherInfo(longlong param_1, undefined8 * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- UxQuicConnectionGetCipherInfo +++ UxQuicConnectionGetCipherInfo @@ -1,89 +0,0 @@ - -void UxQuicConnectionGetCipherInfo(longlong param_1,undefined8 *param_2) - -{ - undefined8 *puVar1; - undefined8 uVar2; - undefined8 *puVar3; - undefined8 *puVar4; - longlong lVar5; - - lVar5 = 5; - if (UxKirSeHttpQueryCryptoParams == '\0') { - puVar3 = (undefined8 *)(param_1 + 0x6b8); - do { - uVar2 = puVar3[1]; - *param_2 = *puVar3; - param_2[1] = uVar2; - uVar2 = puVar3[3]; - param_2[2] = puVar3[2]; - param_2[3] = uVar2; - uVar2 = puVar3[5]; - param_2[4] = puVar3[4]; - param_2[5] = uVar2; - uVar2 = puVar3[7]; - param_2[6] = puVar3[6]; - param_2[7] = uVar2; - uVar2 = puVar3[9]; - param_2[8] = puVar3[8]; - param_2[9] = uVar2; - uVar2 = puVar3[0xb]; - param_2[10] = puVar3[10]; - param_2[0xb] = uVar2; - uVar2 = puVar3[0xd]; - param_2[0xc] = puVar3[0xc]; - param_2[0xd] = uVar2; - puVar4 = param_2 + 0x10; - puVar1 = puVar3 + 0xe; - uVar2 = puVar3[0xf]; - puVar3 = puVar3 + 0x10; - param_2[0xe] = *puVar1; - param_2[0xf] = uVar2; - lVar5 = lVar5 + -1; - param_2 = puVar4; - } while (lVar5 != 0); - } - else { - puVar3 = (undefined8 *)(param_1 + 0x368); - do { - uVar2 = puVar3[1]; - *param_2 = *puVar3; - param_2[1] = uVar2; - uVar2 = puVar3[3]; - param_2[2] = puVar3[2]; - param_2[3] = uVar2; - uVar2 = puVar3[5]; - param_2[4] = puVar3[4]; - param_2[5] = uVar2; - uVar2 = puVar3[7]; - param_2[6] = puVar3[6]; - param_2[7] = uVar2; - uVar2 = puVar3[9]; - param_2[8] = puVar3[8]; - param_2[9] = uVar2; - uVar2 = puVar3[0xb]; - param_2[10] = puVar3[10]; - param_2[0xb] = uVar2; - uVar2 = puVar3[0xd]; - param_2[0xc] = puVar3[0xc]; - param_2[0xd] = uVar2; - puVar4 = param_2 + 0x10; - puVar1 = puVar3 + 0xe; - uVar2 = puVar3[0xf]; - puVar3 = puVar3 + 0x10; - param_2[0xe] = *puVar1; - param_2[0xf] = uVar2; - lVar5 = lVar5 + -1; - param_2 = puVar4; - } while (lVar5 != 0); - } - uVar2 = puVar3[1]; - *puVar4 = *puVar3; - puVar4[1] = uVar2; - uVar2 = puVar3[3]; - puVar4[2] = puVar3[2]; - puVar4[3] = uVar2; - puVar4[4] = puVar3[4]; - return; -} - ``` ## FUN_140156b71 ### Function Meta |Key|http-10.0.26100.7309.sys| | :---: | :---: | |name|FUN_140156b71| |fullname|FUN_140156b71| |refcount|2| |length|26| |called|WPP_SF_Sq| |calling|UlpSetUrlInfo| |paramcount|3| |address|140156b71| |sig|int __fastcall FUN_140156b71(undefined8 param_1, undefined8 param_2, wchar_t * param_3)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_140156b71 +++ FUN_140156b71 @@ -1,18 +0,0 @@ - -int FUN_140156b71(undefined8 param_1,undefined8 param_2,wchar_t *param_3) - -{ - ulonglong unaff_RBX; - undefined4 *unaff_RSI; - int unaff_R15D; - - WPP_SF_Sq(0x89,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,param_3); - if (unaff_R15D < 0) { - UlCleanupConfigGroupInfo(unaff_RSI,1,(undefined4 *)param_3,unaff_RBX); - } - if ((DAT_140187c50 & 8) != 0) { - WPP_SF_L(0x8a,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,unaff_R15D); - } - return unaff_R15D; -} - ``` ## FUN_14015cda4 ### Function Meta |Key|http-10.0.26100.7309.sys| | :---: | :---: | |name|FUN_14015cda4| |fullname|FUN_14015cda4| |refcount|3| |length|355| |called|McTemplateK0p_EtwWriteTransfer
McTemplateK0qp_EtwWriteTransfer
UlEtwEvaluateFilter
UxPktMonTraceDropSslWithNtStatus
WPP_SF_L
WPP_SF_id
WPP_SF_qHdqS| |calling|UxpSslInitiateAscHandler| |paramcount|0| |address|14015cda4| |sig|ulonglong __fastcall FUN_14015cda4(void)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_14015cda4 +++ FUN_14015cda4 @@ -1,210 +0,0 @@ - -/* PDB: Separated code (from the compiler): 14015cda4 - 14015cf06 for parent address: 140065050 */ - -ulonglong FUN_14015cda4(void) - -{ - code cVar1; - ulonglong uVar2; - byte bVar3; - char cVar4; - int iVar5; - uint uVar6; - longlong lVar7; - code *pcVar8; - undefined2 uVar9; - code *pcVar10; - code *unaff_RBX; - byte *unaff_RSI; - code *unaff_RDI; - code *pcVar11; - ushort uVar12; - code *pcVar13; - code *unaff_R12; - byte *unaff_R14; - undefined4 uVar14; - undefined8 in_stack_00000020; - code *in_stack_00000070; - - uVar14 = (undefined4)((ulonglong)in_stack_00000020 >> 0x20); - pcVar11 = unaff_RDI + 0x48; - pcVar10 = (code *)&HTTP_EVENT_SSL_HANDSHAKE_INITIATE; - pcVar13 = unaff_RDI; - McTemplateK0p_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(unaff_RDI + 0x6a0) + 0x698), - &HTTP_EVENT_SSL_HANDSHAKE_INITIATE,pcVar11,unaff_RDI); - if ((DAT_140187c52 & 1) != 0) { - pcVar10 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - pcVar11 = unaff_RDI; - WPP_SF_I(0x91,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,unaff_RDI); - } - if (*(code **)(unaff_RDI + 0x620) == unaff_RBX) { - lVar7 = SspiCreateAsyncContext(); - *(longlong *)(unaff_RDI + 0x620) = lVar7; - if (lVar7 == 0) { - unaff_RBX = (code *)0xc000009a; - goto LAB_14006520a; - } - } - if ((DAT_140187c52 & 1) != 0) { - WPP_SF_iq(0x7a,&WPP_575742ddbbd13d10dc502caa156c9542_Traceguids,unaff_RDI,&stack0x00000070); - } - cVar1 = unaff_RDI[0xe9]; - pcVar13 = (code *)&UxLowPriorityPool; - pcVar10 = (code *)0x200; - if (cVar1 == (code)0x0) { - pcVar10 = (code *)0x100; - } - pcVar11 = (code *)0x59537855; - in_stack_00000070 = unaff_R12; - pcVar8 = (code *)ExAllocatePool3(0x40); - if (pcVar8 == (code *)0x0) { - unaff_RBX = (code *)0xc000009a; - } - else { - *(code **)(pcVar8 + 0x20) = unaff_RDI; - pcVar10 = unaff_RDI + 0x14; - LOCK(); - iVar5 = *(int *)pcVar10; - *(int *)pcVar10 = *(int *)pcVar10 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != (char)unaff_RBX) && (0x7fffffff < iVar5 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,pcVar10,0x38,(longlong)(int)(iVar5 + 1U)); - } - lVar7 = SspiCreateAsyncContext(); - *(longlong *)pcVar8 = lVar7; - if (lVar7 == 0) { - unaff_RBX = (code *)0xc000009a; - } - else { - pcVar10 = UxSslAcceptSecurityContextCallback; - pcVar11 = pcVar8; - iVar5 = SspiSetAsyncNotifyCallback(lVar7); - if (iVar5 == 0) { - in_stack_00000070 = pcVar8; - if (cVar1 != (code)0x0) { - *(code **)(pcVar8 + 0xf8) = pcVar8 + 0x100; - } - goto LAB_1400651a2; - } - uVar6 = UxSslMapSecurityStatusToErrorNtStatus(iVar5); - unaff_RBX = (code *)(ulonglong)uVar6; - } - UxSslFreeAscContext(pcVar8,pcVar10,pcVar11,pcVar13); - } -LAB_1400651a2: - if ((DAT_140187c52 & 1) != 0) { - pcVar10 = (code *)&WPP_575742ddbbd13d10dc502caa156c9542_Traceguids; - pcVar13 = (code *)((ulonglong)unaff_RBX & 0xffffffff); - pcVar11 = in_stack_00000070; - WPP_SF_id(0x7b,&WPP_575742ddbbd13d10dc502caa156c9542_Traceguids,in_stack_00000070,(int)unaff_RBX - ); - } - if ((int)unaff_RBX < 0) { - if ((DAT_140187c4a & 1) == 0) goto LAB_14006520a; - uVar9 = 0x92; -LAB_14015cdd0: - pcVar13 = (code *)((ulonglong)unaff_RBX & 0xffffffff); - pcVar10 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - WPP_SF_id(uVar9,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,unaff_RDI,(int)unaff_RBX); - pcVar11 = unaff_RDI; - } - else { - pcVar10 = in_stack_00000070; - uVar6 = UxpSslAcceptSecurityContext((longlong)unaff_RDI,(undefined8 *)in_stack_00000070); - unaff_RBX = (code *)(ulonglong)uVar6; - if (uVar6 == 0x105) { - if ((DAT_140187c52 & 1) != 0) { - pcVar10 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - WPP_SF_I(0x93,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,unaff_RDI); - pcVar11 = unaff_RDI; - } - } - else { - if (uVar6 != 0x103) { - lVar7 = *(longlong *)(unaff_RDI + 0x1b0); - if ((lVar7 != 0) && (*(char *)(lVar7 + 0x251) != (char)unaff_R12)) { - pcVar10 = (code *)0x2; - LOCK(); - if (*(int *)(lVar7 + 0x6c) == 1) { - *(int *)(lVar7 + 0x6c) = 2; - } - UNLOCK(); - if ((DAT_140187c4e & 1) != 0) { - pcVar10 = *(code **)(unaff_RDI + 0x1b0); - uVar12 = *(ushort *)(unaff_RDI + 0x76) >> 8 | *(ushort *)(unaff_RDI + 0x76) << 8; - pcVar13 = (code *)(ulonglong)uVar12; - pcVar11 = unaff_RDI; - WPP_SF_qHdqS(0x94,pcVar10,unaff_RDI,uVar12,CONCAT44(uVar14,uVar6),pcVar10, - *(longlong *)(pcVar10 + 0x1b0)); - } - } - uVar2 = *(ulonglong *)(unaff_RDI + 0x6a0); - if ((*(byte *)(uVar2 + 0x6e2) & 1) != 0) { - if (*(code **)(uVar2 + 0x6f0) != unaff_R12) { - pcVar11 = unaff_RDI + 0x74; - pcVar10 = unaff_RDI + 0x58; - pcVar13 = (code *)0x0; - cVar4 = UlEtwEvaluateFilter(uVar2,(short *)pcVar10,(longlong)pcVar11,0, - *(undefined4 **)(unaff_RDI + 0x678), - (uint)*(ushort *)(unaff_RDI + 0x670),(ulonglong *)unaff_R12, - (uint)unaff_R12); - if (cVar4 == '\0') goto LAB_14015cebc; - } - pcVar11 = unaff_RDI + 0x48; - pcVar10 = (code *)&HTTP_EVENT_SSL_HANDSHAKE_COMPLETE; - pcVar13 = unaff_RBX; - McTemplateK0qp_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(unaff_RDI + 0x6a0) + 0x698), - &HTTP_EVENT_SSL_HANDSHAKE_COMPLETE,pcVar11,uVar6); - } -LAB_14015cebc: - bVar3 = DAT_140188740; - if ((DAT_140187c52 & 0x40) != 0) { - pcVar11 = (code *)(ulonglong)(uint)DAT_140188740; - pcVar10 = (code *)&WPP_c3410a5607a6316659f67a67ba938abb_Traceguids; - WPP_SF_L(0x26,&WPP_c3410a5607a6316659f67a67ba938abb_Traceguids,(uint)DAT_140188740); - } - if (bVar3 != 0) { - pcVar10 = (code *)0xe0005007; - pcVar11 = unaff_RBX; - UxPktMonTraceDropSslWithNtStatus((longlong)unaff_RDI,0xe0005007,uVar6); - } - if ((DAT_140187c52 & 1) == 0) goto LAB_14006520a; - uVar9 = 0x95; - goto LAB_14015cdd0; - } - uVar6 = *(uint *)(unaff_RDI + 0xdc); - in_stack_00000070 = unaff_R12; - if ((DAT_140187c52 & 1) != 0) { - pcVar10 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - pcVar13 = (code *)0x3; - pcVar11 = unaff_RDI; - WPP_SF_id(0x46,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,unaff_RDI,3); - if ((DAT_140187c52 & 1) != 0) { - pcVar13 = (code *)(ulonglong)uVar6; - pcVar10 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - pcVar11 = unaff_RDI; - WPP_SF_qDL(0x47,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,unaff_RDI,uVar6); - } - } - *(int *)(unaff_RDI + 0xdc) = 3; - if ((DAT_140187c52 & 1) != 0) { - pcVar10 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - WPP_SF_(0x48,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,pcVar11,pcVar13); - } - } - *unaff_RSI = 1; - } -LAB_14006520a: - if (in_stack_00000070 != (code *)0x0) { - UxSslFreeAscContext(in_stack_00000070,pcVar10,pcVar11,pcVar13); - in_stack_00000070 = unaff_R12; - } - if ((DAT_140187c52 & 1) != 0) { - WPP_SF_lld(0x96,pcVar10,(uint)*unaff_RSI,(uint)*unaff_R14); - } - return (ulonglong)unaff_RBX & 0xffffffff; -} - ``` # Added ## UxAllocateRefBlob ### Function Meta |Key|http-10.0.26100.7824.sys| | :---: | :---: | |name|UxAllocateRefBlob| |fullname|UxAllocateRefBlob| |refcount|2| |length|119| |called|NTOSKRNL.EXE::ExAllocatePool3| |calling|UcCaptureConnectionParameters| |paramcount|2| |address|1400df530| |sig|undefined8 __fastcall UxAllocateRefBlob(uint param_1, undefined8 * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- UxAllocateRefBlob +++ UxAllocateRefBlob @@ -0,0 +1,23 @@ + +undefined8 UxAllocateRefBlob(uint param_1,undefined8 *param_2) + +{ + undefined4 *puVar1; + undefined8 uVar2; + + uVar2 = 0; + *param_2 = 0; + puVar1 = (undefined4 *) + ExAllocatePool3(0x100,(ulonglong)param_1 + 0x18,0x42527855,&UxLowPriorityPool,1); + if (puVar1 == (undefined4 *)0x0) { + uVar2 = 0xc000009a; + } + else { + *puVar1 = 1; + *(undefined4 **)(puVar1 + 2) = puVar1 + 6; + puVar1[4] = param_1; + *param_2 = puVar1; + } + return uVar2; +} + ``` ## UxpSslIncrementHandshakeFailuresCounter ### Function Meta |Key|http-10.0.26100.7824.sys| | :---: | :---: | |name|UxpSslIncrementHandshakeFailuresCounter| |fullname|UxpSslIncrementHandshakeFailuresCounter| |refcount|3| |length|51| |called|NTOSKRNL.EXE::KeGetCurrentNodeNumber| |calling|UxpSslInitiateAscHandler
UxpSslWaitForAscHandler| |paramcount|1| |address|14011a844| |sig|undefined __fastcall UxpSslIncrementHandshakeFailuresCounter(longlong param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- UxpSslIncrementHandshakeFailuresCounter +++ UxpSslIncrementHandshakeFailuresCounter @@ -0,0 +1,17 @@ + +void UxpSslIncrementHandshakeFailuresCounter(longlong param_1) + +{ + longlong *plVar1; + longlong lVar2; + ushort uVar3; + + lVar2 = *(longlong *)(*(longlong *)(param_1 + 0x6a0) + 0x620); + uVar3 = KeGetCurrentNodeNumber(); + LOCK(); + plVar1 = (longlong *)(*(longlong *)(lVar2 + 8 + (ulonglong)uVar3 * 8) + 0x20); + *plVar1 = *plVar1 + 1; + UNLOCK(); + return; +} + ``` # Modified *Modified functions contain code changes* ## UlExtractAndAppendAuthenticationResponseInfo ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.38| |i_ratio|0.6| |m_ratio|0.99| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlExtractAndAppendAuthenticationResponseInfo|UlExtractAndAppendAuthenticationResponseInfo| |fullname|UlExtractAndAppendAuthenticationResponseInfo|UlExtractAndAppendAuthenticationResponseInfo| |refcount|4|4| |`length`|2336|2313| |called|
Expand for full list:
McTemplateK0s_EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireCacheAwarePushLockExclusive
NTOSKRNL.EXE::ExAcquireCacheAwarePushLockSharedEx
NTOSKRNL.EXE::ExReleaseCacheAwarePushLockExclusive
NTOSKRNL.EXE::ExReleaseCacheAwarePushLockSharedEx
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlBugCheckEx
UlCaptureChannelBindConfig
UlEtwEvaluateFilterForRequestConnectionUlFreeServiceNameContainer
UlIsAuthChangeNeededOld
UlProbeForRead
UlUpdateAuthConfig
UlUpdateChannelBindConfig
UlVerifyAuthConfig
UlpIsServiceContainerEquivalent
WPP_SF_L
WPP_SF_qiqqllq
|
Expand for full list:
McTemplateK0s_EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireCacheAwarePushLockExclusive
NTOSKRNL.EXE::ExAcquireCacheAwarePushLockSharedEx
NTOSKRNL.EXE::ExReleaseCacheAwarePushLockExclusive
NTOSKRNL.EXE::ExReleaseCacheAwarePushLockSharedEx
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlBugCheckEx
UlCaptureChannelBindConfig
UlEtwEvaluateFilterForRequestConnectionUlFreeServiceNameContainer
UlIsAuthChangeNeededOld
UlProbeForRead
UlUpdateAuthConfig
UlUpdateChannelBindConfig
UlVerifyAuthConfig
UlpIsServiceContainerEquivalent
WPP_SF_L
WPP_SF_qiqqllq
| |calling|UlCaptureHttpResponseOld
UlSendHttpResponseIoctlOld
UlSendResponseOrEntityBodyFastIoOld|UlCaptureHttpResponseOld
UlSendHttpResponseIoctlOld
UlSendResponseOrEntityBodyFastIoOld| |paramcount|6|6| |`address`|14009d2f0|14009d490| |sig|ulonglong __fastcall UlExtractAndAppendAuthenticationResponseInfo(ulonglong param_1, longlong param_2, undefined8 param_3, char param_4, char param_5, undefined1 * param_6)|ulonglong __fastcall UlExtractAndAppendAuthenticationResponseInfo(ulonglong param_1, longlong param_2, undefined8 param_3, char param_4, char param_5, undefined1 * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlExtractAndAppendAuthenticationResponseInfo Diff ```diff --- UlExtractAndAppendAuthenticationResponseInfo +++ UlExtractAndAppendAuthenticationResponseInfo @@ -1,380 +1,373 @@ ulonglong UlExtractAndAppendAuthenticationResponseInfo (ulonglong param_1,longlong param_2,undefined8 param_3,char param_4,char param_5 ,undefined1 *param_6) { - undefined2 uVar1; - undefined2 uVar2; - undefined2 uVar3; - ulonglong *puVar4; - bool bVar5; - bool bVar6; - longlong *plVar7; - char cVar8; - byte bVar9; - undefined1 uVar10; - int iVar11; - undefined8 uVar12; - ulonglong uVar13; - longlong lVar14; - uint uVar15; - uint *puVar16; - ulonglong uVar18; - undefined4 *puVar19; - undefined4 *puVar20; - char *pcVar21; - int *piVar22; + ushort uVar1; + ulonglong *puVar2; + bool bVar3; + bool bVar4; + longlong *plVar5; + char cVar6; + byte bVar7; + undefined1 uVar8; + int iVar9; + undefined8 uVar10; + ulonglong uVar11; + longlong lVar12; + int *piVar13; + uint *puVar14; + ulonglong uVar15; + uint uVar16; + char *pcVar17; + undefined4 *puVar18; ulonglong local_res8; bool local_res10; undefined8 local_res18; char local_res20; char local_107 [3]; uint local_104; undefined1 local_100; undefined1 local_ff; - ushort local_fe; longlong local_f8; - uint local_f0; - int local_e8; - uint uStack_e4; - int iStack_e0; - int iStack_dc; - undefined8 local_d8; - undefined8 uStack_d0; - int *local_c8; + ushort local_f0; + undefined8 local_e8; + undefined8 uStack_e0; + int *local_d8; + int local_d0; + uint uStack_cc; + int iStack_c8; + int iStack_c4; ushort local_c0; + uint local_bc; ulonglong local_b8; undefined8 uStack_b0; undefined8 local_a8; ulonglong uStack_a0; undefined8 local_98; ulonglong uStack_90; undefined8 local_88; ulonglong uStack_80; undefined8 local_78; undefined8 uStack_70; undefined4 *local_68; int *local_60; longlong local_58; longlong *local_50; int *local_48; - longlong lVar17; - bVar5 = false; + bVar3 = false; local_100 = 0; local_b8 = 0; uStack_b0 = 0; local_a8 = 0; uStack_a0 = 0; local_98 = 0; uStack_90 = 0; local_88 = 0; uStack_80 = 0; local_78 = 0; uStack_70 = 0; local_107[0] = '\0'; local_res10 = false; local_ff = 0; - uVar18 = 0; - bVar6 = false; - puVar19 = (undefined4 *)0x0; + uVar15 = 0; + bVar4 = false; + puVar18 = (undefined4 *)0x0; local_68 = (undefined4 *)0x0; local_50 = (longlong *)(param_1 + 0x18); local_f8 = *(longlong *)(*local_50 + 0x448); local_res8 = param_1; local_res18 = param_3; local_res20 = param_4; local_58 = local_f8; if ((DAT_0 & 0x20) != 0) { WPP_SF_qiqqllq(param_1,param_6,param_1,*(undefined8 *)(param_1 + 0x40)); } if (param_6 != (undefined1 *)0x0) { *param_6 = 0; } - if ((param_2 == 0) || (local_fe = *(ushort *)(param_2 + 0x228), local_fe == 0)) + if ((param_2 == 0) || (uVar1 = *(ushort *)(param_2 + 0x228), local_f0 = uVar1, uVar1 == 0)) goto LAB_1; - piVar22 = *(int **)(param_2 + 0x230); - local_c0 = local_fe; - local_48 = piVar22; - cVar8 = IoIs32bitProcess(local_res18); - if (cVar8 == '\0') { - UlProbeForRead((ulonglong)piVar22,(ulonglong)local_fe << 4,8,param_4); - } - uVar15 = 0; - while (lVar14 = local_f8, uVar12 = local_res18, local_f0 = uVar15, local_60 = piVar22, - uVar15 < local_fe) { - local_e8 = *piVar22; - uStack_e4 = piVar22[1]; - iStack_e0 = (int)*(ulonglong *)(piVar22 + 2); - iStack_dc = piVar22[3]; - puVar20 = *(undefined4 **)(piVar22 + 2); - if (3 < local_e8) { - uVar18 = 0xc000000d; + piVar13 = *(int **)(param_2 + 0x230); + local_c0 = uVar1; + local_48 = piVar13; + cVar6 = IoIs32bitProcess(local_res18); + if (cVar6 == '\0') { + UlProbeForRead((ulonglong)piVar13,(ulonglong)uVar1 << 4,8,param_4); + } + uVar16 = 0; + while (local_bc = uVar16, local_60 = piVar13, uVar16 < local_f0) { + local_d0 = *piVar13; + uStack_cc = piVar13[1]; + iStack_c8 = piVar13[2]; + iStack_c4 = piVar13[3]; + if (3 < local_d0) { + uVar15 = 0xc000000d; local_104 = 0xc000000d; if ((DAT_2 & 0x20) != 0) { - WPP_SF_L(0x81,&WPP_aee5f1d9509b337e9d647e3a3f21c431_Traceguids,0xc000000d); + WPP_SF_L(0x81,&WPP_6be8f1a1a6dc3a7610af4fdeda223eb8_Traceguids,0xc000000d); } goto LAB_1; } - if ((local_e8 - 1U & 0xfffffffd) == 0) { - if ((local_e8 != 1) || (bVar5)) { - if ((local_e8 == 3) && (!bVar6)) { - if (UxKirHttpChannelBindInfoFix != '\0') { - cVar8 = IoIs32bitProcess(local_res18); - if (cVar8 == '\0') { - if (uStack_e4 < 0x18) { - uVar18 = 0xc000000d; - local_104 = 0xc000000d; - if ((DAT_2 & 0x20) != 0) { - WPP_SF_L(0x85,&WPP_aee5f1d9509b337e9d647e3a3f21c431_Traceguids,0xc000000d); - } - goto LAB_1; + if ((local_d0 - 1U & 0xfffffffd) == 0) { + if ((local_d0 != 1) || (bVar3)) { + if ((local_d0 == 3) && (!bVar4)) { + cVar6 = IoIs32bitProcess(local_res18); + if (cVar6 == '\0') { + if (uStack_cc < 0x18) { + uVar15 = 0xc000000d; + local_104 = 0xc000000d; + if ((DAT_2 & 0x20) != 0) { + WPP_SF_L(0x85,&WPP_6be8f1a1a6dc3a7610af4fdeda223eb8_Traceguids,0xc000000d); } - puVar20 = (undefined4 *)CONCAT44(iStack_dc,iStack_e0); - UlProbeForRead((ulonglong)puVar20,(ulonglong)uStack_e4,8,param_4); + goto LAB_1; } - else { - if (uStack_e4 < 0x10) { - uVar18 = 0xc000000d; - local_104 = 0xc000000d; - if ((DAT_2 & 0x20) != 0) { - WPP_SF_L(0x84,&WPP_aee5f1d9509b337e9d647e3a3f21c431_Traceguids,0xc000000d); - } - goto LAB_1; + iVar9 = 8; + } + else { + if (uStack_cc < 0x10) { + uVar15 = 0xc000000d; + local_104 = 0xc000000d; + if ((DAT_2 & 0x20) != 0) { + WPP_SF_L(0x84,&WPP_6be8f1a1a6dc3a7610af4fdeda223eb8_Traceguids,0xc000000d); } - puVar20 = (undefined4 *)CONCAT44(iStack_dc,iStack_e0); - UlProbeForRead((ulonglong)puVar20,(ulonglong)uStack_e4,4,param_4); + goto LAB_1; } + iVar9 = 4; } - bVar6 = true; - puVar19 = puVar20; - local_68 = puVar20; + puVar18 = (undefined4 *)CONCAT44(iStack_c4,iStack_c8); + UlProbeForRead((ulonglong)puVar18,(ulonglong)uStack_cc,iVar9,param_4); + bVar4 = true; + local_68 = puVar18; } } else { - cVar8 = IoIs32bitProcess(local_res18); - if (cVar8 == '\0') { - if (uStack_e4 < 0x40) { - uVar18 = 0xc000000d; + cVar6 = IoIs32bitProcess(local_res18); + if (cVar6 == '\0') { + if (uStack_cc < 0x40) { + uVar15 = 0xc000000d; local_104 = 0xc000000d; if ((DAT_2 & 0x20) != 0) { - WPP_SF_L(0x83,&WPP_aee5f1d9509b337e9d647e3a3f21c431_Traceguids,0xc000000d); + WPP_SF_L(0x83,&WPP_6be8f1a1a6dc3a7610af4fdeda223eb8_Traceguids,0xc000000d); } goto LAB_1; } - iVar11 = 8; + iVar9 = 8; } else { - if (uStack_e4 < 0x24) { - uVar18 = 0xc000000d; + if (uStack_cc < 0x24) { + uVar15 = 0xc000000d; local_104 = 0xc000000d; if ((DAT_2 & 0x20) != 0) { - WPP_SF_L(0x82,&WPP_aee5f1d9509b337e9d647e3a3f21c431_Traceguids,0xc000000d); + WPP_SF_L(0x82,&WPP_6be8f1a1a6dc3a7610af4fdeda223eb8_Traceguids,0xc000000d); } goto LAB_1; } - iVar11 = 4; - } - puVar4 = (ulonglong *)CONCAT44(iStack_dc,iStack_e0); - UlProbeForRead((ulonglong)puVar4,(ulonglong)uStack_e4,iVar11,param_4); - cVar8 = IoIs32bitProcess(uVar12); - local_b8 = *puVar4; - uStack_b0 = CONCAT44(uStack_b0._4_4_,(int)puVar4[1]); - if (cVar8 == '\0') { - uStack_90 = puVar4[5]; - uVar1 = (undefined2)puVar4[4]; - uStack_a0 = puVar4[3]; - uVar2 = (undefined2)puVar4[2]; - uStack_80 = puVar4[7]; - uVar3 = (undefined2)puVar4[6]; + iVar9 = 4; + } + puVar2 = (ulonglong *)CONCAT44(iStack_c4,iStack_c8); + UlProbeForRead((ulonglong)puVar2,(ulonglong)uStack_cc,iVar9,param_4); + cVar6 = IoIs32bitProcess(local_res18); + local_b8 = *puVar2; + uStack_b0 = CONCAT44(uStack_b0._4_4_,(int)puVar2[1]); + if (cVar6 == '\0') { + uStack_90 = puVar2[5]; + local_98 = CONCAT62(local_98._2_6_,(short)puVar2[4]); + uStack_a0 = puVar2[3]; + local_a8 = CONCAT62(local_a8._2_6_,(short)puVar2[2]); + uStack_80 = puVar2[7]; + local_88 = CONCAT62(local_88._2_6_,(short)puVar2[6]); + local_78 = 0; + uStack_70 = 0; + bVar3 = true; + local_100 = 1; } else { - uStack_90 = (ulonglong)(uint)puVar4[3]; - uVar1 = *(undefined2 *)((longlong)puVar4 + 0x14); - uStack_a0 = (ulonglong)(uint)puVar4[2]; - uVar2 = *(undefined2 *)((longlong)puVar4 + 0xc); - uStack_80 = (ulonglong)(uint)puVar4[4]; - uVar3 = *(undefined2 *)((longlong)puVar4 + 0x1c); - } - local_88 = CONCAT62(local_88._2_6_,uVar3); - local_98 = CONCAT62(local_98._2_6_,uVar1); - local_a8 = CONCAT62(local_a8._2_6_,uVar2); - local_78 = 0; - uStack_70 = 0; - bVar5 = true; - local_100 = 1; - uVar15 = local_f0; - } - uVar15 = uVar15 + 1; - piVar22 = piVar22 + 4; - } - else { - uVar15 = uVar15 + 1; - piVar22 = piVar22 + 4; - } - } - if (bVar5) { - uVar15 = UlVerifyAuthConfig(local_f8,(uint *)&local_b8); - uVar18 = (ulonglong)uVar15; - if ((int)uVar15 < 0) goto LAB_1; - bVar5 = false; - lVar17 = *(longlong *)(param_1 + 0x608); - if (lVar17 == 0) { + uStack_90 = (ulonglong)(uint)puVar2[3]; + local_98 = CONCAT62(local_98._2_6_,*(undefined2 *)((longlong)puVar2 + 0x14)); + uStack_a0 = (ulonglong)(uint)puVar2[2]; + local_a8 = CONCAT62(local_a8._2_6_,*(undefined2 *)((longlong)puVar2 + 0xc)); + uStack_80 = (ulonglong)(uint)puVar2[4]; + local_88 = CONCAT62(local_88._2_6_,*(undefined2 *)((longlong)puVar2 + 0x1c)); + local_78 = 0; + uStack_70 = 0; + bVar3 = true; + local_100 = 1; + } + } + uVar16 = uVar16 + 1; + piVar13 = piVar13 + 4; + } + else { + uVar16 = uVar16 + 1; + piVar13 = piVar13 + 4; + } + } + if (bVar3) { + uVar16 = UlVerifyAuthConfig(local_f8,(uint *)&local_b8); + uVar15 = (ulonglong)uVar16; + if ((int)uVar16 < 0) goto LAB_1; + bVar3 = false; + lVar12 = *(longlong *)(param_1 + 0x608); + if (lVar12 == 0) { if (*(char *)(param_1 + 0x601) == '\0') { - lVar17 = *(longlong *)(param_1 + 0x530); - bVar5 = false; + lVar12 = *(longlong *)(param_1 + 0x530); goto LAB_3; } - puVar16 = (uint *)(*(longlong *)(param_1 + 0x528) + 0x128); - } - else { - bVar5 = true; + puVar14 = (uint *)(*(longlong *)(param_1 + 0x528) + 0x128); + } + else { + bVar3 = true; LAB_3: - puVar16 = (uint *)(lVar17 + 0x130); + puVar14 = (uint *)(lVar12 + 0x130); } KeEnterCriticalRegion(); - uVar18 = *(ulonglong *)(lVar14 + 0x558); - uVar12 = ExAcquireCacheAwarePushLockSharedEx(uVar18,0); - uVar13 = UlIsAuthChangeNeededOld(uVar18,puVar16,(uint *)&local_b8,param_4,local_107); - uVar18 = uVar13 & 0xffffffff; - ExReleaseCacheAwarePushLockSharedEx(uVar12,0); + uVar15 = *(ulonglong *)(local_f8 + 0x558); + uVar10 = ExAcquireCacheAwarePushLockSharedEx(uVar15,0); + uVar11 = UlIsAuthChangeNeededOld(uVar15,puVar14,(uint *)&local_b8,param_4,local_107); + uVar15 = uVar11 & 0xffffffff; + ExReleaseCacheAwarePushLockSharedEx(uVar10,0); KeLeaveCriticalRegion(); - if ((int)uVar13 < 0) goto LAB_1; - lVar14 = local_f8; + if ((int)uVar11 < 0) goto LAB_1; + lVar12 = local_f8; if ((local_107[0] == '\0') || (param_5 == '\0')) goto LAB_4; KeEnterCriticalRegion(); - lVar14 = local_f8; + lVar12 = local_f8; ExAcquireCacheAwarePushLockExclusive(*(undefined8 *)(local_f8 + 0x558)); - if ((bVar5) && (*(longlong *)(param_1 + 0x608) != *(longlong *)(param_1 + 0x530))) { + if ((bVar3) && (*(longlong *)(param_1 + 0x608) != *(longlong *)(param_1 + 0x530))) { if ((local_b8 & 1) != 0) { - puVar16 = (uint *)(*(longlong *)(param_1 + 0x530) + 0x130); + puVar14 = (uint *)(*(longlong *)(param_1 + 0x530) + 0x130); goto LAB_5; } } else { LAB_5: - uVar15 = UlUpdateAuthConfig(lVar14,puVar16,(uint *)&local_b8,param_4); - uVar18 = (ulonglong)uVar15; - } - ExReleaseCacheAwarePushLockExclusive(*(undefined8 *)(lVar14 + 0x558)); + uVar16 = UlUpdateAuthConfig(lVar12,puVar14,(uint *)&local_b8,param_4); + uVar15 = (ulonglong)uVar16; + } + ExReleaseCacheAwarePushLockExclusive(*(undefined8 *)(lVar12 + 0x558)); KeLeaveCriticalRegion(); - if ((int)uVar18 < 0) goto LAB_1; - } - else if (!bVar6) goto LAB_1; + if ((int)uVar15 < 0) goto LAB_1; + } + else { + lVar12 = local_f8; + if (!bVar4) goto LAB_1; + } LAB_4: - if (bVar6) { - local_d8 = 0; - uStack_d0 = 0; - local_c8 = (int *)0x0; - uVar15 = UlCaptureChannelBindConfig(lVar14,puVar19,(uint *)&local_d8,local_res18,param_4); - uVar18 = (ulonglong)uVar15; - if ((int)uVar15 < 0) goto LAB_1; - bVar5 = false; - lVar14 = *(longlong *)(param_1 + 0x630); - if (lVar14 == 0) { + if (bVar4) { + local_e8 = 0; + uStack_e0 = 0; + local_d8 = (int *)0x0; + uVar16 = UlCaptureChannelBindConfig(lVar12,puVar18,(uint *)&local_e8,local_res18,param_4); + uVar15 = (ulonglong)uVar16; + if ((int)uVar16 < 0) goto LAB_1; + bVar3 = false; + lVar12 = *(longlong *)(param_1 + 0x630); + if (lVar12 == 0) { if (*(char *)(param_1 + 0x629) == '\0') { - lVar14 = *(longlong *)(param_1 + 0x530); + lVar12 = *(longlong *)(param_1 + 0x530); goto LAB_6; } - puVar16 = (uint *)(*(longlong *)(param_1 + 0x528) + 0x178); - pcVar21 = "SERVER_SESSION"; - } - else { - bVar5 = true; + puVar14 = (uint *)(*(longlong *)(param_1 + 0x528) + 0x178); + pcVar17 = "SERVER_SESSION"; + } + else { + bVar3 = true; LAB_6: - pcVar21 = "DEFAULT_GROUP"; - puVar16 = (uint *)(lVar14 + 0x180); + pcVar17 = "DEFAULT_GROUP"; + puVar14 = (uint *)(lVar12 + 0x180); } KeEnterCriticalRegion(); - uVar12 = ExAcquireCacheAwarePushLockSharedEx(*(undefined8 *)(local_f8 + 0x558),0); - piVar22 = local_c8; + uVar10 = ExAcquireCacheAwarePushLockSharedEx(*(undefined8 *)(local_f8 + 0x558),0); + piVar13 = local_d8; local_res8 = local_res8 & 0xffffffffffffff00; - if ((((*puVar16 & 1) == 0) || (puVar16[1] != local_d8._4_4_)) || (puVar16[2] != (uint)uStack_d0) + if ((((*puVar14 & 1) == 0) || (puVar14[1] != local_e8._4_4_)) || (puVar14[2] != (uint)uStack_e0) ) { LAB_7: local_res10 = true; LAB_8: - uVar18 = 0; + uVar15 = 0; local_104 = 0; } else { - if (*(longlong *)(puVar16 + 4) == 0) { - if (local_c8 == (int *)0x0) { + if (*(longlong *)(puVar14 + 4) == 0) { + if (local_d8 == (int *)0x0) { local_res10 = false; goto LAB_8; } - if (local_c8 != (int *)0x0) goto LAB_7; - } - else if (local_c8 == (int *)0x0) goto LAB_7; - uVar18 = UlpIsServiceContainerEquivalent - (*(longlong *)(puVar16 + 4),(longlong)local_c8,(undefined1 *)&local_res8); - local_104 = (uint)uVar18; - uVar18 = uVar18 & 0xffffffff; + if (local_d8 != (int *)0x0) goto LAB_7; + } + else if (local_d8 == (int *)0x0) goto LAB_7; + uVar15 = UlpIsServiceContainerEquivalent + (*(longlong *)(puVar14 + 4),(longlong)local_d8,(undefined1 *)&local_res8); + local_104 = (uint)uVar15; + uVar15 = uVar15 & 0xffffffff; if (-1 < (int)local_104) { local_res10 = (char)local_res8 == '\0'; goto LAB_8; } } - ExReleaseCacheAwarePushLockSharedEx(uVar12,0); + ExReleaseCacheAwarePushLockSharedEx(uVar10,0); KeLeaveCriticalRegion(); - if (((-1 < (int)uVar18) && (local_res10 != false)) && (param_5 != '\0')) { + if (((-1 < (int)uVar15) && (local_res10 != false)) && (param_5 != '\0')) { KeEnterCriticalRegion(); - lVar14 = local_f8; + lVar12 = local_f8; ExAcquireCacheAwarePushLockExclusive(*(undefined8 *)(local_f8 + 0x558)); - if ((bVar5) && (*(longlong *)(param_1 + 0x630) != *(longlong *)(param_1 + 0x530))) { - pcVar21 = "OWNER_GROUP"; - if ((local_d8 & 1) != 0) { - puVar16 = (uint *)(*(longlong *)(param_1 + 0x530) + 0x180); + if ((bVar3) && (*(longlong *)(param_1 + 0x630) != *(longlong *)(param_1 + 0x530))) { + pcVar17 = "OWNER_GROUP"; + if ((local_e8 & 1) != 0) { + puVar14 = (uint *)(*(longlong *)(param_1 + 0x530) + 0x180); goto LAB_9; } } else { LAB_9: - UlUpdateChannelBindConfig(puVar16,(uint *)&local_d8); - } - ExReleaseCacheAwarePushLockExclusive(*(undefined8 *)(lVar14 + 0x558)); + UlUpdateChannelBindConfig(puVar14,(uint *)&local_e8); + } + ExReleaseCacheAwarePushLockExclusive(*(undefined8 *)(lVar12 + 0x558)); KeLeaveCriticalRegion(); - plVar7 = local_50; - lVar14 = *local_50; - if (((lVar14 != 0) && ((*(byte *)(*(longlong *)(lVar14 + 0x448) + 0x6e2) & 0x20) != 0)) && - ((*(longlong *)(*(longlong *)(lVar14 + 0x448) + 0x6f0) == 0 || - (bVar9 = UlEtwEvaluateFilterForRequestConnection(param_1,lVar14,0), bVar9 != 0)))) { + plVar5 = local_50; + lVar12 = *local_50; + if (((lVar12 != 0) && ((*(byte *)(*(longlong *)(lVar12 + 0x448) + 0x6e2) & 0x20) != 0)) && + ((*(longlong *)(*(longlong *)(lVar12 + 0x448) + 0x6f0) == 0 || + (bVar7 = UlEtwEvaluateFilterForRequestConnection(param_1,lVar12,0), bVar7 != 0)))) { McTemplateK0s_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(*plVar7 + 0x448) + 0x698),lVar14,param_1 + 0x48, - pcVar21); - } - } - if (((local_d8 & 1) != 0) && (piVar22 != (int *)0x0)) { + ((undefined8 *)(*(longlong *)(*plVar5 + 0x448) + 0x698),lVar12,param_1 + 0x48, + pcVar17); + } + } + if (((local_e8 & 1) != 0) && (piVar13 != (int *)0x0)) { LOCK(); - iVar11 = *piVar22; - *piVar22 = *piVar22 + -1; + iVar9 = *piVar13; + *piVar13 = *piVar13 + -1; UNLOCK(); - iVar11 = iVar11 + -1; - if ((UxDebugCheckRefcount != '\0') && (iVar11 < 0)) { + iVar9 = iVar9 + -1; + if ((UxDebugCheckRefcount != '\0') && (iVar9 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,local_c8,10,(longlong)iVar11); - } - if (iVar11 == 0) { - UlFreeServiceNameContainer((longlong)local_c8); - } - uVar18 = (ulonglong)local_104; - } - if ((int)uVar18 < 0) goto LAB_1; + UlBugCheckEx(3,local_d8,10,(longlong)iVar9); + } + if (iVar9 == 0) { + UlFreeServiceNameContainer((longlong)local_d8); + } + uVar15 = (ulonglong)local_104; + } + if ((int)uVar15 < 0) goto LAB_1; } if (param_6 != (undefined1 *)0x0) { if ((local_107[0] == '\0') && (local_res10 == false)) { - uVar10 = 0; - } - else { - uVar10 = 1; - } - *param_6 = uVar10; + uVar8 = 0; + } + else { + uVar8 = 1; + } + *param_6 = uVar8; } LAB_1: if ((DAT_0 & 0x20) != 0) { - WPP_SF_L(0x87,&WPP_aee5f1d9509b337e9d647e3a3f21c431_Traceguids,(int)uVar18); - } - return uVar18; + WPP_SF_L(0x87,&WPP_6be8f1a1a6dc3a7610af4fdeda223eb8_Traceguids,(int)uVar15); + } + return uVar15; } ``` ## UlpRebuildResponseHeaders ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.63| |i_ratio|0.47| |m_ratio|0.97| |b_ratio|0.28| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpRebuildResponseHeaders|UlpRebuildResponseHeaders| |fullname|UlpRebuildResponseHeaders|UlpRebuildResponseHeaders| |refcount|2|2| |`length`|1807|1690| |called|
Expand for full list:
HttpStringToULongLong
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::_strnicmp
UlHkeBuilderComputeFixedHeaderSize
UlHkeBuilderCopyFixedHeaders
UlHkeBuilderCopyVariableHeadersUlHkeBuilderGetStatusLineOffsets
UlInitializeParsedHeaders
UlReInitializeParsedHeaders
UlpRebuildHeaderChunks
WPP_SF_Ll
WPP_SF_iq
|
Expand for full list:
HttpStringToULongLong
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::_strnicmp
UlHkeBuilderComputeFixedHeaderSize
UlHkeBuilderCopyFixedHeaders
UlHkeBuilderCopyVariableHeadersUlHkeBuilderGetStatusLineOffsets
UlInitializeParsedHeaders
UlReInitializeParsedHeaders
UlpRebuildHeaderChunks
WPP_SF_Ll
WPP_SF_iq
| |calling|UlpCompleteSendToExtensionWorker|UlpCompleteSendToExtensionWorker| |paramcount|4|4| |`address`|14010cd9c|14010d44c| |sig|longlong * __fastcall UlpRebuildResponseHeaders(int * param_1, byte * param_2, undefined8 param_3, byte * param_4)|longlong * __fastcall UlpRebuildResponseHeaders(int * param_1, byte * param_2, undefined8 param_3, byte * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpRebuildResponseHeaders Diff ```diff --- UlpRebuildResponseHeaders +++ UlpRebuildResponseHeaders @@ -1,293 +1,267 @@ longlong * UlpRebuildResponseHeaders(int *param_1,byte *param_2,undefined8 param_3,byte *param_4) { longlong lVar1; longlong lVar2; - undefined *puVar3; + byte *pbVar3; uint uVar4; int iVar5; - byte *pbVar6; + longlong *plVar6; ulonglong uVar7; - uint *puVar8; + byte **ppbVar8; longlong *plVar9; - undefined *puVar10; + longlong *plVar10; undefined1 uVar11; uint uVar12; undefined8 *puVar13; longlong *plVar14; bool bVar15; bool bVar16; char local_res8; - uint local_res18 [2]; + byte *local_res18; uint local_res20 [2]; - longlong local_c8; - uint local_c0; - uint local_bc; - undefined *local_b8; - uint local_b0; + uint local_b8; + uint local_b4; + longlong local_b0; longlong local_a8; longlong local_a0; - longlong local_98; + undefined8 local_98; undefined8 uStack_90; undefined8 local_88; undefined8 uStack_80; undefined8 local_78; - undefined8 local_70; - undefined8 uStack_68; - undefined8 local_60; - undefined8 uStack_58; - undefined8 local_50; + longlong local_70 [6]; - plVar9 = (longlong *)0x0; - local_b8 = (undefined *)0x0; - local_78 = 0; + plVar6 = (longlong *)0x0; + local_b8 = 0; + local_70[4] = 0; lVar1 = *(longlong *)(param_1 + 0x88); lVar2 = *(longlong *)(param_1 + 0x8a); - local_50 = 0; - local_c0 = 0; - local_res18[0] = 0; - local_c8 = 0; + local_78 = 0; + local_res18 = (byte *)((ulonglong)local_res18 & 0xffffffff00000000); + local_b0 = 0; local_a8 = 0; + local_70[0] = 0; + local_70[1] = 0; + local_res20[0] = 0; + local_70[2] = 0; + local_70[3] = 0; + local_res8 = '\0'; local_98 = 0; uStack_90 = 0; - local_res20[0] = 0; + local_b4 = 0; local_88 = 0; uStack_80 = 0; - local_res8 = '\0'; - local_70 = 0; - uStack_68 = 0; - local_bc = 0; - local_60 = 0; - uStack_58 = 0; local_a0 = 0; if ((DAT_0 & 1) != 0) { param_4 = param_2; - WPP_SF_iq(0xdb,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,param_1,param_2); + WPP_SF_iq(0xdb,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,param_1,param_2); } *param_2 = 0; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(lVar1,0); *(uint *)(lVar1 + 8) = *(uint *)(lVar1 + 8) & 0xfffffffd; if ((*(uint *)(lVar1 + 8) & 4) == 0) { ExReleasePushLockExclusiveEx(); KeLeaveCriticalRegion(); *param_2 = 1; + plVar9 = plVar6; goto LAB_1; } ExReleasePushLockExclusiveEx(lVar1,0); KeLeaveCriticalRegion(); - puVar8 = local_res18; - uVar4 = UlHkeBuilderComputeFixedHeaderSize(lVar1,(int *)puVar8); - puVar13 = (undefined8 *)(ulonglong)local_res18[0]; - plVar14 = plVar9; - local_b0 = uVar4; + ppbVar8 = &local_res18; + uVar4 = UlHkeBuilderComputeFixedHeaderSize(lVar1,(int *)ppbVar8); + puVar13 = (undefined8 *)((ulonglong)local_res18 & 0xffffffff); + plVar14 = plVar6; if (*(char *)(*(longlong *)(param_1 + 6) + 0xc8e) != '\0') { - uVar12 = local_res18[0] + 1 + UlH3ExtraHeaderCount; + uVar12 = (int)local_res18 + 1 + UlH3ExtraHeaderCount; puVar13 = (undefined8 *)(ulonglong)uVar12; if ((uint)param_1[0xb2] < uVar12) { - local_c8 = 0; + local_b0 = 0; if ((ulonglong)((longlong)puVar13 * 0x18) < 0x100000000) { param_4 = &UxLowPriorityPool; - local_c8 = ExAllocatePool3(0x40,(longlong)puVar13 * 0x18,0x464b6c55,&UxLowPriorityPool,1); - } - if (local_c8 == 0) { + local_b0 = ExAllocatePool3(0x40,(longlong)puVar13 * 0x18,0x464b6c55,&UxLowPriorityPool,1); + } + if (local_b0 == 0) { plVar9 = (longlong *)0xc000009a; goto LAB_1; } - UlInitializeParsedHeaders(&local_98,local_c8,(undefined8 *)(ulonglong)uVar12,param_4); + UlInitializeParsedHeaders(local_70,local_b0,(undefined8 *)(ulonglong)uVar12,param_4); local_res8 = '\x01'; - if (UxKirBranchCacheIgnoreResponseCaching != '\0') { - plVar9 = &local_98; - goto LAB_2; - } + plVar14 = local_70; } else { plVar14 = (longlong *)(param_1 + 0xae); - if (UxKirBranchCacheIgnoreResponseCaching == '\0') { - local_98 = *plVar14; - uStack_90 = *(undefined8 *)(param_1 + 0xb0); - local_88 = *(undefined8 *)(param_1 + 0xb2); - uStack_80 = *(undefined8 *)(param_1 + 0xb4); - local_78 = *(undefined8 *)(param_1 + 0xb6); - } - else { - UlReInitializeParsedHeaders(plVar14,puVar8,0xffffffff,param_4); - plVar9 = plVar14; - uVar4 = local_b0; - } -LAB_2: - plVar14 = plVar9; - if (UxKirBranchCacheIgnoreResponseCaching != '\0') goto LAB_3; + UlReInitializeParsedHeaders(plVar14,ppbVar8,0xffffffff,param_4); } - plVar14 = &local_98; - } -LAB_3: - pbVar6 = (byte *)ExAllocatePool3(0x42,uVar4,0x464b6c55,&UxLowPriorityPool,1); - if (pbVar6 == (byte *)0x0) { + } + local_res18 = (byte *)ExAllocatePool3(0x42,uVar4,0x464b6c55,&UxLowPriorityPool,1); + if (local_res18 == (byte *)0x0) { plVar9 = (longlong *)0xc000009a; } else { - uVar4 = UlHkeBuilderCopyFixedHeaders(lVar1,uVar4,pbVar6,(int *)local_res20,plVar14); + uVar4 = UlHkeBuilderCopyFixedHeaders(lVar1,uVar4,local_res18,(int *)local_res20,plVar14); plVar9 = (longlong *)(ulonglong)uVar4; if (-1 < (int)uVar4) { if ((*(uint *)(*(longlong *)(param_1 + 0x88) + 8) & 0x10) != 0) { UlHkeBuilderGetStatusLineOffsets (*(longlong *)(param_1 + 0x88),(uint *)(param_1 + 0x29),param_1 + 0x3b, param_1 + 0x3c,(int *)0x0,(int *)0x0); } if ((char)param_1[0xe] == '\0') { -LAB_4: +LAB_2: if (plVar14 == (longlong *)0x0) { - puVar10 = local_b8; + plVar10 = plVar6; uVar7 = UlpRebuildHeaderChunks - (param_1,pbVar6,(int *)(ulonglong)local_res20[0],local_b8,local_c0); + (param_1,local_res18,(int *)(ulonglong)local_res20[0], + (undefined *)plVar6,local_b8); plVar9 = (longlong *)(uVar7 & 0xffffffff); if (-1 < (int)uVar7) { -LAB_5: +LAB_3: uVar11 = 0; bVar15 = (*(byte *)(lVar2 + 0xd8) & 1) != 0; if (bVar15) { - puVar10 = (undefined *)CONCAT71((int7)((ulonglong)puVar10 >> 8),1); + plVar10 = (longlong *)CONCAT71((int7)((ulonglong)plVar10 >> 8),1); HttpStringToULongLong ('\0',*(ushort **)(lVar2 + 0xe0),(ulonglong)*(ushort *)(lVar2 + 0xda), - (ulonglong)puVar10,10,(longlong *)0x0,(ulonglong *)(param_1 + 8)); + (ulonglong)plVar10,10,(longlong *)0x0,(ulonglong *)(param_1 + 8)); } if ((*(byte *)(lVar2 + 0x88) & 1) != 0) { - uVar11 = 0; if (*(short *)(lVar2 + 0x8a) == 7) { iVar5 = _strnicmp(*(char **)(lVar2 + 0x90),"chunked",7); uVar11 = 0; if (iVar5 == 0) { uVar11 = 1; } } if (bVar15) { plVar9 = (longlong *)0xc0000184; - goto LAB_6; + goto LAB_4; } plVar9 = (longlong *)0x0; } bVar16 = UxKirDtHttpFastForwardHttp11Client != '\0'; *(bool *)(param_1 + 10) = bVar15; *(undefined1 *)((longlong)param_1 + 0x2b) = uVar11; if (bVar16) { *(undefined1 *)(*(longlong *)(param_1 + 6) + 0xc8c) = uVar11; *(bool *)(*(longlong *)(param_1 + 6) + 0xc8d) = bVar15; if (bVar15) { *(undefined8 *)(*(longlong *)(param_1 + 6) + 0xc70) = *(undefined8 *)(param_1 + 8); *(undefined8 *)(*(longlong *)(param_1 + 6) + 0xc78) = *(undefined8 *)(param_1 + 8); } } if ((*(ushort *)(lVar2 + 0x38) & 4) != 0) { if ((*(ushort *)(lVar2 + 0x38) & 1) == 0) { *(undefined4 *)(*(longlong *)(param_1 + 6) + 0xac0) = 0; } else if ((*(short *)(lVar2 + 0x3a) == 5) && (iVar5 = _strnicmp(*(char **)(lVar2 + 0x40),"close",5), iVar5 == 0)) { *(undefined4 *)(*(longlong *)(param_1 + 6) + 0xac0) = 1; } else if ((*(short *)(lVar2 + 0x3a) == 10) && (iVar5 = _strnicmp(*(char **)(lVar2 + 0x40),"keep-alive",10), iVar5 == 0)) { *(undefined4 *)(*(longlong *)(param_1 + 6) + 0xac0) = 2; } } - puVar3 = local_b8; - *(byte **)(param_1 + 0x30) = pbVar6; - pbVar6 = (byte *)0x0; + pbVar3 = local_res18; + local_res18 = (byte *)0x0; + *(byte **)(param_1 + 0x30) = pbVar3; param_1[0x2a] = local_res20[0]; *(undefined1 *)(param_1 + 0xd) = 1; - if (local_b8 != (undefined *)0x0) { - local_b8 = (undefined *)0x0; - *(undefined **)(param_1 + 0x34) = puVar3; - param_1[0x2c] = local_c0; + if (plVar6 != (longlong *)0x0) { + *(longlong **)(param_1 + 0x34) = plVar6; + plVar6 = (longlong *)0x0; + param_1[0x2c] = local_b8; *(undefined1 *)((longlong)param_1 + 0x35) = 1; } if (local_res8 != '\0') { *(char *)((longlong)param_1 + 0x36) = local_res8; lVar1 = plVar14[1]; *(longlong *)(param_1 + 0xae) = *plVar14; *(longlong *)(param_1 + 0xb0) = lVar1; lVar1 = plVar14[3]; *(longlong *)(param_1 + 0xb2) = plVar14[2]; *(longlong *)(param_1 + 0xb4) = lVar1; *(longlong *)(param_1 + 0xb6) = plVar14[4]; - UlInitializeParsedHeaders(plVar14,0,(undefined8 *)0x0,puVar10); - local_c8 = 0; + UlInitializeParsedHeaders(plVar14,0,(undefined8 *)0x0,plVar10); + local_b0 = 0; } if (local_a8 != 0) { *(longlong *)(param_1 + 0xa8) = local_a0; - *(undefined8 *)(param_1 + 0xb8) = local_70; - *(undefined8 *)(param_1 + 0xba) = uStack_68; + *(undefined8 *)(param_1 + 0xb8) = local_98; + *(undefined8 *)(param_1 + 0xba) = uStack_90; *(undefined1 *)((longlong)param_1 + 0x37) = 1; - *(undefined8 *)(param_1 + 0xbc) = local_60; - *(undefined8 *)(param_1 + 0xbe) = uStack_58; - param_1[0xac] = local_bc; - *(undefined8 *)(param_1 + 0xc0) = local_50; - UlInitializeParsedHeaders(&local_70,0,(undefined8 *)0x0,puVar10); + *(undefined8 *)(param_1 + 0xbc) = local_88; + *(undefined8 *)(param_1 + 0xbe) = uStack_80; + param_1[0xac] = local_b4; + *(undefined8 *)(param_1 + 0xc0) = local_78; + UlInitializeParsedHeaders(&local_98,0,(undefined8 *)0x0,plVar10); local_a8 = 0; local_a0 = 0; } } } else { - uVar4 = local_bc; + uVar4 = local_b4; if (((ulonglong)plVar14[4] < 0xffffffff) && - ((uVar4 = *(uint *)(plVar14 + 4), local_bc = uVar4, (char)param_1[0xe] != '\0' || - (local_bc = UlVariableHeaderSize + uVar4, uVar4 <= local_bc)))) { - local_a0 = ExAllocatePool3(0x40,local_bc,0x464b6c55,&UxLowPriorityPool,1); + ((uVar4 = *(uint *)(plVar14 + 4), local_b4 = uVar4, (char)param_1[0xe] != '\0' || + (local_b4 = UlVariableHeaderSize + uVar4, uVar4 <= local_b4)))) { + local_a0 = ExAllocatePool3(0x40,local_b4,0x464b6c55,&UxLowPriorityPool,1); if (local_a0 != 0) { - puVar10 = &UxLowPriorityPool; + plVar10 = (longlong *)&UxLowPriorityPool; local_a8 = ExAllocatePool3(0x40,(longlong)puVar13 * 0x18,0x464b6c55,&UxLowPriorityPool ,1); if (local_a8 != 0) { plVar9 = (longlong *)0x0; - UlInitializeParsedHeaders(&local_70,local_a8,puVar13,puVar10); - goto LAB_5; + UlInitializeParsedHeaders(&local_98,local_a8,puVar13,plVar10); + goto LAB_3; } } plVar9 = (longlong *)0xc000009a; } else { - local_bc = uVar4; + local_b4 = uVar4; plVar9 = (longlong *)0xc0000023; } } -LAB_6: - if (local_b8 != (undefined *)0x0) { -LAB_7: - ExFreePoolWithTag(local_b8,0); - } - if (pbVar6 == (byte *)0x0) goto LAB_8; +LAB_4: + if (plVar6 != (longlong *)0x0) { +LAB_5: + ExFreePoolWithTag(plVar6,0); + } + if (local_res18 == (byte *)0x0) goto LAB_6; } else { uVar7 = (ulonglong)UlVariableHeaderSize; - local_b8 = (undefined *)ExAllocatePool3(0x42,uVar7,0x464b6c55,&UxLowPriorityPool,1); - if (local_b8 != (undefined *)0x0) { - uVar7 = UlHkeBuilderCopyVariableHeaders(lVar1,uVar7,local_b8,(int *)&local_c0,plVar14); + plVar6 = (longlong *)ExAllocatePool3(0x42,uVar7,0x464b6c55,&UxLowPriorityPool,1); + if (plVar6 != (longlong *)0x0) { + uVar7 = UlHkeBuilderCopyVariableHeaders(lVar1,uVar7,plVar6,(int *)&local_b8,plVar14); plVar9 = (longlong *)(uVar7 & 0xffffffff); - if (-1 < (int)uVar7) goto LAB_4; - goto LAB_7; + if (-1 < (int)uVar7) goto LAB_2; + goto LAB_5; } plVar9 = (longlong *)0xc000009a; } } - ExFreePoolWithTag(pbVar6,0); - } -LAB_8: - if (local_c8 != 0) { - ExFreePoolWithTag(local_c8,0); + ExFreePoolWithTag(local_res18,0); + } +LAB_6: + if (local_b0 != 0) { + ExFreePoolWithTag(local_b0,0); } if (local_a8 != 0) { ExFreePoolWithTag(local_a8,0); } if (local_a0 != 0) { ExFreePoolWithTag(local_a0,0); } LAB_1: if ((DAT_0 & 1) != 0) { - WPP_SF_Ll(0xdc,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,(uint)*param_2,(int)plVar9); + WPP_SF_Ll(0xdc,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,(uint)*param_2,(int)plVar9); } return plVar9; } ``` ## UxQuicConnectionGetPeerIssuerListClient ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.79| |i_ratio|0.79| |m_ratio|0.91| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxQuicConnectionGetPeerIssuerListClient|UxQuicConnectionGetPeerIssuerListClient| |fullname|UxQuicConnectionGetPeerIssuerListClient|UxQuicConnectionGetPeerIssuerListClient| |refcount|2|2| |`length`|440|526| |called|NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UxpQuicConnectionCopyIssuerList32
memcpy|NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UxpQuicConnectionCopyIssuerList32
memcpy| |calling|UcQueryClientConnectionProperty|UcQueryClientConnectionProperty| |paramcount|5|5| |`address`|1400e2624|1400e2cb8| |sig|undefined4 __fastcall UxQuicConnectionGetPeerIssuerListClient(longlong param_1, char param_2, longlong * param_3, uint param_4, uint * param_5)|undefined4 __fastcall UxQuicConnectionGetPeerIssuerListClient(longlong param_1, char param_2, longlong * param_3, uint param_4, uint * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxQuicConnectionGetPeerIssuerListClient Diff ```diff --- UxQuicConnectionGetPeerIssuerListClient +++ UxQuicConnectionGetPeerIssuerListClient @@ -1,62 +1,74 @@ undefined4 UxQuicConnectionGetPeerIssuerListClient (longlong param_1,char param_2,longlong *param_3,uint param_4,uint *param_5) { undefined4 uVar1; uint uVar2; ulonglong uVar3; uint uVar4; uint uVar5; longlong *plVar6; longlong *_Dst; longlong local_30 [3]; local_30[0] = 0; local_30[1] = 0; uVar4 = 0; *param_5 = 0; KeEnterCriticalRegion(); ExAcquirePushLockSharedEx(param_1 + 0x28,0); if (*(int *)(param_1 + 0xb0) == -0x3fdbfe8c) { plVar6 = local_30; if (*(longlong **)(param_1 + 0x690) != (longlong *)0x0) { plVar6 = *(longlong **)(param_1 + 0x690); } if (param_2 == '\0') { uVar2 = (*(uint *)(plVar6 + 1) + 1) * 0x10; for (uVar5 = 0; uVar5 < *(uint *)(plVar6 + 1); uVar5 = uVar5 + 1) { uVar2 = uVar2 + *(int *)(*plVar6 + (ulonglong)uVar5 * 0x10); } *param_5 = uVar2; if (param_4 < uVar2) { uVar1 = 0x80000005; } else { uVar1 = 0; *param_3 = (longlong)(param_3 + 2); *(int *)(param_3 + 1) = (int)plVar6[1]; _Dst = param_3 + ((ulonglong)*(uint *)(plVar6 + 1) + 1) * 2; - for (; uVar4 < *(uint *)(plVar6 + 1); uVar4 = uVar4 + 1) { - uVar3 = (ulonglong)uVar4; - *(longlong **)(*param_3 + 8 + uVar3 * 0x10) = _Dst; - *(undefined4 *)(*param_3 + uVar3 * 0x10) = *(undefined4 *)(*plVar6 + uVar3 * 0x10); - memcpy(_Dst,*(void **)(*plVar6 + 8 + uVar3 * 0x10), - (ulonglong)*(uint *)(*plVar6 + uVar3 * 0x10)); - _Dst = (longlong *)((longlong)_Dst + (ulonglong)*(uint *)(*plVar6 + uVar3 * 0x10)); + if (UxKirWritingAndReadingUmCertList == '\0') { + for (; uVar4 < *(uint *)(plVar6 + 1); uVar4 = uVar4 + 1) { + uVar3 = (ulonglong)uVar4; + *(longlong **)(*param_3 + 8 + uVar3 * 0x10) = _Dst; + *(undefined4 *)(*param_3 + uVar3 * 0x10) = *(undefined4 *)(*plVar6 + uVar3 * 0x10); + memcpy(_Dst,*(void **)(*plVar6 + 8 + uVar3 * 0x10), + (ulonglong)*(uint *)(*plVar6 + uVar3 * 0x10)); + _Dst = (longlong *)((longlong)_Dst + (ulonglong)*(uint *)(*plVar6 + uVar3 * 0x10)); + } + } + else { + for (; uVar4 < *(uint *)(plVar6 + 1); uVar4 = uVar4 + 1) { + uVar3 = (ulonglong)uVar4; + param_3[uVar3 * 2 + 3] = (longlong)_Dst; + *(undefined4 *)(param_3 + 2 + uVar3 * 2) = *(undefined4 *)(*plVar6 + uVar3 * 0x10); + memcpy(_Dst,*(void **)(*plVar6 + 8 + uVar3 * 0x10), + (ulonglong)*(uint *)(*plVar6 + uVar3 * 0x10)); + _Dst = (longlong *)((longlong)_Dst + (ulonglong)*(uint *)(*plVar6 + uVar3 * 0x10)); + } } } } else { uVar1 = UxpQuicConnectionCopyIssuerList32(plVar6,(undefined4 *)param_3,param_4,param_5); } } else { uVar1 = 0xc0000225; } ExReleasePushLockSharedEx(param_1 + 0x28,0); KeLeaveCriticalRegion(); return uVar1; } ``` ## UxSslGetTlsCipherInfo ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.21| |i_ratio|0.3| |m_ratio|0.95| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxSslGetTlsCipherInfo|UxSslGetTlsCipherInfo| |fullname|UxSslGetTlsCipherInfo|UxSslGetTlsCipherInfo| |refcount|3|3| |`length`|286|251| |called|WPP_SF_L
WPP_SF_qqLq|WPP_SF_L
WPP_SF_qqLq| |calling|UxQuicStreamConnectionControl
UxSslConnectionControl|UxQuicStreamConnectionControl
UxSslConnectionControl| |paramcount|4|4| |`address`|1401173a8|1401179d8| |sig|undefined4 __fastcall UxSslGetTlsCipherInfo(undefined8 * param_1, undefined8 * param_2, uint param_3, undefined4 * param_4)|undefined4 __fastcall UxSslGetTlsCipherInfo(undefined8 * param_1, undefined8 * param_2, uint param_3, undefined4 * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxSslGetTlsCipherInfo Diff ```diff --- UxSslGetTlsCipherInfo +++ UxSslGetTlsCipherInfo @@ -1,74 +1,66 @@ undefined4 UxSslGetTlsCipherInfo(undefined8 *param_1,undefined8 *param_2,uint param_3,undefined4 *param_4) { undefined8 uVar1; longlong lVar2; - undefined4 uVar3; - undefined8 *puVar4; + undefined8 *puVar3; + undefined4 uVar4; undefined8 *puVar5; - bool bVar6; if ((DAT_0 & 1) != 0) { - WPP_SF_qqLq(0x1e,&WPP_575742ddbbd13d10dc502caa156c9542_Traceguids,param_1,param_2); + WPP_SF_qqLq(0x1e,&WPP_140e93474bd536143d6c6d1c49fd7e6e_Traceguids,param_1,param_2); } - uVar3 = 0; - bVar6 = UxKirSeHttpQueryCryptoParams == '\0'; - *param_4 = 0; - if (bVar6) { - uVar3 = 0xc00000e5; + *param_4 = 0x2a8; + uVar4 = 0; + if ((param_2 == (undefined8 *)0x0) || (param_3 < 0x2a8)) { + uVar4 = 0x80000005; } else { - *param_4 = 0x2a8; - if ((param_2 == (undefined8 *)0x0) || (param_3 < 0x2a8)) { - uVar3 = 0x80000005; - } - else { - lVar2 = 5; - do { - puVar5 = param_2; - puVar4 = param_1; - uVar1 = puVar4[1]; - *puVar5 = *puVar4; - puVar5[1] = uVar1; - uVar1 = puVar4[3]; - puVar5[2] = puVar4[2]; - puVar5[3] = uVar1; - uVar1 = puVar4[5]; - puVar5[4] = puVar4[4]; - puVar5[5] = uVar1; - uVar1 = puVar4[7]; - puVar5[6] = puVar4[6]; - puVar5[7] = uVar1; - uVar1 = puVar4[9]; - puVar5[8] = puVar4[8]; - puVar5[9] = uVar1; - uVar1 = puVar4[0xb]; - puVar5[10] = puVar4[10]; - puVar5[0xb] = uVar1; - uVar1 = puVar4[0xd]; - puVar5[0xc] = puVar4[0xc]; - puVar5[0xd] = uVar1; - uVar1 = puVar4[0xf]; - puVar5[0xe] = puVar4[0xe]; - puVar5[0xf] = uVar1; - lVar2 = lVar2 + -1; - param_1 = puVar4 + 0x10; - param_2 = puVar5 + 0x10; - } while (lVar2 != 0); - uVar1 = puVar4[0x11]; - puVar5[0x10] = puVar4[0x10]; - puVar5[0x11] = uVar1; - uVar1 = puVar4[0x13]; - puVar5[0x12] = puVar4[0x12]; - puVar5[0x13] = uVar1; - puVar5[0x14] = puVar4[0x14]; - } + lVar2 = 5; + do { + puVar5 = param_1; + puVar3 = param_2; + uVar1 = puVar5[1]; + *puVar3 = *puVar5; + puVar3[1] = uVar1; + uVar1 = puVar5[3]; + puVar3[2] = puVar5[2]; + puVar3[3] = uVar1; + uVar1 = puVar5[5]; + puVar3[4] = puVar5[4]; + puVar3[5] = uVar1; + uVar1 = puVar5[7]; + puVar3[6] = puVar5[6]; + puVar3[7] = uVar1; + uVar1 = puVar5[9]; + puVar3[8] = puVar5[8]; + puVar3[9] = uVar1; + uVar1 = puVar5[0xb]; + puVar3[10] = puVar5[10]; + puVar3[0xb] = uVar1; + uVar1 = puVar5[0xd]; + puVar3[0xc] = puVar5[0xc]; + puVar3[0xd] = uVar1; + uVar1 = puVar5[0xf]; + puVar3[0xe] = puVar5[0xe]; + puVar3[0xf] = uVar1; + lVar2 = lVar2 + -1; + param_2 = puVar3 + 0x10; + param_1 = puVar5 + 0x10; + } while (lVar2 != 0); + uVar1 = puVar5[0x11]; + puVar3[0x10] = puVar5[0x10]; + puVar3[0x11] = uVar1; + uVar1 = puVar5[0x13]; + puVar3[0x12] = puVar5[0x12]; + puVar3[0x13] = uVar1; + puVar3[0x14] = puVar5[0x14]; } if ((DAT_0 & 1) != 0) { - WPP_SF_L(0x1f,&WPP_575742ddbbd13d10dc502caa156c9542_Traceguids,uVar3); + WPP_SF_L(0x1f,&WPP_140e93474bd536143d6c6d1c49fd7e6e_Traceguids,uVar4); } - return uVar3; + return uVar4; } ``` ## UlpSetUrlInfo ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.28| |i_ratio|0.08| |m_ratio|1.0| |b_ratio|0.05| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpSetUrlInfo|UlpSetUrlInfo| |fullname|UlpSetUrlInfo|UlpSetUrlInfo| |`refcount`|12|8| |`length`|1982|1794| |`called`|FUN_140156b71
UlBugCheckEx
UlCleanupChannelBindConfig
UlCleanupConfigGroupInfo
UlCopyAuthConfig
UlCopyChannelBindConfig
WPP_SF_L
WPP_SF_qil|UlBugCheckEx
UlCleanupChannelBindConfig
UlCleanupConfigGroupInfo
UlCopyAuthConfig
UlCopyChannelBindConfig
WPP_SF_L
WPP_SF_Sq
WPP_SF_qil| |calling|UlGetCGroupForRequest
UlSetUrlDelegateInfo
UlpTreeFindNodeWalker|UlGetCGroupForRequest
UlSetUrlDelegateInfo
UlpTreeFindNodeWalker| |paramcount|4|4| |`address`|1400309b0|140030a90| |sig|int __fastcall UlpSetUrlInfo(undefined4 * param_1, ulonglong param_2, char param_3, ulonglong param_4)|int __fastcall UlpSetUrlInfo(undefined4 * param_1, ulonglong param_2, char param_3, ulonglong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpSetUrlInfo Called Diff ```diff --- UlpSetUrlInfo called +++ UlpSetUrlInfo called @@ -1 +0,0 @@ -FUN_140156b71 @@ -7,0 +7 @@ +WPP_SF_Sq ``` ### UlpSetUrlInfo Diff ```diff --- UlpSetUrlInfo +++ UlpSetUrlInfo @@ -1,303 +1,294 @@ int UlpSetUrlInfo(undefined4 *param_1,ulonglong param_2,char param_3,ulonglong param_4) { int iVar1; longlong lVar2; undefined8 uVar3; int extraout_EAX; int extraout_EAX_00; - int iVar4; - uint uVar5; - uint *puVar7; - int *piVar8; - wchar_t *pwVar9; - ulonglong uVar10; - uint *puVar6; + int *piVar4; + wchar_t *pwVar5; + ulonglong uVar6; + int iVar7; - iVar4 = 0; + iVar7 = 0; if ((DAT_0 & 8) != 0) { param_4 = param_2; - WPP_SF_qil(0x88,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,param_1,param_2); - } - uVar10 = *(ulonglong *)(param_2 + 0x58); + WPP_SF_qil(0x89,&WPP_2d297478329b39561f77aac2cbbacc14_Traceguids,param_1,param_2); + } + uVar6 = *(ulonglong *)(param_2 + 0x58); if (*(char *)(param_1 + 4) == '\0') { *(undefined8 *)(param_1 + 10) = *(undefined8 *)(param_2 + 0x50); - piVar8 = (int *)(*(longlong *)(uVar10 + 0x30) + 4); + piVar4 = (int *)(*(longlong *)(uVar6 + 0x30) + 4); LOCK(); - iVar1 = *piVar8; - *piVar8 = *piVar8 + 1; + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar8,0x15,(longlong)(int)(iVar1 + 1U)); - } - piVar8 = (int *)(uVar10 + 4); - *(undefined8 *)(param_1 + 6) = *(undefined8 *)(uVar10 + 0x30); - *(ulonglong *)(param_1 + 8) = uVar10; + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,0x15,(longlong)(iVar1 + 1)); + } + piVar4 = (int *)(uVar6 + 4); + *(undefined8 *)(param_1 + 6) = *(undefined8 *)(uVar6 + 0x30); + *(ulonglong *)(param_1 + 8) = uVar6; LOCK(); - iVar1 = *piVar8; - *piVar8 = *piVar8 + 1; + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar8,0x15,(longlong)(int)(iVar1 + 1U)); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,0x15,(longlong)(iVar1 + 1)); } if ((*(int *)(param_2 + 0x2c) != 0) && (UxAllowNonprivilegedCaptureCred == '\0')) { *(undefined1 *)((longlong)param_1 + 0xf2) = 1; } lVar2 = *(longlong *)(param_1 + 6); *(undefined1 *)(param_1 + 4) = 1; if ((*(uint *)(lVar2 + 0x108) & 1) != 0) { uVar3 = *(undefined8 *)(lVar2 + 0x110); *(undefined8 *)(param_1 + 0x21) = *(undefined8 *)(lVar2 + 0x108); *(undefined8 *)(param_1 + 0x23) = uVar3; param_1[0x25] = *(undefined4 *)(lVar2 + 0x118); } - pwVar9 = (wchar_t *)(lVar2 + 0x128); - if ((*(uint *)pwVar9 & 1) == 0) { + pwVar5 = (wchar_t *)(lVar2 + 0x128); + if ((*(uint *)pwVar5 & 1) == 0) { LAB_1: if ((*(uint *)(*(longlong *)(param_1 + 6) + 0x178) & 1) != 0) { UlCopyChannelBindConfig(param_1 + 0x40,(uint *)(*(longlong *)(param_1 + 6) + 0x178)); *(undefined1 *)((longlong)param_1 + 0x119) = 1; } goto LAB_2; } param_4 = 1; - iVar4 = UlCopyAuthConfig(*(longlong *) - (*(longlong *)(*(longlong *)(uVar10 + 0x30) + 0x18) + 0x38), - param_1 + 0x28,(undefined4 *)pwVar9,'\x01', - *(char *)((longlong)param_1 + 0xf2),'\0'); - param_3 = (char)iVar4; - iVar4 = extraout_EAX_00; - if (-1 < extraout_EAX_00) { + UlCopyAuthConfig(*(longlong *)(*(longlong *)(*(longlong *)(uVar6 + 0x30) + 0x18) + 0x38), + param_1 + 0x28,(undefined4 *)pwVar5,'\x01',*(char *)((longlong)param_1 + 0xf2), + '\0'); + iVar7 = extraout_EAX; + if (-1 < extraout_EAX) { *(undefined1 *)((longlong)param_1 + 0xf1) = 1; goto LAB_1; } } else { - if (*(longlong *)(param_1 + 6) != *(longlong *)(uVar10 + 0x30)) goto LAB_3; + if (*(longlong *)(param_1 + 6) != *(longlong *)(uVar6 + 0x30)) goto LAB_3; LAB_2: - piVar8 = (int *)(uVar10 + 4); + piVar4 = (int *)(uVar6 + 4); if (param_3 != '\0') { - *(ulonglong *)(param_1 + 0xe) = uVar10; - LOCK(); - iVar1 = *piVar8; - *piVar8 = *piVar8 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar8,0x15,(longlong)(int)(iVar1 + 1U)); + *(ulonglong *)(param_1 + 0xe) = uVar6; + LOCK(); + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; + UNLOCK(); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,0x15,(longlong)(iVar1 + 1)); } } if ((*(longlong *)(param_1 + 0x16) == 0) && - (*(ulonglong *)(param_1 + 0x16) = uVar10, param_3 == '\0')) { - LOCK(); - iVar1 = *piVar8; - *piVar8 = *piVar8 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar8,0x15,(longlong)(int)(iVar1 + 1U)); - } - } - if (((*(uint *)(uVar10 + 0x40) & 1) != 0) && (*(longlong *)(param_1 + 2) == 0)) { - piVar8 = *(int **)(uVar10 + 0x48); - *(int **)(param_1 + 2) = piVar8; - LOCK(); - iVar1 = *piVar8; - *piVar8 = *piVar8 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar8,7,(longlong)(int)(iVar1 + 1U)); - } - } - if (((*(uint *)(uVar10 + 0x40) & 1) != 0) && (*(longlong *)(param_1 + 0xc) == 0)) { - piVar8 = *(int **)(uVar10 + 0x48); - *(int **)(param_1 + 0xc) = piVar8; - LOCK(); - iVar1 = *piVar8; - *piVar8 = *piVar8 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar8,7,(longlong)(int)(iVar1 + 1U)); - } - } - if ((((*(uint *)(uVar10 + 0x50) & 1) != 0) && (*(longlong *)(param_1 + 0x10) == 0)) && - (*(ulonglong *)(param_1 + 0x10) = uVar10, param_3 == '\0')) { - piVar8 = (int *)(uVar10 + 4); - LOCK(); - iVar1 = *piVar8; - *piVar8 = *piVar8 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar8,0x15,(longlong)(int)(iVar1 + 1U)); - } - } - if (((*(uint *)(uVar10 + 0x68) & 1) != 0) && (*(longlong *)(param_1 + 0x12) == 0)) { - *(ulonglong *)(param_1 + 0x12) = uVar10; + (*(ulonglong *)(param_1 + 0x16) = uVar6, param_3 == '\0')) { + LOCK(); + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; + UNLOCK(); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,0x15,(longlong)(iVar1 + 1)); + } + } + if (((*(uint *)(uVar6 + 0x40) & 1) != 0) && (*(longlong *)(param_1 + 2) == 0)) { + piVar4 = *(int **)(uVar6 + 0x48); + *(int **)(param_1 + 2) = piVar4; + LOCK(); + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; + UNLOCK(); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,7,(longlong)(iVar1 + 1)); + } + } + if (((*(uint *)(uVar6 + 0x40) & 1) != 0) && (*(longlong *)(param_1 + 0xc) == 0)) { + piVar4 = *(int **)(uVar6 + 0x48); + *(int **)(param_1 + 0xc) = piVar4; + LOCK(); + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; + UNLOCK(); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,7,(longlong)(iVar1 + 1)); + } + } + if ((((*(uint *)(uVar6 + 0x50) & 1) != 0) && (*(longlong *)(param_1 + 0x10) == 0)) && + (*(ulonglong *)(param_1 + 0x10) = uVar6, param_3 == '\0')) { + piVar4 = (int *)(uVar6 + 4); + LOCK(); + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; + UNLOCK(); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,0x15,(longlong)(iVar1 + 1)); + } + } + if (((*(uint *)(uVar6 + 0x68) & 1) != 0) && (*(longlong *)(param_1 + 0x12) == 0)) { + *(ulonglong *)(param_1 + 0x12) = uVar6; if (param_3 == '\0') { - piVar8 = (int *)(uVar10 + 4); + piVar4 = (int *)(uVar6 + 4); LOCK(); - iVar1 = *piVar8; - *piVar8 = *piVar8 + 1; + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar8,0x15,(longlong)(int)(iVar1 + 1U)); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,0x15,(longlong)(iVar1 + 1)); } } - lVar2 = *(longlong *)(uVar10 + 0x70); + lVar2 = *(longlong *)(uVar6 + 0x70); *(longlong *)(param_1 + 0x1a) = lVar2; - piVar8 = (int *)(lVar2 + 4); - LOCK(); - iVar1 = *piVar8; - *piVar8 = *piVar8 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar8,7,(longlong)(int)(iVar1 + 1U)); - } - } - if ((((*(uint *)(uVar10 + 0x80) & 1) != 0) && (*(longlong *)(param_1 + 0x14) == 0)) && - (*(ulonglong *)(param_1 + 0x14) = uVar10, param_3 == '\0')) { - piVar8 = (int *)(uVar10 + 4); - LOCK(); - iVar1 = *piVar8; - *piVar8 = *piVar8 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar8,0x15,(longlong)(int)(iVar1 + 1U)); - } - } - puVar6 = *(uint **)(uVar10 + 0x108); - if ((puVar6 != (uint *)0x0) && (*(longlong *)(param_1 + 0x1e) == 0)) { - *(uint **)(param_1 + 0x1e) = puVar6; - puVar7 = puVar6 + 1; - param_1[0x1c] = puVar6[6]; - LOCK(); - uVar5 = *puVar7; - *puVar7 = *puVar7 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar5 + 1)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,puVar7,7,(longlong)(int)(uVar5 + 1)); - } - } - uVar5 = *(uint *)(uVar10 + 0x110); - puVar7 = (uint *)(ulonglong)uVar5; - if (((uVar5 & 1) != 0) && (*(char *)(param_1 + 0x20) == '\0')) { - uVar5 = (param_1[0x21] ^ uVar5) & 1 ^ param_1[0x21]; - puVar6 = (uint *)(ulonglong)uVar5; - param_1[0x21] = uVar5; - if (*(short *)(uVar10 + 0x114) != 0) { - *(short *)(param_1 + 0x22) = *(short *)(uVar10 + 0x114); - } - if (*(short *)(uVar10 + 0x116) != 0) { - *(short *)((longlong)param_1 + 0x8a) = *(short *)(uVar10 + 0x116); - } - if (*(short *)(uVar10 + 0x118) != 0) { - *(short *)(param_1 + 0x23) = *(short *)(uVar10 + 0x118); - } - if (*(short *)(uVar10 + 0x11a) != 0) { - *(short *)((longlong)param_1 + 0x8e) = *(short *)(uVar10 + 0x11a); - } - if (*(short *)(uVar10 + 0x11c) != 0) { - *(short *)(param_1 + 0x24) = *(short *)(uVar10 + 0x11c); - } - if (*(int *)(uVar10 + 0x120) != 0) { - param_1[0x25] = *(int *)(uVar10 + 0x120); + piVar4 = (int *)(lVar2 + 4); + LOCK(); + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; + UNLOCK(); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,7,(longlong)(iVar1 + 1)); + } + } + if ((((*(uint *)(uVar6 + 0x80) & 1) != 0) && (*(longlong *)(param_1 + 0x14) == 0)) && + (*(ulonglong *)(param_1 + 0x14) = uVar6, param_3 == '\0')) { + piVar4 = (int *)(uVar6 + 4); + LOCK(); + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; + UNLOCK(); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,0x15,(longlong)(iVar1 + 1)); + } + } + lVar2 = *(longlong *)(uVar6 + 0x108); + if ((lVar2 != 0) && (*(longlong *)(param_1 + 0x1e) == 0)) { + *(longlong *)(param_1 + 0x1e) = lVar2; + piVar4 = (int *)(lVar2 + 4); + param_1[0x1c] = *(undefined4 *)(lVar2 + 0x18); + LOCK(); + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; + UNLOCK(); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,7,(longlong)(iVar1 + 1)); + } + } + if (((*(uint *)(uVar6 + 0x110) & 1) != 0) && (*(char *)(param_1 + 0x20) == '\0')) { + param_1[0x21] = (param_1[0x21] ^ *(uint *)(uVar6 + 0x110)) & 1 ^ param_1[0x21]; + if (*(short *)(uVar6 + 0x114) != 0) { + *(short *)(param_1 + 0x22) = *(short *)(uVar6 + 0x114); + } + if (*(short *)(uVar6 + 0x116) != 0) { + *(short *)((longlong)param_1 + 0x8a) = *(short *)(uVar6 + 0x116); + } + if (*(short *)(uVar6 + 0x118) != 0) { + *(short *)(param_1 + 0x23) = *(short *)(uVar6 + 0x118); + } + if (*(short *)(uVar6 + 0x11a) != 0) { + *(short *)((longlong)param_1 + 0x8e) = *(short *)(uVar6 + 0x11a); + } + if (*(short *)(uVar6 + 0x11c) != 0) { + *(short *)(param_1 + 0x24) = *(short *)(uVar6 + 0x11c); + } + if (*(int *)(uVar6 + 0x120) != 0) { + param_1[0x25] = *(int *)(uVar6 + 0x120); } *(undefined1 *)(param_1 + 0x20) = 1; } - if (((*(uint *)(uVar10 + 0x38) & 1) != 0) && (*(char *)((longlong)param_1 + 0x11) == '\0')) { - param_1[5] = *(undefined4 *)(uVar10 + 0x3c); + if (((*(uint *)(uVar6 + 0x38) & 1) != 0) && (*(char *)((longlong)param_1 + 0x11) == '\0')) { + param_1[5] = *(undefined4 *)(uVar6 + 0x3c); *(undefined1 *)((longlong)param_1 + 0x11) = 1; } - if ((((*(uint *)(uVar10 + 0x1b8) & 1) != 0) && (*(longlong *)(param_1 + 0x18) == 0)) && - (*(ulonglong *)(param_1 + 0x18) = uVar10, param_3 == '\0')) { - puVar7 = (uint *)(uVar10 + 4); - LOCK(); - uVar5 = *puVar7; - *puVar7 = *puVar7 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar5 + 1)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,puVar7,0x15,(longlong)(int)(uVar5 + 1)); - } - } - pwVar9 = (wchar_t *)(uVar10 + 0x130); - if (((*(uint *)pwVar9 & 1) != 0) && (*(char *)(param_1 + 0x3c) == '\0')) { - puVar7 = param_1 + 0x28; + if ((((*(uint *)(uVar6 + 0x1b8) & 1) != 0) && (*(longlong *)(param_1 + 0x18) == 0)) && + (*(ulonglong *)(param_1 + 0x18) = uVar6, param_3 == '\0')) { + piVar4 = (int *)(uVar6 + 4); + LOCK(); + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; + UNLOCK(); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,0x15,(longlong)(iVar1 + 1)); + } + } + pwVar5 = (wchar_t *)(uVar6 + 0x130); + if (((*(uint *)pwVar5 & 1) != 0) && (*(char *)(param_1 + 0x3c) == '\0')) { param_4 = 1; - puVar6 = *(uint **)(*(longlong *)(*(longlong *)(uVar10 + 0x30) + 0x18) + 0x38); - iVar4 = UlCopyAuthConfig((longlong)puVar6,puVar7,(undefined4 *)pwVar9,'\x01', - *(char *)((longlong)param_1 + 0xf2),'\0'); - param_3 = (char)iVar4; - iVar4 = extraout_EAX; - if (extraout_EAX < 0) goto LAB_4; + UlCopyAuthConfig(*(longlong *)(*(longlong *)(*(longlong *)(uVar6 + 0x30) + 0x18) + 0x38), + param_1 + 0x28,(undefined4 *)pwVar5,'\x01', + *(char *)((longlong)param_1 + 0xf2),'\0'); + iVar7 = extraout_EAX_00; + if (extraout_EAX_00 < 0) goto LAB_4; *(undefined1 *)(param_1 + 0x3c) = 1; - *(ulonglong *)(param_1 + 0x3e) = uVar10; + *(ulonglong *)(param_1 + 0x3e) = uVar6; if (param_3 == '\0') { - puVar7 = (uint *)(uVar10 + 4); + piVar4 = (int *)(uVar6 + 4); LOCK(); - uVar5 = *puVar7; - *puVar7 = *puVar7 + 1; + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar5 + 1)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,puVar7,0x15,(longlong)(int)(uVar5 + 1)); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,0x15,(longlong)(iVar1 + 1)); } } } - if (((*(uint *)(uVar10 + 0x180) & 1) != 0) && (*(char *)(param_1 + 0x46) == '\0')) { + if (((*(uint *)(uVar6 + 0x180) & 1) != 0) && (*(char *)(param_1 + 0x46) == '\0')) { UlCleanupChannelBindConfig(param_1 + 0x40); - puVar7 = (uint *)(uVar10 + 0x180); - puVar6 = param_1 + 0x40; - UlCopyChannelBindConfig(puVar6,puVar7); + UlCopyChannelBindConfig(param_1 + 0x40,(uint *)(uVar6 + 0x180)); *(undefined1 *)(param_1 + 0x46) = 1; - *(ulonglong *)(param_1 + 0x48) = uVar10; + *(ulonglong *)(param_1 + 0x48) = uVar6; if (param_3 == '\0') { - puVar7 = (uint *)(uVar10 + 4); + piVar4 = (int *)(uVar6 + 4); LOCK(); - uVar5 = *puVar7; - *puVar7 = *puVar7 + 1; + iVar1 = *piVar4; + *piVar4 = *piVar4 + 1; UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar5 + 1)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,puVar7,0x15,(longlong)(int)(uVar5 + 1)); + if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar4,0x15,(longlong)(iVar1 + 1)); } } } - if (((*(uint *)(uVar10 + 0x1c0) & 1) != 0) && (*(char *)(param_1 + 0x4a) == '\0')) { + if (((*(uint *)(uVar6 + 0x1c0) & 1) != 0) && (*(char *)(param_1 + 0x4a) == '\0')) { *(undefined1 *)(param_1 + 0x4a) = 1; - *(undefined1 *)((longlong)param_1 + 0x129) = *(undefined1 *)(uVar10 + 0x1c4); - } - if (((*(uint *)(uVar10 + 0x1c8) & 1) != 0) && (*(char *)((longlong)param_1 + 0x12a) == '\0')) { + *(undefined1 *)((longlong)param_1 + 0x129) = *(undefined1 *)(uVar6 + 0x1c4); + } + if (((*(uint *)(uVar6 + 0x1c8) & 1) != 0) && (*(char *)((longlong)param_1 + 0x12a) == '\0')) { *(undefined1 *)((longlong)param_1 + 0x12a) = 1; - *(undefined1 *)((longlong)param_1 + 299) = *(undefined1 *)(uVar10 + 0x1cc); + *(undefined1 *)((longlong)param_1 + 299) = *(undefined1 *)(uVar6 + 0x1cc); + } + if (((UxKirBrHttpQuerySocketTtl != '\0') && ((*(uint *)(uVar6 + 0x1d0) & 1) != 0)) && + (*(char *)(param_1 + 0x4b) == '\0')) { + *(undefined1 *)(param_1 + 0x4b) = 1; + *(byte *)((longlong)param_1 + 0x12d) = *(byte *)(uVar6 + 0x1d8) & 1; } if ((DAT_0 & 8) != 0) { - pwVar9 = (wchar_t *)(param_2 + 0x90); + pwVar5 = (wchar_t *)(param_2 + 0x90); if (*(int *)(param_2 + 0x20) == 0) { - iVar4 = FUN_140156b71(puVar6,puVar7,L""); - return iVar4; - } - WPP_SF_Sq(0x89,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,pwVar9); - param_4 = uVar10; - } - if (-1 < iVar4) goto LAB_3; + pwVar5 = L""; + } + WPP_SF_Sq(0x8a,&WPP_2d297478329b39561f77aac2cbbacc14_Traceguids,pwVar5); + param_4 = uVar6; + } + if (-1 < iVar7) goto LAB_3; } LAB_4: - UlCleanupConfigGroupInfo(param_1,1,(undefined4 *)pwVar9,param_4); + UlCleanupConfigGroupInfo(param_1,1,(undefined4 *)pwVar5,param_4); LAB_3: if ((DAT_0 & 8) != 0) { - WPP_SF_L(0x8a,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,iVar4); - } - return iVar4; + WPP_SF_L(0x8b,&WPP_2d297478329b39561f77aac2cbbacc14_Traceguids,iVar7); + } + return iVar7; } ``` ## UlpRejectFlushedRequests ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.37| |i_ratio|0.48| |m_ratio|0.57| |b_ratio|0.57| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpRejectFlushedRequests|UlpRejectFlushedRequests| |fullname|UlpRejectFlushedRequests|UlpRejectFlushedRequests| |refcount|4|4| |`length`|158|435| |`called`|WPP_SF_
WPP_SF_qqLq|
Expand for full list:
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlBugCheckEx
UlSendErrorResponse
UlSetErrorCodeEx
UlpQueueFreeHttpRequest
WPP_SF_
WPP_SF_I
WPP_SF_qqLq
| |calling|UlCleanupConsumerInternal
UlpSetRequestQueueState|UlCleanupConsumerInternal
UlpSetRequestQueueState| |paramcount|4|4| |`address`|140091f8c|140090fe4| |`sig`|ulonglong __fastcall UlpRejectFlushedRequests(longlong * param_1, longlong * param_2, longlong * param_3, longlong * param_4)|ulonglong __fastcall UlpRejectFlushedRequests(undefined8 * * * * * param_1, undefined8 * * * * * param_2, undefined8 * * * * * param_3, undefined8 * * * * * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpRejectFlushedRequests Called Diff ```diff --- UlpRejectFlushedRequests called +++ UlpRejectFlushedRequests called @@ -0,0 +1,8 @@ +NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx +NTOSKRNL.EXE::ExReleasePushLockExclusiveEx +NTOSKRNL.EXE::KeEnterCriticalRegion +NTOSKRNL.EXE::KeLeaveCriticalRegion +UlBugCheckEx +UlSendErrorResponse +UlSetErrorCodeEx +UlpQueueFreeHttpRequest @@ -1,0 +10 @@ +WPP_SF_I ``` ### UlpRejectFlushedRequests Diff ```diff --- UlpRejectFlushedRequests +++ UlpRejectFlushedRequests @@ -1,86 +1,89 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ ulonglong UlpRejectFlushedRequests - (longlong *param_1,longlong *param_2,longlong *param_3,longlong *param_4) + (undefined8 *****param_1,undefined8 *****param_2,undefined8 *****param_3, + undefined8 *****param_4) { undefined8 *****pppppuVar1; - longlong lVar2; - undefined8 ******ppppppuVar3; - code *pcVar4; - uint uVar5; - ulonglong uVar6; - ulonglong uVar7; - longlong *plVar8; - undefined8 *****pppppuVar9; + int iVar2; + undefined8 *****pppppuVar3; + undefined8 ****ppppuVar4; + undefined8 ******ppppppuVar5; + code *pcVar6; + uint uVar7; + ulonglong uVar8; + ulonglong uVar9; + longlong *plVar10; + undefined8 *****pppppuVar11; - uVar6 = (ulonglong)param_3 & 0xffffffff; - pppppuVar9 = (undefined8 *****)param_4; + uVar8 = (ulonglong)param_3 & 0xffffffff; + pppppuVar11 = param_4; if (DAT_0 < '\0') { param_3 = param_1; - pppppuVar9 = (undefined8 *****)param_2; + pppppuVar11 = param_2; WPP_SF_qqLq(0x62,&WPP_cd24b3c83bd136dba6063467bea0efde_Traceguids,param_1,param_2); } while( true ) { - plVar8 = (longlong *)*param_2; - if (plVar8 == param_2) { - uVar6 = CONCAT71((int7)((ulonglong)plVar8 >> 8),DAT_0); + pppppuVar3 = (undefined8 *****)*param_2; + if (pppppuVar3 == param_2) { + uVar8 = CONCAT71((int7)((ulonglong)pppppuVar3 >> 8),DAT_0); if (DAT_0 < '\0') { - uVar6 = WPP_SF_(100,&WPP_cd24b3c83bd136dba6063467bea0efde_Traceguids,param_3,pppppuVar9); + uVar8 = WPP_SF_(100,&WPP_cd24b3c83bd136dba6063467bea0efde_Traceguids,param_3,pppppuVar11); } - return uVar6; + return uVar8; } - if (((longlong *)plVar8[1] != param_2) || (lVar2 = *plVar8, *(longlong **)(lVar2 + 8) != plVar8) - ) break; - *param_2 = lVar2; - pppppuVar1 = (undefined8 *****)(plVar8 + -0xdf); - *(longlong **)(lVar2 + 8) = param_2; - *plVar8 = 0; - plVar8[1] = 0; - ppppppuVar3 = (undefined8 ******)plVar8[-0xdc]; + if (((undefined8 *****)pppppuVar3[1] != param_2) || + (ppppuVar4 = *pppppuVar3, (undefined8 *****)ppppuVar4[1] != pppppuVar3)) break; + *param_2 = ppppuVar4; + pppppuVar1 = pppppuVar3 + -0xdf; + ppppuVar4[1] = param_2; + *pppppuVar3 = (undefined8 ****)0x0; + pppppuVar3[1] = (undefined8 ****)0x0; + ppppppuVar5 = (undefined8 ******)pppppuVar3[-0xdc]; if ((DAT_1 & 0x20) != 0) { - param_3 = (longlong *)pppppuVar1; + param_3 = pppppuVar1; WPP_SF_I(99,&WPP_cd24b3c83bd136dba6063467bea0efde_Traceguids,pppppuVar1); } KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(ppppppuVar3 + 0x48,0); - if (((ulonglong)ppppppuVar3[0x4f] & 2) == 0) { - pppppuVar9 = (undefined8 *****)0x0; - uVar7 = uVar6; + ExAcquirePushLockExclusiveEx(ppppppuVar5 + 0x48,0); + if (((ulonglong)ppppppuVar5[0x4f] & 2) == 0) { + pppppuVar11 = (undefined8 *****)0x0; + uVar9 = uVar8; param_3 = param_1; - UlSetErrorCodeEx((longlong *)pppppuVar1,uVar6,param_1,0,"",0xd,(longlong)param_4) - ; - UlSendErrorResponse(ppppppuVar3,uVar7,param_3,pppppuVar9); + UlSetErrorCodeEx((longlong *)pppppuVar1,uVar8,(longlong *)param_1,0,"",0xd, + (longlong)param_4); + UlSendErrorResponse(ppppppuVar5,uVar9,param_3,pppppuVar11); } - ExReleasePushLockExclusiveEx(ppppppuVar3 + 0x48,0); + ExReleasePushLockExclusiveEx(ppppppuVar5 + 0x48,0); KeLeaveCriticalRegion(); - plVar8 = plVar8 + -0xd9; + pppppuVar3 = pppppuVar3 + -0xd9; LOCK(); - lVar2 = *plVar8; - *(int *)plVar8 = (int)*plVar8 + -1; + iVar2 = *(int *)pppppuVar3; + *(int *)pppppuVar3 = *(int *)pppppuVar3 + -1; UNLOCK(); - uVar5 = (int)lVar2 - 1; - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar5)) { + uVar7 = iVar2 - 1; + if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar7)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,plVar8,10,(longlong)(int)uVar5); + UlBugCheckEx(3,pppppuVar3,10,(longlong)(int)uVar7); } - if (uVar5 == 0) { - UlpQueueFreeHttpRequest(pppppuVar1,(undefined *)plVar8,(undefined8 *****)param_3,pppppuVar9); + if (uVar7 == 0) { + UlpQueueFreeHttpRequest(pppppuVar1,(undefined *)pppppuVar3,param_3,pppppuVar11); } } - pcVar4 = (code *)swi(0x29); - (*pcVar4)(3); + pcVar6 = (code *)swi(0x29); + (*pcVar6)(3); WPP_SF_iq(0xe0,&WPP_780cdd74485c37e8c461e99f13d7d8d0_Traceguids,param_2,0); - uVar6 = 0; - plVar8 = (longlong *)0x0; - uVar5 = (**(code **)(param_2[0x3f] + 0x78))(param_2[0x3e],0,0,0,0,0,0); - if ((int)uVar5 < 0) { - UlCloseConnection(param_2,'\x01',plVar8,uVar6); + uVar8 = 0; + plVar10 = (longlong *)0x0; + uVar7 = (*(code *)param_2[0x3f][0xf])(param_2[0x3e],0,0,0,0,0,0); + if ((int)uVar7 < 0) { + UlCloseConnection((longlong *)param_2,'\x01',plVar10,uVar8); } if (DAT_0 < '\0') { - WPP_SF_L(0xe1,&WPP_780cdd74485c37e8c461e99f13d7d8d0_Traceguids,uVar5); + WPP_SF_L(0xe1,&WPP_780cdd74485c37e8c461e99f13d7d8d0_Traceguids,uVar7); } - return (ulonglong)uVar5; + return (ulonglong)uVar7; } ``` ## UxTlGetTcpInitialPacketTtl ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.67| |i_ratio|0.73| |m_ratio|0.98| |b_ratio|0.81| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxTlGetTcpInitialPacketTtl|UxTlGetTcpInitialPacketTtl| |fullname|UxTlGetTcpInitialPacketTtl|UxTlGetTcpInitialPacketTtl| |refcount|2|2| |`length`|301|314| |called|NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::IoAllocateIrp
NTOSKRNL.EXE::IoFreeIrp
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UxpWskControlSocket|NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::IoAllocateIrp
NTOSKRNL.EXE::IoFreeIrp
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UxpWskControlSocket| |calling|UxTlConnectionControl|UxTlConnectionControl| |paramcount|1|1| |`address`|140135b68|140136328| |`sig`|int __fastcall UxTlGetTcpInitialPacketTtl(longlong param_1)|undefined8 __fastcall UxTlGetTcpInitialPacketTtl(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxTlGetTcpInitialPacketTtl Diff ```diff --- UxTlGetTcpInitialPacketTtl +++ UxTlGetTcpInitialPacketTtl @@ -1,35 +1,37 @@ -int UxTlGetTcpInitialPacketTtl(longlong param_1) +undefined8 UxTlGetTcpInitialPacketTtl(longlong param_1) { int iVar1; longlong lVar2; + undefined8 uVar3; undefined1 local_res8 [8]; - iVar1 = 0; + uVar3 = 0; local_res8[0] = 0; - if (*(char *)(param_1 + 0x195) == '\0') { + if (*(char *)(param_1 + 0x196) == '\0') { lVar2 = IoAllocateIrp(1,0); if (lVar2 == 0) { - iVar1 = -0x3fffff66; + uVar3 = 0xc000009a; } else { iVar1 = UxpWskControlSocket(*(undefined8 **)(param_1 + 0x50),1,0x3010,0xffff,0,0,1,local_res8, lVar2,'\x01',(longlong *)(param_1 + 0x278), (longlong *)(param_1 + 0x280)); - if (-1 < iVar1) { - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_1 + 0xe8,0); - if (*(char *)(param_1 + 0x195) == '\0') { + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(param_1 + 0xe8,0); + if (*(char *)(param_1 + 0x196) == '\0') { + if (iVar1 == 0) { *(undefined1 *)(param_1 + 0x194) = local_res8[0]; *(undefined1 *)(param_1 + 0x195) = 1; } - ExReleasePushLockExclusiveEx(param_1 + 0xe8,0); - KeLeaveCriticalRegion(); + *(undefined1 *)(param_1 + 0x196) = 1; } + ExReleasePushLockExclusiveEx(param_1 + 0xe8,0); + KeLeaveCriticalRegion(); IoFreeIrp(lVar2); } } - return iVar1; + return uVar3; } ``` ## UxSslConnectionControl ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,calling| |ratio|0.97| |i_ratio|0.83| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxSslConnectionControl|UxSslConnectionControl| |fullname|UxSslConnectionControl|UxSslConnectionControl| |refcount|134|134| |`length`|1195|1179| |called|
Expand for full list:
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlpQueryChannelBindTokenFromConnection
UxSslGetAltSvcInfo
UxSslGetCertInfo
UxSslGetProperties
UxSslGetTlsCipherInfo
UxSslGetTlsClientHello
UxSslGetTokenBindingUxSslRetrieveChannelBindingToken
UxSslRetrieveClientCertificate
UxSslSetTokenBinding
UxSslVerifyRequestHost
UxpSslGetHandshakeSizes
UxpSslGetHandshakeTiming
UxpSslQuerySni
WPP_SF_L
WPP_SF_qLqqqq
_guard_dispatch_icall
|
Expand for full list:
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlpQueryChannelBindTokenFromConnection
UxSslGetAltSvcInfo
UxSslGetCertInfo
UxSslGetProperties
UxSslGetTlsCipherInfo
UxSslGetTlsClientHello
UxSslGetTokenBindingUxSslRetrieveChannelBindingToken
UxSslRetrieveClientCertificate
UxSslSetTokenBinding
UxSslVerifyRequestHost
UxpSslGetHandshakeSizes
UxpSslGetHandshakeTiming
UxpSslQuerySni
WPP_SF_L
WPP_SF_qLqqqq
_guard_dispatch_icall
| |`calling`|
Expand for full list:
FUN_14015b26a
FUN_1401618f2
UcCreateClientStreamIoctl
UcQueryClientStreamProperty
UlCheckRawResponseCompatibility
UlConnectionCleanupWorker
UlDeclarePushIoctl
UlGetQuicCreationStatsV2Size
UlGetTransportIdleConnectionTimeout
UlHttpReceiveHeadersEvent
UlParsePushHeaderPairsUlParsePushHeaderPairsOld
UlParseRequestHeaderPairs
UlParseRequestHeaderPairsOld
UlQueryChannelBindToken
UlReceiveClientCertIoctl
UlSendCachedResponse
UlSetHttpConnectionTokenBinding
UlSetTransportIdleConnectionTimeout
UlpCompleteLogRecordW3C
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestToBuffer
UlpCopySslProtocolInfo
UlpCopyTcpInfoV2
UlpDeliverRequestStagePolicies
UlpHkeAcquireQoS
UlpInitErrorLogInfo
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpLogErrorResposeSendEvent
UxDuoAttachConnection
UxDuoExecuteDetach
UxDuoExecuteIoReady
UxDuoExecuteRetrieveClientCert
UxDuoSetTokenBinding
UxSslAttachConnection
UxpTpSetFlowOnConnection
switchD_140150f8e::caseD_b
|
Expand for full list:
FUN_14015b0f0
FUN_140161bde
UcCreateClientStreamIoctl
UcQueryClientStreamProperty
UlCheckRawResponseCompatibility
UlConnectionCleanupWorker
UlDeclarePushIoctl
UlGetQuicCreationStatsV2Size
UlGetTransportIdleConnectionTimeout
UlHttpReceiveHeadersEvent
UlParsePushHeaderPairsUlParsePushHeaderPairsOld
UlParseRequestHeaderPairs
UlParseRequestHeaderPairsOld
UlQueryChannelBindToken
UlReceiveClientCertIoctl
UlSendCachedResponse
UlSetHttpConnectionTokenBinding
UlSetTransportIdleConnectionTimeout
UlpCompleteLogRecordW3C
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestToBuffer
UlpCopySslProtocolInfo
UlpCopyTcpInfoV2
UlpDeliverRequestStagePolicies
UlpHkeAcquireQoS
UlpInitErrorLogInfo
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpLogErrorResposeSendEvent
UxDuoAttachConnection
UxDuoExecuteDetach
UxDuoExecuteIoReady
UxDuoExecuteRetrieveClientCert
UxDuoSetTokenBinding
UxSslAttachConnection
UxpTpSetFlowOnConnection
switchD_1401516fa::caseD_b
| |paramcount|6|6| |address|140003870|140003870| |sig|int __fastcall UxSslConnectionControl(uint * * * * param_1, uint param_2, uint * * * * param_3, uint * * * * param_4, uint * param_5, undefined8 param_6)|int __fastcall UxSslConnectionControl(uint * * * * param_1, uint param_2, uint * * * * param_3, uint * * * * param_4, uint * param_5, undefined8 param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxSslConnectionControl Calling Diff ```diff --- UxSslConnectionControl calling +++ UxSslConnectionControl calling @@ -1,2 +1,2 @@ -FUN_14015b26a -FUN_1401618f2 +FUN_14015b0f0 +FUN_140161bde @@ -39 +39 @@ -switchD_140150f8e::caseD_b +switchD_1401516fa::caseD_b ``` ### UxSslConnectionControl Diff ```diff --- UxSslConnectionControl +++ UxSslConnectionControl @@ -1,214 +1,209 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ int UxSslConnectionControl (uint ****param_1,uint param_2,uint ****param_3,uint ****param_4,uint *param_5, undefined8 param_6) { int iVar1; undefined8 uVar2; ulonglong uVar3; uint ***pppuVar4; byte bVar5; undefined4 uVar6; uint uVar7; uint ****ppppuVar8; uint ****ppppuVar9; undefined1 uVar10; iVar1 = 0; ppppuVar8 = param_3; ppppuVar9 = param_4; if ((DAT_0 & 1) != 0) { ppppuVar9 = (uint ****)(ulonglong)param_2; ppppuVar8 = param_1; - WPP_SF_qLqqqq(0x20,&WPP_575742ddbbd13d10dc502caa156c9542_Traceguids,param_1,param_2); + WPP_SF_qLqqqq(0x20,&WPP_140e93474bd536143d6c6d1c49fd7e6e_Traceguids,param_1,param_2); } uVar7 = (uint)param_4; if ((int)param_2 < 0x26) { if (param_2 == 0x25) { iVar1 = UxSslGetCertInfo((longlong)(param_1 + 0x39),(longlong)param_1[0x36], (uint *)(param_1 + 0x94),(longlong *)param_3); goto LAB_1; } if ((int)param_2 < 0x15) { if (param_2 == 0x14) { uVar3 = UxSslSetTokenBinding((longlong)param_1,(longlong)param_3,uVar7); iVar1 = (int)uVar3; goto LAB_1; } if (param_2 == 6) { *(undefined1 *)param_3 = 1; goto LAB_1; } if (param_2 == 0xe) { uVar2 = UxSslGetProperties((longlong)param_1,param_3,(longlong)ppppuVar8,ppppuVar9); iVar1 = (int)uVar2; goto LAB_1; } if (param_2 == 0xf) { KeEnterCriticalRegion(); ExAcquirePushLockSharedEx(param_1 + 0x1a,0); *(byte *)param_3 = (byte)(*(uint *)(param_1 + 0x94) >> 3) & 1; ExReleasePushLockSharedEx(param_1 + 0x1a,0); KeLeaveCriticalRegion(); goto LAB_1; } if ((param_2 == 0x10) || (param_2 == 0x11)) { iVar1 = UxSslRetrieveClientCertificate (param_1,param_3, (uint ****)CONCAT71((int7)((ulonglong)ppppuVar8 >> 8),param_2 == 0x11), ppppuVar9); goto LAB_1; } if (param_2 == 0x12) { iVar1 = UxSslRetrieveChannelBindingToken (param_1,(longlong)param_3,ppppuVar8,(longlong)ppppuVar9); goto LAB_1; } if (param_2 == 0x13) { uVar2 = UxSslGetTokenBinding ((longlong)param_1,(longlong *)param_3,(longlong)ppppuVar8, (longlong *)ppppuVar9); iVar1 = (int)uVar2; goto LAB_1; } goto LAB_2; } if (param_2 == 0x15) { uVar10 = *(undefined1 *)(param_1 + 0x31); goto LAB_3; } if (param_2 != 0x16) { if (param_2 == 0x1d) { uVar6 = *(undefined4 *)(param_1[0x36] + 0x58); goto LAB_4; } if (param_2 == 0x1e) { UxpSslGetHandshakeTiming ((longlong)param_1,(longlong)param_3,(longlong)ppppuVar8,(longlong)ppppuVar9); } else { if (param_2 != 0x1f) { if (param_2 == 0x22) { uVar10 = *(undefined1 *)((longlong)param_1 + 0x714); } else { if (param_2 != 0x23) goto LAB_2; uVar10 = *(undefined1 *)(param_1 + 0x93); } LAB_3: *(undefined1 *)param_3 = uVar10; goto LAB_1; } UxpSslGetHandshakeSizes ((longlong)param_1,(ulonglong *)param_3,(longlong)ppppuVar8,(ulonglong *)ppppuVar9 ); } LAB_2: if ((DAT_5 & 1) != 0) { WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,param_1 + 6,param_2); } iVar1 = (*(code *)param_1[7][0x11])(param_1[6],param_2,param_3,param_4,param_5,param_6); if ((DAT_5 & 1) != 0) { WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,iVar1); } goto LAB_1; } bVar5 = *(byte *)(param_1[0x36] + 99); } else { if (0x3a < (int)param_2) { if (param_2 == 0x45) { uVar3 = UxSslGetTlsClientHello ((longlong)param_1[0xd4],(longlong)param_1[0x36], *(char *)((longlong)param_1 + 0x634),param_1[0xc5], *(uint *)(param_1 + 0xc6),param_3,uVar7,param_5); iVar1 = (int)uVar3; goto LAB_1; } if (param_2 == 0x46) { - if (UxKirSeHttpQueryCryptoParams == '\0') { - iVar1 = -0x3ffffffe; - } - else { - iVar1 = UxSslGetTlsCipherInfo(param_1 + 0x3e,param_3,uVar7,param_5); - } + iVar1 = UxSslGetTlsCipherInfo(param_1 + 0x3e,param_3,uVar7,param_5); goto LAB_1; } goto LAB_2; } if (param_2 == 0x3a) { uVar6 = *(undefined4 *)((longlong)param_1[0x36] + 0x324); LAB_4: *(undefined4 *)param_3 = uVar6; goto LAB_1; } if ((int)param_2 < 0x2d) { if (param_2 == 0x2c) { *(undefined4 *)param_3 = *(undefined4 *)((longlong)param_1[0x36] + 0x2c4); *(undefined4 *)param_4 = *(undefined4 *)(param_1[0x36] + 0x59); goto LAB_1; } if (param_2 == 0x26) { pppuVar4 = (uint ***)param_1[0x36][0x5d]; *param_3 = (uint ***)param_1[0x36][0x5c]; param_3[1] = pppuVar4; goto LAB_1; } if (param_2 == 0x27) { bVar5 = (byte)(*(uint *)(param_1[0x36] + 0x56) >> 0xd); } else { if (param_2 == 0x28) { uVar10 = param_1[0xa0] != (uint ***)0x0; goto LAB_3; } if (param_2 == 0x29) { pppuVar4 = (uint ***)UlpQueryChannelBindTokenFromConnection((longlong)param_1); *param_3 = pppuVar4; goto LAB_1; } if (param_2 == 0x2a) { iVar1 = UxSslVerifyRequestHost(param_3,(ushort)param_4,(longlong)param_1); goto LAB_1; } if (param_2 != 0x2b) goto LAB_2; bVar5 = (byte)(*(uint *)(param_1[0x36] + 0x56) >> 9); } } else { if (param_2 != 0x2d) { if (param_2 == 0x2e) { uVar6 = *(undefined4 *)((longlong)param_1[0x36] + 0x31c); } else { if (param_2 != 0x2f) { if (param_2 == 0x32) { iVar1 = UxSslGetAltSvcInfo(param_3,(longlong)param_1); goto LAB_1; } if (param_2 == 0x35) { uVar3 = UxpSslQuerySni((longlong)param_1,param_3); iVar1 = (int)uVar3; goto LAB_1; } goto LAB_2; } uVar6 = *(undefined4 *)(param_1[0x36] + 100); } goto LAB_4; } bVar5 = (byte)((ulonglong)param_1[0x36][0x62] >> 0x3c); } bVar5 = bVar5 & 1; } *(byte *)param_3 = bVar5; LAB_1: if ((DAT_0 & 1) != 0) { - WPP_SF_L(0x21,&WPP_575742ddbbd13d10dc502caa156c9542_Traceguids,iVar1); + WPP_SF_L(0x21,&WPP_140e93474bd536143d6c6d1c49fd7e6e_Traceguids,iVar1); } return iVar1; } ``` ## UlSetConfigGroupProperty ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.38| |i_ratio|0.53| |m_ratio|0.96| |b_ratio|0.48| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlSetConfigGroupProperty|UlSetConfigGroupProperty| |fullname|UlSetConfigGroupProperty|UlSetConfigGroupProperty| |refcount|2|2| |`length`|1748|1914| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExAcquireCacheAwarePushLockExclusive
NTOSKRNL.EXE::ExReleaseCacheAwarePushLockExclusive
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlBugCheckEx
UlCaptureChannelBindConfig
UlCaptureQosParameter
UlConfigLogging
UlCopyAuthConfig
UlEventSetConfigGroupPropertyUlFlushCacheByConfigGroup
UlFreeAuthConfig
UlFreeConfigGroup
UlFreeRequestQueue
UlQosConfigureFlowCharacteristics
UlReferenceRequestQueueByHandle
UlScStartCounters
UlSetConnectionsProperty
UlVerifyAuthConfig
UlpNotifyEdgePolicyChange
UxGetObjectFromOpaqueId
WPP_SF_L
WPP_SF_Ll
WPP_SF_ill
WPP_SF_qqiLqL
__security_check_cookie
memset
|
Expand for full list:
NTOSKRNL.EXE::ExAcquireCacheAwarePushLockExclusive
NTOSKRNL.EXE::ExReleaseCacheAwarePushLockExclusive
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlBugCheckEx
UlCaptureChannelBindConfig
UlCaptureQosParameter
UlConfigLogging
UlCopyAuthConfig
UlEventSetConfigGroupPropertyUlFlushCacheByConfigGroup
UlFreeAuthConfig
UlFreeConfigGroup
UlFreeRequestQueue
UlQosConfigureFlowCharacteristics
UlReferenceRequestQueueByHandle
UlScStartCounters
UlSetConnectionsProperty
UlVerifyAuthConfig
UlpNotifyEdgePolicyChange
UxGetObjectFromOpaqueId
WPP_SF_L
WPP_SF_Ll
WPP_SF_ili
WPP_SF_ill
WPP_SF_qqiLqL
__security_check_cookie
memset
| |calling|UlSetUrlGroupIoctl|UlSetUrlGroupIoctl| |paramcount|6|6| |`address`|14008f5d4|140097064| |sig|undefined8 * * * * * * __fastcall UlSetConfigGroupProperty(undefined8 * * * * * param_1, longlong param_2, undefined8 * * * * * * param_3, uint param_4, ulonglong * param_5, uint param_6)|undefined8 * * * * * * __fastcall UlSetConfigGroupProperty(undefined8 * * * * * param_1, longlong param_2, undefined8 * * * * * * param_3, uint param_4, ulonglong * param_5, uint param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlSetConfigGroupProperty Called Diff ```diff --- UlSetConfigGroupProperty called +++ UlSetConfigGroupProperty called @@ -24,0 +25 @@ +WPP_SF_ili ``` ### UlSetConfigGroupProperty Diff ```diff --- UlSetConfigGroupProperty +++ UlSetConfigGroupProperty @@ -1,380 +1,397 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined8 ****** UlSetConfigGroupProperty (undefined8 *****param_1,longlong param_2,undefined8 ******param_3,uint param_4, ulonglong *param_5,uint param_6) { int *piVar1; undefined2 uVar2; longlong lVar3; char cVar4; undefined1 uVar5; undefined4 uVar6; uint extraout_EAX; - uint uVar7; + int iVar7; undefined8 ******ppppppuVar8; - ulonglong uVar9; - undefined8 uVar10; - undefined8 *****pppppuVar11; - ulonglong uVar12; + undefined8 uVar9; + undefined8 *****pppppuVar10; + uint uVar11; + undefined8 ******ppppppuVar12; undefined8 ******ppppppuVar13; - undefined8 ******ppppppuVar14; + short sVar14; undefined8 ******ppppppuVar15; undefined8 ******ppppppuVar16; - short sVar17; - int iVar18; - undefined8 ******ppppppuVar19; - code *pcVar20; - code *pcVar21; + code *pcVar17; + ulonglong uVar18; + code *pcVar19; + ulonglong uVar20; + ulonglong uVar21; undefined1 auStackY_118 [32]; - undefined8 ******local_d0; - undefined4 local_c8; undefined8 ******local_c0; - longlong local_b8; + undefined4 local_b8; + undefined8 ******local_b0; undefined1 local_a8 [8]; undefined8 uStack_a0; undefined4 local_98; ulonglong local_90; undefined2 local_88; ulonglong local_80; undefined2 local_78; ulonglong local_70; undefined8 local_68; undefined8 uStack_60; ulonglong local_58; local_58 = __security_cookie ^ (ulonglong)auStackY_118; ppppppuVar16 = (undefined8 ******)0x0; - local_d0 = (undefined8 ******)0x0; - ppppppuVar19 = (undefined8 ******)0x0; - uVar9 = 1; - local_c0 = param_3; - local_b8 = param_2; + local_c0 = (undefined8 ******)0x0; + ppppppuVar15 = (undefined8 ******)0x0; + uVar21 = 1; + local_b0 = param_3; memset(local_a8,0,0x50); if ((DAT_0 & 8) != 0) { - WPP_SF_qqiLqL(0x7c,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,param_1,param_2); + WPP_SF_qqiLqL(0x7c,&WPP_2d297478329b39561f77aac2cbbacc14_Traceguids,param_1,param_2); } lVar3 = *(longlong *)(param_2 + 0x38); KeEnterCriticalRegion(); ExAcquireCacheAwarePushLockExclusive(*(undefined8 *)(lVar3 + 0x558)); - pcVar21 = UlValidateConfigGroup; - pcVar20 = UxDuoReferenceConnectionFromId; - ppppppuVar14 = local_c0; + pcVar19 = UlValidateConfigGroup; + pcVar17 = UxDuoReferenceConnectionFromId; + ppppppuVar12 = local_b0; ppppppuVar8 = (undefined8 ******) UxGetObjectFromOpaqueId - ((ulonglong)local_c0,(undefined *)0x2,UxDuoReferenceConnectionFromId, + ((ulonglong)local_b0,(undefined *)0x2,UxDuoReferenceConnectionFromId, UlValidateConfigGroup,param_2); - ppppppuVar15 = (undefined8 ******)0x0; + ppppppuVar13 = (undefined8 ******)0x0; if ((ppppppuVar8 == (undefined8 ******)0x0) || (*(int *)ppppppuVar8 != 0x4a436c55)) { - ppppppuVar19 = (undefined8 ******)0xc000000d; + ppppppuVar16 = (undefined8 ******)0xc000000d; LAB_1: if (param_4 != 2) goto LAB_2; } else { - local_c8 = *(undefined4 *)(ppppppuVar8[6] + 2); - sVar17 = (short)local_c8; - if ((sVar17 == 1) && ((short)((uint)local_c8 >> 0x10) == 0)) { - ppppppuVar19 = (undefined8 ******)0xc00000bb; + local_b8 = *(undefined4 *)(ppppppuVar8[6] + 2); + sVar14 = (short)local_b8; + if ((sVar14 == 1) && ((short)((uint)local_b8 >> 0x10) == 0)) { + ppppppuVar16 = (undefined8 ******)0xc00000bb; goto LAB_1; } + uVar20 = (ulonglong)param_4; if (9 < (int)param_4) { if (param_4 == 10) { - ppppppuVar14 = *(undefined8 *******)(local_b8 + 0x38); - uVar7 = UlCaptureChannelBindConfig - ((longlong)ppppppuVar14,(undefined4 *)param_5,(uint *)(ppppppuVar8 + 0x30) - ,param_1,*(char *)(param_1 + 8)); - } - else if (param_4 == 0xb) { - local_a8 = (undefined1 [8])*param_5; - ppppppuVar14 = ppppppuVar8; - uVar12 = UlpNotifyEdgePolicyChange((longlong)ppppppuVar8,(uint *)local_a8,pcVar20,pcVar21); - uVar7 = (uint)uVar12; + ppppppuVar12 = *(undefined8 *******)(param_2 + 0x38); + uVar11 = UlCaptureChannelBindConfig + ((longlong)ppppppuVar12,(undefined4 *)param_5, + (uint *)(ppppppuVar8 + 0x30),param_1,*(char *)(param_1 + 8)); +LAB_3: + ppppppuVar16 = (undefined8 ******)(ulonglong)uVar11; } else { - if (param_4 != 0xc) { - if (param_4 == 0xf) { - local_a8 = (undefined1 [8])*param_5; - ppppppuVar14 = (undefined8 ******)((ulonglong)local_a8 >> 0x20); - if (1 < (byte)((ulonglong)local_a8 >> 0x20)) goto LAB_3; - ppppppuVar8[0x38] = (undefined8 *****)local_a8; - if ((DAT_0 & 8) != 0) { - ppppppuVar14 = (undefined8 ******)0x7d; -LAB_4: - WPP_SF_ill((short)ppppppuVar14,(ulonglong)local_a8 >> 0x20 & 0xff,ppppppuVar8[1], - local_a8._0_4_ & 1); - } - } - else { - uVar7 = param_4 - 0x10; - ppppppuVar14 = (undefined8 ******)(ulonglong)uVar7; - if (uVar7 == 0) { + if (param_4 == 0xb) { + local_a8 = (undefined1 [8])*param_5; + ppppppuVar12 = ppppppuVar8; + uVar20 = UlpNotifyEdgePolicyChange((longlong)ppppppuVar8,(uint *)local_a8,pcVar17,0xb); + uVar11 = (uint)uVar20; + } + else { + if (param_4 != 0xc) { + if (param_4 == 0xf) { + local_a8 = (undefined1 [8])*param_5; + ppppppuVar12 = (undefined8 ******)((ulonglong)local_a8 >> 0x20); + if (1 < (byte)((ulonglong)local_a8 >> 0x20)) goto LAB_4; + ppppppuVar8[0x38] = (undefined8 *****)local_a8; + ppppppuVar16 = ppppppuVar15; + if ((DAT_0 & 8) != 0) { + ppppppuVar12 = (undefined8 ******)0x7d; LAB_5: - uVar9 = 0; + WPP_SF_ill((short)ppppppuVar12,(ulonglong)local_a8 >> 0x20 & 0xff,ppppppuVar8[1], + local_a8._0_4_ & 1); + ppppppuVar16 = ppppppuVar15; + } + } + else if (param_4 == 0x10) { + uVar21 = 0; + ppppppuVar12 = (undefined8 ******)0x0; + ppppppuVar16 = ppppppuVar15; } else { - if (uVar7 == 2) { + uVar11 = param_4 - 0x12; + ppppppuVar12 = (undefined8 ******)(ulonglong)uVar11; + if (uVar11 == 0) { local_a8 = (undefined1 [8])*param_5; - ppppppuVar14 = (undefined8 ******)((ulonglong)local_a8 >> 0x20); - if ((byte)((ulonglong)local_a8 >> 0x20) < 2) { - ppppppuVar8[0x39] = (undefined8 *****)local_a8; - if ((DAT_0 & 8) != 0) { - ppppppuVar14 = (undefined8 ******)0x7e; - goto LAB_4; - } - goto LAB_6; + ppppppuVar12 = (undefined8 ******)((ulonglong)local_a8 >> 0x20); + if (1 < (byte)((ulonglong)local_a8 >> 0x20)) goto LAB_4; + ppppppuVar8[0x39] = (undefined8 *****)local_a8; + ppppppuVar16 = ppppppuVar15; + if ((DAT_0 & 8) != 0) { + ppppppuVar12 = (undefined8 ******)0x7e; + goto LAB_5; } } -LAB_3: - ppppppuVar19 = (undefined8 ******)0xc000000d; - } - } - goto LAB_6; - } - local_a8 = (undefined1 [8])*param_5; - ppppppuVar14 = ppppppuVar8; - uVar7 = UlScStartCounters((longlong)ppppppuVar8,(undefined8 *)local_a8); - } -LAB_7: - ppppppuVar19 = (undefined8 ******)(ulonglong)uVar7; + else { + if ((uVar11 != 1) || (UxKirBrHttpQuerySocketTtl == '\0')) goto LAB_4; + local_a8 = (undefined1 [8])*param_5; + uStack_a0 = (undefined8 ******)param_5[1]; + ppppppuVar8[0x3a] = (undefined8 *****)local_a8; + ppppppuVar8[0x3b] = uStack_a0; + if ((DAT_0 & 8) != 0) { + WPP_SF_ili(1,0,ppppppuVar8[1],local_a8._0_4_ & 1); + } + } + } + goto LAB_6; + } + local_a8 = (undefined1 [8])*param_5; + ppppppuVar12 = ppppppuVar8; + uVar11 = UlScStartCounters((longlong)ppppppuVar8,(undefined8 *)local_a8); + } + ppppppuVar16 = (undefined8 ******)(ulonglong)uVar11; + } LAB_6: - iVar18 = (int)ppppppuVar19; - pcVar20 = (code *)(ulonglong)param_4; - ppppppuVar16 = local_c0; - pcVar21 = (code *)ppppppuVar19; - UlEventSetConfigGroupProperty(ppppppuVar14,local_c0,param_4,iVar18,(longlong)param_1); + iVar7 = (int)ppppppuVar16; + pcVar17 = (code *)(ulonglong)param_4; + ppppppuVar15 = local_b0; + pcVar19 = (code *)ppppppuVar16; + UlEventSetConfigGroupProperty(ppppppuVar12,local_b0,param_4,iVar7,(longlong)param_1); if ((DAT_0 & 8) != 0) { - ppppppuVar16 = (undefined8 ******)&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids; - pcVar21 = (code *)(ulonglong)param_4; - pcVar20 = (code *)ppppppuVar19; - WPP_SF_Ll(0x7f,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,iVar18,param_4); - } - if ((-1 < iVar18) && ((char)uVar9 != '\0')) { + ppppppuVar15 = (undefined8 ******)&WPP_2d297478329b39561f77aac2cbbacc14_Traceguids; + pcVar19 = (code *)(ulonglong)param_4; + pcVar17 = (code *)ppppppuVar16; + WPP_SF_Ll(0x80,&WPP_2d297478329b39561f77aac2cbbacc14_Traceguids,iVar7,param_4); + } + if ((-1 < iVar7) && ((char)uVar21 != '\0')) { UlFlushCacheByConfigGroup - (ppppppuVar8,ppppppuVar16,(undefined8 *****)pcVar20,(undefined8 ****)pcVar21); + (ppppppuVar8,ppppppuVar15,(undefined8 *****)pcVar17,(undefined8 ****)pcVar19); } goto LAB_1; } if (param_4 == 9) { local_a8 = (undefined1 [8])*param_5; - pppppuVar11 = (undefined8 *****)local_a8; + pppppuVar10 = (undefined8 *****)local_a8; if (((ulonglong)local_a8 & 1) == 0) { - pppppuVar11 = (undefined8 *****)0x0; - } - *(undefined8 ******)((longlong)ppppppuVar8 + 0x124) = pppppuVar11; + pppppuVar10 = (undefined8 *****)0x0; + } + *(undefined8 ******)((longlong)ppppppuVar8 + 0x124) = pppppuVar10; + ppppppuVar16 = ppppppuVar15; goto LAB_6; } if (param_4 == 0) { -LAB_8: +LAB_7: cVar4 = IoIs32bitProcess(param_1); - uVar12 = *param_5; + uVar20 = *param_5; local_a8 = (undefined1 [8])*param_5; if (cVar4 == '\0') { local_80 = param_5[5]; local_88 = (undefined2)param_5[4]; local_90 = param_5[3]; uVar2 = (undefined2)param_5[2]; local_70 = param_5[7]; local_78 = (undefined2)param_5[6]; } else { local_80 = (ulonglong)(uint)param_5[3]; local_88 = *(undefined2 *)((longlong)param_5 + 0x14); local_90 = (ulonglong)(uint)param_5[2]; uVar2 = *(undefined2 *)((longlong)param_5 + 0xc); local_70 = (ulonglong)(uint)param_5[4]; local_78 = *(undefined2 *)((longlong)param_5 + 0x1c); } local_98 = CONCAT22(local_98._2_2_,uVar2); uVar5 = *(undefined1 *)((longlong)param_5 + 0xb); if (param_4 != 8) { uVar5 = 0; } local_68 = 0; uStack_60 = 0; uStack_a0._0_4_ = CONCAT13(uVar5,(int3)param_5[1]); - ppppppuVar16 = *(undefined8 *******)(local_b8 + 0x38); - ppppppuVar14 = ppppppuVar16; - uVar7 = UlVerifyAuthConfig((longlong)ppppppuVar16,(uint *)local_a8); - ppppppuVar19 = (undefined8 ******)(ulonglong)uVar7; - if (-1 < (int)uVar7) { - ppppppuVar14 = ppppppuVar8 + 0x26; - if ((uVar12 & 1) != 0) { - UlCopyAuthConfig((longlong)ppppppuVar16,(undefined4 *)ppppppuVar14,(undefined4 *)local_a8, - '\0','\0',*(char *)(param_1 + 8)); - ppppppuVar14 = ppppppuVar16; - uVar7 = extraout_EAX; - goto LAB_7; - } - UlFreeAuthConfig((uint *)ppppppuVar14,'\0'); + ppppppuVar15 = *(undefined8 *******)(param_2 + 0x38); + ppppppuVar12 = ppppppuVar15; + uVar11 = UlVerifyAuthConfig((longlong)ppppppuVar15,(uint *)local_a8); + ppppppuVar16 = (undefined8 ******)(ulonglong)uVar11; + if (-1 < (int)uVar11) { + ppppppuVar12 = ppppppuVar8 + 0x26; + if ((uVar20 & 1) == 0) { + UlFreeAuthConfig((uint *)ppppppuVar12,'\0'); + } + else { + param_4 = UlCopyAuthConfig((longlong)ppppppuVar15,(undefined4 *)ppppppuVar12, + (undefined4 *)local_a8,'\0','\0',*(char *)(param_1 + 8)); + ppppppuVar12 = ppppppuVar15; + ppppppuVar16 = (undefined8 ******)(ulonglong)extraout_EAX; + } } goto LAB_6; } if (param_4 == 1) { - ppppppuVar14 = ppppppuVar8 + 0xf; - uVar7 = UlConfigLogging(ppppppuVar14,ppppppuVar8,(uint *)param_5,param_1); - goto LAB_7; + ppppppuVar12 = ppppppuVar8 + 0xf; + uVar11 = UlConfigLogging(ppppppuVar12,ppppppuVar8,(uint *)param_5,param_1); + goto LAB_3; } if (param_4 != 2) { if (param_4 == 3) { local_a8 = (undefined1 [8])*param_5; uStack_a0 = (undefined8 ******)param_5[1]; local_98 = (undefined4)param_5[2]; if (((ulonglong)local_a8 & 1) == 0) { uVar6 = 0; ppppppuVar8[0x22] = (undefined8 *****)0x0; ppppppuVar8[0x23] = (undefined8 *****)0x0; } else { ppppppuVar8[0x22] = (undefined8 *****)local_a8; ppppppuVar8[0x23] = uStack_a0; uVar6 = local_98; } *(undefined4 *)(ppppppuVar8 + 0x24) = uVar6; - ppppppuVar14 = (undefined8 ******)0x0; + ppppppuVar12 = (undefined8 ******)0x0; + ppppppuVar16 = (undefined8 ******)0x0; } else if (param_4 == 5) { local_a8 = (undefined1 [8])*param_5; - ppppppuVar14 = (undefined8 ******)((ulonglong)local_a8 >> 0x20); - uVar7 = (uint)((ulonglong)local_a8 >> 0x20); - if (1 < uVar7) goto LAB_3; - if (*(uint *)((longlong)ppppppuVar8 + 0x3c) == uVar7) goto LAB_5; - ppppppuVar8[7] = (undefined8 *****)local_a8; - ppppppuVar19 = ppppppuVar16; + ppppppuVar12 = (undefined8 ******)((ulonglong)local_a8 >> 0x20); + uVar11 = (uint)((ulonglong)local_a8 >> 0x20); + if (1 < uVar11) goto LAB_4; + if (*(uint *)((longlong)ppppppuVar8 + 0x3c) == uVar11) { + uVar21 = 0; + ppppppuVar16 = ppppppuVar15; + } + else { + ppppppuVar8[7] = (undefined8 *****)local_a8; + } } else { - uVar7 = param_4 - 7; - ppppppuVar14 = (undefined8 ******)(ulonglong)uVar7; - if (uVar7 != 0) { - if (uVar7 == 1) goto LAB_8; - goto LAB_3; - } - cVar4 = IoIs32bitProcess(param_1); - if (cVar4 == '\0') { - local_a8 = (undefined1 [8])*param_5; - uStack_a0 = (undefined8 ******)param_5[1]; - ppppppuVar14 = (undefined8 ******)param_5[1]; - uVar7 = local_a8._0_4_; - } - else { - ppppppuVar14 = (undefined8 ******)(ulonglong)*(uint *)((longlong)param_5 + 4); - local_a8._0_4_ = (uint)*param_5; - uVar7 = (uint)*param_5; - uStack_a0 = ppppppuVar14; - } - ppppppuVar13 = ppppppuVar16; - if (((*(uint *)(ppppppuVar8 + 8) & 1) != 0) && - (ppppppuVar15 = (undefined8 ******)ppppppuVar8[9], ppppppuVar13 = (undefined8 ******)0x0, - ppppppuVar15 != (undefined8 ******)0x0)) { - ppppppuVar13 = ppppppuVar15; - } - if ((uVar7 & 1) == 0) { - uVar7 = *(uint *)(ppppppuVar8 + 8) & 0xfffffffe; - uVar12 = (ulonglong)uVar7; - ppppppuVar8[9] = (undefined8 *****)0x0; - *(uint *)(ppppppuVar8 + 8) = uVar7; -LAB_9: - ppppppuVar19 = ppppppuVar16; - if (ppppppuVar13 != (undefined8 ******)0x0) { + uVar11 = param_4 - 7; + ppppppuVar12 = (undefined8 ******)(ulonglong)uVar11; + if (uVar11 == 0) { + cVar4 = IoIs32bitProcess(param_1); + if (cVar4 == '\0') { + local_a8 = (undefined1 [8])*param_5; + uStack_a0 = (undefined8 ******)param_5[1]; + ppppppuVar12 = (undefined8 ******)param_5[1]; + uVar11 = local_a8._0_4_; + } + else { + ppppppuVar12 = (undefined8 ******)(ulonglong)*(uint *)((longlong)param_5 + 4); + local_a8._0_4_ = (uint)*param_5; + uVar11 = (uint)*param_5; + uStack_a0 = ppppppuVar12; + } + ppppppuVar15 = ppppppuVar16; + if (((*(uint *)(ppppppuVar8 + 8) & 1) != 0) && + (ppppppuVar13 = (undefined8 ******)ppppppuVar8[9], + ppppppuVar15 = (undefined8 ******)0x0, ppppppuVar13 != (undefined8 ******)0x0)) { + ppppppuVar15 = ppppppuVar13; + } + if ((uVar11 & 1) == 0) { + uVar11 = *(uint *)(ppppppuVar8 + 8) & 0xfffffffe; + uVar18 = (ulonglong)uVar11; + ppppppuVar8[9] = (undefined8 *****)0x0; + *(uint *)(ppppppuVar8 + 8) = uVar11; +LAB_8: + if (ppppppuVar15 != (undefined8 ******)0x0) { + LOCK(); + iVar7 = *(int *)ppppppuVar15; + *(int *)ppppppuVar15 = *(int *)ppppppuVar15 + -1; + UNLOCK(); + iVar7 = iVar7 + -1; + if ((UxDebugCheckRefcount != '\0') && (iVar7 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,ppppppuVar15,10,(longlong)iVar7); + } + if (iVar7 == 0) { + UlFreeRequestQueue((longlong)ppppppuVar15,ppppppuVar13,uVar18,uVar20); + ppppppuVar12 = ppppppuVar15; + } + } + } + else { + uVar20 = 7; + uVar18 = uVar21; + uVar11 = UlReferenceRequestQueueByHandle(ppppppuVar12,ppppppuVar13,1,7,&local_c0); + ppppppuVar16 = (undefined8 ******)(ulonglong)uVar11; + if ((int)uVar11 < 0) goto LAB_6; + if (*(short *)((longlong)local_c0 + 0x114) == sVar14) { + ppppppuVar12 = (undefined8 ******)(ulonglong)local_b8._2_2_; + if (*(ushort *)((longlong)local_c0 + 0x116) == local_b8._2_2_) { + *(uint *)(ppppppuVar8 + 8) = *(uint *)(ppppppuVar8 + 8) | 1; + ppppppuVar8[9] = local_c0; + ppppppuVar12 = local_c0; + ppppppuVar13 = local_c0; + goto LAB_8; + } + } LOCK(); - iVar18 = *(int *)ppppppuVar13; - *(int *)ppppppuVar13 = *(int *)ppppppuVar13 + -1; + iVar7 = *(int *)local_c0; + *(int *)local_c0 = *(int *)local_c0 + -1; UNLOCK(); - uVar7 = iVar18 - 1; - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar7)) { + iVar7 = iVar7 + -1; + if ((UxDebugCheckRefcount != '\0') && (iVar7 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,ppppppuVar13,10,(longlong)(int)uVar7); - } - if (uVar7 == 0) { - UlFreeRequestQueue((longlong)ppppppuVar13,ppppppuVar15,uVar12,pcVar21); - ppppppuVar14 = ppppppuVar13; - } - } - } - else { - pcVar21 = (code *)0x7; - uVar12 = uVar9; - uVar7 = UlReferenceRequestQueueByHandle(ppppppuVar14,ppppppuVar15,1,7,&local_d0); - ppppppuVar16 = (undefined8 ******)(ulonglong)uVar7; - ppppppuVar19 = ppppppuVar16; - if ((int)uVar7 < 0) goto LAB_6; - if (*(short *)((longlong)local_d0 + 0x114) == sVar17) { - ppppppuVar14 = (undefined8 ******)(ulonglong)local_c8._2_2_; - if (*(ushort *)((longlong)local_d0 + 0x116) == local_c8._2_2_) { - *(uint *)(ppppppuVar8 + 8) = *(uint *)(ppppppuVar8 + 8) | 1; - ppppppuVar8[9] = local_d0; - ppppppuVar14 = local_d0; - ppppppuVar15 = local_d0; - goto LAB_9; - } - } - LOCK(); - iVar18 = *(int *)local_d0; - *(int *)local_d0 = *(int *)local_d0 + -1; - UNLOCK(); - uVar7 = iVar18 - 1; - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar7)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,local_d0,10,(longlong)(int)uVar7); - } - if (uVar7 == 0) { - ppppppuVar14 = local_d0; - UlFreeRequestQueue((longlong)local_d0,local_d0,uVar12,pcVar21); - } - ppppppuVar19 = (undefined8 ******)0xc0000059; + UlBugCheckEx(3,local_c0,10,(longlong)iVar7); + } + if (iVar7 == 0) { + ppppppuVar12 = local_c0; + UlFreeRequestQueue((longlong)local_c0,local_c0,uVar18,uVar20); + } + ppppppuVar16 = (undefined8 ******)0xc0000059; + } + } + else { + if (uVar11 == 1) goto LAB_7; +LAB_4: + ppppppuVar16 = (undefined8 ******)0xc000000d; } } goto LAB_6; } - pcVar20 = (code *)(ulonglong)param_6; - pcVar21 = (code *)local_a8; - uVar9 = UlCaptureQosParameter((longlong)param_1,(uint *)param_5,param_6,(undefined8 *)pcVar21); - ppppppuVar19 = (undefined8 ******)(uVar9 & 0xffffffff); - if (-1 < (int)uVar9) { + pcVar17 = (code *)(ulonglong)param_6; + pcVar19 = (code *)local_a8; + uVar20 = UlCaptureQosParameter((longlong)param_1,(uint *)param_5,param_6,(undefined8 *)pcVar19); + ppppppuVar16 = (undefined8 ******)(uVar20 & 0xffffffff); + if (-1 < (int)uVar20) { if (local_a8._0_4_ == 0) { - ppppppuVar14 = ppppppuVar8 + 10; - uVar7 = UlQosConfigureFlowCharacteristics(ppppppuVar14,(uint *)(local_a8 + 4)); + ppppppuVar12 = ppppppuVar8 + 10; + uVar11 = UlQosConfigureFlowCharacteristics(ppppppuVar12,(uint *)(local_a8 + 4)); } else { if (local_a8._0_4_ != 1) { - ppppppuVar19 = (undefined8 ******)0xc000000d; - goto LAB_10; - } - ppppppuVar14 = ppppppuVar8; - uVar10 = UlSetConnectionsProperty((longlong)ppppppuVar8,(undefined8 *)(local_a8 + 4)); - uVar7 = (uint)uVar10; - } - ppppppuVar19 = (undefined8 ******)(ulonglong)uVar7; - uVar9 = 1; + ppppppuVar16 = (undefined8 ******)0xc000000d; + goto LAB_9; + } + ppppppuVar12 = ppppppuVar8; + uVar9 = UlSetConnectionsProperty((longlong)ppppppuVar8,(undefined8 *)(local_a8 + 4)); + uVar11 = (uint)uVar9; + } + ppppppuVar16 = (undefined8 ******)(ulonglong)uVar11; goto LAB_6; } } -LAB_10: +LAB_9: local_a8 = (undefined1 [8])0x0; uStack_a0 = (undefined8 ******)((ulonglong)uStack_a0 & 0xffffffff00000000); LAB_2: if (ppppppuVar8 != (undefined8 ******)0x0) { piVar1 = (int *)((longlong)ppppppuVar8 + 4); LOCK(); - iVar18 = *piVar1; + iVar7 = *piVar1; *piVar1 = *piVar1 + -1; UNLOCK(); - uVar7 = iVar18 - 1; - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar7)) { + iVar7 = iVar7 + -1; + if ((UxDebugCheckRefcount != '\0') && (iVar7 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar1,0xb,(longlong)(int)uVar7); - } - if (uVar7 == 0) { - UlFreeConfigGroup(ppppppuVar8,piVar1,(undefined8 *****)pcVar20,(undefined8 ****)pcVar21); - } - } - ExReleaseCacheAwarePushLockExclusive(*(undefined8 *)(*(longlong *)(local_b8 + 0x38) + 0x558)); + UlBugCheckEx(3,piVar1,0xb,(longlong)iVar7); + } + if (iVar7 == 0) { + UlFreeConfigGroup(ppppppuVar8,piVar1,(undefined8 *****)pcVar17,(undefined8 ****)pcVar19); + } + } + ExReleaseCacheAwarePushLockExclusive(*(undefined8 *)(*(longlong *)(param_2 + 0x38) + 0x558)); KeLeaveCriticalRegion(); if ((DAT_0 & 8) != 0) { - WPP_SF_L(0x80,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,(int)ppppppuVar19); - } - return ppppppuVar19; + WPP_SF_L(0x81,&WPP_2d297478329b39561f77aac2cbbacc14_Traceguids,(int)ppppppuVar16); + } + return ppppppuVar16; } ``` ## UxQuicCreateConnection ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.31| |i_ratio|0.45| |m_ratio|1.0| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxQuicCreateConnection|UxQuicCreateConnection| |fullname|UxQuicCreateConnection|UxQuicCreateConnection| |refcount|3|3| |`length`|2330|2324| |called|
Expand for full list:
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeGetCurrentIrql
NTOSKRNL.EXE::KeInitializeSpinLock
NTOSKRNL.EXE::KeReleaseSpinLock
QkCreateCodec
QkSetAllowUnackedEviction
QkSetMaxBlockedStreams
QkSetMaxRefListCount
QkSetMaxUnusedElementsPerMinuteUcGetQuicSession
UlBugCheckEx
UlThreadPoolEnqueueWorkItem
UxPodAttachThread
UxPodDetachThread
UxPodReferenceSilo
UxQuicAbortConnection
UxQuicBufferInitialize
UxQuicFreeConnection
UxpQuicConnectionCreateControlStreams
UxpQuicConnectionIdealProcessorChanged
UxpQuicConnectionOpen
UxpQuicGetIdealProcessor
WPP_SF_Lq
WPP_SF_qqqqq
|
Expand for full list:
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeGetCurrentIrql
NTOSKRNL.EXE::KeInitializeSpinLock
NTOSKRNL.EXE::KeReleaseSpinLock
QkCreateCodec
QkSetAllowUnackedEviction
QkSetMaxBlockedStreams
QkSetMaxRefListCount
QkSetMaxUnusedElementsPerMinuteUcGetQuicSession
UlBugCheckEx
UlThreadPoolEnqueueWorkItem
UxPodAttachThread
UxPodDetachThread
UxPodReferenceSilo
UxQuicAbortConnection
UxQuicBufferInitialize
UxQuicFreeConnection
UxpQuicConnectionCreateControlStreams
UxpQuicConnectionIdealProcessorChanged
UxpQuicConnectionOpen
UxpQuicGetIdealProcessor
WPP_SF_Lq
WPP_SF_qqqqq
| |calling|UcStartClientConnectionIoctl
UxpQuicListenerNewConnection|UcStartClientConnectionIoctl
UxpQuicListenerNewConnection| |paramcount|5|5| |`address`|1400e3f40|1400e4620| |`sig`|int __fastcall UxQuicCreateConnection(longlong param_1, longlong param_2, longlong param_3, longlong param_4, undefined8 * param_5)|ulonglong __fastcall UxQuicCreateConnection(longlong param_1, longlong param_2, longlong param_3, longlong param_4, undefined8 * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxQuicCreateConnection Diff ```diff --- UxQuicCreateConnection +++ UxQuicCreateConnection @@ -1,456 +1,460 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -int UxQuicCreateConnection - (longlong param_1,longlong param_2,longlong param_3,longlong param_4, - undefined8 *param_5) +ulonglong UxQuicCreateConnection + (longlong param_1,longlong param_2,longlong param_3,longlong param_4, + undefined8 *param_5) { code *pcVar1; code *pcVar2; code *pcVar3; code *pcVar4; - undefined1 auVar5 [16]; - undefined1 uVar6; - char cVar7; - int iVar8; - int iVar9; - code *pcVar10; - longlong lVar11; - undefined8 uVar12; - longlong lVar13; - uint *puVar14; - uint uVar15; + undefined8 uVar5; + longlong lVar6; + undefined1 auVar7 [16]; + undefined1 uVar8; + char cVar9; + uint uVar10; + int iVar11; + code *pcVar12; + ulonglong uVar13; + longlong lVar14; + uint *puVar15; int *piVar16; char *pcVar17; longlong *plVar18; undefined8 *puVar19; - undefined1 *puVar20; + ulonglong uVar20; undefined1 *puVar21; undefined1 *puVar22; undefined1 *puVar23; - code *pcVar24; + undefined1 *puVar24; code *pcVar25; code *pcVar26; - bool bVar27; + code *pcVar27; undefined1 auStackY_a8 [8]; undefined1 auStackY_a0 [24]; ushort local_68 [2]; uint local_64; longlong local_60; char local_58 [16]; undefined8 local_48; undefined8 uStack_40; + puVar23 = auStackY_a8; + puVar24 = auStackY_a8; puVar22 = auStackY_a8; - puVar23 = auStackY_a8; - puVar21 = auStackY_a8; local_60 = 0; - iVar9 = 0; + iVar11 = 0; local_68[0] = 0; if ((DAT_0 & 0x40) != 0) { - WPP_SF_qqqqq(0xf0,&WPP_016185b96ac5364406b8259b8dc8ab21_Traceguids,0,param_2); + WPP_SF_qqqqq(0xef,&WPP_30545e5a5bdb3575b5a71435da803d80_Traceguids,0,param_2); } *param_5 = 0; if (param_1 == 0) { local_60 = *(longlong *)(param_2 + 0x88); } else { - iVar8 = UcGetQuicSession(*(longlong *)(*(longlong *)(param_1 + 0x28) + 8),&local_60); - puVar20 = auStackY_a8; - if (iVar8 < 0) goto LAB_1; - iVar9 = 1; - } - pcVar25 = (code *)0x43517855; - pcVar26 = (code *)&UxLowPriorityPool; - pcVar10 = (code *)ExAllocatePool3(0x40,0xde0); - cVar7 = (char)iVar9; - if (pcVar10 == (code *)0x0) { - iVar8 = -0x3fffff66; - puVar20 = auStackY_a8; + uVar10 = UcGetQuicSession(*(longlong *)(*(longlong *)(param_1 + 0x28) + 8),&local_60); + uVar20 = (ulonglong)uVar10; + puVar21 = auStackY_a8; + if ((int)uVar10 < 0) goto LAB_1; + iVar11 = 1; + } + pcVar26 = (code *)0x43517855; + pcVar27 = (code *)&UxLowPriorityPool; + pcVar12 = (code *)ExAllocatePool3(0x40,0xb40); + cVar9 = (char)iVar11; + if (pcVar12 == (code *)0x0) { + uVar20 = 0xc000009a; + puVar21 = auStackY_a8; LAB_2: - puVar21 = puVar20; - pcVar24 = pcVar25; - if (cVar7 != '\0') { + puVar22 = puVar21; + pcVar25 = pcVar26; + if (cVar9 != '\0') { LAB_3: - pcVar24 = pcVar25; + pcVar25 = pcVar26; if (local_60 != 0) { LOCK(); piVar16 = (int *)(local_60 + 4); - iVar9 = *piVar16; + iVar11 = *piVar16; *piVar16 = *piVar16 + -1; UNLOCK(); - iVar9 = iVar9 + -1; - if ((UxDebugCheckRefcount != '\0') && (iVar9 < 0)) { - /* WARNING: Subroutine does not return */ - *(undefined **)(puVar21 + -8) = &UNK_4; - UlBugCheckEx(3,local_60 + 4,10,(longlong)iVar9); - } - if (iVar9 == 0) { - uVar12 = *(undefined8 *)(local_60 + 0x50); + iVar11 = iVar11 + -1; + if ((UxDebugCheckRefcount != '\0') && (iVar11 < 0)) { + /* WARNING: Subroutine does not return */ + *(undefined **)(puVar22 + -8) = &UNK_4; + UlBugCheckEx(3,local_60 + 4,10,(longlong)iVar11); + } + if (iVar11 == 0) { + uVar5 = *(undefined8 *)(local_60 + 0x50); plVar18 = (longlong *)(local_60 + 0x20); if (((*plVar18 != 0) || (*(longlong *)(local_60 + 0x30) != 0)) || (*(longlong *)(local_60 + 0x40) != 0)) { /* WARNING: Subroutine does not return */ - *(undefined **)(puVar21 + -8) = &UNK_5; - UlBugCheckEx(1,plVar18,"minio\\http\\sys\\quicconn.h",0x3ef); + *(undefined **)(puVar22 + -8) = &UNK_5; + UlBugCheckEx(1,plVar18,"minio\\http\\sys\\quicconn.h",999); } - *(undefined4 *)(puVar21 + 0x28) = 0xffffffff; - pcVar25 = UxQuicFreeSession; - pcVar26 = (code *)CONCAT71((int7)((ulonglong)pcVar26 >> 8),1); - *(undefined8 *)(puVar21 + 0x20) = uVar12; - *(undefined8 *)(puVar21 + -8) = 0x1400e463d; + *(undefined4 *)(puVar22 + 0x28) = 0xffffffff; + pcVar26 = UxQuicFreeSession; + pcVar27 = (code *)CONCAT71((int7)((ulonglong)pcVar27 >> 8),1); + *(undefined8 *)(puVar22 + 0x20) = uVar5; + *(undefined8 *)(puVar22 + -8) = 0x1400e4d17; UlThreadPoolEnqueueWorkItem - (0,(longlong)plVar18,UxQuicFreeSession,'\x01',*(longlong *)(puVar21 + 0x20), - *(uint *)(puVar21 + 0x28)); + (0,(longlong)plVar18,UxQuicFreeSession,'\x01',*(longlong *)(puVar22 + 0x20), + *(uint *)(puVar22 + 0x28)); } local_60 = 0; - pcVar24 = pcVar25; - } - } - puVar23 = puVar21; - puVar20 = puVar21; - if (pcVar10 == (code *)0x0) goto LAB_1; + pcVar25 = pcVar26; + } + } + puVar24 = puVar22; + puVar21 = puVar22; + if (pcVar12 == (code *)0x0) goto LAB_1; } else { - *(undefined4 *)pcVar10 = 0x43517855; - pcVar1 = pcVar10 + 4; - pcVar2 = pcVar10 + 0x9c0; + *(undefined4 *)pcVar12 = 0x43517855; + pcVar1 = pcVar12 + 4; + pcVar2 = pcVar12 + 0x720; *(int *)pcVar1 = 1; *(longlong *)pcVar2 = 0; - *(longlong *)(pcVar10 + 0x9d0) = 0; - *(longlong *)(pcVar10 + 0x9e0) = 0; - *(longlong *)(pcVar10 + 0x130) = 0; - *(longlong *)(pcVar10 + 0x140) = 0; - *(longlong *)(pcVar10 + 0x150) = 0; - *(longlong *)(pcVar10 + 0x1c0) = 0; - *(longlong *)(pcVar10 + 0x1d0) = 0; - *(longlong *)(pcVar10 + 0x1e0) = 0; - *(longlong *)(pcVar10 + 0x280) = 0; - *(longlong *)(pcVar10 + 0x290) = 0; - *(longlong *)(pcVar10 + 0x2a0) = 0; - KeInitializeSpinLock(pcVar10 + 0xa78); - bVar27 = UxKirHttpDscp != '\0'; - *(longlong *)(pcVar10 + 0x28) = 0; - if (bVar27) { - *(longlong *)(pcVar10 + 0xdd0) = 0; - } - pcVar25 = pcVar10 + 8; - *(code **)(pcVar10 + 0x10) = pcVar25; - *(code **)pcVar25 = pcVar25; - pcVar25 = pcVar10 + 0x18; - *(code **)(pcVar10 + 0x20) = pcVar25; - *(code **)pcVar25 = pcVar25; - pcVar25 = pcVar10 + 0x80; - *(code **)(pcVar10 + 0x88) = pcVar25; - *(code **)pcVar25 = pcVar25; - pcVar25 = pcVar10 + 0x310; - *(code **)(pcVar10 + 0x318) = pcVar25; - *(code **)pcVar25 = pcVar25; - pcVar25 = pcVar10 + 0x168; - *(code **)(pcVar10 + 0x170) = pcVar25; - *(code **)pcVar25 = pcVar25; - pcVar25 = pcVar10 + 0x1f8; - *(code **)(pcVar10 + 0x200) = pcVar25; - *(code **)pcVar25 = pcVar25; - pcVar25 = pcVar10 + 0x208; - *(code **)(pcVar10 + 0x210) = pcVar25; - *(code **)pcVar25 = pcVar25; - pcVar25 = pcVar10 + 0x218; - *(code **)(pcVar10 + 0x220) = pcVar25; - *(code **)pcVar25 = pcVar25; - pcVar25 = pcVar10 + 0xe8; - *(code **)(pcVar10 + 0xf0) = pcVar25; - *(code **)pcVar25 = pcVar25; - pcVar25 = pcVar10 + 0x2b8; - *(code **)(pcVar10 + 0x2c0) = pcVar25; - *(code **)pcVar25 = pcVar25; + *(longlong *)(pcVar12 + 0x730) = 0; + *(longlong *)(pcVar12 + 0x740) = 0; + *(longlong *)(pcVar12 + 0x130) = 0; + *(longlong *)(pcVar12 + 0x140) = 0; + *(longlong *)(pcVar12 + 0x150) = 0; + *(longlong *)(pcVar12 + 0x1c0) = 0; + *(longlong *)(pcVar12 + 0x1d0) = 0; + *(longlong *)(pcVar12 + 0x1e0) = 0; + *(longlong *)(pcVar12 + 0x280) = 0; + *(longlong *)(pcVar12 + 0x290) = 0; + *(longlong *)(pcVar12 + 0x2a0) = 0; + KeInitializeSpinLock(pcVar12 + 0x7d8); + pcVar26 = pcVar12 + 8; + *(longlong *)(pcVar12 + 0x28) = 0; + *(code **)(pcVar12 + 0x10) = pcVar26; + *(code **)pcVar26 = pcVar26; + pcVar26 = pcVar12 + 0x18; + *(longlong *)(pcVar12 + 0xb30) = 0; + *(code **)(pcVar12 + 0x20) = pcVar26; + *(code **)pcVar26 = pcVar26; + pcVar26 = pcVar12 + 0x80; + *(code **)(pcVar12 + 0x88) = pcVar26; + *(code **)pcVar26 = pcVar26; + pcVar26 = pcVar12 + 0x310; + *(code **)(pcVar12 + 0x318) = pcVar26; + *(code **)pcVar26 = pcVar26; + pcVar26 = pcVar12 + 0x168; + *(code **)(pcVar12 + 0x170) = pcVar26; + *(code **)pcVar26 = pcVar26; + pcVar26 = pcVar12 + 0x1f8; + *(code **)(pcVar12 + 0x200) = pcVar26; + *(code **)pcVar26 = pcVar26; + pcVar26 = pcVar12 + 0x208; + *(code **)(pcVar12 + 0x210) = pcVar26; + *(code **)pcVar26 = pcVar26; + pcVar26 = pcVar12 + 0x218; + *(code **)(pcVar12 + 0x220) = pcVar26; + *(code **)pcVar26 = pcVar26; + pcVar26 = pcVar12 + 0xe8; + *(code **)(pcVar12 + 0xf0) = pcVar26; + *(code **)pcVar26 = pcVar26; + pcVar26 = pcVar12 + 0x2b8; + *(code **)(pcVar12 + 0x2c0) = pcVar26; + *(code **)pcVar26 = pcVar26; UxPodReferenceSilo(param_4,0x43517855,0xf); - *(longlong *)(pcVar10 + 0xcb8) = param_3; - *(longlong *)(pcVar10 + 0xcb0) = param_4; - pcVar25 = (code *)0x10000; - *(longlong *)(pcVar10 + 0xca0) = _DAT_6; - *(longlong *)(pcVar10 + 0xca8) = *(longlong *)(*(longlong *)(pcVar10 + 0xcb8) + 0x1c18); - auVar5._8_8_ = 0; - auVar5._0_8_ = _DAT_7 << 8; - *(longlong *)(pcVar10 + 800) = SUB168(auVar5 * (ZEXT416(_DAT_8) << 0x20),8); - iVar8 = UxQuicBufferInitialize((longlong *)(pcVar10 + 0x108),0x800,0x10000); - puVar20 = auStackY_a8; - if (iVar8 < 0) goto LAB_2; - pcVar25 = (code *)0x8000; - iVar8 = UxQuicBufferInitialize((longlong *)(pcVar10 + 0x188),0x800,0x8000); - puVar20 = auStackY_a8; - if (iVar8 < 0) goto LAB_2; - pcVar25 = (code *)0x10000; - iVar8 = UxQuicBufferInitialize((longlong *)(pcVar10 + 0x240),0x4000,0x10000); - puVar20 = auStackY_a8; - if (iVar8 < 0) goto LAB_2; - pcVar3 = pcVar10 + 0xd0; - pcVar25 = (code *)0x0; - local_64 = iVar9 * 2 + 1; - lVar11 = QkCreateCodec((undefined8 *)pcVar3,iVar9 * 2,0); - iVar8 = (int)lVar11; - puVar20 = auStackY_a8; - if (iVar8 < 0) goto LAB_2; - uVar12 = QkSetMaxBlockedStreams(*(longlong *)pcVar3,0); - iVar8 = (int)uVar12; - puVar20 = auStackY_a8; - if (iVar8 < 0) goto LAB_2; - if (cVar7 == '\0') { - if ((0xffff < *(uint *)(*(longlong *)(pcVar10 + 0xcb8) + 0x1be0)) || - (uVar15 = *(uint *)(*(longlong *)(pcVar10 + 0xcb8) + 0x1be0) << 2, 0xffff < uVar15)) { - uVar15 = 0xffff; + *(longlong *)(pcVar12 + 0xa18) = param_3; + *(longlong *)(pcVar12 + 0xa10) = param_4; + pcVar26 = (code *)0x10000; + *(longlong *)(pcVar12 + 0xa00) = _DAT_6; + *(longlong *)(pcVar12 + 0xa08) = *(longlong *)(*(longlong *)(pcVar12 + 0xa18) + 0x1c18); + auVar7._8_8_ = 0; + auVar7._0_8_ = _DAT_7 << 8; + *(longlong *)(pcVar12 + 800) = SUB168(auVar7 * (ZEXT416(_DAT_8) << 0x20),8); + uVar10 = UxQuicBufferInitialize((longlong *)(pcVar12 + 0x108),0x800,0x10000); + uVar20 = (ulonglong)uVar10; + puVar21 = auStackY_a8; + if ((int)uVar10 < 0) goto LAB_2; + pcVar26 = (code *)0x8000; + uVar10 = UxQuicBufferInitialize((longlong *)(pcVar12 + 0x188),0x800,0x8000); + uVar20 = (ulonglong)uVar10; + puVar21 = auStackY_a8; + if ((int)uVar10 < 0) goto LAB_2; + pcVar26 = (code *)0x10000; + uVar10 = UxQuicBufferInitialize((longlong *)(pcVar12 + 0x240),0x4000,0x10000); + uVar20 = (ulonglong)uVar10; + puVar21 = auStackY_a8; + if ((int)uVar10 < 0) goto LAB_2; + pcVar3 = pcVar12 + 0xd0; + pcVar26 = (code *)0x0; + local_64 = iVar11 * 2 + 1; + uVar13 = QkCreateCodec((undefined8 *)pcVar3,iVar11 * 2,0); + uVar20 = uVar13 & 0xffffffff; + puVar21 = auStackY_a8; + if ((int)uVar13 < 0) goto LAB_2; + uVar13 = QkSetMaxBlockedStreams(*(longlong *)pcVar3,0); + uVar20 = uVar13 & 0xffffffff; + puVar21 = auStackY_a8; + if ((int)uVar13 < 0) goto LAB_2; + if (cVar9 == '\0') { + if ((0xffff < *(uint *)(*(longlong *)(pcVar12 + 0xa18) + 0x1be0)) || + (uVar10 = *(uint *)(*(longlong *)(pcVar12 + 0xa18) + 0x1be0) << 2, 0xffff < uVar10)) { + uVar10 = 0xffff; } } else { - uVar15 = 400; - } - uVar12 = QkSetMaxRefListCount(*(uint **)pcVar3,uVar15); - iVar8 = (int)uVar12; - puVar20 = auStackY_a8; - if (iVar8 < 0) goto LAB_2; - pcVar3 = pcVar10 + 0xd8; - pcVar25 = (code *)0x1000; - lVar11 = QkCreateCodec((undefined8 *)pcVar3,local_64,0x1000); - iVar8 = (int)lVar11; - puVar20 = auStackY_a8; - if (iVar8 < 0) goto LAB_2; - puVar14 = *(uint **)pcVar3; - uVar12 = QkSetMaxBlockedStreams((longlong)puVar14,100); - iVar8 = (int)uVar12; - puVar20 = auStackY_a8; - if (iVar8 < 0) goto LAB_2; - pcVar24 = pcVar25; - if (cVar7 != '\0') { + uVar10 = 400; + } + uVar13 = QkSetMaxRefListCount(*(uint **)pcVar3,uVar10); + uVar20 = uVar13 & 0xffffffff; + puVar21 = auStackY_a8; + if ((int)uVar13 < 0) goto LAB_2; + pcVar3 = pcVar12 + 0xd8; + pcVar26 = (code *)0x1000; + uVar13 = QkCreateCodec((undefined8 *)pcVar3,local_64,0x1000); + uVar20 = uVar13 & 0xffffffff; + puVar21 = auStackY_a8; + if ((int)uVar13 < 0) goto LAB_2; + puVar15 = *(uint **)pcVar3; + uVar13 = QkSetMaxBlockedStreams((longlong)puVar15,100); + uVar20 = uVar13 & 0xffffffff; + puVar21 = auStackY_a8; + if ((int)uVar13 < 0) goto LAB_2; + pcVar25 = pcVar26; + if (cVar9 != '\0') { LAB_9: - if (*(char *)(*(longlong *)(pcVar10 + 0xcb8) + 0x1fe0) != '\0') { - puVar14 = *(uint **)pcVar3; - uVar12 = QkSetAllowUnackedEviction(puVar14); - iVar8 = (int)uVar12; - puVar20 = auStackY_a8; - pcVar25 = pcVar24; - if (iVar8 < 0) goto LAB_2; - } - if (cVar7 == '\0') { - *(longlong *)(pcVar10 + 0x90) = param_2; + if (*(char *)(*(longlong *)(pcVar12 + 0xa18) + 0x1fe0) != '\0') { + puVar15 = *(uint **)pcVar3; + uVar13 = QkSetAllowUnackedEviction(puVar15); + uVar20 = uVar13 & 0xffffffff; + puVar21 = auStackY_a8; + pcVar26 = pcVar25; + if ((int)uVar13 < 0) goto LAB_2; + } + if (cVar9 == '\0') { + *(longlong *)(pcVar12 + 0x90) = param_2; piVar16 = (int *)(param_2 + 8); LOCK(); - iVar9 = *piVar16; + iVar11 = *piVar16; *piVar16 = *piVar16 + 1; UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (iVar9 + 1 < 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar16,0xf,(longlong)(iVar9 + 1)); + if ((UxDebugCheckRefcount != '\0') && (iVar11 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar16,0xf,(longlong)(iVar11 + 1)); } } else { - *(longlong *)(pcVar10 + 0x78) = param_1; + *(longlong *)(pcVar12 + 0x78) = param_1; piVar16 = (int *)(param_1 + 4); LOCK(); - iVar9 = *piVar16; + iVar11 = *piVar16; *piVar16 = *piVar16 + 1; UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (iVar9 + 1 < 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar16,0xf,(longlong)(iVar9 + 1)); - } - } - *(longlong *)(pcVar10 + 0x9f0) = local_60; + if ((UxDebugCheckRefcount != '\0') && (iVar11 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar16,0xf,(longlong)(iVar11 + 1)); + } + } + *(longlong *)(pcVar12 + 0x750) = local_60; piVar16 = (int *)(local_60 + 4); LOCK(); - iVar9 = *piVar16; + iVar11 = *piVar16; *piVar16 = *piVar16 + 1; UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (iVar9 + 1 < 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar16,0xf,(longlong)(iVar9 + 1)); - } - if (cVar7 == '\0') { - *(longlong *)(pcVar10 + 0x338) = 0; - uVar6 = KeAcquireSpinLockRaiseToDpc(param_3 + 0x21c0); + if ((UxDebugCheckRefcount != '\0') && (iVar11 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar16,0xf,(longlong)(iVar11 + 1)); + } + if (cVar9 == '\0') { + *(longlong *)(pcVar12 + 0x338) = 0; + uVar8 = KeAcquireSpinLockRaiseToDpc(param_3 + 0x21c0); if ((*(char *)(param_3 + 0x21c8) == '\0') && (*(uint *)(param_3 + 0x20d0) < *(uint *)(param_3 + 0x20d4))) { *(int *)(param_3 + 0x20b8) = *(int *)(param_3 + 0x20b8) + 1; *(uint *)(param_3 + 0x20d0) = *(uint *)(param_3 + 0x20d0) + 1; plVar18 = *(longlong **)(param_3 + 0x20c8); - puVar22 = auStackY_a8; + puVar23 = auStackY_a8; if (*plVar18 != param_3 + 0x20c0) { - pcVar25 = (code *)swi(0x29); - plVar18 = (longlong *)(*pcVar25)(3); - puVar22 = auStackY_a0; + pcVar26 = (code *)swi(0x29); + plVar18 = (longlong *)(*pcVar26)(3); + puVar23 = auStackY_a0; } - pcVar25 = pcVar10 + 8; - *(longlong *)pcVar25 = param_3 + 0x20c0; - *(longlong **)(pcVar10 + 0x10) = plVar18; - *plVar18 = (longlong)pcVar25; - *(code **)(param_3 + 0x20c8) = pcVar25; - *(undefined8 *)(puVar22 + -8) = 0x1400e45cc; + pcVar26 = pcVar12 + 8; + *(longlong *)pcVar26 = param_3 + 0x20c0; + *(longlong **)(pcVar12 + 0x10) = plVar18; + *plVar18 = (longlong)pcVar26; + *(code **)(param_3 + 0x20c8) = pcVar26; + *(undefined8 *)(puVar23 + -8) = 0x1400e4ca6; KeReleaseSpinLock(); LAB_10: - *param_5 = pcVar10; - pcVar10 = (code *)0x0; - puVar20 = puVar22; - pcVar25 = pcVar24; + *param_5 = pcVar12; + pcVar12 = (code *)0x0; + puVar21 = puVar23; + pcVar26 = pcVar25; goto LAB_2; } - KeReleaseSpinLock(param_3 + 0x21c0,uVar6); - iVar8 = -0x3fffff66; - puVar23 = auStackY_a8; + KeReleaseSpinLock(param_3 + 0x21c0,uVar8); + uVar20 = 0xc000009a; + puVar24 = auStackY_a8; goto LAB_11; } LOCK(); - iVar9 = *(int *)pcVar1; + iVar11 = *(int *)pcVar1; *(int *)pcVar1 = *(int *)pcVar1 + 1; UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (iVar9 + 1 < 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,pcVar1,0x11,(longlong)(iVar9 + 1)); - } - pcVar3 = pcVar10 + 0x98; - pcVar24 = pcVar10 + 0xce0; - pcVar25 = pcVar10; - pcVar26 = pcVar3; - iVar8 = UxpQuicConnectionOpen(puVar14,piVar16,pcVar10,pcVar3,(longlong *)pcVar24); - if (iVar8 < 0) { + if ((UxDebugCheckRefcount != '\0') && (iVar11 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,pcVar1,0x11,(longlong)(iVar11 + 1)); + } + pcVar3 = pcVar12 + 0x98; + pcVar25 = pcVar12 + 0xa40; + pcVar26 = pcVar12; + pcVar27 = pcVar3; + uVar10 = UxpQuicConnectionOpen(puVar15,piVar16,pcVar12,pcVar3,(longlong *)pcVar25); + uVar20 = (ulonglong)uVar10; + if ((int)uVar10 < 0) { LOCK(); - iVar9 = *(int *)pcVar1; + iVar11 = *(int *)pcVar1; *(int *)pcVar1 = *(int *)pcVar1 + -1; UNLOCK(); - iVar9 = iVar9 + -1; - if ((UxDebugCheckRefcount != '\0') && (iVar9 < 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,pcVar1,0x11,(longlong)iVar9); - } - puVar21 = auStackY_a8; - if (iVar9 == 0) { - lVar13 = IoGetCurrentProcess(); - lVar11 = *(longlong *)(pcVar10 + 0xcb0); - if (UxSystemProcess == lVar13) { + iVar11 = iVar11 + -1; + if ((UxDebugCheckRefcount != '\0') && (iVar11 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,pcVar1,0x11,(longlong)iVar11); + } + puVar22 = auStackY_a8; + if (iVar11 == 0) { + lVar14 = IoGetCurrentProcess(); + lVar6 = *(longlong *)(pcVar12 + 0xa10); + if (UxSystemProcess == lVar14) { local_58[0] = '\0'; local_58[1] = '\0'; local_58[2] = '\0'; local_58[3] = '\0'; local_58[4] = '\0'; local_58[5] = '\0'; local_58[6] = '\0'; local_58[7] = '\0'; local_58[8] = '\0'; local_58[9] = '\0'; local_58[10] = '\0'; local_58[0xb] = '\0'; local_58[0xc] = '\0'; local_58[0xd] = '\0'; local_58[0xe] = '\0'; local_58[0xf] = '\0'; - if (((*(longlong *)pcVar2 != 0) || (*(longlong *)(pcVar10 + 0x9d0) != 0)) || - (*(longlong *)(pcVar10 + 0x9e0) != 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(1,pcVar2,"minio\\http\\sys\\quicconn.h",0x456); + if (((*(longlong *)pcVar2 != 0) || (*(longlong *)(pcVar12 + 0x730) != 0)) || + (*(longlong *)(pcVar12 + 0x740) != 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(1,pcVar2,"minio\\http\\sys\\quicconn.h",0x44e); } - cVar7 = KeGetCurrentIrql(); - if (cVar7 == '\0') { + cVar9 = KeGetCurrentIrql(); + if (cVar9 == '\0') { pcVar17 = local_58; - UxPodAttachThread(lVar11,(undefined8 *)pcVar17); - UxQuicFreeConnection((longlong)pcVar2,pcVar17,pcVar25,(ulonglong)pcVar26); + UxPodAttachThread(lVar6,(undefined8 *)pcVar17); + UxQuicFreeConnection((longlong)pcVar2,pcVar17,pcVar26,(ulonglong)pcVar27); UxPodDetachThread(local_58); - puVar21 = auStackY_a8; + puVar22 = auStackY_a8; goto LAB_3; } } - else if (((*(longlong *)pcVar2 != 0) || (*(longlong *)(pcVar10 + 0x9d0) != 0)) || - (*(longlong *)(pcVar10 + 0x9e0) != 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(1,pcVar2,"minio\\http\\sys\\quicconn.h",0x44f); + else if (((*(longlong *)pcVar2 != 0) || (*(longlong *)(pcVar12 + 0x730) != 0)) || + (*(longlong *)(pcVar12 + 0x740) != 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(1,pcVar2,"minio\\http\\sys\\quicconn.h",0x447); } - pcVar25 = UxQuicFreeConnection; - pcVar26 = (code *)CONCAT71((int7)((ulonglong)pcVar26 >> 8),1); + pcVar26 = UxQuicFreeConnection; + pcVar27 = (code *)CONCAT71((int7)((ulonglong)pcVar27 >> 8),1); UlThreadPoolEnqueueWorkItem - (0,(longlong)pcVar2,UxQuicFreeConnection,'\x01',lVar11,0xffffffff); - puVar21 = auStackY_a8; + (0,(longlong)pcVar2,UxQuicFreeConnection,'\x01',lVar6,0xffffffff); + puVar22 = auStackY_a8; } } else { - iVar8 = UxpQuicGetIdealProcessor(*(longlong *)pcVar3,local_68,(longlong)pcVar24); - pcVar25 = pcVar24; - if (-1 < iVar8) { - UxpQuicConnectionIdealProcessorChanged((longlong)pcVar10,(ulonglong)local_68[0]); - iVar8 = UxpQuicConnectionCreateControlStreams((longlong)pcVar10); - pcVar25 = pcVar24; - if (-1 < iVar8) goto LAB_10; - } - UxQuicAbortConnection((ulonglong)pcVar10,2,(ulonglong)pcVar25,(ulonglong)pcVar26); + uVar10 = UxpQuicGetIdealProcessor(*(longlong *)pcVar3,local_68,(longlong)pcVar25); + uVar20 = (ulonglong)uVar10; + pcVar26 = pcVar25; + if (-1 < (int)uVar10) { + UxpQuicConnectionIdealProcessorChanged((longlong)pcVar12,(ulonglong)local_68[0]); + uVar10 = UxpQuicConnectionCreateControlStreams((longlong)pcVar12); + uVar20 = (ulonglong)uVar10; + pcVar26 = pcVar25; + if (-1 < (int)uVar10) goto LAB_10; + } + UxQuicAbortConnection((ulonglong)pcVar12,2,(ulonglong)pcVar26,(ulonglong)pcVar27); } goto LAB_3; } - pcVar24 = *(code **)(pcVar10 + 0xcb8); - pcVar25 = pcVar24 + 0x1fd8; - if (*(uint *)pcVar25 == 0) goto LAB_9; - pcVar4 = pcVar24 + 0x1fdc; - pcVar24 = (code *)(ulonglong)*(uint *)pcVar4; - puVar14 = *(uint **)pcVar3; - uVar12 = QkSetMaxUnusedElementsPerMinute(puVar14,(ulonglong)*(uint *)pcVar25,*(uint *)pcVar4); - iVar8 = (int)uVar12; - if (-1 < iVar8) goto LAB_9; + pcVar25 = *(code **)(pcVar12 + 0xa18); + pcVar26 = pcVar25 + 0x1fd8; + if (*(uint *)pcVar26 == 0) goto LAB_9; + pcVar4 = pcVar25 + 0x1fdc; + pcVar25 = (code *)(ulonglong)*(uint *)pcVar4; + puVar15 = *(uint **)pcVar3; + uVar13 = QkSetMaxUnusedElementsPerMinute(puVar15,(ulonglong)*(uint *)pcVar26,*(uint *)pcVar4); + uVar20 = uVar13 & 0xffffffff; + if (-1 < (int)uVar13) goto LAB_9; } LAB_11: - pcVar25 = pcVar10 + 4; + pcVar26 = pcVar12 + 4; LOCK(); - iVar9 = *(int *)pcVar25; - *(int *)pcVar25 = *(int *)pcVar25 + -1; + iVar11 = *(int *)pcVar26; + *(int *)pcVar26 = *(int *)pcVar26 + -1; UNLOCK(); - iVar9 = iVar9 + -1; - if ((UxDebugCheckRefcount != '\0') && (iVar9 < 0)) { - /* WARNING: Subroutine does not return */ - *(undefined **)(puVar23 + -8) = &UNK_12; - UlBugCheckEx(3,pcVar25,1,(longlong)iVar9); - } - puVar20 = puVar23; - if (iVar9 == 0) { - *(undefined8 *)(puVar23 + -8) = 0x1400e46b2; - lVar13 = IoGetCurrentProcess(); - pcVar25 = pcVar10 + 0x9c0; - lVar11 = *(longlong *)(pcVar10 + 0xcb0); - if (UxSystemProcess == lVar13) { + iVar11 = iVar11 + -1; + if ((UxDebugCheckRefcount != '\0') && (iVar11 < 0)) { + /* WARNING: Subroutine does not return */ + *(undefined **)(puVar24 + -8) = &UNK_12; + UlBugCheckEx(3,pcVar26,1,(longlong)iVar11); + } + puVar21 = puVar24; + if (iVar11 == 0) { + *(undefined8 *)(puVar24 + -8) = 0x1400e4d8c; + lVar14 = IoGetCurrentProcess(); + pcVar26 = pcVar12 + 0x720; + lVar6 = *(longlong *)(pcVar12 + 0xa10); + if (UxSystemProcess == lVar14) { local_48 = 0; uStack_40 = 0; - if (((*(longlong *)pcVar25 != 0) || (*(longlong *)(pcVar10 + 0x9d0) != 0)) || - (*(longlong *)(pcVar10 + 0x9e0) != 0)) { - /* WARNING: Subroutine does not return */ - *(undefined **)(puVar23 + -8) = &UNK_13; - UlBugCheckEx(1,pcVar25,"minio\\http\\sys\\quicconn.h",0x456); - } - *(undefined8 *)(puVar23 + -8) = 0x1400e472d; - cVar7 = KeGetCurrentIrql(); - if (cVar7 == '\0') { + if (((*(longlong *)pcVar26 != 0) || (*(longlong *)(pcVar12 + 0x730) != 0)) || + (*(longlong *)(pcVar12 + 0x740) != 0)) { + /* WARNING: Subroutine does not return */ + *(undefined **)(puVar24 + -8) = &UNK_13; + UlBugCheckEx(1,pcVar26,"minio\\http\\sys\\quicconn.h",0x44e); + } + *(undefined8 *)(puVar24 + -8) = 0x1400e4e07; + cVar9 = KeGetCurrentIrql(); + if (cVar9 == '\0') { puVar19 = &local_48; - *(undefined8 *)(puVar23 + -8) = 0x1400e4742; - UxPodAttachThread(lVar11,puVar19); - *(undefined8 *)(puVar23 + -8) = 0x1400e474a; - UxQuicFreeConnection((longlong)pcVar25,puVar19,pcVar24,(ulonglong)pcVar26); - *(undefined8 *)(puVar23 + -8) = 0x1400e4753; + *(undefined8 *)(puVar24 + -8) = 0x1400e4e1c; + UxPodAttachThread(lVar6,puVar19); + *(undefined8 *)(puVar24 + -8) = 0x1400e4e24; + UxQuicFreeConnection((longlong)pcVar26,puVar19,pcVar25,(ulonglong)pcVar27); + *(undefined8 *)(puVar24 + -8) = 0x1400e4e2d; UxPodDetachThread((char *)&local_48); goto LAB_1; } } - else if (((*(longlong *)pcVar25 != 0) || (*(longlong *)(pcVar10 + 0x9d0) != 0)) || - (*(longlong *)(pcVar10 + 0x9e0) != 0)) { - /* WARNING: Subroutine does not return */ - *(undefined **)(puVar23 + -8) = &UNK_14; - UlBugCheckEx(1,pcVar25,"minio\\http\\sys\\quicconn.h",0x44f); - } - *(undefined4 *)(puVar23 + 0x28) = 0xffffffff; - *(longlong *)(puVar23 + 0x20) = lVar11; - *(undefined8 *)(puVar23 + -8) = 0x1400e4709; + else if (((*(longlong *)pcVar26 != 0) || (*(longlong *)(pcVar12 + 0x730) != 0)) || + (*(longlong *)(pcVar12 + 0x740) != 0)) { + /* WARNING: Subroutine does not return */ + *(undefined **)(puVar24 + -8) = &UNK_14; + UlBugCheckEx(1,pcVar26,"minio\\http\\sys\\quicconn.h",0x447); + } + *(undefined4 *)(puVar24 + 0x28) = 0xffffffff; + *(longlong *)(puVar24 + 0x20) = lVar6; + *(undefined8 *)(puVar24 + -8) = 0x1400e4de3; UlThreadPoolEnqueueWorkItem - (0,(longlong)pcVar25,UxQuicFreeConnection,'\x01',*(longlong *)(puVar23 + 0x20), - *(uint *)(puVar23 + 0x28)); + (0,(longlong)pcVar26,UxQuicFreeConnection,'\x01',*(longlong *)(puVar24 + 0x20), + *(uint *)(puVar24 + 0x28)); } LAB_1: if ((DAT_0 & 0x40) != 0) { - uVar12 = *param_5; - *(undefined8 *)(puVar20 + -8) = 0x1400e466a; - WPP_SF_Lq(0xf1,&WPP_016185b96ac5364406b8259b8dc8ab21_Traceguids,iVar8,uVar12); - } - return iVar8; + uVar5 = *param_5; + *(undefined8 *)(puVar21 + -8) = 0x1400e4d44; + WPP_SF_Lq(0xf0,&WPP_30545e5a5bdb3575b5a71435da803d80_Traceguids,(int)uVar20,uVar5); + } + return uVar20; } ``` ## UlHkeBuilderCopyFixedHeaders ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.99| |i_ratio|0.84| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlHkeBuilderCopyFixedHeaders|UlHkeBuilderCopyFixedHeaders| |fullname|UlHkeBuilderCopyFixedHeaders|UlHkeBuilderCopyFixedHeaders| |refcount|2|2| |`length`|558|550| |called|UlSetParsedHeader
UlpHkeCopyKnownHeader
memcpy|UlSetParsedHeader
UlpHkeCopyKnownHeader
memcpy| |calling|UlpRebuildResponseHeaders|UlpRebuildResponseHeaders| |paramcount|5|5| |`address`|140127fe0|140128630| |sig|int __fastcall UlHkeBuilderCopyFixedHeaders(longlong param_1, uint param_2, byte * param_3, int * param_4, longlong * param_5)|int __fastcall UlHkeBuilderCopyFixedHeaders(longlong param_1, uint param_2, byte * param_3, int * param_4, longlong * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlHkeBuilderCopyFixedHeaders Diff ```diff --- UlHkeBuilderCopyFixedHeaders +++ UlHkeBuilderCopyFixedHeaders @@ -1,91 +1,91 @@ int UlHkeBuilderCopyFixedHeaders (longlong param_1,uint param_2,byte *param_3,int *param_4,longlong *param_5) { ushort uVar1; ushort uVar2; int iVar3; byte *pbVar4; byte *pbVar5; uint uVar6; int iVar7; uint uVar8; ushort *puVar9; uint uVar10; uint local_res10 [2]; iVar3 = 0; uVar8 = *(uint *)(param_1 + 8) & 8; local_res10[0] = 0; uVar6 = param_2; if (uVar8 != 0) { if (param_2 < *(ushort *)(param_1 + 0x30)) { return -0x3fffffdd; } memcpy(param_3,*(void **)(param_1 + 0x28),(ulonglong)*(ushort *)(param_1 + 0x30)); if ((param_5 != (longlong *)0x0) && (iVar3 = UlSetParsedHeader(param_5,":status",7,param_3 + 9,3), iVar3 < 0)) { return iVar3; } param_3 = param_3 + *(ushort *)(param_1 + 0x30); uVar6 = param_2 - *(ushort *)(param_1 + 0x30); } uVar10 = 0; do { if (1 < uVar10 - 1) { iVar3 = UlpHkeCopyKnownHeader ((byte *)((ulonglong)uVar10 * 0x10 + *(longlong *)(param_1 + 0x20)),uVar10, uVar6,param_3,(int *)local_res10,param_5); if (iVar3 < 0) { return iVar3; } uVar6 = uVar6 - local_res10[0]; param_3 = param_3 + local_res10[0]; } uVar10 = uVar10 + 1; } while (uVar10 < (-(uint)(uVar8 != 0) & 0xfffffff5) + 0x29); uVar1 = *(ushort *)(param_1 + 0xc); uVar8 = 0; if (uVar1 != 0) { puVar9 = (ushort *)(*(longlong *)(param_1 + 0x18) + 6); do { if ((puVar9[-2] & 1) != 0) { if ((ulonglong)uVar6 < (ulonglong)*puVar9 + 4 + (ulonglong)puVar9[-1]) { return -0x3fffffdd; } memcpy(param_3,*(void **)(puVar9 + 1),(ulonglong)puVar9[-1]); pbVar4 = param_3 + puVar9[-1]; iVar7 = uVar6 + (-2 - (uint)puVar9[-1]); pbVar4[0] = 0x3a; pbVar4[1] = 0x20; pbVar4 = pbVar4 + 2; uVar2 = 0; pbVar5 = pbVar4; if (*puVar9 != 0) { memcpy(pbVar4,*(void **)(puVar9 + 5),(ulonglong)*puVar9); uVar2 = *puVar9; pbVar5 = pbVar4 + uVar2; iVar7 = iVar7 - (uint)uVar2; } if ((param_5 != (longlong *)0x0) && (iVar3 = UlSetParsedHeader(param_5,(char *)param_3,(uint)puVar9[-1],pbVar4,(uint)uVar2), iVar3 < 0)) { return iVar3; } pbVar5[0] = 0xd; pbVar5[1] = 10; param_3 = pbVar5 + 2; uVar6 = iVar7 - 2; } puVar9 = puVar9 + 0xc; uVar8 = uVar8 + 1; } while (uVar8 < uVar1); } - if ((UxKirBranchCacheIgnoreResponseCaching != '\0') && (param_5 != (longlong *)0x0)) { + if (param_5 != (longlong *)0x0) { *(int *)((longlong)param_5 + 0x14) = (int)param_5[1]; } *param_4 = param_2 - uVar6; return iVar3; } ``` ## UxQuicStreamConnectionControl ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.9| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxQuicStreamConnectionControl|UxQuicStreamConnectionControl| |fullname|UxQuicStreamConnectionControl|UxQuicStreamConnectionControl| |refcount|3|3| |`length`|2626|2617| |called|
Expand for full list:
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlBugCheckEx
UxPodReferenceSilo
UxQuicConnectionGetChannelBindToken
UxQuicConnectionGetStatsV1
UxQuicConnectionGetStatsV2
UxQuicConnectionGetTimings
UxQuicConnectionSendGoawayUxQuicErrorCodeFromHttpReceiveFault
UxQuicGetDscpTag
UxQuicGetTransportIdleConnectionTimeout
UxQuicLoggingErrorCodeToHttperr
UxQuicLoggingErrorCodeToString
UxQuicSetDscpTag
UxQuicSetTransportIdleConnectionTimeout
UxQuicStreamAbort
UxSslCopySniToRequestProperty
UxSslGetCertInfo
UxSslGetTlsCipherInfo
UxSslGetTlsClientHello
UxpQuicStreamGetStats
UxpQuicStreamGetTimings
UxpQuicStreamIsRetriable
UxpQuicStreamQuicDeclarePushPromise
UxpQuicStreamRetrievePeerCert
UxpQuicStreamUpdateBundleLimits
WPP_SF_L
WPP_SF_id
memset
|
Expand for full list:
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlBugCheckEx
UxPodReferenceSilo
UxQuicConnectionGetChannelBindToken
UxQuicConnectionGetStatsV1
UxQuicConnectionGetStatsV2
UxQuicConnectionGetTimings
UxQuicConnectionSendGoawayUxQuicErrorCodeFromHttpReceiveFault
UxQuicGetDscpTag
UxQuicGetTransportIdleConnectionTimeout
UxQuicLoggingErrorCodeToHttperr
UxQuicLoggingErrorCodeToString
UxQuicSetDscpTag
UxQuicSetTransportIdleConnectionTimeout
UxQuicStreamAbort
UxSslCopySniToRequestProperty
UxSslGetCertInfo
UxSslGetTlsCipherInfo
UxSslGetTlsClientHello
UxpQuicStreamGetStats
UxpQuicStreamGetTimings
UxpQuicStreamIsRetriable
UxpQuicStreamQuicDeclarePushPromise
UxpQuicStreamRetrievePeerCert
UxpQuicStreamUpdateBundleLimits
WPP_SF_L
WPP_SF_id
memset
| |calling||| |paramcount|5|5| |`address`|1400f47e0|1400f4e30| |sig|int __fastcall UxQuicStreamConnectionControl(undefined8 * * * * * * * * * param_1, uint param_2, undefined8 * * * * * * * * * param_3, undefined8 * * * * * param_4, uint * param_5)|int __fastcall UxQuicStreamConnectionControl(undefined8 * * * * * * * * * param_1, uint param_2, undefined8 * * * * * * * * * param_3, undefined8 * * * * * param_4, uint * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxQuicStreamConnectionControl Diff ```diff --- UxQuicStreamConnectionControl +++ UxQuicStreamConnectionControl @@ -1,590 +1,588 @@ int UxQuicStreamConnectionControl (undefined8 *********param_1,uint param_2,undefined8 *********param_3, undefined8 *****param_4,uint *param_5) { int iVar1; undefined8 *******pppppppuVar2; undefined8 *******pppppppuVar3; undefined8 ********ppppppppuVar4; ushort uVar5; int iVar6; uint uVar7; longlong *plVar8; undefined8 ********ppppppppuVar9; undefined8 ****ppppuVar10; ulonglong uVar11; byte bVar12; undefined1 uVar13; uint uVar14; undefined2 *puVar15; undefined8 *********pppppppppuVar16; undefined8 *****pppppuVar17; bool bVar18; undefined4 uVar19; undefined4 uVar20; undefined4 uVar21; undefined4 uVar22; iVar6 = 0; pppppppppuVar16 = param_3; pppppuVar17 = param_4; if ((DAT_0 & 0x40) != 0) { pppppuVar17 = (undefined8 *****)(ulonglong)param_2; pppppppppuVar16 = param_1; - WPP_SF_id(0xa9,&WPP_4c597f134b723deaa2aa5fa3c3a75c7c_Traceguids,param_1,param_2); + WPP_SF_id(0xa9,&WPP_7a4275336f2e3913c0500ab066a217e4_Traceguids,param_1,param_2); } if ((int)param_2 < 0x28) { if (param_2 != 0x27) { if ((int)param_2 < 0x12) { if (param_2 != 0x11) { pppppppppuVar16 = (undefined8 *********)0x9; if ((int)param_2 < 10) { if (param_2 == 9) { uVar14 = 0xc0000120; LAB_1: UxQuicStreamAbort(param_1,uVar14,(uint)pppppppppuVar16,pppppuVar17); goto LAB_2; } if (param_2 == 0) { ppppppppuVar9 = param_1[0x46]; ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[9]; *param_3 = (undefined8 ********)ppppppppuVar9[8]; param_3[1] = ppppppppuVar4; param_3[2] = (undefined8 ********)ppppppppuVar9[10]; *(undefined4 *)(param_3 + 3) = *(undefined4 *)(ppppppppuVar9 + 0xb); ppppppppuVar9 = param_1[0x46]; ppppuVar10 = *(undefined8 *****)((longlong)ppppppppuVar9 + 100); *param_4 = *(undefined8 *****)((longlong)ppppppppuVar9 + 0x5c); param_4[1] = ppppuVar10; param_4[2] = *(undefined8 *****)((longlong)ppppppppuVar9 + 0x6c); *(undefined4 *)(param_4 + 3) = *(undefined4 *)((longlong)ppppppppuVar9 + 0x74); goto LAB_2; } if (param_2 == 1) { pppppppuVar2 = param_1[0x46][0x12]; LOCK(); pppppppuVar3 = pppppppuVar2 + 1; iVar1 = *(int *)pppppppuVar3; *(int *)pppppppuVar3 = *(int *)pppppppuVar3 + 1; UNLOCK(); if ((UxDebugCheckRefcount != '\0') && (iVar1 + 1 < 0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(3,pppppppuVar2 + 1,10,(longlong)(iVar1 + 1)); } ppppppppuVar9 = (undefined8 ********)param_1[0x46][0x12]; } else { if (param_2 == 3) { uVar19 = *(undefined4 *)(param_1 + 0x3e); uVar20 = *(undefined4 *)((longlong)param_1 + 500); uVar21 = *(undefined4 *)(param_1 + 0x3f); uVar22 = *(undefined4 *)((longlong)param_1 + 0x1fc); LAB_3: *(undefined4 *)param_3 = uVar19; *(undefined4 *)((longlong)param_3 + 4) = uVar20; *(undefined4 *)(param_3 + 1) = uVar21; *(undefined4 *)((longlong)param_3 + 0xc) = uVar22; goto LAB_2; } if (param_2 == 4) { UxQuicStreamAbort(param_1,0xc0000120,0xb,pppppuVar17); goto LAB_4; } if (param_2 != 5) { if (param_2 == 6) goto LAB_5; iVar6 = 0; if (param_2 == 7) goto LAB_2; if (param_2 == 8) { plVar8 = UxpQuicStreamQuicDeclarePushPromise ((ushort *)param_1,(longlong)param_3,(longlong **)0x9, (ushort *)param_5); iVar6 = (int)plVar8; goto LAB_2; } goto LAB_6; } - ppppppppuVar9 = (undefined8 ********)param_1[0x46][0x154]; + ppppppppuVar9 = (undefined8 ********)param_1[0x46][0x100]; } LAB_7: *param_3 = ppppppppuVar9; goto LAB_2; } if (param_2 == 10) { *(undefined1 *)param_3 = 1; *(undefined4 *)param_4 = 3; goto LAB_2; } if (param_2 == 0xb) { ppppppppuVar9 = param_1[7]; LAB_8: *param_3 = ppppppppuVar9; goto LAB_2; } if (param_2 == 0xc) { puVar15 = (undefined2 *)0x0; ppppppppuVar9 = (undefined8 ********) UxQuicLoggingErrorCodeToHttperr (*(uint *)((longlong)param_1 + 0x26c),(undefined2 *)0x0); bVar18 = UxKirHttpBugFix25Q1 != '\0'; *param_3 = ppppppppuVar9; if (bVar18) { ppppuVar10 = (undefined8 ****) UxQuicLoggingErrorCodeToString (*(uint *)((longlong)param_1 + 0x26c),puVar15); *param_4 = ppppuVar10; } goto LAB_2; } if (param_2 == 0xd) { UxpQuicStreamUpdateBundleLimits((longlong)param_1,(longlong)param_3); goto LAB_2; } if (param_2 == 0xe) { ppppppppuVar9 = param_1[0x46]; ppppppppuVar4 = *(undefined8 *********)((longlong)ppppppppuVar9 + 0x354); *param_3 = *(undefined8 *********)((longlong)ppppppppuVar9 + 0x34c); param_3[1] = ppppppppuVar4; param_3[2] = *(undefined8 *********)((longlong)ppppppppuVar9 + 0x35c); *(undefined4 *)(param_3 + 3) = *(undefined4 *)((longlong)ppppppppuVar9 + 0x364); goto LAB_2; } if (param_2 == 0xf) { bVar12 = (byte)(*(uint *)(param_1[0x46] + 0xc3) >> 3) & 1; goto LAB_9; } if (param_2 != 0x10) goto LAB_6; } iVar6 = UxpQuicStreamRetrievePeerCert (param_1,(longlong)param_3, (undefined8 *********) CONCAT71((int7)((ulonglong)pppppppppuVar16 >> 8),param_2 == 0x11), pppppuVar17); goto LAB_2; } if ((int)param_2 < 0x20) { if (param_2 == 0x1f) { param_3[4] = param_1[0x51]; uVar19 = *(undefined4 *)((longlong)param_1 + 0x1ec); LAB_10: *(undefined4 *)param_4 = uVar19; goto LAB_2; } if (param_2 == 0x13) { *param_3 = (undefined8 ********)0x0; param_3[1] = (undefined8 ********)0x0; param_3[2] = (undefined8 ********)0x0; param_3[3] = (undefined8 ********)0x0; goto LAB_2; } if (param_2 == 0x15) goto LAB_11; if (param_2 == 0x19) { - UxPodReferenceSilo((longlong)param_1[0x46][0x196],0x43546c55,0xf); - *param_3 = (undefined8 ********)param_1[0x46][0x197]; - *param_4 = param_1[0x46][0x196]; + UxPodReferenceSilo((longlong)param_1[0x46][0x142],0x43546c55,0xf); + *param_3 = (undefined8 ********)param_1[0x46][0x143]; + *param_4 = param_1[0x46][0x142]; goto LAB_2; } if (((param_2 != 0x1a) && (param_2 != 0x1b)) && (param_2 != 0x1c)) { if (param_2 == 0x1e) { UxpQuicStreamGetTimings((longlong)param_1,(longlong)param_3); UxQuicConnectionGetTimings((longlong)param_1[0x46],(longlong *)param_3); goto LAB_2; } goto LAB_6; } } else if (param_2 != 0x20) { if (param_2 == 0x21) { if (UxExtendedEventsEnabled != '\0') { ppppppppuVar9 = param_1[0x46]; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x19d]; - *param_3 = (undefined8 ********)ppppppppuVar9[0x19c]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x149]; + *param_3 = (undefined8 ********)ppppppppuVar9[0x148]; param_3[1] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x19f]; - param_3[2] = (undefined8 ********)ppppppppuVar9[0x19e]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x14b]; + param_3[2] = (undefined8 ********)ppppppppuVar9[0x14a]; param_3[3] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1a1]; - param_3[4] = (undefined8 ********)ppppppppuVar9[0x1a0]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x14d]; + param_3[4] = (undefined8 ********)ppppppppuVar9[0x14c]; param_3[5] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1a3]; - param_3[6] = (undefined8 ********)ppppppppuVar9[0x1a2]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x14f]; + param_3[6] = (undefined8 ********)ppppppppuVar9[0x14e]; param_3[7] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1a5]; - param_3[8] = (undefined8 ********)ppppppppuVar9[0x1a4]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x151]; + param_3[8] = (undefined8 ********)ppppppppuVar9[0x150]; param_3[9] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1a7]; - param_3[10] = (undefined8 ********)ppppppppuVar9[0x1a6]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x153]; + param_3[10] = (undefined8 ********)ppppppppuVar9[0x152]; param_3[0xb] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1a9]; - param_3[0xc] = (undefined8 ********)ppppppppuVar9[0x1a8]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x155]; + param_3[0xc] = (undefined8 ********)ppppppppuVar9[0x154]; param_3[0xd] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1ab]; - param_3[0xe] = (undefined8 ********)ppppppppuVar9[0x1aa]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x157]; + param_3[0xe] = (undefined8 ********)ppppppppuVar9[0x156]; param_3[0xf] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1ad]; - param_3[0x10] = (undefined8 ********)ppppppppuVar9[0x1ac]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x159]; + param_3[0x10] = (undefined8 ********)ppppppppuVar9[0x158]; param_3[0x11] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1af]; - param_3[0x12] = (undefined8 ********)ppppppppuVar9[0x1ae]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x15b]; + param_3[0x12] = (undefined8 ********)ppppppppuVar9[0x15a]; param_3[0x13] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1b1]; - param_3[0x14] = (undefined8 ********)ppppppppuVar9[0x1b0]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x15d]; + param_3[0x14] = (undefined8 ********)ppppppppuVar9[0x15c]; param_3[0x15] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1b3]; - param_3[0x16] = (undefined8 ********)ppppppppuVar9[0x1b2]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x15f]; + param_3[0x16] = (undefined8 ********)ppppppppuVar9[0x15e]; param_3[0x17] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1b5]; - param_3[0x18] = (undefined8 ********)ppppppppuVar9[0x1b4]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x161]; + param_3[0x18] = (undefined8 ********)ppppppppuVar9[0x160]; param_3[0x19] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1b7]; - param_3[0x1a] = (undefined8 ********)ppppppppuVar9[0x1b6]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x163]; + param_3[0x1a] = (undefined8 ********)ppppppppuVar9[0x162]; param_3[0x1b] = ppppppppuVar4; - ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x1b9]; - param_3[0x1c] = (undefined8 ********)ppppppppuVar9[0x1b8]; + ppppppppuVar4 = (undefined8 ********)ppppppppuVar9[0x165]; + param_3[0x1c] = (undefined8 ********)ppppppppuVar9[0x164]; param_3[0x1d] = ppppppppuVar4; ppppppppuVar9 = param_1[0x8f]; param_3[0x1e] = param_1[0x8e]; param_3[0x1f] = ppppppppuVar9; ppppppppuVar9 = param_1[0x91]; param_3[0x20] = param_1[0x90]; param_3[0x21] = ppppppppuVar9; ppppppppuVar9 = param_1[0x93]; param_3[0x22] = param_1[0x92]; param_3[0x23] = ppppppppuVar9; ppppppppuVar9 = param_1[0x95]; param_3[0x24] = param_1[0x94]; param_3[0x25] = ppppppppuVar9; ppppppppuVar9 = param_1[0x97]; param_3[0x26] = param_1[0x96]; param_3[0x27] = ppppppppuVar9; ppppppppuVar9 = param_1[0x99]; param_3[0x28] = param_1[0x98]; param_3[0x29] = ppppppppuVar9; ppppppppuVar9 = param_1[0x9b]; param_3[0x2a] = param_1[0x9a]; param_3[0x2b] = ppppppppuVar9; ppppppppuVar9 = param_1[0x9d]; param_3[0x2c] = param_1[0x9c]; param_3[0x2d] = ppppppppuVar9; ppppppppuVar9 = param_1[0x9f]; param_3[0x2e] = param_1[0x9e]; param_3[0x2f] = ppppppppuVar9; goto LAB_2; } LAB_12: iVar6 = -0x3ffffff3; goto LAB_2; } if (param_2 != 0x22) { if (param_2 == 0x23) { bVar12 = *(byte *)(param_1[0x46] + 0xc2); LAB_9: *(byte *)param_3 = bVar12; goto LAB_2; } if (param_2 == 0x24) { LAB_5: *(undefined1 *)param_3 = 1; iVar6 = 0; goto LAB_2; } if (param_2 == 0x25) { ppppppppuVar9 = param_1[0x46]; iVar6 = UxSslGetCertInfo((longlong)(ppppppppuVar9 + 0x68),(longlong)ppppppppuVar9[0x66], (uint *)(ppppppppuVar9 + 0xc3),(longlong *)param_3); goto LAB_2; } if (param_2 == 0x26) { pppppppuVar3 = param_1[0x46][0x66]; uVar19 = *(undefined4 *)(pppppppuVar3 + 0x5c); uVar20 = *(undefined4 *)((longlong)pppppppuVar3 + 0x2e4); uVar21 = *(undefined4 *)(pppppppuVar3 + 0x5d); uVar22 = *(undefined4 *)((longlong)pppppppuVar3 + 0x2ec); goto LAB_3; } goto LAB_6; } LAB_11: *(undefined1 *)param_3 = 0; goto LAB_2; } LAB_4: iVar6 = -0x3fffff45; goto LAB_2; } bVar12 = (byte)(*(uint *)(param_1[0x46][0x66] + 0x56) >> 0xd); LAB_13: bVar12 = bVar12 & 1; } else { if (0x3c < (int)param_2) { if ((int)param_2 < 0x46) { if (param_2 == 0x45) { ppppppppuVar9 = param_1[0x46]; uVar11 = UxSslGetTlsClientHello - ((longlong)ppppppppuVar9[0x197],(longlong)ppppppppuVar9[0x66], - *(char *)((longlong)ppppppppuVar9 + 0x98c),ppppppppuVar9[0x130], - *(uint *)(ppppppppuVar9 + 0x131),param_3,(uint)param_4,param_5); + ((longlong)ppppppppuVar9[0x143],(longlong)ppppppppuVar9[0x66], + *(char *)((longlong)ppppppppuVar9 + 0x6e4),ppppppppuVar9[0xdb], + *(uint *)(ppppppppuVar9 + 0xdc),param_3,(uint)param_4,param_5); iVar6 = (int)uVar11; goto LAB_2; } if (param_2 == 0x3d) { KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_1 + 9,0); *param_3 = param_1[0x23]; ExReleasePushLockExclusiveEx(param_1 + 9,0); KeLeaveCriticalRegion(); goto LAB_2; } if (param_2 == 0x3e) { bVar12 = param_1[0x23] == (undefined8 ********)0x110; goto LAB_14; } if (param_2 == 0x3f) { if ((param_1[0x23] == (undefined8 ********)0x110) && (*(char *)((longlong)param_1 + 0x149) == '\0')) { uVar13 = 1; } else { uVar13 = 0; } *(undefined1 *)param_3 = uVar13; goto LAB_2; } if (param_2 == 0x40) { ppppppppuVar9 = param_1[0xa1]; *param_3 = param_1[0xa0]; param_3[1] = ppppppppuVar9; ppppppppuVar9 = param_1[0xa3]; param_3[2] = param_1[0xa2]; param_3[3] = ppppppppuVar9; ppppppppuVar9 = param_1[0xa5]; param_3[4] = param_1[0xa4]; param_3[5] = ppppppppuVar9; ppppppppuVar9 = param_1[0xa7]; param_3[6] = param_1[0xa6]; param_3[7] = ppppppppuVar9; goto LAB_2; } if (param_2 == 0x42) { if (param_3 != (undefined8 *********)0x0) { ppppppppuVar9 = param_1[0x74]; *param_3 = param_1[0x73]; param_3[1] = ppppppppuVar9; ppppppppuVar9 = param_1[0x76]; param_3[2] = param_1[0x75]; param_3[3] = ppppppppuVar9; ppppppppuVar9 = param_1[0x78]; param_3[4] = param_1[0x77]; param_3[5] = ppppppppuVar9; ppppppppuVar9 = param_1[0x7a]; param_3[6] = param_1[0x79]; param_3[7] = ppppppppuVar9; ppppppppuVar9 = param_1[0x7c]; param_3[8] = param_1[0x7b]; param_3[9] = ppppppppuVar9; ppppppppuVar9 = param_1[0x7e]; param_3[10] = param_1[0x7d]; param_3[0xb] = ppppppppuVar9; ppppppppuVar9 = param_1[0x80]; param_3[0xc] = param_1[0x7f]; param_3[0xd] = ppppppppuVar9; ppppppppuVar9 = param_1[0x82]; param_3[0xe] = param_1[0x81]; param_3[0xf] = ppppppppuVar9; ppppppppuVar9 = param_1[0x84]; param_3[0x10] = param_1[0x83]; param_3[0x11] = ppppppppuVar9; ppppppppuVar9 = param_1[0x86]; param_3[0x12] = param_1[0x85]; param_3[0x13] = ppppppppuVar9; ppppppppuVar9 = param_1[0x88]; param_3[0x14] = param_1[0x87]; param_3[0x15] = ppppppppuVar9; ppppppppuVar9 = param_1[0x8a]; param_3[0x16] = param_1[0x89]; param_3[0x17] = ppppppppuVar9; ppppppppuVar9 = param_1[0x8c]; param_3[0x18] = param_1[0x8b]; param_3[0x19] = ppppppppuVar9; } uVar19 = *(undefined4 *)(param_1 + 0x8d); goto LAB_10; } if (param_2 == 0x43) { iVar6 = UxQuicConnectionGetStatsV2 ((longlong)param_1[0x46],(ulonglong *)param_3,param_4,param_5); goto LAB_2; } if (param_2 == 0x44) { iVar6 = UxpQuicStreamGetStats ((longlong)param_1,param_3,(undefined4 *)param_4, (longlong)(param_1 + 0x8e)); goto LAB_2; } } - else if (param_2 == 0x46) { - if (UxKirSeHttpQueryCryptoParams != '\0') { + else { + if (param_2 == 0x46) { iVar6 = UxSslGetTlsCipherInfo(param_1[0x46] + 0x6d,param_3,(uint)param_4,param_5); goto LAB_2; } - } - else { if (param_2 == 0x47) { UxQuicSetTransportIdleConnectionTimeout ((longlong)param_1[0x46],*(ushort *)param_3,(longlong)pppppppppuVar16, (ulonglong)pppppuVar17); goto LAB_2; } if (param_2 == 0x48) { uVar5 = UxQuicGetTransportIdleConnectionTimeout((longlong)param_1[0x46]); *(ushort *)param_3 = uVar5; goto LAB_2; } if (param_2 == 0x49) { if (UxKirHttpBugFix25Q1 != '\0') { uVar7 = UxQuicErrorCodeFromHttpReceiveFault(*(int *)param_3); uVar14 = *(uint *)param_4; pppppppppuVar16 = (undefined8 *********)(ulonglong)uVar7; goto LAB_1; } } else { if (param_2 == 0x4a) { iVar6 = UxQuicSetDscpTag((longlong)param_1[0x46],*(byte *)param_3); goto LAB_2; } if (param_2 == 0x4b) { iVar6 = UxQuicGetDscpTag((longlong)param_1[0x46],(undefined1 *)param_3); goto LAB_2; } } } LAB_6: iVar6 = -0x3ffffffe; goto LAB_2; } if (param_2 == 0x3c) { bVar12 = *(byte *)((longlong)param_1 + 0x116); } else if ((int)param_2 < 0x34) { if (param_2 == 0x33) { iVar6 = UxQuicConnectionSendGoaway((ulonglong)param_1[0x46]); goto LAB_2; } if (param_2 != 0x28) { if (param_2 == 0x29) { ppppppppuVar9 = (undefined8 ********)UxQuicConnectionGetChannelBindToken((longlong)param_1[0x46]); goto LAB_8; } if (param_2 == 0x2a) goto LAB_2; if (param_2 == 0x2b) { bVar12 = (byte)(*(uint *)(param_1[0x46][0x66] + 0x56) >> 9); } else { if (param_2 != 0x2d) { - if (param_2 == 0x2e) { - uVar19 = *(undefined4 *)((longlong)param_1[0x46][0x66] + 0x31c); - goto LAB_15; + if (param_2 != 0x2e) { + if (param_2 == 0x30) { + iVar6 = UxQuicConnectionGetStatsV1 + ((longlong)param_1[0x46],(ulonglong *)param_3,param_4); + goto LAB_2; + } + if (param_2 == 0x31) goto LAB_11; + goto LAB_6; } - if (param_2 == 0x30) { - iVar6 = UxQuicConnectionGetStatsV1 - ((longlong)param_1[0x46],(ulonglong *)param_3,param_4); - goto LAB_2; - } - if (param_2 == 0x31) goto LAB_11; - goto LAB_6; + uVar19 = *(undefined4 *)((longlong)param_1[0x46][0x66] + 0x31c); +LAB_15: + *(undefined4 *)param_3 = uVar19; + goto LAB_2; } bVar12 = (byte)((ulonglong)param_1[0x46][0x66][0x62] >> 0x3c); } goto LAB_13; } bVar12 = param_1[0x46][0xcf] != (undefined8 *******)0x0; } else { if (param_2 == 0x34) { - ppppppppuVar9 = (undefined8 ********)param_1[0x46][0x153]; + ppppppppuVar9 = (undefined8 ********)param_1[0x46][0xff]; goto LAB_7; } if (param_2 == 0x35) { ppppppppuVar9 = param_1[0x46]; memset(param_3,0,0x204); iVar6 = UxSslCopySniToRequestProperty ((ushort *)(ppppppppuVar9 + 6),param_3,(longlong)ppppppppuVar9[0x66]); goto LAB_2; } if (param_2 == 0x36) { ppppppppuVar9 = param_1[0x5b]; *param_3 = param_1[0x5a]; param_3[1] = ppppppppuVar9; ppppppppuVar9 = param_1[0x5d]; param_3[2] = param_1[0x5c]; param_3[3] = ppppppppuVar9; ppppppppuVar9 = param_1[0x5f]; param_3[4] = param_1[0x5e]; param_3[5] = ppppppppuVar9; ppppppppuVar9 = param_1[0x61]; param_3[6] = param_1[0x60]; param_3[7] = ppppppppuVar9; ppppppppuVar9 = param_1[99]; param_3[8] = param_1[0x62]; param_3[9] = ppppppppuVar9; ppppppppuVar9 = param_1[0x65]; param_3[10] = param_1[100]; param_3[0xb] = ppppppppuVar9; ppppppppuVar9 = param_1[0x67]; param_3[0xc] = param_1[0x66]; param_3[0xd] = ppppppppuVar9; ppppppppuVar9 = param_1[0x69]; param_3[0xe] = param_1[0x68]; param_3[0xf] = ppppppppuVar9; ppppppppuVar9 = param_1[0x6b]; param_3[0x10] = param_1[0x6a]; param_3[0x11] = ppppppppuVar9; ppppppppuVar9 = param_1[0x6d]; param_3[0x12] = param_1[0x6c]; param_3[0x13] = ppppppppuVar9; ppppppppuVar9 = param_1[0x6f]; param_3[0x14] = param_1[0x6e]; param_3[0x15] = ppppppppuVar9; ppppppppuVar9 = param_1[0x71]; param_3[0x16] = param_1[0x70]; param_3[0x17] = ppppppppuVar9; param_3[0x18] = param_1[0x72]; goto LAB_2; } if (param_2 == 0x37) { if (*(uint *)param_3 < 0x10000) { *(short *)((longlong)param_1 + 0x26a) = (short)*(uint *)param_3; *(undefined1 *)((longlong)param_1 + 0x269) = 1; goto LAB_2; } goto LAB_12; } if (param_2 == 0x39) { bVar12 = *(byte *)(param_1 + 0x53); } else { if (param_2 == 0x3a) { uVar19 = *(undefined4 *)((longlong)param_1[0x46][0x66] + 0x324); -LAB_15: - *(undefined4 *)param_3 = uVar19; - goto LAB_2; + goto LAB_15; } if (param_2 != 0x3b) goto LAB_6; bVar12 = UxpQuicStreamIsRetriable((longlong)param_1); } } } LAB_14: *(byte *)param_3 = bVar12; LAB_2: if ((DAT_0 & 0x40) != 0) { - WPP_SF_L(0xaa,&WPP_4c597f134b723deaa2aa5fa3c3a75c7c_Traceguids,iVar6); + WPP_SF_L(0xaa,&WPP_7a4275336f2e3913c0500ab066a217e4_Traceguids,iVar6); } return iVar6; } ``` ## UlpCompleteSendCacheEntryWorker ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.62| |i_ratio|0.51| |m_ratio|0.96| |b_ratio|0.58| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpCompleteSendCacheEntryWorker|UlpCompleteSendCacheEntryWorker| |fullname|UlpCompleteSendCacheEntryWorker|UlpCompleteSendCacheEntryWorker| |`refcount`|19|18| |`length`|2264|2101| |`called`|
Expand for full list:
FUN_140159ae0
FUN_140159b15
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToLookasideListEx
NTOSKRNL.EXE::ExpInterlockedPushEntrySList
NTOSKRNL.EXE::IoQueueWorkItemEx
NTOSKRNL.EXE::KeGetCurrentIrql
NTOSKRNL.EXE::KeGetCurrentNodeNumber
NTOSKRNL.EXE::KeGetCurrentProcessorNumberEx
NTOSKRNL.EXE::KeSetEventNTOSKRNL.EXE::ObfReferenceObjectWithTag
NTOSKRNL.EXE::PsAttachSiloToCurrentThread
NTOSKRNL.EXE::PsDetachSiloFromCurrentThread
NTOSKRNL.EXE::PsGetCurrentServerSilo
NTOSKRNL.EXE::PsGetPermanentSiloContext
PplFreeToLookasideListProcessor
PplpLazyInitializeLookasideList
UlBugCheckEx
UlCheckinUriCacheEntry
UlCleanupRangeCacheTracker
UlCloseConnection
UlEtwEvaluateFilterForRequestConnection
UlGetHkeContextFromRequest
UlHkeCancelCalloutContext
UlHkeDereferenceCalloutContext
UlHkeIndicatePublishEntityRequest
UlLogHttpCacheResponse
UlResumeParsing
UlSetSendCompleteState
UlpActivateThreadPoolQueue
UlpAssignThreadPoolWork
UlpFreeHttpRequest
UxPodReferenceSilo
WPP_SF_
WPP_SF_I
WPP_SF_L
WPP_SF_Ll
WPP_SF_Lq
WPP_SF_iq
__security_check_cookie
_guard_dispatch_icall
memset
|
Expand for full list:
FUN_140159966
FUN_14015999b
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExFreeToLookasideListEx
NTOSKRNL.EXE::ExpInterlockedPushEntrySList
NTOSKRNL.EXE::IoQueueWorkItemEx
NTOSKRNL.EXE::KeGetCurrentIrql
NTOSKRNL.EXE::KeGetCurrentNodeNumber
NTOSKRNL.EXE::KeGetCurrentProcessorNumberEx
NTOSKRNL.EXE::KeSetEventNTOSKRNL.EXE::ObfReferenceObjectWithTag
NTOSKRNL.EXE::PsAttachSiloToCurrentThread
NTOSKRNL.EXE::PsDetachSiloFromCurrentThread
NTOSKRNL.EXE::PsGetCurrentServerSilo
NTOSKRNL.EXE::PsGetPermanentSiloContext
PplFreeToLookasideListProcessor
PplpLazyInitializeLookasideList
UlBugCheckEx
UlCheckinUriCacheEntry
UlCleanupRangeCacheTracker
UlCloseConnection
UlEtwEvaluateFilterForRequestConnection
UlGetHkeContextFromRequest
UlHkeCancelCalloutContext
UlHkeDereferenceCalloutContext
UlHkeIndicatePublishEntityRequest
UlLogHttpCacheResponse
UlResumeParsing
UlSetSendCompleteState
UlThreadPoolEnqueueWorkItem
UlpAssignThreadPoolWork
UlpFreeHttpRequest
WPP_SF_
WPP_SF_I
WPP_SF_L
WPP_SF_Ll
WPP_SF_Lq
WPP_SF_iq
__security_check_cookie
_guard_dispatch_icall
memset
| |calling||| |paramcount|4|4| |`address`|140043bb0|14003f1b0| |sig|undefined __fastcall UlpCompleteSendCacheEntryWorker(undefined8 * * * * * param_1, undefined * param_2, undefined8 * * * * * param_3, undefined8 * * * * param_4)|undefined __fastcall UlpCompleteSendCacheEntryWorker(undefined8 * * * * * param_1, undefined * param_2, undefined8 * * * * * param_3, undefined8 * * * * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpCompleteSendCacheEntryWorker Called Diff ```diff --- UlpCompleteSendCacheEntryWorker called +++ UlpCompleteSendCacheEntryWorker called @@ -1,2 +1,2 @@ -FUN_140159ae0 -FUN_140159b15 +FUN_140159966 +FUN_14015999b @@ -31 +31 @@ -UlpActivateThreadPoolQueue +UlThreadPoolEnqueueWorkItem @@ -34 +33,0 @@ -UxPodReferenceSilo ``` ### UlpCompleteSendCacheEntryWorker Diff ```diff --- UlpCompleteSendCacheEntryWorker +++ UlpCompleteSendCacheEntryWorker @@ -1,350 +1,329 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void UlpCompleteSendCacheEntryWorker (undefined8 *****param_1,undefined *param_2,undefined8 *****param_3, undefined8 ****param_4) { int iVar1; - ulonglong *puVar2; + undefined8 ****ppppuVar2; char cVar3; byte bVar4; ushort uVar5; uint uVar6; undefined8 *****pppppuVar7; undefined8 *****pppppuVar8; ulonglong uVar9; - undefined8 *****pppppuVar10; - undefined8 ****ppppuVar11; - undefined8 *****pppppuVar12; - undefined *puVar13; + undefined8 ******ppppppuVar10; + undefined8 *****pppppuVar11; + undefined *puVar12; + int *piVar13; undefined8 *****pppppuVar14; undefined8 ****ppppuVar15; undefined8 *puVar16; - undefined8 *****pppppuVar17; - longlong lVar18; + longlong lVar17; + code *pcVar18; undefined8 *****pppppuVar19; - undefined8 *****pppppuVar20; + undefined8 ******ppppppuVar20; bool bVar21; undefined1 auStackY_128 [32]; char local_e8; char local_e7; byte local_e6 [6]; - undefined8 ****local_e0; - undefined8 local_d8; + longlong local_e0 [2]; undefined8 *****pppppuStack_d0; undefined8 local_c8; undefined8 uStack_c0; undefined8 local_b8; undefined8 ****local_b0; undefined8 uStack_a8; undefined8 ****local_98 [5]; undefined4 local_70; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStackY_128; local_e8 = '\0'; if ((DAT_0 & 1) != 0) { - param_2 = &WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids; + param_2 = &WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids; param_3 = param_1; - WPP_SF_I(0xbf,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,param_1); + WPP_SF_I(0xbf,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,param_1); } pppppuVar8 = (undefined8 *****)param_1[0xc]; - pppppuVar10 = param_1 + -4; - pppppuVar14 = (undefined8 *****)pppppuVar8[3]; + pppppuVar14 = param_1 + -4; + ppppppuVar10 = (undefined8 ******)pppppuVar8[3]; uVar6 = *(uint *)(param_1 + 0x10); - ppppuVar11 = param_1[6]; + ppppuVar2 = param_1[6]; local_e7 = '\0'; local_e6[0] = 0; if ((int)uVar6 < 0) { ppppuVar15 = pppppuVar8[3]; if ((ppppuVar15 != (undefined8 ****)0x0) && (((ulonglong)ppppuVar15[0x89][0xdc] & 0x20) != 0)) { if (ppppuVar15[0x89][0xde] == (undefined8 **)0x0) { param_3 = pppppuVar8 + 9; param_4 = pppppuVar8[7]; McTemplateK0xsq_EtwWriteTransfer (pppppuVar8[3][0x89] + 0xd3,ppppuVar15,param_3,param_4,"SendCacheEntryFailed"); } else { param_3 = (undefined8 *****)0x0; - pppppuVar12 = pppppuVar8; + pppppuVar11 = pppppuVar8; bVar4 = UlEtwEvaluateFilterForRequestConnection((longlong)pppppuVar8,(longlong)ppppuVar15,0) ; if (bVar4 != 0) { - FUN_140159ae0(pppppuVar12,ppppuVar15); + FUN_140159966(pppppuVar11,ppppuVar15); return; } } } if ((char)DAT_0 < '\0') { param_4 = pppppuVar8[7]; - ppppuVar15 = (undefined8 ****)&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids; + ppppuVar15 = (undefined8 ****)&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids; param_3 = (undefined8 *****)(ulonglong)uVar6; - WPP_SF_Lq(0xc0,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,uVar6,param_4); + WPP_SF_Lq(0xc0,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,uVar6,param_4); } param_2 = (undefined *)CONCAT71((int7)((ulonglong)ppppuVar15 >> 8),1); - UlCloseConnection((longlong *)pppppuVar14,'\x01',(longlong *)param_3,(ulonglong)param_4); - } - pppppuVar12 = (undefined8 *****)&local_e7; - pppppuVar19 = (undefined8 *****)0x0; - puVar13 = (undefined *)CONCAT71((int7)((ulonglong)param_2 >> 8),1); + UlCloseConnection((longlong *)ppppppuVar10,'\x01',(longlong *)param_3,(ulonglong)param_4); + } + ppppppuVar20 = (undefined8 ******)&local_e7; + pcVar18 = (code *)0x0; + puVar12 = (undefined *)CONCAT71((int7)((ulonglong)param_2 >> 8),1); UlSetSendCompleteState - ((longlong *)pppppuVar8,puVar13,(longlong *)0x0,(byte *)pppppuVar12,local_e6,&local_e8, - (longlong)param_1[0x11],(longlong)ppppuVar11); + ((longlong *)pppppuVar8,puVar12,(longlong *)0x0,(byte *)ppppppuVar20,local_e6,&local_e8, + (longlong)param_1[0x11],(longlong)ppppuVar2); if (*(char *)(param_1[6] + 0x48) != '\0') { - puVar13 = (undefined *)0x0; - UlLogHttpCacheResponse((longlong)pppppuVar10,(undefined8 *****)0x0); - } - pppppuVar17 = (undefined8 *****)0x0; - pppppuVar20 = (undefined8 *****)0x1; + puVar12 = (undefined *)0x0; + UlLogHttpCacheResponse((longlong)pppppuVar14,(undefined8 *****)0x0); + } + pppppuVar11 = (undefined8 *****)0x0; + pppppuVar19 = (undefined8 *****)0x1; if ((local_e8 != '\0') && (((ulonglong)pppppuVar8[0x115] & 7) != 0)) { local_c8 = 0; uStack_c0 = 0; local_b8 = 0; local_b0 = (undefined8 ****)0x0; uStack_a8 = 0; if ((DAT_0 & 1) != 0) { - pppppuVar12 = (undefined8 *****)pppppuVar8[8]; - pppppuVar19 = pppppuVar8; - WPP_SF_iq(0xd7,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,pppppuVar8,pppppuVar12); + ppppppuVar20 = (undefined8 ******)pppppuVar8[8]; + pcVar18 = (code *)pppppuVar8; + WPP_SF_iq(0xd7,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,pppppuVar8,ppppppuVar20); } pppppuVar7 = (undefined8 *****)UlGetHkeContextFromRequest((longlong)pppppuVar8,0); if (pppppuVar7 != (undefined8 *****)0x0) { if ((*(int *)(pppppuVar7 + 0x11) == 0) && (*(int *)(pppppuVar7 + 0x20) == 1)) { pppppuVar8 = &local_b0; puVar16 = &local_c8; UlHkeIndicatePublishEntityRequest((longlong)pppppuVar7,puVar16,1,pppppuVar8); - FUN_140159b15(pppppuVar7,puVar16,pppppuVar20,pppppuVar8); + FUN_14015999b(pppppuVar7,puVar16,(undefined *)pppppuVar19,pppppuVar8); return; } - UlHkeCancelCalloutContext(pppppuVar7,0,(undefined *)pppppuVar19,pppppuVar12); + UlHkeCancelCalloutContext(pppppuVar7,0,pcVar18,ppppppuVar20); UlHkeDereferenceCalloutContext((int *)pppppuVar7,10); } pppppuVar7 = (undefined8 *****)UlGetHkeContextFromRequest((longlong)pppppuVar8,1); if (pppppuVar7 != (undefined8 *****)0x0) { - UlHkeCancelCalloutContext(pppppuVar7,0,(undefined *)pppppuVar19,pppppuVar12); + UlHkeCancelCalloutContext(pppppuVar7,0,pcVar18,ppppppuVar20); UlHkeDereferenceCalloutContext((int *)pppppuVar7,10); } - puVar13 = (undefined *)0x2; + puVar12 = (undefined *)0x2; pppppuVar7 = (undefined8 *****)UlGetHkeContextFromRequest((longlong)pppppuVar8,2); if (pppppuVar7 != (undefined8 *****)0x0) { - UlHkeCancelCalloutContext(pppppuVar7,0,(undefined *)pppppuVar19,pppppuVar12); - puVar13 = (undefined *)0xa; + UlHkeCancelCalloutContext(pppppuVar7,0,pcVar18,ppppppuVar20); + puVar12 = (undefined *)0xa; UlHkeDereferenceCalloutContext((int *)pppppuVar7,10); } if ((DAT_0 & 1) != 0) { - puVar13 = &WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids; - pppppuVar19 = pppppuVar17; - WPP_SF_L(0xd8,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,0); + puVar12 = &WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids; + pcVar18 = (code *)pppppuVar11; + WPP_SF_L(0xd8,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,0); } } if ((DAT_0 & 1) != 0) { - puVar13 = &WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids; - pppppuVar19 = pppppuVar10; - WPP_SF_I(0xc6,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,pppppuVar10); + puVar12 = &WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids; + pcVar18 = (code *)pppppuVar14; + WPP_SF_I(0xc6,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,pppppuVar14); } if (param_1[0xe] != (undefined8 ****)0x0) { - UlCleanupRangeCacheTracker((int *)param_1[0xe],puVar13,(int *)pppppuVar19,(int *)pppppuVar12); + UlCleanupRangeCacheTracker((int *)param_1[0xe],puVar12,(int *)pcVar18,(int *)ppppppuVar20); param_1[0xe] = (undefined8 ****)0x0; } if (*(char *)((longlong)param_1 + -0xc) == '\0') { pppppuVar7 = (undefined8 *****)0x0; *(undefined4 *)(param_1 + -2) = 0x61634c75; - ExFreePoolWithTag(pppppuVar10); + ExFreePoolWithTag(pppppuVar14); } else { bVar21 = UxDebugDisableLookaside == '\0'; *(undefined4 *)(param_1 + -2) = 0x41434c75; - lVar18 = DAT_1; + lVar17 = DAT_1; if (bVar21) { if (UxCompactMode == '\0') { - lVar18 = (ulonglong)(*(int *)pppppuVar10 + 1) * 0x80 + DAT_1; - if (*(char *)(lVar18 + 0xb0) == '\0') { - PplpLazyInitializeLookasideList(DAT_1,lVar18 + 0x40); + lVar17 = (ulonglong)(*(int *)pppppuVar14 + 1) * 0x80 + DAT_1; + if (*(char *)(lVar17 + 0xb0) == '\0') { + PplpLazyInitializeLookasideList(DAT_1,lVar17 + 0x40); } - ExFreeToLookasideListEx(lVar18 + 0x40); - pppppuVar7 = pppppuVar10; + ExFreeToLookasideListEx(lVar17 + 0x40); + pppppuVar7 = pppppuVar14; } else { uVar5 = KeGetCurrentNodeNumber(); - pppppuVar19 = (undefined8 *****)(ulonglong)uVar5; - PplFreeToLookasideListProcessor(lVar18,pppppuVar10,(uint)uVar5); - pppppuVar7 = pppppuVar10; + pcVar18 = (code *)(ulonglong)uVar5; + PplFreeToLookasideListProcessor(lVar17,pppppuVar14,(uint)uVar5); + pppppuVar7 = pppppuVar14; } } else { - pppppuVar19 = (undefined8 *****)0x60; + pcVar18 = (code *)0x60; memset(local_98,0,0x60); pppppuVar7 = local_98; local_70 = DAT_2; - (*(code *)PTR_UlFreeFromLookaside_140185218)(pppppuVar10); + (*(code *)PTR_UlFreeFromLookaside_140185218)(pppppuVar14); } } if ((DAT_0 & 1) != 0) { - pppppuVar7 = (undefined8 *****)&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids; - WPP_SF_(199,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,pppppuVar19,pppppuVar12); + pppppuVar7 = (undefined8 *****)&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids; + WPP_SF_(199,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,pcVar18,ppppppuVar20); } pppppuVar8[0xd4] = (undefined8 ****)0x0; - UlCheckinUriCacheEntry - ((longlong)ppppuVar11,pppppuVar7,(longlong)pppppuVar19,(longlong)pppppuVar12); + UlCheckinUriCacheEntry((longlong)ppppuVar2,pppppuVar7,(longlong)pcVar18,(longlong)ppppppuVar20); if (local_e7 != '\0') { - UlResumeParsing(pppppuVar14,(undefined8 *****)(ulonglong)local_e6[0],(undefined *)pppppuVar19, - pppppuVar12); + UlResumeParsing(ppppppuVar10,(undefined8 ******)(ulonglong)local_e6[0],pcVar18,ppppppuVar20); } pppppuVar14 = pppppuVar8 + 6; LOCK(); iVar1 = *(int *)pppppuVar14; *(int *)pppppuVar14 = *(int *)pppppuVar14 + -1; UNLOCK(); uVar6 = iVar1 - 1; if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar6)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(3,pppppuVar14,0x22,(longlong)(int)uVar6); } if (uVar6 != 0) goto LAB_3; if (DAT_4 < '\0') { - pppppuVar12 = (undefined8 *****)pppppuVar8[8]; + ppppppuVar20 = (undefined8 ******)pppppuVar8[8]; pppppuVar14 = (undefined8 *****)&WPP_682cf469470432b235cb9a4961616e40_Traceguids; - pppppuVar19 = pppppuVar8; - WPP_SF_iq(0x28,&WPP_682cf469470432b235cb9a4961616e40_Traceguids,pppppuVar8,pppppuVar12); + pcVar18 = (code *)pppppuVar8; + WPP_SF_iq(0x28,&WPP_682cf469470432b235cb9a4961616e40_Traceguids,pppppuVar8,ppppppuVar20); } if (((((ulonglong)pppppuVar8[0x11b] & 1) == 0) && (pppppuVar8[0x11e] == (undefined8 ****)0x0)) && (pppppuVar8[0x121] == (undefined8 ****)0x0)) { pppppuVar7 = pppppuVar8 + 0x9c; - pppppuVar10 = (undefined8 *****)pppppuVar8[3][0x88]; + ppppppuVar10 = (undefined8 ******)pppppuVar8[3][0x88]; if (((*pppppuVar7 != (undefined8 ****)0x0) || (pppppuVar8[0x9e] != (undefined8 ****)0x0)) || (pppppuVar8[0xa0] != (undefined8 ****)0x0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(1,pppppuVar7,"minio\\http\\sys\\httpconn.c",0x64d); } cVar3 = KeGetCurrentIrql(); if (cVar3 == '\0') { bVar21 = false; - local_d8 = 0; + local_e0[1] = 0; pppppuStack_d0 = (undefined8 *****)0x0; pppppuVar8 = pppppuStack_d0; - if ((pppppuVar10 == (undefined8 *****)0xffffffffffffffff) || - (pppppuVar8 = (undefined8 *****)PsAttachSiloToCurrentThread(pppppuVar10), bVar21 = true, + if ((ppppppuVar10 == (undefined8 ******)0xffffffffffffffff) || + (pppppuVar8 = (undefined8 *****)PsAttachSiloToCurrentThread(ppppppuVar10), bVar21 = true, (DAT_5 & 8) == 0)) { - pppppuVar10 = pppppuVar12; - UlpFreeHttpRequest(pppppuVar7,(undefined *)pppppuVar14,pppppuVar19,pppppuVar10); - pppppuVar12 = pppppuVar10; + ppppppuVar10 = ppppppuVar20; + UlpFreeHttpRequest(pppppuVar7,(undefined *)pppppuVar14,(undefined8 *****)pcVar18, + ppppppuVar10); + ppppppuVar20 = ppppppuVar10; if (!bVar21) goto LAB_6; } else { - puVar13 = &WPP_c3fb26de6cad32c9e0d538569f5edd7f_Traceguids; - pppppuVar19 = pppppuVar8; - WPP_SF_iq(0x19,&WPP_c3fb26de6cad32c9e0d538569f5edd7f_Traceguids,pppppuVar8,pppppuVar10); - UlpFreeHttpRequest(pppppuVar7,puVar13,pppppuVar19,pppppuVar10); + puVar12 = &WPP_c3fb26de6cad32c9e0d538569f5edd7f_Traceguids; + pcVar18 = (code *)pppppuVar8; + WPP_SF_iq(0x19,&WPP_c3fb26de6cad32c9e0d538569f5edd7f_Traceguids,pppppuVar8,ppppppuVar10); + UlpFreeHttpRequest(pppppuVar7,puVar12,(undefined8 *****)pcVar18,ppppppuVar10); } if ((DAT_5 & 8) != 0) { - pppppuVar19 = pppppuVar8; + pcVar18 = (code *)pppppuVar8; WPP_SF_I(0x1a,&WPP_c3fb26de6cad32c9e0d538569f5edd7f_Traceguids,pppppuVar8); } PsDetachSiloFromCurrentThread(pppppuVar8); - pppppuVar12 = pppppuVar10; + ppppppuVar20 = ppppppuVar10; } else { if (1 < DAT_7) { uVar9 = KeGetCurrentProcessorNumberEx(0); - pppppuVar17 = (undefined8 *****)((uVar9 & 0xffffffff) % (ulonglong)UxNumberOfProcessors); + pppppuVar11 = (undefined8 *****)((uVar9 & 0xffffffff) % (ulonglong)UxNumberOfProcessors); if (DAT_8 != '\0') { - uVar6 = UlpAssignThreadPoolWork(0x140188f40,(uint)pppppuVar17); - pppppuVar17 = (undefined8 *****)(ulonglong)uVar6; + uVar6 = UlpAssignThreadPoolWork(0x140188f00,(uint)pppppuVar11); + pppppuVar11 = (undefined8 *****)(ulonglong)uVar6; } } - if (pppppuVar10 == (undefined8 *****)0xffffffffffffffff) { - pppppuVar10 = (undefined8 *****)PsGetCurrentServerSilo(); - } - pppppuVar8[0xa0] = pppppuVar10; - local_e0 = (undefined8 ****)0x0; - if (pppppuVar10 != (undefined8 *****)0x0) { - ObfReferenceObjectWithTag(pppppuVar10,0x49576c55); - } - pppppuVar19 = &local_e0; - PsGetPermanentSiloContext(pppppuVar10,UxPodMonitorSlot); - ppppuVar11 = local_e0 + 3; + if (ppppppuVar10 == (undefined8 ******)0xffffffffffffffff) { + ppppppuVar10 = (undefined8 ******)PsGetCurrentServerSilo(); + } + pppppuVar8[0xa0] = ppppppuVar10; + local_e0[0] = 0; + if (ppppppuVar10 != (undefined8 ******)0x0) { + ObfReferenceObjectWithTag(ppppppuVar10,0x49576c55); + } + PsGetPermanentSiloContext(ppppppuVar10,UxPodMonitorSlot,local_e0); + piVar13 = (int *)(local_e0[0] + 0x18); LOCK(); - iVar1 = *(int *)ppppuVar11; - *(int *)ppppuVar11 = *(int *)ppppuVar11 + 1; + iVar1 = *piVar13; + *piVar13 = *piVar13 + 1; UNLOCK(); if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar1 + 1U)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,ppppuVar11,0xd,(longlong)(int)(iVar1 + 1U)); + UlBugCheckEx(3,piVar13,0xd,(longlong)(int)(iVar1 + 1U)); } *(undefined1 *)(pppppuVar8 + 0x9f) = 1; - pppppuVar14 = *(undefined8 ******)(DAT_9 + (longlong)pppppuVar17 * 8); + pcVar18 = UlpFreeHttpRequest; + ppppppuVar10 = *(undefined8 *******)(DAT_9 + (longlong)pppppuVar11 * 8); pppppuVar8[0x9e] = (undefined8 ****)UlpFreeHttpRequest; - lVar18 = ExpInterlockedPushEntrySList(pppppuVar14 + 2,pppppuVar7); - if (lVar18 == 0) { - pppppuVar19 = (undefined8 *****)0x0; - KeSetEvent(pppppuVar14 + 4,0); - if (*(char *)((longlong)*pppppuVar14 + 0x21) != '\0') { + lVar17 = ExpInterlockedPushEntrySList(ppppppuVar10 + 2,pppppuVar7); + if (lVar17 == 0) { + pcVar18 = (code *)0x0; + KeSetEvent(ppppppuVar10 + 4,0); + if (*(char *)((longlong)*ppppppuVar10 + 0x21) != '\0') { LOCK(); - bVar21 = *(int *)((longlong)pppppuVar14 + 0x44) == 0; + bVar21 = *(int *)((longlong)ppppppuVar10 + 0x44) == 0; if (bVar21) { - *(int *)((longlong)pppppuVar14 + 0x44) = 1; + *(int *)((longlong)ppppppuVar10 + 0x44) = 1; } UNLOCK(); if (bVar21) { if (DAT_10 < '\0') { WPP_SF_Ll(0x12,&WPP_2fbb22a52d1f39baf7a5c08a42f1533b_Traceguids, - *(undefined4 *)(pppppuVar14 + 1),*(undefined4 *)*pppppuVar14); + *(undefined4 *)(ppppppuVar10 + 1),*(undefined4 *)*ppppppuVar10); } LOCK(); - *(int *)(pppppuVar14 + 8) = *(int *)(pppppuVar14 + 8) + 1; + *(int *)(ppppppuVar10 + 8) = *(int *)(ppppppuVar10 + 8) + 1; UNLOCK(); ExAcquireRundownProtection(&UlThreadPoolIoWorkItemsRundown); - IoQueueWorkItemEx(pppppuVar14[7],UlpThreadPoolStarter); - pppppuVar19 = pppppuVar20; - pppppuVar12 = pppppuVar14; + IoQueueWorkItemEx(ppppppuVar10[7],UlpThreadPoolStarter); + pcVar18 = (code *)pppppuVar19; + ppppppuVar20 = ppppppuVar10; } } } } } else { pppppuVar14 = pppppuVar8 + 0x9c; - ppppuVar11 = (undefined8 ****)pppppuVar8[3][0x88]; if (((*pppppuVar14 != (undefined8 ****)0x0) || (pppppuVar8[0x9e] != (undefined8 ****)0x0)) || (pppppuVar8[0xa0] != (undefined8 ****)0x0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(1,pppppuVar14,"minio\\http\\sys\\httpconn.c",0x645); } - if (1 < DAT_7) { - uVar9 = KeGetCurrentProcessorNumberEx(0); - pppppuVar17 = (undefined8 *****)((uVar9 & 0xffffffff) % (ulonglong)UxNumberOfProcessors); - if (DAT_8 != '\0') { - uVar6 = UlpAssignThreadPoolWork(0x140188f40,(uint)pppppuVar17); - pppppuVar17 = (undefined8 *****)(ulonglong)uVar6; - } - } - if (ppppuVar11 == (undefined8 ****)0xffffffffffffffff) { - ppppuVar11 = (undefined8 ****)PsGetCurrentServerSilo(); - } - pppppuVar8[0xa0] = ppppuVar11; - pppppuVar19 = (undefined8 *****)0xd; - UxPodReferenceSilo((longlong)ppppuVar11,0x49576c55,0xd); - *(undefined1 *)(pppppuVar8 + 0x9f) = 1; - puVar2 = *(ulonglong **)(DAT_9 + (longlong)pppppuVar17 * 8); - pppppuVar8[0x9e] = (undefined8 ****)UlpFreeHttpRequest; - lVar18 = ExpInterlockedPushEntrySList(puVar2 + 2,pppppuVar14); - if (lVar18 == 0) { - pppppuVar19 = (undefined8 *****)0x0; - KeSetEvent(puVar2 + 4,0); - UlpActivateThreadPoolQueue(puVar2); - } + pcVar18 = UlpFreeHttpRequest; + ppppppuVar20 = (undefined8 ******)0x1; + UlThreadPoolEnqueueWorkItem + (0,(longlong)pppppuVar14,UlpFreeHttpRequest,'\x01',(longlong)pppppuVar8[3][0x88], + 0xffffffff); } LAB_6: if (DAT_4 < '\0') { - WPP_SF_(0x29,&WPP_682cf469470432b235cb9a4961616e40_Traceguids,pppppuVar19,pppppuVar12); + WPP_SF_(0x29,&WPP_682cf469470432b235cb9a4961616e40_Traceguids,pcVar18,ppppppuVar20); } LAB_3: if ((DAT_0 & 1) != 0) { - WPP_SF_(0xc1,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,pppppuVar19,pppppuVar12); + WPP_SF_(0xc1,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,pcVar18,ppppppuVar20); } return; } ``` ## UlpGenerateRangeResponseHeaders ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.77| |i_ratio|0.39| |m_ratio|0.93| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpGenerateRangeResponseHeaders|UlpGenerateRangeResponseHeaders| |fullname|UlpGenerateRangeResponseHeaders|UlpGenerateRangeResponseHeaders| |refcount|3|3| |`length`|460|522| |`called`|UlSetParsedHeader
UlUpdateParsedHeader
UlpGenerateContentRange
UlpHkeBuilderAddKnownHeader|UlSetParsedHeader
UlUpdateParsedHeader
UlpGenerateContentRange
UlpHkeBuilderAddKnownHeader
UlpHkeBuilderModifyStatusCode| |calling|UlPrepareParsedHeaderRangeResponse
UlpBuildParsedHeaderRangeResponseFromSlices|UlPrepareParsedHeaderRangeResponse
UlpBuildParsedHeaderRangeResponseFromSlices| |paramcount|10|10| |`address`|140102e88|1401034d8| |sig|int __fastcall UlpGenerateRangeResponseHeaders(int param_1, ulonglong * param_2, short param_3, char param_4, longlong * param_5, ulonglong param_6, ushort * param_7, uint param_8, longlong param_9, int * param_10)|int __fastcall UlpGenerateRangeResponseHeaders(int param_1, ulonglong * param_2, short param_3, char param_4, longlong * param_5, ulonglong param_6, ushort * param_7, uint param_8, longlong param_9, int * param_10)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpGenerateRangeResponseHeaders Called Diff ```diff --- UlpGenerateRangeResponseHeaders called +++ UlpGenerateRangeResponseHeaders called @@ -4,0 +5 @@ +UlpHkeBuilderModifyStatusCode ``` ### UlpGenerateRangeResponseHeaders Diff ```diff --- UlpGenerateRangeResponseHeaders +++ UlpGenerateRangeResponseHeaders @@ -1,70 +1,83 @@ int UlpGenerateRangeResponseHeaders (int param_1,ulonglong *param_2,short param_3,char param_4,longlong *param_5, ulonglong param_6,ushort *param_7,uint param_8,longlong param_9,int *param_10) { int iVar1; uint uVar2; undefined8 uVar3; char *pcVar4; - uint local_res20 [2]; + uint local_res18 [4]; + ushort local_48 [4]; + char *local_40; + local_48[2] = 0; + local_48[3] = 0; + *param_10 = 0; iVar1 = 0; - *param_10 = 0; - if (param_3 != 0xce) { - UlUpdateParsedHeader - (param_5,(ulonglong)*(uint *)(param_5 + 3),(longlong *)"206 Partial Content",3); + if (((param_3 != 0xce) && + (UlUpdateParsedHeader + (param_5,(ulonglong)*(uint *)(param_5 + 3),(longlong *)"206 Partial Content",3), + iVar1 = 0, UxKirHKERangeRequestH2StatusCode != '\0')) && (param_9 != 0)) { + local_48[0] = 0xce; + local_48[1] = 0xf; + local_40 = "Partial Content"; + uVar3 = UlpHkeBuilderModifyStatusCode(param_9,local_48); + iVar1 = (int)uVar3; + if (iVar1 < 0) { + return iVar1; + } } if (param_4 != '\0') { iVar1 = UlSetParsedHeader(param_5,"Accept-Ranges",0xd,(byte *)"bytes",5); if (iVar1 < 0) { return iVar1; } if (param_9 != 0) { uVar3 = UlpHkeBuilderAddKnownHeader(param_9,0x14,(ushort *)"bytes",5,1); iVar1 = (int)uVar3; if (iVar1 < 0) { return iVar1; } } } if (param_1 == 1) { if (5 < param_8) { param_7[0] = 0x7962; param_7[1] = 0x6574; param_7[2] = 0x2073; - local_res20[0] = param_8 - 6; - if (0x3e < local_res20[0]) { - uVar2 = UlpGenerateContentRange((char *)(param_7 + 3),local_res20,param_2,param_6); + local_res18[0] = param_8 - 6; + if (0x3e < local_res18[0]) { + uVar2 = UlpGenerateContentRange((char *)(param_7 + 3),local_res18,param_2,param_6); pcVar4 = (char *)((ulonglong)uVar2 + (longlong)(param_7 + 3)); iVar1 = UlSetParsedHeader(param_5,"Content-Range",0xd,(byte *)param_7, (int)pcVar4 - (int)param_7); if (iVar1 < 0) { return iVar1; } if (param_9 != 0) { uVar3 = UlpHkeBuilderAddKnownHeader(param_9,0x11,param_7,(short)pcVar4 - (short)param_7,1) ; iVar1 = (int)uVar3; if (iVar1 < 0) { return iVar1; } } goto LAB_0; } } iVar1 = -0x3fffff66; } else { UlUpdateParsedHeader (param_5,(ulonglong)*(uint *)((longlong)param_5 + 0x1c), (longlong *)"multipart/byteranges; boundary=" ,0x47); - local_res20[0] = param_8; + local_res18[0] = param_8; LAB_0: - *param_10 = param_8 - local_res20[0]; + *param_10 = param_8 - local_res18[0]; } return iVar1; } ``` ## UlpCheckIfBypassRangeProcessing ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.29| |i_ratio|0.11| |m_ratio|0.6| |b_ratio|0.19| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpCheckIfBypassRangeProcessing|UlpCheckIfBypassRangeProcessing| |fullname|UlpCheckIfBypassRangeProcessing|UlpCheckIfBypassRangeProcessing| |refcount|2|2| |`length`|367|965| |`called`|FindInETagList
StringTimeToSystemTime
UlAdjustRangesToContentSize
UlPrepareParsedHeader416Response
UlUpdateParsedHeader|FindInETagList
StringTimeToSystemTime
UlAdjustRangesToContentSize
UlPrepareParsedHeader416Response
UlUpdateParsedHeader
UlpHkeBuilderModifyStatusCode
WPP_SF_L
WPP_SF_id| |calling|UlPrepareParsedHeaderRangeResponse|UlPrepareParsedHeaderRangeResponse| |paramcount|3|3| |`address`|14008e754|14009a6c0| |`sig`|int __fastcall UlpCheckIfBypassRangeProcessing(longlong param_1, longlong param_2, undefined1 * param_3)|ulonglong __fastcall UlpCheckIfBypassRangeProcessing(longlong param_1, longlong param_2, undefined1 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpCheckIfBypassRangeProcessing Called Diff ```diff --- UlpCheckIfBypassRangeProcessing called +++ UlpCheckIfBypassRangeProcessing called @@ -5,0 +6,3 @@ +UlpHkeBuilderModifyStatusCode +WPP_SF_L +WPP_SF_id ``` ### UlpCheckIfBypassRangeProcessing Diff ```diff --- UlpCheckIfBypassRangeProcessing +++ UlpCheckIfBypassRangeProcessing @@ -1,62 +1,145 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -int UlpCheckIfBypassRangeProcessing(longlong param_1,longlong param_2,undefined1 *param_3) +ulonglong UlpCheckIfBypassRangeProcessing(longlong param_1,longlong param_2,undefined1 *param_3) { - int iVar1; - ulonglong uVar2; - longlong lVar3; - undefined8 uVar4; - ulonglong uVar5; + short *psVar1; + uint uVar2; + ulonglong uVar3; + longlong lVar4; + undefined8 uVar5; + ulonglong uVar6; + ulonglong uVar7; longlong local_res8; undefined8 local_res18 [2]; + ushort local_48 [4]; + char *local_40; - uVar5 = *(ulonglong *)(param_1 + 0x208); - iVar1 = 0; + uVar6 = *(ulonglong *)(param_1 + 0x208); local_res8 = 0; *param_3 = 0; if (((*(char *)(param_1 + 0xe8) != '\0') && (*(char *)(param_1 + 0xe9) == '\0')) || ((*(uint *)(param_1 + 0x94) & 2) != 0)) { - return -0x3ffffff3; + return 0xc000000d; } + uVar7 = 0; if (((*(char *)(param_2 + 0xa91) == '\0') && (*(int *)(param_2 + 0xa74) != 0)) || - (*(short *)(param_1 + 0x98) != 0xce)) { + (psVar1 = (short *)(param_1 + 0x98), *psVar1 != 0xce)) { if (*(char *)(param_2 + 0x690) == '\0') { LAB_0: - uVar5 = UlAdjustRangesToContentSize(param_2,uVar5); - if (uVar5 != 0) { + uVar6 = UlAdjustRangesToContentSize(param_2,uVar6); + if (uVar6 != 0) { return 0; } - iVar1 = UlPrepareParsedHeader416Response(param_1); + uVar2 = UlPrepareParsedHeader416Response(param_1); + uVar6 = (ulonglong)uVar2; goto LAB_1; } - uVar2 = StringTimeToSystemTime + uVar3 = StringTimeToSystemTime (*(char **)(param_2 + 0x450),(uint)*(ushort *)(param_2 + 0x458),&local_res8); - if ((char)uVar2 == '\0') { + if ((char)uVar3 == '\0') { if ((*(char **)(param_1 + 0x140) != (char *)0x0) && - (uVar4 = FindInETagList(*(char **)(param_1 + 0x140),*(byte **)(param_2 + 0x450),local_res18 - ,'\x01','\0'), (int)uVar4 == 0)) goto LAB_0; + (uVar5 = FindInETagList(*(char **)(param_1 + 0x140),*(byte **)(param_2 + 0x450),local_res18 + ,'\x01','\0'), (int)uVar5 == 0)) goto LAB_0; + uVar6 = uVar7; + if (*(short *)(param_1 + 0x98) != 0xce) goto LAB_1; + if (UxKirHKERangeRequestH2StatusCode == '\0') goto LAB_2; + local_48[2] = 0; + local_48[3] = 0; + if ((DAT_3 & 1) != 0) { + WPP_SF_id(10,&WPP_8c797f63d89b3f2a2db7260ef5ec5eff_Traceguids,param_1,0xce); + } + UlUpdateParsedHeader + ((longlong *)(param_1 + 0x2b8),(ulonglong)*(uint *)(param_1 + 0x2d0), + (longlong *)&s_200_OK,3); + *(undefined2 *)(*(longlong *)(param_1 + 0x18) + 0x69c) = 200; + *(undefined2 *)(param_1 + 0x98) = 200; } else { - lVar3 = *(longlong *)(param_1 + 0x118); + lVar4 = *(longlong *)(param_1 + 0x118); if (*(longlong *)(param_1 + 0x118) == 0) { - lVar3 = _DAT_2; + lVar4 = _DAT_4; } - if (lVar3 <= local_res8) goto LAB_0; + if (lVar4 <= local_res8) goto LAB_0; + uVar6 = 0; + if (*(short *)(param_1 + 0x98) != 0xce) goto LAB_1; + if (UxKirHKERangeRequestH2StatusCode == '\0') { +LAB_2: + UlUpdateParsedHeader + ((longlong *)(param_1 + 0x2b8),(ulonglong)*(uint *)(param_1 + 0x2d0), + (longlong *)&s_200_OK,3); + *(undefined2 *)(*(longlong *)(param_1 + 0x18) + 0x69c) = 200; + *(undefined2 *)(param_1 + 0x98) = 200; + goto LAB_5; + } + local_48[2] = 0; + local_48[3] = 0; + if ((DAT_3 & 1) != 0) { + WPP_SF_id(10,&WPP_8c797f63d89b3f2a2db7260ef5ec5eff_Traceguids,param_1,0xce); + } + UlUpdateParsedHeader + ((longlong *)(param_1 + 0x2b8),(ulonglong)*(uint *)(param_1 + 0x2d0), + (longlong *)&s_200_OK,3); + *(undefined2 *)(*(longlong *)(param_1 + 0x18) + 0x69c) = 200; + *(undefined2 *)(param_1 + 0x98) = 200; } - if (*(short *)(param_1 + 0x98) != 0xce) goto LAB_1; + if (*(longlong *)(param_1 + 0x200) != 0) { + *(undefined2 *)(*(longlong *)(param_1 + 0x200) + 0x78) = 200; + } + uVar7 = 0; + if (*(char *)(param_1 + 0x32) != '\0') { + local_40 = "OK"; + local_48[0] = 200; + local_48[1] = 2; + uVar7 = UlpHkeBuilderModifyStatusCode(*(longlong *)(param_1 + 0x220),local_48); + uVar7 = uVar7 & 0xffffffff; + } } - UlUpdateParsedHeader - ((longlong *)(param_1 + 0x2b8),(ulonglong)*(uint *)(param_1 + 0x2d0), - (longlong *)"200 OK",3); - *(undefined2 *)(*(longlong *)(param_1 + 0x18) + 0x69c) = 200; - *(undefined2 *)(param_1 + 0x98) = 200; - if (*(longlong *)(param_1 + 0x200) != 0) { - *(undefined2 *)(*(longlong *)(param_1 + 0x200) + 0x78) = 200; + else { + if (UxKirHKERangeRequestH2StatusCode == '\0') { + UlUpdateParsedHeader + ((longlong *)(param_1 + 0x2b8),(ulonglong)*(uint *)(param_1 + 0x2d0), + (longlong *)&s_200_OK,3); + *(undefined2 *)(*(longlong *)(param_1 + 0x18) + 0x69c) = 200; + *psVar1 = 200; +LAB_5: + uVar6 = uVar7; + if (*(longlong *)(param_1 + 0x200) != 0) { + *(undefined2 *)(*(longlong *)(param_1 + 0x200) + 0x78) = 200; + } + goto LAB_1; + } + local_48[2] = 0; + local_48[3] = 0; + if ((DAT_3 & 1) != 0) { + WPP_SF_id(10,&WPP_8c797f63d89b3f2a2db7260ef5ec5eff_Traceguids,param_1,0xce); + } + UlUpdateParsedHeader + ((longlong *)(param_1 + 0x2b8),(ulonglong)*(uint *)(param_1 + 0x2d0), + (longlong *)&s_200_OK,3); + *(undefined2 *)(*(longlong *)(param_1 + 0x18) + 0x69c) = 200; + *psVar1 = 200; + if (*(longlong *)(param_1 + 0x200) != 0) { + *(undefined2 *)(*(longlong *)(param_1 + 0x200) + 0x78) = 200; + } + if (*(char *)(param_1 + 0x32) != '\0') { + local_40 = "OK"; + local_48[0] = 200; + local_48[1] = 2; + uVar7 = UlpHkeBuilderModifyStatusCode(*(longlong *)(param_1 + 0x220),local_48); + uVar7 = uVar7 & 0xffffffff; + } + } + if ((DAT_3 & 1) != 0) { + WPP_SF_L(0xb,&WPP_8c797f63d89b3f2a2db7260ef5ec5eff_Traceguids,(int)uVar7); + } + uVar6 = uVar7; + if ((int)uVar7 < 0) { + return uVar7; } LAB_1: *param_3 = 1; - return iVar1; + return uVar6; } ``` ## UlQueryUrlGroupIoctl ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.79| |i_ratio|0.62| |m_ratio|0.96| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlQueryUrlGroupIoctl|UlQueryUrlGroupIoctl| |fullname|UlQueryUrlGroupIoctl|UlQueryUrlGroupIoctl| |refcount|2|2| |`length`|527|564| |called|NTOSKRNL.EXE::IoIs32bitProcess
UlGetCommChannel
UlQueryConfigGroupProperty
UxCompleteIrpForReturn
UxGetInputBuffer
UxGetOutputBufferForOutDirect
WPP_SF_L
WPP_SF_iq|NTOSKRNL.EXE::IoIs32bitProcess
UlGetCommChannel
UlQueryConfigGroupProperty
UxCompleteIrpForReturn
UxGetInputBuffer
UxGetOutputBufferForOutDirect
WPP_SF_L
WPP_SF_iq| |calling||| |paramcount|2|2| |`address`|1400c9770|1400c9e20| |sig|undefined __fastcall UlQueryUrlGroupIoctl(undefined8 * * * * * param_1, longlong param_2)|undefined __fastcall UlQueryUrlGroupIoctl(undefined8 * * * * * param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlQueryUrlGroupIoctl Diff ```diff --- UlQueryUrlGroupIoctl +++ UlQueryUrlGroupIoctl @@ -1,81 +1,90 @@ void UlQueryUrlGroupIoctl(undefined8 *****param_1,longlong param_2) { char cVar1; int iVar2; longlong lVar3; uint uVar4; uint local_res18 [2]; uint local_res20 [2]; longlong local_38; longlong local_30; int *local_28; longlong local_20; local_38 = 0; local_28 = (int *)0x0; local_30 = 0; local_res20[0] = 0; local_res18[0] = 0; local_20 = 0; if ((DAT_0 & 1) != 0) { - WPP_SF_iq(0x28,&WPP_093d4d9875f132d387d0435491be4d4d_Traceguids,param_1,param_2); + WPP_SF_iq(0x28,&WPP_3217c3b7128b385d96320719b5abbc38_Traceguids,param_1,param_2); } iVar2 = UlGetCommChannel(param_2,&local_20); if (iVar2 < 0) goto LAB_1; lVar3 = UxGetInputBuffer((longlong)param_1,param_2,0x20,&local_38); iVar2 = (int)lVar3; if (iVar2 < 0) goto LAB_1; + iVar2 = *(int *)(local_38 + 0x18); uVar4 = 8; - iVar2 = *(int *)(local_38 + 0x18); if (8 < iVar2) { if (iVar2 != 9) { if (iVar2 == 10) goto LAB_2; - if ((iVar2 != 0xb) && ((iVar2 == 0xc || (iVar2 != 0x12)))) goto LAB_3; + if (iVar2 != 0xb) { + if (iVar2 != 0xc) { + if (iVar2 == 0x12) goto LAB_3; + if ((iVar2 == 0x13) && (UxKirBrHttpQuerySocketTtl != '\0')) goto LAB_4; + } + goto LAB_5; + } } - goto LAB_4; +LAB_3: + uVar4 = 8; + goto LAB_6; } if ((iVar2 != 8) && (iVar2 != 0)) { if (iVar2 == 1) { -LAB_3: +LAB_5: iVar2 = -0x3ffffff3; goto LAB_1; } if (iVar2 == 2) { cVar1 = IoIs32bitProcess(param_1); - uVar4 = 8; - if (cVar1 != '\0') goto LAB_4; + if (cVar1 != '\0') goto LAB_6; +LAB_4: + uVar4 = 0x10; cVar1 = IoIs32bitProcess(param_1); lVar3 = (-(ulonglong)(cVar1 != '\0') & 0xfffffffffffffffc) + 8; - uVar4 = 0x10; } else { - if (iVar2 == 3) { - uVar4 = 0x14; + if (iVar2 != 3) { + if (iVar2 == 5) goto LAB_3; + goto LAB_5; } - else if (iVar2 != 5) goto LAB_3; -LAB_4: + uVar4 = 0x14; +LAB_6: IoIs32bitProcess(param_1); lVar3 = 4; } iVar2 = UxGetOutputBufferForOutDirect ((longlong)param_1,param_2,uVar4,lVar3,(longlong *)&local_28,&local_30, local_res18); if (iVar2 < 0) goto LAB_1; } LAB_2: iVar2 = UlQueryConfigGroupProperty (param_1,local_20,*(ulonglong *)(local_38 + 0x10),*(int *)(local_38 + 0x18), local_28,local_res18[0],local_30,(undefined8 ****)local_res20); if (((iVar2 + 0x80000000U & 0x80000000) != 0) || (iVar2 == -0x7ffffffb)) { param_1[7] = (undefined8 ****)(ulonglong)local_res20[0]; } LAB_1: if ((DAT_0 & 1) != 0) { - WPP_SF_L(0x29,&WPP_093d4d9875f132d387d0435491be4d4d_Traceguids,iVar2); + WPP_SF_L(0x29,&WPP_3217c3b7128b385d96320719b5abbc38_Traceguids,iVar2); } UxCompleteIrpForReturn((longlong)param_1,iVar2); return; } ``` ## UlCopyRequestToIrp ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.68| |i_ratio|0.64| |m_ratio|0.99| |b_ratio|0.81| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlCopyRequestToIrp|UlCopyRequestToIrp| |fullname|UlCopyRequestToIrp|UlCopyRequestToIrp| |refcount|5|5| |`length`|2764|2862| |`called`|
Expand for full list:
McTemplateK0pxqzzq_EtwWriteTransfer
NTOSKRNL.EXE::IoGetRequestorProcess
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::PsGetProcessId
UlChannelBindRequestInfoPresent
UlChargeRequestQueueQuota
UlCloseConnection
UlEtwEvaluateFilterForRequestConnection
UlGetQuicCreationStatsV2SizeUlGetTransportIdleConnectionTimeout
UlGetUserAuthInfoSize
UlGetUserChannelBindInfoSize
UlGetUserTokenBindingInfoSize
UlStartRequestQueueTimer
UlUpdateReceiveHttpRequestApiTimings
UlpCopyRequestToBuffer
WPP_SF_I
WPP_SF_L
WPP_SF_dlllll
WPP_SF_dllllll
WPP_SF_dqiqZLSiqddP
WPP_SF_iq
WPP_SF_qII
WPP_SF_qLqqqq
_guard_dispatch_icall
memset
|
Expand for full list:
McTemplateK0pxqzzq_EtwWriteTransfer
NTOSKRNL.EXE::IoGetRequestorProcess
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::PsGetProcessId
UlChannelBindRequestInfoPresent
UlChargeRequestQueueQuota
UlCloseConnection
UlEtwEvaluateFilterForRequestConnection
UlGetQuicCreationStatsV2SizeUlGetTransportIdleConnectionTimeout
UlGetUserAuthInfoSize
UlGetUserChannelBindInfoSize
UlGetUserTokenBindingInfoSize
UlStartRequestQueueTimer
UlUpdateReceiveHttpRequestApiTimings
UlpCopyRequestToBuffer
WPP_SF_I
WPP_SF_L
WPP_SF_dllllll
WPP_SF_dqiqZLSiqddP
WPP_SF_iq
WPP_SF_qII
WPP_SF_qLqqqq
_guard_dispatch_icall
memset
| |calling|UlReceiveHttpRequest
UlpDispatchToRequestQueue
UlpSynchronizeLanesWorker|UlReceiveHttpRequest
UlpDispatchToRequestQueue
UlpSynchronizeLanesWorker| |paramcount|5|5| |`address`|140049bb4|140045104| |sig|undefined __fastcall UlCopyRequestToIrp(uint * param_1, longlong param_2, uint * param_3, uint * param_4, char param_5)|undefined __fastcall UlCopyRequestToIrp(uint * param_1, longlong param_2, uint * param_3, uint * param_4, char param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlCopyRequestToIrp Called Diff ```diff --- UlCopyRequestToIrp called +++ UlCopyRequestToIrp called @@ -21 +20,0 @@ -WPP_SF_dlllll ``` ### UlCopyRequestToIrp Diff ```diff --- UlCopyRequestToIrp +++ UlCopyRequestToIrp @@ -1,513 +1,543 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void UlCopyRequestToIrp(uint *param_1,longlong param_2,uint *param_3,uint *param_4,char param_5) { ushort uVar1; undefined4 uVar2; code *pcVar3; char cVar4; byte bVar5; uint uVar6; undefined8 uVar7; uint *_Size; ulonglong uVar8; uint *puVar9; void *_Dst; longlong *plVar10; wchar_t *pwVar11; int iVar12; uint uVar13; uint *puVar14; - char cVar15; + uint *puVar15; uint *puVar16; - undefined8 *puVar17; - bool bVar18; - byte local_res10; + char cVar17; + uint *puVar18; + longlong *plVar19; + byte local_res10 [8]; + uint *local_res18; + uint *local_res20; ulonglong in_stack_ffffffffffffff08; undefined8 in_stack_ffffffffffffff10; - longlong lVar19; - undefined4 uVar20; - char local_a7; + longlong lVar20; + undefined4 uVar21; + char local_a8; + byte local_a7; byte local_a6; byte local_a5; - byte local_a4; + undefined1 local_a4; byte local_a3; byte local_a2; byte local_a1; byte local_a0; byte local_9f; byte local_9e; byte local_9d; byte local_9c; byte local_9b; + byte local_9a; uint local_98; short local_94 [2]; int local_90; uint local_8c; int local_88 [2]; longlong local_80; uint local_78; undefined4 local_74; uint local_70 [2]; undefined8 uStack_68; undefined8 local_60; undefined8 uStack_58; undefined8 local_50; undefined8 uStack_48; int *local_40; - uVar20 = (undefined4)((ulonglong)in_stack_ffffffffffffff10 >> 0x20); + uVar21 = (undefined4)((ulonglong)in_stack_ffffffffffffff10 >> 0x20); local_78 = local_78 & 0xffffff00; uVar2 = *(undefined4 *)(*(longlong *)(param_3 + 2) + 0x114); _Size = param_3; puVar9 = param_4; + local_res18 = param_3; + local_res20 = param_4; local_74 = uVar2; if ((DAT_0 & 0x20) != 0) { uVar7 = IoGetRequestorProcess(param_2); _Size = (uint *)PsGetProcessId(uVar7); - WPP_SF_I(0x18,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,_Size); + WPP_SF_I(0x17,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,_Size); } local_80 = *(longlong *)(param_2 + 0xb8); if (param_3[10] == 1) { uVar8 = UlChargeRequestQueueQuota((longlong)param_1); - puVar16 = (uint *)(uVar8 & 0xffffffff); + puVar18 = (uint *)(uVar8 & 0xffffffff); + puVar14 = param_4; + puVar15 = param_3; if (-1 < (int)uVar8) goto LAB_1; } else { LAB_1: local_90 = 0; local_88[0] = 0; local_70[0] = 0; local_70[1] = 0; uStack_68 = 0; local_40 = (int *)0x0; local_60 = 0; uStack_58 = 0; local_8c = 0; local_50 = 0; uStack_48 = 0; - local_a1 = 0; local_a0 = 0; local_9f = 0; local_9e = 0; local_9d = 0; local_9c = 0; local_9b = 0; + local_9a = 0; if ((DAT_2 & 0x40) != 0) { if (param_1 == (uint *)0x0) { uVar7 = 0; } else { uVar7 = *(undefined8 *)(param_1 + 0x10); } in_stack_ffffffffffffff08 = param_2; - WPP_SF_qII(0xf,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,param_1,uVar7); + WPP_SF_qII(0xe,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,param_1,uVar7); } cVar4 = IoIs32bitProcess(param_2); uVar1 = (ushort)param_1[0x1ef]; if (cVar4 == '\0') { iVar12 = ((uint)uVar1 + (uint)uVar1 * 2) * 8 + 0x3a0; } else { iVar12 = ((uint)uVar1 + (uint)uVar1 * 2) * 4 + 0x218; } - lVar19 = *(longlong *)(param_1 + 6); + lVar20 = *(longlong *)(param_1 + 6); iVar12 = param_1[0x1ee] + iVar12; - if (*(char *)(lVar19 + 0x1d1) == '\0') { + if (*(char *)(lVar20 + 0x1d1) == '\0') { LAB_3: local_94[0] = 0; - local_a7 = '\0'; - local_res10 = 0; - local_a3 = 0; - local_a2 = 0; + local_a8 = '\0'; + local_a4 = 0; + local_a7 = 0; + local_a6 = 0; + local_a5 = 0; + local_res10[0] = 0; if ((DAT_2 & 0x40) != 0) { - WPP_SF_iq(10,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,param_1, + WPP_SF_iq(10,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,param_1, *(undefined8 *)(param_1 + 0x10)); } puVar9 = *(uint **)(param_1 + 6); uVar6 = (uint)((char)puVar9[0x78] != '\0'); uVar13 = uVar6 + 4; if (((param_1[0x236] & 1) != 0) && (uVar13 = uVar6 + 4, (param_1[0x236] & 2) == 0)) { - local_res10 = 1; + local_a7 = 1; uVar13 = uVar6 + 5; } uVar8 = UlChannelBindRequestInfoPresent((longlong)param_1); - local_a6 = (char)uVar8 != '\0'; + local_a3 = (char)uVar8 != '\0'; uVar6 = uVar13 + 1; if ((char)uVar8 == '\0') { uVar6 = uVar13; } - local_a5 = *(char *)((longlong)puVar9 + 0x1d1) != '\0'; + local_a2 = *(char *)((longlong)puVar9 + 0x1d1) != '\0'; uVar13 = uVar6 + 1; if (*(char *)((longlong)puVar9 + 0x1d1) == '\0') { uVar13 = uVar6; } _Size = (uint *)(ulonglong)uVar13; - local_a4 = *(longlong *)(puVar9 + 0xdc) != 0; + local_a1 = *(longlong *)(puVar9 + 0xdc) != 0; local_98 = uVar13 + 1; if (*(longlong *)(puVar9 + 0xdc) == 0) { local_98 = uVar13; } uVar8 = UlGetTransportIdleConnectionTimeout((longlong)puVar9,local_94); - puVar16 = (uint *)(uVar8 & 0xffffffff); + puVar18 = (uint *)(uVar8 & 0xffffffff); if (-1 < (int)uVar8) { - bVar18 = local_94[0] != 0; - if (bVar18) { + if (local_94[0] != 0) { local_98 = local_98 + 1; - } - if ((UxKirBrHttpQuerySocketTtl != 0) && - (*(char *)(*(longlong *)(param_1 + 6) + 0x1e0) != '\0')) { - local_98 = local_98 + 1; - local_a2 = 1; + local_a6 = 1; + } + if ((((UxKirBrHttpQuerySocketTtl != 0) && ((char)param_1[399] != '\0')) && + (*(char *)((longlong)param_1 + 0x63d) != '\0')) && + (lVar20 = *(longlong *)(param_1 + 6), *(char *)(lVar20 + 0x1e0) != '\0')) { + if ((DAT_4 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, + (undefined8 *)(lVar20 + 0x1f0),0x4c); + } + puVar9 = (uint *)local_res10; + uVar21 = 0; + in_stack_ffffffffffffff08 = 0; + uVar13 = (**(code **)(*(longlong *)(lVar20 + 0x1f8) + 0x88)) + (*(undefined8 *)(lVar20 + 0x1f0),0x4c,&local_a4,puVar9,0,0); + puVar18 = (uint *)(ulonglong)uVar13; + if ((DAT_4 & 1) != 0) { + WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar13); + } + _Size = (uint *)0x1; + if ((int)uVar13 < 0) goto LAB_5; + if (local_res10[0] != 0) { + local_98 = local_98 + 1; + } if ((DAT_2 & 0x40) != 0) { - _Size = (uint *)0x1; - WPP_SF_L(0xb,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,1); - } - } - if (UxKirHttpDscp == 0) { + WPP_SF_L(0xb,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,(uint)local_res10[0]); + } + } + lVar20 = *(longlong *)(param_1 + 6); + if ((DAT_4 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,lVar20 + 0x1f0,0x4b); + } + _Size = (uint *)&local_a8; + uVar21 = 0; + puVar9 = (uint *)0x0; + in_stack_ffffffffffffff08 = 0; + uVar13 = (**(code **)(*(longlong *)(lVar20 + 0x1f8) + 0x88)) + (*(undefined8 *)(lVar20 + 0x1f0),0x4b,_Size,0,0,0); + puVar18 = (uint *)(ulonglong)uVar13; + if ((DAT_4 & 1) != 0) { + _Size = (uint *)(ulonglong)uVar13; + WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar13); + } + if (-1 < (int)uVar13) { + if (local_a8 != '\0') { + local_98 = local_98 + 1; + local_a5 = 1; + } + puVar15 = (uint *)(ulonglong)local_98; if ((DAT_2 & 0x40) != 0) { - puVar9 = (uint *)(ulonglong)local_res10; + puVar9 = (uint *)(ulonglong)local_a7; in_stack_ffffffffffffff08 = in_stack_ffffffffffffff08 & 0xffffffff00000000; - _Size = (uint *)(ulonglong)local_98; - WPP_SF_dlllll((ulonglong)local_a4,(ulonglong)local_a5,local_98,(uint)local_res10); - } - } - else { - lVar19 = *(longlong *)(param_1 + 6); - if ((DAT_4 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,lVar19 + 0x1f0,0x4b); - } - _Size = (uint *)&local_a7; - puVar9 = (uint *)0x0; - uVar20 = 0; - in_stack_ffffffffffffff08 = 0; - uVar13 = (**(code **)(*(longlong *)(lVar19 + 0x1f8) + 0x88)) - (*(undefined8 *)(lVar19 + 0x1f0),0x4b,_Size,0,0,0); - puVar16 = (uint *)(ulonglong)uVar13; - if ((DAT_4 & 1) != 0) { - _Size = (uint *)(ulonglong)uVar13; - WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar13); - } - if ((int)uVar13 < 0) goto LAB_5; - if (local_a7 != '\0') { - local_98 = local_98 + 1; - local_a3 = 1; - } - puVar14 = (uint *)(ulonglong)local_98; - if ((DAT_2 & 0x40) != 0) { - puVar9 = (uint *)(ulonglong)local_res10; - in_stack_ffffffffffffff08 = in_stack_ffffffffffffff08 & 0xffffffff00000000; - WPP_SF_dllllll((ulonglong)bVar18,(ulonglong)local_a4,local_98,(uint)local_res10); - _Size = puVar14; - } - } - local_8c = local_98; - local_a1 = local_res10; - local_a0 = local_a6; - local_9f = local_a5; - local_9e = local_a4; - local_9c = local_a3; - local_9b = local_a2; - local_9d = bVar18; + WPP_SF_dllllll((ulonglong)local_a6,(ulonglong)local_a1,local_98,(uint)local_a7); + _Size = puVar15; + } + local_8c = local_98; + local_a0 = local_a7; + local_9f = local_a3; + local_9e = local_a2; + local_9d = local_a1; + local_9c = local_a6; + local_9b = local_a5; + local_9a = local_res10[0]; + } } LAB_5: if ((DAT_2 & 0x40) != 0) { - _Size = puVar16; - WPP_SF_L(0xe,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,(int)puVar16); + _Size = puVar18; + WPP_SF_L(0xd,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,(int)puVar18); } bVar5 = 0; - puVar14 = (uint *)0x0; - if ((int)puVar16 < 0) goto LAB_6; + puVar16 = (uint *)0x0; + if ((int)puVar18 < 0) goto LAB_6; if (cVar4 == '\0') { uVar13 = (iVar12 + 7U & 0xfffffff8) + local_8c * 0x10; } else { uVar13 = (iVar12 + 3U & 0xfffffffc) + local_8c * 0xc; } - if (local_a1 != 0) { + if (local_a0 != 0) { bVar5 = 0; if (cVar4 == '\0') { iVar12 = UlGetUserAuthInfoSize(param_1 + 0x236,'\0'); uVar13 = uVar13 + 7 & 0xfffffff8; } else { iVar12 = UlGetUserAuthInfoSize(param_1 + 0x236,'\x01'); } uVar13 = uVar13 + iVar12; } - if (local_a0 != bVar5) { + if (local_9f != bVar5) { if (cVar4 == '\0') { iVar12 = UlGetUserChannelBindInfoSize((longlong)param_1,'\0'); uVar13 = uVar13 + 7 & 0xfffffff8; } else { iVar12 = UlGetUserChannelBindInfoSize((longlong)param_1,'\x01'); uVar13 = uVar13 + 3 & 0xfffffffc; } uVar13 = uVar13 + iVar12; bVar5 = 0; } - if (local_9f != bVar5) { + if (local_9e != bVar5) { if (cVar4 == '\0') { uVar13 = uVar13 + 7 & 0xfffffff8; } else { uVar13 = uVar13 + 3 & 0xfffffffc; } uVar13 = uVar13 + 0x1c; } - if (local_9e != bVar5) { + if (local_9d != bVar5) { if (cVar4 == '\0') { iVar12 = UlGetUserTokenBindingInfoSize(*(longlong *)(param_1 + 6) + 0x370,0); uVar13 = (uVar13 + 7 & 0xfffffff8) + iVar12; bVar5 = 0; } else { iVar12 = UlGetUserTokenBindingInfoSize(*(longlong *)(param_1 + 6) + 0x370,1); uVar13 = (uVar13 + 3 & 0xfffffffc) + iVar12; bVar5 = 0; } } _Size = (uint *)0xfffffffc; - if (local_9d != bVar5) { + if (local_9c != bVar5) { if (cVar4 == '\0') { uVar13 = uVar13 + 7 & 0xfffffff8; } else { uVar13 = uVar13 + 3 & 0xfffffffc; } uVar13 = uVar13 + 2; } - if ((UxKirHttpDscp != bVar5) && (local_9c != bVar5)) { + if (local_9b != bVar5) { if (cVar4 == '\0') { uVar13 = uVar13 + 7 & 0xfffffff8; } else { uVar13 = uVar13 + 3 & 0xfffffffc; } uVar13 = uVar13 + 1; } - if ((UxKirBrHttpQuerySocketTtl == bVar5) || (local_9b == bVar5)) { + if ((UxKirBrHttpQuerySocketTtl == bVar5) || (local_9a == bVar5)) { if (cVar4 == '\0') goto LAB_7; LAB_8: uVar13 = uVar13 + 0xfb & 0xfffffffc; } else { if (cVar4 != '\0') { uVar13 = (uVar13 + 3 & 0xfffffffc) + 1; goto LAB_8; } uVar13 = (uVar13 + 7 & 0xfffffff8) + 1; LAB_7: uVar13 = uVar13 + 0xff & 0xfffffff8; } if (*(byte *)(*(longlong *)(param_1 + 6) + 0x1e0) == bVar5) { uVar6 = UlGetQuicCreationStatsV2Size((longlong)param_1,local_88); - puVar16 = (uint *)(ulonglong)uVar6; + puVar18 = (uint *)(ulonglong)uVar6; if ((int)uVar6 < 0) goto LAB_6; if (cVar4 == '\0') { uVar13 = uVar13 + 0x107 & 0xfffffff8; } else { uVar13 = uVar13 + 0x100; } uVar13 = uVar13 + local_88[0]; } else { if (cVar4 == '\0') { uVar13 = uVar13 + 0x3f & 0xfffffff8; } else { uVar13 = uVar13 + 0x38; } uVar13 = uVar13 + 0x98; } - puVar14 = (uint *)(ulonglong)uVar13; + puVar16 = (uint *)(ulonglong)uVar13; if ((DAT_2 & 0x40) != 0) { - _Size = puVar14; - WPP_SF_L(0x10,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,uVar13); + _Size = puVar16; + WPP_SF_L(0xf,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,uVar13); goto LAB_6; } } else { local_40 = &local_90; uStack_68 = CONCAT71(uStack_68._1_7_,cVar4 != '\0'); if ((DAT_4 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,lVar19 + 0x1f0,0x25); + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,lVar20 + 0x1f0,0x25); } _Size = local_70; puVar9 = (uint *)0x0; - uVar20 = 0; + uVar21 = 0; in_stack_ffffffffffffff08 = 0; - uVar13 = (**(code **)(*(longlong *)(lVar19 + 0x1f8) + 0x88))(*(undefined8 *)(lVar19 + 0x1f0)); - puVar16 = (uint *)(ulonglong)uVar13; + uVar13 = (**(code **)(*(longlong *)(lVar20 + 0x1f8) + 0x88))(*(undefined8 *)(lVar20 + 0x1f0)); + puVar18 = (uint *)(ulonglong)uVar13; if ((DAT_4 & 1) != 0) { _Size = (uint *)(ulonglong)uVar13; WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar13); } - puVar14 = (uint *)0x0; + puVar16 = (uint *)0x0; if (-1 < (int)uVar13) { if (cVar4 == '\0') { uVar13 = iVar12 + 7U & 0xfffffff8; } else { uVar13 = iVar12 + 3U & 0xfffffffc; } iVar12 = uVar13 + local_90; goto LAB_3; } LAB_6: if ((DAT_2 & 0x40) != 0) { - _Size = puVar16; - WPP_SF_L(0x11,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,(int)puVar16); - } - } - lVar19 = local_80; - if (-1 < (int)puVar16) { + _Size = puVar18; + WPP_SF_L(0x10,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,(int)puVar18); + } + } + lVar20 = local_80; + puVar14 = local_res20; + puVar15 = local_res18; + if (-1 < (int)puVar18) { uVar13 = local_78; if ((short)uVar2 == 1) { uVar13 = local_78 & 0xff; if (local_74._2_2_ == 0) { uVar13 = 1; } } - if (*(uint *)(local_80 + 8) < (uint)puVar14) { + if (*(uint *)(local_80 + 8) < (uint)puVar16) { cVar4 = IoIs32bitProcess(param_2); - cVar15 = (char)uVar13; - if (cVar4 == '\0') { - uVar13 = (-(uint)(cVar15 != '\0') & 0xfffffff0) + 0x360; + cVar17 = (char)uVar13; + if (cVar4 == '\0') { + uVar13 = (-(uint)(cVar17 != '\0') & 0xfffffff0) + 0x360; } else { uVar13 = (uVar13 & 0xff ^ 1) * 8 + 0x1d0; } - if (*(uint *)(lVar19 + 8) < uVar13) { - puVar16 = (uint *)0xc0000023; + if (*(uint *)(lVar20 + 8) < uVar13) { + puVar18 = (uint *)0xc0000023; + puVar14 = local_res20; + puVar15 = local_res18; } else { if ((*(byte *)(*(longlong *)(param_2 + 8) + 10) & 5) == 0) { puVar9 = (uint *)0x0; _Size = (uint *)0x1; _Dst = (void *)MmMapLockedPagesSpecifyCache(); } else { _Dst = *(void **)(*(longlong *)(param_2 + 8) + 0x18); } if (_Dst == (void *)0x0) { - puVar16 = (uint *)0xc000009a; + puVar18 = (uint *)0xc000009a; + puVar14 = local_res20; + puVar15 = local_res18; } else { cVar4 = IoIs32bitProcess(param_2); if (cVar4 == '\0') { _Size = (uint *)0x350; - if (cVar15 == '\0') { + if (cVar17 == '\0') { _Size = (uint *)0x360; } memset(_Dst,0,(size_t)_Size); *(undefined8 *)((longlong)_Dst + 0x10) = *(undefined8 *)(param_1 + 0xe); *(undefined8 *)((longlong)_Dst + 8) = *(undefined8 *)(param_1 + 8); *(undefined8 *)((longlong)_Dst + 0x340) = *(undefined8 *)(param_1 + 10); } else { _Size = (uint *)0x1d0; - if (cVar15 == '\0') { + if (cVar17 == '\0') { _Size = (uint *)0x1d8; } memset(_Dst,0,(size_t)_Size); *(undefined8 *)((longlong)_Dst + 0x10) = *(undefined8 *)(param_1 + 0xe); *(undefined8 *)((longlong)_Dst + 8) = *(undefined8 *)(param_1 + 8); *(undefined8 *)((longlong)_Dst + 0x1c0) = *(undefined8 *)(param_1 + 10); } - puVar16 = (uint *)0x80000005; - *(uint **)(param_2 + 0x38) = puVar14; + puVar18 = (uint *)0x80000005; + *(uint **)(param_2 + 0x38) = puVar16; + puVar14 = local_res20; + puVar15 = local_res18; } } } else { - lVar19 = *(longlong *)(param_2 + 8); - if ((*(byte *)(lVar19 + 10) & 5) == 0) { - uVar7 = CONCAT44(uVar20,0x40000000); + lVar20 = *(longlong *)(param_2 + 8); + if ((*(byte *)(lVar20 + 10) & 5) == 0) { + uVar7 = CONCAT44(uVar21,0x40000000); _Size = (uint *)0x1; puVar9 = (uint *)MmMapLockedPagesSpecifyCache - (lVar19,0,1,0,in_stack_ffffffffffffff08 & 0xffffffff00000000, + (lVar20,0,1,0,in_stack_ffffffffffffff08 & 0xffffffff00000000, uVar7); - uVar20 = (undefined4)((ulonglong)uVar7 >> 0x20); - } - else { - puVar9 = *(uint **)(lVar19 + 0x18); - } + uVar21 = (undefined4)((ulonglong)uVar7 >> 0x20); + } + else { + puVar9 = *(uint **)(lVar20 + 0x18); + } + puVar15 = local_res18; if (puVar9 == (uint *)0x0) { - puVar16 = (uint *)0xc000009a; - } - else { - _Size = param_3; + puVar18 = (uint *)0xc000009a; + puVar14 = local_res20; + } + else { + _Size = local_res18; UlpCopyRequestToBuffer - ((byte *)param_1,param_2,(ulonglong)param_3,puVar9, - (ulonglong)*(uint *)(*(longlong *)(param_2 + 8) + 0x2c) + - *(longlong *)(*(longlong *)(param_2 + 8) + 0x20),*(uint *)(local_80 + 8), - (char)puVar14,*(uint *)(*(longlong *)(param_2 + 0x18) + 8),param_5, + ((byte *)param_1,param_2,(ulonglong)local_res18,puVar9, + (longlong *) + ((ulonglong)*(uint *)(*(longlong *)(param_2 + 8) + 0x2c) + + *(longlong *)(*(longlong *)(param_2 + 8) + 0x20)),*(uint *)(local_80 + 8), + (char)puVar16,*(uint *)(*(longlong *)(param_2 + 0x18) + 8),param_5, (int *)(param_2 + 0x30)); - puVar16 = (uint *)(ulonglong)*(uint *)(param_2 + 0x30); - } - } - } - } - iVar12 = (int)puVar16; + puVar18 = (uint *)(ulonglong)*(uint *)(param_2 + 0x30); + puVar14 = local_res20; + } + } + } + } + iVar12 = (int)puVar18; if ((DAT_2 & 0x40) != 0) { - lVar19 = *(longlong *)(param_3 + 2); + lVar20 = *(longlong *)(puVar15 + 2); puVar9 = param_1; - WPP_SF_dqiqZLSiqddP(lVar19 + 0xa0,lVar19,iVar12,param_1); - uVar20 = (undefined4)((ulonglong)lVar19 >> 0x20); - _Size = puVar16; + WPP_SF_dqiqZLSiqddP(lVar20 + 0xa0,lVar20,iVar12,param_1); + uVar21 = (undefined4)((ulonglong)lVar20 >> 0x20); + _Size = puVar18; } *(int *)(param_2 + 0x30) = iVar12; if (((iVar12 + 0x80000000U & 0x80000000) == 0) && (iVar12 != -0x7ffffffb)) { UlCloseConnection(*(longlong **)(param_1 + 6),'\x01',(longlong *)_Size,(ulonglong)puVar9); goto LAB_9; } pwVar11 = *(wchar_t **)(param_1 + 6); if (pwVar11 != (wchar_t *)0x0) { _Size = (uint *)0x1; if ((*(byte *)(*(longlong *)(pwVar11 + 0x224) + 0x6e0) & 1) != 0) { if (*(longlong *)(*(longlong *)(pwVar11 + 0x224) + 0x6f0) != 0) { _Size = (uint *)0x0; bVar5 = UlEtwEvaluateFilterForRequestConnection((longlong)param_1,(longlong)pwVar11,0); if (bVar5 == 0) goto LAB_10; } _Size = param_1 + 0x12; pwVar11 = L"<>"; - if (*(wchar_t **)(*(longlong *)(param_3 + 2) + 0xa8) != (wchar_t *)0x0) { - pwVar11 = *(wchar_t **)(*(longlong *)(param_3 + 2) + 0xa8); + if (*(wchar_t **)(*(longlong *)(puVar15 + 2) + 0xa8) != (wchar_t *)0x0) { + pwVar11 = *(wchar_t **)(*(longlong *)(puVar15 + 2) + 0xa8); } puVar9 = param_1; McTemplateK0pxqzzq_EtwWriteTransfer ((undefined8 *)(*(longlong *)(*(longlong *)(param_1 + 6) + 0x448) + 0x698),pwVar11, - _Size,param_1,*(undefined8 *)(param_1 + 0xe),CONCAT44(uVar20,param_1[0x160]), + _Size,param_1,*(undefined8 *)(param_1 + 0xe),CONCAT44(uVar21,param_1[0x160]), pwVar11,*(wchar_t **)(param_1 + 0x1fc)); } } LAB_10: if (iVar12 == -0x7ffffffb) { UlStartRequestQueueTimer((longlong)param_1,pwVar11,_Size,puVar9); } LAB_9: - UlUpdateReceiveHttpRequestApiTimings((longlong)param_3,iVar12); - if (param_4 == (uint *)0x0) { + UlUpdateReceiveHttpRequestApiTimings((longlong)puVar15,iVar12); + if (puVar14 == (uint *)0x0) { IofCompleteRequest(param_2,0); } else { - plVar10 = *(longlong **)(param_4 + 2); - puVar17 = (undefined8 *)(param_2 + 0xa8); - if ((uint *)*plVar10 != param_4) { + plVar10 = *(longlong **)(puVar14 + 2); + plVar19 = (longlong *)(param_2 + 0xa8); + if ((uint *)*plVar10 != puVar14) { pcVar3 = (code *)swi(0x29); plVar10 = (longlong *)(*pcVar3)(3); } - *puVar17 = param_4; + *plVar19 = (longlong)puVar14; *(longlong **)(param_2 + 0xb0) = plVar10; - *plVar10 = (longlong)puVar17; - *(undefined8 **)(param_4 + 2) = puVar17; + *plVar10 = (longlong)plVar19; + *(longlong **)(puVar14 + 2) = plVar19; } return; } ``` ## UlPrepareParsedHeaderRangeResponse ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.19| |i_ratio|0.46| |m_ratio|0.97| |b_ratio|0.16| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlPrepareParsedHeaderRangeResponse|UlPrepareParsedHeaderRangeResponse| |fullname|UlPrepareParsedHeaderRangeResponse|UlPrepareParsedHeaderRangeResponse| |refcount|2|2| |`length`|1786|1894| |called|
Expand for full list:
McTemplateK0xxqxxxx_EtwWriteTransfer
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::ExFreePoolWithTag
UlDestroyCapturedChunk
UlEtwEvaluateFilterForRequestConnection
UlpCheckIfBypassRangeProcessing
UlpDuplicateChunkRange
UlpGenerateCommonBoundaryBuffer
UlpGenerateRangeResponseBoundary
UlpGenerateRangeResponseHeaders
UlpGenerateRangeResponseLastBoundaryWPP_SF_iILIIII
|
Expand for full list:
McTemplateK0xxqxxxx_EtwWriteTransfer
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::ExFreePoolWithTag
UlDestroyCapturedChunk
UlEtwEvaluateFilterForRequestConnection
UlpCheckIfBypassRangeProcessing
UlpDuplicateChunkRange
UlpGenerateCommonBoundaryBuffer
UlpGenerateRangeResponseBoundary
UlpGenerateRangeResponseHeaders
UlpGenerateRangeResponseLastBoundaryWPP_SF_iILIIII
| |calling|UlSendHttpResponse|UlSendHttpResponse| |paramcount|2|2| |`address`|14008e050|14008dfb4| |sig|ulonglong __fastcall UlPrepareParsedHeaderRangeResponse(longlong param_1, longlong param_2)|ulonglong __fastcall UlPrepareParsedHeaderRangeResponse(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlPrepareParsedHeaderRangeResponse Diff ```diff --- UlPrepareParsedHeaderRangeResponse +++ UlPrepareParsedHeaderRangeResponse @@ -1,365 +1,390 @@ ulonglong UlPrepareParsedHeaderRangeResponse(longlong param_1,longlong param_2) { ulonglong uVar1; undefined8 *puVar2; byte bVar3; - uint uVar4; - int iVar5; - uint uVar6; - int *piVar7; + int iVar4; + ulonglong uVar5; + int *piVar6; + int iVar7; int iVar8; - undefined8 *puVar9; - uint uVar10; - ulonglong *puVar11; + ulonglong uVar9; + undefined8 *puVar10; + uint uVar11; ulonglong *puVar12; longlong lVar13; - int iVar14; + uint uVar14; ushort *puVar15; - ulonglong *puVar16; - ulonglong uVar17; - int *piVar18; - ulonglong uVar19; - ulonglong *puVar20; - uint *puVar21; + longlong *plVar16; + int *piVar17; + ulonglong uVar18; + longlong *plVar19; + uint *puVar20; + ulonglong *puVar21; ulonglong *puVar22; - ulonglong *puVar23; + ulonglong uVar23; uint uVar24; - ulonglong uVar25; + longlong lVar25; ulonglong *puVar26; - ulonglong uVar27; - longlong lVar28; - uint uVar29; - ulonglong *puVar30; - bool bVar31; + uint uVar27; + ulonglong uVar28; + ulonglong *puVar29; + bool bVar30; ulonglong local_res8; uint local_res10 [2]; uint local_res18; ulonglong local_res20; - uint local_84; - ulonglong local_78; - ulonglong *local_70; - longlong local_68; - ulonglong *local_60; - ulonglong local_58; - ushort *local_50; + uint local_98; + uint local_94; + longlong local_88; + ulonglong *local_80; + ulonglong *local_78; + longlong local_70; + longlong *local_68; + ulonglong local_60; + ushort *local_58; - puVar23 = *(ulonglong **)(param_2 + 0xa78); - local_58 = *(ulonglong *)(param_1 + 0x208); - iVar14 = 0; + puVar22 = *(ulonglong **)(param_2 + 0xa78); + uVar11 = *(uint *)(param_2 + 0xa74); + uVar9 = 0; + iVar7 = 0; local_res18 = 0; - local_50 = (ushort *)0x0; - uVar17 = 0; + local_58 = (ushort *)0x0; + local_60 = *(ulonglong *)(param_1 + 0x208); local_res10[0] = 0; - local_68 = 0; - local_78 = 0; + local_70 = 0; + local_88 = 0; + local_res8 = local_res8 & 0xffffffffffffff00; local_res20 = 0; - uVar10 = *(uint *)(param_2 + 0xa74); - local_res8 = local_res8 & 0xffffffffffffff00; - local_70 = puVar23; - uVar4 = UlpCheckIfBypassRangeProcessing(param_1,param_2,(undefined1 *)&local_res8); - uVar27 = (ulonglong)uVar4; - if (-1 < (int)uVar4) { + local_80 = puVar22; + uVar5 = UlpCheckIfBypassRangeProcessing(param_1,param_2,(undefined1 *)&local_res8); + uVar28 = uVar5 & 0xffffffff; + if (-1 < (int)uVar5) { if ((char)local_res8 != '\0') goto LAB_0; - if ((uVar10 != 1) && (*(int *)(param_1 + 0x2d4) == 0xfffffff)) { + if ((uVar11 != 1) && (*(int *)(param_1 + 0x2d4) == 0xfffffff)) { return 0xc000000d; } if (*(uint *)(param_1 + 0x370) != 0) { - piVar7 = (int *)(param_1 + 0x380); - uVar27 = (ulonglong)*(uint *)(param_1 + 0x370); - iVar14 = 0; + piVar6 = (int *)(param_1 + 0x380); + uVar28 = (ulonglong)*(uint *)(param_1 + 0x370); + uVar5 = uVar9; do { - puVar20 = puVar23; - uVar25 = (ulonglong)uVar10; - if (uVar10 != 0) { + puVar12 = puVar22; + uVar23 = (ulonglong)uVar11; + if (uVar11 != 0) { do { - uVar1 = *puVar20; - if (uVar1 < uVar17) { - if (uVar17 < puVar20[1] + uVar1) goto LAB_1; + uVar1 = *puVar12; + if (uVar1 < uVar5) { + if (uVar5 < puVar12[1] + uVar1) goto LAB_1; } else { - iVar8 = *piVar7; - uVar19 = 0; - if (iVar8 == 1) { - uVar19 = (ulonglong)(uint)piVar7[4]; - } - else if (iVar8 == 2) { - uVar19 = *(ulonglong *)(piVar7 + 4); - } - else if (iVar8 == 3) { - uVar19 = (ulonglong)*(uint *)(*(longlong *)(piVar7 + 2) + 0x28); - } - if (uVar1 < uVar19 + uVar17) { + iVar7 = *piVar6; + uVar18 = 0; + if (iVar7 == 1) { + uVar18 = (ulonglong)(uint)piVar6[4]; + } + else if (iVar7 == 2) { + uVar18 = *(ulonglong *)(piVar6 + 4); + } + else if (iVar7 == 3) { + uVar18 = (ulonglong)*(uint *)(*(longlong *)(piVar6 + 2) + 0x28); + } + if (uVar1 < uVar18 + uVar5) { LAB_1: - iVar14 = iVar14 + 1; + uVar9 = (ulonglong)((int)uVar9 + 1); } } - uVar25 = uVar25 - 1; - puVar20 = puVar20 + 2; - } while (uVar25 != 0); - } - iVar8 = *piVar7; - uVar25 = 0; + uVar23 = uVar23 - 1; + puVar12 = puVar12 + 2; + } while (uVar23 != 0); + } + iVar7 = (int)uVar9; + iVar8 = *piVar6; + uVar23 = 0; if (iVar8 == 1) { - uVar25 = (ulonglong)(uint)piVar7[4]; + uVar23 = (ulonglong)(uint)piVar6[4]; } else if (iVar8 == 2) { - uVar25 = *(ulonglong *)(piVar7 + 4); + uVar23 = *(ulonglong *)(piVar6 + 4); } else if (iVar8 == 3) { - uVar25 = (ulonglong)*(uint *)(*(longlong *)(piVar7 + 2) + 0x28); - } - uVar17 = uVar17 + uVar25; - piVar7 = piVar7 + 0x14; - uVar27 = uVar27 - 1; - } while (uVar27 != 0); - } - if (uVar10 < 2) { + uVar23 = (ulonglong)*(uint *)(*(longlong *)(piVar6 + 2) + 0x28); + } + uVar5 = uVar5 + uVar23; + piVar6 = piVar6 + 0x14; + uVar28 = uVar28 - 1; + } while (uVar28 != 0); + } + if (uVar11 < 2) { if (*(char *)(param_1 + 0x32) != '\0') { local_res20 = *(ulonglong *)(param_1 + 0x220); } iVar8 = 0; - lVar28 = 0; - local_84 = 0; - if (uVar10 != 1) goto LAB_2; - iVar5 = 0x45; + lVar25 = 0; + local_94 = 0; + if (uVar11 != 1) goto LAB_2; + iVar4 = 0x45; } else { - lVar28 = *(longlong *)(param_1 + 0x2b8) + (ulonglong)*(uint *)(param_1 + 0x2d4) * 0x18; + lVar25 = *(longlong *)(param_1 + 0x2b8) + (ulonglong)*(uint *)(param_1 + 0x2d4) * 0x18; LAB_2: - iVar8 = uVar10 * 2 + 1; - local_84 = *(int *)(lVar28 + 0x14) + 0x53; - iVar5 = uVar10 * 0x43 + 0x32 + local_84; - } - uVar4 = iVar14 + iVar8; - puVar21 = (uint *)&UxLowPriorityPool; - uVar29 = uVar4 * 0x50 + iVar5; - uVar17 = (ulonglong)uVar29; - piVar7 = (int *)ExAllocatePool3(0x40,uVar17,0x46596c55,&UxLowPriorityPool,1); - if (piVar7 == (int *)0x0) { + iVar8 = uVar11 * 2 + 1; + local_94 = *(int *)(lVar25 + 0x14) + 0x53; + iVar4 = uVar11 * 0x43 + 0x32 + local_94; + } + uVar14 = iVar7 + iVar8; + puVar20 = (uint *)&UxLowPriorityPool; + uVar27 = uVar14 * 0x50 + iVar4; + uVar5 = (ulonglong)uVar27; + piVar6 = (int *)ExAllocatePool3(0x40,uVar5,0x46596c55,&UxLowPriorityPool,1); + if (piVar6 == (int *)0x0) { return 0xc000009a; } - puVar15 = (ushort *)(piVar7 + (ulonglong)uVar4 * 0x14); - uVar29 = ((int)piVar7 - (int)puVar15) + uVar29; - if (1 < uVar10) { - puVar21 = local_res10; - local_50 = puVar15; - UlpGenerateCommonBoundaryBuffer((undefined8 *)puVar15,uVar17,lVar28,(int *)puVar21); + puVar15 = (ushort *)(piVar6 + (ulonglong)uVar14 * 0x14); + uVar27 = ((int)piVar6 - (int)puVar15) + uVar27; + local_res8 = CONCAT44(local_res8._4_4_,uVar27); + if (1 < uVar11) { + puVar20 = local_res10; + local_58 = puVar15; + UlpGenerateCommonBoundaryBuffer((undefined8 *)puVar15,uVar5,lVar25,(int *)puVar20); puVar15 = (ushort *)((longlong)puVar15 + (ulonglong)local_res10[0]); - uVar29 = uVar29 - local_res10[0]; - } - bVar31 = *(char *)(param_1 + 0xe8) == '\0'; - puVar20 = (ulonglong *)(ulonglong)*(ushort *)(param_1 + 0x98); - puVar23 = (ulonglong *)CONCAT71((int7)((ulonglong)puVar21 >> 8),bVar31); - puVar12 = local_70; - uVar6 = UlpGenerateRangeResponseHeaders - (uVar10,local_70,*(ushort *)(param_1 + 0x98),bVar31, - (longlong *)(param_1 + 0x2b8),local_58,puVar15,uVar29,local_res20, - (int *)local_res10); - uVar27 = (ulonglong)uVar6; - if ((int)uVar6 < 0) { + uVar27 = uVar27 - local_res10[0]; + local_res8 = CONCAT44(local_res8._4_4_,uVar27); + } + bVar30 = *(char *)(param_1 + 0xe8) == '\0'; + plVar19 = (longlong *)(ulonglong)*(ushort *)(param_1 + 0x98); + puVar22 = (ulonglong *)CONCAT71((int7)((ulonglong)puVar20 >> 8),bVar30); + puVar12 = local_80; + uVar27 = UlpGenerateRangeResponseHeaders + (uVar11,local_80,*(ushort *)(param_1 + 0x98),bVar30, + (longlong *)(param_1 + 0x2b8),local_60,puVar15,uVar27,local_res20, + (int *)local_res10); + uVar28 = (ulonglong)uVar27; + if ((int)uVar27 < 0) { LAB_3: - uVar17 = (ulonglong)uVar4; - piVar18 = piVar7; - if (uVar4 != 0) { + uVar5 = (ulonglong)uVar14; + piVar17 = piVar6; + if (uVar14 != 0) { do { - UlDestroyCapturedChunk(piVar18,(undefined *)puVar12,(int *)puVar20,(longlong)puVar23); - piVar18 = piVar18 + 0x14; - uVar17 = uVar17 - 1; - } while (uVar17 != 0); - } - ExFreePoolWithTag(piVar7,0); + UlDestroyCapturedChunk(piVar17,(undefined *)puVar12,(int *)plVar19,(longlong)puVar22); + piVar17 = piVar17 + 0x14; + uVar5 = uVar5 - 1; + } while (uVar5 != 0); + } + ExFreePoolWithTag(piVar6,0); } else { - puVar16 = (ulonglong *)((longlong)puVar15 + (ulonglong)local_res10[0]); - puVar11 = puVar12; - puVar22 = puVar23; - puVar12 = (ulonglong *)(ulonglong)(uVar29 - local_res10[0]); - for (uVar6 = 0; uVar6 < uVar10; uVar6 = uVar6 + 1) { - local_60 = (ulonglong *)0x0; - local_res8 = local_res8 & 0xffffffffffffff00; - puVar11 = (ulonglong *)0x0; - puVar23 = puVar12; - while( true ) { - local_res20 = CONCAT44(local_res20._4_4_,(uint)puVar11); - puVar12 = puVar11; - puVar22 = local_60; - puVar26 = puVar23; - if (*(uint *)(param_1 + 0x370) <= (uint)puVar11) break; - if (uVar10 < 2) { + plVar16 = (longlong *)((longlong)puVar15 + (ulonglong)local_res10[0]); + puVar26 = (ulonglong *)(ulonglong)((int)local_res8 - local_res10[0]); + if ((UxKirHKERangeRequestH2StatusCode != '\0') && (*(short *)(param_1 + 0x98) != 0xce)) { + *(undefined2 *)(*(longlong *)(param_1 + 0x18) + 0x69c) = 0xce; + *(undefined2 *)(param_1 + 0x98) = 0xce; + if (*(longlong *)(param_1 + 0x200) != 0) { + *(undefined2 *)(*(longlong *)(param_1 + 0x200) + 0x78) = 0xce; + } + } + uVar27 = 0; + local_res20 = local_res20 & 0xffffffff00000000; + puVar29 = puVar12; + puVar21 = local_80; + if (uVar11 != 0) { + do { + local_res8 = local_res8 & 0xffffffffffffff00; + uVar5 = 0; + local_68 = (longlong *)0x0; + local_98 = 0; + puVar22 = puVar26; + local_78 = puVar21; + if (*(int *)(param_1 + 0x370) != 0) { + do { + puVar12 = puVar21; + if ((uVar11 < 2) || ((longlong *)*puVar21 < local_68)) { LAB_4: - puVar20 = (ulonglong *)local_70[(ulonglong)uVar6 * 2]; - puVar30 = (ulonglong *)((longlong)puVar11 * 0x50 + 0x380 + param_1); - if (puVar20 < local_60) { - if (local_60 < (ulonglong *)((local_70 + (ulonglong)uVar6 * 2)[1] + (longlong)puVar20) - ) goto LAB_5; + plVar19 = (longlong *)*puVar12; + puVar29 = (ulonglong *)(uVar5 * 0x50 + 0x380 + param_1); + puVar21 = puVar12; + puVar26 = puVar22; + if (plVar19 < local_68) { + if (local_68 < (longlong *)(puVar12[1] + (longlong)plVar19)) goto LAB_5; + } + else { + iVar7 = (int)*puVar29; + uVar5 = 0; + if (iVar7 == 1) { + uVar5 = (ulonglong)(uint)puVar29[2]; + } + else if (iVar7 == 2) { + uVar5 = puVar29[2]; + } + else if (iVar7 == 3) { + uVar5 = (ulonglong)*(uint *)(puVar29[1] + 0x28); + } + if (plVar19 < (longlong *)(uVar5 + (longlong)local_68)) goto LAB_5; + } + } + else { + iVar7 = *(int *)(param_1 + 0x380 + uVar5 * 0x50); + uVar9 = 0; + if (iVar7 == 1) { + uVar9 = (ulonglong)*(uint *)(param_1 + 0x390 + uVar5 * 0x50); + } + else if (iVar7 == 2) { + uVar9 = *(ulonglong *)(param_1 + 0x390 + uVar5 * 0x50); + } + else if (iVar7 == 3) { + uVar9 = (ulonglong)*(uint *)(*(longlong *)(param_1 + 0x388 + uVar5 * 0x50) + 0x28) + ; + } + puVar12 = local_78; + if ((longlong *)(uVar9 + (longlong)local_68) <= (longlong *)*puVar21) + goto LAB_4; + puVar12 = (ulonglong *)(ulonglong)local_94; + uVar24 = (uint)puVar22; + plVar19 = plVar16; + uVar5 = UlpGenerateRangeResponseBoundary + (local_58,puVar12,(char *)plVar16,uVar24, + local_80 + (ulonglong)uVar27 * 2,local_60,&local_70,&local_88, + (int *)local_res10); + lVar13 = local_70; + lVar25 = local_88; + uVar28 = uVar5 & 0xffffffff; + if ((int)uVar5 < 0) goto LAB_3; + plVar16 = (longlong *)((longlong)plVar16 + (ulonglong)local_res10[0]); + local_70 = 0; + uVar27 = local_res18 + 1; + *(longlong *)(piVar6 + (ulonglong)local_res18 * 0x14 + 2) = lVar13; + piVar6[(ulonglong)local_res18 * 0x14] = 3; + local_res18 = local_res18 + 2; + local_88 = 0; + piVar6[(ulonglong)uVar27 * 0x14] = 3; + *(longlong *)(piVar6 + (ulonglong)uVar27 * 0x14 + 2) = lVar25; + puVar26 = (ulonglong *)(ulonglong)(uVar24 - local_res10[0]); +LAB_5: + puVar29 = (ulonglong *)((ulonglong)local_98 * 0x50 + 0x380 + param_1); + puVar22 = (ulonglong *)(piVar6 + (ulonglong)local_res18 * 0x14); + puVar12 = puVar29; + plVar19 = local_68; + uVar27 = UlpDuplicateChunkRange + (local_80 + (local_res20 & 0xffffffff) * 2,(int *)puVar29, + (ulonglong)local_68,(undefined4 *)puVar22, + (undefined1 *)&local_res8); + uVar28 = (ulonglong)uVar27; + if ((int)uVar27 < 0) goto LAB_3; + local_res18 = local_res18 + 1; + puVar21 = local_78; + if ((char)local_res8 != '\0') { + uVar27 = (uint)local_res20; + break; + } + } + iVar7 = (int)*puVar29; + puVar12 = (ulonglong *)0x0; + if (iVar7 == 1) { + puVar12 = (ulonglong *)(ulonglong)(uint)puVar29[2]; + } + else if (iVar7 == 2) { + puVar12 = (ulonglong *)puVar29[2]; + } + else if (iVar7 == 3) { + puVar12 = (ulonglong *)(ulonglong)*(uint *)(puVar29[1] + 0x28); + } + local_68 = (longlong *)((longlong)local_68 + (longlong)puVar12); + local_98 = local_98 + 1; + uVar5 = (ulonglong)local_98; + puVar22 = puVar26; + uVar27 = (uint)local_res20; + } while (local_98 < *(uint *)(param_1 + 0x370)); + } + uVar27 = uVar27 + 1; + puVar22 = puVar21 + 2; + local_res20 = CONCAT44(local_res20._4_4_,uVar27); + puVar29 = puVar12; + puVar21 = puVar22; + local_78 = puVar22; + } while (uVar27 < uVar11); + } + puVar12 = puVar26; + if (1 < uVar11) { + puVar22 = (ulonglong *)local_res10; + plVar19 = &local_88; + uVar5 = UlpGenerateRangeResponseLastBoundary + (plVar16,(uint)puVar12,plVar19,(undefined4 *)puVar22); + uVar28 = uVar5 & 0xffffffff; + if ((int)uVar5 < 0) goto LAB_3; + piVar6[(ulonglong)local_res18 * 0x14] = 3; + *(longlong *)(piVar6 + (ulonglong)local_res18 * 0x14 + 2) = local_88; + puVar29 = puVar12; + } + *(undefined8 *)(param_1 + 0x208) = 0; + if (uVar14 != 0) { + puVar22 = (ulonglong *)0x0; + puVar20 = (uint *)(piVar6 + 4); + uVar5 = (ulonglong)uVar14; + do { + plVar19 = (longlong *)0x0; + if (puVar20[-4] == 1) { + plVar19 = (longlong *)(ulonglong)*puVar20; + puVar29 = (ulonglong *)0x0; + } + else { + uVar11 = puVar20[-4] - 2; + puVar29 = (ulonglong *)(ulonglong)uVar11; + if (uVar11 == 0) { + plVar19 = *(longlong **)puVar20; } - else { - uVar29 = (uint)*puVar30; - uVar17 = 0; - if (uVar29 == 1) { - uVar17 = (ulonglong)(uint)puVar30[2]; - } - else if (uVar29 == 2) { - uVar17 = puVar30[2]; - } - else if (uVar29 == 3) { - uVar17 = (ulonglong)*(uint *)(puVar30[1] + 0x28); - } - if (puVar20 < (ulonglong *)(uVar17 + (longlong)local_60)) goto LAB_5; + else if (uVar11 == 1) { + plVar19 = (longlong *)(ulonglong)*(uint *)(*(longlong *)(puVar20 + -2) + 0x28); } } - else { - puVar20 = (ulonglong *)local_70[(ulonglong)uVar6 * 2]; - if (puVar20 < local_60) goto LAB_4; - iVar14 = *(int *)(param_1 + 0x380 + (longlong)puVar11 * 0x50); - uVar17 = 0; - if (iVar14 == 1) { - uVar17 = (ulonglong)*(uint *)(param_1 + 0x390 + (longlong)puVar11 * 0x50); - } - else if (iVar14 == 2) { - uVar17 = *(ulonglong *)(param_1 + 0x390 + (longlong)puVar11 * 0x50); - } - else if (iVar14 == 3) { - uVar17 = (ulonglong) - *(uint *)(*(longlong *)(param_1 + 0x388 + (longlong)puVar11 * 0x50) + 0x28); - } - if ((ulonglong *)(uVar17 + (longlong)local_60) <= puVar20) goto LAB_4; - puVar12 = (ulonglong *)(ulonglong)local_84; - uVar29 = (uint)puVar23; - puVar20 = puVar16; - uVar25 = UlpGenerateRangeResponseBoundary - (local_50,puVar12,(char *)puVar16,uVar29, - local_70 + (ulonglong)uVar6 * 2,local_58,&local_68, - (longlong *)&local_78,(int *)local_res10); - lVar28 = local_68; - uVar17 = local_78; - uVar27 = uVar25 & 0xffffffff; - if ((int)uVar25 < 0) goto LAB_3; - puVar16 = (ulonglong *)((longlong)puVar16 + (ulonglong)local_res10[0]); - local_68 = 0; - uVar24 = local_res18 + 1; - *(longlong *)(piVar7 + (ulonglong)local_res18 * 0x14 + 2) = lVar28; - piVar7[(ulonglong)local_res18 * 0x14] = 3; - local_res18 = local_res18 + 2; - local_78 = 0; - puVar11 = (ulonglong *)(local_res20 & 0xffffffff); - piVar7[(ulonglong)uVar24 * 0x14] = 3; - *(ulonglong *)(piVar7 + (ulonglong)uVar24 * 0x14 + 2) = uVar17; - puVar26 = (ulonglong *)(ulonglong)(uVar29 - local_res10[0]); -LAB_5: - puVar30 = (ulonglong *)((longlong)puVar11 * 0x50 + 0x380 + param_1); - puVar23 = (ulonglong *)(piVar7 + (ulonglong)local_res18 * 0x14); - puVar12 = puVar30; - puVar20 = local_60; - uVar29 = UlpDuplicateChunkRange - (local_70 + (ulonglong)uVar6 * 2,(int *)puVar30,(ulonglong)local_60, - (undefined4 *)puVar23,(undefined1 *)&local_res8); - uVar27 = (ulonglong)uVar29; - if ((int)uVar29 < 0) goto LAB_3; - local_res18 = local_res18 + 1; - puVar22 = puVar23; - if ((char)local_res8 != '\0') break; - } - uVar29 = (uint)*puVar30; - uVar17 = 0; - if (uVar29 == 1) { - uVar17 = (ulonglong)(uint)puVar30[2]; - } - else if (uVar29 == 2) { - uVar17 = puVar30[2]; - } - else if (uVar29 == 3) { - uVar17 = (ulonglong)*(uint *)(puVar30[1] + 0x28); - } - local_60 = (ulonglong *)((longlong)local_60 + uVar17); - puVar11 = (ulonglong *)(ulonglong)((int)local_res20 + 1); - puVar23 = puVar26; - } - puVar11 = puVar12; - puVar12 = puVar26; - } - puVar23 = puVar22; - if (1 < uVar10) { - puVar23 = (ulonglong *)local_res10; - puVar20 = &local_78; - uVar17 = UlpGenerateRangeResponseLastBoundary - (puVar16,(uint)puVar12,(longlong *)puVar20,(undefined4 *)puVar23); - uVar27 = uVar17 & 0xffffffff; - if ((int)uVar17 < 0) goto LAB_3; - piVar7[(ulonglong)local_res18 * 0x14] = 3; - *(ulonglong *)(piVar7 + (ulonglong)local_res18 * 0x14 + 2) = local_78; - puVar11 = puVar12; - } - *(undefined8 *)(param_1 + 0x208) = 0; - if (uVar4 != 0) { - puVar23 = (ulonglong *)0x0; - puVar21 = (uint *)(piVar7 + 4); - uVar17 = (ulonglong)uVar4; - do { - puVar20 = (ulonglong *)0x0; - if (puVar21[-4] == 1) { - puVar20 = (ulonglong *)(ulonglong)*puVar21; - puVar11 = (ulonglong *)0x0; - } - else { - uVar10 = puVar21[-4] - 2; - puVar11 = (ulonglong *)(ulonglong)uVar10; - if (uVar10 == 0) { - puVar20 = *(ulonglong **)puVar21; - } - else if (uVar10 == 1) { - puVar20 = (ulonglong *)(ulonglong)*(uint *)(*(longlong *)(puVar21 + -2) + 0x28); - } - } - puVar23 = (ulonglong *)((longlong)puVar23 + (longlong)puVar20); - puVar21 = puVar21 + 0x14; - *(ulonglong **)(param_1 + 0x208) = puVar23; - uVar17 = uVar17 - 1; - } while (uVar17 != 0); - } - uVar17 = 0; + puVar22 = (ulonglong *)((longlong)puVar22 + (longlong)plVar19); + puVar20 = puVar20 + 0x14; + *(ulonglong **)(param_1 + 0x208) = puVar22; + uVar5 = uVar5 - 1; + } while (uVar5 != 0); + } + uVar5 = 0; if (*(int *)(param_1 + 0x370) != 0) { do { UlDestroyCapturedChunk - ((int *)(uVar17 * 0x50 + *(longlong *)(param_1 + 0x378)),(undefined *)puVar11, - (int *)puVar20,(longlong)puVar23); - uVar10 = (int)uVar17 + 1; - uVar17 = (ulonglong)uVar10; - } while (uVar10 < *(uint *)(param_1 + 0x370)); - } - *(int **)(param_1 + 0x378) = piVar7; - *(uint *)(param_1 + 0x370) = uVar4; - *(int **)(param_1 + 0x100) = piVar7; - } - } - if ((int)uVar27 < 0) { - return uVar27; + ((int *)(uVar5 * 0x50 + *(longlong *)(param_1 + 0x378)),(undefined *)puVar29, + (int *)plVar19,(longlong)puVar22); + uVar11 = (int)uVar5 + 1; + uVar5 = (ulonglong)uVar11; + } while (uVar11 < *(uint *)(param_1 + 0x370)); + } + *(int **)(param_1 + 0x378) = piVar6; + *(uint *)(param_1 + 0x370) = uVar14; + *(int **)(param_1 + 0x100) = piVar6; + } + } + if ((int)uVar28 < 0) { + return uVar28; } LAB_0: puVar2 = *(undefined8 **)(param_1 + 0x18); local_res8 = 0; - puVar9 = (undefined8 *)(ulonglong)*(uint *)((longlong)puVar2 + 0xa74); + puVar10 = (undefined8 *)(ulonglong)*(uint *)((longlong)puVar2 + 0xa74); if (*(uint *)((longlong)puVar2 + 0xa74) != 0) { local_res8 = ((longlong *)puVar2[0x14f])[1] + -1 + *(longlong *)puVar2[0x14f]; } - uVar10 = *(uint *)(param_1 + 0xac); - lVar28 = *(longlong *)(param_1 + 0x208); + uVar11 = *(uint *)(param_1 + 0xac); + lVar25 = *(longlong *)(param_1 + 0x208); lVar13 = puVar2[3]; - uVar4 = *(uint *)(param_1 + 0xa8); + uVar14 = *(uint *)(param_1 + 0xa8); if (((lVar13 != 0) && - (puVar9 = *(undefined8 **)(lVar13 + 0x448), (*(byte *)((longlong)puVar9 + 0x6e4) & 8) != 0)) - && ((puVar9[0xde] == 0 || - (puVar9 = puVar2, + (puVar10 = *(undefined8 **)(lVar13 + 0x448), (*(byte *)((longlong)puVar10 + 0x6e4) & 8) != 0)) + && ((puVar10[0xde] == 0 || + (puVar10 = puVar2, bVar3 = UlEtwEvaluateFilterForRequestConnection((longlong)puVar2,lVar13,0), bVar3 != 0)))) { - puVar9 = (undefined8 *)(*(longlong *)(puVar2[3] + 0x448) + 0x698); - McTemplateK0xxqxxxx_EtwWriteTransfer(puVar9,lVar13,puVar2 + 9,puVar2[7]); + puVar10 = (undefined8 *)(*(longlong *)(puVar2[3] + 0x448) + 0x698); + McTemplateK0xxqxxxx_EtwWriteTransfer(puVar10,lVar13,puVar2 + 9,puVar2[7]); } if ((DAT_6 & 8) != 0) { - WPP_SF_iILIIII(puVar9,lVar13,puVar2[7],(lVar28 - (ulonglong)uVar10) - (ulonglong)uVar4); - } - return uVar27; + WPP_SF_iILIIII(puVar10,lVar13,puVar2[7],(lVar25 - (ulonglong)uVar11) - (ulonglong)uVar14); + } + return uVar28; } ``` ## UlQueryConfigGroupProperty ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.28| |i_ratio|0.55| |m_ratio|0.98| |b_ratio|0.4| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlQueryConfigGroupProperty|UlQueryConfigGroupProperty| |fullname|UlQueryConfigGroupProperty|UlQueryConfigGroupProperty| |refcount|2|2| |`length`|775|834| |called|
Expand for full list:
NTOSKRNL.EXE::ExAcquireCacheAwarePushLockSharedEx
NTOSKRNL.EXE::ExReleaseCacheAwarePushLockSharedEx
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlBugCheckEx
UlCopyAuthConfigToIrp
UlCopyChannelBindConfigToIrp
UlCopyQosSettingInfo
UlFreeConfigGroup
UxGetObjectFromOpaqueIdWPP_SF_qDL
WPP_SF_qqiLqLqq
|
Expand for full list:
NTOSKRNL.EXE::ExAcquireCacheAwarePushLockSharedEx
NTOSKRNL.EXE::ExReleaseCacheAwarePushLockSharedEx
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlBugCheckEx
UlCopyAuthConfigToIrp
UlCopyChannelBindConfigToIrp
UlCopyQosSettingInfo
UlFreeConfigGroup
UxGetObjectFromOpaqueIdWPP_SF_qDL
WPP_SF_qqiLqLqq
| |calling|UlQueryUrlGroupIoctl|UlQueryUrlGroupIoctl| |paramcount|8|8| |`address`|1400ab88c|1400abd5c| |sig|int __fastcall UlQueryConfigGroupProperty(undefined8 * * * * * param_1, longlong param_2, ulonglong param_3, int param_4, int * param_5, uint param_6, undefined8 param_7, undefined8 * * * * param_8)|int __fastcall UlQueryConfigGroupProperty(undefined8 * * * * * param_1, longlong param_2, ulonglong param_3, int param_4, int * param_5, uint param_6, undefined8 param_7, undefined8 * * * * param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlQueryConfigGroupProperty Diff ```diff --- UlQueryConfigGroupProperty +++ UlQueryConfigGroupProperty @@ -1,143 +1,155 @@ int UlQueryConfigGroupProperty (undefined8 *****param_1,longlong param_2,ulonglong param_3,int param_4,int *param_5, uint param_6,undefined8 param_7,undefined8 ****param_8) { int *piVar1; int iVar2; int iVar3; - uint uVar4; - undefined8 uVar5; - undefined8 *****pppppuVar6; - undefined8 ****ppppuVar7; - ulonglong uVar8; - undefined8 uVar9; + undefined8 uVar4; + undefined8 *****pppppuVar5; + undefined8 ****ppppuVar6; + ulonglong uVar7; + undefined8 uVar8; + code *pcVar9; code *pcVar10; - code *pcVar11; - longlong lVar12; + longlong lVar11; - iVar3 = 0; + iVar2 = 0; if ((DAT_0 & 8) != 0) { - WPP_SF_qqiLqLqq(0x7a,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,param_1,param_2); + WPP_SF_qqiLqLqq(0x7a,&WPP_2d297478329b39561f77aac2cbbacc14_Traceguids,param_1,param_2); } *(undefined4 *)param_8 = 0; - lVar12 = *(longlong *)(param_2 + 0x38); + lVar11 = *(longlong *)(param_2 + 0x38); KeEnterCriticalRegion(); - uVar5 = ExAcquireCacheAwarePushLockSharedEx(*(undefined8 *)(lVar12 + 0x558),0); - pcVar11 = UlValidateConfigGroup; - pcVar10 = UxDuoReferenceConnectionFromId; - lVar12 = param_2; - pppppuVar6 = (undefined8 *****) + uVar4 = ExAcquireCacheAwarePushLockSharedEx(*(undefined8 *)(lVar11 + 0x558),0); + pcVar10 = UlValidateConfigGroup; + pcVar9 = UxDuoReferenceConnectionFromId; + lVar11 = param_2; + pppppuVar5 = (undefined8 *****) UxGetObjectFromOpaqueId (param_3,(undefined *)0x2,UxDuoReferenceConnectionFromId, UlValidateConfigGroup,param_2); - if ((pppppuVar6 == (undefined8 *****)0x0) || (*(int *)pppppuVar6 != 0x4a436c55)) { - iVar3 = -0x3ffffff3; - if (pppppuVar6 == (undefined8 *****)0x0) goto LAB_1; + if ((pppppuVar5 == (undefined8 *****)0x0) || (*(int *)pppppuVar5 != 0x4a436c55)) { + iVar2 = -0x3ffffff3; + if (pppppuVar5 == (undefined8 *****)0x0) goto LAB_1; } - else if (((short)*(undefined4 *)(pppppuVar6[6] + 2) == 1) && - ((short)((uint)*(undefined4 *)(pppppuVar6[6] + 2) >> 0x10) == 0)) { - iVar3 = -0x3fffff45; - } - else if (param_4 == 0) { -LAB_2: - pcVar11 = (code *)param_8; - iVar3 = UlCopyAuthConfigToIrp - (1,(undefined4 *)(pppppuVar6 + 0x26),(longlong)param_1,(uint *)param_8); - pcVar10 = (code *)param_1; - } - else if (param_4 == 2) { - IoIs32bitProcess(param_1); - if (*param_5 == 0) { - IoIs32bitProcess(param_1); - pcVar10 = (code *)(pppppuVar6 + 10); - uVar9 = 0; - } - else { - if (*param_5 != 1) goto LAB_3; - IoIs32bitProcess(param_1); - pcVar10 = (code *)(pppppuVar6 + 0xd); - uVar9 = 1; - } - uVar8 = UlCopyQosSettingInfo - (param_1,uVar9,pcVar10,pcVar11,lVar12,param_7,(longlong)param_5,param_6, - (uint *)param_8); - iVar3 = (int)uVar8; + else if (((short)*(undefined4 *)(pppppuVar5[6] + 2) == 1) && + ((short)((uint)*(undefined4 *)(pppppuVar5[6] + 2) >> 0x10) == 0)) { + iVar2 = -0x3fffff45; } else { - if (param_4 == 3) { - if (0x13 < param_6) { - ppppuVar7 = pppppuVar6[0x23]; - *(undefined8 *****)param_5 = pppppuVar6[0x22]; - *(undefined8 *****)(param_5 + 2) = ppppuVar7; - param_5[4] = *(int *)(pppppuVar6 + 0x24); - *(undefined4 *)param_8 = 0x14; - goto LAB_4; + if (param_4 < 10) { + if (param_4 == 9) { + if (7 < param_6) { + ppppuVar6 = *(undefined8 *****)((longlong)pppppuVar5 + 0x124); + goto LAB_2; + } } - } - else if (param_4 == 5) { - if (7 < param_6) { - ppppuVar7 = pppppuVar6[7]; - goto LAB_5; + else { + if (param_4 == 0) { +LAB_3: + pcVar10 = (code *)param_8; + iVar2 = UlCopyAuthConfigToIrp + (1,(undefined4 *)(pppppuVar5 + 0x26),(longlong)param_1,(uint *)param_8); + pcVar9 = (code *)param_1; + goto LAB_4; + } + if (param_4 == 2) { + IoIs32bitProcess(param_1); + if (*param_5 == 0) { + IoIs32bitProcess(param_1); + pcVar9 = (code *)(pppppuVar5 + 10); + uVar8 = 0; + } + else { + if (*param_5 != 1) goto LAB_5; + IoIs32bitProcess(param_1); + pcVar9 = (code *)(pppppuVar5 + 0xd); + uVar8 = 1; + } + uVar7 = UlCopyQosSettingInfo + (param_1,uVar8,pcVar9,pcVar10,lVar11,param_7,(longlong)param_5,param_6, + (uint *)param_8); + iVar2 = (int)uVar7; + goto LAB_4; + } + if (param_4 == 3) { + if (0x13 < param_6) { + ppppuVar6 = pppppuVar5[0x23]; + *(undefined8 *****)param_5 = pppppuVar5[0x22]; + *(undefined8 *****)(param_5 + 2) = ppppuVar6; + param_5[4] = *(int *)(pppppuVar5 + 0x24); + *(undefined4 *)param_8 = 0x14; + goto LAB_4; + } + } + else if (param_4 == 5) { + if (7 < param_6) { + ppppuVar6 = pppppuVar5[7]; + goto LAB_2; + } + } + else if (param_4 == 8) goto LAB_3; } } else { - if (param_4 == 8) goto LAB_2; - if (param_4 == 9) { + if (param_4 == 10) { + pcVar10 = (code *)param_8; + iVar2 = UlCopyChannelBindConfigToIrp + (*(longlong *)(param_2 + 0x38),(uint *)(pppppuVar5 + 0x30), + (longlong)param_1,(uint *)param_8); + pcVar9 = (code *)param_1; + goto LAB_4; + } + if (param_4 == 0xb) { if (7 < param_6) { - ppppuVar7 = *(undefined8 *****)((longlong)pppppuVar6 + 0x124); - goto LAB_5; - } - } - else { - if (param_4 == 10) { - pcVar11 = (code *)param_8; - iVar3 = UlCopyChannelBindConfigToIrp - (*(longlong *)(param_2 + 0x38),(uint *)(pppppuVar6 + 0x30), - (longlong)param_1,(uint *)param_8); - pcVar10 = (code *)param_1; - goto LAB_4; - } - if (param_4 == 0xb) { - if (7 < param_6) { - ppppuVar7 = pppppuVar6[0x37]; - goto LAB_5; - } - } - else if ((param_4 == 0x12) && (7 < param_6)) { - ppppuVar7 = pppppuVar6[0x39]; -LAB_5: - *(undefined8 *****)param_5 = ppppuVar7; + ppppuVar6 = pppppuVar5[0x37]; +LAB_2: + *(undefined8 *****)param_5 = ppppuVar6; *(undefined4 *)param_8 = 8; goto LAB_4; } } + else if (param_4 == 0x12) { + if (7 < param_6) { + ppppuVar6 = pppppuVar5[0x39]; + goto LAB_2; + } + } + else if (((param_4 == 0x13) && (UxKirBrHttpQuerySocketTtl != '\0')) && (0xf < param_6)) { + ppppuVar6 = pppppuVar5[0x3b]; + *(undefined8 *****)param_5 = pppppuVar5[0x3a]; + *(undefined8 *****)(param_5 + 2) = ppppuVar6; + *(undefined4 *)param_8 = 0x10; + goto LAB_4; + } } -LAB_3: - iVar3 = -0x3ffffff3; +LAB_5: + iVar2 = -0x3ffffff3; } LAB_4: - piVar1 = (int *)((longlong)pppppuVar6 + 4); + piVar1 = (int *)((longlong)pppppuVar5 + 4); LOCK(); - iVar2 = *piVar1; + iVar3 = *piVar1; *piVar1 = *piVar1 + -1; UNLOCK(); - uVar4 = iVar2 - 1; - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar4)) { + iVar3 = iVar3 + -1; + if ((UxDebugCheckRefcount != '\0') && (iVar3 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar1,0xb,(longlong)(int)uVar4); + UlBugCheckEx(3,piVar1,0xb,(longlong)iVar3); } - if (uVar4 == 0) { - UlFreeConfigGroup(pppppuVar6,piVar1,(undefined8 *****)pcVar10,(undefined8 ****)pcVar11); + if (iVar3 == 0) { + UlFreeConfigGroup(pppppuVar5,piVar1,(undefined8 *****)pcVar9,(undefined8 ****)pcVar10); } LAB_1: - ExReleaseCacheAwarePushLockSharedEx(uVar5,0); + ExReleaseCacheAwarePushLockSharedEx(uVar4,0); KeLeaveCriticalRegion(); if ((DAT_0 & 8) != 0) { - WPP_SF_qDL(0x7b,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,param_5,*(undefined4 *)param_8) + WPP_SF_qDL(0x7b,&WPP_2d297478329b39561f77aac2cbbacc14_Traceguids,param_5,*(undefined4 *)param_8) ; } - return iVar3; + return iVar2; } ``` ## UcQueryClientConnectionProperty ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.62| |i_ratio|0.46| |m_ratio|0.96| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UcQueryClientConnectionProperty|UcQueryClientConnectionProperty| |fullname|UcQueryClientConnectionProperty|UcQueryClientConnectionProperty| |refcount|2|2| |`length`|1405|1510| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeGetCurrentIrql
NTOSKRNL.EXE::KeLeaveCriticalRegion
UcFreeConnection
UlBugCheckEx
UlThreadPoolEnqueueWorkItem
UxGetObjectFromOpaqueId
UxPodAttachThreadUxPodDetachThread
UxQuicConnectionCopyBindings
UxQuicConnectionGetCipherInfo
UxQuicConnectionGetIdleState
UxQuicConnectionGetPeerCertificatesClient
UxQuicConnectionGetPeerIssuerListClient
UxQuicConnectionGetStatsV1
UxQuicConnectionGetStatsV2
UxQuicFreeConnection
WPP_SF_L
WPP_SF_Ll
WPP_SF_qil
WPP_SF_qqlqLq
|
Expand for full list:
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeGetCurrentIrql
NTOSKRNL.EXE::KeLeaveCriticalRegion
UcFreeConnection
UlBugCheckEx
UlThreadPoolEnqueueWorkItem
UxGetObjectFromOpaqueId
UxPodAttachThreadUxPodDetachThread
UxQuicConnectionCopyBindings
UxQuicConnectionGetIdleState
UxQuicConnectionGetPeerCertificatesClient
UxQuicConnectionGetPeerIssuerListClient
UxQuicConnectionGetStatsV1
UxQuicConnectionGetStatsV2
UxQuicFreeConnection
WPP_SF_L
WPP_SF_Ll
WPP_SF_qil
WPP_SF_qqlqLq
| |calling|UcQueryClientConnectionFastIo|UcQueryClientConnectionFastIo| |paramcount|6|6| |`address`|1401409a4|140141174| |sig|int __fastcall UcQueryClientConnectionProperty(ulonglong * param_1, undefined8 param_2, char param_3, undefined * param_4, uint param_5, undefined * param_6)|int __fastcall UcQueryClientConnectionProperty(ulonglong * param_1, undefined8 param_2, char param_3, undefined * param_4, uint param_5, undefined * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UcQueryClientConnectionProperty Called Diff ```diff --- UcQueryClientConnectionProperty called +++ UcQueryClientConnectionProperty called @@ -14 +13,0 @@ -UxQuicConnectionGetCipherInfo ``` ### UcQueryClientConnectionProperty Diff ```diff --- UcQueryClientConnectionProperty +++ UcQueryClientConnectionProperty @@ -1,301 +1,343 @@ int UcQueryClientConnectionProperty (ulonglong *param_1,undefined8 param_2,char param_3,undefined *param_4,uint param_5, undefined *param_6) { code *pcVar1; longlong *plVar2; int iVar3; longlong lVar4; - longlong lVar5; - undefined8 uVar6; + undefined8 uVar5; + undefined8 *puVar6; char cVar7; uint uVar8; int iVar9; code *pcVar10; ulonglong uVar11; longlong lVar12; - int *piVar13; - char *pcVar14; - code *pcVar15; - code *pcVar16; - undefined4 uVar17; - undefined4 uVar18; - undefined4 uVar19; + undefined8 *puVar13; + int *piVar14; + longlong lVar15; + char *pcVar16; + undefined8 *puVar17; + code *pcVar18; + code *pcVar19; undefined4 uVar20; + undefined4 uVar21; + undefined4 uVar22; + undefined4 uVar23; ulonglong local_res8; char local_38 [16]; local_res8 = 0; if ((DAT_0 & 0x10) != 0) { WPP_SF_qqlqLq(0x94,param_2,param_1,param_2); } *(undefined4 *)param_6 = 0; - pcVar16 = UcValidateClientConnectionFromId; - pcVar15 = UcReferenceClientConnectionFromId; + pcVar19 = UcValidateClientConnectionFromId; + pcVar18 = UcReferenceClientConnectionFromId; pcVar10 = (code *)UxGetObjectFromOpaqueId (*param_1,(undefined *)0x7,UcReferenceClientConnectionFromId, UcValidateClientConnectionFromId,param_2); if (pcVar10 == (code *)0x0) { iVar9 = -0x3ffffdc6; if ((DAT_1 & 0x10) != 0) { - WPP_SF_L(0x95,&WPP_3baf1a8f1c5839804353b4f9a81881b3_Traceguids,0xc000023a); + WPP_SF_L(0x95,&WPP_c863f6d3c83339e4cac94c76938dcce7_Traceguids,0xc000023a); } goto LAB_2; } KeEnterCriticalRegion(); pcVar1 = pcVar10 + 0x80; ExAcquirePushLockExclusiveEx(pcVar1,0); if (pcVar10[9] == (code)0x0) { if (*(longlong *)(pcVar10 + 0x30) == 0) { iVar9 = -0x3ffffdc6; goto LAB_3; } - piVar13 = (int *)(*(longlong *)(pcVar10 + 0x30) + 4); + piVar14 = (int *)(*(longlong *)(pcVar10 + 0x30) + 4); LOCK(); - iVar9 = *piVar13; - *piVar13 = *piVar13 + 1; + iVar9 = *piVar14; + *piVar14 = *piVar14 + 1; UNLOCK(); if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar9 + 1U)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar13,0x27,(longlong)(int)(iVar9 + 1U)); + UlBugCheckEx(3,piVar14,0x27,(longlong)(int)(iVar9 + 1U)); } lVar4 = *(longlong *)(pcVar10 + 0x30); ExReleasePushLockExclusiveEx(pcVar1,0); KeLeaveCriticalRegion(); if ((DAT_0 & 0x10) != 0) { - pcVar16 = *(code **)(pcVar10 + 0x18); - pcVar15 = pcVar10; - WPP_SF_qil(0x96,&WPP_3baf1a8f1c5839804353b4f9a81881b3_Traceguids,pcVar10,pcVar16); + pcVar19 = *(code **)(pcVar10 + 0x18); + pcVar18 = pcVar10; + WPP_SF_qil(0x96,&WPP_c863f6d3c83339e4cac94c76938dcce7_Traceguids,pcVar10,pcVar19); } iVar9 = (int)param_1[1]; if (iVar9 < 7) { if (iVar9 == 6) { if (param_5 < 0x80) goto LAB_4; - uVar6 = *(undefined8 *)(lVar4 + 0x48); + uVar5 = *(undefined8 *)(lVar4 + 0x48); *(undefined8 *)param_4 = *(undefined8 *)(lVar4 + 0x40); - *(undefined8 *)(param_4 + 8) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0x58); + *(undefined8 *)(param_4 + 8) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0x58); *(undefined8 *)(param_4 + 0x10) = *(undefined8 *)(lVar4 + 0x50); - *(undefined8 *)(param_4 + 0x18) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0x68); + *(undefined8 *)(param_4 + 0x18) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0x68); *(undefined8 *)(param_4 + 0x20) = *(undefined8 *)(lVar4 + 0x60); - *(undefined8 *)(param_4 + 0x28) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0x78); + *(undefined8 *)(param_4 + 0x28) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0x78); *(undefined8 *)(param_4 + 0x30) = *(undefined8 *)(lVar4 + 0x70); - *(undefined8 *)(param_4 + 0x38) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0x88); + *(undefined8 *)(param_4 + 0x38) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0x88); *(undefined8 *)(param_4 + 0x40) = *(undefined8 *)(lVar4 + 0x80); - *(undefined8 *)(param_4 + 0x48) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0x98); + *(undefined8 *)(param_4 + 0x48) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0x98); *(undefined8 *)(param_4 + 0x50) = *(undefined8 *)(lVar4 + 0x90); - *(undefined8 *)(param_4 + 0x58) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0xa8); + *(undefined8 *)(param_4 + 0x58) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0xa8); *(undefined8 *)(param_4 + 0x60) = *(undefined8 *)(lVar4 + 0xa0); - *(undefined8 *)(param_4 + 0x68) = uVar6; - uVar17 = *(undefined4 *)(lVar4 + 0xb0); - uVar18 = *(undefined4 *)(lVar4 + 0xb4); - uVar19 = *(undefined4 *)(lVar4 + 0xb8); - uVar20 = *(undefined4 *)(lVar4 + 0xbc); + *(undefined8 *)(param_4 + 0x68) = uVar5; + uVar20 = *(undefined4 *)(lVar4 + 0xb0); + uVar21 = *(undefined4 *)(lVar4 + 0xb4); + uVar22 = *(undefined4 *)(lVar4 + 0xb8); + uVar23 = *(undefined4 *)(lVar4 + 0xbc); LAB_5: - *(undefined4 *)(param_4 + 0x70) = uVar17; - *(undefined4 *)(param_4 + 0x74) = uVar18; - *(undefined4 *)(param_4 + 0x78) = uVar19; - *(undefined4 *)(param_4 + 0x7c) = uVar20; + *(undefined4 *)(param_4 + 0x70) = uVar20; + *(undefined4 *)(param_4 + 0x74) = uVar21; + *(undefined4 *)(param_4 + 0x78) = uVar22; + *(undefined4 *)(param_4 + 0x7c) = uVar23; *(undefined4 *)param_6 = 0x80; LAB_6: iVar9 = 0; } else if (iVar9 == 0) { - pcVar16 = (code *)(ulonglong)param_5; + pcVar19 = (code *)(ulonglong)param_5; uVar11 = UxQuicConnectionGetPeerCertificatesClient (lVar4,param_3,(uint *)param_4,param_5,(uint *)param_6); iVar9 = (int)uVar11; - pcVar15 = (code *)param_4; + pcVar18 = (code *)param_4; } else { if (iVar9 == 1) { if (0x1b < param_5) { - uVar6 = *(undefined8 *)(lVar4 + 0x354); + uVar5 = *(undefined8 *)(lVar4 + 0x354); *(undefined8 *)param_4 = *(undefined8 *)(lVar4 + 0x34c); - *(undefined8 *)(param_4 + 8) = uVar6; + *(undefined8 *)(param_4 + 8) = uVar5; *(undefined8 *)(param_4 + 0x10) = *(undefined8 *)(lVar4 + 0x35c); *(undefined4 *)(param_4 + 0x18) = *(undefined4 *)(lVar4 + 0x364); *(undefined4 *)param_6 = 0x1c; goto LAB_6; } goto LAB_4; } if (iVar9 == 2) { - pcVar16 = (code *)0x2a8; + pcVar18 = (code *)0x2a8; if (param_5 < 0x2a8) goto LAB_4; iVar9 = 0; - UxQuicConnectionGetCipherInfo(lVar4,(undefined8 *)param_4); - *(int *)param_6 = (int)pcVar16; + lVar15 = 5; + puVar6 = (undefined8 *)(lVar4 + 0x368); + do { + puVar17 = (undefined8 *)param_4; + puVar13 = puVar6; + uVar5 = puVar13[1]; + *puVar17 = *puVar13; + puVar17[1] = uVar5; + uVar5 = puVar13[3]; + puVar17[2] = puVar13[2]; + puVar17[3] = uVar5; + uVar5 = puVar13[5]; + puVar17[4] = puVar13[4]; + puVar17[5] = uVar5; + uVar5 = puVar13[7]; + puVar17[6] = puVar13[6]; + puVar17[7] = uVar5; + uVar5 = puVar13[9]; + puVar17[8] = puVar13[8]; + puVar17[9] = uVar5; + uVar5 = puVar13[0xb]; + puVar17[10] = puVar13[10]; + puVar17[0xb] = uVar5; + uVar5 = puVar13[0xd]; + puVar17[0xc] = puVar13[0xc]; + puVar17[0xd] = uVar5; + uVar5 = puVar13[0xf]; + puVar17[0xe] = puVar13[0xe]; + puVar17[0xf] = uVar5; + lVar15 = lVar15 + -1; + puVar6 = puVar13 + 0x10; + param_4 = (undefined *)(puVar17 + 0x10); + } while (lVar15 != 0); + uVar5 = puVar13[0x11]; + puVar17[0x10] = puVar13[0x10]; + puVar17[0x11] = uVar5; + uVar5 = puVar13[0x13]; + puVar17[0x12] = puVar13[0x12]; + puVar17[0x13] = uVar5; + puVar17[0x14] = puVar13[0x14]; + *(undefined4 *)param_6 = 0x2a8; } else if (iVar9 == 3) { - pcVar16 = (code *)(ulonglong)param_5; + pcVar19 = (code *)(ulonglong)param_5; iVar9 = UxQuicConnectionCopyBindings (lVar4,param_3,(undefined4 *)param_4,param_5,(uint *)param_6); - pcVar15 = (code *)param_4; + pcVar18 = (code *)param_4; } else { if ((iVar9 != 5) || (param_5 < 200)) goto LAB_4; iVar9 = UxQuicConnectionGetStatsV1(lVar4,&local_res8,(undefined8 *)param_4); - pcVar15 = (code *)param_4; + pcVar18 = (code *)param_4; if (-1 < iVar9) { *(undefined4 *)param_6 = 200; } } } goto LAB_7; } if (iVar9 == 7) { if (0x7f < param_5) { - uVar6 = *(undefined8 *)(lVar4 + 100); + uVar5 = *(undefined8 *)(lVar4 + 100); *(undefined8 *)param_4 = *(undefined8 *)(lVar4 + 0x5c); - *(undefined8 *)(param_4 + 8) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0x74); + *(undefined8 *)(param_4 + 8) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0x74); *(undefined8 *)(param_4 + 0x10) = *(undefined8 *)(lVar4 + 0x6c); - *(undefined8 *)(param_4 + 0x18) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0x84); + *(undefined8 *)(param_4 + 0x18) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0x84); *(undefined8 *)(param_4 + 0x20) = *(undefined8 *)(lVar4 + 0x7c); - *(undefined8 *)(param_4 + 0x28) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0x94); + *(undefined8 *)(param_4 + 0x28) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0x94); *(undefined8 *)(param_4 + 0x30) = *(undefined8 *)(lVar4 + 0x8c); - *(undefined8 *)(param_4 + 0x38) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0xa4); + *(undefined8 *)(param_4 + 0x38) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0xa4); *(undefined8 *)(param_4 + 0x40) = *(undefined8 *)(lVar4 + 0x9c); - *(undefined8 *)(param_4 + 0x48) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0xb4); + *(undefined8 *)(param_4 + 0x48) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0xb4); *(undefined8 *)(param_4 + 0x50) = *(undefined8 *)(lVar4 + 0xac); - *(undefined8 *)(param_4 + 0x58) = uVar6; - uVar6 = *(undefined8 *)(lVar4 + 0xc4); + *(undefined8 *)(param_4 + 0x58) = uVar5; + uVar5 = *(undefined8 *)(lVar4 + 0xc4); *(undefined8 *)(param_4 + 0x60) = *(undefined8 *)(lVar4 + 0xbc); - *(undefined8 *)(param_4 + 0x68) = uVar6; - uVar17 = *(undefined4 *)(lVar4 + 0xcc); - uVar18 = *(undefined4 *)(lVar4 + 0xd0); - uVar19 = *(undefined4 *)(lVar4 + 0xd4); - uVar20 = *(undefined4 *)(lVar4 + 0xd8); + *(undefined8 *)(param_4 + 0x68) = uVar5; + uVar20 = *(undefined4 *)(lVar4 + 0xcc); + uVar21 = *(undefined4 *)(lVar4 + 0xd0); + uVar22 = *(undefined4 *)(lVar4 + 0xd4); + uVar23 = *(undefined4 *)(lVar4 + 0xd8); goto LAB_5; } LAB_4: iVar9 = -0x3ffffff3; } else if (iVar9 == 8) { if (param_5 < 0x10) goto LAB_4; iVar9 = 0; UxQuicConnectionGetIdleState (lVar4,*(code **)(pcVar10 + 0x50) == pcVar10 + 0x50,(undefined8 *)param_4); *(undefined4 *)param_6 = 0x10; - pcVar15 = (code *)param_4; + pcVar18 = (code *)param_4; } else { if (iVar9 != 9) { if (iVar9 == 10) { if (0xcf < param_5) { - pcVar16 = (code *)param_6; + pcVar19 = (code *)param_6; iVar9 = UxQuicConnectionGetStatsV2(lVar4,&local_res8,param_4,(uint *)param_6); - pcVar15 = (code *)param_4; + pcVar18 = (code *)param_4; goto LAB_7; } } else if ((iVar9 == 0xb) && (3 < param_5)) { *(undefined4 *)param_4 = *(undefined4 *)(lVar4 + 0x698); *(undefined4 *)param_6 = 4; goto LAB_6; } goto LAB_4; } - pcVar16 = (code *)(ulonglong)param_5; + pcVar19 = (code *)(ulonglong)param_5; iVar9 = UxQuicConnectionGetPeerIssuerListClient (lVar4,param_3,(longlong *)param_4,param_5,(uint *)param_6); - pcVar15 = (code *)param_4; + pcVar18 = (code *)param_4; } LAB_7: if (lVar4 != 0) { - piVar13 = (int *)(lVar4 + 4); + piVar14 = (int *)(lVar4 + 4); LOCK(); - iVar3 = *piVar13; - *piVar13 = *piVar13 + -1; + iVar3 = *piVar14; + *piVar14 = *piVar14 + -1; UNLOCK(); uVar8 = iVar3 - 1; if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar8)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar13,0x27,(longlong)(int)uVar8); + UlBugCheckEx(3,piVar14,0x27,(longlong)(int)uVar8); } if (uVar8 == 0) { lVar12 = IoGetCurrentProcess(); - plVar2 = (longlong *)(lVar4 + 0x9c0); - lVar5 = *(longlong *)(lVar4 + 0xcb0); + plVar2 = (longlong *)(lVar4 + 0x720); + lVar15 = *(longlong *)(lVar4 + 0xa10); if (UxSystemProcess == lVar12) { local_38[0] = '\0'; local_38[1] = '\0'; local_38[2] = '\0'; local_38[3] = '\0'; local_38[4] = '\0'; local_38[5] = '\0'; local_38[6] = '\0'; local_38[7] = '\0'; local_38[8] = '\0'; local_38[9] = '\0'; local_38[10] = '\0'; local_38[0xb] = '\0'; local_38[0xc] = '\0'; local_38[0xd] = '\0'; local_38[0xe] = '\0'; local_38[0xf] = '\0'; - if (((*plVar2 != 0) || (*(longlong *)(lVar4 + 0x9d0) != 0)) || - (*(longlong *)(lVar4 + 0x9e0) != 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(1,plVar2,"minio\\http\\sys\\quicconn.h",0x456); + if (((*plVar2 != 0) || (*(longlong *)(lVar4 + 0x730) != 0)) || + (*(longlong *)(lVar4 + 0x740) != 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(1,plVar2,"minio\\http\\sys\\quicconn.h",0x44e); } cVar7 = KeGetCurrentIrql(); if (cVar7 == '\0') { - pcVar14 = local_38; - UxPodAttachThread(lVar5,(undefined8 *)pcVar14); - UxQuicFreeConnection((longlong)plVar2,pcVar14,pcVar15,(ulonglong)pcVar16); + pcVar16 = local_38; + UxPodAttachThread(lVar15,(undefined8 *)pcVar16); + UxQuicFreeConnection((longlong)plVar2,pcVar16,pcVar18,(ulonglong)pcVar19); UxPodDetachThread(local_38); goto LAB_8; } } - else if (((*plVar2 != 0) || (*(longlong *)(lVar4 + 0x9d0) != 0)) || - (*(longlong *)(lVar4 + 0x9e0) != 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(1,plVar2,"minio\\http\\sys\\quicconn.h",0x44f); - } - pcVar15 = UxQuicFreeConnection; - pcVar16 = (code *)CONCAT71((int7)((ulonglong)pcVar16 >> 8),1); - UlThreadPoolEnqueueWorkItem(0,(longlong)plVar2,UxQuicFreeConnection,'\x01',lVar5,0xffffffff) - ; + else if (((*plVar2 != 0) || (*(longlong *)(lVar4 + 0x730) != 0)) || + (*(longlong *)(lVar4 + 0x740) != 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(1,plVar2,"minio\\http\\sys\\quicconn.h",0x447); + } + pcVar18 = UxQuicFreeConnection; + pcVar19 = (code *)CONCAT71((int7)((ulonglong)pcVar19 >> 8),1); + UlThreadPoolEnqueueWorkItem + (0,(longlong)plVar2,UxQuicFreeConnection,'\x01',lVar15,0xffffffff); } } } else { iVar9 = -0x3ffffee0; LAB_3: ExReleasePushLockExclusiveEx(pcVar1,0); KeLeaveCriticalRegion(); } LAB_8: pcVar1 = pcVar10 + 4; LOCK(); iVar3 = *(int *)pcVar1; *(int *)pcVar1 = *(int *)pcVar1 + -1; UNLOCK(); uVar8 = iVar3 - 1; if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar8)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(3,pcVar1,0xb,(longlong)(int)uVar8); } if (uVar8 == 0) { - UcFreeConnection((int *)pcVar10,pcVar1,(int *)pcVar15,pcVar16); + UcFreeConnection((int *)pcVar10,pcVar1,(int *)pcVar18,pcVar19); } LAB_2: if ((DAT_0 & 0x10) != 0) { - WPP_SF_Ll(0x97,&WPP_3baf1a8f1c5839804353b4f9a81881b3_Traceguids,iVar9,*(undefined4 *)param_6); + WPP_SF_Ll(0x97,&WPP_c863f6d3c83339e4cac94c76938dcce7_Traceguids,iVar9,*(undefined4 *)param_6); } return iVar9; } ``` ## UcCaptureConnectionParameters ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.34| |i_ratio|0.62| |m_ratio|0.94| |b_ratio|0.46| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UcCaptureConnectionParameters|UcCaptureConnectionParameters| |fullname|UcCaptureConnectionParameters|UcCaptureConnectionParameters| |refcount|2|2| |`length`|1325|1129| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::IoGetRequestorProcess
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::KeStackAttachProcess
NTOSKRNL.EXE::KeUnstackDetachProcess
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::PsChargeProcessPoolQuota
UcAllocateConnectionParameters
UcFreeCaptureConnectionParameters
UlBugCheckEx
UxCaptureUnicodeStringUxCaptureUserMemory
UxFreeCapturedUnicodeString
UxGetInputBuffer
UxGetObjectFromOpaqueId
WPP_SF_L
WPP_SF_qIII
__security_check_cookie
|
Expand for full list:
NTOSKRNL.EXE::IoGetRequestorProcess
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::KeStackAttachProcess
NTOSKRNL.EXE::KeUnstackDetachProcess
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::PsChargeProcessPoolQuota
UcAllocateConnectionParameters
UcFreeCaptureConnectionParameters
UlBugCheckEx
UxAllocateRefBlob
UxCaptureUnicodeStringUxCaptureUserMemory
UxFreeCapturedUnicodeString
UxGetInputBuffer
UxGetObjectFromOpaqueId
WPP_SF_L
WPP_SF_qIII
__security_check_cookie
| |calling|UcCreateClientConnectionIoctl|UcCreateClientConnectionIoctl| |paramcount|4|4| |`address`|140146320|140146b50| |sig|int __fastcall UcCaptureConnectionParameters(undefined * param_1, ulonglong * * param_2, undefined * param_3, ulonglong * * param_4)|int __fastcall UcCaptureConnectionParameters(undefined * param_1, ulonglong * * param_2, undefined * param_3, ulonglong * * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UcCaptureConnectionParameters Called Diff ```diff --- UcCaptureConnectionParameters called +++ UcCaptureConnectionParameters called @@ -1 +0,0 @@ -NTOSKRNL.EXE::ExAllocatePool3 @@ -10,0 +10 @@ +UxAllocateRefBlob ``` ### UcCaptureConnectionParameters Diff ```diff --- UcCaptureConnectionParameters +++ UcCaptureConnectionParameters @@ -1,262 +1,224 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ int UcCaptureConnectionParameters (undefined *param_1,ulonglong **param_2,undefined *param_3,ulonglong **param_4) { - int iVar1; - char cVar2; - int iVar3; - uint uVar4; - uint uVar5; - longlong lVar6; + char cVar1; + int iVar2; + uint uVar3; + int iVar4; + longlong lVar5; + ulonglong uVar6; ulonglong uVar7; - ulonglong uVar8; - undefined4 *puVar9; - undefined8 uVar10; - undefined1 uVar11; - ulonglong **ppuVar12; - undefined8 *puVar13; - ulonglong **ppuVar14; - ulonglong *puVar15; - code *pcVar16; - code *pcVar17; - void *pvVar18; - bool bVar19; + undefined8 uVar8; + undefined1 uVar9; + ulonglong **ppuVar10; + undefined8 *puVar11; + ulonglong *puVar12; + uint uVar13; + code *pcVar14; + code *pcVar15; + void *pvVar16; undefined1 auStackY_f8 [32]; ulonglong *local_c8; ulonglong *local_c0; ulonglong *local_b8; ulonglong local_b0; ulonglong uStack_a8; ulonglong local_a0; ulonglong local_98; ulonglong uStack_90; - undefined *local_88; - undefined8 local_80; - undefined8 uStack_78; - undefined8 local_70; - undefined8 uStack_68; - undefined8 local_60; - undefined8 uStack_58; - ulonglong local_50; + undefined8 local_88; + undefined8 uStack_80; + undefined8 local_78; + undefined8 uStack_70; + undefined8 local_68; + undefined8 uStack_60; + ulonglong local_58; - local_50 = __security_cookie ^ (ulonglong)auStackY_f8; + local_58 = __security_cookie ^ (ulonglong)auStackY_f8; local_c8 = (ulonglong *)0x0; local_b8 = (ulonglong *)0x0; - bVar19 = false; + local_c0 = (ulonglong *)0x0; local_a0 = 0; - local_c0 = (ulonglong *)0x0; local_b0 = 0; uStack_a8 = 0; - local_80 = 0; - uStack_78 = 0; - local_70 = 0; - uStack_68 = 0; - local_60 = 0; - uStack_58 = 0; + local_88 = 0; + uStack_80 = 0; + local_78 = 0; + uStack_70 = 0; + local_68 = 0; + uStack_60 = 0; local_98 = 0; uStack_90 = 0; - ppuVar12 = param_2; - pcVar16 = (code *)param_3; - pcVar17 = (code *)param_4; - local_88 = param_3; + ppuVar10 = param_2; + pcVar14 = (code *)param_3; + pcVar15 = (code *)param_4; if ((DAT_0 & 0x10) != 0) { - ppuVar12 = (ulonglong **)&WPP_e2cc211bdb6c30b46889b9a2ad66f7be_Traceguids; - pcVar16 = (code *)param_1; - pcVar17 = (code *)param_2; - WPP_SF_qIII(0xe,&WPP_e2cc211bdb6c30b46889b9a2ad66f7be_Traceguids,param_1,param_2); + ppuVar10 = (ulonglong **)&WPP_609ac273db373e5fa4cdd1f132236450_Traceguids; + pcVar14 = (code *)param_1; + pcVar15 = (code *)param_2; + WPP_SF_qIII(0xe,&WPP_609ac273db373e5fa4cdd1f132236450_Traceguids,param_1,param_2); } *param_4 = (ulonglong *)0x0; - iVar3 = UcAllocateConnectionParameters(&local_c8); - if (iVar3 < 0) goto LAB_1; - cVar2 = IoIs32bitProcess(param_1); - if (cVar2 == '\0') { - pcVar17 = (code *)&local_b8; - if (UxKirHttpDscp == '\0') { - pcVar16 = (code *)0x48; - lVar6 = UxGetInputBuffer((longlong)param_1,(longlong)param_2,0x48,(longlong *)pcVar17); - iVar3 = (int)lVar6; - ppuVar12 = param_2; - if (iVar3 < 0) goto LAB_1; - } - else { - iVar1 = *(int *)(param_2 + 2); - uVar5 = 0x44; - if (iVar1 != 0x44) { - uVar5 = 0x48; - } - pcVar16 = (code *)(ulonglong)uVar5; - lVar6 = UxGetInputBuffer((longlong)param_1,(longlong)param_2,uVar5,(longlong *)pcVar17); - iVar3 = (int)lVar6; - ppuVar12 = param_2; - if (iVar3 < 0) goto LAB_1; - bVar19 = iVar1 == 0x44; - } - uVar7 = *local_b8; - puVar15 = local_b8 + 1; - pvVar18 = (void *)local_b8[7]; - uVar5 = (uint)local_b8[8]; + iVar2 = UcAllocateConnectionParameters(&local_c8); + if (iVar2 < 0) goto LAB_1; + cVar1 = IoIs32bitProcess(param_1); + iVar4 = *(int *)(param_2 + 2); + if (cVar1 == '\0') { + pcVar15 = (code *)&local_b8; + uVar13 = 0x44; + if (iVar4 != 0x44) { + uVar13 = 0x48; + } + pcVar14 = (code *)(ulonglong)uVar13; + lVar5 = UxGetInputBuffer((longlong)param_1,(longlong)param_2,uVar13,(longlong *)pcVar15); + iVar2 = (int)lVar5; + ppuVar10 = param_2; + if (iVar2 < 0) goto LAB_1; + uVar6 = *local_b8; + puVar12 = local_b8 + 1; + pvVar16 = (void *)local_b8[7]; + uVar13 = (uint)local_b8[8]; *(int *)(local_c8 + 8) = (int)local_b8[4]; *(short *)(local_c8 + 6) = (short)local_b8[3]; *(undefined4 *)((longlong)local_c8 + 0x34) = *(undefined4 *)((longlong)local_b8 + 0x1c); *(undefined4 *)((longlong)local_c8 + 0x44) = *(undefined4 *)((longlong)local_b8 + 0x24); *(int *)(local_c8 + 9) = (int)local_b8[5]; *(undefined4 *)((longlong)local_c8 + 0x4c) = *(undefined4 *)((longlong)local_b8 + 0x2c); *(int *)(local_c8 + 10) = (int)local_b8[6]; *(undefined4 *)((longlong)local_c8 + 0x54) = *(undefined4 *)((longlong)local_b8 + 0x34); - if ((UxKirHttpDscp != '\0') && (!bVar19)) { - uVar11 = *(undefined1 *)((longlong)local_b8 + 0x44); + if (iVar4 != 0x44) { + uVar9 = *(undefined1 *)((longlong)local_b8 + 0x44); goto LAB_2; } } else { - pcVar17 = (code *)&local_c0; - if (UxKirHttpDscp == '\0') { - pcVar16 = (code *)0x40; - lVar6 = UxGetInputBuffer((longlong)param_1,(longlong)param_2,0x40,(longlong *)pcVar17); - iVar3 = (int)lVar6; - ppuVar12 = param_2; - if (iVar3 < 0) goto LAB_1; - } - else { - iVar1 = *(int *)(param_2 + 2); - uVar5 = 0x38; - if (iVar1 != 0x38) { - uVar5 = 0x40; - } - pcVar16 = (code *)(ulonglong)uVar5; - lVar6 = UxGetInputBuffer((longlong)param_1,(longlong)param_2,uVar5,(longlong *)pcVar17); - iVar3 = (int)lVar6; - ppuVar12 = param_2; - if (iVar3 < 0) goto LAB_1; - bVar19 = iVar1 == 0x38; - } - puVar15 = &local_98; - uVar7 = *local_c0; - pvVar18 = (void *)(ulonglong)(uint)local_c0[6]; - uVar5 = *(uint *)((longlong)local_c0 + 0x34); + pcVar15 = (code *)&local_c0; + uVar13 = 0x38; + if (iVar4 != 0x38) { + uVar13 = 0x40; + } + pcVar14 = (code *)(ulonglong)uVar13; + lVar5 = UxGetInputBuffer((longlong)param_1,(longlong)param_2,uVar13,(longlong *)pcVar15); + iVar2 = (int)lVar5; + ppuVar10 = param_2; + if (iVar2 < 0) goto LAB_1; + puVar12 = &local_98; + uVar6 = *local_c0; + pvVar16 = (void *)(ulonglong)(uint)local_c0[6]; + uVar13 = *(uint *)((longlong)local_c0 + 0x34); local_98 = CONCAT44(local_98._4_4_,(int)local_c0[1]); uStack_90 = (ulonglong)*(uint *)((longlong)local_c0 + 0xc); *(int *)(local_c8 + 8) = (int)local_c0[3]; *(short *)(local_c8 + 6) = (short)local_c0[2]; *(undefined4 *)((longlong)local_c8 + 0x34) = *(undefined4 *)((longlong)local_c0 + 0x14); *(undefined4 *)((longlong)local_c8 + 0x44) = *(undefined4 *)((longlong)local_c0 + 0x1c); *(int *)(local_c8 + 9) = (int)local_c0[4]; *(undefined4 *)((longlong)local_c8 + 0x4c) = *(undefined4 *)((longlong)local_c0 + 0x24); *(int *)(local_c8 + 10) = (int)local_c0[5]; *(undefined4 *)((longlong)local_c8 + 0x54) = *(undefined4 *)((longlong)local_c0 + 0x2c); - if ((UxKirHttpDscp != '\0') && (!bVar19)) { - uVar11 = (undefined1)local_c0[7]; + if (iVar4 != 0x38) { + uVar9 = (undefined1)local_c0[7]; LAB_2: - *(undefined1 *)(local_c8 + 0xc) = uVar11; + *(undefined1 *)(local_c8 + 0xc) = uVar9; } } if ((int)local_c8[8] != 0) { - iVar3 = -0x3ffffff3; - ppuVar12 = param_2; + iVar2 = -0x3ffffff3; + ppuVar10 = param_2; goto LAB_1; } - if (uVar7 != 0) { - pcVar17 = UcValidateClientCredentialFromId; - pcVar16 = UcReferenceClientCredentialFromId; - ppuVar12 = (ulonglong **)0x9; - uVar7 = UxGetObjectFromOpaqueId - (uVar7,(undefined *)0x9,UcReferenceClientCredentialFromId, - UcValidateClientCredentialFromId,local_88); - if (uVar7 == 0) { - iVar3 = -0x3ffffff3; + if (uVar6 != 0) { + pcVar15 = UcValidateClientCredentialFromId; + pcVar14 = UcReferenceClientCredentialFromId; + ppuVar10 = (ulonglong **)0x9; + uVar6 = UxGetObjectFromOpaqueId + (uVar6,(undefined *)0x9,UcReferenceClientCredentialFromId, + UcValidateClientCredentialFromId,param_3); + if (uVar6 == 0) { + iVar2 = -0x3ffffff3; if ((DAT_3 & 0x10) != 0) { - pcVar16 = (code *)0xc000000d; - ppuVar12 = (ulonglong **)&WPP_e2cc211bdb6c30b46889b9a2ad66f7be_Traceguids; - WPP_SF_L(0xf,&WPP_e2cc211bdb6c30b46889b9a2ad66f7be_Traceguids,0xc000000d); + pcVar14 = (code *)0xc000000d; + ppuVar10 = (ulonglong **)&WPP_609ac273db373e5fa4cdd1f132236450_Traceguids; + WPP_SF_L(0xf,&WPP_609ac273db373e5fa4cdd1f132236450_Traceguids,0xc000000d); } goto LAB_1; } - local_c8[7] = uVar7; - } - uVar7 = IoGetRequestorProcess(param_1); - puVar13 = &local_80; - KeStackAttachProcess(uVar7,puVar13); - ppuVar12 = (ulonglong **)CONCAT71((int7)((ulonglong)puVar13 >> 8),param_1[0x40]); - pcVar16 = (code *)&local_b0; - uVar8 = UxCaptureUnicodeString((ushort *)puVar15,param_1[0x40],(longlong *)pcVar16); - puVar15 = local_c8; - iVar3 = (int)uVar8; - if (-1 < iVar3) { - if ((pvVar18 == (void *)0x0) || (uVar5 == 0)) { + local_c8[7] = uVar6; + } + uVar6 = IoGetRequestorProcess(param_1); + puVar11 = &local_88; + KeStackAttachProcess(uVar6,puVar11); + ppuVar10 = (ulonglong **)CONCAT71((int7)((ulonglong)puVar11 >> 8),param_1[0x40]); + pcVar14 = (code *)&local_b0; + uVar7 = UxCaptureUnicodeString((ushort *)puVar12,param_1[0x40],(longlong *)pcVar14); + iVar2 = (int)uVar7; + if (-1 < iVar2) { + if ((pvVar16 == (void *)0x0) || (uVar13 == 0)) { LAB_4: - uVar4 = (ushort)local_b0 + 0x68; - if ((uVar4 < 0x68) || (uVar5 = uVar4 + uVar5, uVar5 < uVar4)) { - iVar3 = -0x3fffff6b; + uVar3 = (ushort)local_b0 + 0x68; + if ((uVar3 < 0x68) || (uVar13 = uVar3 + uVar13, uVar13 < uVar3)) { + iVar2 = -0x3fffff6b; } else { - ppuVar12 = (ulonglong **)0x1; - pcVar16 = (code *)(ulonglong)uVar5; - iVar3 = PsChargeProcessPoolQuota(uVar7); - if (-1 < iVar3) { - *(uint *)(local_c8 + 2) = uVar5; - local_c8[1] = uVar7; - ObfReferenceObject(uVar7); - puVar15 = local_c8; + ppuVar10 = (ulonglong **)0x1; + pcVar14 = (code *)(ulonglong)uVar13; + iVar2 = PsChargeProcessPoolQuota(uVar6); + if (-1 < iVar2) { + *(uint *)(local_c8 + 2) = uVar13; + local_c8[1] = uVar6; + ObfReferenceObject(uVar6); + puVar12 = local_c8; local_c8[3] = local_b0; local_c8[4] = uStack_a8; local_c8[5] = local_a0; local_a0 = 0; local_c8 = (ulonglong *)0x0; - *param_4 = puVar15; + *param_4 = puVar12; local_b0 = 0; uStack_a8 = 0; } } } else { - pcVar17 = (code *)&UxLowPriorityPool; - ppuVar12 = (ulonglong **)(ulonglong)uVar5; - pcVar16 = (code *)0x42527855; - local_c8[0xb] = 0; - ppuVar14 = ppuVar12 + 3; - puVar9 = (undefined4 *)ExAllocatePool3(0x100); - if (puVar9 == (undefined4 *)0x0) { - iVar3 = -0x3fffff66; - ppuVar12 = ppuVar14; - } - else { - *puVar9 = 1; - puVar9[4] = uVar5; - *(undefined4 **)(puVar9 + 2) = puVar9 + 6; - puVar15[0xb] = (ulonglong)puVar9; - pcVar17 = (code *)CONCAT71((int7)((ulonglong)pcVar17 >> 8),param_1[0x40]); - pcVar16 = (code *)0x1; - uVar10 = UxCaptureUserMemory(pvVar18,(size_t)ppuVar12,1,param_1[0x40], - *(void **)(local_c8[0xb] + 8)); - iVar3 = (int)uVar10; - if (-1 < iVar3) goto LAB_4; - } - } - } - KeUnstackDetachProcess(&local_80); + ppuVar10 = (ulonglong **)(local_c8 + 0xb); + uVar8 = UxAllocateRefBlob(uVar13,ppuVar10); + iVar2 = (int)uVar8; + if (-1 < iVar2) { + pcVar14 = (code *)0x1; + pcVar15 = (code *)CONCAT71((int7)((ulonglong)pcVar15 >> 8),param_1[0x40]); + ppuVar10 = (ulonglong **)(ulonglong)uVar13; + uVar8 = UxCaptureUserMemory(pvVar16,(size_t)ppuVar10,1,param_1[0x40], + *(void **)(local_c8[0xb] + 8)); + iVar2 = (int)uVar8; + if (-1 < iVar2) goto LAB_4; + } + } + } + KeUnstackDetachProcess(&local_88); LAB_1: UxFreeCapturedUnicodeString(&local_b0); if (local_c8 != (ulonglong *)0x0) { LOCK(); - uVar7 = *local_c8; + uVar6 = *local_c8; *(int *)local_c8 = (int)*local_c8 + -1; UNLOCK(); - uVar5 = (int)uVar7 - 1; - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < uVar5)) { + iVar4 = (int)uVar6 + -1; + if ((UxDebugCheckRefcount != '\0') && (iVar4 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,local_c8,1,(longlong)(int)uVar5); - } - if (uVar5 == 0) { - UcFreeCaptureConnectionParameters((int *)local_c8,ppuVar12,(int *)pcVar16,pcVar17); + UlBugCheckEx(3,local_c8,1,(longlong)iVar4); + } + if (iVar4 == 0) { + UcFreeCaptureConnectionParameters((int *)local_c8,ppuVar10,(int *)pcVar14,pcVar15); } local_c8 = (ulonglong *)0x0; } if ((DAT_0 & 0x10) != 0) { - WPP_SF_L(0x10,&WPP_e2cc211bdb6c30b46889b9a2ad66f7be_Traceguids,iVar3); - } - return iVar3; + WPP_SF_L(0x10,&WPP_609ac273db373e5fa4cdd1f132236450_Traceguids,iVar2); + } + return iVar2; } ``` ## UxQuicConnectionCopyBindings ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.89| |i_ratio|0.5| |m_ratio|0.95| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxQuicConnectionCopyBindings|UxQuicConnectionCopyBindings| |fullname|UxQuicConnectionCopyBindings|UxQuicConnectionCopyBindings| |refcount|2|2| |`length`|280|321| |called|NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
memcpy|NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
memcpy| |calling|UcQueryClientConnectionProperty|UcQueryClientConnectionProperty| |paramcount|5|5| |`address`|1400e1754|1400e1ea4| |sig|undefined4 __fastcall UxQuicConnectionCopyBindings(longlong param_1, char param_2, undefined4 * param_3, uint param_4, uint * param_5)|undefined4 __fastcall UxQuicConnectionCopyBindings(longlong param_1, char param_2, undefined4 * param_3, uint param_4, uint * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxQuicConnectionCopyBindings Diff ```diff --- UxQuicConnectionCopyBindings +++ UxQuicConnectionCopyBindings @@ -1,49 +1,53 @@ undefined4 UxQuicConnectionCopyBindings (longlong param_1,char param_2,undefined4 *param_3,uint param_4,uint *param_5) { longlong lVar1; uint uVar2; + undefined4 *_Dst; undefined4 uVar3; *param_5 = 0; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_1 + 0x28,0); lVar1 = *(longlong *)(param_1 + 0x6b0); if (lVar1 == 0) { uVar3 = 0xc0000184; } else if (param_2 == '\0') { uVar2 = *(int *)(lVar1 + 8) + 0x10; *param_5 = uVar2; if (param_4 < uVar2) { uVar3 = 0x80000005; } else { uVar3 = 0; *param_3 = *(undefined4 *)(lVar1 + 8); *(undefined4 **)(param_3 + 2) = param_3 + 4; memcpy(param_3 + 4,*(void **)(lVar1 + 0x10),(ulonglong)*(uint *)(lVar1 + 8)); } } else { + _Dst = param_3 + 2; uVar2 = *(int *)(lVar1 + 8) + 8; *param_5 = uVar2; if (param_4 < uVar2) { uVar3 = 0x80000005; } else { uVar3 = 0; *param_3 = *(undefined4 *)(lVar1 + 8); - uVar2 = (int)param_3 + 8; - param_3[1] = uVar2; - memcpy((void *)(ulonglong)uVar2,*(void **)(lVar1 + 0x10),(ulonglong)*(uint *)(lVar1 + 8)); + param_3[1] = (int)_Dst; + if (UxKirWritingAndReadingUm == '\0') { + _Dst = (undefined4 *)((ulonglong)_Dst & 0xffffffff); + } + memcpy(_Dst,*(void **)(lVar1 + 0x10),(ulonglong)*(uint *)(lVar1 + 8)); } } ExReleasePushLockExclusiveEx(param_1 + 0x28,0); KeLeaveCriticalRegion(); return uVar3; } ``` ## UlSetUrlGroupIoctl ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.95| |i_ratio|0.67| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlSetUrlGroupIoctl|UlSetUrlGroupIoctl| |fullname|UlSetUrlGroupIoctl|UlSetUrlGroupIoctl| |refcount|2|2| |`length`|584|605| |called|NTOSKRNL.EXE::IoIs32bitProcess
UlGetCommChannel
UlSetConfigGroupProperty
UxCompleteIrpForReturn
UxGetInputBuffer
UxGetOutputBufferForInDirect
WPP_SF_L
WPP_SF_iq|NTOSKRNL.EXE::IoIs32bitProcess
UlGetCommChannel
UlSetConfigGroupProperty
UxCompleteIrpForReturn
UxGetInputBuffer
UxGetOutputBufferForInDirect
WPP_SF_L
WPP_SF_iq| |calling||| |paramcount|2|2| |`address`|140037880|140098b10| |sig|undefined __fastcall UlSetUrlGroupIoctl(undefined8 * * * * * param_1, longlong param_2)|undefined __fastcall UlSetUrlGroupIoctl(undefined8 * * * * * param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlSetUrlGroupIoctl Diff ```diff --- UlSetUrlGroupIoctl +++ UlSetUrlGroupIoctl @@ -1,111 +1,115 @@ void UlSetUrlGroupIoctl(undefined8 *****param_1,longlong param_2) { char cVar1; int iVar2; longlong lVar3; undefined8 ******ppppppuVar4; uint uVar5; uint local_res18 [2]; longlong local_res20; ulonglong *local_28; longlong local_20; local_res20 = 0; local_28 = (ulonglong *)0x0; local_res18[0] = 0; local_20 = 0; if ((DAT_0 & 1) != 0) { - WPP_SF_iq(0x2e,&WPP_093d4d9875f132d387d0435491be4d4d_Traceguids,param_1,param_2); + WPP_SF_iq(0x2e,&WPP_3217c3b7128b385d96320719b5abbc38_Traceguids,param_1,param_2); } iVar2 = UlGetCommChannel(param_2,&local_20); if (iVar2 < 0) goto LAB_1; lVar3 = UxGetInputBuffer((longlong)param_1,param_2,0x20,&local_res20); iVar2 = (int)lVar3; if (iVar2 < 0) goto LAB_1; iVar2 = *(int *)(local_res20 + 0x18); if (iVar2 < 10) { if (iVar2 == 9) { LAB_2: uVar5 = 8; } else if (iVar2 == 0) { LAB_3: cVar1 = IoIs32bitProcess(param_1); if (cVar1 == '\0') { uVar5 = 0x40; goto LAB_4; } uVar5 = 0x24; } else if (iVar2 == 1) { cVar1 = IoIs32bitProcess(param_1); if (cVar1 == '\0') { uVar5 = 0x48; goto LAB_4; } uVar5 = 0x30; } else { if (iVar2 != 2) { if (iVar2 == 3) { uVar5 = 0x14; goto LAB_5; } if (iVar2 == 5) goto LAB_2; if (iVar2 != 7) { if (iVar2 != 8) goto LAB_6; goto LAB_3; } } LAB_7: cVar1 = IoIs32bitProcess(param_1); if (cVar1 == '\0') { uVar5 = 0x10; goto LAB_4; } uVar5 = 8; } LAB_5: IoIs32bitProcess(param_1); lVar3 = 4; } else { if (iVar2 != 10) { if (((iVar2 != 0xb) && (iVar2 != 0xc)) && (iVar2 != 0xf)) { if (iVar2 == 0x10) goto LAB_7; if (iVar2 != 0x12) { + if ((iVar2 != 0x13) || (UxKirBrHttpQuerySocketTtl == '\0')) { LAB_6: - iVar2 = -0x3ffffff3; - goto LAB_1; + iVar2 = -0x3ffffff3; + goto LAB_1; + } + uVar5 = 0x10; + goto LAB_4; } } goto LAB_2; } cVar1 = IoIs32bitProcess(param_1); if (cVar1 != '\0') { uVar5 = 0x10; goto LAB_5; } uVar5 = 0x18; LAB_4: cVar1 = IoIs32bitProcess(param_1); lVar3 = (-(ulonglong)(cVar1 != '\0') & 0xfffffffffffffffc) + 8; } iVar2 = UxGetOutputBufferForInDirect ((longlong)param_1,param_2,uVar5,lVar3,(longlong *)&local_28,local_res18); if (-1 < iVar2) { ppppppuVar4 = UlSetConfigGroupProperty (param_1,local_20,*(undefined8 *******)(local_res20 + 0x10), *(uint *)(local_res20 + 0x18),local_28,local_res18[0]); iVar2 = (int)ppppppuVar4; } LAB_1: if ((DAT_0 & 1) != 0) { - WPP_SF_L(0x2f,&WPP_093d4d9875f132d387d0435491be4d4d_Traceguids,iVar2); + WPP_SF_L(0x2f,&WPP_3217c3b7128b385d96320719b5abbc38_Traceguids,iVar2); } UxCompleteIrpForReturn((longlong)param_1,iVar2); return; } ``` ## UxpQuicQueryConnectionInfo ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.45| |i_ratio|0.58| |m_ratio|0.93| |b_ratio|0.72| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxpQuicQueryConnectionInfo|UxpQuicQueryConnectionInfo| |fullname|UxpQuicQueryConnectionInfo|UxpQuicQueryConnectionInfo| |refcount|3|3| |`length`|1611|1416| |called|
Expand for full list:
HAL.DLL::KeQueryPerformanceCounter
KSECDD.SYS::FreeContextBuffer
McTemplateK0pqs_EtwWriteTransfer
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlAllocateChannelBindToken
UxSslGetServerCertSubjectAndIssuer
UxpQuicGetTlsParamUxpQuicQueryConnectionAddresses
WPP_SF_I
WPP_SF_L
WPP_SF_id
__security_check_cookie
memcpy
memset
|
Expand for full list:
HAL.DLL::KeQueryPerformanceCounter
KSECDD.SYS::FreeContextBuffer
McTemplateK0pqs_EtwWriteTransfer
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlAllocateChannelBindToken
UxSslGetServerCertSubjectAndIssuer
UxpQuicGetTlsParamUxpQuicQueryConnectionAddresses
WPP_SF_I
WPP_SF_L
WPP_SF_id
__security_check_cookie
memcpy
memset
| |calling|UxpQuicConnectionCheckServerCert
UxpQuicConnectionConnected|UxpQuicConnectionCheckServerCert
UxpQuicConnectionConnected| |paramcount|1|1| |`address`|1400ef0f4|1400ef804| |sig|int __fastcall UxpQuicQueryConnectionInfo(longlong param_1)|int __fastcall UxpQuicQueryConnectionInfo(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxpQuicQueryConnectionInfo Diff ```diff --- UxpQuicQueryConnectionInfo +++ UxpQuicQueryConnectionInfo @@ -1,315 +1,251 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ int UxpQuicQueryConnectionInfo(longlong param_1) { undefined8 uVar1; undefined8 uVar2; undefined8 uVar3; undefined8 *puVar4; int iVar5; undefined8 uVar6; - ulonglong uVar7; - undefined8 *puVar8; + undefined8 *puVar7; + ulonglong uVar8; undefined4 *puVar9; undefined2 uVar10; undefined8 *puVar11; undefined *puVar12; longlong lVar13; - longlong lVar14; - undefined8 *puVar15; - undefined *puVar16; - bool bVar17; + undefined8 *puVar14; + undefined *puVar15; undefined1 auStackY_378 [32]; undefined4 in_stack_fffffffffffffcac; ulonglong local_348; void *pvStack_340; undefined8 local_338; undefined8 uStack_330; undefined4 local_328; undefined8 local_320; undefined8 uStack_318; undefined8 local_310; undefined4 local_308; undefined8 local_300; undefined8 uStack_2f8; undefined8 local_2f0; undefined8 uStack_2e8; undefined8 local_2e0; undefined8 local_2d8 [86]; ulonglong local_28; local_28 = __security_cookie ^ (ulonglong)auStackY_378; local_310 = 0; local_308 = 0; local_328 = 0; puVar12 = (undefined *)0x0; local_348 = 0; pvStack_340 = (void *)0x0; local_320 = 0; uStack_318 = 0; local_338 = 0; uStack_330 = 0; memset(local_2d8,0,0x2a8); local_300 = 0; uStack_2f8 = 0; local_2e0 = 0; local_2f0 = 0; uStack_2e8 = 0; if ((DAT_0 & 0x40) != 0) { - puVar12 = &WPP_016185b96ac5364406b8259b8dc8ab21_Traceguids; - WPP_SF_I(0x7b,&WPP_016185b96ac5364406b8259b8dc8ab21_Traceguids,param_1); + puVar12 = &WPP_30545e5a5bdb3575b5a71435da803d80_Traceguids; + WPP_SF_I(0x7b,&WPP_30545e5a5bdb3575b5a71435da803d80_Traceguids,param_1); } uVar6 = KeQueryPerformanceCounter(0); - *(undefined8 *)(param_1 + 0x970) = uVar6; + *(undefined8 *)(param_1 + 0x6c8) = uVar6; iVar5 = UxpQuicQueryConnectionAddresses(param_1,puVar12); if (iVar5 < 0) goto LAB_1; - puVar12 = (undefined *)(param_1 + 0xce0); + puVar12 = (undefined *)(param_1 + 0xa40); iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),4,&local_338,(longlong)puVar12); if (iVar5 < 0) { - if ((*(byte *)(*(longlong *)(param_1 + 0xcb8) + 0x6e3) & 8) != 0) { + if ((*(byte *)(*(longlong *)(param_1 + 0xa18) + 0x6e3) & 8) != 0) { McTemplateK0pqs_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(param_1 + 0xcb8) + 0x698), - &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0xa84,param_1, + ((undefined8 *)(*(longlong *)(param_1 + 0xa18) + 0x698), + &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x7e4,param_1, CONCAT44(in_stack_fffffffffffffcac,iVar5),"Attribute_StreamSizes"); } - if ((DAT_2 & 0x40) == 0) goto LAB_1400ef6d7; + if ((DAT_2 & 0x40) == 0) goto LAB_1400efd24; uVar10 = 0x7c; } else { *(undefined4 *)(param_1 + 0x340) = (undefined4)local_338; *(undefined4 *)(param_1 + 0x344) = local_338._4_4_; *(undefined4 *)(param_1 + 0x348) = (undefined4)uStack_330; iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),0x5a,&local_320,(longlong)puVar12); if (iVar5 < 0) { - if ((*(byte *)(*(longlong *)(param_1 + 0xcb8) + 0x6e3) & 8) != 0) { + if ((*(byte *)(*(longlong *)(param_1 + 0xa18) + 0x6e3) & 8) != 0) { McTemplateK0pqs_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(param_1 + 0xcb8) + 0x698), - &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0xa84,param_1, + ((undefined8 *)(*(longlong *)(param_1 + 0xa18) + 0x698), + &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x7e4,param_1, CONCAT44(in_stack_fffffffffffffcac,iVar5),"Attribute_ConnInfo"); } - if ((DAT_2 & 0x40) == 0) goto LAB_1400ef6d7; + if ((DAT_2 & 0x40) == 0) goto LAB_1400efd24; uVar10 = 0x7d; } else { - bVar17 = UxKirSeHttpQueryCryptoParams != '\0'; - lVar14 = 5; *(undefined8 *)(param_1 + 0x34c) = local_320; *(undefined8 *)(param_1 + 0x354) = uStack_318; *(undefined8 *)(param_1 + 0x35c) = local_310; *(undefined4 *)(param_1 + 0x364) = local_308; - if (bVar17) { - iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),100,local_2d8,(longlong)puVar12); - if (iVar5 < 0) { - if ((*(byte *)(*(longlong *)(param_1 + 0xcb8) + 0x6e3) & 8) != 0) { - McTemplateK0pqs_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(param_1 + 0xcb8) + 0x698), - &HTTP_EVENT_SSL_QUERY_CIPHER_INFO_FAILURE,param_1 + 0xa84,param_1, - CONCAT44(in_stack_fffffffffffffcac,iVar5),"Attribute_CipherInfo"); - } - if ((DAT_2 & 0x40) == 0) goto LAB_1400ef6d7; - uVar10 = 0x7e; - goto LAB_3; + iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),100,local_2d8,(longlong)puVar12); + if (iVar5 < 0) { + if ((*(byte *)(*(longlong *)(param_1 + 0xa18) + 0x6e3) & 8) != 0) { + McTemplateK0pqs_EtwWriteTransfer + ((undefined8 *)(*(longlong *)(param_1 + 0xa18) + 0x698), + &HTTP_EVENT_SSL_QUERY_CIPHER_INFO_FAILURE,param_1 + 0x7e4,param_1, + CONCAT44(in_stack_fffffffffffffcac,iVar5),"Attribute_CipherInfo"); } + if ((DAT_2 & 0x40) == 0) goto LAB_1400efd24; + uVar10 = 0x7e; + } + else { lVar13 = 5; - puVar15 = local_2d8; + puVar14 = local_2d8; puVar4 = (undefined8 *)(param_1 + 0x368); do { puVar11 = puVar4; - puVar8 = puVar15; - uVar6 = puVar8[1]; - uVar1 = puVar8[2]; - uVar2 = puVar8[3]; - *puVar11 = *puVar8; + puVar7 = puVar14; + uVar6 = puVar7[1]; + uVar1 = puVar7[2]; + uVar2 = puVar7[3]; + *puVar11 = *puVar7; puVar11[1] = uVar6; - uVar6 = puVar8[4]; - uVar3 = puVar8[5]; + uVar6 = puVar7[4]; + uVar3 = puVar7[5]; puVar11[2] = uVar1; puVar11[3] = uVar2; - uVar1 = puVar8[6]; - uVar2 = puVar8[7]; + uVar1 = puVar7[6]; + uVar2 = puVar7[7]; puVar11[4] = uVar6; puVar11[5] = uVar3; - uVar6 = puVar8[8]; - uVar3 = puVar8[9]; + uVar6 = puVar7[8]; + uVar3 = puVar7[9]; puVar11[6] = uVar1; puVar11[7] = uVar2; - uVar1 = puVar8[10]; - uVar2 = puVar8[0xb]; + uVar1 = puVar7[10]; + uVar2 = puVar7[0xb]; puVar11[8] = uVar6; puVar11[9] = uVar3; - uVar6 = puVar8[0xc]; - uVar3 = puVar8[0xd]; + uVar6 = puVar7[0xc]; + uVar3 = puVar7[0xd]; puVar11[10] = uVar1; puVar11[0xb] = uVar2; - uVar1 = puVar8[0xe]; - uVar2 = puVar8[0xf]; + uVar1 = puVar7[0xe]; + uVar2 = puVar7[0xf]; puVar11[0xc] = uVar6; puVar11[0xd] = uVar3; puVar11[0xe] = uVar1; puVar11[0xf] = uVar2; lVar13 = lVar13 + -1; - puVar15 = puVar8 + 0x10; + puVar14 = puVar7 + 0x10; puVar4 = puVar11 + 0x10; } while (lVar13 != 0); - uVar1 = puVar8[0x11]; - uVar2 = puVar8[0x12]; - uVar3 = puVar8[0x13]; - uVar6 = puVar8[0x14]; - puVar11[0x10] = puVar8[0x10]; + uVar1 = puVar7[0x11]; + uVar2 = puVar7[0x12]; + uVar3 = puVar7[0x13]; + uVar6 = puVar7[0x14]; + puVar14 = &local_300; + puVar11[0x10] = puVar7[0x10]; puVar11[0x11] = uVar1; puVar11[0x12] = uVar2; puVar11[0x13] = uVar3; puVar11[0x14] = uVar6; - } - puVar15 = &local_300; - puVar16 = puVar12; - iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),0x5d,puVar15,(longlong)puVar12); - if (iVar5 < 0) { - if ((*(byte *)(*(longlong *)(param_1 + 0xcb8) + 0x6e3) & 8) != 0) { - McTemplateK0pqs_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(param_1 + 0xcb8) + 0x698), - &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0xa84,param_1, - CONCAT44(in_stack_fffffffffffffcac,iVar5),"Attribute_SessionInfo"); + puVar15 = puVar12; + iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),0x5d,puVar14,(longlong)puVar12); + if (iVar5 < 0) { + if ((*(byte *)(*(longlong *)(param_1 + 0xa18) + 0x6e3) & 8) != 0) { + McTemplateK0pqs_EtwWriteTransfer + ((undefined8 *)(*(longlong *)(param_1 + 0xa18) + 0x698), + &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x7e4,param_1, + CONCAT44(in_stack_fffffffffffffcac,iVar5),"Attribute_SessionInfo"); + } + if ((DAT_2 & 0x40) == 0) goto LAB_1400efd24; + uVar10 = 0x7f; } - if ((DAT_2 & 0x40) == 0) goto LAB_1400ef6d7; - uVar10 = 0x7f; - } - else { - *(undefined4 *)(param_1 + 0x614) = 2; - *(byte *)(param_1 + 0x610) = (byte)local_300 & 1; - if (*(longlong *)(param_1 + 0x90) == 0) { - if (UxKirSeHttpQueryCryptoParams == '\0') { - iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),100,local_2d8, + else { + *(undefined4 *)(param_1 + 0x614) = 2; + *(byte *)(param_1 + 0x610) = (byte)local_300 & 1; + if (*(longlong *)(param_1 + 0x90) == 0) { + iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),0x74,&local_348, (longlong)puVar12); - if (iVar5 < 0) { - if ((DAT_2 & 0x40) == 0) goto LAB_1400ef6d7; - uVar10 = 0x81; - goto LAB_3; + if (-1 < iVar5) { + puVar15 = &UxLowPriorityPool; + puVar9 = (undefined4 *) + ExAllocatePool3(0x100,(local_348 & 0xffffffff) + 0x10,0x43536c55); + if (puVar9 != (undefined4 *)0x0) { + *(undefined4 **)(puVar9 + 2) = puVar9 + 4; + *puVar9 = (undefined4)local_348; + puVar14 = (undefined8 *)(local_348 & 0xffffffff); + memcpy(puVar9 + 4,pvStack_340,(size_t)puVar14); + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(param_1 + 0x28); + uVar6 = 0; + *(undefined4 **)(param_1 + 0x688) = puVar9; + lVar13 = param_1 + 0x28; + ExReleasePushLockExclusiveEx(); + KeLeaveCriticalRegion(); + goto LAB_3; + } +LAB_4: + iVar5 = -0x3fffff66; + goto LAB_1; } - puVar15 = local_2d8; - puVar4 = (undefined8 *)(param_1 + 0x6b8); - do { - puVar11 = puVar4; - puVar8 = puVar15; - uVar6 = puVar8[1]; - uVar1 = puVar8[2]; - uVar2 = puVar8[3]; - *puVar11 = *puVar8; - puVar11[1] = uVar6; - uVar6 = puVar8[4]; - uVar3 = puVar8[5]; - puVar11[2] = uVar1; - puVar11[3] = uVar2; - uVar1 = puVar8[6]; - uVar2 = puVar8[7]; - puVar11[4] = uVar6; - puVar11[5] = uVar3; - uVar6 = puVar8[8]; - uVar3 = puVar8[9]; - puVar11[6] = uVar1; - puVar11[7] = uVar2; - uVar1 = puVar8[10]; - uVar2 = puVar8[0xb]; - puVar11[8] = uVar6; - puVar11[9] = uVar3; - uVar6 = puVar8[0xc]; - uVar3 = puVar8[0xd]; - puVar11[10] = uVar1; - puVar11[0xb] = uVar2; - uVar1 = puVar8[0xe]; - uVar2 = puVar8[0xf]; - puVar11[0xc] = uVar6; - puVar11[0xd] = uVar3; - puVar11[0xe] = uVar1; - puVar11[0xf] = uVar2; - lVar14 = lVar14 + -1; - puVar15 = puVar8 + 0x10; - puVar4 = puVar11 + 0x10; - } while (lVar14 != 0); - uVar1 = puVar8[0x11]; - uVar2 = puVar8[0x12]; - uVar3 = puVar8[0x13]; - uVar6 = puVar8[0x14]; - puVar11[0x10] = puVar8[0x10]; - puVar11[0x11] = uVar1; - puVar11[0x12] = uVar2; - puVar11[0x13] = uVar3; - puVar11[0x14] = uVar6; + if ((DAT_2 & 0x40) == 0) goto LAB_1400efd24; + uVar10 = 0x81; } - iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),0x74,&local_348, - (longlong)puVar12); - if (-1 < iVar5) { - puVar16 = &UxLowPriorityPool; - puVar9 = (undefined4 *)ExAllocatePool3(0x100,(local_348 & 0xffffffff) + 0x10,0x43536c55) - ; - if (puVar9 != (undefined4 *)0x0) { - *(undefined4 **)(puVar9 + 2) = puVar9 + 4; - *puVar9 = (undefined4)local_348; - puVar15 = (undefined8 *)(local_348 & 0xffffffff); - memcpy(puVar9 + 4,pvStack_340,(size_t)puVar15); - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_1 + 0x28); - uVar6 = 0; - *(undefined4 **)(param_1 + 0x688) = puVar9; - lVar14 = param_1 + 0x28; - ExReleasePushLockExclusiveEx(); - KeLeaveCriticalRegion(); + else { + uVar6 = 1; + lVar13 = param_1; + uVar8 = UxSslGetServerCertSubjectAndIssuer(param_1,1); + iVar5 = (int)uVar8; + if (-1 < iVar5) { +LAB_3: + puVar9 = UlAllocateChannelBindToken(lVar13,uVar6,puVar14,puVar15); + if (puVar9 != (undefined4 *)0x0) { + iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),0x1a,puVar9 + 2, + (longlong)puVar12); + if ((iVar5 != 0) && ((DAT_5 & 0x40) != 0)) { + WPP_SF_id(0x82,&WPP_30545e5a5bdb3575b5a71435da803d80_Traceguids,param_1,iVar5); + } + iVar5 = 0; + *(undefined4 **)(param_1 + 0x6b0) = puVar9; + uVar6 = KeQueryPerformanceCounter(0); + *(undefined8 *)(param_1 + 0x6d0) = uVar6; + goto LAB_1; + } goto LAB_4; } -LAB_5: - iVar5 = -0x3fffff66; - goto LAB_1; + if ((*(byte *)(*(longlong *)(param_1 + 0xa18) + 0x6e3) & 8) != 0) { + McTemplateK0pqs_EtwWriteTransfer + ((undefined8 *)(*(longlong *)(param_1 + 0xa18) + 0x698), + &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x7e4,param_1, + CONCAT44(in_stack_fffffffffffffcac,iVar5),"Attribute_LocalCertInfo"); + } + if ((DAT_2 & 0x40) == 0) goto LAB_1400efd24; + uVar10 = 0x80; } - if ((DAT_2 & 0x40) == 0) goto LAB_1400ef6d7; - uVar10 = 0x82; - } - else { - uVar6 = 1; - lVar14 = param_1; - uVar7 = UxSslGetServerCertSubjectAndIssuer(param_1,1); - iVar5 = (int)uVar7; - if (-1 < iVar5) { -LAB_4: - puVar9 = UlAllocateChannelBindToken(lVar14,uVar6,puVar15,puVar16); - if (puVar9 != (undefined4 *)0x0) { - iVar5 = UxpQuicGetTlsParam(*(undefined8 *)(param_1 + 0x98),0x1a,puVar9 + 2, - (longlong)puVar12); - if ((iVar5 != 0) && ((DAT_6 & 0x40) != 0)) { - WPP_SF_id(0x83,&WPP_016185b96ac5364406b8259b8dc8ab21_Traceguids,param_1,iVar5); - } - iVar5 = 0; - *(undefined4 **)(param_1 + 0x6b0) = puVar9; - uVar6 = KeQueryPerformanceCounter(0); - *(undefined8 *)(param_1 + 0x978) = uVar6; - goto LAB_1; - } - goto LAB_5; - } - if ((*(byte *)(*(longlong *)(param_1 + 0xcb8) + 0x6e3) & 8) != 0) { - McTemplateK0pqs_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(param_1 + 0xcb8) + 0x698), - &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0xa84,param_1, - CONCAT44(in_stack_fffffffffffffcac,iVar5),"Attribute_LocalCertInfo"); - } - if ((DAT_2 & 0x40) == 0) goto LAB_1400ef6d7; - uVar10 = 0x80; } } } } -LAB_3: - WPP_SF_id(uVar10,&WPP_016185b96ac5364406b8259b8dc8ab21_Traceguids,param_1,iVar5); + WPP_SF_id(uVar10,&WPP_30545e5a5bdb3575b5a71435da803d80_Traceguids,param_1,iVar5); LAB_1: if (pvStack_340 != (void *)0x0) { FreeContextBuffer(); pvStack_340 = (void *)0x0; local_348 = local_348 & 0xffffffff00000000; } if ((DAT_0 & 0x40) != 0) { - WPP_SF_L(0x84,&WPP_016185b96ac5364406b8259b8dc8ab21_Traceguids,iVar5); + WPP_SF_L(0x83,&WPP_30545e5a5bdb3575b5a71435da803d80_Traceguids,iVar5); } return iVar5; } ``` ## UlpCopyRequestInformation ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.31| |i_ratio|0.14| |m_ratio|0.98| |b_ratio|0.59| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpCopyRequestInformation|UlpCopyRequestInformation| |fullname|UlpCopyRequestInformation|UlpCopyRequestInformation| |refcount|2|2| |`length`|5185|5427| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlChannelBindRequestInfoPresent
UlCleanupAuthInfo
UlCopyUserAuthInfo
UlCopyUserChannelBindInfo
UlCopyUserTokenBindingInfo
UlGetQuicCreationStatsV2SizeUlGetTransportIdleConnectionTimeout
UlGetUserAuthInfoSize
UlGetUserChannelBindInfoSize
UlGetUserTokenBindingInfoSize
UlpCopyDscpInfo
UlpCopyInitialPacketTtl
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestSizingInfo
UlpCopyRequestTimingInfo
UlpCopySslProtocolInfo
UlpCopyTcpInfoOlderVersions
UlpCopyTcpInfoV2
UlpCopyTransportIdleConnectionTimeoutInfo
WPP_SF_L
WPP_SF_dlllll
WPP_SF_dllllll
WPP_SF_iq
WPP_SF_qLqqqq
_guard_dispatch_icall
|
Expand for full list:
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlChannelBindRequestInfoPresent
UlCleanupAuthInfo
UlCopyUserAuthInfo
UlCopyUserChannelBindInfo
UlCopyUserTokenBindingInfo
UlGetQuicCreationStatsV2SizeUlGetTransportIdleConnectionTimeout
UlGetUserAuthInfoSize
UlGetUserChannelBindInfoSize
UlGetUserTokenBindingInfoSize
UlpCopyDscpInfo
UlpCopyInitialPacketTtl
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestSizingInfo
UlpCopyRequestTimingInfo
UlpCopySslProtocolInfo
UlpCopyTcpInfoOlderVersions
UlpCopyTcpInfoV2
UlpCopyTransportIdleConnectionTimeoutInfo
WPP_SF_L
WPP_SF_dllllll
WPP_SF_iq
WPP_SF_qLqqqq
_guard_dispatch_icall
| |calling|UlpCopyRequestToBuffer|UlpCopyRequestToBuffer| |paramcount|8|8| |`address`|1400061a8|140006188| |`sig`|longlong * __fastcall UlpCopyRequestInformation(longlong * param_1, ulonglong param_2, uint param_3, longlong param_4, longlong * param_5, char param_6, byte param_7, undefined8 * param_8)|longlong * __fastcall UlpCopyRequestInformation(longlong * param_1, ulonglong param_2, uint param_3, longlong * param_4, longlong * param_5, char param_6, byte param_7, undefined8 * param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpCopyRequestInformation Called Diff ```diff --- UlpCopyRequestInformation called +++ UlpCopyRequestInformation called @@ -27 +26,0 @@ -WPP_SF_dlllll ``` ### UlpCopyRequestInformation Diff ```diff --- UlpCopyRequestInformation +++ UlpCopyRequestInformation @@ -1,740 +1,755 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ longlong * UlpCopyRequestInformation - (longlong *param_1,ulonglong param_2,uint param_3,longlong param_4,longlong *param_5, + (longlong *param_1,ulonglong param_2,uint param_3,longlong *param_4,longlong *param_5, char param_6,byte param_7,undefined8 *param_8) { longlong lVar1; int iVar2; ulonglong uVar3; undefined8 uVar4; longlong *plVar5; - uint7 uVar7; longlong *plVar6; - ulonglong uVar8; - uint uVar9; - int iVar10; - int *piVar11; - uint uVar12; - int *piVar13; - undefined4 uVar14; - bool bVar15; + ulonglong uVar7; + uint uVar8; + int iVar9; + undefined4 uVar10; + uint uVar11; + longlong *plVar12; + bool bVar13; ulonglong local_res10; uint local_res18; - longlong local_res20; - ulonglong in_stack_fffffffffffffef8; - undefined7 uVar16; - undefined4 local_d8; - char local_d4; - char local_d3; - byte local_d2; - byte local_d1; + longlong *local_res20; + ulonglong in_stack_fffffffffffffee8; + undefined7 uVar14; + byte local_e8 [4]; + uint local_e4; + undefined4 local_e0; + longlong *local_d8; char local_d0; - char local_cf; + byte local_cf; + char local_ce; int local_cc; - int *local_c8; - longlong *local_c0; + longlong *local_c8; + undefined1 local_c0; + char local_bf; + char local_be; + byte local_bd; + char local_bc; + char local_bb; + byte local_ba; + byte local_b9; char local_b8; - char local_b7; - byte local_b6; - byte local_b5; - char local_b4; - char local_b3; - char local_b2; - uint local_b0; - char local_ac; - ulonglong local_a8; - int local_a0; - int local_9c; + byte local_b7; + char local_b6; + ulonglong local_b0; + uint local_a8 [2]; + longlong *local_a0; int local_98; int local_94; int local_90; int local_8c; int local_88; int local_84; int local_80; int local_7c; int local_78; int local_74; - uint local_70; - uint local_6c; + int local_70; + int local_6c; uint local_68; uint local_64; uint local_60; uint local_5c; uint local_58; uint local_54; - uint local_50; - uint local_4c; - longlong *local_48; - uint *local_40; + uint local_50 [2]; + uint *local_48; - local_cf = '\0'; - local_b7 = '\0'; - local_b6 = 0; - local_b5 = 0; - local_b4 = '\0'; - local_b3 = '\0'; - local_b2 = '\0'; - local_b0 = 0; - plVar5 = param_1 + 3; - local_ac = *(char *)(*plVar5 + 0x1e0); + local_ce = '\0'; + local_bc = '\0'; + local_bb = '\0'; + local_ba = 0; + local_b9 = 0; + local_b8 = '\0'; + local_b7 = 0; + local_e4 = 0; + local_b6 = *(char *)(param_1[3] + 0x1e0); if (param_5 == (longlong *)0x0) { return (longlong *)0x0; } local_res10 = param_2; local_res18 = param_3; local_res20 = param_4; - local_48 = plVar5; if (param_6 == '\0') { KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(*plVar5 + 0x240,0); - } - local_d8 = (uint)local_d8._2_2_ << 0x10; - local_d4 = '\0'; - uVar14 = 0; + ExAcquirePushLockExclusiveEx(param_1[3] + 0x240,0); + } + local_e0 = (uint)local_e0._2_2_ << 0x10; local_d0 = '\0'; - local_b8 = '\0'; + local_c0 = 0; + uVar10 = 0; + local_cf = 0; + local_e8[0] = 0; if ((DAT_0 & 0x40) != 0) { - WPP_SF_iq(10,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,param_1,param_1[8]); - } - plVar5 = (longlong *)*plVar5; - uVar12 = (uint)((char)plVar5[0x3c] != '\0'); - local_40 = (uint *)(param_1 + 0x11b); - uVar9 = uVar12 + 4; - if (((*local_40 & 1) != 0) && (uVar9 = uVar12 + 4, (*local_40 & 2) == 0)) { - uVar14 = 1; - uVar9 = uVar12 + 5; + WPP_SF_iq(10,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,param_1,param_1[8]); + } + plVar5 = (longlong *)param_1[3]; + uVar11 = (uint)((char)plVar5[0x3c] != '\0'); + local_48 = (uint *)(param_1 + 0x11b); + uVar8 = uVar11 + 4; + if (((*local_48 & 1) != 0) && (uVar8 = uVar11 + 4, (*local_48 & 2) == 0)) { + uVar10 = 1; + uVar8 = uVar11 + 5; } uVar3 = UlChannelBindRequestInfoPresent((longlong)param_1); - local_d3 = (char)uVar3 != '\0'; - uVar12 = uVar9 + 1; + local_bf = (char)uVar3 != '\0'; + uVar11 = uVar8 + 1; if ((char)uVar3 == '\0') { - uVar12 = uVar9; - } - local_d2 = *(char *)((longlong)plVar5 + 0x1d1) != '\0'; - uVar9 = uVar12 + 1; + uVar11 = uVar8; + } + local_be = *(char *)((longlong)plVar5 + 0x1d1) != '\0'; + uVar8 = uVar11 + 1; if (*(char *)((longlong)plVar5 + 0x1d1) == '\0') { - uVar9 = uVar12; - } - local_d1 = plVar5[0x6e] != 0; - uVar12 = uVar9 + 1; + uVar8 = uVar11; + } + local_bd = plVar5[0x6e] != 0; + uVar11 = uVar8 + 1; if (plVar5[0x6e] == 0) { - uVar12 = uVar9; - } - uVar3 = UlGetTransportIdleConnectionTimeout((longlong)plVar5,(undefined2 *)&local_d8); + uVar11 = uVar8; + } + uVar3 = UlGetTransportIdleConnectionTimeout((longlong)plVar5,(undefined2 *)&local_e0); iVar2 = (int)uVar3; if (iVar2 < 0) { LAB_1: - uVar3 = (ulonglong)local_b0; + uVar3 = (ulonglong)local_e4; } else { - bVar15 = (short)local_d8 != 0; - if (bVar15) { - uVar12 = uVar12 + 1; - } - plVar6 = (longlong *)(ulonglong)bVar15; - uVar3 = (ulonglong)uVar12; - if ((UxKirBrHttpQuerySocketTtl != '\0') && (*(char *)(*local_48 + 0x1e0) != '\0')) { - local_b8 = '\x01'; - uVar3 = (ulonglong)(uVar12 + 1); + if ((short)local_e0 != 0) { + local_cf = 1; + uVar11 = uVar11 + 1; + } + uVar3 = (ulonglong)uVar11; + if ((((UxKirBrHttpQuerySocketTtl != '\0') && (*(char *)((longlong)param_1 + 0x63c) != '\0')) && + (*(char *)((longlong)param_1 + 0x63d) != '\0')) && + (lVar1 = param_1[3], *(char *)(lVar1 + 0x1e0) != '\0')) { + if ((DAT_2 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, + (undefined8 *)(lVar1 + 0x1f0),0x4c); + } + in_stack_fffffffffffffee8 = 0; + plVar5 = *(longlong **)(lVar1 + 0x1f0); + iVar2 = (**(code **)(*(longlong *)(lVar1 + 0x1f8) + 0x88))(plVar5,0x4c,&local_c0,local_e8,0,0) + ; + if ((DAT_2 & 1) != 0) { + plVar5 = (longlong *)&DAT_3; + WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,iVar2); + } + if (iVar2 < 0) goto LAB_1; + if (local_e8[0] != 0) { + uVar3 = (ulonglong)(uVar11 + 1); + } if ((DAT_0 & 0x40) != 0) { - plVar5 = (longlong *)&DAT_2; - WPP_SF_L(0xb,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,1); - } - } - if (UxKirHttpDscp == '\0') { - if ((DAT_0 & 0x40) != 0) { - plVar5 = (longlong *)(ulonglong)local_d1; - in_stack_fffffffffffffef8 = in_stack_fffffffffffffef8 & 0xffffffff00000000; - WPP_SF_dlllll(plVar5,(ulonglong)local_d2,(int)uVar3,uVar14); - } - } - else { - lVar1 = *local_48; - if ((DAT_3 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,lVar1 + 0x1f0,0x4b); - } - in_stack_fffffffffffffef8 = 0; - plVar5 = *(longlong **)(lVar1 + 0x1f0); - iVar2 = (**(code **)(*(longlong *)(lVar1 + 0x1f8) + 0x88))(plVar5,0x4b,&local_d4,0,0,0); - if ((DAT_3 & 1) != 0) { - plVar5 = (longlong *)&DAT_2; - WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,iVar2); - } - if (iVar2 < 0) goto LAB_1; - uVar7 = (uint7)((ulonglong)plVar5 >> 8); - if (local_d4 == '\0') { - plVar5 = (longlong *)((ulonglong)uVar7 << 8); - } - else { - plVar5 = (longlong *)CONCAT71(uVar7,1); - local_d0 = '\x01'; - uVar3 = (ulonglong)((int)uVar3 + 1); - } - if ((DAT_0 & 0x40) != 0) { - in_stack_fffffffffffffef8 = in_stack_fffffffffffffef8 & 0xffffffff00000000; - WPP_SF_dllllll(plVar6,(ulonglong)local_d1,(int)uVar3,uVar14); - plVar5 = plVar6; - } - } - local_b0 = (uint)uVar3; - local_b7 = local_d3; - local_b6 = local_d2; - local_b5 = local_d1; - local_b3 = local_d0; - local_b2 = local_b8; - local_cf = (char)uVar14; - local_b4 = bVar15; + WPP_SF_L(0xb,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,(uint)local_e8[0]); + } + } + lVar1 = param_1[3]; + if ((DAT_2 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,lVar1 + 0x1f0,0x4b); + } + in_stack_fffffffffffffee8 = 0; + plVar5 = *(longlong **)(lVar1 + 0x1f0); + iVar2 = (**(code **)(*(longlong *)(lVar1 + 0x1f8) + 0x88))(plVar5,0x4b,&local_d0,0,0,0); + if ((DAT_2 & 1) != 0) { + plVar5 = (longlong *)&DAT_3; + WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,iVar2); + } + if (iVar2 < 0) goto LAB_1; + bVar13 = local_d0 != '\0'; + if (bVar13) { + uVar3 = (ulonglong)((int)uVar3 + 1); + } + if ((DAT_0 & 0x40) != 0) { + plVar5 = (longlong *)(ulonglong)local_cf; + in_stack_fffffffffffffee8 = in_stack_fffffffffffffee8 & 0xffffffff00000000; + WPP_SF_dllllll(plVar5,(ulonglong)local_bd,(uint)uVar3,uVar10); + } + local_bc = local_bf; + local_bb = local_be; + local_ba = local_bd; + local_b9 = local_cf; + local_b7 = local_e8[0]; + local_e4 = (uint)uVar3; + local_ce = (char)uVar10; + local_b8 = bVar13; } if ((DAT_0 & 0x40) != 0) { - plVar5 = (longlong *)0xe; - WPP_SF_L(0xe,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,iVar2); + plVar5 = (longlong *)0xd; + WPP_SF_L(0xd,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,iVar2); } if (iVar2 < 0) goto LAB_4; - uVar8 = (ulonglong)local_res18; - uVar9 = (uint)param_4; - iVar10 = (int)local_res10; + uVar7 = (ulonglong)local_res18; + uVar8 = (uint)local_res20; + iVar9 = (int)local_res10; if (param_7 == 0) { if (local_res18 < 0x360) goto LAB_4; *(undefined8 *)(local_res10 + 0x358) = 0; *(undefined2 *)(local_res10 + 0x350) = 0; - local_a8 = uVar8; - if (uVar8 < uVar3 * 0x10 + 0x360) goto LAB_4; - piVar13 = (int *)((longlong)param_5 + 7U & 0xfffffffffffffff8); + local_b0 = uVar7; + if (uVar7 < uVar3 * 0x10 + 0x360) goto LAB_4; + plVar12 = (longlong *)((longlong)param_5 + 7U & 0xfffffffffffffff8); plVar5 = (longlong *) - ((ulonglong)(((uint)((longlong)param_5 + 7U) & 0xfffffff8) - iVar10) + param_4); + ((ulonglong)(((uint)((longlong)param_5 + 7U) & 0xfffffff8) - iVar9) + + (longlong)local_res20); *(longlong **)(local_res10 + 0x358) = plVar5; - *(short *)(local_res10 + 0x350) = (short)local_b0; - param_5 = (longlong *)(piVar13 + uVar3 * 4); + *(short *)(local_res10 + 0x350) = (short)local_e4; + param_5 = plVar12 + uVar3 * 2; } else { if (local_res18 < 0x1d8) goto LAB_4; *(undefined4 *)(local_res10 + 0x1d4) = 0; *(undefined2 *)(local_res10 + 0x1d0) = 0; plVar5 = (longlong *)(uVar3 * 3); - local_a8 = uVar8; - if (uVar8 < uVar3 * 0xc + 0x1d8) goto LAB_4; - piVar13 = (int *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *(uint *)(local_res10 + 0x1d4) = (uVar9 - iVar10) + (int)piVar13; - *(short *)(local_res10 + 0x1d0) = (short)local_b0; - param_5 = (longlong *)(piVar13 + uVar3 * 3); - } - local_c8 = piVar13; - local_b0 = uVar9; - local_a8 = uVar8; - if (local_cf != '\0') { - piVar11 = piVar13; - local_d8 = UlGetUserAuthInfoSize((uint *)(param_1 + 0x11b),param_7); + local_b0 = uVar7; + if (uVar7 < uVar3 * 0xc + 0x1d8) goto LAB_4; + plVar12 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); + *(uint *)(local_res10 + 0x1d4) = (uVar8 - iVar9) + (int)plVar12; + *(short *)(local_res10 + 0x1d0) = (short)local_e4; + param_5 = (longlong *)((longlong)plVar12 + uVar3 * 0xc); + } + local_e4 = uVar8; + local_d8 = param_5; + local_c8 = plVar12; + local_b0 = uVar7; + if (local_ce != '\0') { + plVar6 = local_res20; + local_e0 = UlGetUserAuthInfoSize((uint *)(param_1 + 0x11b),param_7); + local_64 = 0; + if (param_7 == 0) { + uVar3 = (longlong)param_5 + 7; + param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); + *(undefined4 *)plVar12 = 0; + *(uint *)((longlong)plVar12 + 4) = local_e0; + plVar12[1] = (ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)plVar6; + plVar12 = plVar12 + 2; + } + else { + *(undefined4 *)plVar12 = 0; + *(uint *)((longlong)plVar12 + 4) = local_e0; + *(int *)(plVar12 + 1) = ((int)plVar6 - iVar9) + (int)param_5; + plVar12 = (longlong *)((longlong)plVar12 + 0xc); + } + local_d8 = param_5; + local_c8 = plVar12; + if ((longlong)local_b0 < (longlong)((local_e0 - local_res10) + (longlong)param_5)) { + local_7c = -0x3fffffdd; + plVar5 = param_5; + } + else { + local_7c = 0; + in_stack_fffffffffffffee8 = CONCAT71((int7)(in_stack_fffffffffffffee8 >> 8),param_7); + plVar5 = param_1; + local_7c = UlCopyUserAuthInfo((longlong)param_1,param_5,(iVar9 - (int)param_5) + local_res18, + (ulonglong)(uint)((int)param_5 - iVar9) + (longlong)plVar6, + param_7,&local_64,param_8); + if (-1 < local_7c) { + param_5 = (longlong *)((ulonglong)local_64 + (longlong)local_d8); + } + } + iVar2 = local_7c; + local_cc = local_7c; + if (local_7c < 0) goto LAB_4; + } + if (local_bc != '\0') { + plVar5 = param_1; + local_e0 = UlGetUserChannelBindInfoSize((longlong)param_1,param_7); + local_5c = 0; + if (param_7 == 0) { + uVar3 = (longlong)param_5 + 7; + param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); + *(undefined4 *)plVar12 = 1; + *(uint *)((longlong)plVar12 + 4) = local_e0; + plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)local_res20) + ; + plVar12[1] = (longlong)plVar5; + plVar12 = plVar12 + 2; + } + else { + param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); + *(undefined4 *)plVar12 = 1; + *(uint *)((longlong)plVar12 + 4) = local_e0; + *(uint *)(plVar12 + 1) = (local_e4 - iVar9) + (int)param_5; + plVar12 = (longlong *)((longlong)plVar12 + 0xc); + } + local_d8 = param_5; + local_c8 = plVar12; + if ((longlong)local_b0 < (longlong)((local_e0 - local_res10) + (longlong)param_5)) { + local_78 = -0x3fffffdd; + } + else { + local_78 = 0; + in_stack_fffffffffffffee8 = CONCAT71((int7)(in_stack_fffffffffffffee8 >> 8),param_7); + plVar5 = param_1; + uVar4 = UlCopyUserChannelBindInfo + ((longlong)param_1,param_5,(iVar9 - (int)param_5) + local_res18, + (ulonglong)(uint)((int)param_5 - iVar9) + (longlong)local_res20,param_7, + (int *)&local_5c); + local_78 = (int)uVar4; + if (-1 < local_78) { + param_5 = (longlong *)((ulonglong)local_5c + (longlong)local_d8); + } + } + iVar2 = local_78; + local_cc = local_78; + if (local_78 < 0) goto LAB_4; + } + if (local_bb != '\0') { + local_e0 = 0x1c; + local_58 = 0; + if (param_7 == 0) { + uVar3 = (longlong)param_5 + 7; + param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); + *(undefined4 *)plVar12 = 2; + *(undefined4 *)((longlong)plVar12 + 4) = 0x1c; + plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)local_res20) + ; + plVar12[1] = (longlong)plVar5; + plVar12 = plVar12 + 2; + } + else { + param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); + *(undefined4 *)plVar12 = 2; + *(undefined4 *)((longlong)plVar12 + 4) = 0x1c; + *(uint *)(plVar12 + 1) = (local_e4 - iVar9) + (int)param_5; + plVar12 = (longlong *)((longlong)plVar12 + 0xc); + } + local_d8 = param_5; + local_c8 = plVar12; + if ((longlong)local_b0 < (longlong)((longlong)param_5 + (0x1c - local_res10))) { + local_74 = -0x3fffffdd; + } + else { + local_74 = 0; + in_stack_fffffffffffffee8 = CONCAT71((int7)(in_stack_fffffffffffffee8 >> 8),param_7); + plVar5 = param_1; + local_74 = UlpCopySslProtocolInfo + ((longlong)param_1,(undefined4 *)param_5, + (iVar9 - (int)param_5) + local_res18, + (ulonglong)(uint)((int)param_5 - iVar9) + (longlong)local_res20, + in_stack_fffffffffffffee8,&local_58); + if (-1 < local_74) { + param_5 = (longlong *)((ulonglong)local_58 + (longlong)local_d8); + } + } + iVar2 = local_74; + local_cc = local_74; + if (local_74 < 0) goto LAB_4; + } + if (local_ba != 0) { + plVar5 = (longlong *)(param_1[3] + 0x370); + local_e0 = UlGetUserTokenBindingInfoSize((longlong)plVar5,param_7); local_54 = 0; if (param_7 == 0) { uVar3 = (longlong)param_5 + 7; param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar11 = 0; - piVar11[1] = local_d8; - *(ulonglong *)(piVar11 + 2) = (ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20; - piVar13 = piVar11 + 4; - } - else { - *piVar13 = 0; - piVar13[1] = local_d8; - piVar13[2] = (uVar9 - iVar10) + (int)param_5; - piVar13 = piVar13 + 3; - } - local_c8 = piVar13; - local_c0 = param_5; - if ((longlong)local_a8 < (longlong)((local_d8 - local_res10) + (longlong)param_5)) { - local_7c = -0x3fffffdd; - plVar5 = param_5; - } - else { - local_7c = 0; - in_stack_fffffffffffffef8 = CONCAT71((int7)(in_stack_fffffffffffffef8 >> 8),param_7); + *(undefined4 *)plVar12 = 4; + *(uint *)((longlong)plVar12 + 4) = local_e0; + plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)local_res20) + ; + plVar12[1] = (longlong)plVar5; + plVar12 = plVar12 + 2; + } + else { + param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); + *(undefined4 *)plVar12 = 4; + *(uint *)((longlong)plVar12 + 4) = local_e0; + *(uint *)(plVar12 + 1) = (local_e4 - iVar9) + (int)param_5; + plVar12 = (longlong *)((longlong)plVar12 + 0xc); + } + local_d8 = param_5; + local_c8 = plVar12; + if ((longlong)local_b0 < (longlong)((local_e0 - local_res10) + (longlong)param_5)) { + local_70 = -0x3fffffdd; + } + else { + local_70 = 0; + in_stack_fffffffffffffee8 = CONCAT71((int7)(in_stack_fffffffffffffee8 >> 8),param_7); plVar5 = param_1; - local_7c = UlCopyUserAuthInfo((longlong)param_1,param_5,(iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20,param_7, - &local_54,param_8); - if (-1 < local_7c) { - param_5 = (longlong *)((ulonglong)local_54 + (longlong)local_c0); - } - } - iVar2 = local_7c; - local_cc = local_7c; - if (local_7c < 0) goto LAB_4; - } - if (local_b7 != '\0') { - plVar5 = param_1; - local_d8 = UlGetUserChannelBindInfoSize((longlong)param_1,param_7); - local_50 = 0; + local_70 = UlCopyUserTokenBindingInfo + ((longlong)param_1,param_5,(iVar9 - (int)param_5) + local_res18, + (ulonglong)(uint)((int)param_5 - iVar9) + (longlong)local_res20,param_7, + (int *)&local_54); + if (-1 < local_70) { + param_5 = (longlong *)((ulonglong)local_54 + (longlong)local_d8); + } + } + iVar2 = local_70; + local_cc = local_70; + if (local_70 < 0) goto LAB_4; + } + if (local_b9 != 0) { + local_e0 = 2; + local_50[0] = 0; if (param_7 == 0) { uVar3 = (longlong)param_5 + 7; param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar13 = 1; - piVar13[1] = local_d8; - plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - piVar13 = piVar13 + 4; + *(undefined4 *)plVar12 = 0xc; + *(undefined4 *)((longlong)plVar12 + 4) = 2; + plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)local_res20) + ; + plVar12[1] = (longlong)plVar5; + plVar12 = plVar12 + 2; } else { param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 1; - piVar13[1] = local_d8; - piVar13[2] = (uVar9 - iVar10) + (int)param_5; - piVar13 = piVar13 + 3; - } - local_c8 = piVar13; - local_c0 = param_5; - if ((longlong)local_a8 < (longlong)((local_d8 - local_res10) + (longlong)param_5)) { - local_78 = -0x3fffffdd; - } - else { - local_78 = 0; - in_stack_fffffffffffffef8 = CONCAT71((int7)(in_stack_fffffffffffffef8 >> 8),param_7); - plVar5 = param_1; - uVar4 = UlCopyUserChannelBindInfo - ((longlong)param_1,param_5,(iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20,param_7, - (int *)&local_50); - local_78 = (int)uVar4; - if (-1 < local_78) { - param_5 = (longlong *)((ulonglong)local_50 + (longlong)local_c0); - } - } - iVar2 = local_78; - local_cc = local_78; - if (local_78 < 0) goto LAB_4; - } - if (local_b6 != 0) { - local_d8 = 0x1c; - local_4c = 0; - if (param_7 == 0) { - uVar3 = (longlong)param_5 + 7; - param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar13 = 2; - piVar13[1] = 0x1c; - plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - piVar13 = piVar13 + 4; - } - else { - param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 2; - piVar13[1] = 0x1c; - piVar13[2] = (uVar9 - iVar10) + (int)param_5; - piVar13 = piVar13 + 3; - } - local_c8 = piVar13; - local_c0 = param_5; - if ((longlong)local_a8 < (longlong)((longlong)param_5 + (0x1c - local_res10))) { - local_74 = -0x3fffffdd; - } - else { - local_74 = 0; - in_stack_fffffffffffffef8 = CONCAT71((int7)(in_stack_fffffffffffffef8 >> 8),param_7); - plVar5 = param_1; - local_74 = UlpCopySslProtocolInfo - ((longlong)param_1,(undefined4 *)param_5, - (iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20, - in_stack_fffffffffffffef8,&local_4c); - if (-1 < local_74) { - param_5 = (longlong *)((ulonglong)local_4c + (longlong)local_c0); - } - } - iVar2 = local_74; - local_cc = local_74; - if (local_74 < 0) goto LAB_4; - } - if (local_b5 != 0) { - plVar5 = (longlong *)(*local_48 + 0x370); - local_d8 = UlGetUserTokenBindingInfoSize((longlong)plVar5,param_7); - local_70 = 0; - if (param_7 == 0) { - uVar3 = (longlong)param_5 + 7; - param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar13 = 4; - piVar13[1] = local_d8; - plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - piVar13 = piVar13 + 4; - } - else { - param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 4; - piVar13[1] = local_d8; - piVar13[2] = (uVar9 - iVar10) + (int)param_5; - piVar13 = piVar13 + 3; - } - local_c8 = piVar13; - local_c0 = param_5; - if ((longlong)local_a8 < (longlong)((local_d8 - local_res10) + (longlong)param_5)) { - local_a0 = -0x3fffffdd; - } - else { - local_a0 = 0; - in_stack_fffffffffffffef8 = CONCAT71((int7)(in_stack_fffffffffffffef8 >> 8),param_7); - plVar5 = param_1; - local_a0 = UlCopyUserTokenBindingInfo - ((longlong)param_1,param_5,(iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20,param_7, - (int *)&local_70); - if (-1 < local_a0) { - param_5 = (longlong *)((ulonglong)local_70 + (longlong)local_c0); - } - } - iVar2 = local_a0; - local_cc = local_a0; - if (local_a0 < 0) goto LAB_4; - } - if (local_b4 != '\0') { - local_d8 = 2; - local_6c = 0; - if (param_7 == 0) { - uVar3 = (longlong)param_5 + 7; - param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar13 = 0xc; - piVar13[1] = 2; - plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - piVar13 = piVar13 + 4; - } - else { - param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 0xc; - piVar13[1] = 2; - piVar13[2] = (uVar9 - iVar10) + (int)param_5; - piVar13 = piVar13 + 3; - } - local_c8 = piVar13; - local_c0 = param_5; - if ((longlong)local_a8 < (longlong)((longlong)param_5 + (2 - local_res10))) { - local_9c = -0x3fffffdd; - } - else { - local_9c = 0; - in_stack_fffffffffffffef8 = CONCAT71((int7)(in_stack_fffffffffffffef8 >> 8),param_7); + *(undefined4 *)plVar12 = 0xc; + *(undefined4 *)((longlong)plVar12 + 4) = 2; + *(uint *)(plVar12 + 1) = (local_e4 - iVar9) + (int)param_5; + plVar12 = (longlong *)((longlong)plVar12 + 0xc); + } + local_d8 = param_5; + local_c8 = plVar12; + if ((longlong)local_b0 < (longlong)((longlong)param_5 + (2 - local_res10))) { + local_6c = -0x3fffffdd; + } + else { + local_6c = 0; + in_stack_fffffffffffffee8 = CONCAT71((int7)(in_stack_fffffffffffffee8 >> 8),param_7); plVar5 = param_1; uVar3 = UlpCopyTransportIdleConnectionTimeoutInfo - ((longlong)param_1,param_5,(iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20, - in_stack_fffffffffffffef8,&local_6c); - local_9c = (int)uVar3; - if (-1 < local_9c) { - param_5 = (longlong *)((ulonglong)local_6c + (longlong)local_c0); - } - } - iVar2 = local_9c; - local_cc = local_9c; - if (local_9c < 0) goto LAB_4; - } - if ((UxKirHttpDscp != '\0') && (local_b3 != '\0')) { - local_d8 = 1; + ((longlong)param_1,param_5,(iVar9 - (int)param_5) + local_res18, + (ulonglong)(uint)((int)param_5 - iVar9) + (longlong)local_res20, + in_stack_fffffffffffffee8,local_50); + local_6c = (int)uVar3; + if (-1 < local_6c) { + param_5 = (longlong *)((ulonglong)local_50[0] + (longlong)local_d8); + } + } + iVar2 = local_6c; + local_cc = local_6c; + if (local_6c < 0) goto LAB_4; + } + if (local_b8 == '\0') { + plVar6 = (longlong *)(1 - local_res10); + } + else { + local_e0 = 1; local_68 = 0; if (param_7 == 0) { uVar3 = (longlong)param_5 + 7; param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar13 = 0xd; - piVar13[1] = 1; - plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - piVar13 = piVar13 + 4; + *(undefined4 *)plVar12 = 0xd; + *(undefined4 *)((longlong)plVar12 + 4) = 1; + plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)local_res20) + ; + plVar12[1] = (longlong)plVar5; + plVar12 = plVar12 + 2; } else { param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 0xd; - piVar13[1] = 1; - piVar13[2] = (uVar9 - iVar10) + (int)param_5; - piVar13 = piVar13 + 3; - } - local_c8 = piVar13; - local_c0 = param_5; - if ((longlong)local_a8 < (longlong)((longlong)param_5 + (1 - local_res10))) { + *(undefined4 *)plVar12 = 0xd; + *(undefined4 *)((longlong)plVar12 + 4) = 1; + *(uint *)(plVar12 + 1) = (local_e4 - iVar9) + (int)param_5; + plVar12 = (longlong *)((longlong)plVar12 + 0xc); + } + local_a0 = (longlong *)(1 - local_res10); + local_d8 = param_5; + local_c8 = plVar12; + if ((longlong)local_b0 < (longlong)local_a0 + (longlong)param_5) { local_98 = -0x3fffffdd; } else { local_98 = 0; - in_stack_fffffffffffffef8 = CONCAT71((int7)(in_stack_fffffffffffffef8 >> 8),param_7); + in_stack_fffffffffffffee8 = CONCAT71((int7)(in_stack_fffffffffffffee8 >> 8),param_7); plVar5 = param_1; local_98 = UlpCopyDscpInfo((longlong)param_1,(undefined1 *)param_5, - (iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20, - in_stack_fffffffffffffef8,&local_68); + (iVar9 - (int)param_5) + local_res18, + (ulonglong)(uint)((int)param_5 - iVar9) + (longlong)local_res20, + in_stack_fffffffffffffee8,&local_68); if (-1 < local_98) { - param_5 = (longlong *)((ulonglong)local_68 + (longlong)local_c0); - } - } + param_5 = (longlong *)((ulonglong)local_68 + (longlong)local_d8); + } + } + plVar6 = local_a0; iVar2 = local_98; local_cc = local_98; if (local_98 < 0) goto LAB_4; } - if ((UxKirBrHttpQuerySocketTtl != '\0') && (local_b2 != '\0')) { - local_d8 = 1; - local_64 = 0; + if ((UxKirBrHttpQuerySocketTtl != '\0') && (local_b7 != 0)) { + local_e0 = 1; + local_a8[0] = 0; if (param_7 == 0) { uVar3 = (longlong)param_5 + 7; param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar13 = 0xe; - piVar13[1] = 1; - plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - piVar13 = piVar13 + 4; + *(undefined4 *)plVar12 = 0xe; + *(undefined4 *)((longlong)plVar12 + 4) = 1; + plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)local_res20) + ; + plVar12[1] = (longlong)plVar5; + plVar12 = plVar12 + 2; } else { param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 0xe; - piVar13[1] = 1; - piVar13[2] = (uVar9 - iVar10) + (int)param_5; - piVar13 = piVar13 + 3; - } - local_c8 = piVar13; - local_c0 = param_5; - if ((longlong)local_a8 < (longlong)((longlong)param_5 + (1 - local_res10))) { + *(undefined4 *)plVar12 = 0xe; + *(undefined4 *)((longlong)plVar12 + 4) = 1; + *(uint *)(plVar12 + 1) = (local_e4 - iVar9) + (int)param_5; + plVar12 = (longlong *)((longlong)plVar12 + 0xc); + } + local_d8 = param_5; + local_c8 = plVar12; + if ((longlong)local_b0 < (longlong)param_5 + (longlong)plVar6) { local_94 = -0x3fffffdd; } else { local_94 = 0; - in_stack_fffffffffffffef8 = CONCAT71((int7)(in_stack_fffffffffffffef8 >> 8),param_7); + in_stack_fffffffffffffee8 = CONCAT71((int7)(in_stack_fffffffffffffee8 >> 8),param_7); plVar5 = param_1; local_94 = UlpCopyInitialPacketTtl ((longlong)param_1,(undefined1 *)param_5, - (iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20, - in_stack_fffffffffffffef8,&local_64); + (iVar9 - (int)param_5) + local_res18, + (ulonglong)(uint)((int)param_5 - iVar9) + (longlong)local_res20, + in_stack_fffffffffffffee8,local_a8); if (-1 < local_94) { - param_5 = (longlong *)((ulonglong)local_64 + (longlong)local_c0); + param_5 = (longlong *)((ulonglong)local_a8[0] + (longlong)local_d8); } } iVar2 = local_94; local_cc = local_94; if (local_94 < 0) goto LAB_4; } - local_d8 = 0xf8; - local_60 = 0; + local_e0 = 0xf8; + local_e4 = 0; + local_a8[0] = (uint)local_res20; if (param_7 == 0) { uVar3 = (longlong)param_5 + 7; param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar13 = 5; - piVar13[1] = 0xf8; - plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - piVar13 = piVar13 + 4; + *(undefined4 *)plVar12 = 5; + *(undefined4 *)((longlong)plVar12 + 4) = 0xf8; + plVar12[1] = (ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)local_res20; + plVar5 = plVar12 + 2; } else { param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 5; - piVar13[1] = 0xf8; - piVar13[2] = (uVar9 - iVar10) + (int)param_5; - piVar13 = piVar13 + 3; - } - local_c8 = piVar13; - if ((longlong)local_a8 < (longlong)((longlong)param_5 + (0xf8 - local_res10))) { + *(undefined4 *)plVar12 = 5; + *(undefined4 *)((longlong)plVar12 + 4) = 0xf8; + *(uint *)(plVar12 + 1) = (local_a8[0] - iVar9) + (int)param_5; + plVar5 = (longlong *)((longlong)plVar12 + 0xc); + } + local_c8 = plVar5; + if ((longlong)local_b0 < (longlong)((longlong)param_5 + (0xf8 - local_res10))) { local_90 = -0x3fffffdd; } else { local_90 = 0; - in_stack_fffffffffffffef8 = CONCAT71((int7)(in_stack_fffffffffffffef8 >> 8),param_7); - plVar5 = param_1; + in_stack_fffffffffffffee8 = CONCAT71((int7)(in_stack_fffffffffffffee8 >> 8),param_7); uVar4 = UlpCopyRequestTimingInfo - ((longlong)param_1,(undefined4 *)param_5,(iVar10 - (int)param_5) + local_res18 - ,(ulonglong)(uint)((int)param_5 - iVar10) + local_res20,param_7,&local_60); + ((longlong)param_1,(undefined4 *)param_5,(iVar9 - (int)param_5) + local_res18, + (ulonglong)(uint)((int)param_5 - iVar9) + (longlong)local_res20,param_7, + &local_e4); local_90 = (int)uVar4; if (-1 < local_90) { - param_5 = (longlong *)((ulonglong)local_60 + (longlong)param_5); - } - } - uVar9 = local_b0; + param_5 = (longlong *)((ulonglong)local_e4 + (longlong)param_5); + } + } iVar2 = local_90; local_cc = local_90; if (-1 < local_90) { - local_d8 = 0x38; - local_5c = 0; + local_e0 = 0x38; + local_60 = 0; if (param_7 == 0) { uVar3 = (longlong)param_5 + 7; param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar13 = 7; - piVar13[1] = 0x38; - plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - piVar13 = piVar13 + 4; + *(undefined4 *)plVar5 = 7; + *(undefined4 *)((longlong)plVar5 + 4) = 0x38; + plVar6 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)local_res20) + ; + plVar5[1] = (longlong)plVar6; + plVar12 = plVar5 + 2; } else { param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 7; - piVar13[1] = 0x38; - piVar13[2] = (local_b0 - iVar10) + (int)param_5; - piVar13 = piVar13 + 3; - } - local_c8 = piVar13; - local_c0 = param_5; - if ((longlong)local_a8 < (longlong)((longlong)param_5 + (0x38 - local_res10))) { + *(undefined4 *)plVar5 = 7; + *(undefined4 *)((longlong)plVar5 + 4) = 0x38; + *(uint *)(plVar5 + 1) = (local_a8[0] - iVar9) + (int)param_5; + plVar12 = (longlong *)((longlong)plVar5 + 0xc); + plVar6 = plVar5; + } + local_d8 = param_5; + local_c8 = plVar12; + if ((longlong)local_b0 < (longlong)((longlong)param_5 + (0x38 - local_res10))) { local_8c = -0x3fffffdd; } else { local_8c = 0; - in_stack_fffffffffffffef8 = CONCAT71((int7)(in_stack_fffffffffffffef8 >> 8),param_7); - plVar5 = param_1; + in_stack_fffffffffffffee8 = CONCAT71((int7)(in_stack_fffffffffffffee8 >> 8),param_7); + plVar6 = param_1; local_cc = local_90; uVar4 = UlpCopyRequestSizingInfo - ((longlong)param_1,param_5,(iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20, - in_stack_fffffffffffffef8,&local_5c); + ((longlong)param_1,param_5,(iVar9 - (int)param_5) + local_res18, + (ulonglong)(uint)((int)param_5 - iVar9) + (longlong)local_res20, + in_stack_fffffffffffffee8,&local_60); local_8c = (int)uVar4; if (-1 < local_8c) { - param_5 = (longlong *)((ulonglong)local_5c + (longlong)local_c0); + param_5 = (longlong *)((ulonglong)local_60 + (longlong)local_d8); } } uVar3 = local_res10; + plVar5 = plVar6; iVar2 = local_8c; local_cc = local_8c; if (-1 < local_8c) { - uVar16 = (undefined7)(in_stack_fffffffffffffef8 >> 8); + uVar14 = (undefined7)(in_stack_fffffffffffffee8 >> 8); + plVar5 = local_res20; local_cc = local_8c; - if (local_ac == '\0') { - local_d8 = 200; - local_58 = 0; + if (local_b6 == '\0') { + local_e0 = 200; + local_a0 = (longlong *)((ulonglong)local_a0 & 0xffffffff00000000); if (param_7 == 0) { uVar3 = (longlong)param_5 + 7; param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar13 = 8; - piVar13[1] = 200; - plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - piVar13 = piVar13 + 4; + *(undefined4 *)plVar12 = 8; + *(undefined4 *)((longlong)plVar12 + 4) = 200; + plVar12[1] = (ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)local_res20; + plVar12 = plVar12 + 2; } else { - param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 8; - piVar13[1] = 200; - piVar13[2] = (uVar9 - iVar10) + (int)param_5; - piVar13 = piVar13 + 3; - } - local_c8 = piVar13; - if ((longlong)local_a8 < (longlong)((longlong)param_5 + (200 - local_res10))) { + uVar3 = (longlong)param_5 + 3; + param_5 = (longlong *)(uVar3 & 0xfffffffffffffffc); + *(undefined4 *)plVar12 = 8; + *(undefined4 *)((longlong)plVar12 + 4) = 200; + *(uint *)(plVar12 + 1) = (((uint)uVar3 & 0xfffffffc) - iVar9) + (int)local_res20; + plVar12 = (longlong *)((longlong)plVar12 + 0xc); + } + local_d8 = param_5; + local_c8 = plVar12; + if ((longlong)local_b0 < (longlong)((longlong)param_5 + (200 - local_res10))) { local_84 = -0x3fffffdd; } else { local_84 = 0; - in_stack_fffffffffffffef8 = CONCAT71(uVar16,param_7); + in_stack_fffffffffffffee8 = CONCAT71(uVar14,param_7); plVar5 = param_1; - local_84 = UlpCopyQuicStats((longlong)param_1,param_5, - (iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20, - in_stack_fffffffffffffef8,&local_58); + local_84 = UlpCopyQuicStats((longlong)param_1,param_5,(iVar9 - (int)param_5) + local_res18 + ,(ulonglong)(uint)((int)param_5 - iVar9) + + (longlong)local_res20,in_stack_fffffffffffffee8, + (undefined4 *)&local_a0); if (-1 < local_84) { - param_5 = (longlong *)((ulonglong)local_58 + (longlong)param_5); + param_5 = (longlong *)(((ulonglong)local_a0 & 0xffffffff) + (longlong)local_d8); } } iVar2 = local_84; local_cc = local_84; if ((-1 < local_84) && (plVar5 = param_1, local_cc = local_84, - iVar2 = UlGetQuicCreationStatsV2Size((longlong)param_1,&local_d8), local_cc = iVar2, + iVar2 = UlGetQuicCreationStatsV2Size((longlong)param_1,&local_e0), local_cc = iVar2, -1 < iVar2)) { - local_c0 = (longlong *)((ulonglong)local_c0 & 0xffffffff00000000); + local_d8 = (longlong *)((ulonglong)local_d8 & 0xffffffff00000000); if (param_7 == 0) { uVar3 = (longlong)param_5 + 7; param_5 = (longlong *)(uVar3 & 0xfffffffffffffff8); - *piVar13 = 10; - piVar13[1] = local_d8; - plVar5 = (longlong *)((ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - local_c8 = piVar13 + 4; + *(undefined4 *)plVar12 = 10; + *(uint *)((longlong)plVar12 + 4) = local_e0; + plVar12[1] = (ulonglong)(((uint)uVar3 & 0xfffffff8) - iVar9) + (longlong)local_res20; + local_c8 = plVar12 + 2; } else { - param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 10; - piVar13[1] = local_d8; - piVar13[2] = (local_b0 - iVar10) + (int)param_5; - local_c8 = piVar13 + 3; + uVar3 = (longlong)param_5 + 3; + param_5 = (longlong *)(uVar3 & 0xfffffffffffffffc); + *(undefined4 *)plVar12 = 10; + *(uint *)((longlong)plVar12 + 4) = local_e0; + *(uint *)(plVar12 + 1) = (((uint)uVar3 & 0xfffffffc) - iVar9) + (int)local_res20; + local_c8 = (longlong *)((longlong)plVar12 + 0xc); } - if ((longlong)local_a8 < (longlong)((local_d8 - local_res10) + (longlong)param_5)) { + local_a0 = param_5; + if ((longlong)local_b0 < (longlong)((local_e0 - local_res10) + (longlong)param_5)) { local_80 = -0x3fffffdd; + plVar5 = local_res20; iVar2 = local_80; local_cc = local_80; } else { local_80 = 0; + plVar5 = param_1; iVar2 = UlpCopyQuicStatsV2((longlong)param_1,param_5, - (iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20, - CONCAT71((int7)(in_stack_fffffffffffffef8 >> 8),param_7), - (uint *)&local_c0); - plVar5 = param_1; + (iVar9 - (int)param_5) + local_res18, + (ulonglong)(uint)((int)param_5 - iVar9) + + (longlong)local_res20, + CONCAT71((int7)(in_stack_fffffffffffffee8 >> 8),param_7), + (uint *)&local_d8); local_cc = iVar2; local_80 = iVar2; if (-1 < iVar2) { - param_5 = (longlong *)(((ulonglong)local_c0 & 0xffffffff) + (longlong)param_5); + param_5 = (longlong *)(((ulonglong)local_d8 & 0xffffffff) + (longlong)local_a0); } } } } else { - local_d8 = 0x98; + local_e0 = 0x98; local_res10 = local_res10 & 0xffffffff00000000; if (param_7 == 0) { - uVar8 = (longlong)param_5 + 7; - param_5 = (longlong *)(uVar8 & 0xfffffffffffffff8); - *piVar13 = 0xb; - piVar13[1] = 0x98; - plVar5 = (longlong *)((ulonglong)(((uint)uVar8 & 0xfffffff8) - iVar10) + local_res20); - *(longlong **)(piVar13 + 2) = plVar5; - local_c8 = piVar13 + 4; + uVar7 = (longlong)param_5 + 7; + param_5 = (longlong *)(uVar7 & 0xfffffffffffffff8); + *(undefined4 *)plVar12 = 0xb; + *(undefined4 *)((longlong)plVar12 + 4) = 0x98; + plVar12[1] = (ulonglong)(((uint)uVar7 & 0xfffffff8) - iVar9) + (longlong)local_res20; + local_c8 = plVar12 + 2; } else { - param_5 = (longlong *)((longlong)param_5 + 3U & 0xfffffffffffffffc); - *piVar13 = 0xb; - piVar13[1] = 0x98; - piVar13[2] = (uVar9 - iVar10) + (int)param_5; - local_c8 = piVar13 + 3; - } - if ((longlong)local_a8 < (longlong)((longlong)param_5 + (0x98 - uVar3))) { + uVar7 = (longlong)param_5 + 3; + param_5 = (longlong *)(uVar7 & 0xfffffffffffffffc); + *(undefined4 *)plVar12 = 0xb; + *(undefined4 *)((longlong)plVar12 + 4) = 0x98; + *(uint *)(plVar12 + 1) = (((uint)uVar7 & 0xfffffffc) - iVar9) + (int)local_res20; + local_c8 = (longlong *)((longlong)plVar12 + 0xc); + } + if ((longlong)local_b0 < (longlong)((longlong)param_5 + (0x98 - uVar3))) { local_88 = -0x3fffffdd; - param_1 = plVar5; } else { local_88 = 0; - local_88 = UlpCopyTcpInfoV2((longlong)param_1,param_5, - (iVar10 - (int)param_5) + local_res18, - (ulonglong)(uint)((int)param_5 - iVar10) + local_res20, - CONCAT71(uVar16,param_7),(undefined4 *)&local_res10); + plVar5 = param_1; + local_88 = UlpCopyTcpInfoV2((longlong)param_1,param_5,(iVar9 - (int)param_5) + local_res18 + ,(ulonglong)(uint)((int)param_5 - iVar9) + + (longlong)local_res20,CONCAT71(uVar14,param_7), + (undefined4 *)&local_res10); if (-1 < local_88) { param_5 = (longlong *)((local_res10 & 0xffffffff) + (longlong)param_5); } } - plVar5 = param_1; iVar2 = local_88; local_cc = local_88; if (-1 < local_88) { - plVar5 = (longlong *)CONCAT71((int7)((ulonglong)param_1 >> 8),param_7); + plVar5 = (longlong *)CONCAT71((int7)((ulonglong)plVar5 >> 8),param_7); local_cc = local_88; - uVar4 = UlpCopyTcpInfoOlderVersions(param_7,(longlong *)&local_c8,piVar13,9); + uVar4 = UlpCopyTcpInfoOlderVersions(param_7,(longlong *)&local_c8,(int *)plVar12,9); iVar2 = (int)uVar4; local_cc = iVar2; if (-1 < iVar2) { plVar5 = (longlong *)CONCAT71((int7)((ulonglong)plVar5 >> 8),param_7); - uVar4 = UlpCopyTcpInfoOlderVersions(param_7,(longlong *)&local_c8,piVar13,6); + uVar4 = UlpCopyTcpInfoOlderVersions(param_7,(longlong *)&local_c8,(int *)plVar12,6); iVar2 = (int)uVar4; local_cc = iVar2; } } } } } LAB_4: - if (local_cf != '\0') { - UlCleanupAuthInfo(plVar5,local_40); + if (local_ce != '\0') { + UlCleanupAuthInfo(plVar5,local_48); } if (param_6 == '\0') { - ExReleasePushLockExclusiveEx(*local_48 + 0x240,0); + ExReleasePushLockExclusiveEx(param_1[3] + 0x240,0); KeLeaveCriticalRegion(); } if (-1 < iVar2) { return param_5; } /* WARNING: Subroutine does not return */ ExRaiseStatus(iVar2); } ``` ## UxpSslQuerySslConnectionInfo ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.5| |i_ratio|0.69| |m_ratio|1.0| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxpSslQuerySslConnectionInfo|UxpSslQuerySslConnectionInfo| |fullname|UxpSslQuerySslConnectionInfo|UxpSslQuerySslConnectionInfo| |refcount|2|2| |`length`|2403|2387| |called|
Expand for full list:
HAL.DLL::KeQueryPerformanceCounter
KSECDD.SYS::QueryContextAttributesW
KSECDD.SYS::QuerySecurityContextToken
McTemplateK0pqs_EtwWriteTransfer
NTOSKRNL.EXE::RtlMapSecurityErrorToNtStatus
NTOSKRNL.EXE::RtlNtStatusToDosErrorNoTeb
UlEtwEvaluateFilter
UxSslGetServerCertSubjectAndIssuer
UxSslMapSecurityStatusToCertError
UxSslMapSecurityStatusToErrorNtStatus
UxpSslProcessApplicationProtocolQueryUxpSslQueryChannelBindingInfo
UxpSslQuerySslConnectionPostHandshakeClientAuth
UxpSslQuerySslTokenBindingInfo
WPP_SF_DDL
WPP_SF_I
WPP_SF_L
WPP_SF_id
__security_check_cookie
memset
|
Expand for full list:
HAL.DLL::KeQueryPerformanceCounter
KSECDD.SYS::QueryContextAttributesW
KSECDD.SYS::QuerySecurityContextToken
McTemplateK0pqs_EtwWriteTransfer
NTOSKRNL.EXE::RtlMapSecurityErrorToNtStatus
NTOSKRNL.EXE::RtlNtStatusToDosErrorNoTeb
UlEtwEvaluateFilter
UxSslGetServerCertSubjectAndIssuer
UxSslMapSecurityStatusToCertError
UxSslMapSecurityStatusToErrorNtStatus
UxpSslProcessApplicationProtocolQueryUxpSslQueryChannelBindingInfo
UxpSslQuerySslConnectionPostHandshakeClientAuth
UxpSslQuerySslTokenBindingInfo
WPP_SF_DDL
WPP_SF_I
WPP_SF_L
WPP_SF_id
__security_check_cookie
memset
| |calling|UxpSslWaitForAscHandler|UxpSslWaitForAscHandler| |paramcount|4|4| |`address`|14009b9f0|14009bba0| |sig|ulonglong __fastcall UxpSslQuerySslConnectionInfo(longlong param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)|ulonglong __fastcall UxpSslQuerySslConnectionInfo(longlong param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxpSslQuerySslConnectionInfo Diff ```diff --- UxpSslQuerySslConnectionInfo +++ UxpSslQuerySslConnectionInfo @@ -1,384 +1,383 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong UxpSslQuerySslConnectionInfo (longlong param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4) { undefined4 uVar1; undefined4 uVar2; undefined4 uVar3; undefined4 uVar4; undefined8 uVar5; undefined8 uVar6; undefined8 uVar7; undefined8 *puVar8; undefined8 *puVar9; char cVar10; int iVar11; uint uVar12; undefined8 uVar13; undefined8 *puVar14; ulonglong uVar15; undefined2 uVar16; undefined8 *puVar17; - longlong lVar18; - int *piVar19; - ulonglong uVar20; + int *piVar18; + ulonglong uVar19; + longlong lVar20; int *piVar21; - bool bVar22; undefined1 auStackY_4a8 [32]; undefined8 in_stack_fffffffffffffb78; - undefined4 uVar24; - undefined4 *puVar23; + undefined4 uVar23; + undefined4 *puVar22; undefined8 local_468; undefined4 *puStack_460; undefined8 local_458; undefined8 uStack_450; undefined4 local_448; int local_440 [6]; undefined8 local_428; undefined8 uStack_420; undefined8 local_418; undefined4 local_410; undefined8 local_408; undefined8 uStack_400; undefined8 local_3f8; undefined8 uStack_3f0; undefined8 local_3e8; int local_3d8 [68]; undefined8 local_2c8 [86]; ulonglong local_18; - uVar24 = (undefined4)((ulonglong)in_stack_fffffffffffffb78 >> 0x20); + uVar23 = (undefined4)((ulonglong)in_stack_fffffffffffffb78 >> 0x20); local_18 = __security_cookie ^ (ulonglong)auStackY_4a8; local_448 = 0; local_418 = 0; local_410 = 0; local_458 = 0; uStack_450 = 0; local_428 = 0; uStack_420 = 0; memset(local_2c8,0,0x2a8); local_3e8 = 0; local_408 = 0; uStack_400 = 0; local_3f8 = 0; uStack_3f0 = 0; memset(local_3d8,0,0x108); local_468 = 0; puStack_460 = (undefined4 *)0x0; local_440[4] = 0; local_440[0] = 0; local_440[1] = 0; local_440[2] = 0; local_440[3] = 0; if ((DAT_0 & 1) != 0) { - WPP_SF_I(0xd2,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1); + WPP_SF_I(0xd2,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1); } if (*(char *)(param_1 + 0xe8) == '\0') { uVar13 = KeQueryPerformanceCounter(0); *(undefined8 *)(param_1 + 0x6c0) = uVar13; } iVar11 = QueryContextAttributesW(param_1 + 0x1b8,4,&local_458); if (iVar11 == 0) { *(undefined4 *)(param_1 + 0x1c8) = (undefined4)local_458; *(undefined4 *)(param_1 + 0x1cc) = local_458._4_4_; uVar12 = (uint)uStack_450; if (0x4000 < (uint)uStack_450) { uVar12 = 0x4000; } *(uint *)(param_1 + 0x1d0) = uVar12; iVar11 = QueryContextAttributesW(param_1 + 0x1b8,0x5a,&local_428); if (iVar11 == 0) { - bVar22 = UxKirSeHttpQueryCryptoParams != '\0'; *(undefined8 *)(param_1 + 0x1d4) = local_428; *(undefined8 *)(param_1 + 0x1dc) = uStack_420; *(undefined8 *)(param_1 + 0x1e4) = local_418; *(undefined4 *)(param_1 + 0x1ec) = local_410; - if (bVar22) { - iVar11 = QueryContextAttributesW(param_1 + 0x1b8,100,local_2c8); - if (iVar11 != 0) { - uVar20 = *(ulonglong *)(param_1 + 0x6a0); - if ((*(byte *)(uVar20 + 0x6e3) & 8) != 0) { - if (*(longlong *)(uVar20 + 0x6f0) != 0) { - puVar23 = *(undefined4 **)(param_1 + 0x678); - cVar10 = UlEtwEvaluateFilter(uVar20,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar23 - ,(uint)*(ushort *)(param_1 + 0x670),(ulonglong *)0x0,0); - uVar24 = (undefined4)((ulonglong)puVar23 >> 0x20); - if (cVar10 == '\0') goto LAB_1; - } - McTemplateK0pqs_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(param_1 + 0x6a0) + 0x698), - &HTTP_EVENT_SSL_QUERY_CIPHER_INFO_FAILURE,param_1 + 0x48,param_1, - CONCAT44(uVar24,iVar11),"Attribute_CipherInfo"); - } -LAB_1: - uVar12 = UxSslMapSecurityStatusToErrorNtStatus(iVar11); - uVar20 = (ulonglong)uVar12; - if ((DAT_3 & 1) == 0) goto LAB_14009c2e4; - uVar16 = 0xd5; - goto LAB_4; - } - lVar18 = 5; + iVar11 = QueryContextAttributesW(param_1 + 0x1b8,100,local_2c8); + if (iVar11 == 0) { + lVar20 = 5; puVar8 = local_2c8; puVar9 = (undefined8 *)(param_1 + 0x1f0); do { puVar17 = puVar9; puVar14 = puVar8; uVar13 = puVar14[1]; uVar5 = puVar14[2]; uVar6 = puVar14[3]; *puVar17 = *puVar14; puVar17[1] = uVar13; uVar13 = puVar14[4]; uVar7 = puVar14[5]; puVar17[2] = uVar5; puVar17[3] = uVar6; uVar5 = puVar14[6]; uVar6 = puVar14[7]; puVar17[4] = uVar13; puVar17[5] = uVar7; uVar13 = puVar14[8]; uVar7 = puVar14[9]; puVar17[6] = uVar5; puVar17[7] = uVar6; uVar5 = puVar14[10]; uVar6 = puVar14[0xb]; puVar17[8] = uVar13; puVar17[9] = uVar7; uVar13 = puVar14[0xc]; uVar7 = puVar14[0xd]; puVar17[10] = uVar5; puVar17[0xb] = uVar6; uVar5 = puVar14[0xe]; uVar6 = puVar14[0xf]; puVar17[0xc] = uVar13; puVar17[0xd] = uVar7; puVar17[0xe] = uVar5; puVar17[0xf] = uVar6; - lVar18 = lVar18 + -1; + lVar20 = lVar20 + -1; puVar8 = puVar14 + 0x10; puVar9 = puVar17 + 0x10; - } while (lVar18 != 0); + } while (lVar20 != 0); uVar5 = puVar14[0x11]; uVar1 = *(undefined4 *)(puVar14 + 0x12); uVar2 = *(undefined4 *)((longlong)puVar14 + 0x94); uVar3 = *(undefined4 *)(puVar14 + 0x13); uVar4 = *(undefined4 *)((longlong)puVar14 + 0x9c); uVar13 = puVar14[0x14]; puVar17[0x10] = puVar14[0x10]; puVar17[0x11] = uVar5; *(undefined4 *)(puVar17 + 0x12) = uVar1; *(undefined4 *)((longlong)puVar17 + 0x94) = uVar2; *(undefined4 *)(puVar17 + 0x13) = uVar3; *(undefined4 *)((longlong)puVar17 + 0x9c) = uVar4; puVar17[0x14] = uVar13; - } - iVar11 = QueryContextAttributesW(param_1 + 0x1b8,0x5d,&local_408); - if (iVar11 == 0) { - *(byte *)(param_1 + 0x498) = (byte)local_408 & 1; - uVar12 = UxpSslQuerySslConnectionPostHandshakeClientAuth(param_1); - uVar20 = (ulonglong)uVar12; - if ((int)uVar12 < 0) goto LAB_2; - if (*(char *)(param_1 + 0xe8) == '\0') { - piVar21 = local_3d8; - iVar11 = QueryContextAttributesW(param_1 + 0x1b8,0x23); - if (iVar11 != 0) { - uVar12 = UxSslMapSecurityStatusToErrorNtStatus(iVar11); - uVar20 = (ulonglong)uVar12; - if ((DAT_3 & 1) == 0) goto LAB_14009c2e4; - uVar16 = 0xd7; - goto LAB_4; - } - piVar19 = local_3d8; - uVar12 = UxpSslProcessApplicationProtocolQuery(param_1,piVar19); - uVar20 = (ulonglong)uVar12; - if ((int)uVar12 < 0) { - if ((DAT_3 & 1) != 0) { - WPP_SF_id(0xd8,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,uVar12); - } - goto LAB_2; - } - uVar12 = UxpSslQuerySslTokenBindingInfo(param_1); - uVar20 = (ulonglong)uVar12; - if ((int)uVar12 < 0) { - if ((DAT_3 & 1) != 0) { - WPP_SF_id(0xd9,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,uVar12); - } - goto LAB_2; - } - uVar15 = UxpSslQueryChannelBindingInfo - (param_1,(undefined *)piVar19,(longlong)piVar21,param_4); - uVar20 = uVar15 & 0xffffffff; - if ((int)uVar15 < 0) { - if ((DAT_3 & 1) != 0) { - WPP_SF_id(0xda,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,(int)uVar15); - } - goto LAB_2; - } - } - uVar15 = UxSslGetServerCertSubjectAndIssuer(param_1,0); - uVar20 = uVar15 & 0xffffffff; - if ((int)uVar15 < 0) goto LAB_2; - if (*(char *)(param_1 + 0xe8) == '\0') { - uVar13 = KeQueryPerformanceCounter(0); - *(undefined8 *)(param_1 + 0x6c8) = uVar13; - } - if ((*(uint *)(param_1 + 0x4a0) & 4) == 0) goto LAB_2; - if (*(char *)(param_1 + 0xe8) == '\0') { - uVar13 = KeQueryPerformanceCounter(0); - *(undefined8 *)(param_1 + 0x6d0) = uVar13; - } - iVar11 = QueryContextAttributesW(param_1 + 0x1b8,0x5f,&local_468); - if ((iVar11 != 0) || (local_468._4_4_ == 0)) { - uVar20 = 0; - *(undefined8 *)(param_1 + 0x4f0) = 0; - *(undefined8 *)(param_1 + 0x4e8) = 0; - goto LAB_2; - } - *(undefined8 *)(param_1 + 0x4e8) = local_468; - *(undefined4 **)(param_1 + 0x4f0) = puStack_460; - *(undefined4 *)(param_1 + 0x4a4) = *puStack_460; - local_440[1] = 0xa67215d8; - local_440[2] = 0x431fdbf1; - local_440[3] = 0x1751fd9e; - local_440[4] = 0xd5bfb9e5; - iVar11 = QueryContextAttributesW(param_1 + 0x1b8,0x61,local_440); + iVar11 = QueryContextAttributesW(param_1 + 0x1b8,0x5d,&local_408); if (iVar11 == 0) { - iVar11 = UxSslMapSecurityStatusToCertError(local_440[0]); - *(int *)(param_1 + 0x4f8) = iVar11; - if ((*(byte *)(*(longlong *)(param_1 + 0x1b0) + 0x2b0) & 1) == 0) goto LAB_2; - iVar11 = QuerySecurityContextToken(param_1 + 0x1b8,param_1 + 0x500); - uVar20 = 0; + *(byte *)(param_1 + 0x498) = (byte)local_408 & 1; + uVar12 = UxpSslQuerySslConnectionPostHandshakeClientAuth(param_1); + uVar19 = (ulonglong)uVar12; + if ((int)uVar12 < 0) goto LAB_1; + if (*(char *)(param_1 + 0xe8) == '\0') { + piVar21 = local_3d8; + iVar11 = QueryContextAttributesW(param_1 + 0x1b8,0x23); + if (iVar11 != 0) { + uVar12 = UxSslMapSecurityStatusToErrorNtStatus(iVar11); + uVar19 = (ulonglong)uVar12; + if ((DAT_2 & 1) == 0) goto LAB_14009c484; + uVar16 = 0xd7; + goto LAB_3; + } + piVar18 = local_3d8; + uVar12 = UxpSslProcessApplicationProtocolQuery(param_1,piVar18); + uVar19 = (ulonglong)uVar12; + if ((int)uVar12 < 0) { + if ((DAT_2 & 1) != 0) { + WPP_SF_id(0xd8,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,uVar12); + } + goto LAB_1; + } + uVar12 = UxpSslQuerySslTokenBindingInfo(param_1); + uVar19 = (ulonglong)uVar12; + if ((int)uVar12 < 0) { + if ((DAT_2 & 1) != 0) { + WPP_SF_id(0xd9,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,uVar12); + } + goto LAB_1; + } + uVar15 = UxpSslQueryChannelBindingInfo + (param_1,(undefined *)piVar18,(longlong)piVar21,param_4); + uVar19 = uVar15 & 0xffffffff; + if ((int)uVar15 < 0) { + if ((DAT_2 & 1) != 0) { + WPP_SF_id(0xda,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,(int)uVar15) + ; + } + goto LAB_1; + } + } + uVar15 = UxSslGetServerCertSubjectAndIssuer(param_1,0); + uVar19 = uVar15 & 0xffffffff; + if ((int)uVar15 < 0) goto LAB_1; + if (*(char *)(param_1 + 0xe8) == '\0') { + uVar13 = KeQueryPerformanceCounter(0); + *(undefined8 *)(param_1 + 0x6c8) = uVar13; + } + if ((*(uint *)(param_1 + 0x4a0) & 4) == 0) goto LAB_1; + if (*(char *)(param_1 + 0xe8) == '\0') { + uVar13 = KeQueryPerformanceCounter(0); + *(undefined8 *)(param_1 + 0x6d0) = uVar13; + } + iVar11 = QueryContextAttributesW(param_1 + 0x1b8,0x5f,&local_468); + if ((iVar11 != 0) || (local_468._4_4_ == 0)) { + uVar19 = 0; + *(undefined8 *)(param_1 + 0x4f0) = 0; + *(undefined8 *)(param_1 + 0x4e8) = 0; + goto LAB_1; + } + *(undefined8 *)(param_1 + 0x4e8) = local_468; + *(undefined4 **)(param_1 + 0x4f0) = puStack_460; + *(undefined4 *)(param_1 + 0x4a4) = *puStack_460; + local_440[1] = 0xa67215d8; + local_440[2] = 0x431fdbf1; + local_440[3] = 0x1751fd9e; + local_440[4] = 0xd5bfb9e5; + iVar11 = QueryContextAttributesW(param_1 + 0x1b8,0x61,local_440); if (iVar11 == 0) { - *(undefined1 *)(param_1 + 0x508) = 0; - goto LAB_2; - } - uVar15 = *(ulonglong *)(param_1 + 0x6a0); - if ((*(byte *)(uVar15 + 0x6e3) & 8) != 0) { - if (*(longlong *)(uVar15 + 0x6f0) != 0) { - puVar23 = *(undefined4 **)(param_1 + 0x678); - cVar10 = UlEtwEvaluateFilter(uVar15,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar23 + iVar11 = UxSslMapSecurityStatusToCertError(local_440[0]); + *(int *)(param_1 + 0x4f8) = iVar11; + if ((*(byte *)(*(longlong *)(param_1 + 0x1b0) + 0x2b0) & 1) == 0) goto LAB_1; + iVar11 = QuerySecurityContextToken(param_1 + 0x1b8,param_1 + 0x500); + uVar19 = 0; + if (iVar11 == 0) { + *(undefined1 *)(param_1 + 0x508) = 0; + goto LAB_1; + } + uVar15 = *(ulonglong *)(param_1 + 0x6a0); + if ((*(byte *)(uVar15 + 0x6e3) & 8) != 0) { + if (*(longlong *)(uVar15 + 0x6f0) != 0) { + puVar22 = *(undefined4 **)(param_1 + 0x678); + cVar10 = UlEtwEvaluateFilter(uVar15,(short *)(param_1 + 0x58),param_1 + 0x74,0, + puVar22,(uint)*(ushort *)(param_1 + 0x670), + (ulonglong *)0x0,0); + uVar23 = (undefined4)((ulonglong)puVar22 >> 0x20); + if (cVar10 == '\0') goto LAB_4; + } + McTemplateK0pqs_EtwWriteTransfer + ((undefined8 *)(*(longlong *)(param_1 + 0x6a0) + 0x698), + &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x48,param_1, + CONCAT44(uVar23,iVar11),"ContextToken"); + } +LAB_4: + if ((DAT_5 & 1) != 0) { + WPP_SF_id(0xdc,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,iVar11); + } + *(undefined8 *)(param_1 + 0x500) = 0; + *(undefined1 *)(param_1 + 0x508) = 1; + goto LAB_1; + } + uVar19 = *(ulonglong *)(param_1 + 0x6a0); + if ((*(byte *)(uVar19 + 0x6e3) & 8) != 0) { + if (*(longlong *)(uVar19 + 0x6f0) != 0) { + puVar22 = *(undefined4 **)(param_1 + 0x678); + cVar10 = UlEtwEvaluateFilter(uVar19,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar22 ,(uint)*(ushort *)(param_1 + 0x670),(ulonglong *)0x0,0); - uVar24 = (undefined4)((ulonglong)puVar23 >> 0x20); - if (cVar10 == '\0') goto LAB_5; + uVar23 = (undefined4)((ulonglong)puVar22 >> 0x20); + if (cVar10 == '\0') goto LAB_6; } McTemplateK0pqs_EtwWriteTransfer ((undefined8 *)(*(longlong *)(param_1 + 0x6a0) + 0x698), &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x48,param_1, - CONCAT44(uVar24,iVar11),"ContextToken"); - } -LAB_5: - if ((DAT_6 & 1) != 0) { - WPP_SF_id(0xdc,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,iVar11); - } - *(undefined8 *)(param_1 + 0x500) = 0; - *(undefined1 *)(param_1 + 0x508) = 1; - goto LAB_2; + CONCAT44(uVar23,iVar11),"Attribute_PolicyResult"); + } +LAB_6: + uVar12 = UxSslMapSecurityStatusToErrorNtStatus(iVar11); + uVar19 = (ulonglong)uVar12; + if ((DAT_2 & 1) == 0) goto LAB_14009c484; + uVar16 = 0xdb; } - uVar20 = *(ulonglong *)(param_1 + 0x6a0); - if ((*(byte *)(uVar20 + 0x6e3) & 8) != 0) { - if (*(longlong *)(uVar20 + 0x6f0) != 0) { - puVar23 = *(undefined4 **)(param_1 + 0x678); - cVar10 = UlEtwEvaluateFilter(uVar20,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar23, + else { + uVar19 = *(ulonglong *)(param_1 + 0x6a0); + if ((*(byte *)(uVar19 + 0x6e3) & 8) != 0) { + if (*(longlong *)(uVar19 + 0x6f0) != 0) { + puVar22 = *(undefined4 **)(param_1 + 0x678); + cVar10 = UlEtwEvaluateFilter(uVar19,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar22 + ,(uint)*(ushort *)(param_1 + 0x670),(ulonglong *)0x0,0); + uVar23 = (undefined4)((ulonglong)puVar22 >> 0x20); + if (cVar10 == '\0') goto LAB_7; + } + McTemplateK0pqs_EtwWriteTransfer + ((undefined8 *)(*(longlong *)(param_1 + 0x6a0) + 0x698), + &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x48,param_1, + CONCAT44(uVar23,iVar11),"Attribute_SessionInfo"); + } +LAB_7: + uVar12 = UxSslMapSecurityStatusToErrorNtStatus(iVar11); + uVar19 = (ulonglong)uVar12; + if ((DAT_2 & 1) == 0) goto LAB_14009c484; + uVar16 = 0xd6; + } + } + else { + uVar19 = *(ulonglong *)(param_1 + 0x6a0); + if ((*(byte *)(uVar19 + 0x6e3) & 8) != 0) { + if (*(longlong *)(uVar19 + 0x6f0) != 0) { + puVar22 = *(undefined4 **)(param_1 + 0x678); + cVar10 = UlEtwEvaluateFilter(uVar19,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar22, (uint)*(ushort *)(param_1 + 0x670),(ulonglong *)0x0,0); - uVar24 = (undefined4)((ulonglong)puVar23 >> 0x20); - if (cVar10 == '\0') goto LAB_7; + uVar23 = (undefined4)((ulonglong)puVar22 >> 0x20); + if (cVar10 == '\0') goto LAB_8; } McTemplateK0pqs_EtwWriteTransfer ((undefined8 *)(*(longlong *)(param_1 + 0x6a0) + 0x698), - &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x48,param_1, - CONCAT44(uVar24,iVar11),"Attribute_PolicyResult"); - } -LAB_7: - uVar12 = UxSslMapSecurityStatusToErrorNtStatus(iVar11); - uVar20 = (ulonglong)uVar12; - if ((DAT_3 & 1) == 0) goto LAB_14009c2e4; - uVar16 = 0xdb; - } - else { - uVar20 = *(ulonglong *)(param_1 + 0x6a0); - if ((*(byte *)(uVar20 + 0x6e3) & 8) != 0) { - if (*(longlong *)(uVar20 + 0x6f0) != 0) { - puVar23 = *(undefined4 **)(param_1 + 0x678); - cVar10 = UlEtwEvaluateFilter(uVar20,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar23, - (uint)*(ushort *)(param_1 + 0x670),(ulonglong *)0x0,0); - uVar24 = (undefined4)((ulonglong)puVar23 >> 0x20); - if (cVar10 == '\0') goto LAB_8; - } - McTemplateK0pqs_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(param_1 + 0x6a0) + 0x698), - &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x48,param_1, - CONCAT44(uVar24,iVar11),"Attribute_SessionInfo"); + &HTTP_EVENT_SSL_QUERY_CIPHER_INFO_FAILURE,param_1 + 0x48,param_1, + CONCAT44(uVar23,iVar11),"Attribute_CipherInfo"); } LAB_8: uVar12 = UxSslMapSecurityStatusToErrorNtStatus(iVar11); - uVar20 = (ulonglong)uVar12; - if ((DAT_3 & 1) == 0) goto LAB_14009c2e4; - uVar16 = 0xd6; + uVar19 = (ulonglong)uVar12; + if ((DAT_2 & 1) == 0) goto LAB_14009c484; + uVar16 = 0xd5; } } else { - uVar20 = *(ulonglong *)(param_1 + 0x6a0); - if ((*(byte *)(uVar20 + 0x6e3) & 8) != 0) { - if (*(longlong *)(uVar20 + 0x6f0) != 0) { - puVar23 = *(undefined4 **)(param_1 + 0x678); - cVar10 = UlEtwEvaluateFilter(uVar20,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar23, + uVar19 = *(ulonglong *)(param_1 + 0x6a0); + if ((*(byte *)(uVar19 + 0x6e3) & 8) != 0) { + if (*(longlong *)(uVar19 + 0x6f0) != 0) { + puVar22 = *(undefined4 **)(param_1 + 0x678); + cVar10 = UlEtwEvaluateFilter(uVar19,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar22, (uint)*(ushort *)(param_1 + 0x670),(ulonglong *)0x0,0); - uVar24 = (undefined4)((ulonglong)puVar23 >> 0x20); + uVar23 = (undefined4)((ulonglong)puVar22 >> 0x20); if (cVar10 == '\0') goto LAB_9; } McTemplateK0pqs_EtwWriteTransfer ((undefined8 *)(*(longlong *)(param_1 + 0x6a0) + 0x698), &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x48,param_1, - CONCAT44(uVar24,iVar11),"Attribute_ConnInfo"); + CONCAT44(uVar23,iVar11),"Attribute_ConnInfo"); } LAB_9: uVar12 = UxSslMapSecurityStatusToErrorNtStatus(iVar11); - uVar20 = (ulonglong)uVar12; - if ((DAT_3 & 1) == 0) goto LAB_14009c2e4; + uVar19 = (ulonglong)uVar12; + if ((DAT_2 & 1) == 0) goto LAB_14009c484; uVar16 = 0xd4; } } else { - uVar20 = *(ulonglong *)(param_1 + 0x6a0); - if ((*(byte *)(uVar20 + 0x6e3) & 8) != 0) { - if (*(longlong *)(uVar20 + 0x6f0) != 0) { - puVar23 = *(undefined4 **)(param_1 + 0x678); - cVar10 = UlEtwEvaluateFilter(uVar20,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar23, + uVar19 = *(ulonglong *)(param_1 + 0x6a0); + if ((*(byte *)(uVar19 + 0x6e3) & 8) != 0) { + if (*(longlong *)(uVar19 + 0x6f0) != 0) { + puVar22 = *(undefined4 **)(param_1 + 0x678); + cVar10 = UlEtwEvaluateFilter(uVar19,(short *)(param_1 + 0x58),param_1 + 0x74,0,puVar22, (uint)*(ushort *)(param_1 + 0x670),(ulonglong *)0x0,0); - uVar24 = (undefined4)((ulonglong)puVar23 >> 0x20); + uVar23 = (undefined4)((ulonglong)puVar22 >> 0x20); if (cVar10 == '\0') goto LAB_10; } McTemplateK0pqs_EtwWriteTransfer ((undefined8 *)(*(longlong *)(param_1 + 0x6a0) + 0x698), &HTTP_EVENT_SSL_QUERY_CONN_INFO_FAILURE,param_1 + 0x48,param_1, - CONCAT44(uVar24,iVar11),"Attribute_StreamSizes"); + CONCAT44(uVar23,iVar11),"Attribute_StreamSizes"); } LAB_10: uVar12 = RtlMapSecurityErrorToNtStatus(iVar11); - uVar20 = (ulonglong)uVar12; - if ((DAT_3 & 1) != 0) { + uVar19 = (ulonglong)uVar12; + if ((DAT_2 & 1) != 0) { RtlNtStatusToDosErrorNoTeb(uVar12); WPP_SF_DDL(10,&WPP_0bc7d871aa9c336ae6b9b3be63cc5e1c_Traceguids,iVar11,uVar12); } if ((uVar12 & 0xc0000000) != 0xc0000000) { - uVar20 = 0xc0000001; - } - if ((DAT_3 & 1) == 0) goto LAB_14009c2e4; + uVar19 = 0xc0000001; + } + if ((DAT_2 & 1) == 0) goto LAB_14009c484; uVar16 = 0xd3; } -LAB_4: - WPP_SF_id(uVar16,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,iVar11); -LAB_2: +LAB_3: + WPP_SF_id(uVar16,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,iVar11); +LAB_1: if ((*(char *)(param_1 + 0xe8) == '\0') && ((*(uint *)(param_1 + 0x4a0) & 4) != 0)) { uVar13 = KeQueryPerformanceCounter(0); *(undefined8 *)(param_1 + 0x6d8) = uVar13; } if ((DAT_0 & 1) != 0) { - WPP_SF_L(0xdd,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,(int)uVar20); - } - return uVar20; + WPP_SF_L(0xdd,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,(int)uVar19); + } + return uVar19; } ``` ## UlGenerateTrailers ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,refcount,length,address| |ratio|0.34| |i_ratio|0.1| |m_ratio|0.91| |b_ratio|0.68| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlGenerateTrailers|UlGenerateTrailers| |fullname|UlGenerateTrailers|UlGenerateTrailers| |`refcount`|6|5| |`length`|647|784| |called|NTOSKRNL.EXE::IoIs32bitProcess
UlProbeAnsiString
UlProbeForRead
UlSetParsedHeader
WPP_SF_L
WPP_SF_qqlqq
memcpy|NTOSKRNL.EXE::IoIs32bitProcess
UlProbeAnsiString
UlProbeForRead
UlSetParsedHeader
WPP_SF_L
WPP_SF_qqlqq
memcpy| |calling|UlFastSendHttpResponseOld
UlpPrepareHttpResponse
UlpPrepareHttpResponseOld
UlpPrepareSendFastTracker|UlFastSendHttpResponseOld
UlpPrepareHttpResponse
UlpPrepareHttpResponseOld
UlpPrepareSendFastTracker| |paramcount|7|7| |`address`|1400741f0|14009de00| |sig|int __fastcall UlGenerateTrailers(undefined8 param_1, longlong param_2, char param_3, byte * param_4, uint param_5, longlong * param_6, int * param_7)|int __fastcall UlGenerateTrailers(undefined8 param_1, longlong param_2, char param_3, byte * param_4, uint param_5, longlong * param_6, int * param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlGenerateTrailers Diff ```diff --- UlGenerateTrailers +++ UlGenerateTrailers @@ -1,78 +1,111 @@ int UlGenerateTrailers(undefined8 param_1,longlong param_2,char param_3,byte *param_4,uint param_5, longlong *param_6,int *param_7) { ushort *puVar1; - ushort uVar2; + longlong lVar2; ushort uVar3; ushort uVar4; - ulonglong uVar5; - char cVar6; - ushort uVar7; + ushort uVar5; + ulonglong uVar6; + char cVar7; int iVar8; - byte *pbVar9; + uint uVar9; + uint uVar10; byte *_Dst; - byte *pbVar10; - uint uVar11; + byte *pbVar11; + byte *pbVar12; + ulonglong _Size; + ushort uVar13; + iVar8 = 0; if ((DAT_0 & 0x20) != 0) { - WPP_SF_qqlqq(0x8b,&WPP_aee5f1d9509b337e9d647e3a3f21c431_Traceguids,param_2,param_4); + WPP_SF_qqlqq(0x8b,&WPP_6be8f1a1a6dc3a7610af4fdeda223eb8_Traceguids,param_2,param_4); } *param_7 = 0; - iVar8 = 0; - if ((param_2 != 0) && (uVar5 = *(ulonglong *)(param_2 + 0x10), iVar8 = 0, uVar5 != 0)) { - uVar2 = *(ushort *)(param_2 + 8); - if (uVar2 != 0) { - if (uVar2 < 10000) { - cVar6 = IoIs32bitProcess(param_1); - if (cVar6 == '\0') { - UlProbeForRead(uVar5,(ulonglong)uVar2 * 0x18,8,param_3); + if ((param_2 != 0) && (uVar6 = *(ulonglong *)(param_2 + 0x10), uVar6 != 0)) { + uVar3 = *(ushort *)(param_2 + 8); + if (uVar3 != 0) { + if (uVar3 < 10000) { + cVar7 = IoIs32bitProcess(param_1); + if (cVar7 == '\0') { + UlProbeForRead(uVar6,(ulonglong)uVar3 * 0x18,8,param_3); } - uVar11 = param_5; + uVar13 = 0; iVar8 = 0; - for (uVar7 = 0; uVar7 < uVar2; uVar7 = uVar7 + 1) { - puVar1 = (ushort *)(uVar5 + (ulonglong)uVar7 * 0x18); - uVar3 = *puVar1; - if (uVar3 != 0) { - UlProbeAnsiString(*(byte **)(puVar1 + 4),(ulonglong)uVar3,param_3); - if (uVar11 <= uVar3 && uVar3 != uVar11) { - iVar8 = -0x3fffff66; - goto LAB_1; - } - memcpy(param_4,*(void **)(puVar1 + 4),(ulonglong)uVar3); - _Dst = param_4 + uVar3; - uVar11 = uVar11 - uVar3; - uVar4 = puVar1[1]; - pbVar9 = (byte *)0x0; - pbVar10 = _Dst; - if (uVar4 != 0) { - UlProbeAnsiString(*(byte **)(puVar1 + 8),(ulonglong)uVar4,param_3); - if (uVar11 <= uVar4 && uVar4 != uVar11) { + uVar10 = param_5; + while (uVar13 < uVar3) { + puVar1 = (ushort *)(uVar6 + (ulonglong)uVar13 * 0x18); + uVar4 = *puVar1; + _Size = (ulonglong)uVar4; + if (uVar4 == 0) { + uVar13 = uVar13 + 1; + } + else { + lVar2 = uVar6 + (ulonglong)uVar13 * 0x18; + pbVar11 = *(byte **)(lVar2 + 8); + if (UxKirHttpReadingTrailersFromUm == '\0') { + UlProbeAnsiString(pbVar11,_Size,param_3); + if (uVar10 < uVar4) { iVar8 = -0x3fffff66; goto LAB_1; } - memcpy(_Dst,*(void **)(puVar1 + 8),(ulonglong)uVar4); - pbVar10 = _Dst + uVar4; - uVar11 = uVar11 - uVar4; - pbVar9 = _Dst; + pbVar11 = *(byte **)(puVar1 + 4); } - iVar8 = UlSetParsedHeader(param_6,(char *)param_4,(uint)uVar3,pbVar9,(uint)uVar4); - param_4 = pbVar10; + else { + UlProbeAnsiString(pbVar11,_Size,param_3); + if (uVar10 < uVar4) { + iVar8 = -0x3fffff66; + goto LAB_1; + } + } + memcpy(param_4,pbVar11,_Size); + _Dst = param_4 + _Size; + uVar10 = uVar10 - uVar4; + uVar5 = puVar1[1]; + uVar9 = (uint)uVar5; + pbVar11 = _Dst; + pbVar12 = (byte *)0x0; + if (uVar5 != 0) { + pbVar11 = *(byte **)(lVar2 + 0x10); + if (UxKirHttpReadingTrailersFromUm == '\0') { + UlProbeAnsiString(pbVar11,(ulonglong)uVar5,param_3); + if (uVar10 < uVar9) { + iVar8 = -0x3fffff66; + goto LAB_1; + } + pbVar11 = *(byte **)(puVar1 + 8); + } + else { + UlProbeAnsiString(pbVar11,(ulonglong)uVar5,param_3); + if (uVar10 <= uVar9 && uVar5 != uVar10) { + iVar8 = -0x3fffff66; + goto LAB_1; + } + } + memcpy(_Dst,pbVar11,(ulonglong)uVar5); + pbVar11 = _Dst + uVar5; + uVar10 = uVar10 - uVar9; + pbVar12 = _Dst; + } + iVar8 = UlSetParsedHeader(param_6,(char *)param_4,(uint)uVar4,pbVar12,uVar9); if (iVar8 < 0) goto LAB_1; + uVar13 = uVar13 + 1; + param_4 = pbVar11; } } - *param_7 = param_5 - uVar11; + *param_7 = param_5 - uVar10; } else { iVar8 = -0x3ffffff3; } } } LAB_1: if ((DAT_0 & 0x20) != 0) { - WPP_SF_L(0x8d,&WPP_aee5f1d9509b337e9d647e3a3f21c431_Traceguids,iVar8); + WPP_SF_L(0x8d,&WPP_6be8f1a1a6dc3a7610af4fdeda223eb8_Traceguids,iVar8); } return iVar8; } ``` ## UxpQuicConnectionCopyCertBlob ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.4| |i_ratio|0.53| |m_ratio|0.92| |b_ratio|0.86| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxpQuicConnectionCopyCertBlob|UxpQuicConnectionCopyCertBlob| |fullname|UxpQuicConnectionCopyCertBlob|UxpQuicConnectionCopyCertBlob| |refcount|2|2| |`length`|164|139| |`called`|memcpy|UxpQuicConnectionCopyCertBlob32
memcpy| |calling|UxQuicConnectionGetPeerCertificatesClient|UxQuicConnectionGetPeerCertificatesClient| |paramcount|5|5| |`address`|1400e9b1c|1400ea1ec| |`sig`|undefined8 __fastcall UxpQuicConnectionCopyCertBlob(uint * param_1, char param_2, uint * param_3, uint param_4, uint * param_5)|ulonglong __fastcall UxpQuicConnectionCopyCertBlob(uint * param_1, char param_2, uint * param_3, uint param_4, uint * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxpQuicConnectionCopyCertBlob Called Diff ```diff --- UxpQuicConnectionCopyCertBlob called +++ UxpQuicConnectionCopyCertBlob called @@ -0,0 +1 @@ +UxpQuicConnectionCopyCertBlob32 ``` ### UxpQuicConnectionCopyCertBlob Diff ```diff --- UxpQuicConnectionCopyCertBlob +++ UxpQuicConnectionCopyCertBlob @@ -1,45 +1,33 @@ -undefined8 -UxpQuicConnectionCopyCertBlob(uint *param_1,char param_2,uint *param_3,uint param_4,uint *param_5) +ulonglong UxpQuicConnectionCopyCertBlob + (uint *param_1,char param_2,uint *param_3,uint param_4,uint *param_5) { uint uVar1; - undefined8 uVar2; + ulonglong uVar2; + uVar2 = 0; *param_5 = 0; if (param_1 == (uint *)0x0) { uVar2 = 0xc000000d; } - else { - if (param_2 == '\0') { - uVar1 = *param_1 + 0x10; - *param_5 = uVar1; - if (uVar1 <= param_4) { - memcpy(param_3,param_1,(ulonglong)*param_1 + 0x10); - if (*(longlong *)(param_1 + 2) == 0) { - return 0; - } + else if (param_2 == '\0') { + uVar1 = *param_1; + *param_5 = uVar1 + 0x10; + if (param_4 < uVar1 + 0x10) { + uVar2 = 0x80000005; + } + else { + memcpy(param_3,param_1,(ulonglong)*param_1 + 0x10); + if (*(longlong *)(param_1 + 2) != 0) { *(uint **)(param_3 + 2) = param_3 + 4; - return 0; } } - else { - uVar1 = *param_1 + 8; - *param_5 = uVar1; - if (uVar1 <= param_4) { - *param_3 = *param_1; - param_3[1] = 0; - if (*(longlong *)(param_1 + 2) == 0) { - return 0; - } - uVar1 = (int)param_3 + 8; - param_3[1] = uVar1; - memcpy((void *)(ulonglong)uVar1,*(void **)(param_1 + 2),(ulonglong)*param_1); - return 0; - } - } - uVar2 = 0x80000005; + } + else { + uVar2 = UxpQuicConnectionCopyCertBlob32(param_1,param_3,param_4,param_5); + uVar2 = uVar2 & 0xffffffff; } return uVar2; } ``` ## UxpSslInitiateAscHandler ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,called| |ratio|0.13| |i_ratio|0.14| |m_ratio|0.98| |b_ratio|0.08| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxpSslInitiateAscHandler|UxpSslInitiateAscHandler| |fullname|UxpSslInitiateAscHandler|UxpSslInitiateAscHandler| |`refcount`|6|4| |`length`|984|945| |`called`|
Expand for full list:
FUN_14015cda4
KSECDD.SYS::SspiCreateAsyncContext
KSECDD.SYS::SspiSetAsyncNotifyCallback
NTOSKRNL.EXE::ExAllocatePool3
UlBugCheckEx
UlEtwEvaluateFilter
UxSslFreeAscContext
UxSslMapSecurityStatusToErrorNtStatus
UxpSslAcceptSecurityContext
WPP_SF_
WPP_SF_IWPP_SF_id
WPP_SF_iq
WPP_SF_lld
WPP_SF_qDL
WPP_SF_qII
|
Expand for full list:
KSECDD.SYS::SspiCreateAsyncContext
McTemplateK0p_EtwWriteTransfer
McTemplateK0qp_EtwWriteTransfer
NTOSKRNL.EXE::KeGetCurrentNodeNumber
UlEtwEvaluateFilter
UxSslAllocateAscContext
UxSslFreeAscContext
UxpPktMonNtStatusToDropReason
UxpPktMonTraceSslDropInternal
UxpSslAcceptSecurityContext
UxpSslIncrementHandshakeFailuresCounterUxpSslSetConnectionState
WPP_SF_I
WPP_SF_L
WPP_SF_id
WPP_SF_lld
WPP_SF_qHdqS
WPP_SF_qII
| |calling|UxpSslReceiver|UxpSslReceiver| |paramcount|4|4| |`address`|140065050|140060650| |`sig`|undefined * __fastcall UxpSslInitiateAscHandler(undefined * param_1, undefined * param_2, undefined * param_3, undefined * param_4)|uint __fastcall UxpSslInitiateAscHandler(byte * * * * * * * param_1, byte * * * * * * * param_2, byte * * * * * * * param_3, byte * * * * * * * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxpSslInitiateAscHandler Called Diff ```diff --- UxpSslInitiateAscHandler called +++ UxpSslInitiateAscHandler called @@ -1 +0,0 @@ -FUN_14015cda4 @@ -3,3 +2,3 @@ -KSECDD.SYS::SspiSetAsyncNotifyCallback -NTOSKRNL.EXE::ExAllocatePool3 -UlBugCheckEx +McTemplateK0p_EtwWriteTransfer +McTemplateK0qp_EtwWriteTransfer +NTOSKRNL.EXE::KeGetCurrentNodeNumber @@ -6,0 +6 @@ +UxSslAllocateAscContext @@ -8 +8,2 @@ -UxSslMapSecurityStatusToErrorNtStatus +UxpPktMonNtStatusToDropReason +UxpPktMonTraceSslDropInternal @@ -10 +11,2 @@ -WPP_SF_ +UxpSslIncrementHandshakeFailuresCounter +UxpSslSetConnectionState @@ -11,0 +14 @@ +WPP_SF_L @@ -13 +15,0 @@ -WPP_SF_iq @@ -15 +17 @@ -WPP_SF_qDL +WPP_SF_qHdqS ``` ### UxpSslInitiateAscHandler Diff ```diff --- UxpSslInitiateAscHandler +++ UxpSslInitiateAscHandler @@ -1,244 +1,184 @@ -undefined * -UxpSslInitiateAscHandler - (undefined *param_1,undefined *param_2,undefined *param_3,undefined *param_4) +uint UxpSslInitiateAscHandler + (byte *******param_1,byte *******param_2,byte *******param_3,byte *******param_4) { - ulonglong uVar1; - byte bVar2; - char cVar3; - int iVar4; - uint uVar5; - longlong lVar6; - undefined *puVar7; - undefined2 uVar8; - code *pcVar9; - code *pcVar10; - code *pcVar11; - code *pcVar12; - ushort uVar13; - code *local_res8; - undefined8 in_stack_ffffffffffffffb8; - undefined4 uVar15; - undefined4 *puVar14; + byte *****pppppbVar1; + bool bVar2; + byte bVar3; + char cVar4; + ushort uVar5; + uint uVar6; + byte ******ppppppbVar7; + undefined8 uVar8; + byte **********ppppppppppbVar9; + byte *******pppppppbVar10; + byte *********local_res8; + byte *******in_stack_ffffffffffffffb8; - uVar15 = (undefined4)((ulonglong)in_stack_ffffffffffffffb8 >> 0x20); - pcVar11 = (code *)0x0; - pcVar10 = (code *)0x0; - local_res8 = (code *)0x0; - pcVar9 = (code *)param_2; - pcVar12 = (code *)param_3; + uVar6 = 0; + local_res8 = (byte *********)0x0; + ppppppppppbVar9 = (byte **********)param_2; + pppppppbVar10 = param_3; if ((DAT_0 & 1) != 0) { - pcVar9 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - pcVar12 = (code *)param_1; + ppppppppppbVar9 = (byte **********)&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids; + pppppppbVar10 = param_1; param_4 = param_2; - puVar7 = param_3; - WPP_SF_qII(0x90,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,param_2); - uVar15 = (undefined4)((ulonglong)puVar7 >> 0x20); + in_stack_ffffffffffffffb8 = param_3; + WPP_SF_qII(0x90,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,param_2); } - *param_2 = 0; - *param_3 = 0; - if (*(int *)(param_1 + 0x5c4) == 0) { - *param_3 = 1; + *(undefined1 *)param_2 = 0; + *(undefined1 *)param_3 = 0; + if (*(int *)((longlong)param_1 + 0x5c4) == 0) { + *(undefined1 *)param_3 = 1; goto LAB_1; } - uVar1 = *(ulonglong *)(param_1 + 0x6a0); - if ((*(byte *)(uVar1 + 0x6e2) & 1) != 0) { - if (*(longlong *)(uVar1 + 0x6f0) == 0) { - pcVar12 = (code *)(param_1 + 0x48); - pcVar9 = (code *)&HTTP_EVENT_SSL_HANDSHAKE_INITIATE; - param_4 = param_1; - McTemplateK0p_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(param_1 + 0x6a0) + 0x698), - &HTTP_EVENT_SSL_HANDSHAKE_INITIATE,pcVar12,param_1); + ppppppbVar7 = param_1[0xd4]; + if ((*(byte *)((longlong)ppppppbVar7 + 0x6e2) & 1) != 0) { + if (ppppppbVar7[0xde] != (byte *****)0x0) { + pppppppbVar10 = (byte *******)((longlong)param_1 + 0x74); + ppppppppppbVar9 = (byte **********)(param_1 + 0xb); + param_4 = (byte *******)0x0; + in_stack_ffffffffffffffb8 = (byte *******)param_1[0xcf]; + cVar4 = UlEtwEvaluateFilter((ulonglong)ppppppbVar7,(short *)ppppppppppbVar9, + (longlong)pppppppbVar10,0,(undefined4 *)in_stack_ffffffffffffffb8, + (uint)*(ushort *)(param_1 + 0xce),(ulonglong *)0x0,0); + if (cVar4 == '\0') goto LAB_2; } - else { - pcVar12 = (code *)(param_1 + 0x74); - pcVar9 = (code *)(param_1 + 0x58); - param_4 = (code *)0x0; - puVar14 = *(undefined4 **)(param_1 + 0x678); - cVar3 = UlEtwEvaluateFilter(uVar1,(short *)pcVar9,(longlong)pcVar12,0,puVar14, - (uint)*(ushort *)(param_1 + 0x670),(ulonglong *)0x0,0); - uVar15 = (undefined4)((ulonglong)puVar14 >> 0x20); - if (cVar3 != '\0') { - puVar7 = (undefined *)FUN_14015cda4(); - return puVar7; - } - } - } - if ((DAT_0 & 1) != 0) { - pcVar9 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - pcVar12 = (code *)param_1; - WPP_SF_I(0x91,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1); - } - if (*(longlong *)(param_1 + 0x620) == 0) { - lVar6 = SspiCreateAsyncContext(); - *(longlong *)(param_1 + 0x620) = lVar6; - if (lVar6 == 0) { - pcVar10 = (code *)0xc000009a; - goto LAB_1; - } - } - if ((DAT_0 & 1) != 0) { - WPP_SF_iq(0x7a,&WPP_575742ddbbd13d10dc502caa156c9542_Traceguids,param_1,&local_res8); - } - cVar3 = param_1[0xe9]; - param_4 = &UxLowPriorityPool; - local_res8 = (code *)0x0; - pcVar9 = (code *)0x200; - if (cVar3 == '\0') { - pcVar9 = (code *)0x100; - } - pcVar12 = (code *)0x59537855; - pcVar10 = (code *)ExAllocatePool3(0x40); - if (pcVar10 == (code *)0x0) { - pcVar11 = (code *)0xc000009a; - } - else { - *(undefined **)(pcVar10 + 0x20) = param_1; - pcVar9 = (code *)(param_1 + 0x14); - LOCK(); - iVar4 = *(int *)pcVar9; - *(int *)pcVar9 = *(int *)pcVar9 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (0x7fffffff < iVar4 + 1U)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,pcVar9,0x38,(longlong)(int)(iVar4 + 1U)); - } - lVar6 = SspiCreateAsyncContext(); - *(longlong *)pcVar10 = lVar6; - if (lVar6 == 0) { - pcVar11 = (code *)0xc000009a; - } - else { - pcVar9 = UxSslAcceptSecurityContextCallback; - pcVar12 = pcVar10; - iVar4 = SspiSetAsyncNotifyCallback(lVar6); - if (iVar4 == 0) { - local_res8 = pcVar10; - if (cVar3 != '\0') { - *(code **)(pcVar10 + 0xf8) = pcVar10 + 0x100; - } - goto LAB_2; - } - uVar5 = UxSslMapSecurityStatusToErrorNtStatus(iVar4); - pcVar11 = (code *)(ulonglong)uVar5; - } - UxSslFreeAscContext(pcVar10,pcVar9,pcVar12,param_4); + pppppppbVar10 = param_1 + 9; + ppppppppppbVar9 = (byte **********)&HTTP_EVENT_SSL_HANDSHAKE_INITIATE; + param_4 = param_1; + McTemplateK0p_EtwWriteTransfer + (param_1[0xd4] + 0xd3,&HTTP_EVENT_SSL_HANDSHAKE_INITIATE,pppppppbVar10,param_1); } LAB_2: if ((DAT_0 & 1) != 0) { - pcVar9 = (code *)&WPP_575742ddbbd13d10dc502caa156c9542_Traceguids; - pcVar12 = local_res8; - param_4 = pcVar11; - WPP_SF_id(0x7b,&WPP_575742ddbbd13d10dc502caa156c9542_Traceguids,local_res8,(int)pcVar11); + ppppppppppbVar9 = (byte **********)&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids; + pppppppbVar10 = param_1; + WPP_SF_I(0x91,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1); } - if ((int)pcVar11 < 0) { - pcVar10 = pcVar11; - if ((DAT_3 & 1) == 0) goto LAB_14006520a; - uVar8 = 0x92; -LAB_4: - pcVar9 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - param_4 = pcVar11; - WPP_SF_id(uVar8,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,(int)pcVar11); - pcVar10 = pcVar11; - pcVar12 = (code *)param_1; + bVar2 = false; + if (param_1[0xc4] == (byte ******)0x0) { + ppppppbVar7 = (byte ******)SspiCreateAsyncContext(); + param_1[0xc4] = ppppppbVar7; + if (ppppppbVar7 == (byte ******)0x0) { + uVar6 = 0xc000009a; + goto LAB_1; + } + bVar2 = false; + if (UxKirHttpTlsHandshakePerfCounter != '\0') { + bVar2 = true; + } + } + ppppppppppbVar9 = &local_res8; + uVar6 = UxSslAllocateAscContext((longlong)param_1,ppppppppppbVar9); + if ((int)uVar6 < 0) { + if ((DAT_3 & 1) != 0) { + ppppppppppbVar9 = (byte **********)&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids; + param_4 = (byte *******)(ulonglong)uVar6; + WPP_SF_id(0x92,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,uVar6); + pppppppbVar10 = param_1; + } + goto LAB_1; + } + if ((UxKirHttpTlsHandshakePerfCounter != '\0') && (bVar2)) { + pppppbVar1 = param_1[0xd4][0xc4]; + uVar5 = KeGetCurrentNodeNumber(); + LOCK(); + pppppbVar1[(ulonglong)uVar5 + 1][3] = + (byte ***)((longlong)pppppbVar1[(ulonglong)uVar5 + 1][3] + 1); + UNLOCK(); + } + ppppppppppbVar9 = (byte **********)local_res8; + uVar6 = UxpSslAcceptSecurityContext((longlong)param_1,local_res8); + if (uVar6 == 0x105) { + if ((DAT_0 & 1) != 0) { + ppppppppppbVar9 = (byte **********)&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids; + WPP_SF_I(0x93,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1); + pppppppbVar10 = param_1; + } } else { - pcVar9 = local_res8; - uVar5 = UxpSslAcceptSecurityContext((longlong)param_1,(undefined8 *)local_res8); - pcVar11 = (code *)(ulonglong)uVar5; - pcVar10 = pcVar11; - if (uVar5 == 0x105) { - if ((DAT_0 & 1) != 0) { - pcVar9 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - WPP_SF_I(0x93,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1); - pcVar12 = (code *)param_1; - } - } - else { - if (uVar5 != 0x103) { - lVar6 = *(longlong *)(param_1 + 0x1b0); - if ((lVar6 != 0) && (*(char *)(lVar6 + 0x251) != '\0')) { - pcVar9 = (code *)0x2; - LOCK(); - if (*(int *)(lVar6 + 0x6c) == 1) { - *(int *)(lVar6 + 0x6c) = 2; - } - UNLOCK(); - if ((DAT_5 & 1) != 0) { - pcVar9 = *(code **)(param_1 + 0x1b0); - uVar13 = *(ushort *)(param_1 + 0x76) >> 8 | *(ushort *)(param_1 + 0x76) << 8; - param_4 = (undefined *)(ulonglong)uVar13; - pcVar12 = (code *)param_1; - WPP_SF_qHdqS(0x94,pcVar9,param_1,uVar13,CONCAT44(uVar15,uVar5),pcVar9, - *(longlong *)(pcVar9 + 0x1b0)); - } + if (uVar6 != 0x103) { + ppppppbVar7 = param_1[0x36]; + if ((ppppppbVar7 != (byte ******)0x0) && (*(char *)((longlong)ppppppbVar7 + 0x251) != '\0')) { + ppppppppppbVar9 = (byte **********)0x2; + LOCK(); + if (*(int *)((longlong)ppppppbVar7 + 0x6c) == 1) { + *(int *)((longlong)ppppppbVar7 + 0x6c) = 2; } - uVar1 = *(ulonglong *)(param_1 + 0x6a0); - if ((*(byte *)(uVar1 + 0x6e2) & 1) != 0) { - if (*(longlong *)(uVar1 + 0x6f0) != 0) { - pcVar12 = (code *)(param_1 + 0x74); - pcVar9 = (code *)(param_1 + 0x58); - param_4 = (code *)0x0; - cVar3 = UlEtwEvaluateFilter(uVar1,(short *)pcVar9,(longlong)pcVar12,0, - *(undefined4 **)(param_1 + 0x678), - (uint)*(ushort *)(param_1 + 0x670),(ulonglong *)0x0,0); - if (cVar3 == '\0') goto LAB_6; - } - pcVar12 = (code *)(param_1 + 0x48); - pcVar9 = (code *)&HTTP_EVENT_SSL_HANDSHAKE_COMPLETE; - param_4 = pcVar11; - McTemplateK0qp_EtwWriteTransfer - ((undefined8 *)(*(longlong *)(param_1 + 0x6a0) + 0x698), - &HTTP_EVENT_SSL_HANDSHAKE_COMPLETE,pcVar12,uVar5); - } -LAB_6: - bVar2 = DAT_7; - if ((DAT_0 & 0x40) != 0) { - pcVar12 = (code *)(ulonglong)(uint)DAT_7; - pcVar9 = (code *)&WPP_c3410a5607a6316659f67a67ba938abb_Traceguids; - WPP_SF_L(0x26,&WPP_c3410a5607a6316659f67a67ba938abb_Traceguids,(uint)DAT_7); - } - if (bVar2 != 0) { - pcVar9 = (code *)0xe0005007; - pcVar12 = pcVar11; - UxPktMonTraceDropSslWithNtStatus((longlong)param_1,0xe0005007,uVar5); - } - if ((DAT_0 & 1) == 0) goto LAB_14006520a; - uVar8 = 0x95; - goto LAB_4; - } - uVar5 = *(uint *)(param_1 + 0xdc); - local_res8 = (code *)0x0; - if ((DAT_0 & 1) != 0) { - pcVar9 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - param_4 = (code *)0x3; - pcVar12 = (code *)param_1; - WPP_SF_id(0x46,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,3); - if ((DAT_0 & 1) != 0) { - param_4 = (undefined *)(ulonglong)uVar5; - pcVar9 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - pcVar12 = (code *)param_1; - WPP_SF_qDL(0x47,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,uVar5); + UNLOCK(); + if ((DAT_4 & 1) != 0) { + ppppppppppbVar9 = (byte **********)param_1[0x36]; + uVar5 = *(ushort *)((longlong)param_1 + 0x76) >> 8 | + *(ushort *)((longlong)param_1 + 0x76) << 8; + param_4 = (byte *******)(ulonglong)uVar5; + in_stack_ffffffffffffffb8 = + (byte *******)CONCAT44((int)((ulonglong)in_stack_ffffffffffffffb8 >> 0x20),uVar6); + pppppppbVar10 = param_1; + WPP_SF_qHdqS(0x94,ppppppppppbVar9,param_1,uVar5,in_stack_ffffffffffffffb8,ppppppppppbVar9, + (longlong)ppppppppppbVar9[0x36]); } } - *(undefined4 *)(param_1 + 0xdc) = 3; + ppppppbVar7 = param_1[0xd4]; + if ((*(byte *)((longlong)ppppppbVar7 + 0x6e2) & 1) != 0) { + if (ppppppbVar7[0xde] != (byte *****)0x0) { + pppppppbVar10 = (byte *******)((longlong)param_1 + 0x74); + ppppppppppbVar9 = (byte **********)(param_1 + 0xb); + param_4 = (byte *******)0x0; + in_stack_ffffffffffffffb8 = (byte *******)param_1[0xcf]; + cVar4 = UlEtwEvaluateFilter((ulonglong)ppppppbVar7,(short *)ppppppppppbVar9, + (longlong)pppppppbVar10,0, + (undefined4 *)in_stack_ffffffffffffffb8, + (uint)*(ushort *)(param_1 + 0xce),(ulonglong *)0x0,0); + if (cVar4 == '\0') goto LAB_5; + } + pppppppbVar10 = param_1 + 9; + param_4 = (byte *******)(ulonglong)uVar6; + ppppppppppbVar9 = (byte **********)&HTTP_EVENT_SSL_HANDSHAKE_COMPLETE; + in_stack_ffffffffffffffb8 = param_1; + McTemplateK0qp_EtwWriteTransfer + (param_1[0xd4] + 0xd3,&HTTP_EVENT_SSL_HANDSHAKE_COMPLETE,pppppppbVar10,uVar6); + } +LAB_5: + bVar3 = DAT_6; + if ((DAT_0 & 0x40) != 0) { + pppppppbVar10 = (byte *******)(ulonglong)(uint)DAT_6; + ppppppppppbVar9 = (byte **********)&WPP_c3410a5607a6316659f67a67ba938abb_Traceguids; + WPP_SF_L(0x26,&WPP_c3410a5607a6316659f67a67ba938abb_Traceguids,(uint)DAT_6); + } + if ((bVar3 != 0) && (DAT_7 != '\0')) { + uVar8 = UxpPktMonNtStatusToDropReason(uVar6); + ppppppppppbVar9 = (byte **********)(param_1 + 0xb); + pppppppbVar10 = (byte *******)((longlong)param_1 + 0x74); + UxpPktMonTraceSslDropInternal + ((longlong)param_1,(short *)ppppppppppbVar9,(longlong)pppppppbVar10,param_4, + in_stack_ffffffffffffffb8,0xe0005007,(int)uVar8); + } if ((DAT_0 & 1) != 0) { - pcVar9 = (code *)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - WPP_SF_(0x48,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,pcVar12,param_4); + ppppppppppbVar9 = (byte **********)&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids; + param_4 = (byte *******)(ulonglong)uVar6; + pppppppbVar10 = param_1; + WPP_SF_id(0x95,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,uVar6); } + if (UxKirHttpTlsHandshakePerfCounter != '\0') { + UxpSslIncrementHandshakeFailuresCounter((longlong)param_1); + } + goto LAB_1; } - *param_2 = 1; + ppppppppppbVar9 = (byte **********)0x3; + local_res8 = (byte *********)0x0; + UxpSslSetConnectionState((longlong)param_1,3,(longlong)pppppppbVar10,(ulonglong)param_4); } + *(undefined1 *)param_2 = 1; LAB_1: - if (local_res8 != (code *)0x0) { - UxSslFreeAscContext(local_res8,pcVar9,pcVar12,param_4); - local_res8 = (code *)0x0; + if ((byte **********)local_res8 != (byte **********)0x0) { + UxSslFreeAscContext((undefined *)local_res8,ppppppppppbVar9,(undefined *)pppppppbVar10,param_4); + local_res8 = (byte *********)0x0; } if ((DAT_0 & 1) != 0) { - WPP_SF_lld(0x96,pcVar9,(uint)(byte)*param_2,(uint)(byte)*param_3); + WPP_SF_lld(0x96,ppppppppppbVar9,(uint)*(byte *)param_2,(uint)*(byte *)param_3); } - return pcVar10; + return uVar6; } ``` ## UlpCompleteSendToExtensionWorker ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.95| |i_ratio|0.71| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpCompleteSendToExtensionWorker|UlpCompleteSendToExtensionWorker| |fullname|UlpCompleteSendToExtensionWorker|UlpCompleteSendToExtensionWorker| |refcount|4|4| |`length`|796|781| |called|
Expand for full list:
McTemplateK0xsq_EtwWriteTransfer
NTOSKRNL.EXE::KeGetCurrentIrql
UlBugCheckEx
UlCloseConnection
UlDestroyCapturedResponse
UlEtwEvaluateFilterForRequestConnection
UlHkeCancelCalloutContext
UlHkeDereferenceCalloutContext
UlThreadPoolEnqueueWorkItem
UlpRebuildResponseBody
UlpRebuildResponseHeadersUxPodAttachThread
UxPodDetachThread
WPP_SF_
WPP_SF_I
WPP_SF_Lq
_guard_dispatch_icall
|
Expand for full list:
McTemplateK0xsq_EtwWriteTransfer
NTOSKRNL.EXE::KeGetCurrentIrql
UlBugCheckEx
UlCloseConnection
UlDestroyCapturedResponse
UlEtwEvaluateFilterForRequestConnection
UlHkeCancelCalloutContext
UlHkeDereferenceCalloutContext
UlThreadPoolEnqueueWorkItem
UlpRebuildResponseBody
UlpRebuildResponseHeadersUxPodAttachThread
UxPodDetachThread
WPP_SF_
WPP_SF_I
WPP_SF_Lq
_guard_dispatch_icall
| |calling|UlpSendResponseToExtension|UlpSendResponseToExtension| |paramcount|4|4| |`address`|140109730|140109df0| |sig|undefined __fastcall UlpCompleteSendToExtensionWorker(undefined8 * * * * * param_1, undefined8 param_2, undefined8 * * * * * param_3, undefined8 * * * * * param_4)|undefined __fastcall UlpCompleteSendToExtensionWorker(undefined8 * * * * * param_1, undefined8 param_2, undefined8 * * * * * param_3, undefined8 * * * * * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpCompleteSendToExtensionWorker Diff ```diff --- UlpCompleteSendToExtensionWorker +++ UlpCompleteSendToExtensionWorker @@ -1,154 +1,151 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void UlpCompleteSendToExtensionWorker (undefined8 *****param_1,undefined8 param_2,undefined8 *****param_3, undefined8 *****param_4) { int *piVar1; undefined8 ****ppppuVar2; undefined8 ****ppppuVar3; undefined8 ****ppppuVar4; undefined8 **ppuVar5; byte bVar6; char cVar7; uint uVar8; int iVar9; longlong *plVar10; longlong lVar11; undefined8 ***pppuVar12; undefined8 *****pppppuVar13; uint uVar14; uint uVar15; code *pcVar16; byte local_res8 [8]; undefined8 ***local_res10; undefined8 ****local_res18; undefined8 ****local_res20; undefined8 ****local_58; undefined8 uStack_50; local_res8[0] = 0; if ((DAT_0 & 1) != 0) { param_3 = param_1; - WPP_SF_I(0xd2,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,param_1); + WPP_SF_I(0xd2,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,param_1); } pppppuVar13 = (undefined8 *****)param_1[-9]; ppppuVar2 = param_1[-0x49]; uVar14 = *(uint *)(param_1 + -4); ppppuVar3 = pppppuVar13[0x12]; local_res10 = ppppuVar2[3]; ppppuVar4 = pppppuVar13[0x13]; local_58 = param_1[6]; local_res20 = param_1[7]; local_res18 = param_1[-3]; plVar10 = UlpRebuildResponseHeaders((int *)(param_1 + -0x4c),local_res8,param_3,(byte *)param_4); + pcVar16 = (code *)0x0; uVar8 = (uint)plVar10; uVar15 = uVar8; if (((int)uVar8 < 0) || (uVar15 = uVar14, (int)uVar14 < 0)) { LAB_1: pcVar16 = (code *)0x0; pppuVar12 = ppppuVar2[3]; if ((pppuVar12 != (undefined8 ***)0x0) && (((ulonglong)pppuVar12[0x89][0xdc] & 0x20) != 0)) { if (pppuVar12[0x89][0xde] != (undefined8 *)0x0) { pcVar16 = (code *)0x0; bVar6 = UlEtwEvaluateFilterForRequestConnection((longlong)ppppuVar2,(longlong)pppuVar12,0); if (bVar6 == 0) goto LAB_2; } pcVar16 = (code *)(ppppuVar2 + 9); param_4 = (undefined8 *****)ppppuVar2[7]; McTemplateK0xsq_EtwWriteTransfer (ppppuVar2[3][0x89] + 0xd3,pppuVar12,pcVar16,param_4,"PublishToExtensionFailed"); } LAB_2: if ((char)DAT_0 < '\0') { param_4 = (undefined8 *****)ppppuVar2[7]; pcVar16 = (code *)(ulonglong)uVar15; - WPP_SF_Lq(0xd3,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,uVar15,param_4); + WPP_SF_Lq(0xd3,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,uVar15,param_4); } if (((int)uVar8 < 0) || (*(int *)(pppppuVar13 + 0x20) == 3)) { UlCloseConnection((longlong *)local_res10,'\x01',(longlong *)pcVar16,(ulonglong)param_4); pcVar16 = (code *)local_res18; (*(code *)local_58)(local_res20); UlHkeCancelCalloutContext(pppppuVar13,0,pcVar16,param_4); goto LAB_3; } UlHkeCancelCalloutContext(pppppuVar13,0,pcVar16,param_4); } else { iVar9 = *(int *)(pppppuVar13 + 0x20); if (iVar9 == 0) { LAB_4: uVar15 = 0xc0000184; goto LAB_1; } - pcVar16 = (code *)(undefined8 ****)0x0; if (iVar9 == 1) { *(undefined1 *)((longlong)param_1 + -0x22d) = 1; LAB_5: if (local_res8[0] == 0) { *(undefined4 *)((longlong)param_1 + -0x2c) = 0; - pcVar16 = (code *)(undefined8 ****)0x0; } } - else if (iVar9 == 2) { - if (UxKirBranchCacheIgnoreResponseCaching != '\0') goto LAB_5; - } else { + if (iVar9 == 2) goto LAB_5; if ((iVar9 != 3) || (pppppuVar13[0x22] == (undefined8 ****)0x0)) goto LAB_4; *(undefined4 *)((longlong)param_1 + -0x2c) = 0; lVar11 = UlpRebuildResponseBody ((longlong)ppppuVar2,(undefined *)(param_1 + -0x4c),0,(longlong)param_4); + pcVar16 = (code *)0x0; uVar8 = (uint)lVar11; if ((int)uVar8 < 0) { uVar14 = uVar8; } - pcVar16 = (code *)(undefined8 ****)0x0; uVar15 = uVar14; if ((int)uVar14 < 0) goto LAB_1; } } (*(code *)ppppuVar4)(ppppuVar3); LAB_3: param_1[-9] = (undefined8 ****)0x0; UlHkeDereferenceCalloutContext((int *)pppppuVar13,10); piVar1 = (int *)((longlong)param_1 + -0x24c); LOCK(); iVar9 = *piVar1; *piVar1 = *piVar1 + -1; UNLOCK(); iVar9 = iVar9 + -1; if ((UxDebugCheckRefcount != '\0') && (iVar9 < 0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(3,piVar1,0x2f,(longlong)iVar9); } if (iVar9 == 0) { local_58 = (undefined8 ****)0x0; uStack_50 = 0; ppuVar5 = param_1[-0x49][3][0x88]; if (((*param_1 != (undefined8 ****)0x0) || (param_1[2] != (undefined8 ****)0x0)) || (param_1[4] != (undefined8 ****)0x0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(1,param_1,"minio\\http\\sys\\sendresponse.h",0x44e); } cVar7 = KeGetCurrentIrql(); if (cVar7 == '\0') { pppppuVar13 = &local_58; UxPodAttachThread((longlong)ppuVar5,pppppuVar13); UlDestroyCapturedResponse(param_1,(int *)pppppuVar13,pcVar16,param_4); UxPodDetachThread((char *)&local_58); } else { pcVar16 = UlDestroyCapturedResponse; param_4 = (undefined8 *****)CONCAT71((int7)((ulonglong)param_4 >> 8),1); UlThreadPoolEnqueueWorkItem (0,(longlong)param_1,UlDestroyCapturedResponse,'\x01',(longlong)ppuVar5,0xffffffff); } } if ((DAT_0 & 1) != 0) { - WPP_SF_(0xd4,&WPP_ccbc0ab89449398e15fea7e2da239f3f_Traceguids,pcVar16,param_4); + WPP_SF_(0xd4,&WPP_faf8577d6c653eaf57c97f690d063f25_Traceguids,pcVar16,param_4); } return; } ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.73| |i_ratio|0.47| |m_ratio|0.99| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2|2| |`length`|377|374| |called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|4|4| |`address`|1400b722c|1400b7914| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_RecordUsageInCache Diff ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -1,101 +1,101 @@ uint * wil_details_FeatureReporting_RecordUsageInCache (uint *param_1,uint *param_2,undefined8 param_3,uint param_4) { uint uVar1; uint uVar2; uint uVar3; uint uVar4; uint uVar5; bool bVar6; - uVar1 = (uint)param_3; + uVar3 = (uint)param_3; param_1[0] = 0; param_1[1] = 0; param_1[2] = 0; param_1[3] = 0; param_1[4] = 0; param_1[5] = 0; - if (uVar1 == 0) { + if (uVar3 == 0) { LAB_0: - wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar1,param_3,param_1); + wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar3,param_3,param_1); } else { - if (uVar1 == 1) { + if (uVar3 == 1) { LAB_1: - wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar1,param_3,param_1); + wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar3,param_3,param_1); return param_1; } - if ((uVar1 != 2) && (uVar1 != 3)) { - if (uVar1 == 4) goto LAB_0; - if (uVar1 == 5) goto LAB_1; - if ((uVar1 != 6) && (uVar1 != 7)) { - uVar4 = uVar1 - 0x140; + if ((uVar3 != 2) && (uVar3 != 3)) { + if (uVar3 == 4) goto LAB_0; + if (uVar3 == 5) goto LAB_1; + if ((uVar3 != 6) && (uVar3 != 7)) { + uVar4 = uVar3 - 0x140; if ((int)uVar4 < 0x40) { uVar5 = param_2[1]; do { if (((uVar5 & 0x10) == 0) || (uVar2 = 1, (uVar5 >> 5 & 0x3f) != uVar4)) { uVar2 = 0; } param_1[4] = uVar2; LOCK(); uVar2 = param_2[1]; bVar6 = uVar5 == uVar2; if (bVar6) { param_2[1] = (uVar4 * 0x20 ^ uVar5) & 0x7e0 ^ uVar5 | 0x10; uVar2 = uVar5; } uVar5 = uVar2; UNLOCK(); } while (!bVar6); if (param_1[4] != 0) { return param_1; } } - param_1[2] = uVar1; + param_1[2] = uVar3; param_1[1] = 1; param_1[3] = param_4; return param_1; } } uVar4 = 0; - if (uVar1 == 2) { + if (uVar3 == 2) { uVar4 = 2; } - else if (uVar1 == 3) { + else if (uVar3 == 3) { uVar4 = 8; } - else if (uVar1 == 6) { + else if (uVar3 == 6) { uVar4 = 4; } - else if (uVar1 == 7) { + else if (uVar3 == 7) { uVar4 = 0x10; } uVar5 = 1; - uVar1 = *param_2; + uVar3 = *param_2; do { - uVar3 = uVar1; - uVar1 = uVar4 | uVar3; - param_1[4] = (uint)(uVar1 == uVar3); - uVar2 = uVar1 | 1; - if (uVar1 == uVar3) { - uVar2 = uVar1; + uVar1 = uVar3; + uVar3 = uVar4 | uVar1; + param_1[4] = (uint)(uVar3 == uVar1); + uVar2 = uVar3 | 1; + if (uVar3 == uVar1) { + uVar2 = uVar3; } LOCK(); - uVar1 = *param_2; - bVar6 = uVar3 == uVar1; + uVar3 = *param_2; + bVar6 = uVar1 == uVar3; if (bVar6) { *param_2 = uVar2; - uVar1 = uVar3; + uVar3 = uVar1; } UNLOCK(); } while (!bVar6); - if (((uVar2 & 1) == 0) || ((uVar3 & 1) != 0)) { + if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) { uVar5 = 0; } *param_1 = uVar5; } return param_1; } ``` ## UxpSslWaitForAscHandler ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.89| |i_ratio|0.26| |m_ratio|1.0| |b_ratio|0.36| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxpSslWaitForAscHandler|UxpSslWaitForAscHandler| |fullname|UxpSslWaitForAscHandler|UxpSslWaitForAscHandler| |refcount|2|2| |`length`|2278|2285| |`called`|
Expand for full list:
McTemplateK0pq_EtwWriteTransfer
McTemplateK0qp_EtwWriteTransfer
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
PnlFreeToLookasideList
PplFreeToLookasideListProcessor
UlBugCheckEx
UlEtwEvaluateFilterUxPktMonTraceDropSsl
UxPktMonTraceDropSslWithNtStatus
UxSslConnectionHandshakeCompletion
UxSslFreeAscContext
UxSslFreeSendBufferList
UxSslLogError
UxSslMapSecurityStatusToErrorNtStatus
UxSslSendRawData
UxWfpConnectionClassify
UxpSslConsumeReceiveBufferSpace
UxpSslQuerySslConnectionInfo
UxpSslSetConnectionState
UxpSslSetNotifyCallout
WPP_SF_
WPP_SF_I
WPP_SF_L
WPP_SF_id
WPP_SF_lld
WPP_SF_qHdqS
WPP_SF_qII
__security_check_cookie
_guard_dispatch_icall
memset
|
Expand for full list:
McTemplateK0pq_EtwWriteTransfer
McTemplateK0qp_EtwWriteTransfer
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
PnlFreeToLookasideList
PplFreeToLookasideListProcessor
UlBugCheckEx
UlEtwEvaluateFilterUxPktMonTraceDropSsl
UxPktMonTraceDropSslWithNtStatus
UxSslConnectionHandshakeCompletion
UxSslFreeAscContext
UxSslFreeSendBufferList
UxSslLogError
UxSslMapSecurityStatusToErrorNtStatus
UxSslSendRawData
UxWfpConnectionClassify
UxpSslConsumeReceiveBufferSpace
UxpSslIncrementHandshakeFailuresCounter
UxpSslQuerySslConnectionInfo
UxpSslSetConnectionState
UxpSslSetNotifyCallout
WPP_SF_
WPP_SF_I
WPP_SF_L
WPP_SF_id
WPP_SF_lld
WPP_SF_qHdqS
WPP_SF_qII
__security_check_cookie
_guard_dispatch_icall
memset
| |calling|UxpSslReceiver|UxpSslReceiver| |paramcount|4|4| |`address`|140064758|14005fd58| |sig|uint * * * * * __fastcall UxpSslWaitForAscHandler(uint * * * * * param_1, uint * * * * * param_2, uint * * * * * param_3, uint * * * * * param_4)|uint * * * * * __fastcall UxpSslWaitForAscHandler(uint * * * * * param_1, uint * * * * * param_2, uint * * * * * param_3, uint * * * * * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxpSslWaitForAscHandler Called Diff ```diff --- UxpSslWaitForAscHandler called +++ UxpSslWaitForAscHandler called @@ -21,0 +22 @@ +UxpSslIncrementHandshakeFailuresCounter ``` ### UxpSslWaitForAscHandler Diff ```diff --- UxpSslWaitForAscHandler +++ UxpSslWaitForAscHandler @@ -1,460 +1,467 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ uint ***** UxpSslWaitForAscHandler(uint *****param_1,uint *****param_2,uint *****param_3,uint *****param_4) { uint *puVar1; byte bVar2; byte bVar3; uint uVar4; uint uVar5; char cVar6; uint uVar7; int iVar8; ulonglong uVar9; code *pcVar10; uint ****ppppuVar11; longlong lVar12; uint uVar13; uint *****pppppuVar14; int *piVar15; undefined1 *puVar16; uint ****ppppuVar17; undefined1 *puVar18; undefined1 *puVar19; uint *****pppppuVar20; uint *****pppppuVar21; uint *****pppppuVar22; ushort uVar23; undefined1 auStackY_218 [8]; undefined1 auStackY_210 [24]; undefined1 local_1c8 [40]; undefined4 local_1a0; undefined1 local_168 [40]; undefined4 local_140; undefined1 local_108 [40]; undefined4 local_e0; undefined1 local_a8 [40]; undefined4 local_80; ulonglong local_48; puVar16 = auStackY_218; + puVar19 = auStackY_218; puVar18 = auStackY_218; - puVar19 = auStackY_218; local_48 = __security_cookie ^ (ulonglong)auStackY_218; pppppuVar21 = (uint *****)0x0; pppppuVar14 = param_2; pppppuVar22 = param_3; if ((DAT_0 & 1) != 0) { - pppppuVar14 = (uint *****)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; + pppppuVar14 = (uint *****)&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids; pppppuVar22 = param_1; param_4 = param_2; - WPP_SF_qII(0x97,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,param_2); + WPP_SF_qII(0x97,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,param_2); } *(undefined1 *)param_2 = 0; *(undefined1 *)param_3 = 0; if (*(int *)((longlong)param_1 + 0x5c4) == 0) { *(undefined1 *)param_3 = 1; - puVar18 = auStackY_218; + puVar19 = auStackY_218; goto LAB_1; } KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_1 + 0x1a); pppppuVar14 = (uint *****)param_1[0xc2]; pppppuVar20 = pppppuVar21; if (pppppuVar14 != (uint *****)0x0) { param_1[0xc2] = (uint ****)0x0; pppppuVar20 = pppppuVar14; } pppppuVar14 = (uint *****)0x0; ExReleasePushLockExclusiveEx(param_1 + 0x1a); KeLeaveCriticalRegion(); if (pppppuVar20 == (uint *****)0x0) { *(undefined1 *)param_2 = 1; - puVar18 = auStackY_218; + puVar19 = auStackY_218; } else { param_1[0xd5] = (uint ****) ((longlong)param_1[0xd5] + ((longlong)pppppuVar20[3] - (longlong)pppppuVar20[2])); uVar7 = *(uint *)((longlong)pppppuVar20 + 0xc); uVar4 = *(uint *)(param_1[0xc0] + 0xd); uVar5 = *(uint *)((longlong)pppppuVar20 + 0xec); if (uVar7 == 0x80090321) { param_4 = (uint *****)((ulonglong)*(uint *)(param_1 + 0xd0) * 2); if (param_4 < (uint *****)0x100000000) { uVar7 = (uint)param_4; *(uint *)(param_1 + 0xd0) = uVar7; if (uVar7 < 0x104141) { pppppuVar14 = (uint *****)0x2; UxpSslSetConnectionState((longlong)param_1,2,(longlong)pppppuVar22,(ulonglong)param_4); - puVar18 = auStackY_218; + puVar19 = auStackY_218; goto LAB_2; } pppppuVar14 = (uint *****)0x80090321; if ((DAT_3 & 1) != 0) { - pppppuVar14 = (uint *****)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; + pppppuVar14 = (uint *****)&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids; pppppuVar22 = param_1; - WPP_SF_id(0x98,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,uVar7); + WPP_SF_id(0x98,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,uVar7); } pppppuVar21 = (uint *****)0xc000000d; puVar16 = auStackY_218; } else { *(undefined4 *)(param_1 + 0xd0) = 0xffffffff; pppppuVar21 = (uint *****)0xc0000095; pppppuVar14 = (uint *****)0x80090321; puVar16 = auStackY_218; } LAB_4: ppppuVar17 = param_1[0x36]; iVar8 = (int)pppppuVar21; if ((ppppuVar17 != (uint ****)0x0) && (*(char *)((longlong)ppppuVar17 + 0x251) != '\0')) { LOCK(); if (*(int *)((longlong)ppppuVar17 + 0x6c) == 1) { *(int *)((longlong)ppppuVar17 + 0x6c) = 2; } UNLOCK(); if ((DAT_5 & 1) != 0) { pppppuVar14 = (uint *****)param_1[0x36]; uVar23 = *(ushort *)((longlong)param_1 + 0x76) >> 8 | *(ushort *)((longlong)param_1 + 0x76) << 8; param_4 = (uint *****)(ulonglong)uVar23; *(uint *****)(puVar16 + 0x30) = pppppuVar14[0x36]; *(uint ******)(puVar16 + 0x28) = pppppuVar14; *(int *)(puVar16 + 0x20) = iVar8; - *(undefined8 *)(puVar16 + -8) = 0x140064ef1; + *(undefined8 *)(puVar16 + -8) = 0x14005ff57; pppppuVar22 = param_1; WPP_SF_qHdqS(0x9c,pppppuVar14,param_1,uVar23,*(undefined8 *)(puVar16 + 0x20), *(undefined8 *)(puVar16 + 0x28),*(longlong *)(puVar16 + 0x30)); } } ppppuVar17 = param_1[0xd4]; if ((*(byte *)((longlong)ppppuVar17 + 0x6e2) & 1) != 0) { if (ppppuVar17[0xde] != (uint ***)0x0) { uVar23 = *(ushort *)(param_1 + 0xce); pppppuVar22 = (uint *****)((longlong)param_1 + 0x74); *(undefined4 *)(puVar16 + 0x38) = 0; pppppuVar14 = param_1 + 0xb; *(undefined8 *)(puVar16 + 0x30) = 0; param_4 = (uint *****)0x0; *(uint *)(puVar16 + 0x28) = (uint)uVar23; *(uint *****)(puVar16 + 0x20) = param_1[0xcf]; - *(undefined8 *)(puVar16 + -8) = 0x140064f3b; + *(undefined8 *)(puVar16 + -8) = 0x14005ffa1; cVar6 = UlEtwEvaluateFilter((ulonglong)ppppuVar17,(short *)pppppuVar14, (longlong)pppppuVar22,0,*(undefined4 **)(puVar16 + 0x20), *(uint *)(puVar16 + 0x28),*(ulonglong **)(puVar16 + 0x30), *(uint *)(puVar16 + 0x38)); if (cVar6 == '\0') goto LAB_6; } ppppuVar17 = param_1[0xd4]; pppppuVar22 = param_1 + 9; *(uint ******)(puVar16 + 0x20) = param_1; pppppuVar14 = (uint *****)&HTTP_EVENT_SSL_HANDSHAKE_COMPLETE; - *(undefined8 *)(puVar16 + -8) = 0x140064f65; + *(undefined8 *)(puVar16 + -8) = 0x14005ffcb; param_4 = pppppuVar21; McTemplateK0qp_EtwWriteTransfer (ppppuVar17 + 0xd3,&HTTP_EVENT_SSL_HANDSHAKE_COMPLETE,pppppuVar22,iVar8); } LAB_6: bVar2 = DAT_7; if ((DAT_0 & 0x40) != 0) { pppppuVar22 = (uint *****)(ulonglong)(uint)DAT_7; pppppuVar14 = (uint *****)&WPP_c3410a5607a6316659f67a67ba938abb_Traceguids; - *(undefined8 *)(puVar16 + -8) = 0x140064f8a; + *(undefined8 *)(puVar16 + -8) = 0x14005fff0; WPP_SF_L(0x26,&WPP_c3410a5607a6316659f67a67ba938abb_Traceguids,(uint)DAT_7); } if (bVar2 != 0) { pppppuVar14 = (uint *****)0xe0005007; - *(undefined8 *)(puVar16 + -8) = 0x140064f9f; + *(undefined8 *)(puVar16 + -8) = 0x140060005; pppppuVar22 = pppppuVar21; UxPktMonTraceDropSslWithNtStatus((longlong)param_1,0xe0005007,iVar8); } - puVar18 = puVar16; if ((DAT_0 & 1) != 0) { - pppppuVar14 = (uint *****)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - *(undefined8 *)(puVar16 + -8) = 0x140064fbf; + pppppuVar14 = (uint *****)&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids; + *(undefined8 *)(puVar16 + -8) = 0x140060025; + pppppuVar22 = param_1; param_4 = pppppuVar21; - WPP_SF_id(0x9d,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1,iVar8); - pppppuVar22 = param_1; + WPP_SF_id(0x9d,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1,iVar8); + } + puVar19 = puVar16; + if (UxKirHttpTlsHandshakePerfCounter != '\0') { + *(undefined8 *)(puVar16 + -8) = 0x140060036; + UxpSslIncrementHandshakeFailuresCounter((longlong)param_1); } } else if (uVar7 == 0x80090318) { if ((*(byte *)((longlong)param_1[0xd4] + 0x6e2) & 1) != 0) { pppppuVar22 = param_1 + 9; param_4 = param_1; McTemplateK0pq_EtwWriteTransfer (param_1[0xd4] + 0xd3,&HTTP_EVENT_SSL_ASC_RESULT,pppppuVar22,param_1); } if ((DAT_0 & 1) != 0) { param_4 = (uint *****)(ulonglong)*(uint *)((longlong)pppppuVar20 + 0xc); pppppuVar22 = param_1; - WPP_SF_id(0x99,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1, + WPP_SF_id(0x99,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1, *(uint *)((longlong)pppppuVar20 + 0xc)); } if (((int)*(uint *)((longlong)pppppuVar20 + 0xc) < 0) && (pppppuVar20[6] == (uint ****)0x0)) { param_1[0x38] = (uint ****)0xffffffffffffffff; param_1[0x37] = (uint ****)0xffffffffffffffff; } if (uVar4 == uVar5) { *(undefined1 *)((longlong)param_1 + 0x5f4) = 1; LAB_8: *(undefined1 *)param_2 = 1; } LAB_9: pppppuVar21 = (uint *****)0x0; pppppuVar14 = (uint *****)0x2; UxpSslSetConnectionState((longlong)param_1,2,(longlong)pppppuVar22,(ulonglong)param_4); } else { if ((uVar7 == 0) || (uVar7 == 0x90312)) { LAB_10: uVar7 = 0; - if ((*(uint *)((longlong)pppppuVar20 + 0x5c) == 5) && (*(uint *)(pppppuVar20 + 0xb) != 0)) { - uVar7 = *(uint *)(pppppuVar20 + 0xb); + if (*(uint *)((longlong)pppppuVar20 + 0x5c) == 5) { + uVar7 = 0; + if (*(uint *)(pppppuVar20 + 0xb) != 0) { + uVar7 = *(uint *)(pppppuVar20 + 0xb); + } } uVar13 = (*(uint *)((longlong)pppppuVar20 + 0xec) - *(int *)(param_1[0xc0] + 0xe)) - uVar7; uVar9 = (ulonglong)uVar13; UxpSslConsumeReceiveBufferSpace ((longlong)param_1,uVar13,(longlong)pppppuVar22,(ulonglong)param_4); *(uint *)(param_1[0xc0] + 0xe) = *(uint *)((longlong)pppppuVar20 + 0xec) - uVar7; if (((*(uint *)((longlong)pppppuVar20 + 0xbc) == 2) && (uVar9 = 0, pppppuVar20[0x18] != (uint ****)0x0)) && (*(uint *)(pppppuVar20 + 0x17) != 0)) { *(uint *)(pppppuVar20[5] + 7) = *(uint *)(pppppuVar20 + 0x17); } else { UxSslFreeSendBufferList((uint *)pppppuVar20[5],uVar9,(uint *)pppppuVar22,param_4); pppppuVar20[5] = (uint ****)0x0; } if (((*(char *)(param_1 + 0x1d) == '\0') && (uVar9 = (ulonglong)*(uint *)(param_1 + 0xe2), *(uint *)(param_1 + 0xe2) < 2)) && ((*(uint *)(param_1 + uVar9 * 3 + 0xde) = *(int *)(param_1 + uVar9 * 3 + 0xde) + (*(uint *)((longlong)pppppuVar20 + 0xec) - uVar7), pppppuVar20[5] != (uint ****)0x0 || (*(uint *)((longlong)pppppuVar20 + 0xc) == 0)))) { param_1[uVar9 * 3 + 0xdc] = pppppuVar20[2]; param_1[uVar9 * 3 + 0xdd] = pppppuVar20[3]; if (pppppuVar20[5] != (uint ****)0x0) { *(undefined4 *)((longlong)param_1 + uVar9 * 0x18 + 0x6f4) = *(undefined4 *)(pppppuVar20[5] + 7); } if (uVar7 != 0) { *(undefined1 *)((longlong)param_1 + 0x714) = 1; } *(int *)(param_1 + 0xe2) = *(int *)(param_1 + 0xe2) + 1; } param_4 = (uint *****)pppppuVar20[5]; if (param_4 != (uint *****)0x0) { pppppuVar22 = (uint *****)0x4; UxSslSendRawData((uint ****)param_1,0,4,param_4,(undefined *)0x0,(uint *****)0x0, (longlong *)0x0); pppppuVar20[5] = (uint ****)0x0; } pppppuVar14 = (uint *****)0x0; if ((pppppuVar20[0x1f] != (uint ****)0x0) && (*(char *)pppppuVar20[0x1f] != '\0')) { *(undefined1 *)((longlong)param_1 + 0xea) = 1; } *(undefined4 *)(param_1 + 0xd0) = 0x4105; if (*(uint *)((longlong)pppppuVar20 + 0xc) == 0x90312) { if ((uVar4 == uVar5) && (uVar7 == 0)) goto LAB_8; goto LAB_9; } uVar9 = UxpSslQuerySslConnectionInfo((longlong)param_1,0,pppppuVar22,param_4); pppppuVar21 = (uint *****)(uVar9 & 0xffffffff); if ((int)uVar9 < 0) goto LAB_4; piVar15 = (int *)((longlong)param_1[0xc0] + 0x14); LOCK(); iVar8 = *piVar15; *piVar15 = *piVar15 + 1; UNLOCK(); if ((UxDebugCheckRefcount != '\0') && (iVar8 + 1 < 0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(3,piVar15,0x1d,(longlong)(iVar8 + 1)); } pppppuVar14 = (uint *****)param_1[0xc0]; puVar1 = (uint *)((longlong)pppppuVar14 + 0x14); LOCK(); uVar7 = *puVar1; *puVar1 = *puVar1 - 1; UNLOCK(); iVar8 = uVar7 - 1; if ((UxDebugCheckRefcount != '\0') && (iVar8 < 0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(3,puVar1,1,(longlong)iVar8); } if (iVar8 == 0) { if ((DAT_0 & 1) != 0) { pppppuVar22 = pppppuVar14; WPP_SF_I(10,&WPP_842ebce0d6863175fcde2c51d1930128_Traceguids,pppppuVar14); } uVar7 = *(uint *)(pppppuVar14 + 0xf); *(uint *)(pppppuVar14 + 2) = 0x6c735875; if (uVar7 == 0) { lVar12 = DAT_11; if (UxDebugDisableLookaside == '\0') goto LAB_12; pppppuVar22 = (uint *****)0x60; memset(local_1c8,0,0x60); puVar16 = local_1c8; local_1a0 = DAT_13; pcVar10 = (code *)PTR_UlFreeFromLookaside_140185638; LAB_14: (*pcVar10)(pppppuVar14,puVar16); } else { if (uVar7 == 1) { lVar12 = DAT_15; if (UxDebugDisableLookaside != '\0') { pppppuVar22 = (uint *****)0x60; memset(local_168,0,0x60); local_140 = DAT_16; puVar16 = local_168; pcVar10 = (code *)PTR_UlFreeFromLookaside_140185668; goto LAB_14; } } else if (uVar7 == 2) { lVar12 = DAT_17; if (UxDebugDisableLookaside != '\0') { pppppuVar22 = (uint *****)0x60; memset(local_108,0,0x60); local_e0 = DAT_18; puVar16 = local_108; pcVar10 = (code *)PTR_UlFreeFromLookaside_140185698; goto LAB_14; } } else { if (uVar7 != 3) { ExFreePoolWithTag(pppppuVar14,0); goto LAB_19; } lVar12 = DAT_20; if (UxDebugDisableLookaside != '\0') { pppppuVar22 = (uint *****)0x60; memset(local_a8,0,0x60); local_80 = DAT_21; puVar16 = local_a8; pcVar10 = (code *)PTR_UlFreeFromLookaside_1401856c8; goto LAB_14; } } LAB_12: if (UxCompactMode == '\0') { pppppuVar22 = (uint *****)(ulonglong)*(uint *)pppppuVar14; PplFreeToLookasideListProcessor(lVar12,pppppuVar14,*(uint *)pppppuVar14); } else { PnlFreeToLookasideList(lVar12,pppppuVar14); } } LAB_19: if ((DAT_0 & 1) != 0) { WPP_SF_(0xb,&WPP_842ebce0d6863175fcde2c51d1930128_Traceguids,pppppuVar22,param_4); } } pppppuVar21 = param_1 + 0xaf; *(undefined1 *)((longlong)param_1[0xc0] + 0x74) = 1; ppppuVar17 = *pppppuVar21; ppppuVar11 = param_1[0xc0] + 10; if ((uint *****)ppppuVar17[1] != pppppuVar21) { pppppuVar21 = (uint *****)0x3; pcVar10 = (code *)swi(0x29); ppppuVar11 = (uint ****)(*pcVar10)(); - puVar19 = auStackY_210; + puVar18 = auStackY_210; } *ppppuVar11 = (uint ***)ppppuVar17; ppppuVar11[1] = (uint ***)pppppuVar21; ppppuVar17[1] = (uint ***)ppppuVar11; pppppuVar14 = (uint *****)0x4; *pppppuVar21 = ppppuVar11; param_1[0xc0] = (uint ****)0x0; - *(undefined8 *)(puVar19 + -8) = 0x140064e2a; + *(undefined8 *)(puVar18 + -8) = 0x1400605b2; UxpSslSetConnectionState((longlong)param_1,4,(longlong)pppppuVar22,(ulonglong)param_4); LOCK(); if (*(int *)((longlong)param_1[0x36] + 0x6c) == 2) { *(int *)((longlong)param_1[0x36] + 0x6c) = 1; } UNLOCK(); if (*(char *)((longlong)param_1 + 0x715) != '\0') { pppppuVar22 = (uint *****)0x0; - *(undefined8 *)(puVar19 + -8) = 0x140064e50; + *(undefined8 *)(puVar18 + -8) = 0x1400605d8; uVar9 = UxWfpConnectionClassify((longlong)param_1,0,0); pppppuVar14 = (uint *****)0x0; pppppuVar21 = (uint *****)(uVar9 & 0xffffffff); - *(undefined8 *)(puVar19 + -8) = 0x140064e5c; + *(undefined8 *)(puVar18 + -8) = 0x1400605e4; UxpSslSetNotifyCallout((longlong)param_1,0,(longlong)pppppuVar22,(ulonglong)param_4); if ((int)uVar9 < 0) { - puVar16 = puVar19; + puVar16 = puVar18; if ((DAT_3 & 1) != 0) { - pppppuVar14 = (uint *****)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; - *(undefined8 *)(puVar19 + -8) = 0x140064e7d; + pppppuVar14 = (uint *****)&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids; + *(undefined8 *)(puVar18 + -8) = 0x140060609; pppppuVar22 = param_1; - WPP_SF_I(0x9b,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1); + WPP_SF_I(0x9b,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1); } goto LAB_4; } } - *(undefined8 *)(puVar19 + -8) = 0x140064e87; + *(undefined8 *)(puVar18 + -8) = 0x140060616; uVar9 = UxSslConnectionHandshakeCompletion (param_1,pppppuVar14,(undefined *)pppppuVar22,param_4); pppppuVar21 = (uint *****)(uVar9 & 0xffffffff); - puVar18 = puVar19; + puVar19 = puVar18; } else { if (((int)uVar7 < 0) && (pppppuVar20[6] == (uint ****)0x0)) { param_1[0x38] = (uint ****)0xffffffffffffffff; param_1[0x37] = (uint ****)0xffffffffffffffff; } if ((*(byte *)((longlong)param_1[0xd4] + 0x6e2) & 1) != 0) { param_4 = param_1; McTemplateK0pq_EtwWriteTransfer (param_1[0xd4] + 0xd3,&HTTP_EVENT_SSL_ASC_RESULT,param_1 + 9,param_1); } bVar2 = DAT_7; if ((DAT_0 & 0x40) != 0) { WPP_SF_L(0x26,&WPP_c3410a5607a6316659f67a67ba938abb_Traceguids,(uint)DAT_7); } if (bVar2 != 0) { UxPktMonTraceDropSsl((longlong)param_1,0xe0005007,*(uint *)((longlong)pppppuVar20 + 0xc)); } pppppuVar22 = (uint *****)(ulonglong)*(uint *)((longlong)pppppuVar20 + 0xc); pppppuVar14 = (uint *****)0x2; UxSslLogError((longlong)param_1,2,*(uint *)((longlong)pppppuVar20 + 0xc)); if (*(uint *)((longlong)pppppuVar20 + 0xc) == 0) goto LAB_10; uVar7 = UxSslMapSecurityStatusToErrorNtStatus(*(uint *)((longlong)pppppuVar20 + 0xc)); pppppuVar21 = (uint *****)(ulonglong)uVar7; - puVar18 = auStackY_218; + puVar19 = auStackY_218; if ((DAT_0 & 1) != 0) { param_4 = (uint *****)(ulonglong)*(uint *)((longlong)pppppuVar20 + 0xc); - pppppuVar14 = (uint *****)&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids; + pppppuVar14 = (uint *****)&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids; pppppuVar22 = param_1; - WPP_SF_id(0x9a,&WPP_903e62bdd42130beaa4050f055593fc6_Traceguids,param_1, + WPP_SF_id(0x9a,&WPP_22e84aecc40d3f661731489fd49cac9b_Traceguids,param_1, *(uint *)((longlong)pppppuVar20 + 0xc)); - puVar18 = auStackY_218; - } - } - puVar16 = puVar18; + puVar19 = auStackY_218; + } + } + puVar16 = puVar19; if ((int)pppppuVar21 < 0) goto LAB_4; } LAB_2: - *(undefined8 *)(puVar18 + -8) = 0x140064fc7; + *(undefined8 *)(puVar19 + -8) = 0x14006003e; UxSslFreeAscContext((undefined *)pppppuVar20,pppppuVar14,(undefined *)pppppuVar22,param_4); - param_2 = *(uint ******)(puVar18 + 0x40); - } - param_3 = *(uint ******)(puVar18 + 0x48); + param_2 = *(uint ******)(puVar19 + 0x40); + } + param_3 = *(uint ******)(puVar19 + 0x48); LAB_1: if ((DAT_0 & 1) != 0) { bVar2 = *(byte *)param_3; bVar3 = *(byte *)param_2; - *(int *)(puVar18 + 0x20) = (int)pppppuVar21; - *(undefined8 *)(puVar18 + -8) = 0x140064ff1; + *(int *)(puVar19 + 0x20) = (int)pppppuVar21; + *(undefined8 *)(puVar19 + -8) = 0x140060068; WPP_SF_lld(0x9e,pppppuVar14,(uint)bVar3,(uint)bVar2); } - *(undefined8 *)(puVar18 + -8) = 0x140065002; + *(undefined8 *)(puVar19 + -8) = 0x140060079; return pppppuVar21; } ``` ## UlCopyRequestToBuffer ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address,calling,called| |ratio|0.79| |i_ratio|0.64| |m_ratio|0.99| |b_ratio|0.86| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlCopyRequestToBuffer|UlCopyRequestToBuffer| |fullname|UlCopyRequestToBuffer|UlCopyRequestToBuffer| |refcount|3|3| |`length`|2748|2851| |`called`|
Expand for full list:
McTemplateK0pxqzzq_EtwWriteTransfer
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::PsGetCurrentProcessId
UlChannelBindRequestInfoPresent
UlChargeRequestQueueQuota
UlCloseConnection
UlEtwEvaluateFilterForRequestConnection
UlGetQuicCreationStatsV2Size
UlGetTransportIdleConnectionTimeout
UlGetUserAuthInfoSize
UlGetUserChannelBindInfoSizeUlGetUserTokenBindingInfoSize
UlStartRequestQueueTimer
UlpCopyRequestToBuffer
WPP_SF_I
WPP_SF_L
WPP_SF_dlllll
WPP_SF_dllllll
WPP_SF_dqiqZLSiddP
WPP_SF_iq
WPP_SF_qII
WPP_SF_qLqqqq
_guard_dispatch_icall
memset
|
Expand for full list:
McTemplateK0pxqzzq_EtwWriteTransfer
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::PsGetCurrentProcessId
UlChannelBindRequestInfoPresent
UlChargeRequestQueueQuota
UlCloseConnection
UlEtwEvaluateFilterForRequestConnection
UlGetQuicCreationStatsV2Size
UlGetTransportIdleConnectionTimeout
UlGetUserAuthInfoSize
UlGetUserChannelBindInfoSizeUlGetUserTokenBindingInfoSize
UlStartRequestQueueTimer
UlpCopyRequestToBuffer
WPP_SF_I
WPP_SF_L
WPP_SF_dllllll
WPP_SF_dqiqZLSiddP
WPP_SF_iq
WPP_SF_qII
WPP_SF_qLqqqq
_guard_dispatch_icall
memset
| |`calling`|FUN_14015a796
UlFastReceiveHttpRequest|FUN_14015a61c
UlFastReceiveHttpRequest| |paramcount|6|6| |`address`|14004e2dc|14004988c| |sig|undefined __fastcall UlCopyRequestToBuffer(ulonglong * param_1, uint * param_2, uint param_3, ulonglong param_4, uint param_5, uint * param_6)|undefined __fastcall UlCopyRequestToBuffer(ulonglong * param_1, uint * param_2, uint param_3, ulonglong param_4, uint param_5, uint * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlCopyRequestToBuffer Called Diff ```diff --- UlCopyRequestToBuffer called +++ UlCopyRequestToBuffer called @@ -17 +16,0 @@ -WPP_SF_dlllll ``` ### UlCopyRequestToBuffer Calling Diff ```diff --- UlCopyRequestToBuffer calling +++ UlCopyRequestToBuffer calling @@ -1 +1 @@ -FUN_14015a796 +FUN_14015a61c ``` ### UlCopyRequestToBuffer Diff ```diff --- UlCopyRequestToBuffer +++ UlCopyRequestToBuffer @@ -1,435 +1,447 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void UlCopyRequestToBuffer (ulonglong *param_1,uint *param_2,uint param_3,ulonglong param_4,uint param_5, uint *param_6) { ushort uVar1; undefined4 uVar2; int iVar3; longlong *plVar4; char cVar5; byte bVar6; int iVar7; uint uVar8; undefined8 uVar9; ulonglong uVar10; ulonglong uVar11; uint uVar12; wchar_t *pwVar13; short sVar14; uint uVar15; size_t sVar17; ulonglong *puVar18; ulonglong *puVar19; char cVar20; ulonglong *puVar21; - bool bVar22; undefined8 in_stack_fffffffffffffef0; - longlong lVar23; - undefined4 uVar24; + longlong lVar22; + undefined4 uVar23; byte local_c7; - char local_c5; - char local_c4; - byte local_c3; - byte local_c2; + char local_c6; + byte local_c5; + byte local_c4; + char local_c3; + undefined1 local_c2; char local_c1; char local_c0; byte local_bf; - char local_be; - byte local_bd; - byte local_bc; - char local_bb; - char local_ba; + byte local_be; + char local_bd; + char local_bc; + byte local_bb; + byte local_ba; char local_b9; - char local_b8; + byte local_b8; + char local_b7; int local_b4; int local_b0; short local_ac [2]; uint local_a8; undefined4 local_a4; int local_a0; int local_9c; int local_98 [2]; uint local_90; ulonglong *local_88; longlong *local_80; undefined8 local_78; undefined8 uStack_70; undefined8 local_68; undefined8 uStack_60; undefined8 local_58; undefined8 uStack_50; int *local_48; ulonglong uVar16; - uVar24 = (undefined4)((ulonglong)in_stack_fffffffffffffef0 >> 0x20); + uVar23 = (undefined4)((ulonglong)in_stack_fffffffffffffef0 >> 0x20); uVar16 = 0; local_80 = (longlong *)(param_4 + 8); uVar2 = *(undefined4 *)(*local_80 + 0x114); local_a4 = uVar2; - local_b8 = IoIs32bitProcess(0); + local_b7 = IoIs32bitProcess(0); *param_6 = 0; local_88 = (ulonglong *)(param_6 + 2); *local_88 = 0; if ((DAT_0 & 0x20) != 0) { uVar9 = PsGetCurrentProcessId(); - WPP_SF_I(0x1a,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,uVar9); + WPP_SF_I(0x19,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,uVar9); } if (*(int *)(param_4 + 0x28) == 1) { uVar10 = UlChargeRequestQueueQuota((longlong)param_1); puVar21 = (ulonglong *)(uVar10 & 0xffffffff); if (-1 < (int)uVar10) goto LAB_1; } else { LAB_1: sVar14 = (short)uVar2; - if (local_b8 == '\0') { + if (local_b7 == '\0') { if ((sVar14 != 1) || (local_a8 = 0x350, local_a4._2_2_ != 0)) { local_a8 = 0x360; } } else if ((sVar14 == 1) && (local_a4._2_2_ == 0)) { local_a8 = 0x1d0; } else { local_a8 = 0x1d8; } local_a0 = 0; local_78 = 0; uStack_70 = 0; local_68 = 0; uStack_60 = 0; local_58 = 0; uStack_50 = 0; local_48 = (int *)0x0; local_98[0] = 0; local_9c = 0; - local_bf = 0; - local_be = '\0'; - local_bd = 0; - local_bc = 0; - local_bb = '\0'; - local_ba = '\0'; + local_be = 0; + local_bd = '\0'; + local_bc = '\0'; + local_bb = 0; + local_ba = 0; local_b9 = '\0'; + local_b8 = 0; if ((DAT_2 & 0x40) != 0) { uVar10 = uVar16; if (param_1 != (ulonglong *)0x0) { uVar10 = param_1[8]; } - WPP_SF_qII(0xf,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,param_1,uVar10); + WPP_SF_qII(0xe,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,param_1,uVar10); } local_90 = 0; cVar5 = IoIs32bitProcess(0); uVar1 = *(ushort *)((longlong)param_1 + 0x7bc); if (cVar5 == '\0') { local_b0 = ((uint)uVar1 + (uint)uVar1 * 2) * 8 + 0x3a0; } else { local_b0 = ((uint)uVar1 + (uint)uVar1 * 2) * 4 + 0x218; } local_b0 = (int)param_1[0xf7] + local_b0; uVar10 = param_1[3]; if (*(char *)(uVar10 + 0x1d1) == '\0') { LAB_3: local_ac[0] = 0; - local_c5 = '\0'; + local_c6 = '\0'; + local_c2 = 0; + local_c5 = 0; + local_c4 = 0; + local_c3 = '\0'; local_c7 = 0; - local_c1 = '\0'; - local_c0 = '\0'; if ((DAT_2 & 0x40) != 0) { - WPP_SF_iq(10,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,param_1,param_1[8]); + WPP_SF_iq(10,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,param_1,param_1[8]); } uVar10 = param_1[3]; uVar12 = (uint)(*(char *)(uVar10 + 0x1e0) != '\0'); iVar7 = uVar12 + 4; if (((param_1[0x11b] & 1) != 0) && (iVar7 = uVar12 + 4, (param_1[0x11b] & 2) == 0)) { - local_c7 = 1; + local_c5 = 1; iVar7 = uVar12 + 5; } uVar11 = UlChannelBindRequestInfoPresent((longlong)param_1); - local_c4 = (char)uVar11 != '\0'; + local_c1 = (char)uVar11 != '\0'; iVar3 = iVar7 + 1; if ((char)uVar11 == '\0') { iVar3 = iVar7; } - local_c3 = *(char *)(uVar10 + 0x1d1) != '\0'; + local_c0 = *(char *)(uVar10 + 0x1d1) != '\0'; iVar7 = iVar3 + 1; if (*(char *)(uVar10 + 0x1d1) == '\0') { iVar7 = iVar3; } - local_c2 = *(longlong *)(uVar10 + 0x370) != 0; + local_bf = *(longlong *)(uVar10 + 0x370) != 0; local_b4 = iVar7 + 1; if (*(longlong *)(uVar10 + 0x370) == 0) { local_b4 = iVar7; } uVar10 = UlGetTransportIdleConnectionTimeout(uVar10,local_ac); puVar21 = (ulonglong *)(uVar10 & 0xffffffff); if (-1 < (int)uVar10) { - bVar22 = local_ac[0] != 0; - if (bVar22) { + if (local_ac[0] != 0) { + local_c4 = 1; local_b4 = local_b4 + 1; } - if ((UxKirBrHttpQuerySocketTtl != '\0') && (*(char *)(param_1[3] + 0x1e0) != '\0')) { - local_c0 = '\x01'; - local_b4 = local_b4 + 1; - if ((DAT_2 & 0x40) != 0) { - WPP_SF_L(0xb,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,1); - } - } - if (UxKirHttpDscp == '\0') { - if ((DAT_2 & 0x40) != 0) { - WPP_SF_dlllll((ulonglong)local_c2,(ulonglong)local_c3,local_b4,(uint)local_c7); - } - } - else { - uVar10 = param_1[3]; + if ((((UxKirBrHttpQuerySocketTtl != '\0') && (*(char *)((longlong)param_1 + 0x63c) != '\0')) + && (*(char *)((longlong)param_1 + 0x63d) != '\0')) && + (uVar10 = param_1[3], *(char *)(uVar10 + 0x1e0) != '\0')) { if ((DAT_4 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar10 + 0x1f0,0x4b); - } - uVar24 = 0; + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, + (undefined8 *)(uVar10 + 0x1f0),0x4c); + } + uVar23 = 0; uVar12 = (**(code **)(*(longlong *)(uVar10 + 0x1f8) + 0x88)) - (*(undefined8 *)(uVar10 + 0x1f0),0x4b,&local_c5,0,0,0); + (*(undefined8 *)(uVar10 + 0x1f0),0x4c,&local_c2,&local_c7,0,0); puVar21 = (ulonglong *)(ulonglong)uVar12; if ((DAT_4 & 1) != 0) { WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar12); } if ((int)uVar12 < 0) goto LAB_5; - if (local_c5 != '\0') { - local_c1 = '\x01'; + if (local_c7 != 0) { local_b4 = local_b4 + 1; } if ((DAT_2 & 0x40) != 0) { - WPP_SF_dllllll((ulonglong)bVar22,(ulonglong)local_c2,local_b4,(uint)local_c7); - } - } - local_9c = local_b4; - local_bf = local_c7; - local_be = local_c4; - local_bd = local_c3; - local_bc = local_c2; - local_ba = local_c1; - local_b9 = local_c0; - local_bb = bVar22; + WPP_SF_L(0xb,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,(uint)local_c7); + } + } + uVar10 = param_1[3]; + if ((DAT_4 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar10 + 0x1f0,0x4b); + } + uVar23 = 0; + uVar12 = (**(code **)(*(longlong *)(uVar10 + 0x1f8) + 0x88)) + (*(undefined8 *)(uVar10 + 0x1f0),0x4b,&local_c6,0,0,0); + puVar21 = (ulonglong *)(ulonglong)uVar12; + if ((DAT_4 & 1) != 0) { + WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar12); + } + if (-1 < (int)uVar12) { + if (local_c6 != '\0') { + local_c3 = '\x01'; + local_b4 = local_b4 + 1; + } + if ((DAT_2 & 0x40) != 0) { + WPP_SF_dllllll((ulonglong)local_c4,(ulonglong)local_bf,local_b4,(uint)local_c5); + } + local_9c = local_b4; + local_be = local_c5; + local_bd = local_c1; + local_bc = local_c0; + local_bb = local_bf; + local_ba = local_c4; + local_b9 = local_c3; + local_b8 = local_c7; + } } LAB_5: if ((DAT_2 & 0x40) != 0) { - WPP_SF_L(0xe,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,(int)puVar21); + WPP_SF_L(0xd,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,(int)puVar21); } uVar15 = local_90; if (-1 < (int)puVar21) { if (cVar5 == '\0') { uVar12 = (local_b0 + 7U & 0xfffffff8) + local_9c * 0x10; } else { uVar12 = (local_b0 + 3U & 0xfffffffc) + local_9c * 0xc; } cVar20 = cVar5; - if (local_bf != 0) { + if (local_be != 0) { if (cVar5 == '\0') { iVar7 = UlGetUserAuthInfoSize((uint *)(param_1 + 0x11b),'\0'); uVar12 = uVar12 + 7 & 0xfffffff8; } else { iVar7 = UlGetUserAuthInfoSize((uint *)(param_1 + 0x11b),'\x01'); } uVar12 = uVar12 + iVar7; } - if (local_be != '\0') { + if (local_bd != '\0') { if (cVar20 == '\0') { iVar7 = UlGetUserChannelBindInfoSize((longlong)param_1,'\0'); uVar12 = uVar12 + 7 & 0xfffffff8; } else { iVar7 = UlGetUserChannelBindInfoSize((longlong)param_1,'\x01'); uVar12 = uVar12 + 3 & 0xfffffffc; } uVar12 = uVar12 + iVar7; } - if (local_bd != 0) { + if (local_bc != '\0') { if (cVar5 == '\0') { uVar12 = uVar12 + 7 & 0xfffffff8; } else { uVar12 = uVar12 + 3 & 0xfffffffc; } uVar12 = uVar12 + 0x1c; } - if (local_bc != 0) { + if (local_bb != 0) { if (cVar5 == '\0') { iVar7 = UlGetUserTokenBindingInfoSize(param_1[3] + 0x370,0); uVar12 = (uVar12 + 7 & 0xfffffff8) + iVar7; } else { iVar7 = UlGetUserTokenBindingInfoSize(param_1[3] + 0x370,1); uVar12 = (uVar12 + 3 & 0xfffffffc) + iVar7; } } - if (local_bb != '\0') { + if (local_ba != 0) { if (cVar5 == '\0') { uVar12 = uVar12 + 7 & 0xfffffff8; } else { uVar12 = uVar12 + 3 & 0xfffffffc; } uVar12 = uVar12 + 2; } - if ((UxKirHttpDscp != '\0') && (local_ba != '\0')) { + if (local_b9 != '\0') { if (cVar5 == '\0') { uVar12 = uVar12 + 7 & 0xfffffff8; } else { uVar12 = uVar12 + 3 & 0xfffffffc; } uVar12 = uVar12 + 1; } - if ((UxKirBrHttpQuerySocketTtl != '\0') && (local_b9 != '\0')) { + if ((UxKirBrHttpQuerySocketTtl != '\0') && (local_b8 != 0)) { if (cVar5 == '\0') { uVar12 = uVar12 + 7 & 0xfffffff8; } else { uVar12 = uVar12 + 3 & 0xfffffffc; } uVar12 = uVar12 + 1; } if (cVar5 == '\0') { uVar12 = uVar12 + 7 & 0xfffffff8; } else { uVar12 = uVar12 + 3 & 0xfffffffc; } if (*(char *)(param_1[3] + 0x1e0) == '\0') { uVar8 = UlGetQuicCreationStatsV2Size((longlong)param_1,local_98); puVar21 = (ulonglong *)(ulonglong)uVar8; uVar15 = local_90; if ((int)uVar8 < 0) goto LAB_6; if (cVar5 == '\0') { uVar12 = uVar12 + 0x137 & 0xfffffff8; } else { uVar12 = uVar12 + 0x130; } uVar15 = local_98[0] + 200 + uVar12; } else { if (cVar5 == '\0') { uVar12 = uVar12 + 0x137 & 0xfffffff8; } else { uVar12 = uVar12 + 0x130; } uVar15 = uVar12 + 0x98; } uVar16 = (ulonglong)uVar15; if ((DAT_2 & 0x40) != 0) { - WPP_SF_L(0x10,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,uVar15); + WPP_SF_L(0xf,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,uVar15); } } } else { uStack_70 = CONCAT71(uStack_70._1_7_,cVar5 != '\0'); local_48 = &local_a0; if ((DAT_4 & 1) != 0) { WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar10 + 0x1f0,0x25); } - uVar24 = 0; + uVar23 = 0; uVar12 = (**(code **)(*(longlong *)(uVar10 + 0x1f8) + 0x88)) (*(undefined8 *)(uVar10 + 0x1f0),0x25,&local_78,0,0,0); puVar21 = (ulonglong *)(ulonglong)uVar12; if ((DAT_4 & 1) != 0) { WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar12); } uVar15 = local_90; if (-1 < (int)uVar12) { if (cVar5 == '\0') { uVar12 = local_b0 + 7U & 0xfffffff8; } else { uVar12 = local_b0 + 3U & 0xfffffffc; } local_b0 = uVar12 + local_a0; goto LAB_3; } } LAB_6: local_90 = uVar15; if ((DAT_2 & 0x40) != 0) { - WPP_SF_L(0x11,&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,(int)puVar21); + WPP_SF_L(0x10,&WPP_acfa19df7d6c33f6a506e5b9373748a8_Traceguids,(int)puVar21); } if (-1 < (int)puVar21) { if (param_3 < local_a8) { puVar21 = (ulonglong *)0xc0000023; } else if (param_3 < (uint)uVar16) { - if (local_b8 == '\0') { + if (local_b7 == '\0') { if ((sVar14 != 1) || (sVar17 = 0x350, local_a4._2_2_ != 0)) { sVar17 = 0x360; } memset(param_2,0,sVar17); *(ulonglong *)(param_2 + 4) = param_1[7]; *(ulonglong *)(param_2 + 2) = param_1[4]; *(ulonglong *)(param_2 + 0xd0) = param_1[5]; } else { if ((sVar14 != 1) || (sVar17 = 0x1d0, local_a4._2_2_ != 0)) { sVar17 = 0x1d8; } memset(param_2,0,sVar17); *(ulonglong *)(param_2 + 4) = param_1[7]; *(ulonglong *)(param_2 + 2) = param_1[4]; *(ulonglong *)(param_2 + 0x70) = param_1[5]; } *local_88 = uVar16; puVar21 = (ulonglong *)0x80000005; } else { UlpCopyRequestToBuffer - ((byte *)param_1,0,param_4,param_2,(longlong)param_2,param_3,(char)uVar16,param_5, - '\0',(int *)param_6); + ((byte *)param_1,0,param_4,param_2,(longlong *)param_2,param_3,(char)uVar16, + param_5,'\0',(int *)param_6); puVar21 = (ulonglong *)(ulonglong)*param_6; } } } plVar4 = local_80; uVar12 = (uint)puVar21; *param_6 = uVar12; puVar18 = (ulonglong *)(ulonglong)param_3; puVar19 = local_88; if ((DAT_2 & 0x40) != 0) { - lVar23 = *local_80; + lVar22 = *local_80; puVar19 = param_1; - WPP_SF_dqiqZLSiddP(lVar23 + 0xa0,lVar23,uVar12,param_1); - uVar24 = (undefined4)((ulonglong)lVar23 >> 0x20); + WPP_SF_dqiqZLSiddP(lVar22 + 0xa0,lVar22,uVar12,param_1); + uVar23 = (undefined4)((ulonglong)lVar22 >> 0x20); puVar18 = puVar21; } if (((uVar12 + 0x80000000 & 0x80000000) == 0) && (uVar12 != 0x80000005)) { UlCloseConnection((longlong *)param_1[3],'\x01',(longlong *)puVar18,(ulonglong)puVar19); return; } pwVar13 = (wchar_t *)param_1[3]; if ((pwVar13 != (wchar_t *)0x0) && ((*(byte *)(*(longlong *)(pwVar13 + 0x224) + 0x6e0) & 1) != 0)) { if (*(longlong *)(*(longlong *)(pwVar13 + 0x224) + 0x6f0) != 0) { puVar18 = (ulonglong *)0x0; bVar6 = UlEtwEvaluateFilterForRequestConnection((longlong)param_1,(longlong)pwVar13,0); if (bVar6 == 0) goto LAB_7; } pwVar13 = L"<>"; if (*(wchar_t **)(*plVar4 + 0xa8) != (wchar_t *)0x0) { pwVar13 = *(wchar_t **)(*plVar4 + 0xa8); } puVar18 = param_1 + 9; puVar19 = param_1; McTemplateK0pxqzzq_EtwWriteTransfer ((undefined8 *)(*(longlong *)(param_1[3] + 0x448) + 0x698),pwVar13,puVar18,param_1, - param_1[7],CONCAT44(uVar24,(int)param_1[0xb0]),pwVar13,(wchar_t *)param_1[0xfe]); + param_1[7],CONCAT44(uVar23,(int)param_1[0xb0]),pwVar13,(wchar_t *)param_1[0xfe]); } LAB_7: if (uVar12 == 0x80000005) { UlStartRequestQueueTimer((longlong)param_1,pwVar13,puVar18,puVar19); } return; } ``` ## UlSetRequestProperty ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.98| |i_ratio|0.53| |m_ratio|1.0| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlSetRequestProperty|UlSetRequestProperty| |fullname|UlSetRequestProperty|UlSetRequestProperty| |refcount|3|3| |`length`|835|826| |called|
Expand for full list:
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeGetCurrentIrql
UlBugCheckEx
UlFreeHttpConnection
UlGetConnectionFromId
UlGetConsumer
UlGetRequestFromId
UlSetTransportIdleConnectionTimeout
UlThreadPoolEnqueueWorkItem
UlpQueueFreeHttpRequest
UxPodAttachThreadUxPodDetachThread
WPP_SF_L
WPP_SF_iq
WPP_SF_qLqqqq
_guard_dispatch_icall
|
Expand for full list:
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeGetCurrentIrql
UlBugCheckEx
UlFreeHttpConnection
UlGetConnectionFromId
UlGetConsumer
UlGetRequestFromId
UlSetTransportIdleConnectionTimeout
UlThreadPoolEnqueueWorkItem
UlpQueueFreeHttpRequest
UxPodAttachThreadUxPodDetachThread
WPP_SF_L
WPP_SF_iq
WPP_SF_qLqqqq
_guard_dispatch_icall
| |calling|UlSetRequestFastIo
UlSetRequestIoctl|UlSetRequestFastIo
UlSetRequestIoctl| |paramcount|4|4| |`address`|1400cb260|1400cb930| |sig|uint __fastcall UlSetRequestProperty(longlong param_1, undefined8 * * * * * param_2, undefined8 param_3, undefined8 * * * * * param_4)|uint __fastcall UlSetRequestProperty(longlong param_1, undefined8 * * * * * param_2, undefined8 param_3, undefined8 * * * * * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlSetRequestProperty Diff ```diff --- UlSetRequestProperty +++ UlSetRequestProperty @@ -1,153 +1,153 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ uint UlSetRequestProperty (longlong param_1,undefined8 *****param_2,undefined8 param_3,undefined8 *****param_4) { undefined8 ****ppppuVar1; char cVar2; uint uVar3; int iVar4; undefined8 *****pppppuVar5; undefined8 *****pppppuVar6; ulonglong uVar7; longlong lVar8; undefined8 uVar9; char *pcVar10; undefined8 *****pppppuVar11; uint **ppuVar12; undefined8 *****pppppuVar13; uint *local_res18 [2]; char local_38 [16]; pppppuVar6 = (undefined8 *****)0x0; local_res18[0] = (uint *)0x0; if ((DAT_0 & 1) != 0) { param_4 = param_2; - WPP_SF_iq(0x8a,&WPP_093d4d9875f132d387d0435491be4d4d_Traceguids,param_1,param_2); + WPP_SF_iq(0x8a,&WPP_3217c3b7128b385d96320719b5abbc38_Traceguids,param_1,param_2); } ppuVar12 = local_res18; uVar3 = UlGetConsumer(param_1,1,(longlong *)ppuVar12); if ((int)uVar3 < 0) goto LAB_1; pppppuVar5 = (undefined8 *****) UlGetRequestFromId((ulonglong)*param_2,local_res18[0],ppuVar12,(uint *)param_4); if (pppppuVar5 == (undefined8 *****)0x0) { pppppuVar6 = (undefined8 *****)UlGetConnectionFromId(local_res18[0],(ulonglong)*param_2,1); pppppuVar13 = pppppuVar6; if (pppppuVar6 == (undefined8 *****)0x0) { uVar3 = 0xc000023a; goto LAB_1; } } else { pppppuVar13 = (undefined8 *****)pppppuVar5[3]; } iVar4 = *(int *)(param_2 + 1); if (iVar4 == 5) { if ((DAT_2 & 1) != 0) { WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,pppppuVar13 + 0x3e,0x37); } uVar9 = 0x37; LAB_3: pppppuVar11 = (undefined8 *****)((longlong)param_2 + 0xc); param_4 = (undefined8 *****)0x0; uVar3 = (*(code *)pppppuVar13[0x3f][0x11])(pppppuVar13[0x3e],uVar9,pppppuVar11,0,0,0); pppppuVar13 = pppppuVar11; if ((DAT_2 & 1) != 0) { pppppuVar13 = (undefined8 *****)(ulonglong)uVar3; WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar3); } } else if (iVar4 == 0xc) { uVar7 = UlSetTransportIdleConnectionTimeout ((longlong)pppppuVar13,*(ushort *)((longlong)param_2 + 0xc)); uVar3 = (uint)uVar7; } else { - if ((iVar4 == 0xd) && (UxKirHttpDscp != '\0')) { + if (iVar4 == 0xd) { if ((DAT_2 & 1) != 0) { WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,pppppuVar13 + 0x3e,0x4a); } uVar9 = 0x4a; goto LAB_3; } uVar3 = 0xc000000d; } if (pppppuVar5 != (undefined8 *****)0x0) { pppppuVar11 = pppppuVar5 + 6; LOCK(); iVar4 = *(int *)pppppuVar11; *(int *)pppppuVar11 = *(int *)pppppuVar11 + -1; UNLOCK(); iVar4 = iVar4 + -1; if ((UxDebugCheckRefcount != '\0') && (iVar4 < 0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(3,pppppuVar11,0xb,(longlong)iVar4); } if (iVar4 == 0) { UlpQueueFreeHttpRequest(pppppuVar5,(undefined *)pppppuVar11,pppppuVar13,param_4); } } if (pppppuVar6 != (undefined8 *****)0x0) { pppppuVar5 = pppppuVar6 + 5; LOCK(); iVar4 = *(int *)pppppuVar5; *(int *)pppppuVar5 = *(int *)pppppuVar5 + -1; UNLOCK(); iVar4 = iVar4 + -1; if ((UxDebugCheckRefcount != '\0') && (iVar4 < 0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(3,pppppuVar5,0xb,(longlong)iVar4); } if (iVar4 == 0) { lVar8 = IoGetCurrentProcess(); pppppuVar5 = pppppuVar6 + 8; ppppuVar1 = pppppuVar6[0x88]; if (UxSystemProcess == lVar8) { local_38[0] = '\0'; local_38[1] = '\0'; local_38[2] = '\0'; local_38[3] = '\0'; local_38[4] = '\0'; local_38[5] = '\0'; local_38[6] = '\0'; local_38[7] = '\0'; local_38[8] = '\0'; local_38[9] = '\0'; local_38[10] = '\0'; local_38[0xb] = '\0'; local_38[0xc] = '\0'; local_38[0xd] = '\0'; local_38[0xe] = '\0'; local_38[0xf] = '\0'; if (((*pppppuVar5 != (undefined8 ****)0x0) || (pppppuVar6[10] != (undefined8 ****)0x0)) || (pppppuVar6[0xc] != (undefined8 ****)0x0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(1,pppppuVar5,"minio\\http\\sys\\httpconn.h",0xe1); } cVar2 = KeGetCurrentIrql(); if (cVar2 == '\0') { pcVar10 = local_38; UxPodAttachThread((longlong)ppppuVar1,(undefined8 *)pcVar10); UlFreeHttpConnection(pppppuVar5,pcVar10,pppppuVar13,param_4); UxPodDetachThread(local_38); goto LAB_1; } } else if (((*pppppuVar5 != (undefined8 ****)0x0) || (pppppuVar6[10] != (undefined8 ****)0x0)) || (pppppuVar6[0xc] != (undefined8 ****)0x0)) { /* WARNING: Subroutine does not return */ UlBugCheckEx(1,pppppuVar5,"minio\\http\\sys\\httpconn.h",0xdb); } UlThreadPoolEnqueueWorkItem (0,(longlong)pppppuVar5,UlFreeHttpConnection,'\x01',(longlong)ppppuVar1,0xffffffff); } } LAB_1: if ((DAT_0 & 1) != 0) { - WPP_SF_L(0x8b,&WPP_093d4d9875f132d387d0435491be4d4d_Traceguids,uVar3); + WPP_SF_L(0x8b,&WPP_3217c3b7128b385d96320719b5abbc38_Traceguids,uVar3); } return uVar3; } ``` ## UlpCopyInitialPacketTtl ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.74| |i_ratio|0.36| |m_ratio|0.91| |b_ratio|0.84| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpCopyInitialPacketTtl|UlpCopyInitialPacketTtl| |fullname|UlpCopyInitialPacketTtl|UlpCopyInitialPacketTtl| |refcount|2|2| |`length`|212|261| |called|WPP_SF_L
WPP_SF_qLqqqq
_guard_dispatch_icall|WPP_SF_L
WPP_SF_qLqqqq
_guard_dispatch_icall| |calling|UlpCopyRequestInformation|UlpCopyRequestInformation| |paramcount|6|6| |`address`|140105584|140105c14| |sig|int __fastcall UlpCopyInitialPacketTtl(longlong param_1, undefined1 * param_2, int param_3, undefined8 param_4, undefined8 param_5, undefined4 * param_6)|int __fastcall UlpCopyInitialPacketTtl(longlong param_1, undefined1 * param_2, int param_3, undefined8 param_4, undefined8 param_5, undefined4 * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpCopyInitialPacketTtl Diff ```diff --- UlpCopyInitialPacketTtl +++ UlpCopyInitialPacketTtl @@ -1,33 +1,43 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ int UlpCopyInitialPacketTtl (longlong param_1,undefined1 *param_2,int param_3,undefined8 param_4, undefined8 param_5,undefined4 *param_6) { longlong lVar1; int iVar2; + char local_res18 [16]; + undefined1 local_18 [16]; + local_18[0] = 0; + local_res18[0] = '\0'; *param_6 = 0; if (param_3 == 0) { iVar2 = -0x3fffffdd; } else { - *param_2 = 0; lVar1 = *(longlong *)(param_1 + 0x18); if ((DAT_0 & 1) != 0) { WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,lVar1 + 0x1f0,0x4c); } iVar2 = (**(code **)(*(longlong *)(lVar1 + 0x1f8) + 0x88)) - (*(undefined8 *)(lVar1 + 0x1f0),0x4c,param_2,0,0,0); + (*(undefined8 *)(lVar1 + 0x1f0),0x4c,local_18,local_res18,0,0); if ((DAT_0 & 1) != 0) { WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,iVar2); } if (-1 < iVar2) { - *param_6 = 1; + if (local_res18[0] == '\0') { + iVar2 = -0x3fffff45; + } + else { + iVar2 = 0; + *param_2 = local_18[0]; + *param_6 = 1; + } } } return iVar2; } ``` ## UxTlConnectionControl ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address,calling| |ratio|0.5| |i_ratio|0.53| |m_ratio|0.99| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxTlConnectionControl|UxTlConnectionControl| |fullname|UxTlConnectionControl|UxTlConnectionControl| |refcount|128|128| |`length`|1340|1327| |called|
Expand for full list:
UlAiFreeAddressInformation
UlAiGetAddressInformation
UlBugCheckEx
UlEtIsConnectionEdgeTraversed
UxPodReferenceSilo
UxTlGetDscpTag
UxTlGetTcpFastOpen
UxTlGetTcpInfo
UxTlGetTcpInitialPacketTtl
UxTlQosSetFlowOnConnection
UxTlSetAggressiveIcwUxTlSetDscpTag
UxTlSetIsbPrecision
WPP_SF_L
WPP_SF_id
WPP_SF_qLqqqq
|
Expand for full list:
UlAiFreeAddressInformation
UlAiGetAddressInformation
UlBugCheckEx
UlEtIsConnectionEdgeTraversed
UxPodReferenceSilo
UxTlGetDscpTag
UxTlGetTcpFastOpen
UxTlGetTcpInfo
UxTlGetTcpInitialPacketTtl
UxTlQosSetFlowOnConnection
UxTlSetAggressiveIcwUxTlSetDscpTag
UxTlSetIsbPrecision
WPP_SF_L
WPP_SF_id
WPP_SF_qLqqqq
| |`calling`|
Expand for full list:
FUN_14015b26a
FUN_1401618f2
UcCreateClientStreamIoctl
UcQueryClientStreamProperty
UlCheckRawResponseCompatibility
UlConnectionCleanupWorker
UlDeclarePushIoctl
UlGetQuicCreationStatsV2Size
UlGetTransportIdleConnectionTimeout
UlHttpReceiveHeadersEvent
UlParsePushHeaderPairsUlParsePushHeaderPairsOld
UlParseRequestHeaderPairs
UlParseRequestHeaderPairsOld
UlQueryChannelBindToken
UlReceiveClientCertIoctl
UlSendCachedResponse
UlSetHttpConnectionTokenBinding
UlSetTransportIdleConnectionTimeout
UlpCompleteLogRecordW3C
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestToBuffer
UlpCopySslProtocolInfo
UlpCopyTcpInfoV2
UlpDeliverRequestStagePolicies
UlpHkeAcquireQoS
UlpInitErrorLogInfo
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpLogErrorResposeSendEvent
UxDuoAttachConnection
UxDuoExecuteDetach
UxDuoExecuteIoReady
UxDuoExecuteRetrieveClientCert
UxDuoSetTokenBinding
UxSslAttachConnection
UxpTpSetFlowOnConnection
switchD_140150f8e::caseD_b
|
Expand for full list:
FUN_14015b0f0
FUN_140161bde
UcCreateClientStreamIoctl
UcQueryClientStreamProperty
UlCheckRawResponseCompatibility
UlConnectionCleanupWorker
UlDeclarePushIoctl
UlGetQuicCreationStatsV2Size
UlGetTransportIdleConnectionTimeout
UlHttpReceiveHeadersEvent
UlParsePushHeaderPairsUlParsePushHeaderPairsOld
UlParseRequestHeaderPairs
UlParseRequestHeaderPairsOld
UlQueryChannelBindToken
UlReceiveClientCertIoctl
UlSendCachedResponse
UlSetHttpConnectionTokenBinding
UlSetTransportIdleConnectionTimeout
UlpCompleteLogRecordW3C
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestToBuffer
UlpCopySslProtocolInfo
UlpCopyTcpInfoV2
UlpDeliverRequestStagePolicies
UlpHkeAcquireQoS
UlpInitErrorLogInfo
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpLogErrorResposeSendEvent
UxDuoAttachConnection
UxDuoExecuteDetach
UxDuoExecuteIoReady
UxDuoExecuteRetrieveClientCert
UxDuoSetTokenBinding
UxSslAttachConnection
UxpTpSetFlowOnConnection
switchD_1401516fa::caseD_b
| |paramcount|4|4| |`address`|140005c60|140005c50| |sig|ulonglong __fastcall UxTlConnectionControl(ulonglong * param_1, uint param_2, ulonglong * param_3, ulonglong * param_4)|ulonglong __fastcall UxTlConnectionControl(ulonglong * param_1, uint param_2, ulonglong * param_3, ulonglong * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxTlConnectionControl Calling Diff ```diff --- UxTlConnectionControl calling +++ UxTlConnectionControl calling @@ -1,2 +1,2 @@ -FUN_14015b26a -FUN_1401618f2 +FUN_14015b0f0 +FUN_140161bde @@ -39 +39 @@ -switchD_140150f8e::caseD_b +switchD_1401516fa::caseD_b ``` ### UxTlConnectionControl Diff ```diff --- UxTlConnectionControl +++ UxTlConnectionControl @@ -1,277 +1,275 @@ ulonglong UxTlConnectionControl (ulonglong *param_1,uint param_2,ulonglong *param_3,ulonglong *param_4) { - undefined1 uVar1; - uint uVar2; - int iVar3; - undefined4 uVar4; - ulonglong uVar5; - int *piVar6; - ulonglong uVar7; + uint uVar1; + int iVar2; + undefined4 uVar3; + ulonglong uVar4; + int *piVar5; + ulonglong uVar6; + ulonglong *puVar7; ulonglong *puVar8; - ulonglong *puVar9; - bool bVar10; + bool bVar9; ulonglong local_res8; - uVar7 = 0; + uVar6 = 0; local_res8 = 0; - puVar8 = param_3; - puVar9 = param_4; + puVar7 = param_3; + puVar8 = param_4; if ((DAT_0 & 0x40) != 0) { - puVar9 = (ulonglong *)(ulonglong)param_2; - puVar8 = param_1; - WPP_SF_qLqqqq(0x16,&WPP_9c9c85f07d5d334c19286e9ec3ffb0db_Traceguids,param_1,param_2); + puVar8 = (ulonglong *)(ulonglong)param_2; + puVar7 = param_1; + WPP_SF_qLqqqq(0x16,&WPP_90f0d61f998b399b863c98e974e69a96_Traceguids,param_1,param_2); } if (0x24 < (int)param_2) { if ((int)param_2 < 0x36) { - if (param_2 == 0x35) { - uVar7 = 0xc00000bb; - goto LAB_1; - } - if (param_2 != 0x2d) { - if (param_2 == 0x2e) { - uVar4 = *(undefined4 *)(*(longlong *)(param_1[0x1a] + 200) + 0x1120); - } - else { - if (param_2 != 0x2f) { - if (param_2 == 0x31) { - *(undefined1 *)param_3 = 1; - goto LAB_1; - } - if (param_2 == 0x33) goto LAB_1; - goto LAB_2; - } - uVar4 = *(undefined4 *)(*(longlong *)(param_1[0x1a] + 200) + 0x1be0); - } - *(undefined4 *)param_3 = uVar4; - goto LAB_1; - } + if (param_2 != 0x35) { + if (param_2 != 0x2d) { + if (param_2 == 0x2e) { + uVar3 = *(undefined4 *)(*(longlong *)(param_1[0x1a] + 200) + 0x1120); + } + else { + if (param_2 != 0x2f) { + if (param_2 == 0x31) { + *(undefined1 *)param_3 = 1; + goto LAB_1; + } + if (param_2 == 0x33) goto LAB_1; + goto LAB_2; + } + uVar3 = *(undefined4 *)(*(longlong *)(param_1[0x1a] + 200) + 0x1be0); + } + *(undefined4 *)param_3 = uVar3; + goto LAB_1; + } LAB_3: - *(undefined1 *)param_3 = 0; - goto LAB_1; - } - if (param_2 == 0x46) { - uVar7 = (ulonglong)((-(uint)(UxKirSeHttpQueryCryptoParams != '\0') & 0xb9) + 0xc0000002); - goto LAB_1; - } - if (param_2 == 0x4a) { - uVar2 = UxTlSetDscpTag((longlong)param_1,(byte)*param_3); - } - else { - if (param_2 != 0x4b) { - if ((param_2 != 0x4c) || (UxKirBrHttpQuerySocketTtl == '\0')) { + *(undefined1 *)param_3 = 0; + goto LAB_1; + } + } + else if (param_2 != 0x46) { + if (param_2 == 0x4a) { + uVar1 = UxTlSetDscpTag((longlong)param_1,(byte)*param_3); + } + else { + if (param_2 != 0x4b) { + if ((param_2 == 0x4c) && (UxKirBrHttpQuerySocketTtl != '\0')) { + uVar4 = UxTlGetTcpInitialPacketTtl((longlong)param_1); + uVar6 = uVar4 & 0xffffffff; + if (-1 < (int)uVar4) { + *(undefined1 *)param_3 = *(undefined1 *)((longlong)param_1 + 0x194); + *(undefined1 *)param_4 = *(undefined1 *)((longlong)param_1 + 0x195); + } + goto LAB_1; + } LAB_2: - uVar7 = 0xc0000002; + uVar6 = 0xc0000002; goto LAB_1; } - uVar2 = UxTlGetTcpInitialPacketTtl((longlong)param_1); - uVar7 = (ulonglong)uVar2; - if ((int)uVar2 < 0) goto LAB_1; - uVar1 = *(undefined1 *)((longlong)param_1 + 0x194); - goto LAB_4; - } - uVar2 = UxTlGetDscpTag((longlong)param_1,(undefined1 *)param_3); - } - goto LAB_5; + uVar1 = UxTlGetDscpTag((longlong)param_1,(undefined1 *)param_3); + } + goto LAB_4; + } + uVar6 = 0xc00000bb; + goto LAB_1; } if (param_2 == 0x24) { - uVar2 = UxTlGetTcpFastOpen((longlong)param_1); - uVar7 = (ulonglong)uVar2; - if ((int)uVar2 < 0) goto LAB_1; - uVar1 = *(undefined1 *)((longlong)param_1 + 0x191); -LAB_4: - *(undefined1 *)param_3 = uVar1; + uVar1 = UxTlGetTcpFastOpen((longlong)param_1); + uVar6 = (ulonglong)uVar1; + if (-1 < (int)uVar1) { + *(undefined1 *)param_3 = *(undefined1 *)((longlong)param_1 + 0x191); + } goto LAB_1; } if ((int)param_2 < 0x12) { if (param_2 != 0x11) { if ((int)param_2 < 7) { if (param_2 != 6) { if (param_2 == 0) { if (param_3 != (ulonglong *)0x0) { - uVar5 = *(ulonglong *)((longlong)param_1 + 0x9c); + uVar4 = *(ulonglong *)((longlong)param_1 + 0x9c); *param_3 = *(ulonglong *)((longlong)param_1 + 0x94); - param_3[1] = uVar5; + param_3[1] = uVar4; param_3[2] = *(ulonglong *)((longlong)param_1 + 0xa4); *(undefined4 *)(param_3 + 3) = *(undefined4 *)((longlong)param_1 + 0xac); } if (param_4 != (ulonglong *)0x0) { - uVar5 = param_1[0x17]; + uVar4 = param_1[0x17]; *param_4 = param_1[0x16]; - param_4[1] = uVar5; + param_4[1] = uVar4; param_4[2] = param_1[0x18]; *(int *)(param_4 + 3) = (int)param_1[0x19]; } goto LAB_1; } if (param_2 == 1) { - piVar6 = (int *)(param_1[0x1a] + 8); + piVar5 = (int *)(param_1[0x1a] + 8); LOCK(); - iVar3 = *piVar6; - *piVar6 = *piVar6 + 1; + iVar2 = *piVar5; + *piVar5 = *piVar5 + 1; UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (iVar3 + 1 < 0)) { + if ((UxDebugCheckRefcount != '\0') && (iVar2 + 1 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar6,10,(longlong)(iVar3 + 1)); - } - uVar5 = param_1[0x1a]; + UlBugCheckEx(3,piVar5,10,(longlong)(iVar2 + 1)); + } + uVar4 = param_1[0x1a]; } else if (param_2 == 2) { - uVar7 = 0; + uVar6 = 0; if (param_1[0x41] == 0) { - uVar2 = UlAiGetAddressInformation - ((short *)((longlong)param_1 + 0x94),&local_res8,(short *)puVar8, - puVar9); - uVar7 = (ulonglong)uVar2; - if ((int)uVar2 < 0) goto LAB_1; + uVar1 = UlAiGetAddressInformation + ((short *)((longlong)param_1 + 0x94),&local_res8,(short *)puVar7, + puVar8); + uVar6 = (ulonglong)uVar1; + if ((int)uVar1 < 0) goto LAB_1; LOCK(); - bVar10 = param_1[0x41] == 0; - if (bVar10) { + bVar9 = param_1[0x41] == 0; + if (bVar9) { param_1[0x41] = local_res8; } UNLOCK(); - if (!bVar10) { - piVar6 = (int *)(local_res8 + 0x10); + if (!bVar9) { + piVar5 = (int *)(local_res8 + 0x10); LOCK(); - iVar3 = *piVar6; - *piVar6 = *piVar6 + -1; + iVar2 = *piVar5; + *piVar5 = *piVar5 + -1; UNLOCK(); - iVar3 = iVar3 + -1; - if ((UxDebugCheckRefcount != '\0') && (iVar3 < 0)) { + iVar2 = iVar2 + -1; + if ((UxDebugCheckRefcount != '\0') && (iVar2 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar6,10,(longlong)iVar3); + UlBugCheckEx(3,piVar5,10,(longlong)iVar2); } - if (iVar3 == 0) { + if (iVar2 == 0) { UlAiFreeAddressInformation - (local_res8,(undefined *)piVar6,(ulonglong)puVar8,puVar9); + (local_res8,(undefined *)piVar5,(ulonglong)puVar7,puVar8); } } } - uVar5 = param_1[0x41]; + uVar4 = param_1[0x41]; } else { if (param_2 == 3) { - uVar5 = param_1[0x34]; + uVar4 = param_1[0x34]; *param_3 = param_1[0x33]; - param_3[1] = uVar5; + param_3[1] = uVar4; goto LAB_1; } if (param_2 == 4) { - uVar5 = UlEtIsConnectionEdgeTraversed((longlong)param_1,(uint *)param_3); - uVar7 = uVar5 & 0xffffffff; - if (((int)uVar5 < 0) && ((DAT_6 & 0x40) != 0)) { - WPP_SF_id(0x17,&WPP_9c9c85f07d5d334c19286e9ec3ffb0db_Traceguids,param_1,(int)uVar5); + uVar4 = UlEtIsConnectionEdgeTraversed((longlong)param_1,(uint *)param_3); + uVar6 = uVar4 & 0xffffffff; + if (((int)uVar4 < 0) && ((DAT_5 & 0x40) != 0)) { + WPP_SF_id(0x17,&WPP_90f0d61f998b399b863c98e974e69a96_Traceguids,param_1,(int)uVar4); } goto LAB_1; } if (param_2 != 5) goto LAB_2; - uVar5 = param_1[0x3c]; - uVar7 = 0; - } - *param_3 = uVar5; + uVar4 = param_1[0x3c]; + uVar6 = 0; + } + *param_3 = uVar4; goto LAB_1; } goto LAB_3; } if (param_2 == 7) { - uVar2 = UxTlQosSetFlowOnConnection((longlong)param_1,(longlong)param_3); - goto LAB_5; + uVar1 = UxTlQosSetFlowOnConnection((longlong)param_1,(longlong)param_3); + goto LAB_4; } if (param_2 == 10) { *(undefined1 *)param_3 = 0; *(undefined4 *)param_4 = 0; goto LAB_1; } if (param_2 == 0xb) { *(undefined4 *)param_3 = 0; goto LAB_1; } if (param_2 == 0xc) { - bVar10 = UxKirHttpBugFix25Q1 != '\0'; + bVar9 = UxKirHttpBugFix25Q1 != '\0'; *param_3 = 0; - if (bVar10) { + if (bVar9) { *param_4 = 0; } goto LAB_1; } if (param_2 == 0xd) goto LAB_1; if (param_2 != 0x10) goto LAB_2; } } else if ((int)param_2 < 0x1a) { if (param_2 == 0x19) { *param_3 = *(ulonglong *)(param_1[0x1a] + 200); - uVar5 = *(ulonglong *)(param_1[0x1a] + 0xc0); - UxPodReferenceSilo(uVar5,0x43546c55,0xf); - *param_4 = uVar5; + uVar4 = *(ulonglong *)(param_1[0x1a] + 0xc0); + UxPodReferenceSilo(uVar4,0x43546c55,0xf); + *param_4 = uVar4; goto LAB_1; } if (param_2 != 0x12) { if (param_2 == 0x13) { *param_3 = 0; param_3[1] = 0; param_3[2] = 0; param_3[3] = 0; goto LAB_1; } if ((param_2 == 0x15) || (param_2 == 0x16)) goto LAB_3; if (param_2 == 0x17) { - uVar2 = UxTlSetAggressiveIcw((longlong)param_1); + uVar1 = UxTlSetAggressiveIcw((longlong)param_1); } else { if (param_2 != 0x18) goto LAB_2; - uVar2 = UxTlSetIsbPrecision((longlong)param_1,(int)param_3); - } - goto LAB_5; + uVar1 = UxTlSetIsbPrecision((longlong)param_1,(int)param_3); + } + goto LAB_4; } } else { if (((param_2 == 0x1a) || (param_2 == 0x1b)) || (param_2 == 0x1c)) { - uVar2 = UxTlGetTcpInfo((longlong)param_1,param_2,param_3,param_4); -LAB_5: - uVar7 = (ulonglong)uVar2; + uVar1 = UxTlGetTcpInfo((longlong)param_1,param_2,param_3,param_4); +LAB_4: + uVar6 = (ulonglong)uVar1; goto LAB_1; } if (param_2 == 0x1e) { if (*param_3 == 0) { *param_3 = param_1[0x43]; } if (param_3[1] == 0) { param_3[1] = param_1[0x44]; } goto LAB_1; } if (param_2 == 0x1f) goto LAB_1; if (param_2 != 0x20) goto LAB_2; if (UxExtendedEventsEnabled != '\0') { - uVar5 = param_1[0x46]; + uVar4 = param_1[0x46]; *param_3 = param_1[0x45]; - param_3[1] = uVar5; - uVar5 = param_1[0x48]; + param_3[1] = uVar4; + uVar4 = param_1[0x48]; param_3[2] = param_1[0x47]; - param_3[3] = uVar5; - uVar5 = param_1[0x4a]; + param_3[3] = uVar4; + uVar4 = param_1[0x4a]; param_3[4] = param_1[0x49]; - param_3[5] = uVar5; - uVar5 = param_1[0x4c]; + param_3[5] = uVar4; + uVar4 = param_1[0x4c]; param_3[6] = param_1[0x4b]; - param_3[7] = uVar5; - uVar5 = param_1[0x4e]; + param_3[7] = uVar4; + uVar4 = param_1[0x4e]; param_3[8] = param_1[0x4d]; - param_3[9] = uVar5; - uVar5 = param_1[0x50]; + param_3[9] = uVar4; + uVar4 = param_1[0x50]; param_3[10] = param_1[0x4f]; - param_3[0xb] = uVar5; - goto LAB_1; - } - } - uVar7 = 0xc000000d; + param_3[0xb] = uVar4; + goto LAB_1; + } + } + uVar6 = 0xc000000d; LAB_1: if ((DAT_0 & 0x40) != 0) { - WPP_SF_L(0x18,&WPP_9c9c85f07d5d334c19286e9ec3ffb0db_Traceguids,(int)uVar7); - } - return uVar7; + WPP_SF_L(0x18,&WPP_90f0d61f998b399b863c98e974e69a96_Traceguids,(int)uVar6); + } + return uVar6; } ``` ## UlQueryRequestFastIo ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.98| |i_ratio|0.64| |m_ratio|1.0| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlQueryRequestFastIo|UlQueryRequestFastIo| |fullname|UlQueryRequestFastIo|UlQueryRequestFastIo| |refcount|3|3| |`length`|786|777| |called|
Expand for full list:
NTOSKRNL.EXE::IoIs32bitProcess
UlQueryRequestProperty
UxCaptureUserMemory
UxQuicGetStatsV2MinimumSize
UxQuicGetStreamStatsMinimumSize
UxTryCopyUserMemory
UxTryProbeForWrite
WPP_SF_qil
WPP_SF_qqLqLql
__security_check_cookie
memset
|
Expand for full list:
NTOSKRNL.EXE::IoIs32bitProcess
UlQueryRequestProperty
UxCaptureUserMemory
UxQuicGetStatsV2MinimumSize
UxQuicGetStreamStatsMinimumSize
UxTryCopyUserMemory
UxTryProbeForWrite
WPP_SF_qil
WPP_SF_qqLqLql
__security_check_cookie
memset
| |calling||| |paramcount|7|7| |`address`|1400bb330|1400bba00| |sig|undefined1 __fastcall UlQueryRequestFastIo(longlong param_1, void * param_2, int param_3, undefined8 * * * * * param_4, uint param_5, uint * param_6, char param_7)|undefined1 __fastcall UlQueryRequestFastIo(longlong param_1, void * param_2, int param_3, undefined8 * * * * * param_4, uint param_5, uint * param_6, char param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlQueryRequestFastIo Diff ```diff --- UlQueryRequestFastIo +++ UlQueryRequestFastIo @@ -1,164 +1,164 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined1 UlQueryRequestFastIo (longlong param_1,void *param_2,int param_3,undefined8 *****param_4,uint param_5, uint *param_6,char param_7) { char cVar1; uint uVar2; undefined8 uVar3; undefined8 *****pppppuVar4; uint uVar5; uint uVar6; bool bVar7; bool bVar8; undefined1 auStackY_378 [32]; undefined1 local_328; uint local_324; longlong local_320; undefined8 ****local_318; undefined8 ****local_310; undefined8 uStack_308; undefined8 local_300; undefined8 ****local_2f8 [86]; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_378; local_324 = 0; local_318 = (undefined8 ****)0x0; uVar5 = 0x2a8; local_328 = 1; local_300 = 0; local_310 = (undefined8 ****)0x0; uStack_308 = 0; local_320 = param_1; memset(local_2f8,0,0x2a8); if ((DAT_0 & 1) != 0) { - WPP_SF_qqLqLql(0x15,&WPP_b4d4442ef33f389e6257e4bcc469d66c_Traceguids,local_320,param_2); + WPP_SF_qqLqLql(0x15,&WPP_ac205c1ce0c030cbc4c86aa2ba746ce0_Traceguids,local_320,param_2); } param_6[0] = 0; param_6[1] = 0; param_6[2] = 0; param_6[3] = 0; if ((param_2 == (void *)0x0) || (param_3 != 0x18)) { uVar2 = 0xc000000d; goto LAB_1; } cVar1 = IoIs32bitProcess(0); uVar3 = UxCaptureUserMemory(param_2,0x18,(-(uint)(cVar1 != '\0') & 0xfffffffc) + 8,param_7, &local_310); uVar2 = (uint)uVar3; if ((int)uVar2 < 0) goto LAB_1; IoIs32bitProcess(0); uVar3 = UxTryProbeForWrite((ulonglong)param_4,(ulonglong)param_5,1,param_7); uVar2 = (uint)uVar3; if ((int)uVar2 < 0) goto LAB_1; if ((int)uStack_308 < 8) { if ((int)uStack_308 == 7) { uVar5 = 0x180; goto LAB_2; } if ((int)uStack_308 != 0) { if ((int)uStack_308 == 1) { uVar5 = 0x58; } else if ((int)uStack_308 == 2) { uVar5 = 200; } else if ((int)uStack_308 == 3) { uVar5 = 0x88; } else if ((int)uStack_308 == 4) { uVar5 = 0x204; } else { if ((int)uStack_308 != 6) goto LAB_3; uVar5 = 0x60; } goto LAB_2; } pppppuVar4 = &local_318; uVar6 = 8; } else { if ((int)uStack_308 == 8) { uVar5 = 0xd0; } else if ((int)uStack_308 == 9) { uVar5 = 0x40; } else if ((int)uStack_308 == 10) { uVar5 = 0x98; } else { pppppuVar4 = param_4; uVar6 = param_5; if ((int)uStack_308 == 0xb) goto LAB_4; - if (((int)uStack_308 != 0xe) || (UxKirSeHttpQueryCryptoParams == '\0')) { + if ((int)uStack_308 != 0xe) { LAB_3: local_328 = 0; goto LAB_1; } } LAB_2: pppppuVar4 = local_2f8; uVar6 = uVar5; } LAB_4: uVar2 = UlQueryRequestProperty(local_320,&local_310,1,pppppuVar4,uVar6,&local_324); if ((int)uVar2 < 0) goto LAB_1; if ((int)uStack_308 == 8) { if (0xbb < param_5) { uVar2 = 0; if (param_5 < local_324) { uVar2 = UxQuicGetStatsV2MinimumSize(param_5,&local_324); if ((int)uVar2 < 0) goto LAB_1; if (0xbb < local_324) { bVar7 = local_324 < 0xd0; bVar8 = local_324 == 0xd0; LAB_5: if (bVar7 || bVar8) goto LAB_6; } LAB_7: uVar2 = 0xc00000e5; goto LAB_1; } goto LAB_8; } } else { if ((int)uStack_308 == 9) { if (param_5 < 0x40) goto LAB_9; if (param_5 < local_324) { uVar2 = UxQuicGetStreamStatsMinimumSize(param_5,&local_324); if ((int)uVar2 < 0) goto LAB_1; bVar7 = local_324 < 0x40; bVar8 = local_324 == 0x40; if (!bVar7) goto LAB_5; goto LAB_7; } LAB_6: uVar2 = 0; } LAB_8: if (pppppuVar4 == param_4) goto LAB_1; if (local_324 <= param_5) { uVar3 = UxTryCopyUserMemory(param_4,pppppuVar4,(ulonglong)local_324); uVar2 = (uint)uVar3; goto LAB_1; } } LAB_9: uVar2 = 0xc0000023; LAB_1: *(ulonglong *)(param_6 + 2) = (ulonglong)local_324; *param_6 = uVar2; if ((DAT_0 & 1) != 0) { - WPP_SF_qil(0x16,&WPP_b4d4442ef33f389e6257e4bcc469d66c_Traceguids,param_4,param_6); + WPP_SF_qil(0x16,&WPP_ac205c1ce0c030cbc4c86aa2ba746ce0_Traceguids,param_4,param_6); } return local_328; } ``` ## UlQueryRequestProperty ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.2| |i_ratio|0.47| |m_ratio|1.0| |b_ratio|0.53| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlQueryRequestProperty|UlQueryRequestProperty| |fullname|UlQueryRequestProperty|UlQueryRequestProperty| |refcount|3|3| |`length`|2884|2858| |called|
Expand for full list:
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeGetCurrentIrql
UlBugCheckEx
UlFreeHttpConnection
UlGetConnectionFromId
UlGetConsumer
UlGetRequestFromId
UlThreadPoolEnqueueWorkItem
UlpQueueFreeHttpRequest
UxDuoFreeConnection
UxGetObjectFromOpaqueIdUxPodAttachThread
UxPodDetachThread
UxQuicConnectionGetStatsV1
UxQuicConnectionGetStatsV2
UxQuicFreeConnection
UxQuicGetStatsV2MinimumSize
UxQuicGetStreamStatsMinimumSize
WPP_SF_L
WPP_SF_qDL
WPP_SF_qLqqqq
WPP_SF_qiqLq
__security_check_cookie
_guard_dispatch_icall
memcpy
memset
|
Expand for full list:
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeGetCurrentIrql
UlBugCheckEx
UlFreeHttpConnection
UlGetConnectionFromId
UlGetConsumer
UlGetRequestFromId
UlThreadPoolEnqueueWorkItem
UlpQueueFreeHttpRequest
UxDuoFreeConnection
UxGetObjectFromOpaqueIdUxPodAttachThread
UxPodDetachThread
UxQuicConnectionGetStatsV1
UxQuicConnectionGetStatsV2
UxQuicFreeConnection
UxQuicGetStatsV2MinimumSize
UxQuicGetStreamStatsMinimumSize
WPP_SF_L
WPP_SF_qDL
WPP_SF_qLqqqq
WPP_SF_qiqLq
__security_check_cookie
_guard_dispatch_icall
memcpy
memset
| |calling|UlQueryRequestFastIo
UlQueryRequestIoctl|UlQueryRequestFastIo
UlQueryRequestIoctl| |paramcount|6|6| |`address`|1400c8968|1400c9028| |sig|uint __fastcall UlQueryRequestProperty(longlong param_1, undefined8 * * * * * param_2, int param_3, undefined8 * * * * * param_4, uint param_5, uint * param_6)|uint __fastcall UlQueryRequestProperty(longlong param_1, undefined8 * * * * * param_2, int param_3, undefined8 * * * * * param_4, uint param_5, uint * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlQueryRequestProperty Diff ```diff --- UlQueryRequestProperty +++ UlQueryRequestProperty @@ -1,507 +1,488 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Type propagation algorithm not settling */ uint UlQueryRequestProperty (longlong param_1,undefined8 *****param_2,int param_3,undefined8 *****param_4, uint param_5,uint *param_6) { undefined8 *****pppppuVar1; - longlong *plVar2; - int *piVar3; + int *piVar2; + longlong *plVar3; undefined8 ****ppppuVar4; uint uVar5; char cVar6; uint uVar7; int iVar8; - undefined *puVar9; - undefined *puVar10; + longlong lVar9; + longlong lVar10; longlong lVar11; - longlong lVar12; - undefined8 ******ppppppuVar13; - undefined4 uVar14; - undefined8 *****pppppuVar15; - uint uVar16; - undefined8 *****pppppuVar17; - uint **ppuVar18; - code *pcVar19; + undefined8 ******ppppppuVar12; + undefined **ppuVar13; + undefined8 *****pppppuVar14; + undefined4 uVar15; + undefined8 *****pppppuVar16; + uint uVar17; + int iVar18; + uint **ppuVar19; code *pcVar20; - undefined *puVar21; - bool bVar22; - bool bVar23; + undefined8 *****pppppuVar21; + code *pcVar22; undefined1 auStackY_198 [32]; - uint local_158 [2]; - undefined *local_150; + undefined8 ****local_158; + longlong local_150; uint *local_148; uint *local_140; - undefined8 *****local_138; + undefined *local_138; undefined8 uStack_130; undefined8 *****local_128; undefined8 uStack_120; undefined8 ****local_118 [26]; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_198; - puVar9 = (undefined *)0x0; - pppppuVar15 = (undefined8 *****)(ulonglong)param_5; + pppppuVar16 = (undefined8 *****)(ulonglong)param_5; local_148 = param_6; local_140 = (uint *)0x0; - local_138 = (undefined8 *****)0x0; - local_150 = (undefined *)0x0; - puVar21 = (undefined *)0x0; - pppppuVar17 = param_4; + local_138 = (undefined *)0x0; + local_150 = 0; + pppppuVar21 = param_4; memset(local_118,0,0xd0); - local_158[0] = 0; + local_158._0_4_ = 0; if ((DAT_0 & 1) != 0) { - pppppuVar17 = param_2; - WPP_SF_qiqLq(0x8c,&WPP_093d4d9875f132d387d0435491be4d4d_Traceguids,param_1,param_2); + pppppuVar21 = param_2; + WPP_SF_qiqLq(0x8c,&WPP_3217c3b7128b385d96320719b5abbc38_Traceguids,param_1,param_2); } *param_6 = 0; - ppuVar18 = &local_140; - uVar7 = UlGetConsumer(param_1,1,(longlong *)ppuVar18); + ppuVar19 = &local_140; + uVar7 = UlGetConsumer(param_1,1,(longlong *)ppuVar19); if ((int)uVar7 < 0) goto LAB_1; local_128 = (undefined8 *****) - UlGetRequestFromId((ulonglong)*param_2,local_140,ppuVar18,(uint *)pppppuVar17); + UlGetRequestFromId((ulonglong)*param_2,local_140,ppuVar19,(uint *)pppppuVar21); + uVar17 = 8; if (local_128 == (undefined8 *****)0x0) { - pcVar19 = (code *)UlGetConnectionFromId(local_140,(ulonglong)*param_2,0); - local_138 = (undefined8 *****)pcVar19; + if (UxKirHttpBugFix26Q1 == '\0') { +LAB_2: + iVar18 = 0; + } + else { + iVar8 = *(int *)(param_2 + 1); + if (iVar8 < 8) { + if (iVar8 == 7) goto LAB_2; + } + else { + iVar8 = iVar8 + -8; + } + iVar18 = 1; + if ((((iVar8 == 0) || (iVar8 == 1)) || (iVar8 == 2)) || + (((iVar8 == 3 || (iVar8 == 4)) || ((iVar8 == 5 || (iVar8 == 6)))))) goto LAB_2; + } + pcVar20 = (code *)UlGetConnectionFromId(local_140,(ulonglong)*param_2,iVar18); + pppppuVar21 = (undefined8 *****)pcVar20; } else { - pcVar19 = (code *)local_128[3]; + pcVar20 = (code *)local_128[3]; + pppppuVar21 = (undefined8 *****)0x0; } uVar7 = *(uint *)(param_2 + 1); - pcVar20 = (code *)0xa; - puVar10 = puVar9; - if (((10 < uVar7) || ((0x50eU >> (uVar7 & 0x1f) & 1) == 0)) && - ((undefined8 *****)pcVar19 == (undefined8 *****)0x0)) { + pcVar22 = (code *)0xa; + if (((uVar7 < 0xb) && ((0x50eU >> (uVar7 & 0x1f) & 1) != 0)) || + ((undefined8 *****)pcVar20 != (undefined8 *****)0x0)) { + lVar9 = local_150; + if ((int)uVar7 < 8) { + if (uVar7 == 7) { + if ((param_4 != (undefined8 *****)0x0) && (uVar17 = 0x180, 0x17f < param_5)) { + uVar15 = 0x21; + goto LAB_3; + } + } + else if (uVar7 == 0) { + if ((param_4 != (undefined8 *****)0x0) && (7 < param_5)) { + uVar7 = 0; + *param_4 = (undefined8 ****)(ulonglong)*(uint *)((longlong)pcVar20 + 0x3e0); + uVar5 = uVar17; +LAB_4: + local_158._0_4_ = uVar5; + *local_148 = uVar17; + lVar9 = local_150; + goto LAB_5; + } + } + else { + if (uVar7 == 1) { +LAB_6: + if (uVar7 == 1) { + uVar15 = 0x1a; + uVar17 = 0x58; + } + else { + if (uVar7 != 3) goto LAB_7; + uVar15 = 0x1b; + uVar17 = 0x88; + } + goto LAB_8; + } + if (uVar7 == 2) { + if (param_4 != (undefined8 *****)0x0) { + uVar17 = 200; + if (199 < param_5) { + if ((undefined8 *****)pcVar20 != (undefined8 *****)0x0) { + pppppuVar16 = param_2 + 2; + uVar15 = 0x30; + pcVar22 = (code *)param_4; + if ((DAT_9 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, + (undefined8 *****)((longlong)pcVar20 + 0x1f0),0x30); + } + goto LAB_10; + } + pcVar22 = UlValidateSucceed; + pcVar20 = UxDuoReferenceConnectionFromId; + lVar9 = UxGetObjectFromOpaqueId + ((ulonglong)*param_2,(undefined *)0x6,UxDuoReferenceConnectionFromId + ,UlValidateSucceed,0); + if (lVar9 == 0) goto LAB_11; + pcVar20 = (code *)param_4; + local_150 = lVar9; + uVar7 = UxQuicConnectionGetStatsV1(lVar9,(ulonglong *)(param_2 + 2),param_4); + uVar17 = 200; + goto joined_r0x0001400c933c; + } + } + } + else { + if (uVar7 == 3) goto LAB_6; + if (uVar7 == 4) { + if ((param_4 != (undefined8 *****)0x0) && (uVar17 = 0x204, 0x203 < param_5)) { + uVar15 = 0x35; +LAB_3: + if ((DAT_9 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, + (undefined8 *****)((longlong)pcVar20 + 0x1f0),uVar15); + } + pppppuVar16 = param_4; + pcVar22 = (code *)(undefined8 *****)0x0; +LAB_10: + lVar9 = 0; + uVar7 = (*(code *)(*(undefined8 *****)((longlong)pcVar20 + 0x1f8))[0x11]) + (*(undefined8 *****)((longlong)pcVar20 + 0x1f0),uVar15); + pcVar20 = (code *)pppppuVar16; + if ((DAT_9 & 1) != 0) { + pcVar20 = (code *)(ulonglong)uVar7; + WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); + } + goto joined_r0x0001400c933c; + } + } + else { + if (uVar7 != 6) goto LAB_12; + if ((param_4 != (undefined8 *****)0x0) && (uVar17 = 0x60, 0x5f < param_5)) { + uVar15 = 0x20; + goto LAB_3; + } + } + } + } +LAB_13: + uVar7 = 0xc0000023; + lVar9 = 0; + } + else if (uVar7 == 8) { + if ((param_4 == (undefined8 *****)0x0) || (param_5 < 0xbc)) goto LAB_14; + if ((undefined8 *****)pcVar20 == (undefined8 *****)0x0) { + pcVar22 = UlValidateSucceed; + pcVar20 = UxDuoReferenceConnectionFromId; + lVar9 = UxGetObjectFromOpaqueId + ((ulonglong)*param_2,(undefined *)0x6,UxDuoReferenceConnectionFromId, + UlValidateSucceed,0); + if (lVar9 == 0) { +LAB_11: + uVar7 = 0xc000023a; + local_150 = lVar9; + goto LAB_5; + } + pcVar22 = (code *)&local_158; + pcVar20 = (code *)local_118; + local_150 = lVar9; + uVar7 = UxQuicConnectionGetStatsV2(lVar9,(ulonglong *)(param_2 + 2),pcVar20,(uint *)pcVar22) + ; + } + else { + pppppuVar16 = param_2 + 2; + if ((DAT_9 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, + (undefined8 *****)((longlong)pcVar20 + 0x1f0),0x43); + } + pcVar22 = (code *)local_118; + uVar7 = (*(code *)(*(undefined8 *****)((longlong)pcVar20 + 0x1f8))[0x11]) + (*(undefined8 *****)((longlong)pcVar20 + 0x1f0),0x43); + pcVar20 = (code *)pppppuVar16; + lVar9 = local_150; + if ((DAT_9 & 1) != 0) { + pcVar20 = (code *)(ulonglong)uVar7; + WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); + lVar9 = local_150; + } + } + if (-1 < (int)uVar7) { + pppppuVar16 = (undefined8 *****)(ulonglong)(uint)local_158; + if ((uint)local_158 <= param_5) { +LAB_15: + uVar17 = (uint)pppppuVar16; + memcpy(param_4,local_118,(size_t)pppppuVar16); + pcVar20 = (code *)pppppuVar16; + uVar5 = (uint)local_158; + goto LAB_4; + } + uVar7 = UxQuicGetStatsV2MinimumSize(param_5,(undefined4 *)&local_158); + if (-1 < (int)uVar7) { + pppppuVar16 = (undefined8 *****)(ulonglong)(uint)local_158; + if (((0xbb < (uint)local_158) && ((uint)local_158 < 0xd1)) && ((uint)local_158 <= param_5) + ) { + uVar7 = 0; + goto LAB_15; + } + uVar7 = 0xc00000e5; + } + } + } + else { + if (uVar7 == 9) { + lVar9 = 0; + if ((param_4 == (undefined8 *****)0x0) || (param_5 < 0x40)) goto LAB_13; + pppppuVar16 = (undefined8 *****)((longlong)pcVar20 + 0x1f0); + if ((DAT_9 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,pppppuVar16,0x44); + } + pppppuVar14 = (undefined8 *****)((longlong)pcVar20 + 0x1f8); + pcVar22 = (code *)&local_158; + pcVar20 = (code *)local_118; + uVar7 = (*(code *)(*pppppuVar14)[0x11])(*pppppuVar16,0x44); + if ((DAT_9 & 1) != 0) { + pcVar20 = (code *)(ulonglong)uVar7; + WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); + } + if (-1 < (int)uVar7) { + pppppuVar16 = (undefined8 *****)(ulonglong)(uint)local_158; + if ((uint)local_158 <= param_5) goto LAB_15; + uVar7 = UxQuicGetStreamStatsMinimumSize(param_5,(undefined4 *)&local_158); + if (-1 < (int)uVar7) { + pppppuVar16 = (undefined8 *****)(ulonglong)(uint)local_158; + if (((0x3f < (uint)local_158) && ((uint)local_158 < 0x41)) && + (uVar7 = 0, (uint)local_158 <= param_5)) goto LAB_15; + uVar7 = 0xc00000e5; + } + } + goto LAB_5; + } + if (uVar7 != 10) { + if (uVar7 == 0xb) { + if (param_3 == 0) { +LAB_16: + uVar7 = 0xc0000002; + goto LAB_5; + } + uVar15 = 0x45; + } + else { + if (uVar7 != 0xe) { +LAB_12: + uVar7 = 0xc000000d; + goto LAB_5; + } + if (param_3 == 0) goto LAB_16; + uVar15 = 0x46; + } + pppppuVar14 = (undefined8 *****)((longlong)pcVar20 + 0x1f0); + if ((DAT_9 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,pppppuVar14,uVar15); + } + pppppuVar1 = (undefined8 *****)((longlong)pcVar20 + 0x1f8); + pcVar20 = (code *)param_4; + uVar7 = (*(code *)(*pppppuVar1)[0x11])(*pppppuVar14,uVar15); + pcVar22 = (code *)pppppuVar16; + lVar9 = local_150; + if ((DAT_9 & 1) != 0) { + pcVar20 = (code *)(ulonglong)uVar7; + WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); + pcVar22 = (code *)pppppuVar16; + lVar9 = local_150; + } + goto LAB_5; + } +LAB_7: + uVar15 = 0x1c; + uVar17 = 0x98; +LAB_8: + if ((param_4 == (undefined8 *****)0x0) || (param_5 < uVar17)) { +LAB_14: + uVar7 = 0xc0000023; + } + else { + if ((undefined8 *****)pcVar20 == (undefined8 *****)0x0) { + pcVar22 = UlValidateSucceed; + pcVar20 = UxDuoReferenceConnectionFromId; + local_138 = (undefined *) + UxGetObjectFromOpaqueId + ((ulonglong)*param_2,&DAT_17,UxDuoReferenceConnectionFromId, + UlValidateSucceed,0); + if (local_138 == (undefined *)0x0) goto LAB_18; + pppppuVar16 = (undefined8 *****)(local_138 + 8); + } + else { + pppppuVar16 = (undefined8 *****)((longlong)pcVar20 + 0x1f0); + } + if ((DAT_9 & 1) != 0) { + WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,pppppuVar16,uVar15); + } + pcVar20 = (code *)(param_2 + 2); + pcVar22 = (code *)param_4; + uVar7 = (*(code *)pppppuVar16[1][0x11])(*pppppuVar16,uVar15); + lVar9 = local_150; + if ((DAT_9 & 1) != 0) { + pcVar20 = (code *)(ulonglong)uVar7; + WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); + lVar9 = local_150; + } +joined_r0x0001400c933c: + uVar5 = uVar17; + if (-1 < (int)uVar7) goto LAB_4; + } + } + } + else { +LAB_18: uVar7 = 0xc000023a; - puVar21 = puVar9; - goto LAB_2; - } - if ((int)uVar7 < 8) { - if (uVar7 == 7) { - if ((param_4 != (undefined8 *****)0x0) && (uVar16 = 0x180, 0x17f < param_5)) { - uVar14 = 0x21; - goto LAB_3; - } - } - else if (uVar7 == 0) { - if ((param_4 != (undefined8 *****)0x0) && (uVar16 = 8, 7 < param_5)) { - uVar7 = 0; - *param_4 = (undefined8 ****)(ulonglong)*(uint *)((longlong)pcVar19 + 0x3e0); - puVar9 = puVar21; - uVar5 = uVar16; -LAB_4: - local_158[0] = uVar5; - *local_148 = uVar16; - puVar10 = local_150; - puVar21 = puVar9; - goto LAB_2; - } - } - else { - if (uVar7 == 1) { + lVar9 = local_150; + } LAB_5: - if (uVar7 == 1) { - uVar14 = 0x1a; - uVar16 = 0x58; - } - else { - if (uVar7 != 3) goto LAB_6; - uVar14 = 0x1b; - uVar16 = 0x88; - } - goto LAB_7; - } - if (uVar7 == 2) { - if (param_4 != (undefined8 *****)0x0) { - uVar16 = 200; - if (199 < param_5) { - if ((undefined8 *****)pcVar19 != (undefined8 *****)0x0) { - pppppuVar17 = param_2 + 2; - uVar14 = 0x30; - pcVar20 = (code *)param_4; - uVar16 = 200; - if ((DAT_8 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, - (undefined8 *****)((longlong)pcVar19 + 0x1f0),0x30); - } - goto LAB_9; - } - pcVar20 = UlValidateSucceed; - pcVar19 = UxDuoReferenceConnectionFromId; - puVar9 = (undefined *) - UxGetObjectFromOpaqueId - ((ulonglong)*param_2,(undefined *)0x6,UxDuoReferenceConnectionFromId, - UlValidateSucceed,0); - if (puVar9 == (undefined *)0x0) goto LAB_10; - pcVar19 = (code *)param_4; - uVar7 = UxQuicConnectionGetStatsV1((longlong)puVar9,(ulonglong *)(param_2 + 2),param_4); -LAB_11: - puVar10 = (undefined *)0x0; - puVar21 = puVar9; - uVar5 = uVar16; - if ((int)uVar7 < 0) goto LAB_2; - goto LAB_4; - } - } - } - else { - if (uVar7 == 3) goto LAB_5; - if (uVar7 == 4) { - if ((param_4 != (undefined8 *****)0x0) && (uVar16 = 0x204, 0x203 < param_5)) { - uVar14 = 0x35; -LAB_3: - if ((DAT_8 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, - (undefined8 *****)((longlong)pcVar19 + 0x1f0),uVar14); - } - pcVar20 = (code *)0x0; - pppppuVar17 = param_4; -LAB_9: - uVar7 = (*(code *)(*(undefined8 *****)((longlong)pcVar19 + 0x1f8))[0x11]) - (*(undefined8 *****)((longlong)pcVar19 + 0x1f0),uVar14); - pcVar19 = (code *)pppppuVar17; - if ((DAT_8 & 1) != 0) { - pcVar19 = (code *)(ulonglong)uVar7; - WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); - } - goto LAB_11; - } - } - else { - if (uVar7 != 6) goto LAB_12; - if ((param_4 != (undefined8 *****)0x0) && (uVar16 = 0x60, 0x5f < param_5)) { - uVar14 = 0x20; - goto LAB_3; - } - } - } - } -LAB_13: - uVar7 = 0xc0000023; - puVar10 = (undefined *)0x0; - } - else { - if (uVar7 == 8) { - if ((param_4 != (undefined8 *****)0x0) && (0xbb < param_5)) { - if ((undefined8 *****)pcVar19 == (undefined8 *****)0x0) { - pcVar20 = UlValidateSucceed; - pcVar19 = UxDuoReferenceConnectionFromId; - puVar9 = (undefined *) - UxGetObjectFromOpaqueId - ((ulonglong)*param_2,(undefined *)0x6,UxDuoReferenceConnectionFromId, - UlValidateSucceed,0); - if (puVar9 == (undefined *)0x0) { -LAB_10: - uVar7 = 0xc000023a; - puVar10 = (undefined *)0x0; - puVar21 = puVar9; - goto LAB_2; - } - pcVar20 = (code *)local_158; - pcVar19 = (code *)local_118; - uVar7 = UxQuicConnectionGetStatsV2 - ((longlong)puVar9,(ulonglong *)(param_2 + 2),pcVar19,(uint *)pcVar20); - } - else { - pppppuVar17 = param_2 + 2; - if ((DAT_8 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, - (undefined8 *****)((longlong)pcVar19 + 0x1f0),0x43); - } - pcVar20 = (code *)local_118; - uVar7 = (*(code *)(*(undefined8 *****)((longlong)pcVar19 + 0x1f8))[0x11]) - (*(undefined8 *****)((longlong)pcVar19 + 0x1f0),0x43); - pcVar19 = (code *)pppppuVar17; - if ((DAT_8 & 1) != 0) { - pcVar19 = (code *)(ulonglong)uVar7; - WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); - } - } - puVar10 = (undefined *)0x0; - puVar21 = puVar9; - if (-1 < (int)uVar7) { - pppppuVar17 = (undefined8 *****)(ulonglong)local_158[0]; - if (local_158[0] <= param_5) { -LAB_14: - uVar16 = (uint)pppppuVar17; - memcpy(param_4,local_118,(size_t)pppppuVar17); - pcVar19 = (code *)pppppuVar17; - uVar5 = local_158[0]; - goto LAB_4; - } - uVar7 = UxQuicGetStatsV2MinimumSize(param_5,local_158); - if (-1 < (int)uVar7) { - if (0xbb < local_158[0]) { - bVar22 = local_158[0] < 0xd0; - bVar23 = local_158[0] == 0xd0; -LAB_15: - pppppuVar17 = (undefined8 *****)(ulonglong)local_158[0]; - if ((bVar22 || bVar23) && (local_158[0] <= param_5)) { - uVar7 = 0; - goto LAB_14; - } - } -LAB_16: - uVar7 = 0xc00000e5; - puVar10 = (undefined *)0x0; - puVar21 = puVar9; - } - } - goto LAB_2; - } - goto LAB_13; - } - if (uVar7 == 9) { - if ((param_4 != (undefined8 *****)0x0) && (0x3f < param_5)) { - pppppuVar17 = (undefined8 *****)((longlong)pcVar19 + 0x1f0); - if ((DAT_8 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,pppppuVar17,0x44); - } - pppppuVar15 = (undefined8 *****)((longlong)pcVar19 + 0x1f8); - pcVar20 = (code *)local_158; - pcVar19 = (code *)local_118; - uVar7 = (*(code *)(*pppppuVar15)[0x11])(*pppppuVar17,0x44); - if ((DAT_8 & 1) != 0) { - pcVar19 = (code *)(ulonglong)uVar7; - WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); - } - puVar10 = (undefined *)0x0; - if (-1 < (int)uVar7) { - pppppuVar17 = (undefined8 *****)(ulonglong)local_158[0]; - if (local_158[0] <= param_5) goto LAB_14; - uVar7 = UxQuicGetStreamStatsMinimumSize(param_5,local_158); - puVar10 = (undefined *)0x0; - if (-1 < (int)uVar7) { - bVar22 = local_158[0] < 0x40; - bVar23 = local_158[0] == 0x40; - if (!bVar22) goto LAB_15; - goto LAB_16; - } - } - goto LAB_2; - } - goto LAB_13; - } - if (uVar7 != 10) { - if (uVar7 == 0xb) { - if (param_3 == 0) { -LAB_17: - uVar7 = 0xc0000002; - puVar21 = puVar9; - goto LAB_2; - } - uVar14 = 0x45; - } - else { - if (uVar7 != 0xe) { -LAB_12: - uVar7 = 0xc000000d; - puVar21 = puVar9; - goto LAB_2; - } - if (param_3 == 0) goto LAB_17; - uVar14 = 0x46; - } - pppppuVar17 = (undefined8 *****)((longlong)pcVar19 + 0x1f0); - if ((DAT_8 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,pppppuVar17,uVar14); - } - pppppuVar1 = (undefined8 *****)((longlong)pcVar19 + 0x1f8); - pcVar19 = (code *)param_4; - uVar7 = (*(code *)(*pppppuVar1)[0x11])(*pppppuVar17,uVar14); - pcVar20 = (code *)pppppuVar15; - puVar21 = puVar9; - if ((DAT_8 & 1) != 0) { - pcVar19 = (code *)(ulonglong)uVar7; - WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); - pcVar20 = (code *)pppppuVar15; - } - goto LAB_2; - } -LAB_6: - uVar14 = 0x1c; - uVar16 = 0x98; -LAB_7: - if ((param_4 == (undefined8 *****)0x0) || (param_5 < uVar16)) { - uVar7 = 0xc0000023; - puVar21 = puVar9; - } - else { - if ((undefined8 *****)pcVar19 == (undefined8 *****)0x0) { - pcVar20 = UlValidateSucceed; - pcVar19 = UxDuoReferenceConnectionFromId; - puVar10 = (undefined *) - UxGetObjectFromOpaqueId - ((ulonglong)*param_2,&DAT_18,UxDuoReferenceConnectionFromId, - UlValidateSucceed,0); - local_150 = puVar10; - if (puVar10 == (undefined *)0x0) { - uVar7 = 0xc000023a; - goto LAB_2; - } - pcVar19 = (code *)(param_2 + 2); - if ((DAT_8 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,puVar10 + 8,uVar14); - } - pcVar20 = (code *)param_4; - uVar7 = (**(code **)(*(longlong *)(puVar10 + 0x10) + 0x88)) - (*(undefined8 *)(puVar10 + 8),uVar14); - if ((DAT_8 & 1) != 0) { - pcVar19 = (code *)(ulonglong)uVar7; - WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); - } - } - else { - pppppuVar17 = param_2 + 2; - if ((DAT_8 & 1) != 0) { - WPP_SF_qLqqqq(10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, - (undefined8 *****)((longlong)pcVar19 + 0x1f0),uVar14); - } - pcVar20 = (code *)param_4; - uVar7 = (*(code *)(*(undefined8 *****)((longlong)pcVar19 + 0x1f8))[0x11]) - (*(undefined8 *****)((longlong)pcVar19 + 0x1f0),uVar14); - pcVar19 = (code *)pppppuVar17; - if ((DAT_8 & 1) != 0) { - pcVar19 = (code *)(ulonglong)uVar7; - WPP_SF_L(0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar7); - } - } - puVar9 = (undefined *)0x0; - puVar21 = puVar9; - uVar5 = uVar16; - if (-1 < (int)uVar7) goto LAB_4; - } - } -LAB_2: if (local_128 != (undefined8 *****)0x0) { - pppppuVar17 = local_128 + 6; + pppppuVar16 = local_128 + 6; LOCK(); - iVar8 = *(int *)pppppuVar17; - *(int *)pppppuVar17 = *(int *)pppppuVar17 + -1; + iVar8 = *(int *)pppppuVar16; + *(int *)pppppuVar16 = *(int *)pppppuVar16 + -1; UNLOCK(); iVar8 = iVar8 + -1; if ((UxDebugCheckRefcount != '\0') && (iVar8 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,pppppuVar17,0xb,(longlong)iVar8); + UlBugCheckEx(3,pppppuVar16,0xb,(longlong)iVar8); } if (iVar8 == 0) { UlpQueueFreeHttpRequest - (local_128,(undefined *)pppppuVar17,(undefined8 *****)pcVar19, - (undefined8 *****)pcVar20); - } - } - pppppuVar17 = local_138; - if (local_138 != (undefined8 *****)0x0) { - pppppuVar15 = local_138 + 5; + (local_128,(undefined *)pppppuVar16,(undefined8 *****)pcVar20, + (undefined8 *****)pcVar22); + } + } + if (pppppuVar21 != (undefined8 *****)0x0) { + pppppuVar16 = pppppuVar21 + 5; LOCK(); - iVar8 = *(int *)pppppuVar15; - *(int *)pppppuVar15 = *(int *)pppppuVar15 + -1; + iVar8 = *(int *)pppppuVar16; + *(int *)pppppuVar16 = *(int *)pppppuVar16 + -1; UNLOCK(); iVar8 = iVar8 + -1; if ((UxDebugCheckRefcount != '\0') && (iVar8 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,pppppuVar15,0xb,(longlong)iVar8); + UlBugCheckEx(3,pppppuVar16,0xb,(longlong)iVar8); } if (iVar8 == 0) { - lVar11 = IoGetCurrentProcess(); - pppppuVar15 = pppppuVar17 + 8; - ppppuVar4 = pppppuVar17[0x88]; - if (UxSystemProcess == lVar11) { + lVar10 = IoGetCurrentProcess(); + ppppuVar4 = pppppuVar21[0x88]; + pppppuVar16 = pppppuVar21 + 8; + if (UxSystemProcess == lVar10) { local_128 = (undefined8 *****)0x0; uStack_120 = 0; - if (((*pppppuVar15 != (undefined8 ****)0x0) || (pppppuVar17[10] != (undefined8 ****)0x0)) || - (pppppuVar17[0xc] != (undefined8 ****)0x0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(1,pppppuVar15,"minio\\http\\sys\\httpconn.h",0xe1); + if (((*pppppuVar16 != (undefined8 ****)0x0) || (pppppuVar21[10] != (undefined8 ****)0x0)) || + (pppppuVar21[0xc] != (undefined8 ****)0x0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(1,pppppuVar16,"minio\\http\\sys\\httpconn.h",0xe1); } cVar6 = KeGetCurrentIrql(); if (cVar6 == '\0') { - ppppppuVar13 = &local_128; - UxPodAttachThread((longlong)ppppuVar4,ppppppuVar13); + ppppppuVar12 = &local_128; + UxPodAttachThread((longlong)ppppuVar4,ppppppuVar12); UlFreeHttpConnection - (pppppuVar15,ppppppuVar13,(undefined8 *****)pcVar19,(undefined8 ****)pcVar20); + (pppppuVar16,ppppppuVar12,(undefined8 *****)pcVar20,(undefined8 ****)pcVar22); UxPodDetachThread((char *)&local_128); goto LAB_19; } } - else if (((*pppppuVar15 != (undefined8 ****)0x0) || (pppppuVar17[10] != (undefined8 ****)0x0)) - || (pppppuVar17[0xc] != (undefined8 ****)0x0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(1,pppppuVar15,"minio\\http\\sys\\httpconn.h",0xdb); - } - pcVar19 = UlFreeHttpConnection; - pcVar20 = (code *)CONCAT71((int7)((ulonglong)pcVar20 >> 8),1); + else if (((*pppppuVar16 != (undefined8 ****)0x0) || (pppppuVar21[10] != (undefined8 ****)0x0)) + || (pppppuVar21[0xc] != (undefined8 ****)0x0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(1,pppppuVar16,"minio\\http\\sys\\httpconn.h",0xdb); + } + pcVar20 = UlFreeHttpConnection; + pcVar22 = (code *)CONCAT71((int7)((ulonglong)pcVar22 >> 8),1); UlThreadPoolEnqueueWorkItem - (0,(longlong)pppppuVar15,UlFreeHttpConnection,'\x01',(longlong)ppppuVar4,0xffffffff) + (0,(longlong)pppppuVar16,UlFreeHttpConnection,'\x01',(longlong)ppppuVar4,0xffffffff) ; } } LAB_19: - if (puVar10 != (undefined *)0x0) { - piVar3 = (int *)(puVar10 + 4); + if (local_138 != (undefined *)0x0) { + piVar2 = (int *)(local_138 + 4); LOCK(); - iVar8 = *piVar3; - *piVar3 = *piVar3 + -1; + iVar8 = *piVar2; + *piVar2 = *piVar2 + -1; UNLOCK(); iVar8 = iVar8 + -1; if ((UxDebugCheckRefcount != '\0') && (iVar8 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar3,0xb,(longlong)iVar8); + UlBugCheckEx(3,piVar2,0xb,(longlong)iVar8); } if (iVar8 == 0) { - UxDuoFreeConnection(puVar10,piVar3,(longlong *)pcVar19,pcVar20); + UxDuoFreeConnection(local_138,piVar2,(longlong *)pcVar20,pcVar22); } } param_6 = local_148; - if (puVar21 != (undefined *)0x0) { - piVar3 = (int *)(puVar21 + 4); + if (lVar9 != 0) { + piVar2 = (int *)(lVar9 + 4); LOCK(); - iVar8 = *piVar3; - *piVar3 = *piVar3 + -1; + iVar8 = *piVar2; + *piVar2 = *piVar2 + -1; UNLOCK(); iVar8 = iVar8 + -1; if ((UxDebugCheckRefcount != '\0') && (iVar8 < 0)) { /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,piVar3,0xb,(longlong)iVar8); + UlBugCheckEx(3,piVar2,0xb,(longlong)iVar8); } if (iVar8 == 0) { - lVar12 = IoGetCurrentProcess(); - lVar11 = *(longlong *)(puVar21 + 0xcb0); - plVar2 = (longlong *)(puVar21 + 0x9c0); - if (UxSystemProcess == lVar12) { - local_138 = (undefined8 *****)0x0; + lVar11 = IoGetCurrentProcess(); + lVar10 = *(longlong *)(lVar9 + 0xa10); + plVar3 = (longlong *)(lVar9 + 0x720); + if (UxSystemProcess == lVar11) { + local_138 = (undefined *)0x0; uStack_130 = 0; - if (((*plVar2 != 0) || (*(longlong *)(puVar21 + 0x9d0) != 0)) || - (*(longlong *)(puVar21 + 0x9e0) != 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(1,plVar2,"minio\\http\\sys\\quicconn.h",0x456); + if (((*plVar3 != 0) || (*(longlong *)(lVar9 + 0x730) != 0)) || + (*(longlong *)(lVar9 + 0x740) != 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(1,plVar3,"minio\\http\\sys\\quicconn.h",0x44e); } cVar6 = KeGetCurrentIrql(); if (cVar6 == '\0') { - ppppppuVar13 = &local_138; - UxPodAttachThread(lVar11,ppppppuVar13); - UxQuicFreeConnection((longlong)plVar2,ppppppuVar13,pcVar19,(ulonglong)pcVar20); + ppuVar13 = &local_138; + UxPodAttachThread(lVar10,ppuVar13); + UxQuicFreeConnection((longlong)plVar3,ppuVar13,pcVar20,(ulonglong)pcVar22); UxPodDetachThread((char *)&local_138); param_6 = local_148; goto LAB_1; } } - else if (((*plVar2 != 0) || (*(longlong *)(puVar21 + 0x9d0) != 0)) || - (*(longlong *)(puVar21 + 0x9e0) != 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(1,plVar2,"minio\\http\\sys\\quicconn.h",0x44f); - } - UlThreadPoolEnqueueWorkItem(0,(longlong)plVar2,UxQuicFreeConnection,'\x01',lVar11,0xffffffff); + else if (((*plVar3 != 0) || (*(longlong *)(lVar9 + 0x730) != 0)) || + (*(longlong *)(lVar9 + 0x740) != 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(1,plVar3,"minio\\http\\sys\\quicconn.h",0x447); + } + UlThreadPoolEnqueueWorkItem(0,(longlong)plVar3,UxQuicFreeConnection,'\x01',lVar10,0xffffffff); param_6 = local_148; } } LAB_1: if ((DAT_0 & 1) != 0) { - WPP_SF_qDL(0x8d,&WPP_093d4d9875f132d387d0435491be4d4d_Traceguids,param_4,*param_6); + WPP_SF_qDL(0x8d,&WPP_3217c3b7128b385d96320719b5abbc38_Traceguids,param_4,*param_6); } return uVar7; } ``` ## UlGenerateDateHeader ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.76| |i_ratio|0.51| |m_ratio|0.97| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlGenerateDateHeader|UlGenerateDateHeader| |fullname|UlGenerateDateHeader|UlGenerateDateHeader| |refcount|4|4| |`length`|410|385| |called|NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlpGenerateDateHeaderString
WPP_SF_iq
WPP_SF_qil
memcpy|NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlpGenerateDateHeaderString
WPP_SF_iq
WPP_SF_qil
memcpy| |calling|UlGenerateSingleVariableHeaders
UlGenerateVariableHeaders
UlSendSimpleStatus|UlGenerateSingleVariableHeaders
UlGenerateVariableHeaders
UlSendSimpleStatus| |paramcount|2|2| |`address`|140060510|14005bb30| |sig|int __fastcall UlGenerateDateHeader(void * param_1, longlong * param_2)|int __fastcall UlGenerateDateHeader(void * param_1, longlong * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlGenerateDateHeader Diff ```diff --- UlGenerateDateHeader +++ UlGenerateDateHeader @@ -1,57 +1,56 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ int UlGenerateDateHeader(void *param_1,longlong *param_2) { longlong lVar1; longlong lVar2; undefined8 uVar3; longlong lVar4; if ((DAT_0 & 0x20) != 0) { - WPP_SF_iq(0x6f,&WPP_aee5f1d9509b337e9d647e3a3f21c431_Traceguids,param_1,param_2); + WPP_SF_iq(0x6f,&WPP_6be8f1a1a6dc3a7610af4fdeda223eb8_Traceguids,param_1,param_2); } - lVar2 = _DAT_1; + lVar4 = _DAT_1; lVar1 = g_UlSystemTime; *param_2 = _DAT_1; - lVar2 = lVar2 - lVar1; - lVar4 = lVar2; - if ((UxKirHttpBugFix25Q2V2 != '\0') && (lVar4 = -lVar2, -1 < lVar2)) { - lVar4 = lVar2; + lVar2 = -(lVar4 - lVar1); + if (lVar2 < 0) { + lVar2 = lVar4 - lVar1; } - if (lVar4 < 10000000) { + if (lVar2 < 10000000) { memcpy(param_1,&g_UlDateString,(ulonglong)(g_UlDateStringLength + 1)); if (lVar1 == g_UlSystemTime) { *param_2 = lVar1; goto LAB_2; } } KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(&UlDateHeaderPushLock,0); lVar1 = _DAT_1; - lVar4 = *param_2 - g_UlSystemTime; - lVar2 = lVar4; - if ((UxKirHttpBugFix25Q2V2 != '\0') && (lVar2 = -lVar4, -1 < lVar4)) { - lVar2 = lVar4; + lVar2 = *param_2 - g_UlSystemTime; + lVar4 = -lVar2; + if (-lVar2 < 0) { + lVar4 = lVar2; } - if (lVar2 < 10000000) { + if (lVar4 < 10000000) { *param_2 = g_UlSystemTime; } else { g_UlSystemTime = 0; *param_2 = _DAT_1; uVar3 = UlpGenerateDateHeaderString(lVar4,lVar2,lVar1); g_UlDateStringLength = (int)uVar3; g_UlSystemTime = *param_2; } memcpy(param_1,&g_UlDateString,(ulonglong)(g_UlDateStringLength + 1)); ExReleasePushLockExclusiveEx(&UlDateHeaderPushLock,0); KeLeaveCriticalRegion(); LAB_2: if ((DAT_0 & 0x20) != 0) { - WPP_SF_qil(0x70,&WPP_aee5f1d9509b337e9d647e3a3f21c431_Traceguids,param_1,param_2); + WPP_SF_qil(0x70,&WPP_6be8f1a1a6dc3a7610af4fdeda223eb8_Traceguids,param_1,param_2); } return g_UlDateStringLength; } ``` ## UlFeatureSupportedFastIo ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.86| |i_ratio|0.62| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlFeatureSupportedFastIo|UlFeatureSupportedFastIo| |fullname|UlFeatureSupportedFastIo|UlFeatureSupportedFastIo| |refcount|3|3| |`length`|471|449| |called|NTOSKRNL.EXE::IoIs32bitProcess
UxCaptureUserMemory
UxTryCopyUserMemory
UxTryProbeForWrite
WPP_SF_qil
WPP_SF_qqLqLql|NTOSKRNL.EXE::IoIs32bitProcess
UxCaptureUserMemory
UxTryCopyUserMemory
UxTryProbeForWrite
WPP_SF_qil
WPP_SF_qqLqLql| |calling||| |paramcount|7|7| |`address`|1400bafc0|1400bb6a0| |sig|undefined8 __fastcall UlFeatureSupportedFastIo(undefined8 param_1, void * param_2, uint param_3, void * param_4, uint param_5, int * param_6, char param_7)|undefined8 __fastcall UlFeatureSupportedFastIo(undefined8 param_1, void * param_2, uint param_3, void * param_4, uint param_5, int * param_6, char param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlFeatureSupportedFastIo Diff ```diff --- UlFeatureSupportedFastIo +++ UlFeatureSupportedFastIo @@ -1,63 +1,60 @@ undefined8 UlFeatureSupportedFastIo (undefined8 param_1,void *param_2,uint param_3,void *param_4,uint param_5,int *param_6, char param_7) { undefined8 uVar1; undefined1 local_res10 [8]; int local_28 [4]; local_28[0] = 0; local_res10[0] = 0; if ((DAT_0 & 1) != 0) { - WPP_SF_qqLqLql(0x4a,&WPP_b4d4442ef33f389e6257e4bcc469d66c_Traceguids,param_1,param_2); + WPP_SF_qqLqLql(0x4a,&WPP_ac205c1ce0c030cbc4c86aa2ba746ce0_Traceguids,param_1,param_2); } param_6[0] = 0; param_6[1] = 0; param_6[2] = 0; param_6[3] = 0; if ((param_2 == (void *)0x0) || (param_3 < 4)) { uVar1 = 0xc000000d; } else { IoIs32bitProcess(0); uVar1 = UxCaptureUserMemory(param_2,4,4,param_7,local_28); if (-1 < (int)uVar1) { IoIs32bitProcess(0); uVar1 = UxTryProbeForWrite((ulonglong)param_4,(ulonglong)param_5,1,param_7); if (-1 < (int)uVar1) { - if ((local_28[0] - 1U < 0x10) || (local_28[0] - 100000U < 5)) { + if ((local_28[0] - 1U < 0x11) || (local_28[0] - 100000U < 5)) { local_res10[0] = 1; } if (local_28[0] == 0xd) { local_res10[0] = UxKirAddDisableAiaFlag; } - if (local_28[0] == 0xe) { - local_res10[0] = UxKirHttpDscp; - } - if (local_28[0] == 0xf) { - local_res10[0] = UxKirSeHttpQueryCryptoParams; - } if (local_28[0] == 0x10) { local_res10[0] = UxKirBrHttpQuerySocketTtl; + } + if (local_28[0] == 0x11) { + local_res10[0] = UxKirHttpTlsHandshakePerfCounter; } if (param_5 == 0) { uVar1 = 0xc0000023; } else { uVar1 = UxTryCopyUserMemory(param_4,local_res10,1); } } } } *param_6 = (int)uVar1; param_6[2] = 1; param_6[3] = 0; if ((DAT_0 & 1) != 0) { - uVar1 = WPP_SF_qil(0x4b,&WPP_b4d4442ef33f389e6257e4bcc469d66c_Traceguids,param_4,param_6); + uVar1 = WPP_SF_qil(0x4b,&WPP_ac205c1ce0c030cbc4c86aa2ba746ce0_Traceguids,param_4,param_6); } return CONCAT71((int7)((ulonglong)uVar1 >> 8),1); } ``` ## UlCopyGlobalCounters ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling| |ratio|0.96| |i_ratio|0.75| |m_ratio|0.98| |b_ratio|0.82| |match_types|StructuralGraphExactHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |`name`|UlCopyGlobalCounters|UlpCopyGlobalCounters| |`fullname`|UlCopyGlobalCounters|UlpCopyGlobalCounters| |`refcount`|3|2| |`length`|236|225| |called|WPP_SF_
WPP_SF_iq|WPP_SF_
WPP_SF_iq| |`calling`|UlScGetGlobalCounters
UlpPcwCollectInstances|UlScGetGlobalCounters| |paramcount|4|4| |`address`|140090808|1400af20c| |`sig`|undefined __fastcall UlCopyGlobalCounters(longlong param_1, int * param_2, undefined8 param_3, int * param_4)|undefined __fastcall UlpCopyGlobalCounters(longlong param_1, int * param_2, undefined8 param_3, int * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlCopyGlobalCounters Calling Diff ```diff --- UlCopyGlobalCounters calling +++ UlpCopyGlobalCounters calling @@ -2 +1,0 @@ -UlpPcwCollectInstances ``` ### UlCopyGlobalCounters Diff ```diff --- UlCopyGlobalCounters +++ UlpCopyGlobalCounters @@ -1,59 +1,59 @@ -void UlCopyGlobalCounters(longlong param_1,int *param_2,undefined8 param_3,int *param_4) +void UlpCopyGlobalCounters(longlong param_1,int *param_2,undefined8 param_3,int *param_4) { int *piVar1; int *piVar2; int *piVar3; uint uVar4; int *piVar6; int *piVar7; ulonglong uVar8; int *piVar5; if ((DAT_0 & 1) != 0) { param_4 = param_2; - WPP_SF_iq(0x13,&WPP_880ba1e7355d3d2646c1ab8e0eecfb30_Traceguids,param_1,param_2); + WPP_SF_iq(0x13,&WPP_f3e171eb2e923c9a4ea2a4f5cdc0687b_Traceguids,param_1,param_2); } param_2[0] = 0; param_2[1] = 0; param_2[2] = 0; param_2[3] = 0; param_2[4] = 0; param_2[5] = 0; piVar2 = (int *)0x0; piVar5 = piVar2; if (**(uint **)(param_1 + 0x620) != 0) { uVar8 = (ulonglong)**(uint **)(param_1 + 0x620); piVar3 = piVar2; param_4 = piVar2; piVar6 = piVar2; piVar7 = piVar2; do { piVar2 = piVar2 + 2; piVar1 = *(int **)(*(longlong *)(param_1 + 0x620) + (longlong)piVar2); *param_2 = *param_2 + *piVar1; uVar4 = (int)piVar5 + piVar1[1]; piVar5 = (int *)(ulonglong)uVar4; param_2[1] = uVar4; uVar4 = (int)param_4 + piVar1[2]; param_4 = (int *)(ulonglong)uVar4; param_2[2] = uVar4; uVar4 = (int)piVar6 + piVar1[3]; piVar6 = (int *)(ulonglong)uVar4; param_2[3] = uVar4; uVar4 = (int)piVar7 + piVar1[4]; piVar7 = (int *)(ulonglong)uVar4; param_2[4] = uVar4; uVar4 = (int)piVar3 + piVar1[5]; piVar3 = (int *)(ulonglong)uVar4; param_2[5] = uVar4; uVar8 = uVar8 - 1; } while (uVar8 != 0); } if ((DAT_0 & 1) != 0) { - WPP_SF_(0x14,&WPP_880ba1e7355d3d2646c1ab8e0eecfb30_Traceguids,piVar5,param_4); + WPP_SF_(0x14,&WPP_f3e171eb2e923c9a4ea2a4f5cdc0687b_Traceguids,piVar5,param_4); } return; } ``` ## UlCopyUrlGroupCounters ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling| |ratio|0.92| |i_ratio|0.75| |m_ratio|0.99| |b_ratio|0.82| |match_types|StructuralGraphExactHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |`name`|UlCopyUrlGroupCounters|UlpCopyUrlGroupCounters| |`fullname`|UlCopyUrlGroupCounters|UlpCopyUrlGroupCounters| |`refcount`|3|2| |`length`|255|244| |called|WPP_SF_I
WPP_SF_iq
memset|WPP_SF_I
WPP_SF_iq
memset| |`calling`|UlScGetSiteCounters
UlpPcwCollectInstances|UlScGetSiteCounters| |paramcount|2|2| |`address`|140091e84|1400af2f4| |`sig`|undefined __fastcall UlCopyUrlGroupCounters(undefined4 * param_1, undefined4 * param_2)|undefined __fastcall UlpCopyUrlGroupCounters(undefined4 * param_1, undefined4 * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlCopyUrlGroupCounters Calling Diff ```diff --- UlCopyUrlGroupCounters calling +++ UlpCopyUrlGroupCounters calling @@ -2 +1,0 @@ -UlpPcwCollectInstances ``` ### UlCopyUrlGroupCounters Diff ```diff --- UlCopyUrlGroupCounters +++ UlpCopyUrlGroupCounters @@ -1,52 +1,52 @@ -void UlCopyUrlGroupCounters(undefined4 *param_1,undefined4 *param_2) +void UlpCopyUrlGroupCounters(undefined4 *param_1,undefined4 *param_2) { longlong *plVar1; longlong lVar2; ulonglong uVar3; int iVar4; longlong lVar5; longlong lVar6; int iVar7; int iVar8; - if ((DAT_0 & 8) != 0) { - WPP_SF_iq(0xab,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,param_1,param_2); + if ((DAT_0 & 1) != 0) { + WPP_SF_iq(0x19,&WPP_f3e171eb2e923c9a4ea2a4f5cdc0687b_Traceguids,param_1,param_2); } memset(param_2,0,0x48); lVar2 = 0; *param_2 = *param_1; param_2[8] = param_1[1]; param_2[9] = param_1[2]; param_2[10] = param_1[3]; if (**(uint **)(param_1 + 4) != 0) { lVar5 = *(longlong *)(param_2 + 2); uVar3 = (ulonglong)**(uint **)(param_1 + 4); lVar6 = *(longlong *)(param_2 + 4); iVar7 = param_2[0xb]; iVar8 = param_2[0xc]; iVar4 = param_2[0xd]; do { lVar2 = lVar2 + 8; plVar1 = *(longlong **)(lVar2 + *(longlong *)(param_1 + 4)); lVar5 = lVar5 + *plVar1; *(longlong *)(param_2 + 2) = lVar5; lVar6 = lVar6 + plVar1[1]; *(longlong *)(param_2 + 4) = lVar6; iVar7 = iVar7 + (int)plVar1[2]; param_2[0xb] = iVar7; iVar8 = iVar8 + *(int *)((longlong)plVar1 + 0x14); param_2[0xc] = iVar8; iVar4 = iVar4 + (int)plVar1[3]; param_2[0xd] = iVar4; uVar3 = uVar3 - 1; } while (uVar3 != 0); } *(longlong *)(param_2 + 6) = *(longlong *)(param_2 + 2) + *(longlong *)(param_2 + 4); - if ((DAT_0 & 8) != 0) { - WPP_SF_I(0xac,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,param_2); + if ((DAT_0 & 1) != 0) { + WPP_SF_I(0x1a,&WPP_f3e171eb2e923c9a4ea2a4f5cdc0687b_Traceguids,param_2); } return; } ``` ## WPP_SF_dlllll ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling| |ratio|0.7| |i_ratio|0.36| |m_ratio|0.8| |b_ratio|0.8| |match_types|BSIM| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |`name`|WPP_SF_dlllll|WPP_SF_ili| |`fullname`|WPP_SF_dlllll|WPP_SF_ili| |`refcount`|4|2| |`length`|116|78| |called|FastWppTraceMessage|FastWppTraceMessage| |`calling`|UlCopyRequestToBuffer
UlCopyRequestToIrp
UlpCopyRequestInformation|UlSetConfigGroupProperty| |paramcount|4|4| |`address`|1401b2518|1401a9e5c| |`sig`|undefined __fastcall WPP_SF_dlllll(undefined8 param_1, undefined8 param_2, undefined4 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_ili(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_dlllll Calling Diff ```diff --- WPP_SF_dlllll calling +++ WPP_SF_ili calling @@ -1,3 +1 @@ -UlCopyRequestToBuffer -UlCopyRequestToIrp -UlpCopyRequestInformation +UlSetConfigGroupProperty ``` ### WPP_SF_dlllll Diff ```diff --- WPP_SF_dlllll +++ WPP_SF_ili @@ -1,13 +1,13 @@ -void WPP_SF_dlllll(undefined8 param_1,undefined8 param_2,undefined4 param_3,undefined4 param_4) +void WPP_SF_ili(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined4 param_4) { - undefined4 local_res18 [2]; + undefined8 local_res18; undefined4 local_res20; - local_res18[0] = param_3; + local_res18 = param_3; local_res20 = param_4; - FastWppTraceMessage(&WPP_0b41636710353117bc5e4d8a9d73d640_Traceguids,0xd,local_res18,4); + FastWppTraceMessage(&WPP_2d297478329b39561f77aac2cbbacc14_Traceguids,0x7f,&local_res18,8); return; } ``` ## memcpy ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.04| |i_ratio|0.01| |m_ratio|0.32| |b_ratio|0.14| |match_types|Implied Match| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |`name`|memcpy|UxpQuicConnectionCopyCertBlob32| |`fullname`|memcpy|UxpQuicConnectionCopyCertBlob32| |`refcount`|380|2| |`length`|537|89| |`called`||memcpy| |`calling`|
Expand for full list:
CreateNewEventEntry
FUN_14000cbb0
FUN_140157028
FUN_1401582ca
FUN_14015bf9e
FUN_14015c52c
FUN_14015fb0f
FUN_140160512
FUN_140160fd8
FUN_140162fda
HkAddPairToTableHkDecode
HkDecodeLiteral
HkDecodingEmitterAppendPair
HkEmitBuffer
HkEncode
HkEncodeString
HkExpandEncodingEmitter
HkExpandStorage
HttpValidateHostname
HttppFixParsedUrl
HttppValidateIpv6Hostname
InitializeTelemetryAssertsKM
InitializeTelemetryAssertsKMWorkerInternal
QkAllocateElement
QkEmitBuffer
QkExpandEncodingEmitter
QkExpandRefArray
QkExpandStorage
TraceFilterEngineStoreFilterRulesInternal
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcQueryClientStreamProperty
UcStreamCopyReceiveList
UcpCaptureUserPairs32
UcpCopyBufferToUser
UcpCopyHeaderPairsToUser
UlAddServiceNameToContainer
UlAdjustRangesToContentSize
UlAllocateWideString
UlAppendHeaderValue
UlAuthCopyKnownAuthHeaderToBuffer
UlAuthCopyUnconfiguredAuthHeaderToBuffer
UlBufferWriterAlign
UlBufferWriterWrite
UlBuildLogHeader
UlBuildPushRequestHeaders
UlCaptureRawLogData
UlCaptureWideString
UlContentRangeHeaderHandler
UlCopyAuthConfigProperty
UlCopyAuthConfigToIrp
UlCopyAuthHeader
UlCopyChannelBindConfigToIrp
UlCopyHttpVerb
UlCopyLogDataToCache
UlCopyLoggingProperty
UlCopyParsedHeaders
UlCopyUserAuthInfo
UlCopyUserChannelBindInfo
UlCopyUserTokenBindingInfo
UlCreateCacheEntryFromResponse
UlCreateConsumerHelper
UlDeepCopyParsedHeaders
UlEventLogCreateFailure
UlFastSendHttpResponseOld
UlFlushCacheByUri
UlGenerateDateHeader
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateRoutingToken
UlGenerateSingleVariableHeaders
UlGenerateTrailers
UlGenerateVariableHeaders
UlGetDateTimeFields
UlGetServerHeader
UlGetTypeAndSubType
UlHkeBuilderCopyFixedHeaders
UlHkeBuilderQueryKnownHeader
UlHkeBuilderQueryUnknownHeader
UlLogHttpError
UlPrepareUrlIoctl
UlQueryKnownRequestHeader
UlQueryRequestProperty
UlQueryUnknownRequestHeader
UlReadFragmentFromCache
UlReadStringParameter
UlRefreshFileName
UlReplaceHeaderValue
UlSendSimpleStatus
UlSerializeTrailers
UlWriteEventLogEntry
UlpAddIpAddressToList
UlpAiPopulateAddressList
UlpAllocateAuthCacheEntry
UlpBufferWriterUpdate
UlpBuildErrorLogRecord
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildUriKeyFromCookedUrl
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCaptureSoftwareDirective
UlpCompleteAuthInfo
UlpCompleteLogRecordETW
UlpCompleteLogRecordIIS
UlpCompleteLogRecordNCSA
UlpCompleteLogRecordW3C
UlpCopyCacheEntryInfo
UlpCopyChannelBindTokenToIrp
UlpCopyConfigGroupInfo
UlpCopyIndicatedData
UlpCopyQuicStatsV2
UlpCopyRegisteredUrl
UlpCopyRequestQueueInfo
UlpCopyRequestToBuffer
UlpCopySingleMultipleHeader
UlpCopyString
UlpCopyUrl
UlpCopyUserDataToFastTracker
UlpCreateTargetServiceName
UlpDeleteIpAddressFromList
UlpDigestFastAuthenticator
UlpDuplicateSliceTrackerForCache
UlpFastAuthenticate
UlpFixupIISLogRecord
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpGenerateBoundaryChunk
UlpGenerateCommonBoundaryBuffer
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpHkeBuilderAddKnownHeader
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpHkeCopyKnownHeader
UlpLogSpecificInitFailure
UlpMergeBuffers
UlpParseNextRequest
UlpPrepare200Response
UlpPrepareOutputToken
UlpRawCopyForLogCacheHit
UlpRawCopyForLogCacheMiss
UlpRewriteLogRecord
UlpSanitizeResponseHeaders
UlpSanitizeTrailerHeaders
UlpSetRequestQueueExternalId
UlpSspiAuthenticationHandler
UlpTreeFindWildcardSite
UlpTreeFreeNode
UlpTreeInsertEntry
UlpUpdateReservationInRegistry
UlpWriteServerHeader
UlpWriteSingleHeader
UlpWriteToErrorLogFileDebug
UlpWriteToErrorLogFileExclusive
UlpWriteToLogFileDebug
UlpWriteToLogFileExclusive
UlpWriteToLogFileShared
UxAllocateBufferedMdl
UxAppendCopyToAggregator
UxAppendToExbuffer
UxCaptureString
UxCaptureUserMemory
UxCaptureWideString
UxCopyMdlChainToMdlChain
UxDuoBeginFullFrameParse
UxDuoBuildContinuationChain
UxDuoDispatchAltSvcParcel
UxDuoParse
UxDuoParseCatalog
UxDuoParseSettings
UxDuoParseWindowUpdate
UxGenerateSubdomainWildcardHostname
UxIpv4AddressToStringExW
UxIpv6AddressToStringExW
UxQuicBufferAddData
UxQuicBufferShiftData
UxQuicConnectionCopyBindings
UxQuicConnectionGetPeerIssuerListClient
UxQuicConnectionGetStatsV2
UxQuicPreParser
UxQuicSetSessionKeys
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslCopyConfigurationProperties
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCopySniToRequestProperty
UxSslGetAltSvcInfo
UxSslGetCertInfo
UxSslInitializeClientCertPolicy
UxSslInitiateSend
UxSslParseTlsRestrictions
UxSslReadConfigurationPropertiesFromUser
UxSslReadExtendedConfigurationPropertiesFromUser
UxTryCopyUserMemory
UxWskAcceptEvent
UxpDuoCaptureHostName
UxpQuicBufferExpandBuffer
UxpQuicConnectionCopyCertBlob
UxpQuicConnectionCopyIssuerList32
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicCreateCustomAlpnArray
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicParseAndCopyDataIndication
UxpQuicQueryConnectionInfo
UxpQuicStreamGetStats
UxpQuicUnknownStreamReceiveEvent
UxpSslCommonSendData
UxpSslCommonSendDataHelper
UxpSslCopyCertificateParam
UxpSslCopySniForEtwFiltering
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslExpandTransportDataIndication
UxpSslGetClientCertInfo
UxpSslGetClientHello
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslProcessRenegotiateRecord
UxpSslReadConfigurationPropertiesFromRegistry
WppTraceCallback
|UxpQuicConnectionCopyCertBlob| |paramcount|3|4| |`address`|14014db80|1400ea280| |`sig`|void * __cdecl memcpy(void * _Dst, void * _Src, size_t _Size)|undefined8 __fastcall UxpQuicConnectionCopyCertBlob32(uint * param_1, uint * param_2, uint param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### memcpy Called Diff ```diff --- memcpy called +++ UxpQuicConnectionCopyCertBlob32 called @@ -0,0 +1 @@ +memcpy ``` ### memcpy Calling Diff ```diff --- memcpy calling +++ UxpQuicConnectionCopyCertBlob32 calling @@ -1,201 +0,0 @@ -CreateNewEventEntry -FUN_14000cbb0 -FUN_140157028 -FUN_1401582ca -FUN_14015bf9e -FUN_14015c52c -FUN_14015fb0f -FUN_140160512 -FUN_140160fd8 -FUN_140162fda -HkAddPairToTable -HkDecode -HkDecodeLiteral -HkDecodingEmitterAppendPair -HkEmitBuffer -HkEncode -HkEncodeString -HkExpandEncodingEmitter -HkExpandStorage -HttpValidateHostname -HttppFixParsedUrl -HttppValidateIpv6Hostname -InitializeTelemetryAssertsKM -InitializeTelemetryAssertsKMWorkerInternal -QkAllocateElement -QkEmitBuffer -QkExpandEncodingEmitter -QkExpandRefArray -QkExpandStorage -TraceFilterEngineStoreFilterRulesInternal -UcQueryClientConnectionFastIo -UcQueryClientStreamFastIo -UcQueryClientStreamProperty -UcStreamCopyReceiveList -UcpCaptureUserPairs32 -UcpCopyBufferToUser -UcpCopyHeaderPairsToUser -UlAddServiceNameToContainer -UlAdjustRangesToContentSize -UlAllocateWideString -UlAppendHeaderValue -UlAuthCopyKnownAuthHeaderToBuffer -UlAuthCopyUnconfiguredAuthHeaderToBuffer -UlBufferWriterAlign -UlBufferWriterWrite -UlBuildLogHeader -UlBuildPushRequestHeaders -UlCaptureRawLogData -UlCaptureWideString -UlContentRangeHeaderHandler -UlCopyAuthConfigProperty -UlCopyAuthConfigToIrp -UlCopyAuthHeader -UlCopyChannelBindConfigToIrp -UlCopyHttpVerb -UlCopyLogDataToCache -UlCopyLoggingProperty -UlCopyParsedHeaders -UlCopyUserAuthInfo -UlCopyUserChannelBindInfo -UlCopyUserTokenBindingInfo -UlCreateCacheEntryFromResponse -UlCreateConsumerHelper -UlDeepCopyParsedHeaders -UlEventLogCreateFailure -UlFastSendHttpResponseOld -UlFlushCacheByUri -UlGenerateDateHeader -UlGenerateFixedHeadersOld -UlGenerateMultipleKnownHeadersOld -UlGenerateRoutingToken -UlGenerateSingleVariableHeaders -UlGenerateTrailers -UlGenerateVariableHeaders -UlGetDateTimeFields -UlGetServerHeader -UlGetTypeAndSubType -UlHkeBuilderCopyFixedHeaders -UlHkeBuilderQueryKnownHeader -UlHkeBuilderQueryUnknownHeader -UlLogHttpError -UlPrepareUrlIoctl -UlQueryKnownRequestHeader -UlQueryRequestProperty -UlQueryUnknownRequestHeader -UlReadFragmentFromCache -UlReadStringParameter -UlRefreshFileName -UlReplaceHeaderValue -UlSendSimpleStatus -UlSerializeTrailers -UlWriteEventLogEntry -UlpAddIpAddressToList -UlpAiPopulateAddressList -UlpAllocateAuthCacheEntry -UlpBufferWriterUpdate -UlpBuildErrorLogRecord -UlpBuildMultiRangeMdlChainFromSlices -UlpBuildUriKeyFromCookedUrl -UlpCaptureBasicParams -UlpCaptureDigestParams -UlpCaptureSoftwareDirective -UlpCompleteAuthInfo -UlpCompleteLogRecordETW -UlpCompleteLogRecordIIS -UlpCompleteLogRecordNCSA -UlpCompleteLogRecordW3C -UlpCopyCacheEntryInfo -UlpCopyChannelBindTokenToIrp -UlpCopyConfigGroupInfo -UlpCopyIndicatedData -UlpCopyQuicStatsV2 -UlpCopyRegisteredUrl -UlpCopyRequestQueueInfo -UlpCopyRequestToBuffer -UlpCopySingleMultipleHeader -UlpCopyString -UlpCopyUrl -UlpCopyUserDataToFastTracker -UlpCreateTargetServiceName -UlpDeleteIpAddressFromList -UlpDigestFastAuthenticator -UlpDuplicateSliceTrackerForCache -UlpFastAuthenticate -UlpFixupIISLogRecord -UlpGenerateAuthHeaders -UlpGenerateAuthHeadersOld -UlpGenerateBoundaryChunk -UlpGenerateCommonBoundaryBuffer -UlpGetChunkInfo -UlpGetChunkInfoOld -UlpHkeBuilderAddKnownHeader -UlpHkeBuilderAddUnknownHeader -UlpHkeBuilderModifyKnownHeader -UlpHkeBuilderModifyStatusCode -UlpHkeBuilderModifyUnknownHeader -UlpHkeCopyKnownHeader -UlpLogSpecificInitFailure -UlpMergeBuffers -UlpParseNextRequest -UlpPrepare200Response -UlpPrepareOutputToken -UlpRawCopyForLogCacheHit -UlpRawCopyForLogCacheMiss -UlpRewriteLogRecord -UlpSanitizeResponseHeaders -UlpSanitizeTrailerHeaders -UlpSetRequestQueueExternalId -UlpSspiAuthenticationHandler -UlpTreeFindWildcardSite -UlpTreeFreeNode -UlpTreeInsertEntry -UlpUpdateReservationInRegistry -UlpWriteServerHeader -UlpWriteSingleHeader -UlpWriteToErrorLogFileDebug -UlpWriteToErrorLogFileExclusive -UlpWriteToLogFileDebug -UlpWriteToLogFileExclusive -UlpWriteToLogFileShared -UxAllocateBufferedMdl -UxAppendCopyToAggregator -UxAppendToExbuffer -UxCaptureString -UxCaptureUserMemory -UxCaptureWideString -UxCopyMdlChainToMdlChain -UxDuoBeginFullFrameParse -UxDuoBuildContinuationChain -UxDuoDispatchAltSvcParcel -UxDuoParse -UxDuoParseCatalog -UxDuoParseSettings -UxDuoParseWindowUpdate -UxGenerateSubdomainWildcardHostname -UxIpv4AddressToStringExW -UxIpv6AddressToStringExW -UxQuicBufferAddData -UxQuicBufferShiftData -UxQuicConnectionCopyBindings -UxQuicConnectionGetPeerIssuerListClient -UxQuicConnectionGetStatsV2 -UxQuicPreParser -UxQuicSetSessionKeys -UxReadRegistryKeyValue -UxSetExbufferSize -UxSslCopyConfigurationProperties -UxSslCopyErrorHeaders -UxSslCopyExtendedProperties -UxSslCopySniToRequestProperty -UxSslGetAltSvcInfo -UxSslGetCertInfo -UxSslInitializeClientCertPolicy -UxSslInitiateSend -UxSslParseTlsRestrictions -UxSslReadConfigurationPropertiesFromUser -UxSslReadExtendedConfigurationPropertiesFromUser -UxTryCopyUserMemory -UxWskAcceptEvent -UxpDuoCaptureHostName -UxpQuicBufferExpandBuffer @@ -203,23 +1,0 @@ -UxpQuicConnectionCopyIssuerList32 -UxpQuicConnectionQueryIssuerListInfo -UxpQuicConnectionStoreClientCert -UxpQuicCreateCustomAlpnArray -UxpQuicInitializeConfigurationContext -UxpQuicListenerNewConnection -UxpQuicParseAndCopyDataIndication -UxpQuicQueryConnectionInfo -UxpQuicStreamGetStats -UxpQuicUnknownStreamReceiveEvent -UxpSslCommonSendData -UxpSslCommonSendDataHelper -UxpSslCopyCertificateParam -UxpSslCopySniForEtwFiltering -UxpSslCopyTransportIndicationsToHandshakeBuffer -UxpSslExpandTransportDataIndication -UxpSslGetClientCertInfo -UxpSslGetClientHello -UxpSslParseAndCopyDataIndication -UxpSslPrepareSendBuffer -UxpSslProcessRenegotiateRecord -UxpSslReadConfigurationPropertiesFromRegistry -WppTraceCallback ``` ### memcpy Diff ```diff --- memcpy +++ UxpQuicConnectionCopyCertBlob32 @@ -1,292 +1,30 @@ -void * __cdecl memcpy(void *_Dst,void *_Src,size_t _Size) +undefined8 UxpQuicConnectionCopyCertBlob32(uint *param_1,uint *param_2,uint param_3,uint *param_4) { - undefined4 *puVar1; - undefined1 *puVar2; - undefined8 uVar3; - undefined8 uVar4; - undefined8 uVar5; - undefined8 uVar6; - undefined8 uVar7; - undefined8 uVar8; - undefined1 *puVar9; - undefined8 *puVar10; - undefined8 *puVar11; - undefined4 *puVar12; - undefined4 *puVar13; - undefined4 *puVar14; - longlong lVar15; - ulonglong uVar16; - ulonglong uVar17; - undefined4 uVar18; - undefined4 uVar19; - undefined4 uVar20; - undefined4 uVar21; - undefined4 uVar22; - undefined4 uVar23; - undefined4 uVar24; - undefined4 uVar25; + uint uVar1; + uint *_Dst; + undefined8 uVar2; - if (_Size < 8) { - if (_Size != 0) { - puVar9 = _Dst; - if (_Src < _Dst) { - puVar9 = (undefined1 *)((longlong)_Dst + _Size); - do { - puVar2 = puVar9 + ((longlong)_Src - (longlong)_Dst) + -1; - puVar9 = puVar9 + -1; - _Size = _Size - 1; - *puVar9 = *puVar2; - } while (_Size != 0); - return _Dst; + uVar1 = *param_1; + _Dst = param_2 + 2; + *param_4 = uVar1 + 8; + if (param_3 < uVar1 + 8) { + uVar2 = 0x80000005; + } + else { + uVar1 = *param_1; + uVar2 = 0; + param_2[1] = 0; + *param_2 = uVar1; + if (*(longlong *)(param_1 + 2) != 0) { + if (UxKirWritingAndReadingUm == '\0') { + _Dst = (uint *)(ulonglong)((int)param_2 + 8); } - do { - _Size = _Size - 1; - *puVar9 = puVar9[(longlong)_Src - (longlong)_Dst]; - puVar9 = puVar9 + 1; - } while (_Size != 0); - } - return _Dst; - } - if (_Size < 0x11) { - uVar3 = *(undefined8 *)((longlong)_Src + (_Size - 8)); - *(undefined8 *)_Dst = *(undefined8 *)_Src; - *(undefined8 *)((longlong)_Dst + (_Size - 8)) = uVar3; - return _Dst; - } - if (_Size < 0x21) { - uVar3 = *(undefined8 *)((longlong)_Src + 8); - puVar10 = (undefined8 *)((longlong)_Src + (_Size - 0x10)); - uVar4 = *puVar10; - uVar5 = puVar10[1]; - *(undefined8 *)_Dst = *(undefined8 *)_Src; - *(undefined8 *)((longlong)_Dst + 8) = uVar3; - puVar10 = (undefined8 *)((longlong)_Dst + (_Size - 0x10)); - *puVar10 = uVar4; - puVar10[1] = uVar5; - return _Dst; - } - lVar15 = (longlong)_Src - (longlong)_Dst; - if ((_Src < _Dst) && (_Dst < (void *)((longlong)_Src + _Size))) { - puVar14 = (undefined4 *)((longlong)_Dst + lVar15 + (_Size - 0x10)); - uVar18 = puVar14[1]; - uVar20 = puVar14[2]; - uVar22 = puVar14[3]; - puVar12 = (undefined4 *)((longlong)_Dst + (_Size - 0x10)); - uVar16 = _Size - 0x10; - puVar13 = puVar12; - uVar19 = *puVar14; - uVar21 = uVar18; - uVar23 = uVar20; - uVar25 = uVar22; - if (((ulonglong)puVar12 & 0xf) != 0) { - puVar13 = (undefined4 *)((ulonglong)puVar12 & 0xfffffffffffffff0); - puVar1 = (undefined4 *)((longlong)puVar13 + lVar15); - uVar19 = *puVar1; - uVar21 = puVar1[1]; - uVar23 = puVar1[2]; - uVar25 = puVar1[3]; - *puVar12 = *puVar14; - *(undefined4 *)((longlong)_Dst + (_Size - 0xc)) = uVar18; - *(undefined4 *)((longlong)_Dst + (_Size - 8)) = uVar20; - *(undefined4 *)((longlong)_Dst + (_Size - 4)) = uVar22; - uVar16 = (longlong)puVar13 - (longlong)_Dst; - } - uVar17 = uVar16 >> 6; - if (uVar17 != 0) { - uVar16 = uVar16 & 0x3f; - puVar14 = puVar13; - uVar18 = uVar19; - uVar20 = uVar21; - uVar22 = uVar23; - uVar24 = uVar25; - do { - puVar10 = (undefined8 *)((longlong)puVar14 + lVar15 + -0x10); - uVar3 = *puVar10; - uVar4 = puVar10[1]; - puVar10 = (undefined8 *)((longlong)puVar14 + lVar15 + -0x20); - uVar5 = *puVar10; - uVar6 = puVar10[1]; - puVar10 = (undefined8 *)((longlong)puVar14 + lVar15 + -0x30); - uVar7 = *puVar10; - uVar8 = puVar10[1]; - puVar13 = (undefined4 *)((longlong)puVar14 + lVar15 + -0x40); - uVar19 = *puVar13; - uVar21 = puVar13[1]; - uVar23 = puVar13[2]; - uVar25 = puVar13[3]; - *puVar14 = uVar18; - puVar14[1] = uVar20; - puVar14[2] = uVar22; - puVar14[3] = uVar24; - puVar13 = puVar14 + -0x10; - uVar17 = uVar17 - 1; - *(undefined8 *)(puVar14 + -4) = uVar3; - *(undefined8 *)(puVar14 + -2) = uVar4; - *(undefined8 *)(puVar14 + -8) = uVar5; - *(undefined8 *)(puVar14 + -6) = uVar6; - *(undefined8 *)(puVar14 + -0xc) = uVar7; - *(undefined8 *)(puVar14 + -10) = uVar8; - puVar14 = puVar13; - uVar18 = uVar19; - uVar20 = uVar21; - uVar22 = uVar23; - uVar24 = uVar25; - } while (uVar17 != 0); - } - for (uVar17 = uVar16 >> 4; uVar17 != 0; uVar17 = uVar17 - 1) { - *puVar13 = uVar19; - puVar13[1] = uVar21; - puVar13[2] = uVar23; - puVar13[3] = uVar25; - puVar14 = (undefined4 *)((longlong)puVar13 + lVar15 + -0x10); - uVar19 = *puVar14; - uVar21 = puVar14[1]; - uVar23 = puVar14[2]; - uVar25 = puVar14[3]; - puVar13 = puVar13 + -4; - } - if ((uVar16 & 0xf) != 0) { - puVar10 = (undefined8 *)((longlong)puVar13 - (uVar16 & 0xf)); - uVar3 = ((undefined8 *)((longlong)puVar10 + lVar15))[1]; - *puVar10 = *(undefined8 *)((longlong)puVar10 + lVar15); - puVar10[1] = uVar3; - } - *puVar13 = uVar19; - puVar13[1] = uVar21; - puVar13[2] = uVar23; - puVar13[3] = uVar25; - return _Dst; - } - puVar14 = (undefined4 *)((longlong)_Dst + lVar15); - uVar18 = puVar14[1]; - uVar20 = puVar14[2]; - uVar22 = puVar14[3]; - puVar10 = (undefined8 *)((longlong)_Dst + 0x10); - uVar19 = *puVar14; - uVar21 = uVar18; - uVar23 = uVar20; - uVar25 = uVar22; - if (((ulonglong)puVar10 & 0xf) != 0) { - puVar13 = (undefined4 *)(((ulonglong)puVar10 & 0xfffffffffffffff0) + lVar15); - uVar19 = *puVar13; - uVar21 = puVar13[1]; - uVar23 = puVar13[2]; - uVar25 = puVar13[3]; - *(undefined4 *)_Dst = *puVar14; - *(undefined4 *)((longlong)_Dst + 4) = uVar18; - *(undefined4 *)((longlong)_Dst + 8) = uVar20; - *(undefined4 *)((longlong)_Dst + 0xc) = uVar22; - puVar10 = (undefined8 *)(((ulonglong)puVar10 & 0xfffffffffffffff0) + 0x10); - } - uVar16 = (longlong)_Dst + (_Size - (longlong)puVar10); - uVar17 = uVar16 >> 6; - if (uVar17 != 0) { - if (uVar17 < 0x1001) { - uVar16 = uVar16 & 0x3f; - puVar11 = puVar10; - uVar18 = uVar19; - uVar20 = uVar21; - uVar22 = uVar23; - uVar24 = uVar25; - do { - uVar3 = *(undefined8 *)((longlong)puVar11 + lVar15); - uVar4 = ((undefined8 *)((longlong)puVar11 + lVar15))[1]; - puVar10 = (undefined8 *)((longlong)puVar11 + lVar15 + 0x10); - uVar5 = *puVar10; - uVar6 = puVar10[1]; - puVar10 = (undefined8 *)((longlong)puVar11 + lVar15 + 0x20); - uVar7 = *puVar10; - uVar8 = puVar10[1]; - puVar14 = (undefined4 *)((longlong)puVar11 + lVar15 + 0x30); - uVar19 = *puVar14; - uVar21 = puVar14[1]; - uVar23 = puVar14[2]; - uVar25 = puVar14[3]; - *(undefined4 *)(puVar11 + -2) = uVar18; - *(undefined4 *)((longlong)puVar11 + -0xc) = uVar20; - *(undefined4 *)(puVar11 + -1) = uVar22; - *(undefined4 *)((longlong)puVar11 + -4) = uVar24; - puVar10 = puVar11 + 8; - uVar17 = uVar17 - 1; - *puVar11 = uVar3; - puVar11[1] = uVar4; - puVar11[2] = uVar5; - puVar11[3] = uVar6; - puVar11[4] = uVar7; - puVar11[5] = uVar8; - puVar11 = puVar10; - uVar18 = uVar19; - uVar20 = uVar21; - uVar22 = uVar23; - uVar24 = uVar25; - } while (uVar17 != 0); - } - else { - uVar17 = uVar16 >> 6; - uVar16 = uVar16 & 0x3f; - puVar11 = puVar10; - uVar18 = uVar19; - uVar20 = uVar21; - uVar22 = uVar23; - uVar24 = uVar25; - do { - uVar3 = *(undefined8 *)((longlong)puVar11 + lVar15); - uVar4 = ((undefined8 *)((longlong)puVar11 + lVar15))[1]; - puVar10 = (undefined8 *)((longlong)puVar11 + lVar15 + 0x10); - uVar5 = *puVar10; - uVar6 = puVar10[1]; - puVar10 = (undefined8 *)((longlong)puVar11 + lVar15 + 0x20); - uVar7 = *puVar10; - uVar8 = puVar10[1]; - puVar14 = (undefined4 *)((longlong)puVar11 + lVar15 + 0x30); - uVar19 = *puVar14; - uVar21 = puVar14[1]; - uVar23 = puVar14[2]; - uVar25 = puVar14[3]; - *(undefined4 *)(puVar11 + -2) = uVar18; - *(undefined4 *)((longlong)puVar11 + -0xc) = uVar20; - *(undefined4 *)(puVar11 + -1) = uVar22; - *(undefined4 *)((longlong)puVar11 + -4) = uVar24; - puVar10 = puVar11 + 8; - uVar17 = uVar17 - 1; - *puVar11 = uVar3; - puVar11[1] = uVar4; - puVar11[2] = uVar5; - puVar11[3] = uVar6; - puVar11[4] = uVar7; - puVar11[5] = uVar8; - puVar11 = puVar10; - uVar18 = uVar19; - uVar20 = uVar21; - uVar22 = uVar23; - uVar24 = uVar25; - } while (uVar17 != 0); + param_2[1] = (uint)_Dst; + memcpy(_Dst,*(void **)(param_1 + 2),(ulonglong)*param_1); } } - for (uVar17 = uVar16 >> 4; uVar17 != 0; uVar17 = uVar17 - 1) { - *(undefined4 *)(puVar10 + -2) = uVar19; - *(undefined4 *)((longlong)puVar10 + -0xc) = uVar21; - *(undefined4 *)(puVar10 + -1) = uVar23; - *(undefined4 *)((longlong)puVar10 + -4) = uVar25; - puVar14 = (undefined4 *)((longlong)puVar10 + lVar15); - uVar19 = *puVar14; - uVar21 = puVar14[1]; - uVar23 = puVar14[2]; - uVar25 = puVar14[3]; - puVar10 = puVar10 + 2; - } - if ((uVar16 & 0xf) != 0) { - puVar11 = (undefined8 *)((longlong)puVar10 + ((uVar16 & 0xf) - 0x10)); - uVar3 = ((undefined8 *)((longlong)puVar11 + lVar15))[1]; - *puVar11 = *(undefined8 *)((longlong)puVar11 + lVar15); - puVar11[1] = uVar3; - } - *(undefined4 *)(puVar10 + -2) = uVar19; - *(undefined4 *)((longlong)puVar10 + -0xc) = uVar21; - *(undefined4 *)(puVar10 + -1) = uVar23; - *(undefined4 *)((longlong)puVar10 + -4) = uVar25; - return _Dst; + return uVar2; } ``` ## UlCopyGlobalCounters ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.24| |i_ratio|0.15| |m_ratio|0.85| |b_ratio|0.48| |match_types|Implied Match| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |`name`|UlCopyGlobalCounters|UlpPcwCopyGlobalCounters| |`fullname`|UlCopyGlobalCounters|UlpPcwCopyGlobalCounters| |`refcount`|3|2| |`length`|236|164| |`called`|WPP_SF_
WPP_SF_iq|| |`calling`|UlScGetGlobalCounters
UlpPcwCollectInstances|UlpPcwCollectInstances| |paramcount|4|2| |`address`|140090808|14013527c| |`sig`|undefined __fastcall UlCopyGlobalCounters(longlong param_1, int * param_2, undefined8 param_3, int * param_4)|undefined __fastcall UlpPcwCopyGlobalCounters(longlong param_1, int * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlCopyGlobalCounters Called Diff ```diff --- UlCopyGlobalCounters called +++ UlpPcwCopyGlobalCounters called @@ -1,2 +0,0 @@ -WPP_SF_ -WPP_SF_iq ``` ### UlCopyGlobalCounters Calling Diff ```diff --- UlCopyGlobalCounters calling +++ UlpPcwCopyGlobalCounters calling @@ -1 +0,0 @@ -UlScGetGlobalCounters ``` ### UlCopyGlobalCounters Diff ```diff --- UlCopyGlobalCounters +++ UlpPcwCopyGlobalCounters @@ -1,59 +1,49 @@ -void UlCopyGlobalCounters(longlong param_1,int *param_2,undefined8 param_3,int *param_4) +void UlpPcwCopyGlobalCounters(longlong param_1,int *param_2) { int *piVar1; - int *piVar2; - int *piVar3; - uint uVar4; - int *piVar6; - int *piVar7; - ulonglong uVar8; - int *piVar5; + int iVar2; + int iVar3; + int iVar4; + int iVar5; + ulonglong uVar6; + longlong lVar7; + int iVar8; + bool bVar9; - if ((DAT_0 & 1) != 0) { - param_4 = param_2; - WPP_SF_iq(0x13,&WPP_880ba1e7355d3d2646c1ab8e0eecfb30_Traceguids,param_1,param_2); - } param_2[0] = 0; param_2[1] = 0; - param_2[2] = 0; - param_2[3] = 0; - param_2[4] = 0; - param_2[5] = 0; - piVar2 = (int *)0x0; - piVar5 = piVar2; + uVar6 = (ulonglong)**(uint **)(param_1 + 0x620); if (**(uint **)(param_1 + 0x620) != 0) { - uVar8 = (ulonglong)**(uint **)(param_1 + 0x620); - piVar3 = piVar2; - param_4 = piVar2; - piVar6 = piVar2; - piVar7 = piVar2; + iVar2 = param_2[2]; + iVar8 = 0; + iVar5 = param_2[3]; + lVar7 = 0; + iVar4 = param_2[4]; + iVar3 = param_2[5]; do { - piVar2 = piVar2 + 2; - piVar1 = *(int **)(*(longlong *)(param_1 + 0x620) + (longlong)piVar2); + piVar1 = *(int **)(lVar7 + 8 + *(longlong *)(param_1 + 0x620)); *param_2 = *param_2 + *piVar1; - uVar4 = (int)piVar5 + piVar1[1]; - piVar5 = (int *)(ulonglong)uVar4; - param_2[1] = uVar4; - uVar4 = (int)param_4 + piVar1[2]; - param_4 = (int *)(ulonglong)uVar4; - param_2[2] = uVar4; - uVar4 = (int)piVar6 + piVar1[3]; - piVar6 = (int *)(ulonglong)uVar4; - param_2[3] = uVar4; - uVar4 = (int)piVar7 + piVar1[4]; - piVar7 = (int *)(ulonglong)uVar4; - param_2[4] = uVar4; - uVar4 = (int)piVar3 + piVar1[5]; - piVar3 = (int *)(ulonglong)uVar4; - param_2[5] = uVar4; - uVar8 = uVar8 - 1; - } while (uVar8 != 0); - } - if ((DAT_0 & 1) != 0) { - WPP_SF_(0x14,&WPP_880ba1e7355d3d2646c1ab8e0eecfb30_Traceguids,piVar5,param_4); + iVar8 = iVar8 + piVar1[1]; + param_2[1] = iVar8; + iVar2 = iVar2 + piVar1[2]; + param_2[2] = iVar2; + iVar5 = iVar5 + piVar1[3]; + param_2[3] = iVar5; + iVar4 = iVar4 + piVar1[4]; + param_2[4] = iVar4; + iVar3 = iVar3 + piVar1[5]; + bVar9 = UxKirHttpTlsHandshakePerfCounter != '\0'; + param_2[5] = iVar3; + if (bVar9) { + *(longlong *)(param_2 + 6) = *(longlong *)(param_2 + 6) + *(longlong *)(piVar1 + 6); + *(longlong *)(param_2 + 8) = *(longlong *)(param_2 + 8) + *(longlong *)(piVar1 + 8); + } + lVar7 = lVar7 + 8; + uVar6 = uVar6 - 1; + } while (uVar6 != 0); } return; } ``` ## UlCopyUrlGroupCounters ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.38| |i_ratio|0.36| |m_ratio|0.91| |b_ratio|0.72| |match_types|Implied Match| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |`name`|UlCopyUrlGroupCounters|UlPcwCopyUrlGroupCounters| |`fullname`|UlCopyUrlGroupCounters|UlPcwCopyUrlGroupCounters| |`refcount`|3|2| |`length`|255|194| |`called`|WPP_SF_I
WPP_SF_iq
memset|memset| |`calling`|UlScGetSiteCounters
UlpPcwCollectInstances|UlpPcwCollectInstances| |paramcount|2|2| |`address`|140091e84|140134db8| |`sig`|undefined __fastcall UlCopyUrlGroupCounters(undefined4 * param_1, undefined4 * param_2)|undefined __fastcall UlPcwCopyUrlGroupCounters(undefined4 * param_1, undefined4 * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlCopyUrlGroupCounters Called Diff ```diff --- UlCopyUrlGroupCounters called +++ UlPcwCopyUrlGroupCounters called @@ -1,2 +0,0 @@ -WPP_SF_I -WPP_SF_iq ``` ### UlCopyUrlGroupCounters Calling Diff ```diff --- UlCopyUrlGroupCounters calling +++ UlPcwCopyUrlGroupCounters calling @@ -1 +0,0 @@ -UlScGetSiteCounters ``` ### UlCopyUrlGroupCounters Diff ```diff --- UlCopyUrlGroupCounters +++ UlPcwCopyUrlGroupCounters @@ -1,52 +1,48 @@ -void UlCopyUrlGroupCounters(undefined4 *param_1,undefined4 *param_2) +void UlPcwCopyUrlGroupCounters(undefined4 *param_1,undefined4 *param_2) { longlong *plVar1; - longlong lVar2; - ulonglong uVar3; + longlong *plVar2; + int iVar3; int iVar4; longlong lVar5; longlong lVar6; - int iVar7; + longlong lVar7; int iVar8; + ulonglong uVar9; - if ((DAT_0 & 8) != 0) { - WPP_SF_iq(0xab,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,param_1,param_2); - } memset(param_2,0,0x48); - lVar2 = 0; + plVar1 = (longlong *)(param_2 + 4); *param_2 = *param_1; + lVar5 = 0; param_2[8] = param_1[1]; param_2[9] = param_1[2]; param_2[10] = param_1[3]; if (**(uint **)(param_1 + 4) != 0) { - lVar5 = *(longlong *)(param_2 + 2); - uVar3 = (ulonglong)**(uint **)(param_1 + 4); - lVar6 = *(longlong *)(param_2 + 4); - iVar7 = param_2[0xb]; - iVar8 = param_2[0xc]; - iVar4 = param_2[0xd]; + lVar6 = *(longlong *)(param_2 + 2); + uVar9 = (ulonglong)**(uint **)(param_1 + 4); + lVar7 = *plVar1; + iVar8 = param_2[0xb]; + iVar4 = param_2[0xc]; + iVar3 = param_2[0xd]; do { - lVar2 = lVar2 + 8; - plVar1 = *(longlong **)(lVar2 + *(longlong *)(param_1 + 4)); - lVar5 = lVar5 + *plVar1; - *(longlong *)(param_2 + 2) = lVar5; - lVar6 = lVar6 + plVar1[1]; - *(longlong *)(param_2 + 4) = lVar6; - iVar7 = iVar7 + (int)plVar1[2]; - param_2[0xb] = iVar7; - iVar8 = iVar8 + *(int *)((longlong)plVar1 + 0x14); - param_2[0xc] = iVar8; - iVar4 = iVar4 + (int)plVar1[3]; - param_2[0xd] = iVar4; - uVar3 = uVar3 - 1; - } while (uVar3 != 0); + lVar5 = lVar5 + 8; + plVar2 = *(longlong **)(*(longlong *)(param_1 + 4) + lVar5); + lVar6 = lVar6 + *plVar2; + *(longlong *)(param_2 + 2) = lVar6; + lVar7 = lVar7 + plVar2[1]; + *plVar1 = lVar7; + iVar8 = iVar8 + (int)plVar2[2]; + param_2[0xb] = iVar8; + iVar4 = iVar4 + *(int *)((longlong)plVar2 + 0x14); + param_2[0xc] = iVar4; + iVar3 = iVar3 + (int)plVar2[3]; + param_2[0xd] = iVar3; + uVar9 = uVar9 - 1; + } while (uVar9 != 0); } - *(longlong *)(param_2 + 6) = *(longlong *)(param_2 + 2) + *(longlong *)(param_2 + 4); - if ((DAT_0 & 8) != 0) { - WPP_SF_I(0xac,&WPP_77486edebb5b31b450bd509a6f61e3ae_Traceguids,param_2); - } + *(longlong *)(param_2 + 6) = *(longlong *)(param_2 + 2) + *plVar1; return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## WPP_SF_qLqqqq ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.96| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|WPP_SF_qLqqqq|WPP_SF_qLqqqq| |fullname|WPP_SF_qLqqqq|WPP_SF_qLqqqq| |`refcount`|113|115| |length|119|119| |called|FastWppTraceMessage|FastWppTraceMessage| |`calling`|
Expand for full list:
UcCreateClientStreamIoctl
UcQueryClientStreamProperty
UlCheckRawResponseCompatibility
UlConnectionCleanupWorker
UlCopyRequestToBuffer
UlCopyRequestToIrp
UlDeclarePushIoctl
UlGetQuicCreationStatsV2Size
UlGetTransportIdleConnectionTimeout
UlHttpAttachConnection
UlHttpReceiveHeadersEventUlParsePushHeaderPairs
UlParsePushHeaderPairsOld
UlParseRequestHeaderPairs
UlParseRequestHeaderPairsOld
UlQueryChannelBindToken
UlQueryRequestProperty
UlReceiveClientCertIoctl
UlSendCacheEntryWorker
UlSendCachedResponse
UlSendEntityBodyIoctlOld
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendResponseOrEntityBodyFastIoOld
UlSetHttpConnectionTokenBinding
UlSetRequestProperty
UlSetTransportIdleConnectionTimeout
UlTransformResponseTail
UlpCompleteLogRecordW3C
UlpCopyDscpInfo
UlpCopyInitialPacketTtl
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestInformation
UlpCopyRequestToBuffer
UlpCopySslProtocolInfo
UlpCopyTcpInfoV2
UlpDeliverRequestStageInspection
UlpDeliverRequestStagePolicies
UlpEventRequestConnectionStats
UlpHkeAcquireQoS
UlpInitErrorLogInfo
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpLogErrorResposeSendEvent
UlpSendResponseOrEntityBodyFastIo
UxDuoAttachConnection
UxDuoConnectionControl
UxDuoExecuteDetach
UxDuoExecuteIoReady
UxDuoExecuteRetrieveClientCert
UxDuoSetTokenBinding
UxQuicCreateStream
UxQuicStreamInitiateHeadersSend
UxSslAttachConnection
UxSslConnectionControl
UxTlConnectionControl
UxpTpSetFlowOnConnection
switchD_140150f8e::caseD_b
|
Expand for full list:
UcCreateClientStreamIoctl
UcQueryClientStreamProperty
UlCheckRawResponseCompatibility
UlConnectionCleanupWorker
UlCopyRequestToBuffer
UlCopyRequestToIrp
UlDeclarePushIoctl
UlGetQuicCreationStatsV2Size
UlGetTransportIdleConnectionTimeout
UlHttpAttachConnection
UlHttpReceiveHeadersEventUlParsePushHeaderPairs
UlParsePushHeaderPairsOld
UlParseRequestHeaderPairs
UlParseRequestHeaderPairsOld
UlQueryChannelBindToken
UlQueryRequestProperty
UlReceiveClientCertIoctl
UlSendCacheEntryWorker
UlSendCachedResponse
UlSendEntityBodyIoctlOld
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendResponseOrEntityBodyFastIoOld
UlSetHttpConnectionTokenBinding
UlSetRequestProperty
UlSetTransportIdleConnectionTimeout
UlTransformResponseTail
UlpCompleteLogRecordW3C
UlpCopyDscpInfo
UlpCopyInitialPacketTtl
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestInformation
UlpCopyRequestToBuffer
UlpCopySslProtocolInfo
UlpCopyTcpInfoV2
UlpDeliverRequestStageInspection
UlpDeliverRequestStagePolicies
UlpEventRequestConnectionStats
UlpHkeAcquireQoS
UlpInitErrorLogInfo
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpLogErrorResposeSendEvent
UlpSendResponseOrEntityBodyFastIo
UxDuoAttachConnection
UxDuoConnectionControl
UxDuoExecuteDetach
UxDuoExecuteIoReady
UxDuoExecuteRetrieveClientCert
UxDuoSetTokenBinding
UxQuicCreateStream
UxQuicStreamInitiateHeadersSend
UxSslAttachConnection
UxSslConnectionControl
UxTlConnectionControl
UxpTpSetFlowOnConnection
switchD_1401516fa::caseD_b
| |paramcount|4|4| |address|1401a5238|1401a5238| |sig|undefined __fastcall WPP_SF_qLqqqq(undefined2 param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_qLqqqq(undefined2 param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_qLqqqq Calling Diff ```diff --- WPP_SF_qLqqqq calling +++ WPP_SF_qLqqqq calling @@ -59 +59 @@ -switchD_140150f8e::caseD_b +switchD_1401516fa::caseD_b ``` ## UlThreadPoolEnqueueWorkItem ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.77| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlThreadPoolEnqueueWorkItem|UlThreadPoolEnqueueWorkItem| |fullname|UlThreadPoolEnqueueWorkItem|UlThreadPoolEnqueueWorkItem| |`refcount`|212|213| |length|544|544| |called|
Expand for full list:
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExpInterlockedPushEntrySList
NTOSKRNL.EXE::IoQueueWorkItemEx
NTOSKRNL.EXE::KeGetCurrentProcessorNumberEx
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::ObfReferenceObjectWithTag
NTOSKRNL.EXE::PsGetCurrentServerSilo
NTOSKRNL.EXE::PsGetPermanentSiloContext
UlBugCheckEx
UlpAssignThreadPoolWork
WPP_SF_Ll
|
Expand for full list:
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExpInterlockedPushEntrySList
NTOSKRNL.EXE::IoQueueWorkItemEx
NTOSKRNL.EXE::KeGetCurrentProcessorNumberEx
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::ObfReferenceObjectWithTag
NTOSKRNL.EXE::PsGetCurrentServerSilo
NTOSKRNL.EXE::PsGetPermanentSiloContext
UlBugCheckEx
UlpAssignThreadPoolWork
WPP_SF_Ll
| |`calling`|
Expand for full list:
FUN_14001d0d0
FUN_140150dec
FUN_1401542fc
FUN_1401546e4
FUN_1401566de
FUN_14015da91
UcAbortConnection
UcAllocateStream
UcConnectionCancelIrp
UcQueryClientConnectionProperty
UcStartClientConnectionIoctlUcWaitForClientConnectionDisconnect
UcpCleanupClientSession
UcpCleanupConnection
UcpCreateClientSession
UcpStreamCancelIrp
UcpStreamIndicateFastForwardDetach
UcpStreamStartProcessFastForwardReceiveData
UlAddSite
UlAuthenticate
UlBuildCacheEntryWorker
UlCancelSendHttpResponse
UlCaptureHttpResponse
UlCaptureHttpResponseOld
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlCloseLogFile
UlCompleteWaitForDisconnects
UlConnectionCleanupWorker
UlDestroyCapturedResponse
UlDestroyLogDataBuffer
UlEgressDisconnectCompletion
UlExecuteLazyAuthInitialization
UlFastSendCompleteWorker
UlFastSendHttpResponse
UlFastSendHttpResponseOld
UlFreeBuildTracker
UlFreeHttpConnection
UlGenericLogTimerDpcRoutine
UlHttpAttachConnection
UlHttpDetachConnection
UlHttpIngressDisconnectEvent
UlInvokeCompletionRoutine
UlLogZombieConnection
UlNotifyIPListenListChanges
UlPeriodicAuthCacheScavenger
UlProcessResponseInfo
UlPurgeZombieConnections
UlQueryRequestProperty
UlQueueLoggingRoutine
UlReceiveClientCertIoctl
UlRemoveSendIrpCancelRoutine
UlRestartFastSendHttpResponse
UlRestartSendHttpResponseIoctl
UlResumeParsing
UlSendCacheEntryWorker
UlSendEntityBodyIoctlOld
UlSendHttpResponse
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendRangeCacheEntry
UlSetRequestProperty
UlSetSendIrpCancelRoutine
UlStopHttpIdealBacklogFastForwarderNotification
UlUnlinkHkeContext
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlWaitForDisconnectIoctl
UlpAuthenticateRequest
UlpCancelEntityBody
UlpCancelWaitForDisconnectIrp
UlpCleanupCoupling
UlpCleanupZombieHttpConnection
UlpCloseConnectionWorker
UlpCompleteCacheSliceBuild
UlpCompleteFailedFastForwardResponse
UlpCompleteFailedFastForwardResponseWorker
UlpCompleteSendErrorResponse
UlpCompleteSendResponseToExtension
UlpCompleteSendToExtensionWorker
UlpConnectionDisconnectWorker
UlpCreateHttpRequest
UlpDereferenceBundle
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFilteredFlushUriCache
UlpFreeAuthCacheEntry
UlpFreeCoupling
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpHandleRequest
UlpHttpIdealBacklogFastForwarderNotification
UlpLockRequestQueueAndCoupling
UlpMetronomeDpcRoutine
UlpNotifyEdgePolicyChange
UlpNotifyEdgePolicyChangeForUrl
UlpRestartAddFragmentToCache
UlpRestartCacheMdlRead
UlpRestartFastForwardSend
UlpResumeParsingWorker
UlpSendCacheEntry
UlpSendErrorResponse
UlpSendFastForwardDataContext
UlpSendHttpResponseRegular
UlpSendResponseToExtension
UlpSendSimpleStatusWorker
UlpTerminateZombieList
UlpWriteEventStatsWorker
UlpWriteStatsOnEgressDisconnect
UxDuoExecuteStreamDisconnect
UxDuoFreeJob
UxFileEntryRequest
UxInvokeCompletionRoutine
UxQuicCloseListener
UxQuicConnectionAcceptStream
UxQuicConnectionDecoder
UxQuicConnectionEncoder
UxQuicConnectionIndicatePush
UxQuicConnectionProcessPush
UxQuicConnectionStartPushStream
UxQuicCreateConnection
UxQuicCreateSession
UxQuicCreateStream
UxQuicFreeConnection
UxQuicFreeDecodeTracker
UxQuicFreeSendTracker
UxQuicFreeSession
UxQuicFreeStream
UxQuicResetEndpointConnections
UxQuicStreamCompleteHeadersDecode
UxQuicStreamDetachComplete
UxQuicStreamInitiateReceive
UxQuicStreamSendDestroyContext
UxSslAcquireCredentialsHandleLookupCallback
UxSslAttachConnection
UxSslCompleteRetrieveIrp
UxSslFreeAchContext
UxSslFreeAscContext
UxSslFreeConnection
UxSslQueueReceiverWorkItemEx
UxSslReleaseEndpointConfiguration
UxSslRestartSendRawData
UxSslRetrieveClientCertificate
UxSslScavengeCertificate
UxTlDestroyConnection
UxTlDestroyConnectionWorker
UxTlDisconnectCompletion
UxWfpFreeThrottleContext
UxpQuicAbortStreamList
UxpQuicCleanupEndpointLookupInfo
UxpQuicCompleteEncodeTracker
UxpQuicConfigurationLoadComplete
UxpQuicConnectionProcessCancelPush
UxpQuicConnectionQueueDecoder
UxpQuicConnectionQueueEncoder
UxpQuicConnectionShutdownComplete
UxpQuicDecodeControlStreamCallbackHandler
UxpQuicEncodeControlStreamCallbackHandler
UxpQuicFreeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicSendControlStreamCallbackHandler
UxpQuicStreamAbortSends
UxpQuicStreamCallbackEpilog
UxpQuicStreamDetach
UxpQuicStreamProcessReceiveWorkItem
UxpQuicStreamPushStartComplete
UxpQuicStreamQueueEncodeHeaders
UxpQuicStreamStartDrain
UxpRestartReadFileEntry
UxpSslFreeRegistration
UxpSslLoadCertificateSync
UxpTlCloseAddressEndpoint
UxpTlCloseListenEndpoint
UxpTlCreateListenEndpoint
UxpTpDequeueTransmitPacket
UxpTpFlushMdlRuns
UxpTpFreeBufferTracker
UxpTpFreeFileMdlRun
UxpTpFreeTransmitPacket
UxpTpRestartBufferSend
UxpTpRestartFastTransmit
UxpTpRestartMdlProbe
UxpTpRestartMdlReadExtension
UxpWfpQuicConnectionClassifyCompletion
UxpWfpSslConnectionClassifyCompletion
UxpWskQosNotifyDetachProvider
UxpWskSendCompletion
|
Expand for full list:
FUN_14001d1b0
FUN_140151558
FUN_140154a68
FUN_140154e50
FUN_140156e4a
FUN_14015d741
UcAbortConnection
UcAllocateStream
UcConnectionCancelIrp
UcQueryClientConnectionProperty
UcStartClientConnectionIoctlUcWaitForClientConnectionDisconnect
UcpCleanupClientSession
UcpCleanupConnection
UcpCreateClientSession
UcpStreamCancelIrp
UcpStreamIndicateFastForwardDetach
UcpStreamStartProcessFastForwardReceiveData
UlAddSite
UlAuthenticate
UlBuildCacheEntryWorker
UlCancelSendHttpResponse
UlCaptureHttpResponse
UlCaptureHttpResponseOld
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlCloseLogFile
UlCompleteWaitForDisconnects
UlConnectionCleanupWorker
UlDestroyCapturedResponse
UlDestroyLogDataBuffer
UlEgressDisconnectCompletion
UlExecuteLazyAuthInitialization
UlFastSendCompleteWorker
UlFastSendHttpResponse
UlFastSendHttpResponseOld
UlFreeBuildTracker
UlFreeHttpConnection
UlGenericLogTimerDpcRoutine
UlHttpAttachConnection
UlHttpDetachConnection
UlHttpIngressDisconnectEvent
UlInvokeCompletionRoutine
UlLogZombieConnection
UlNotifyIPListenListChanges
UlPeriodicAuthCacheScavenger
UlProcessResponseInfo
UlPurgeZombieConnections
UlQueryRequestProperty
UlQueueLoggingRoutine
UlReceiveClientCertIoctl
UlRemoveSendIrpCancelRoutine
UlRestartFastSendHttpResponse
UlRestartSendHttpResponseIoctl
UlResumeParsing
UlSendCacheEntryWorker
UlSendEntityBodyIoctlOld
UlSendHttpResponse
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendRangeCacheEntry
UlSetRequestProperty
UlSetSendIrpCancelRoutine
UlStopHttpIdealBacklogFastForwarderNotification
UlUnlinkHkeContext
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlWaitForDisconnectIoctl
UlpAuthenticateRequest
UlpCancelEntityBody
UlpCancelWaitForDisconnectIrp
UlpCleanupCoupling
UlpCleanupZombieHttpConnection
UlpCloseConnectionWorker
UlpCompleteCacheSliceBuild
UlpCompleteFailedFastForwardResponse
UlpCompleteFailedFastForwardResponseWorker
UlpCompleteSendCacheEntryWorker
UlpCompleteSendErrorResponse
UlpCompleteSendResponseToExtension
UlpCompleteSendToExtensionWorker
UlpConnectionDisconnectWorker
UlpCreateHttpRequest
UlpDereferenceBundle
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFilteredFlushUriCache
UlpFreeAuthCacheEntry
UlpFreeCoupling
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpHandleRequest
UlpHttpIdealBacklogFastForwarderNotification
UlpLockRequestQueueAndCoupling
UlpMetronomeDpcRoutine
UlpNotifyEdgePolicyChange
UlpNotifyEdgePolicyChangeForUrl
UlpRestartAddFragmentToCache
UlpRestartCacheMdlRead
UlpRestartFastForwardSend
UlpResumeParsingWorker
UlpSendCacheEntry
UlpSendErrorResponse
UlpSendFastForwardDataContext
UlpSendHttpResponseRegular
UlpSendResponseToExtension
UlpSendSimpleStatusWorker
UlpTerminateZombieList
UlpWriteEventStatsWorker
UlpWriteStatsOnEgressDisconnect
UxDuoExecuteStreamDisconnect
UxDuoFreeJob
UxFileEntryRequest
UxInvokeCompletionRoutine
UxQuicCloseListener
UxQuicConnectionAcceptStream
UxQuicConnectionDecoder
UxQuicConnectionEncoder
UxQuicConnectionIndicatePush
UxQuicConnectionProcessPush
UxQuicConnectionStartPushStream
UxQuicCreateConnection
UxQuicCreateSession
UxQuicCreateStream
UxQuicFreeConnection
UxQuicFreeDecodeTracker
UxQuicFreeSendTracker
UxQuicFreeSession
UxQuicFreeStream
UxQuicResetEndpointConnections
UxQuicStreamCompleteHeadersDecode
UxQuicStreamDetachComplete
UxQuicStreamInitiateReceive
UxQuicStreamSendDestroyContext
UxSslAcquireCredentialsHandleLookupCallback
UxSslAttachConnection
UxSslCompleteRetrieveIrp
UxSslFreeAchContext
UxSslFreeAscContext
UxSslFreeConnection
UxSslQueueReceiverWorkItemEx
UxSslReleaseEndpointConfiguration
UxSslRestartSendRawData
UxSslRetrieveClientCertificate
UxSslScavengeCertificate
UxTlDestroyConnection
UxTlDestroyConnectionWorker
UxTlDisconnectCompletion
UxWfpFreeThrottleContext
UxpQuicAbortStreamList
UxpQuicCleanupEndpointLookupInfo
UxpQuicCompleteEncodeTracker
UxpQuicConfigurationLoadComplete
UxpQuicConnectionProcessCancelPush
UxpQuicConnectionQueueDecoder
UxpQuicConnectionQueueEncoder
UxpQuicConnectionShutdownComplete
UxpQuicDecodeControlStreamCallbackHandler
UxpQuicEncodeControlStreamCallbackHandler
UxpQuicFreeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicSendControlStreamCallbackHandler
UxpQuicStreamAbortSends
UxpQuicStreamCallbackEpilog
UxpQuicStreamDetach
UxpQuicStreamProcessReceiveWorkItem
UxpQuicStreamPushStartComplete
UxpQuicStreamQueueEncodeHeaders
UxpQuicStreamStartDrain
UxpRestartReadFileEntry
UxpSslFreeRegistration
UxpSslLoadCertificateSync
UxpTlCloseAddressEndpoint
UxpTlCloseListenEndpoint
UxpTlCreateListenEndpoint
UxpTpDequeueTransmitPacket
UxpTpFlushMdlRuns
UxpTpFreeBufferTracker
UxpTpFreeFileMdlRun
UxpTpFreeTransmitPacket
UxpTpRestartBufferSend
UxpTpRestartFastTransmit
UxpTpRestartMdlProbe
UxpTpRestartMdlReadExtension
UxpWfpQuicConnectionClassifyCompletion
UxpWfpSslConnectionClassifyCompletion
UxpWskQosNotifyDetachProvider
UxpWskSendCompletion
| |paramcount|6|6| |`address`|14001db20|14001dc00| |sig|ulonglong __fastcall UlThreadPoolEnqueueWorkItem(int param_1, longlong param_2, undefined8 param_3, char param_4, longlong param_5, uint param_6)|ulonglong __fastcall UlThreadPoolEnqueueWorkItem(int param_1, longlong param_2, undefined8 param_3, char param_4, longlong param_5, uint param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlThreadPoolEnqueueWorkItem Calling Diff ```diff --- UlThreadPoolEnqueueWorkItem calling +++ UlThreadPoolEnqueueWorkItem calling @@ -1,6 +1,6 @@ -FUN_14001d0d0 -FUN_140150dec -FUN_1401542fc -FUN_1401546e4 -FUN_1401566de -FUN_14015da91 +FUN_14001d1b0 +FUN_140151558 +FUN_140154a68 +FUN_140154e50 +FUN_140156e4a +FUN_14015d741 @@ -77,0 +78 @@ +UlpCompleteSendCacheEntryWorker ``` ## WPP_SF_qDL ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.95| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|WPP_SF_qDL|WPP_SF_qDL| |fullname|WPP_SF_qDL|WPP_SF_qDL| |`refcount`|106|105| |length|77|77| |called|FastWppTraceMessage|FastWppTraceMessage| |`calling`|
Expand for full list:
FUN_14015b63c
HkAddPairToTable
HkDecodeLiteral
HkEncode
HkEncodeString
HkExpandStorage
HkTrimTable
HttpCopyUrl
HttpUnescapePercentHexEncoding
HttppPopCharAbsPathUtf8
QkDecodeControlQkDecodeData
QkEncodeLiteral
QkEncodeString
QkEncodeStringPrefix
QkExpandStorage
QkResetStorage
UcSetStreamReceiveState
UcStreamTimeout
UcpCopyClientSessionProcessesInfo
UlCopyAllCacheEntryInfo
UlCopyContentType
UlCopyQosSettingInfo
UlDeliverEntityBody
UlDisableBundleTimer
UlEnableBundleTimer
UlFastReceiveHttpRequest
UlGenerateMultipleKnownHeadersOld
UlGenerateSubdomainWildcardUrl
UlGenerateTransferChunkingChunks
UlGetServerSessionProperty
UlQueryConfigGroupProperty
UlQueryRequestProperty
UlQuerySettingConfiguration
UlReadFragmentFromCache
UlResetBundleTimer
UlScGetGlobalCounters
UlScGetSiteCounters
UlStopRequestQueueTimer
UlUpdateClientStreamReceiveLimit
UlpCopyRegisteredUrl
UlpCopyRequestQueueProcessesInfo
UlpCreateFastForwardDataContext
UlpCreateFastForwardDataContextBuffer
UlpFindWSToken
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpMergeSlicesToCache
UlpParseNextRequest
UlpSynchronizeLanesWorker
UxDuoAllocateStream
UxDuoExecuteRunnerCompletion
UxGetOutputBufferForMethodNeither
UxQuicBufferInitialize
UxQuicConnectionTimeout
UxQuicSetConnectionState
UxQuicSetTransportIdleConnectionTimeout
UxQuicStreamAbort
UxSslConnectionTimeout
UxSslParseSni
UxSslQueueReceiverWorkItemEx
UxSslSetEndpointLookupState
UxTlCleanupConnection
UxTlDisconnectEvent
UxWfpConnectionClassify
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicParseAndCopyDataIndication
UxpQuicStreamAbortLocked
UxpQuicStreamShutdownComplete
UxpSslCleanupConnection
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointParseSni
UxpSslEndpointThrottleHandler
UxpSslEndpointWaitForThrottleHandler
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindSniHandler
UxpSslGetAlpnExtension
UxpSslInitiateAscHandler
UxpSslLogHandshakeFailure
UxpSslReceiver
UxpSslSetConnectionState
|
Expand for full list:
FUN_14015b4c2
HkAddPairToTable
HkDecodeLiteral
HkEncode
HkEncodeString
HkExpandStorage
HkTrimTable
HttpCopyUrl
HttpUnescapePercentHexEncoding
HttppPopCharAbsPathUtf8
QkDecodeControlQkDecodeData
QkEncodeLiteral
QkEncodeString
QkEncodeStringPrefix
QkExpandStorage
QkResetStorage
UcSetStreamReceiveState
UcStreamTimeout
UcpCopyClientSessionProcessesInfo
UlCopyAllCacheEntryInfo
UlCopyContentType
UlCopyQosSettingInfo
UlDeliverEntityBody
UlDisableBundleTimer
UlEnableBundleTimer
UlFastReceiveHttpRequest
UlGenerateMultipleKnownHeadersOld
UlGenerateSubdomainWildcardUrl
UlGenerateTransferChunkingChunks
UlGetServerSessionProperty
UlQueryConfigGroupProperty
UlQueryRequestProperty
UlQuerySettingConfiguration
UlReadFragmentFromCache
UlResetBundleTimer
UlScGetGlobalCounters
UlScGetSiteCounters
UlStopRequestQueueTimer
UlUpdateClientStreamReceiveLimit
UlpCopyRegisteredUrl
UlpCopyRequestQueueProcessesInfo
UlpCreateFastForwardDataContext
UlpCreateFastForwardDataContextBuffer
UlpFindWSToken
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpMergeSlicesToCache
UlpParseNextRequest
UlpSynchronizeLanesWorker
UxDuoAllocateStream
UxDuoExecuteRunnerCompletion
UxGetOutputBufferForMethodNeither
UxQuicBufferInitialize
UxQuicConnectionTimeout
UxQuicSetConnectionState
UxQuicSetTransportIdleConnectionTimeout
UxQuicStreamAbort
UxSslConnectionTimeout
UxSslParseSni
UxSslQueueReceiverWorkItemEx
UxSslSetEndpointLookupState
UxTlCleanupConnection
UxTlDisconnectEvent
UxWfpConnectionClassify
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicParseAndCopyDataIndication
UxpQuicStreamAbortLocked
UxpQuicStreamShutdownComplete
UxpSslCleanupConnection
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointParseSni
UxpSslEndpointThrottleHandler
UxpSslEndpointWaitForThrottleHandler
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindSniHandler
UxpSslGetAlpnExtension
UxpSslLogHandshakeFailure
UxpSslReceiver
UxpSslSetConnectionState
| |paramcount|4|4| |`address`|1401b8fb0|1401b8f90| |sig|undefined __fastcall WPP_SF_qDL(undefined2 param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_qDL(undefined2 param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_qDL Calling Diff ```diff --- WPP_SF_qDL calling +++ WPP_SF_qDL calling @@ -1 +1 @@ -FUN_14015b63c +FUN_14015b4c2 @@ -81 +80,0 @@ -UxpSslInitiateAscHandler ``` ## UxpPktMonNtStatusToDropReason ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxpPktMonNtStatusToDropReason|UxpPktMonNtStatusToDropReason| |fullname|UxpPktMonNtStatusToDropReason|UxpPktMonNtStatusToDropReason| |`refcount`|5|6| |length|208|208| |called||| |`calling`|UxPktMonTraceDropHttpReceiveWithError
UxPktMonTraceDropHttpSend
UxPktMonTraceDropSslWithNtStatus
UxPktMonTraceQuicDropSslWithNtStatus|UxPktMonTraceDropHttpReceiveWithError
UxPktMonTraceDropHttpSend
UxPktMonTraceDropSslWithNtStatus
UxPktMonTraceQuicDropSslWithNtStatus
UxpSslInitiateAscHandler| |paramcount|1|1| |`address`|1401378e0|1401380b0| |sig|undefined8 __fastcall UxpPktMonNtStatusToDropReason(int param_1)|undefined8 __fastcall UxpPktMonNtStatusToDropReason(int param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxpPktMonNtStatusToDropReason Calling Diff ```diff --- UxpPktMonNtStatusToDropReason calling +++ UxpPktMonNtStatusToDropReason calling @@ -4,0 +5 @@ +UxpSslInitiateAscHandler ``` ## NTOSKRNL.EXE::KeSetEvent ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|KeSetEvent|KeSetEvent| |fullname|NTOSKRNL.EXE::KeSetEvent|NTOSKRNL.EXE::KeSetEvent| |`refcount`|90|89| |length|0|0| |called||| |`calling`|
Expand for full list:
FUN_140162748
TlgAggregateInternalFlushWorkItemRoutineKernelMode
UcpStartClientStreamCompletion
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlDestroyCapturedResponse
UlFreeBuildTracker
UlFreeHttpConnection
UlHttpIngressDisconnectEvent
UlLazyAuthInitializationWorker
UlPmAssociateTlConnectionUlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendCachedResponse
UlSendSimpleStatus
UlStopScavenger2Module
UlThreadPoolEnqueueWorkItem
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpDeferredAddSiteWorker
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpInitializeThreadPoolWorkers
UlpLockRequestQueueAndCoupling
UlpLogBufferWriteCompletion
UlpPmAssociateConnection
UlpPmDisassociateConnection
UlpQueueFreeHttpRequest
UlpQueueLoggingRoutineWorker
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UlpTerminateThreadPoolWorkersLocked
UlpTimerWheelWorker
UlpTransformAndQueueRequestBuffers
UxDuoAttachConnection
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteRunnerCompletion
UxDuoFreeConnection
UxDuoScheduleStreamSends
UxPodDereferenceSilo
UxPodSiloTerminateCallback
UxQuicLoadCertificateWorker
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxSslFreeConnection
UxSslQueueReceiverWorkItemEx
UxSslRestartSendRawData
UxTlDestroyConnection
UxTlDestroyConnectionWorker
UxTlDestroyListenEndpoint
UxTlNotifyEdgePolicyChange
UxTlSynchronousIrpComplete
UxTlUpdateListenAddressList
UxWskQosDereferenceFlow
UxpQuicConfigurationLoadComplete
UxpRestartReadCompleteFileEntry
UxpSslAcquireCredentialsHandleCreationCallback
UxpSslCleanupConnection
UxpSslLoadCertificateWorker
UxpSslReceiver
UxpSslReceiverWorker
UxpTlDestroyAddressEndpoint
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
UxpTpRestartMdlRead
UxpTpRestartMdlSend
__MsQuicClientAttachProvider
|
Expand for full list:
FUN_140162a34
TlgAggregateInternalFlushWorkItemRoutineKernelMode
UcpStartClientStreamCompletion
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlDestroyCapturedResponse
UlFreeBuildTracker
UlFreeHttpConnection
UlHttpIngressDisconnectEvent
UlLazyAuthInitializationWorker
UlPmAssociateTlConnectionUlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendCachedResponse
UlSendSimpleStatus
UlStopScavenger2Module
UlThreadPoolEnqueueWorkItem
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpDeferredAddSiteWorker
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpInitializeThreadPoolWorkers
UlpLockRequestQueueAndCoupling
UlpLogBufferWriteCompletion
UlpPmAssociateConnection
UlpPmDisassociateConnection
UlpQueueFreeHttpRequest
UlpQueueLoggingRoutineWorker
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UlpTerminateThreadPoolWorkersLocked
UlpTimerWheelWorker
UlpTransformAndQueueRequestBuffers
UxDuoAttachConnection
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteRunnerCompletion
UxDuoFreeConnection
UxDuoScheduleStreamSends
UxPodDereferenceSilo
UxPodSiloTerminateCallback
UxQuicLoadCertificateWorker
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxSslFreeConnection
UxSslQueueReceiverWorkItemEx
UxSslRestartSendRawData
UxTlDestroyConnection
UxTlDestroyConnectionWorker
UxTlDestroyListenEndpoint
UxTlNotifyEdgePolicyChange
UxTlSynchronousIrpComplete
UxTlUpdateListenAddressList
UxWskQosDereferenceFlow
UxpQuicConfigurationLoadComplete
UxpRestartReadCompleteFileEntry
UxpSslAcquireCredentialsHandleCreationCallback
UxpSslCleanupConnection
UxpSslLoadCertificateWorker
UxpSslReceiver
UxpSslReceiverWorker
UxpTlDestroyAddressEndpoint
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
UxpTpRestartMdlRead
UxpTpRestartMdlSend
__MsQuicClientAttachProvider
| |paramcount|0|0| |address|EXTERNAL:000000fe|EXTERNAL:000000fe| |sig|undefined KeSetEvent(void)|undefined KeSetEvent(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeSetEvent Calling Diff ```diff --- NTOSKRNL.EXE::KeSetEvent calling +++ NTOSKRNL.EXE::KeSetEvent calling @@ -1 +1 @@ -FUN_140162748 +FUN_140162a34 ``` ## UlProbeForRead ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.81| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlProbeForRead|UlProbeForRead| |fullname|UlProbeForRead|UlProbeForRead| |`refcount`|88|87| |length|188|188| |called|NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::ExRaiseStatus
WPP_SF_PqLc|NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::ExRaiseStatus
WPP_SF_PqLc| |calling|
Expand for full list:
UcpCaptureUserPairs32
UlAddFragmentToCache
UlCancelHttpRequest
UlCaptureChannelBindConfigOld
UlComputeFixedHeaderSizeNew
UlComputeFixedHeaderSizeOld
UlComputeMultipleKnownHeaderSizeOld
UlComputeTrailersSize
UlControlService
UlCopyChannelBindConfigFromPropertyInfo
UlCopyServiceBindingsUlExtractAndAppendAuthenticationResponseInfo
UlFastSendHttpResponseOld
UlFlCaptureFlowRateInfo
UlFlCaptureFlowRateInfoOld
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateTrailers
UlGetServiceBindingInfo
UlGetServiceBindingInfo32
UlProbeWideString
UlReadFragmentFromCache
UlResponseInfoParsing
UlSendHttpResponseIoctlOld
UlSendResponseOrEntityBodyFastIoOld
UlpCalculateAuthHeaderSize
UlpCalculateSizeOfSingleMultipleHeader
UlpCopyLogInfo32
UlpCopySendInfo32
UlpCopySingleMultipleHeader
UlpCopyUserDataToFastTracker
UlpGetAuthInfoNew
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpGetLogInfoOld
UlpGetMultipleKnownHeader
UlpGetResponseInfo
UlpGetSendInfoOld
UlpHandleAuthHeader
UlpProbeChunks
UlpProbeLogDataAndChunksOld
UlpWriteUnknownHeaders
UxCaptureWideStringZ
UxCopyTrailersChunk32
UxTryProbeForRead
|
Expand for full list:
UcpCaptureUserPairs32
UlAddFragmentToCache
UlCancelHttpRequest
UlCaptureChannelBindConfigOld
UlComputeFixedHeaderSizeNew
UlComputeFixedHeaderSizeOld
UlComputeMultipleKnownHeaderSizeOld
UlComputeTrailersSize
UlControlService
UlCopyChannelBindConfigFromPropertyInfo
UlCopyServiceBindingsUlExtractAndAppendAuthenticationResponseInfo
UlFastSendHttpResponseOld
UlFlCaptureFlowRateInfo
UlFlCaptureFlowRateInfoOld
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateTrailers
UlGetServiceBindingInfo
UlGetServiceBindingInfo32
UlProbeWideString
UlReadFragmentFromCache
UlResponseInfoParsing
UlSendHttpResponseIoctlOld
UlSendResponseOrEntityBodyFastIoOld
UlpCalculateAuthHeaderSize
UlpCalculateSizeOfSingleMultipleHeader
UlpCopyLogInfo32
UlpCopySendInfo32
UlpCopySingleMultipleHeader
UlpCopyUserDataToFastTracker
UlpGetAuthInfoNew
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpGetLogInfoOld
UlpGetMultipleKnownHeader
UlpGetResponseInfo
UlpGetSendInfoOld
UlpHandleAuthHeader
UlpProbeChunks
UlpProbeLogDataAndChunksOld
UlpWriteUnknownHeaders
UxCaptureWideStringZ
UxCopyTrailersChunk32
UxTryProbeForRead
| |paramcount|4|4| |`address`|140067c30|140062cb0| |sig|undefined __fastcall UlProbeForRead(ulonglong param_1, longlong param_2, int param_3, char param_4)|undefined __fastcall UlProbeForRead(ulonglong param_1, longlong param_2, int param_3, char param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## wil_details_FeatureReporting_IncrementUsageInCache ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|length,address| |ratio|1.0| |i_ratio|0.79| |m_ratio|0.97| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_IncrementUsageInCache|wil_details_FeatureReporting_IncrementUsageInCache| |fullname|wil_details_FeatureReporting_IncrementUsageInCache|wil_details_FeatureReporting_IncrementUsageInCache| |refcount|2|2| |`length`|230|220| |called||| |calling|wil_details_FeatureReporting_RecordUsageInCache|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4|4| |`address`|1400b713c|1400b7830| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## memcpy ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|memcpy|memcpy| |fullname|memcpy|memcpy| |`refcount`|380|381| |length|537|537| |called||| |`calling`|
Expand for full list:
CreateNewEventEntry
FUN_14000cbb0
FUN_140157028
FUN_1401582ca
FUN_14015bf9e
FUN_14015c52c
FUN_14015fb0f
FUN_140160512
FUN_140160fd8
FUN_140162fda
HkAddPairToTableHkDecode
HkDecodeLiteral
HkDecodingEmitterAppendPair
HkEmitBuffer
HkEncode
HkEncodeString
HkExpandEncodingEmitter
HkExpandStorage
HttpValidateHostname
HttppFixParsedUrl
HttppValidateIpv6Hostname
InitializeTelemetryAssertsKM
InitializeTelemetryAssertsKMWorkerInternal
QkAllocateElement
QkEmitBuffer
QkExpandEncodingEmitter
QkExpandRefArray
QkExpandStorage
TraceFilterEngineStoreFilterRulesInternal
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcQueryClientStreamProperty
UcStreamCopyReceiveList
UcpCaptureUserPairs32
UcpCopyBufferToUser
UcpCopyHeaderPairsToUser
UlAddServiceNameToContainer
UlAdjustRangesToContentSize
UlAllocateWideString
UlAppendHeaderValue
UlAuthCopyKnownAuthHeaderToBuffer
UlAuthCopyUnconfiguredAuthHeaderToBuffer
UlBufferWriterAlign
UlBufferWriterWrite
UlBuildLogHeader
UlBuildPushRequestHeaders
UlCaptureRawLogData
UlCaptureWideString
UlContentRangeHeaderHandler
UlCopyAuthConfigProperty
UlCopyAuthConfigToIrp
UlCopyAuthHeader
UlCopyChannelBindConfigToIrp
UlCopyHttpVerb
UlCopyLogDataToCache
UlCopyLoggingProperty
UlCopyParsedHeaders
UlCopyUserAuthInfo
UlCopyUserChannelBindInfo
UlCopyUserTokenBindingInfo
UlCreateCacheEntryFromResponse
UlCreateConsumerHelper
UlDeepCopyParsedHeaders
UlEventLogCreateFailure
UlFastSendHttpResponseOld
UlFlushCacheByUri
UlGenerateDateHeader
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateRoutingToken
UlGenerateSingleVariableHeaders
UlGenerateTrailers
UlGenerateVariableHeaders
UlGetDateTimeFields
UlGetServerHeader
UlGetTypeAndSubType
UlHkeBuilderCopyFixedHeaders
UlHkeBuilderQueryKnownHeader
UlHkeBuilderQueryUnknownHeader
UlLogHttpError
UlPrepareUrlIoctl
UlQueryKnownRequestHeader
UlQueryRequestProperty
UlQueryUnknownRequestHeader
UlReadFragmentFromCache
UlReadStringParameter
UlRefreshFileName
UlReplaceHeaderValue
UlSendSimpleStatus
UlSerializeTrailers
UlWriteEventLogEntry
UlpAddIpAddressToList
UlpAiPopulateAddressList
UlpAllocateAuthCacheEntry
UlpBufferWriterUpdate
UlpBuildErrorLogRecord
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildUriKeyFromCookedUrl
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCaptureSoftwareDirective
UlpCompleteAuthInfo
UlpCompleteLogRecordETW
UlpCompleteLogRecordIIS
UlpCompleteLogRecordNCSA
UlpCompleteLogRecordW3C
UlpCopyCacheEntryInfo
UlpCopyChannelBindTokenToIrp
UlpCopyConfigGroupInfo
UlpCopyIndicatedData
UlpCopyQuicStatsV2
UlpCopyRegisteredUrl
UlpCopyRequestQueueInfo
UlpCopyRequestToBuffer
UlpCopySingleMultipleHeader
UlpCopyString
UlpCopyUrl
UlpCopyUserDataToFastTracker
UlpCreateTargetServiceName
UlpDeleteIpAddressFromList
UlpDigestFastAuthenticator
UlpDuplicateSliceTrackerForCache
UlpFastAuthenticate
UlpFixupIISLogRecord
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpGenerateBoundaryChunk
UlpGenerateCommonBoundaryBuffer
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpHkeBuilderAddKnownHeader
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpHkeCopyKnownHeader
UlpLogSpecificInitFailure
UlpMergeBuffers
UlpParseNextRequest
UlpPrepare200Response
UlpPrepareOutputToken
UlpRawCopyForLogCacheHit
UlpRawCopyForLogCacheMiss
UlpRewriteLogRecord
UlpSanitizeResponseHeaders
UlpSanitizeTrailerHeaders
UlpSetRequestQueueExternalId
UlpSspiAuthenticationHandler
UlpTreeFindWildcardSite
UlpTreeFreeNode
UlpTreeInsertEntry
UlpUpdateReservationInRegistry
UlpWriteServerHeader
UlpWriteSingleHeader
UlpWriteToErrorLogFileDebug
UlpWriteToErrorLogFileExclusive
UlpWriteToLogFileDebug
UlpWriteToLogFileExclusive
UlpWriteToLogFileShared
UxAllocateBufferedMdl
UxAppendCopyToAggregator
UxAppendToExbuffer
UxCaptureString
UxCaptureUserMemory
UxCaptureWideString
UxCopyMdlChainToMdlChain
UxDuoBeginFullFrameParse
UxDuoBuildContinuationChain
UxDuoDispatchAltSvcParcel
UxDuoParse
UxDuoParseCatalog
UxDuoParseSettings
UxDuoParseWindowUpdate
UxGenerateSubdomainWildcardHostname
UxIpv4AddressToStringExW
UxIpv6AddressToStringExW
UxQuicBufferAddData
UxQuicBufferShiftData
UxQuicConnectionCopyBindings
UxQuicConnectionGetPeerIssuerListClient
UxQuicConnectionGetStatsV2
UxQuicPreParser
UxQuicSetSessionKeys
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslCopyConfigurationProperties
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCopySniToRequestProperty
UxSslGetAltSvcInfo
UxSslGetCertInfo
UxSslInitializeClientCertPolicy
UxSslInitiateSend
UxSslParseTlsRestrictions
UxSslReadConfigurationPropertiesFromUser
UxSslReadExtendedConfigurationPropertiesFromUser
UxTryCopyUserMemory
UxWskAcceptEvent
UxpDuoCaptureHostName
UxpQuicBufferExpandBuffer
UxpQuicConnectionCopyCertBlob
UxpQuicConnectionCopyIssuerList32
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicCreateCustomAlpnArray
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicParseAndCopyDataIndication
UxpQuicQueryConnectionInfo
UxpQuicStreamGetStats
UxpQuicUnknownStreamReceiveEvent
UxpSslCommonSendData
UxpSslCommonSendDataHelper
UxpSslCopyCertificateParam
UxpSslCopySniForEtwFiltering
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslExpandTransportDataIndication
UxpSslGetClientCertInfo
UxpSslGetClientHello
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslProcessRenegotiateRecord
UxpSslReadConfigurationPropertiesFromRegistry
WppTraceCallback
|
Expand for full list:
CreateNewEventEntry
FUN_14000cc90
FUN_140157626
FUN_140158150
FUN_14015be24
FUN_14015c3b2
FUN_140160147
FUN_140160846
FUN_1401612c4
FUN_1401632c6
HkAddPairToTableHkDecode
HkDecodeLiteral
HkDecodingEmitterAppendPair
HkEmitBuffer
HkEncode
HkEncodeString
HkExpandEncodingEmitter
HkExpandStorage
HttpValidateHostname
HttppFixParsedUrl
HttppValidateIpv6Hostname
InitializeTelemetryAssertsKM
InitializeTelemetryAssertsKMWorkerInternal
QkAllocateElement
QkEmitBuffer
QkExpandEncodingEmitter
QkExpandRefArray
QkExpandStorage
TraceFilterEngineStoreFilterRulesInternal
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcQueryClientStreamProperty
UcStreamCopyReceiveList
UcpCaptureUserPairs32
UcpCopyBufferToUser
UcpCopyHeaderPairsToUser
UlAddServiceNameToContainer
UlAdjustRangesToContentSize
UlAllocateWideString
UlAppendHeaderValue
UlAuthCopyKnownAuthHeaderToBuffer
UlAuthCopyUnconfiguredAuthHeaderToBuffer
UlBufferWriterAlign
UlBufferWriterWrite
UlBuildLogHeader
UlBuildPushRequestHeaders
UlCaptureRawLogData
UlCaptureWideString
UlContentRangeHeaderHandler
UlCopyAuthConfigProperty
UlCopyAuthConfigToIrp
UlCopyAuthHeader
UlCopyChannelBindConfigToIrp
UlCopyHttpVerb
UlCopyLogDataToCache
UlCopyLoggingProperty
UlCopyParsedHeaders
UlCopyUserAuthInfo
UlCopyUserChannelBindInfo
UlCopyUserTokenBindingInfo
UlCreateCacheEntryFromResponse
UlCreateConsumerHelper
UlDeepCopyParsedHeaders
UlEventLogCreateFailure
UlFastSendHttpResponseOld
UlFlushCacheByUri
UlGenerateDateHeader
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateRoutingToken
UlGenerateSingleVariableHeaders
UlGenerateTrailers
UlGenerateVariableHeaders
UlGetDateTimeFields
UlGetServerHeader
UlGetTypeAndSubType
UlHkeBuilderCopyFixedHeaders
UlHkeBuilderQueryKnownHeader
UlHkeBuilderQueryUnknownHeader
UlLogHttpError
UlPrepareUrlIoctl
UlQueryKnownRequestHeader
UlQueryRequestProperty
UlQueryUnknownRequestHeader
UlReadFragmentFromCache
UlReadStringParameter
UlRefreshFileName
UlReplaceHeaderValue
UlSendSimpleStatus
UlSerializeTrailers
UlWriteEventLogEntry
UlpAddIpAddressToList
UlpAiPopulateAddressList
UlpAllocateAuthCacheEntry
UlpBufferWriterUpdate
UlpBuildErrorLogRecord
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildUriKeyFromCookedUrl
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCaptureSoftwareDirective
UlpCompleteAuthInfo
UlpCompleteLogRecordETW
UlpCompleteLogRecordIIS
UlpCompleteLogRecordNCSA
UlpCompleteLogRecordW3C
UlpCopyCacheEntryInfo
UlpCopyChannelBindTokenToIrp
UlpCopyConfigGroupInfo
UlpCopyIndicatedData
UlpCopyQuicStatsV2
UlpCopyRegisteredUrl
UlpCopyRequestQueueInfo
UlpCopyRequestToBuffer
UlpCopySingleMultipleHeader
UlpCopyString
UlpCopyUrl
UlpCopyUserDataToFastTracker
UlpCreateTargetServiceName
UlpDeleteIpAddressFromList
UlpDigestFastAuthenticator
UlpDuplicateSliceTrackerForCache
UlpFastAuthenticate
UlpFixupIISLogRecord
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpGenerateBoundaryChunk
UlpGenerateCommonBoundaryBuffer
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpHkeBuilderAddKnownHeader
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpHkeCopyKnownHeader
UlpLogSpecificInitFailure
UlpMergeBuffers
UlpParseNextRequest
UlpPrepare200Response
UlpPrepareOutputToken
UlpRawCopyForLogCacheHit
UlpRawCopyForLogCacheMiss
UlpRewriteLogRecord
UlpSanitizeResponseHeaders
UlpSanitizeTrailerHeaders
UlpSetRequestQueueExternalId
UlpSspiAuthenticationHandler
UlpTreeFindWildcardSite
UlpTreeFreeNode
UlpTreeInsertEntry
UlpUpdateReservationInRegistry
UlpWriteServerHeader
UlpWriteSingleHeader
UlpWriteToErrorLogFileDebug
UlpWriteToErrorLogFileExclusive
UlpWriteToLogFileDebug
UlpWriteToLogFileExclusive
UlpWriteToLogFileShared
UxAllocateBufferedMdl
UxAppendCopyToAggregator
UxAppendToExbuffer
UxCaptureString
UxCaptureUserMemory
UxCaptureWideString
UxCopyMdlChainToMdlChain
UxDuoBeginFullFrameParse
UxDuoBuildContinuationChain
UxDuoDispatchAltSvcParcel
UxDuoParse
UxDuoParseCatalog
UxDuoParseSettings
UxDuoParseWindowUpdate
UxGenerateSubdomainWildcardHostname
UxIpv4AddressToStringExW
UxIpv6AddressToStringExW
UxQuicBufferAddData
UxQuicBufferShiftData
UxQuicConnectionCopyBindings
UxQuicConnectionGetPeerIssuerListClient
UxQuicConnectionGetStatsV2
UxQuicPreParser
UxQuicSetSessionKeys
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslCopyConfigurationProperties
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCopySniToRequestProperty
UxSslGetAltSvcInfo
UxSslGetCertInfo
UxSslInitializeClientCertPolicy
UxSslInitiateSend
UxSslParseTlsRestrictions
UxSslReadConfigurationPropertiesFromUser
UxSslReadExtendedConfigurationPropertiesFromUser
UxTryCopyUserMemory
UxWskAcceptEvent
UxpDuoCaptureHostName
UxpQuicBufferExpandBuffer
UxpQuicConnectionCopyCertBlob
UxpQuicConnectionCopyCertBlob32
UxpQuicConnectionCopyIssuerList32
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicCreateCustomAlpnArray
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicParseAndCopyDataIndication
UxpQuicQueryConnectionInfo
UxpQuicStreamGetStats
UxpQuicUnknownStreamReceiveEvent
UxpSslCommonSendData
UxpSslCommonSendDataHelper
UxpSslCopyCertificateParam
UxpSslCopySniForEtwFiltering
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslExpandTransportDataIndication
UxpSslGetClientCertInfo
UxpSslGetClientHello
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslProcessRenegotiateRecord
UxpSslReadConfigurationPropertiesFromRegistry
WppTraceCallback
| |paramcount|3|3| |`address`|14014db80|14014e300| |sig|void * __cdecl memcpy(void * _Dst, void * _Src, size_t _Size)|void * __cdecl memcpy(void * _Dst, void * _Src, size_t _Size)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### memcpy Calling Diff ```diff --- memcpy calling +++ memcpy calling @@ -2,9 +2,9 @@ -FUN_14000cbb0 -FUN_140157028 -FUN_1401582ca -FUN_14015bf9e -FUN_14015c52c -FUN_14015fb0f -FUN_140160512 -FUN_140160fd8 -FUN_140162fda +FUN_14000cc90 +FUN_140157626 +FUN_140158150 +FUN_14015be24 +FUN_14015c3b2 +FUN_140160147 +FUN_140160846 +FUN_1401612c4 +FUN_1401632c6 @@ -202,0 +203 @@ +UxpQuicConnectionCopyCertBlob32 ``` ## UxPktMonTraceDropSslWithNtStatus ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxPktMonTraceDropSslWithNtStatus|UxPktMonTraceDropSslWithNtStatus| |fullname|UxPktMonTraceDropSslWithNtStatus|UxPktMonTraceDropSslWithNtStatus| |`refcount`|9|8| |length|58|58| |called|UxpPktMonNtStatusToDropReason
UxpPktMonTraceSslDropInternal|UxpPktMonNtStatusToDropReason
UxpPktMonTraceSslDropInternal| |`calling`|FUN_14015cd79
FUN_14015cda4
UxPktMonTraceDropSsl
UxSslLoadCertificateAsync
UxSslLoadCertificateComplete
UxpSslReceiverCreateServerHelloMessage
UxpSslReceiverSendServerHelloMessage
UxpSslWaitForAscHandler|FUN_14015cbff
UxPktMonTraceDropSsl
UxSslLoadCertificateAsync
UxSslLoadCertificateComplete
UxpSslReceiverCreateServerHelloMessage
UxpSslReceiverSendServerHelloMessage
UxpSslWaitForAscHandler| |paramcount|3|3| |`address`|14013776c|140137f3c| |sig|undefined __fastcall UxPktMonTraceDropSslWithNtStatus(longlong param_1, undefined4 param_2, int param_3)|undefined __fastcall UxPktMonTraceDropSslWithNtStatus(longlong param_1, undefined4 param_2, int param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxPktMonTraceDropSslWithNtStatus Calling Diff ```diff --- UxPktMonTraceDropSslWithNtStatus calling +++ UxPktMonTraceDropSslWithNtStatus calling @@ -1,2 +1 @@ -FUN_14015cd79 -FUN_14015cda4 +FUN_14015cbff ``` ## memset ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|memset|memset| |fullname|memset|memset| |`refcount`|551|552| |length|236|236| |called||| |`calling`|
Expand for full list:
CreateNewEventEntry
CreateTlgAggregateSession
FUN_14000ad3a
FUN_140153258
FUN_140153ac6
FUN_140154966
FUN_140155ea1
FUN_140157bb0
FUN_1401582ca
FUN_14015c52c
FUN_14015e49dHkAddPairToTable
HkDecode
HkEncode
HttpCmnInitializeStaticHttpCharsTable
HttpParseUrl
HttpValidateHostname
HttppRebuildFixedUrl
HttppValidateIpv6Hostname
InitializeTelemetryAssertsKM
McGenControlCallbackV2
PktMonClientComponentUnregister
PktMonDetachProvider
QkAllocateElement
QkCreateCodec
QkCreateRefListEntry
QkDecodeControl
QkDecodeData
QkEncodeControl
QkEncodeData
QkEncodeReset
QkInitializeEmitter
RtlStringCchPrintfExA
RtlStringCchPrintfExW
RtlStringExHandleOtherFlagsA
RtlStringExHandleOtherFlagsW
StringToHostAddressW
TraceFilterEngineValidateAndStoreRules
UcClientObjectAccessCheck
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcQueryClientStreamProperty
UcpCreateClientConfiguration
UcpCreateClientSession
UlAddFragmentToCache
UlAddSite
UlAddSslBinding
UlAddUrlToConfigGroup
UlAddUrlToUrlGroupIoctl
UlAllocateCacheEntry
UlAllocateCacheTracker
UlAllocateCacheTrackerToLookaside
UlAllocateFastTracker
UlAllocateFastTrackerToLookaside
UlAllocateGrip
UlAllocateLogFileBuffer
UlAllocatePerNode
UlAllocateRequestBuffer
UlAllocateToLookaside
UlBuildPushRequestHeaders
UlCleanupConfigGroupInfo
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlCleanupRangeCacheTracker
UlCompleteWaitForDisconnects
UlConfigLogging
UlCopyConfigGroupInfoForCache
UlCopyRequestToBuffer
UlCopyRequestToIrp
UlCopyUrlGroupCounters
UlCopyUserAuthInfo
UlDeepCopyParsedHeaders
UlDeleteIpListenList
UlDeleteSslBinding
UlDestroyCapturedResponse
UlDestroyLogDataBufferWorker
UlErrorLog
UlEtStartModule
UlEtwShutdownFacet
UlEtwStartFacet
UlEventFlushResponseCache
UlEventLogAddUrl
UlEventLogCreateUrlGroup
UlEventLogDeleteUrlGroup
UlEventLogRemoveAllUrls
UlEventLogRemoveUrl
UlEventLogUrlReservation
UlEventSetConfigGroupProperty
UlEventSetIpListenList
UlEventSslSettingsCreated
UlEventSslSettingsDeleted
UlEventSslSettingsUpdated
UlExecuteLazyAuthInitialization
UlFindUrlGroupId
UlFindUrlGroupIdIoctl
UlFlAddPerResponseFlow
UlFlCaptureFlowRateInfoOld
UlFlFlowRateInfoProcessing
UlFreeCacheTracker
UlFreeFastTracker
UlFreeGrip
UlFreeHttpConnection
UlFreeLogFileBuffer
UlFreePerNode
UlGetIrpSid
UlHkeCreateCalloutContext
UlHkeDestroyCalloutContext
UlHttpAttachConnection
UlInitializeBundle
UlInitializeConfigGroupInfo
UlInitializeLogBufferGranularity
UlInitializeLogTimer
UlListenerObjectAccessCheck
UlLogHttpError
UlNotifyIPListenListChanges
UlPktMonCleanupCallback
UlPrepare416Response
UlPrepareCacheMissRangeResponse
UlPrepareUrlIoctl
UlProbeAndCopyIpPortAddressToStringW
UlQosConfigureFlowCharacteristics
UlQueryConsumerProcessInfo
UlQueryRequestFastIo
UlQueryRequestProperty
UlQueryServiceConfigIoctl
UlQueueLoggingRoutine
UlReadGenericParameter
UlRegisterPeriodicScavenger
UlReleaseRequestBuffer
UlRemoveUrlFromConfigGroup
UlRemoveUrlFromUrlGroupIoctl
UlResumeParsing
UlSendEntityBodyIoctlOld
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConfigGroupProperty
UlSetIpListenList
UlSetServerSessionProperty
UlSetUrlDelegateInfo
UlStartConfigGroupFacet
UlStartErrorLogFacet
UlStartTimerModule
UlThreadAdminCheck
UlUpdateSslBinding
UlpAiIpAddressChangeCallback
UlpAiPopulateAddressList
UlpAllocateConfigGroupObject
UlpAllocateConsumer
UlpAllocateInternalResponse
UlpAllocateServerSession
UlpBufferWriterUpdate
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildParsedHeaderRangeResponseFromSlices
UlpBuildSingleRangeMdlChainFromSlices
UlpCheckAndSetRequestQueueExternalId
UlpCleanupCoupling
UlpCleanupLoggingInfo
UlpCompleteSendCacheEntryWorker
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestTimingInfo
UlpCopyRequestToBuffer
UlpCopyTcpInfoV2
UlpCreateFastForwardDataContext
UlpCreateFragmentCacheEntry
UlpCreateHttpRequest
UlpDigestAuthenticationHandler
UlpDigestFastAuthenticator
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpEtwEvaluateFilterInternal
UlpEventRequestConnectionStats
UlpFilteredFlushUriCache
UlpFreeCoupling
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpGetGMTOffset
UlpGetLocalMachineAuthIdentity
UlpHotAddNotifyModules
UlpInitErrorLogInfo
UlpInitializeThreadPoolWorkers
UlpInitializeTimerUnit
UlpLockRequestQueueAndCoupling
UlpLogonUser
UlpMergeSlicesToCache
UlpNotifyEdgePolicyChange
UlpNotifyEdgePolicyChangeForUrl
UlpOpenCoupling
UlpOpenRequestQueue
UlpPcwCollectInstances
UlpReadAndCopyCacheEntries
UlpReadAndCopyClientServiceState
UlpReadAndCopyServiceState
UlpReadReservations
UlpRegisterEventScavenger
UlpSendCacheEntry
UlpSendErrorResponse
UlpSendResponseOrEntityBodyFastIo
UlpSendResponseToExtension
UlpTreeInsertEntry
UxAllocateMdlAndBufferEx
UxDuoAllocateDataIndication
UxDuoAllocateStream
UxDuoAllocateTask
UxDuoAttachConnection
UxDuoCaptureDeclarePushParameters
UxDuoCleanupTask
UxDuoEnqueueDisconnectTask
UxDuoExecuteDetach
UxDuoExecuteParcelCompletion
UxDuoExecuteReceiver
UxDuoExecuteStreamDisconnect
UxDuoExecuteUpdateStreamBundleLimits
UxDuoFreeBufferIndication
UxDuoFreeDataIndication
UxDuoFreeParcel
UxDuoFreeStream
UxDuoFreeTask
UxDuoGenerateHttperr
UxDuoHpackAllocateBlock
UxDuoHpackAllocatePairs
UxDuoHpackFreeBlock
UxDuoInitiateEgressDisconnect
UxDuoInitiateHeadersSend
UxDuoIoReadyEvent
UxDuoReceiveEvent
UxDuoSanitizeDeclarePushParameters
UxGetPhysicalMemorySize
UxInitializePerfectHttpHeaderHash
UxIpv6AddressToStringExW
UxPodSiloCreateCallback
UxQuicConnectionGetStatsV1
UxQuicConnectionGetStatsV2
UxQuicConnectionSendGoaway
UxQuicConnectionSetQuicSettings
UxQuicCreateDecodeTracker
UxQuicCreateSendTracker
UxQuicFreeDecodeTracker
UxQuicFreeSendTracker
UxQuicFreeStream
UxQuicGenerateHttperr
UxQuicListenerEndpointLookup
UxQuicLoadCertificateAsync
UxQuicLoadCertificateWorker
UxQuicParseFrame
UxQuicPreParser
UxQuicSetSessionKeys
UxQuicStreamConnectionControl
UxSslAllocateSendBuffer
UxSslAllocateTransportDataIndication
UxSslAttachConnection
UxSslConnectionTimeout
UxSslFreeAscContext
UxSslFreeBufferIndication
UxSslFreeConnection
UxSslFreeSendBufferList
UxSslGetCertificateParams
UxSslInitializeHostSearchDescriptorHelper
UxSslInitializeIpSearchDescriptor
UxSslInsertEndpointConfig
UxSslLogError
UxSslQueueIndicationList
UxSslReleaseReceiveBuffers
UxSslRestartSendRawData
UxSslValidateSni
UxStartDeviceModule
UxStartEnvironmentModule
UxStartParserModule
UxStartUtilModule
UxTlDestroyConnection
UxTlDestroyConnectionWorker
UxTlGetTcpInfo
UxTlInitiateSend
UxTlPeriodicConnectionCountLogger
UxWfpConnectionClassify
UxWskAcceptEvent
UxWskInitiateSend
UxpAllocateHeaderBufferBlock
UxpFreeHeaderBufferBlock
UxpPktMonUnregisterHttp
UxpQuicAllocateDataIndication
UxpQuicAllocateTransportIndication
UxpQuicCleanupEndpointLookupInfo
UxpQuicCreateCustomAlpnArray
UxpQuicCreateStream
UxpQuicFreeBufferIndication
UxpQuicFreeDataIndication
UxpQuicFreeTransportIndication
UxpQuicInitializeEndpointLookupInfo
UxpQuicListenerNewConnection
UxpQuicQueryConnectionInfo
UxpQuicReceiveControlStreamReceiveEvent
UxpQuicStreamGetStats
UxpQuicStreamParseReceiveBuffer
UxpSslAllocateDataIndication
UxpSslCleanupConnection
UxpSslCleanupDecryptPendingList
UxpSslCleanupTransportIndicationList
UxpSslCommonSendDataHelper
UxpSslConnectionDecryptData
UxpSslCopyCcsConfigurationToUser
UxpSslCopyCertificateParam
UxpSslCopyHostConfigToUserExHelper
UxpSslCopyHostConfigToUserHelper
UxpSslCopyIpConfigurationToUser
UxpSslCopyIpConfigurationToUserEx
UxpSslExpandTransportDataIndication
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindScopedCcsHandler
UxpSslFindSniHandler
UxpSslFindWildcardScopedCcsHandler
UxpSslFindWildcardSniHandler
UxpSslFreeDataIndication
UxpSslFreeSendRequestTracker
UxpSslIndicateReceiveEvent
UxpSslInitializeHostConfigByRegistryIndexHelper
UxpSslInitializeHostConfigByUserKeyHelper
UxpSslInitializeIpConfigurationByUserKey
UxpSslLoadConfigurations
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslQuerySni
UxpSslQuerySslConnectionInfo
UxpSslReceiver
UxpSslRemoveEndpointConfig
UxpSslValidateHostname
UxpSslWaitForAscHandler
UxpTpAllocateBufferTracker
UxpTpAllocateTransmitPacket
UxpTpFreeBufferTracker
UxpTpFreeChunkTracker
UxpTpFreeTransmitPacket
UxpTpInitializeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpProcessMdlRuns
UxpWskCancelPendingIo
UxpWskCleanupIoContext
UxpWskCreateIoContext
UxpWskSendCompletion
WppTraceCallback
|
Expand for full list:
CreateNewEventEntry
CreateTlgAggregateSession
FUN_14000ae1a
FUN_1401539c4
FUN_140154232
FUN_1401550d2
FUN_14015660d
FUN_140158150
FUN_14015c3b2
FUN_14015e6e2
FUN_14015ec6fHkAddPairToTable
HkDecode
HkEncode
HttpCmnInitializeStaticHttpCharsTable
HttpParseUrl
HttpValidateHostname
HttppRebuildFixedUrl
HttppValidateIpv6Hostname
InitializeTelemetryAssertsKM
McGenControlCallbackV2
PktMonClientComponentUnregister
PktMonDetachProvider
QkAllocateElement
QkCreateCodec
QkCreateRefListEntry
QkDecodeControl
QkDecodeData
QkEncodeControl
QkEncodeData
QkEncodeReset
QkInitializeEmitter
RtlStringCchPrintfExA
RtlStringCchPrintfExW
RtlStringExHandleOtherFlagsA
RtlStringExHandleOtherFlagsW
StringToHostAddressW
TraceFilterEngineValidateAndStoreRules
UcClientObjectAccessCheck
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcQueryClientStreamProperty
UcpCreateClientConfiguration
UcpCreateClientSession
UlAddFragmentToCache
UlAddSite
UlAddSslBinding
UlAddUrlToConfigGroup
UlAddUrlToUrlGroupIoctl
UlAllocateCacheEntry
UlAllocateCacheTracker
UlAllocateCacheTrackerToLookaside
UlAllocateFastTracker
UlAllocateFastTrackerToLookaside
UlAllocateGrip
UlAllocateLogFileBuffer
UlAllocatePerNode
UlAllocateRequestBuffer
UlAllocateToLookaside
UlBuildPushRequestHeaders
UlCleanupConfigGroupInfo
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlCleanupRangeCacheTracker
UlCompleteWaitForDisconnects
UlConfigLogging
UlCopyConfigGroupInfoForCache
UlCopyRequestToBuffer
UlCopyRequestToIrp
UlCopyUserAuthInfo
UlDeepCopyParsedHeaders
UlDeleteIpListenList
UlDeleteSslBinding
UlDestroyCapturedResponse
UlDestroyLogDataBufferWorker
UlErrorLog
UlEtStartModule
UlEtwShutdownFacet
UlEtwStartFacet
UlEventFlushResponseCache
UlEventLogAddUrl
UlEventLogCreateUrlGroup
UlEventLogDeleteUrlGroup
UlEventLogRemoveAllUrls
UlEventLogRemoveUrl
UlEventLogUrlReservation
UlEventSetConfigGroupProperty
UlEventSetIpListenList
UlEventSslSettingsCreated
UlEventSslSettingsDeleted
UlEventSslSettingsUpdated
UlExecuteLazyAuthInitialization
UlFindUrlGroupId
UlFindUrlGroupIdIoctl
UlFlAddPerResponseFlow
UlFlCaptureFlowRateInfoOld
UlFlFlowRateInfoProcessing
UlFreeCacheTracker
UlFreeFastTracker
UlFreeGrip
UlFreeHttpConnection
UlFreeLogFileBuffer
UlFreePerNode
UlGetIrpSid
UlHkeCreateCalloutContext
UlHkeDestroyCalloutContext
UlHttpAttachConnection
UlInitializeBundle
UlInitializeConfigGroupInfo
UlInitializeLogBufferGranularity
UlInitializeLogTimer
UlListenerObjectAccessCheck
UlLogHttpError
UlNotifyIPListenListChanges
UlPcwCopyUrlGroupCounters
UlPktMonCleanupCallback
UlPrepare416Response
UlPrepareCacheMissRangeResponse
UlPrepareUrlIoctl
UlProbeAndCopyIpPortAddressToStringW
UlQosConfigureFlowCharacteristics
UlQueryConsumerProcessInfo
UlQueryRequestFastIo
UlQueryRequestProperty
UlQueryServiceConfigIoctl
UlQueueLoggingRoutine
UlReadGenericParameter
UlRegisterPeriodicScavenger
UlReleaseRequestBuffer
UlRemoveUrlFromConfigGroup
UlRemoveUrlFromUrlGroupIoctl
UlResumeParsing
UlSendEntityBodyIoctlOld
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConfigGroupProperty
UlSetIpListenList
UlSetServerSessionProperty
UlSetUrlDelegateInfo
UlStartConfigGroupFacet
UlStartErrorLogFacet
UlStartTimerModule
UlThreadAdminCheck
UlUpdateSslBinding
UlpAiIpAddressChangeCallback
UlpAiPopulateAddressList
UlpAllocateConfigGroupObject
UlpAllocateConsumer
UlpAllocateInternalResponse
UlpAllocateServerSession
UlpBufferWriterUpdate
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildParsedHeaderRangeResponseFromSlices
UlpBuildSingleRangeMdlChainFromSlices
UlpCheckAndSetRequestQueueExternalId
UlpCleanupCoupling
UlpCleanupLoggingInfo
UlpCompleteSendCacheEntryWorker
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestTimingInfo
UlpCopyRequestToBuffer
UlpCopyTcpInfoV2
UlpCopyUrlGroupCounters
UlpCreateFastForwardDataContext
UlpCreateFragmentCacheEntry
UlpCreateHttpRequest
UlpDigestAuthenticationHandler
UlpDigestFastAuthenticator
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpEtwEvaluateFilterInternal
UlpEventRequestConnectionStats
UlpFilteredFlushUriCache
UlpFreeCoupling
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpGetGMTOffset
UlpGetLocalMachineAuthIdentity
UlpHotAddNotifyModules
UlpInitErrorLogInfo
UlpInitializeThreadPoolWorkers
UlpInitializeTimerUnit
UlpLockRequestQueueAndCoupling
UlpLogonUser
UlpMergeSlicesToCache
UlpNotifyEdgePolicyChange
UlpNotifyEdgePolicyChangeForUrl
UlpOpenCoupling
UlpOpenRequestQueue
UlpPcwCollectInstances
UlpReadAndCopyCacheEntries
UlpReadAndCopyClientServiceState
UlpReadAndCopyServiceState
UlpReadReservations
UlpRegisterEventScavenger
UlpSendCacheEntry
UlpSendErrorResponse
UlpSendResponseOrEntityBodyFastIo
UlpSendResponseToExtension
UlpTreeInsertEntry
UxAllocateMdlAndBufferEx
UxDuoAllocateDataIndication
UxDuoAllocateStream
UxDuoAllocateTask
UxDuoAttachConnection
UxDuoCaptureDeclarePushParameters
UxDuoCleanupTask
UxDuoEnqueueDisconnectTask
UxDuoExecuteDetach
UxDuoExecuteParcelCompletion
UxDuoExecuteReceiver
UxDuoExecuteStreamDisconnect
UxDuoExecuteUpdateStreamBundleLimits
UxDuoFreeBufferIndication
UxDuoFreeDataIndication
UxDuoFreeParcel
UxDuoFreeStream
UxDuoFreeTask
UxDuoGenerateHttperr
UxDuoHpackAllocateBlock
UxDuoHpackAllocatePairs
UxDuoHpackFreeBlock
UxDuoInitiateEgressDisconnect
UxDuoInitiateHeadersSend
UxDuoIoReadyEvent
UxDuoReceiveEvent
UxDuoSanitizeDeclarePushParameters
UxGetPhysicalMemorySize
UxInitializePerfectHttpHeaderHash
UxIpv6AddressToStringExW
UxPodSiloCreateCallback
UxQuicConnectionGetStatsV1
UxQuicConnectionGetStatsV2
UxQuicConnectionSendGoaway
UxQuicConnectionSetQuicSettings
UxQuicCreateDecodeTracker
UxQuicCreateSendTracker
UxQuicFreeDecodeTracker
UxQuicFreeSendTracker
UxQuicFreeStream
UxQuicGenerateHttperr
UxQuicListenerEndpointLookup
UxQuicLoadCertificateAsync
UxQuicLoadCertificateWorker
UxQuicParseFrame
UxQuicPreParser
UxQuicSetSessionKeys
UxQuicStreamConnectionControl
UxSslAllocateSendBuffer
UxSslAllocateTransportDataIndication
UxSslAttachConnection
UxSslConnectionTimeout
UxSslFreeAscContext
UxSslFreeBufferIndication
UxSslFreeConnection
UxSslFreeSendBufferList
UxSslGetCertificateParams
UxSslInitializeHostSearchDescriptorHelper
UxSslInitializeIpSearchDescriptor
UxSslInsertEndpointConfig
UxSslLogError
UxSslQueueIndicationList
UxSslReleaseReceiveBuffers
UxSslRestartSendRawData
UxSslValidateSni
UxStartDeviceModule
UxStartEnvironmentModule
UxStartParserModule
UxStartUtilModule
UxTlDestroyConnection
UxTlDestroyConnectionWorker
UxTlGetTcpInfo
UxTlInitiateSend
UxTlPeriodicConnectionCountLogger
UxWfpConnectionClassify
UxWskAcceptEvent
UxWskInitiateSend
UxpAllocateHeaderBufferBlock
UxpFreeHeaderBufferBlock
UxpPktMonUnregisterHttp
UxpQuicAllocateDataIndication
UxpQuicAllocateTransportIndication
UxpQuicCleanupEndpointLookupInfo
UxpQuicCreateCustomAlpnArray
UxpQuicCreateStream
UxpQuicFreeBufferIndication
UxpQuicFreeDataIndication
UxpQuicFreeTransportIndication
UxpQuicInitializeEndpointLookupInfo
UxpQuicListenerNewConnection
UxpQuicQueryConnectionInfo
UxpQuicReceiveControlStreamReceiveEvent
UxpQuicStreamGetStats
UxpQuicStreamParseReceiveBuffer
UxpSslAllocateDataIndication
UxpSslCleanupConnection
UxpSslCleanupDecryptPendingList
UxpSslCleanupTransportIndicationList
UxpSslCommonSendDataHelper
UxpSslConnectionDecryptData
UxpSslCopyCcsConfigurationToUser
UxpSslCopyCertificateParam
UxpSslCopyHostConfigToUserExHelper
UxpSslCopyHostConfigToUserHelper
UxpSslCopyIpConfigurationToUser
UxpSslCopyIpConfigurationToUserEx
UxpSslExpandTransportDataIndication
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindScopedCcsHandler
UxpSslFindSniHandler
UxpSslFindWildcardScopedCcsHandler
UxpSslFindWildcardSniHandler
UxpSslFreeDataIndication
UxpSslFreeSendRequestTracker
UxpSslIndicateReceiveEvent
UxpSslInitializeHostConfigByRegistryIndexHelper
UxpSslInitializeHostConfigByUserKeyHelper
UxpSslInitializeIpConfigurationByUserKey
UxpSslLoadConfigurations
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslQuerySni
UxpSslQuerySslConnectionInfo
UxpSslReceiver
UxpSslRemoveEndpointConfig
UxpSslValidateHostname
UxpSslWaitForAscHandler
UxpTpAllocateBufferTracker
UxpTpAllocateTransmitPacket
UxpTpFreeBufferTracker
UxpTpFreeChunkTracker
UxpTpFreeTransmitPacket
UxpTpInitializeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpProcessMdlRuns
UxpWskCancelPendingIo
UxpWskCleanupIoContext
UxpWskCreateIoContext
UxpWskSendCompletion
WppTraceCallback
| |paramcount|3|3| |`address`|14014de80|14014e600| |sig|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### memset Calling Diff ```diff --- memset calling +++ memset calling @@ -3,9 +3,9 @@ -FUN_14000ad3a -FUN_140153258 -FUN_140153ac6 -FUN_140154966 -FUN_140155ea1 -FUN_140157bb0 -FUN_1401582ca -FUN_14015c52c -FUN_14015e49d +FUN_14000ae1a +FUN_1401539c4 +FUN_140154232 +FUN_1401550d2 +FUN_14015660d +FUN_140158150 +FUN_14015c3b2 +FUN_14015e6e2 +FUN_14015ec6f @@ -70 +69,0 @@ -UlCopyUrlGroupCounters @@ -115,0 +115 @@ +UlPcwCopyUrlGroupCounters @@ -165,0 +166 @@ +UlpCopyUrlGroupCounters ``` ## NTOSKRNL.EXE::ExpInterlockedPushEntrySList ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|ExpInterlockedPushEntrySList|ExpInterlockedPushEntrySList| |fullname|NTOSKRNL.EXE::ExpInterlockedPushEntrySList|NTOSKRNL.EXE::ExpInterlockedPushEntrySList| |`refcount`|59|58| |length|0|0| |called||| |calling|
Expand for full list:
UlAllocateConnectionRequestId
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlDestroyCapturedResponse
UlFreeBuildTracker
UlHttpIngressDisconnectEvent
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendSimpleStatus
UlThreadPoolEnqueueWorkItem
UlUnlinkHttpRequestUlUnlinkRequestFromRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpLockRequestQueueAndCoupling
UlpQueueFreeHttpRequest
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UlpTransformAndQueueRequestBuffers
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteDetach
UxDuoExecuteRunnerCompletion
UxDuoReceiveEvent
UxDuoScheduleStreamSends
UxFreeOpaqueId
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxSslQueueReceiverWorkItemEx
UxSslRestartSendRawData
UxTlDestroyConnection
UxpAllocateOpaqueIdEntry
UxpExpandOpaqueIdTable
UxpSslCleanupConnection
UxpSslReceiver
UxpSslReceiverWorker
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
UxpTpRestartMdlRead
UxpTpRestartMdlSend
|
Expand for full list:
UlAllocateConnectionRequestId
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlDestroyCapturedResponse
UlFreeBuildTracker
UlHttpIngressDisconnectEvent
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendSimpleStatus
UlThreadPoolEnqueueWorkItem
UlUnlinkHttpRequestUlUnlinkRequestFromRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpLockRequestQueueAndCoupling
UlpQueueFreeHttpRequest
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UlpTransformAndQueueRequestBuffers
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteDetach
UxDuoExecuteRunnerCompletion
UxDuoReceiveEvent
UxDuoScheduleStreamSends
UxFreeOpaqueId
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxSslQueueReceiverWorkItemEx
UxSslRestartSendRawData
UxTlDestroyConnection
UxpAllocateOpaqueIdEntry
UxpExpandOpaqueIdTable
UxpSslCleanupConnection
UxpSslReceiver
UxpSslReceiverWorker
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
UxpTpRestartMdlRead
UxpTpRestartMdlSend
| |paramcount|0|0| |address|EXTERNAL:0000003a|EXTERNAL:0000003a| |sig|undefined ExpInterlockedPushEntrySList(void)|undefined ExpInterlockedPushEntrySList(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## UxPodReferenceSilo ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.79| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxPodReferenceSilo|UxPodReferenceSilo| |fullname|UxPodReferenceSilo|UxPodReferenceSilo| |`refcount`|17|16| |length|131|131| |called|NTOSKRNL.EXE::ObfReferenceObjectWithTag
NTOSKRNL.EXE::PsGetPermanentSiloContext
UlBugCheckEx|NTOSKRNL.EXE::ObfReferenceObjectWithTag
NTOSKRNL.EXE::PsGetPermanentSiloContext
UlBugCheckEx| |`calling`|
Expand for full list:
UcpAllocateClientSession
UlCleanupConnectionCouplings
UlCreateCommChannel
UlCreateConsumer
UlFreeBuildTracker
UlpAllocateRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntryWorker
UlpFlushLogFileBufferWorker
UxQuicCreateConnectionUxQuicCreateSession
UxQuicStreamConnectionControl
UxSslDetachConnection
UxTlConnectionControl
UxpTlCreateListenEndpoint
|
Expand for full list:
UcpAllocateClientSession
UlCleanupConnectionCouplings
UlCreateCommChannel
UlCreateConsumer
UlFreeBuildTracker
UlpAllocateRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuild
UlpFlushLogFileBufferWorker
UxQuicCreateConnection
UxQuicCreateSessionUxQuicStreamConnectionControl
UxSslDetachConnection
UxTlConnectionControl
UxpTlCreateListenEndpoint
| |paramcount|3|3| |`address`|14001de20|14001df00| |sig|undefined __fastcall UxPodReferenceSilo(longlong param_1, undefined8 param_2, ulonglong param_3)|undefined __fastcall UxPodReferenceSilo(longlong param_1, undefined8 param_2, ulonglong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxPodReferenceSilo Calling Diff ```diff --- UxPodReferenceSilo calling +++ UxPodReferenceSilo calling @@ -9 +8,0 @@ -UlpCompleteSendCacheEntryWorker ``` ## UlProbeAnsiString ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.8| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlProbeAnsiString|UlProbeAnsiString| |fullname|UlProbeAnsiString|UlProbeAnsiString| |`refcount`|49|51| |length|227|227| |called|NTOSKRNL.EXE::ExRaiseStatus
WPP_SF_Hqc
WPP_SF_PqLc|NTOSKRNL.EXE::ExRaiseStatus
WPP_SF_Hqc
WPP_SF_PqLc| |calling|
Expand for full list:
IsChunkSpecified
ParseContentType
ParseLastModified
UlComputeFixedHeaderSizeOld
UlFastSendHttpResponseOld
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateTrailers
UlGetServerHeader
UlIsHeaderZeroLengthString
UlProbeLogDataUlProbeLogDataOld
UlpCopySingleMultipleHeader
UlpCopyString
UlpHandleAuthHeader
UlpInitializeInternalResponseHeadersOld
|
Expand for full list:
IsChunkSpecified
ParseContentType
ParseLastModified
UlComputeFixedHeaderSizeOld
UlFastSendHttpResponseOld
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateTrailers
UlGetServerHeader
UlIsHeaderZeroLengthString
UlProbeLogDataUlProbeLogDataOld
UlpCopySingleMultipleHeader
UlpCopyString
UlpHandleAuthHeader
UlpInitializeInternalResponseHeadersOld
| |paramcount|3|3| |`address`|140069070|1400640f0| |sig|byte * __fastcall UlProbeAnsiString(byte * param_1, ulonglong param_2, char param_3)|byte * __fastcall UlProbeAnsiString(byte * param_1, ulonglong param_2, char param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## UxpQuicGetTlsParam ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.94| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxpQuicGetTlsParam|UxpQuicGetTlsParam| |fullname|UxpQuicGetTlsParam|UxpQuicGetTlsParam| |`refcount`|9|8| |length|75|75| |called|UxpQuicGetParam|UxpQuicGetParam| |`calling`|FUN_140161abc
UxpQuicQueryConnectionInfo|FUN_140161da8
UxpQuicQueryConnectionInfo| |paramcount|4|4| |`address`|1400ed6c4|1400eddd4| |sig|undefined __fastcall UxpQuicGetTlsParam(undefined8 param_1, ushort param_2, undefined8 param_3, longlong param_4)|undefined __fastcall UxpQuicGetTlsParam(undefined8 param_1, ushort param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxpQuicGetTlsParam Calling Diff ```diff --- UxpQuicGetTlsParam calling +++ UxpQuicGetTlsParam calling @@ -1 +1 @@ -FUN_140161abc +FUN_140161da8 ``` ## UlpActivateThreadPoolQueue ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpActivateThreadPoolQueue|UlpActivateThreadPoolQueue| |fullname|UlpActivateThreadPoolQueue|UlpActivateThreadPoolQueue| |`refcount`|38|37| |length|142|142| |called|NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::IoQueueWorkItemEx
WPP_SF_Ll|NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::IoQueueWorkItemEx
WPP_SF_Ll| |`calling`|
Expand for full list:
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlFreeBuildTracker
UlHttpIngressDisconnectEvent
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendSimpleStatus
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuildUlpCompleteSendCacheEntryWorker
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpLockRequestQueueAndCoupling
UlpQueueFreeHttpRequest
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoExecuteRunnerCompletion
UxDuoScheduleStreamSends
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxpSslCleanupConnection
UxpSslReceiver
UxpSslReceiverWorker
UxpTpRestartFastTransmit
|
Expand for full list:
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlFreeBuildTracker
UlHttpIngressDisconnectEvent
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendSimpleStatus
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuildUlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpLockRequestQueueAndCoupling
UlpQueueFreeHttpRequest
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoExecuteRunnerCompletion
UxDuoScheduleStreamSends
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxpSslCleanupConnection
UxpSslReceiver
UxpSslReceiverWorker
UxpTpRestartFastTransmit
| |paramcount|1|1| |`address`|14001afa0|14001b080| |sig|ulonglong __fastcall UlpActivateThreadPoolQueue(ulonglong * param_1)|ulonglong __fastcall UlpActivateThreadPoolQueue(ulonglong * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpActivateThreadPoolQueue Calling Diff ```diff --- UlpActivateThreadPoolQueue calling +++ UlpActivateThreadPoolQueue calling @@ -12 +11,0 @@ -UlpCompleteSendCacheEntryWorker ``` ## UxSslMapSecurityStatusToErrorNtStatus ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.9| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxSslMapSecurityStatusToErrorNtStatus|UxSslMapSecurityStatusToErrorNtStatus| |fullname|UxSslMapSecurityStatusToErrorNtStatus|UxSslMapSecurityStatusToErrorNtStatus| |`refcount`|30|29| |length|36|36| |called|UxSslMapSecurityStatusToNtStatus|UxSslMapSecurityStatusToNtStatus| |`calling`|
Expand for full list:
FUN_140153016
UlCreateTokenForMachineAccount
UlpGetLocalMachineAuthIdentity
UxPktMonTraceDropSsl
UxSslAcquireCredentialsHandle
UxSslAllocateAchContext
UxSslAllocateAscContext
UxSslGetServerCertSubjectAndIssuer
UxSslLoadCertificateComplete
UxSslLogEndpointEvent
UxSslParseSniUxSslStartReceiverFacet
UxpSslAcceptSecurityContext
UxpSslDecryptTlsRecord
UxpSslGetAlpnExtension
UxpSslInitiateAscHandler
UxpSslQuerySslConnectionInfo
UxpSslQuerySslConnectionPostHandshakeClientAuth
UxpSslQuerySslTokenBindingInfo
UxpSslReceiverAcceptSecurityContextForServerHello
UxpSslReceiverSendServerHelloMessage
UxpSslSetClientCertPolicy
UxpSslSetSessionKeys
UxpSslVerifyTokenBinding
UxpSslWaitForAscHandler
|
Expand for full list:
FUN_140153782
UlCreateTokenForMachineAccount
UlpGetLocalMachineAuthIdentity
UxPktMonTraceDropSsl
UxSslAcquireCredentialsHandle
UxSslAllocateAchContext
UxSslAllocateAscContext
UxSslGetServerCertSubjectAndIssuer
UxSslLoadCertificateComplete
UxSslLogEndpointEvent
UxSslParseSniUxSslStartReceiverFacet
UxpSslAcceptSecurityContext
UxpSslDecryptTlsRecord
UxpSslGetAlpnExtension
UxpSslQuerySslConnectionInfo
UxpSslQuerySslConnectionPostHandshakeClientAuth
UxpSslQuerySslTokenBindingInfo
UxpSslReceiverAcceptSecurityContextForServerHello
UxpSslReceiverSendServerHelloMessage
UxpSslSetClientCertPolicy
UxpSslSetSessionKeys
UxpSslVerifyTokenBinding
UxpSslWaitForAscHandler
| |paramcount|1|1| |`address`|14009ed94|14009f264| |sig|uint __fastcall UxSslMapSecurityStatusToErrorNtStatus(undefined4 param_1)|uint __fastcall UxSslMapSecurityStatusToErrorNtStatus(undefined4 param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxSslMapSecurityStatusToErrorNtStatus Calling Diff ```diff --- UxSslMapSecurityStatusToErrorNtStatus calling +++ UxSslMapSecurityStatusToErrorNtStatus calling @@ -1 +1 @@ -FUN_140153016 +FUN_140153782 @@ -16 +15,0 @@ -UxpSslInitiateAscHandler ``` ## WPP_SF_iq ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.94| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|WPP_SF_iq|WPP_SF_iq| |fullname|WPP_SF_iq|WPP_SF_iq| |`refcount`|540|539| |length|61|61| |called|FastWppTraceMessage|FastWppTraceMessage| |`calling`|
Expand for full list:
FUN_140154f32
FUN_1401560d8
FUN_1401582ca
FUN_140158950
FUN_14015a80c
FUN_14015a838
FUN_14015afc0
FUN_14015bf9e
HttppPrintIpAddressA
HttppPrintIpAddressW
QkComputeRequiredInsertCountQkDecodeControl
QkDecodeData
QkDecodeLiteral
QkDecodeLiteralEmbeddedLength
QkDecodeNumber
QkEncodeData
QkEncodeReset
QkEncodeSetDynamicTableCapacity
QkFindStreamRefListEntry
QkProcessHeaderAcks
QkProcessInsertCountIncrement
QkRecalculateDrainOrdinal
QkVerifyStaticOrdinal
UcAbortClientConnectionIoctl
UcAbortClientStreamIoctl
UcAbortConnection
UcAllocateStream
UcCleanupClientSessionContext
UcCloseClientConnectionIoctl
UcCloseClientCredentialIoctl
UcCloseClientStreamIoctl
UcCloseConnection
UcConnectionCancelIrp
UcConnectionGetQuicConnection
UcConnectionPendIrp
UcCreateClientConnectionIoctl
UcCreateClientCredentialIoctl
UcCreateClientStreamIoctl
UcGetNewStreamEntityBodyState
UcGetQuicSession
UcLinkConnectionToSessionContext
UcLinkCredentialToSessionContext
UcLinkStreamToConnection
UcNotifyDisconnectClientStreamIoctl
UcQueryClientConnectionIoctl
UcQueryClientStreamIoctl
UcReceiveEntityBodyClientStreamIoctl
UcReceiveHeadersClientStreamIoctl
UcSendEntityBodyClientStreamIoctl
UcSendHeadersClientStreamFastIo
UcSessionContextFromFileObject
UcSetClientConnectionIoctl
UcSetClientConnectionProperty
UcSetClientStreamProperty
UcSetClientStreamPropertyIoctl
UcSetIrpCancellationRoutine
UcStartClientConnectionIoctl
UcStreamFastForwardReceive
UcStreamFreeReceiveBuffer
UcStreamIdealBacklogEvent
UcStreamSend
UcUnlinkStreamFromConnection
UcValidateClientConnectionFromId
UcValidateClientCredentialFromId
UcValidateClientStreamFromId
UcValidateClientStreamFromIdForFastForwarding
UcWaitForClientConnectionDisconnect
UcWaitForClientConnectionDisconnectIoctl
UcpAbortStream
UcpAddConnectionToSessionContext
UcpAddCredentialToSessionContext
UcpAllocateClientSessionContext
UcpConnectionResetIrpCancellationRoutine
UcpCoupleSessionContextAndSession
UcpNotifyDisconnectClientStream
UcpReceiveHeadersClientStream
UcpRemoveConnectionFromSessionContext
UcpRemoveCredentialFromSessionContext
UcpRemoveSessionContextFromSessionList
UcpSendEntityBodyClientStream
UcpStreamCancelIrp
UcpStreamMarkSendDisconnected
UcpStreamResetIrpCancellationRoutine
UcpStreamSendCompletion
UlAddFragmentToCacheIoctl
UlAddToHashTable
UlAddUrlToUrlGroupIoctl
UlAiGetAddressInformation
UlAllocateConnectionRequestId
UlBeginOpaqueMode
UlCancelHttpRequestIoctl
UlCancelRequestIo
UlCancelSendHttpResponse
UlCaptureLogFieldsETW
UlCaptureLogFieldsW3C
UlChargeRequestQueueQuota
UlCheckCachePreconditions
UlCheckDisconnectInfo
UlCheckProtocolCompliance
UlCheckRawResponseCompatibility
UlCheckReceiveEntityBodyState
UlCheckoutUriCacheEntry
UlCleanupConnectionCouplings
UlCleanupConsumer
UlCleanupHttpConnection
UlCloseServerSessionIoctl
UlCompleteWaitForDisconnects
UlConsumerCleanupCompletion
UlControlServiceIoctl
UlCookUrl
UlCopyConfigGroupInfoForCache
UlCopyGlobalCounters
UlCopyParsedHeaders
UlCopyRequestQueueCounters
UlCopyRequestToBuffer
UlCopyRequestToIrp
UlCopyUrlGroupCounters
UlCreateAutoConfigGroup
UlCreateServerSessionIoctl
UlCreateUrlGroupIoctl
UlDeclarePushIoctl
UlDelegateRequest
UlDelegateRequestExFastIo
UlDelegateRequestExIoctl
UlDelegateRequestFastIo
UlDelegateRequestIoctl
UlDeleteConfigGroup
UlDeleteConfigGroupById
UlDeleteServerSession
UlDeleteServiceConfigIoctl
UlDeleteUrlGroupIoctl
UlDeliverEntityBody
UlDestroyCapturedResponse
UlEtwEvaluateFilter
UlEvaluateRequest
UlEvaluateRequestFastIo
UlEvaluateRequestIoctl
UlEventLogRemoveAllUrls
UlFastReceiveHttpRequest
UlFeatureSupportedIoctl
UlFindUrlGroupId
UlFindUrlGroupIdIoctl
UlFlushCacheByConfigGroup
UlFlushCacheForAddUrl
UlFlushLogFileBuffer
UlFlushResponseCacheIoctl
UlFreeBuildTracker
UlFreeConfigGroup
UlGenerateDateHeader
UlGetAutoConfigGroup
UlGetCGroupForRequest
UlGetCommChannel
UlGetCountersIoctl
UlGetRequestFromId
UlGetTransportIdleConnectionTimeout
UlHandle100Continue
UlHostHeaderHandler
UlHttpIdealBacklogEvent
UlHttpIngressDisconnectEvent
UlHttpReceiveHeadersEvent
UlLookupAndVerifyCacheEntry
UlLookupHostPlusIPSite
UlNotifyForAllChannels
UlNotifyForAllConfigGroups
UlNotifyIPListenListChanges
UlPrepareUrlIoctl
UlQosConfigureFlowCharacteristics
UlQueryConsumerProcessInfo
UlQueryExpectHeader
UlQueryRequestIoctl
UlQueryRequestQueueIoctl
UlQueryServerSessionIoctl
UlQueryServiceConfigIoctl
UlQueryUrlGroupIoctl
UlReadFragmentFromCacheIoctl
UlReceiveClientCertIoctl
UlReceiveEntityBodyIoctl
UlReceiveHttpRequest
UlReceiveHttpRequestIoctl
UlReleaseRequestBuffer
UlRemoveConnectionOptionHeaders
UlRemoveSendIrpCancelRoutine
UlRemoveUrlFromUrlGroupIoctl
UlResumeParsing
UlScStopCounters
UlSendCachedResponse
UlSendEntityBodyIoctlOld
UlSendErrorResponse
UlSendHttpResponseIoctlOld
UlSetEntityBodyType
UlSetHttpConnectionTokenBinding
UlSetRequestFastIo
UlSetRequestIoctl
UlSetRequestProperty
UlSetRequestQueueIoctl
UlSetResponseDisconnectFlags
UlSetServerSessionIoctl
UlSetServiceConfigIoctl
UlSetUrlGroupIoctl
UlShutdownRequestQueueIoctl
UlSingleHeaderHandler
UlStartRequestQueueTimer
UlStopRequestQueueTimer
UlTimeoutQueuedRequest
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlUpdateServiceConfigIoctl
UlUserAgentHeaderHandler
UlValidateConfigGroup
UlValidateConfigGroupBoundToRequestQueue
UlValidateHttpConnectionFromId
UlValidateHttpRequestFromId
UlValidateServerSession
UlWaitForDemandStart
UlWaitForDemandStartIoctl
UlWaitForDisconnectIoctl
UlpAdjustBuffers
UlpAllocateConfigGroupObject
UlpAttachConsumerToRequestQueue
UlpAuthenticateRequest
UlpAuthenticateRequestCompletion
UlpBindServerSessionToCommChannel
UlpCancelDemandStartIrp
UlpCancelEntityBody
UlpCancelHttpReceiveIrp
UlpCancelWaitForDisconnectIrp
UlpCheckSpaceAndAddEntryStats
UlpCleanAllUrls
UlpCleanupCoupling
UlpCleanupZombieHttpConnection
UlpCloseConnectionWorker
UlpCloseDisconnectedConnection
UlpCloseLogFileWorker
UlpCompleteCacheBuild
UlpCompleteSendCacheEntryWorker
UlpConnectionDisconnectWorker
UlpCopyCacheEntryInfo
UlpCopyChannelBindTokenToIrp
UlpCopyFragmentInfo
UlpCopyRequestInformation
UlpCopySslParamEx32
UlpCopySslSniSet32
UlpCopySslSniSetEx32
UlpCreateConfigGroup
UlpDeliverHttpRequest
UlpDeliverRequestStageInitial
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpExtractSchemeHostPortIp
UlpFinalizeQValueTable
UlpFlushConsumerCallbacks
UlpFlushFilterClearCentralizedLogged
UlpFlushFilterForAddUrl
UlpFlushFilterForRemoveUrl
UlpFlushFilterIncScavengerTicks
UlpFlushFilterTrimCache
UlpFlushFilterUriRecursive
UlpFreeCoupling
UlpFreeHttpRequest
UlpGetIrpProcessIdAndImageName
UlpHandle503Response
UlpHandleRequest
UlpHkeAcquireQoS
UlpIndicateCompleteToExtension
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpIsLocalRequest
UlpIsRequestFromProxy
UlpLockRequestQueueAndCoupling
UlpNotifyIPListenListChangesOfConfigGroup
UlpParseFullUrl
UlpParseNextRequest
UlpParseTransferEncoding
UlpQosDeleteFlowCharacteristicsOfConfigGroup
UlpQueryConfigGroupBinding
UlpQueryRequestQueue503Verbosity
UlpQueryRequestQueueLengthLimit
UlpQueryRequestQueueState
UlpQueryTranslateHeader
UlpQueueFreeHttpRequest
UlpRebuildRequestHeaders
UlpRebuildResponseHeaders
UlpReceiveData
UlpRemoveRequestFromLane
UlpRemoveZombieHttpConnection
UlpReplaceSystemAccessToken
UlpRetrieveRequest
UlpSendErrorResponse
UlpSendSimpleStatusWorker
UlpSetFilterData
UlpSynchronizeLanesWorker
UlpThreadPoolWorker
UlpUnbindCoupling
UlpUpdateFlushedRequestState
UlpValidateTrailerHeader
UlpZombifyHttpConnection
UxCleanup
UxClose
UxCreate
UxDeviceControl
UxDuoAttachConnection
UxDuoReleaseReceiveBuffers
UxPodAttachThread
UxPodReleaseSiloHold
UxPodSiloTerminate
UxPodSiloTerminateCallback
UxPodTryAttachThread
UxQuicConnectionAcceptStream
UxQuicConnectionGetAndUpdatePushId
UxQuicConnectionStartPushStream
UxQuicFreeStream
UxQuicGetDscpTag
UxQuicPreParser
UxQuicStreamPushInjectDestroyContext
UxQuicStreamReleaseReceiveBuffers
UxReadCompleteFileEntry
UxReadCompleteFileEntryFast
UxReadFileEntryFast
UxSslAcceptSecurityContextCallback
UxSslAcquireCredentialsHandle
UxSslAcquireCredentialsHandleLookupCallback
UxSslAllocateAscContext
UxSslCopyConfigurationProperties
UxSslCopyExtendedProperties
UxSslFreeBufferIndication
UxSslGetAltSvcInfo
UxSslGetProperties
UxSslGetTokenBinding
UxSslGetValidatedSniHostname
UxSslIdealBacklogEvent
UxSslInitializeClientCertPolicy
UxSslInsertEndpointConfig
UxSslLookupEndpointConfig
UxSslParseTlsRestrictions
UxSslQueueIndicationList
UxSslReleaseReceiveBuffers
UxSslRetrieveChannelBindingToken
UxSslSetCurrentLookupConfig
UxSslValidateTlsRestrictions
UxTlDestroyConnection
UxTlGetDscpTag
UxTpTransmitPacket
UxpQuicCompleteDecodeControlBytes
UxpQuicCompleteEncodeControlBytes
UxpQuicConnectionAbortNonAcceptedStreams
UxpQuicConnectionCallbackHandler
UxpQuicConnectionCheckCancelPushThrottle
UxpQuicConnectionCheckServerCert
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicConnectionSetConfiguration
UxpQuicCreateStream
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicParseAndCopyDataIndication
UxpQuicStreamCalculateQuicBufferCount
UxpQuicStreamCallbackEpilog
UxpQuicStreamCallbackHandler
UxpQuicStreamIndicateReceiveEvent
UxpQuicStreamInitializePushState
UxpQuicStreamProcessReceive
UxpQuicStreamProcessTransportIndicationsList
UxpQuicStreamQueueEncodeHeaders
UxpQuicStreamQuicDeclarePushPromise
UxpSslAcceptSecurityContext
UxpSslAcquireCredentialsHandleCreationCallback
UxpSslAllocateRegistration
UxpSslCleanupConnection
UxpSslConfigToPrincipal
UxpSslConnectionDecryptData
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslCreateRegistration
UxpSslDecryptTransportIndication
UxpSslDeleteChildConfigCallback
UxpSslEndpointFoundHandler
UxpSslEndpointGetSniHostname
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointNotFoundHandler
UxpSslEndpointParseSni
UxpSslEndpointRejectHandler
UxpSslEndpointThrottleHandler
UxpSslEndpointWaitForThrottleHandler
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindScopedCcsHandler
UxpSslFindSniHandler
UxpSslFindWildcardScopedCcsHandler
UxpSslFindWildcardSniHandler
UxpSslFreeDataIndication
UxpSslGenerateCloseNotify
UxpSslGetHandshakeSizes
UxpSslGetHandshakeTiming
UxpSslIndicateReceiveEvent
UxpSslInitializeSchCredentials
UxpSslInitiateAscHandler
UxpSslLoadCertificateSync
UxpSslParseAndCopyDataIndication
UxpSslProcessApplicationProtocolQuery
UxpSslQuerySni
UxpSslReadErrorHeadersFromRegistry
UxpSslReceiver
UxpSslReceiverAcceptSecurityContextForServerHello
UxpSslRetrieveIrpCancelRoutine
UxpSslScavengerCallback
UxpSslSetIrpConnection
UxpSslWaitForCcsAchHandler
UxpSslWaitForIpAchHandler
UxpSslWaitForIpv4WildcardAchHandler
UxpSslWaitForIpv6WildcardAchHandler
UxpSslWaitForScopedCcsAchHandler
UxpSslWaitForSniAchHandler
UxpSslWaitForWildcardSniAchHandler
UxpSslWriteCertConfigToRegistry
UxpSslWriteErrorHeadersToRegistry
UxpSslWriteTlsRestrictionsToRegistry
UxpTpDequeueTransmitPacket
UxpTpDirectTransmitFromMdl
UxpTpDirectTransmitKernelMemory
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
|
Expand for full list:
FUN_14015569e
FUN_140156844
FUN_140158150
FUN_1401587d6
FUN_14015a692
FUN_14015a6be
FUN_14015ae46
FUN_14015be24
HttppPrintIpAddressA
HttppPrintIpAddressW
QkComputeRequiredInsertCountQkDecodeControl
QkDecodeData
QkDecodeLiteral
QkDecodeLiteralEmbeddedLength
QkDecodeNumber
QkEncodeData
QkEncodeReset
QkEncodeSetDynamicTableCapacity
QkFindStreamRefListEntry
QkProcessHeaderAcks
QkProcessInsertCountIncrement
QkRecalculateDrainOrdinal
QkVerifyStaticOrdinal
UcAbortClientConnectionIoctl
UcAbortClientStreamIoctl
UcAbortConnection
UcAllocateStream
UcCleanupClientSessionContext
UcCloseClientConnectionIoctl
UcCloseClientCredentialIoctl
UcCloseClientStreamIoctl
UcCloseConnection
UcConnectionCancelIrp
UcConnectionGetQuicConnection
UcConnectionPendIrp
UcCreateClientConnectionIoctl
UcCreateClientCredentialIoctl
UcCreateClientStreamIoctl
UcGetNewStreamEntityBodyState
UcGetQuicSession
UcLinkConnectionToSessionContext
UcLinkCredentialToSessionContext
UcLinkStreamToConnection
UcNotifyDisconnectClientStreamIoctl
UcQueryClientConnectionIoctl
UcQueryClientStreamIoctl
UcReceiveEntityBodyClientStreamIoctl
UcReceiveHeadersClientStreamIoctl
UcSendEntityBodyClientStreamIoctl
UcSendHeadersClientStreamFastIo
UcSessionContextFromFileObject
UcSetClientConnectionIoctl
UcSetClientConnectionProperty
UcSetClientStreamProperty
UcSetClientStreamPropertyIoctl
UcSetIrpCancellationRoutine
UcStartClientConnectionIoctl
UcStreamFastForwardReceive
UcStreamFreeReceiveBuffer
UcStreamIdealBacklogEvent
UcStreamSend
UcUnlinkStreamFromConnection
UcValidateClientConnectionFromId
UcValidateClientCredentialFromId
UcValidateClientStreamFromId
UcValidateClientStreamFromIdForFastForwarding
UcWaitForClientConnectionDisconnect
UcWaitForClientConnectionDisconnectIoctl
UcpAbortStream
UcpAddConnectionToSessionContext
UcpAddCredentialToSessionContext
UcpAllocateClientSessionContext
UcpConnectionResetIrpCancellationRoutine
UcpCoupleSessionContextAndSession
UcpNotifyDisconnectClientStream
UcpReceiveHeadersClientStream
UcpRemoveConnectionFromSessionContext
UcpRemoveCredentialFromSessionContext
UcpRemoveSessionContextFromSessionList
UcpSendEntityBodyClientStream
UcpStreamCancelIrp
UcpStreamMarkSendDisconnected
UcpStreamResetIrpCancellationRoutine
UcpStreamSendCompletion
UlAddFragmentToCacheIoctl
UlAddToHashTable
UlAddUrlToUrlGroupIoctl
UlAiGetAddressInformation
UlAllocateConnectionRequestId
UlBeginOpaqueMode
UlCancelHttpRequestIoctl
UlCancelRequestIo
UlCancelSendHttpResponse
UlCaptureLogFieldsETW
UlCaptureLogFieldsW3C
UlChargeRequestQueueQuota
UlCheckCachePreconditions
UlCheckDisconnectInfo
UlCheckProtocolCompliance
UlCheckRawResponseCompatibility
UlCheckReceiveEntityBodyState
UlCheckoutUriCacheEntry
UlCleanupConnectionCouplings
UlCleanupConsumer
UlCleanupHttpConnection
UlCloseServerSessionIoctl
UlCompleteWaitForDisconnects
UlConsumerCleanupCompletion
UlControlServiceIoctl
UlCookUrl
UlCopyConfigGroupInfoForCache
UlCopyParsedHeaders
UlCopyRequestQueueCounters
UlCopyRequestToBuffer
UlCopyRequestToIrp
UlCreateAutoConfigGroup
UlCreateServerSessionIoctl
UlCreateUrlGroupIoctl
UlDeclarePushIoctl
UlDelegateRequest
UlDelegateRequestExFastIo
UlDelegateRequestExIoctl
UlDelegateRequestFastIo
UlDelegateRequestIoctl
UlDeleteConfigGroup
UlDeleteConfigGroupById
UlDeleteServerSession
UlDeleteServiceConfigIoctl
UlDeleteUrlGroupIoctl
UlDeliverEntityBody
UlDestroyCapturedResponse
UlEtwEvaluateFilter
UlEvaluateRequest
UlEvaluateRequestFastIo
UlEvaluateRequestIoctl
UlEventLogRemoveAllUrls
UlFastReceiveHttpRequest
UlFeatureSupportedIoctl
UlFindUrlGroupId
UlFindUrlGroupIdIoctl
UlFlushCacheByConfigGroup
UlFlushCacheForAddUrl
UlFlushLogFileBuffer
UlFlushResponseCacheIoctl
UlFreeBuildTracker
UlFreeConfigGroup
UlGenerateDateHeader
UlGetAutoConfigGroup
UlGetCGroupForRequest
UlGetCommChannel
UlGetCountersIoctl
UlGetRequestFromId
UlGetTransportIdleConnectionTimeout
UlHandle100Continue
UlHostHeaderHandler
UlHttpIdealBacklogEvent
UlHttpIngressDisconnectEvent
UlHttpReceiveHeadersEvent
UlLookupAndVerifyCacheEntry
UlLookupHostPlusIPSite
UlNotifyForAllChannels
UlNotifyForAllConfigGroups
UlNotifyIPListenListChanges
UlPrepareUrlIoctl
UlQosConfigureFlowCharacteristics
UlQueryConsumerProcessInfo
UlQueryExpectHeader
UlQueryRequestIoctl
UlQueryRequestQueueIoctl
UlQueryServerSessionIoctl
UlQueryServiceConfigIoctl
UlQueryUrlGroupIoctl
UlReadFragmentFromCacheIoctl
UlReceiveClientCertIoctl
UlReceiveEntityBodyIoctl
UlReceiveHttpRequest
UlReceiveHttpRequestIoctl
UlReleaseRequestBuffer
UlRemoveConnectionOptionHeaders
UlRemoveSendIrpCancelRoutine
UlRemoveUrlFromUrlGroupIoctl
UlResumeParsing
UlScStopCounters
UlSendCachedResponse
UlSendEntityBodyIoctlOld
UlSendErrorResponse
UlSendHttpResponseIoctlOld
UlSetEntityBodyType
UlSetHttpConnectionTokenBinding
UlSetRequestFastIo
UlSetRequestIoctl
UlSetRequestProperty
UlSetRequestQueueIoctl
UlSetResponseDisconnectFlags
UlSetServerSessionIoctl
UlSetServiceConfigIoctl
UlSetUrlGroupIoctl
UlShutdownRequestQueueIoctl
UlSingleHeaderHandler
UlStartRequestQueueTimer
UlStopRequestQueueTimer
UlTimeoutQueuedRequest
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlUpdateServiceConfigIoctl
UlUserAgentHeaderHandler
UlValidateConfigGroup
UlValidateConfigGroupBoundToRequestQueue
UlValidateHttpConnectionFromId
UlValidateHttpRequestFromId
UlValidateServerSession
UlWaitForDemandStart
UlWaitForDemandStartIoctl
UlWaitForDisconnectIoctl
UlpAdjustBuffers
UlpAllocateConfigGroupObject
UlpAttachConsumerToRequestQueue
UlpAuthenticateRequest
UlpAuthenticateRequestCompletion
UlpBindServerSessionToCommChannel
UlpCancelDemandStartIrp
UlpCancelEntityBody
UlpCancelHttpReceiveIrp
UlpCancelWaitForDisconnectIrp
UlpCheckSpaceAndAddEntryStats
UlpCleanAllUrls
UlpCleanupCoupling
UlpCleanupZombieHttpConnection
UlpCloseConnectionWorker
UlpCloseDisconnectedConnection
UlpCloseLogFileWorker
UlpCompleteCacheBuild
UlpCompleteSendCacheEntryWorker
UlpConnectionDisconnectWorker
UlpCopyCacheEntryInfo
UlpCopyChannelBindTokenToIrp
UlpCopyFragmentInfo
UlpCopyGlobalCounters
UlpCopyRequestInformation
UlpCopySslParamEx32
UlpCopySslSniSet32
UlpCopySslSniSetEx32
UlpCopyUrlGroupCounters
UlpCreateConfigGroup
UlpDeliverHttpRequest
UlpDeliverRequestStageInitial
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpExtractSchemeHostPortIp
UlpFinalizeQValueTable
UlpFlushConsumerCallbacks
UlpFlushFilterClearCentralizedLogged
UlpFlushFilterForAddUrl
UlpFlushFilterForRemoveUrl
UlpFlushFilterIncScavengerTicks
UlpFlushFilterTrimCache
UlpFlushFilterUriRecursive
UlpFreeCoupling
UlpFreeHttpRequest
UlpGetIrpProcessIdAndImageName
UlpHandle503Response
UlpHandleRequest
UlpHkeAcquireQoS
UlpIndicateCompleteToExtension
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpIsLocalRequest
UlpIsRequestFromProxy
UlpLockRequestQueueAndCoupling
UlpNotifyIPListenListChangesOfConfigGroup
UlpParseFullUrl
UlpParseNextRequest
UlpParseTransferEncoding
UlpQosDeleteFlowCharacteristicsOfConfigGroup
UlpQueryConfigGroupBinding
UlpQueryRequestQueue503Verbosity
UlpQueryRequestQueueLengthLimit
UlpQueryRequestQueueState
UlpQueryTranslateHeader
UlpQueueFreeHttpRequest
UlpRebuildRequestHeaders
UlpRebuildResponseHeaders
UlpReceiveData
UlpRemoveRequestFromLane
UlpRemoveZombieHttpConnection
UlpReplaceSystemAccessToken
UlpRetrieveRequest
UlpSendErrorResponse
UlpSendSimpleStatusWorker
UlpSetFilterData
UlpSynchronizeLanesWorker
UlpThreadPoolWorker
UlpUnbindCoupling
UlpUpdateFlushedRequestState
UlpValidateTrailerHeader
UlpZombifyHttpConnection
UxCleanup
UxClose
UxCreate
UxDeviceControl
UxDuoAttachConnection
UxDuoReleaseReceiveBuffers
UxPodAttachThread
UxPodReleaseSiloHold
UxPodSiloTerminate
UxPodSiloTerminateCallback
UxPodTryAttachThread
UxQuicConnectionAcceptStream
UxQuicConnectionGetAndUpdatePushId
UxQuicConnectionStartPushStream
UxQuicFreeStream
UxQuicGetDscpTag
UxQuicPreParser
UxQuicStreamPushInjectDestroyContext
UxQuicStreamReleaseReceiveBuffers
UxReadCompleteFileEntry
UxReadCompleteFileEntryFast
UxReadFileEntryFast
UxSslAcceptSecurityContextCallback
UxSslAcquireCredentialsHandle
UxSslAcquireCredentialsHandleLookupCallback
UxSslAllocateAscContext
UxSslCopyConfigurationProperties
UxSslCopyExtendedProperties
UxSslFreeBufferIndication
UxSslGetAltSvcInfo
UxSslGetProperties
UxSslGetTokenBinding
UxSslGetValidatedSniHostname
UxSslIdealBacklogEvent
UxSslInitializeClientCertPolicy
UxSslInsertEndpointConfig
UxSslLookupEndpointConfig
UxSslParseTlsRestrictions
UxSslQueueIndicationList
UxSslReleaseReceiveBuffers
UxSslRetrieveChannelBindingToken
UxSslSetCurrentLookupConfig
UxSslValidateTlsRestrictions
UxTlDestroyConnection
UxTlGetDscpTag
UxTpTransmitPacket
UxpQuicCompleteDecodeControlBytes
UxpQuicCompleteEncodeControlBytes
UxpQuicConnectionAbortNonAcceptedStreams
UxpQuicConnectionCallbackHandler
UxpQuicConnectionCheckCancelPushThrottle
UxpQuicConnectionCheckServerCert
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicConnectionSetConfiguration
UxpQuicCreateStream
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicParseAndCopyDataIndication
UxpQuicStreamCalculateQuicBufferCount
UxpQuicStreamCallbackEpilog
UxpQuicStreamCallbackHandler
UxpQuicStreamIndicateReceiveEvent
UxpQuicStreamInitializePushState
UxpQuicStreamProcessReceive
UxpQuicStreamProcessTransportIndicationsList
UxpQuicStreamQueueEncodeHeaders
UxpQuicStreamQuicDeclarePushPromise
UxpSslAcceptSecurityContext
UxpSslAcquireCredentialsHandleCreationCallback
UxpSslAllocateRegistration
UxpSslCleanupConnection
UxpSslConfigToPrincipal
UxpSslConnectionDecryptData
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslCreateRegistration
UxpSslDecryptTransportIndication
UxpSslDeleteChildConfigCallback
UxpSslEndpointFoundHandler
UxpSslEndpointGetSniHostname
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointNotFoundHandler
UxpSslEndpointParseSni
UxpSslEndpointRejectHandler
UxpSslEndpointThrottleHandler
UxpSslEndpointWaitForThrottleHandler
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindScopedCcsHandler
UxpSslFindSniHandler
UxpSslFindWildcardScopedCcsHandler
UxpSslFindWildcardSniHandler
UxpSslFreeDataIndication
UxpSslGenerateCloseNotify
UxpSslGetHandshakeSizes
UxpSslGetHandshakeTiming
UxpSslIndicateReceiveEvent
UxpSslInitializeSchCredentials
UxpSslLoadCertificateSync
UxpSslParseAndCopyDataIndication
UxpSslProcessApplicationProtocolQuery
UxpSslQuerySni
UxpSslReadErrorHeadersFromRegistry
UxpSslReceiver
UxpSslReceiverAcceptSecurityContextForServerHello
UxpSslRetrieveIrpCancelRoutine
UxpSslScavengerCallback
UxpSslSetIrpConnection
UxpSslWaitForCcsAchHandler
UxpSslWaitForIpAchHandler
UxpSslWaitForIpv4WildcardAchHandler
UxpSslWaitForIpv6WildcardAchHandler
UxpSslWaitForScopedCcsAchHandler
UxpSslWaitForSniAchHandler
UxpSslWaitForWildcardSniAchHandler
UxpSslWriteCertConfigToRegistry
UxpSslWriteErrorHeadersToRegistry
UxpSslWriteTlsRestrictionsToRegistry
UxpTpDequeueTransmitPacket
UxpTpDirectTransmitFromMdl
UxpTpDirectTransmitKernelMemory
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
| |paramcount|4|4| |`address`|1401b9308|1401b92e8| |sig|undefined __fastcall WPP_SF_iq(undefined2 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_iq(undefined2 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_iq Calling Diff ```diff --- WPP_SF_iq calling +++ WPP_SF_iq calling @@ -1,8 +1,8 @@ -FUN_140154f32 -FUN_1401560d8 -FUN_1401582ca -FUN_140158950 -FUN_14015a80c -FUN_14015a838 -FUN_14015afc0 -FUN_14015bf9e +FUN_14015569e +FUN_140156844 +FUN_140158150 +FUN_1401587d6 +FUN_14015a692 +FUN_14015a6be +FUN_14015ae46 +FUN_14015be24 @@ -113 +112,0 @@ -UlCopyGlobalCounters @@ -118 +116,0 @@ -UlCopyUrlGroupCounters @@ -240,0 +239 @@ +UlpCopyGlobalCounters @@ -244,0 +244 @@ +UlpCopyUrlGroupCounters @@ -398 +397,0 @@ -UxpSslInitiateAscHandler ``` ## WPP_SF_id ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.94| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|WPP_SF_id|WPP_SF_id| |fullname|WPP_SF_id|WPP_SF_id| |`refcount`|378|380| |length|65|65| |called|FastWppTraceMessage|FastWppTraceMessage| |`calling`|
Expand for full list:
FUN_14000ad3a
FUN_140018f70
FUN_14001d716
FUN_14003b046
FUN_140153016
FUN_140154172
FUN_140155f08
FUN_14015b63c
FUN_14015baea
FUN_14015c2e7
FUN_14015cda4FUN_14015f69d
HkDecode
HkDecodeLiteral
HkDecodeNumber
HkEncode
HkEncodeString
HkSetEmitterDrain
HttpCopyHost
HttpCopyUrl
HttpNormalizeNamedHost
HttpParseUrl
HttpUnescapePercentHexEncoding
HttppCleanAndCopyUrlByType
HttppNormalizePath
HttppPopCharAbsPathCommonTail
HttppPopCharAbsPathUtf8
HttppRebuildFixedUrl
QkAddPairToTable
QkDecodeControl
QkDecodeData
QkDecodeNumber
QkEncodeControl
QkEncodeData
QkEncodeSetDynamicTableCapacity
QkEncodeString
QkEncodeStringPrefix
QkSetEmitterDrain
UcAbortClientConnectionFastIo
UcAbortClientStreamFastIo
UcConnectionCancelIrpWorker
UcGetNewStreamEntityBodyState
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcSetClientConnectionFastIo
UcSetClientStreamPropertyFastIo
UcStreamFastForwardReceive
UcStreamIngressDisconnectEvent
UcStreamReceiveHeadersEvent
UcStreamSendHeaders
UcpGetSendHeadersPairs
UcpReceiveEntityBodyClientStream
UcpReceiveHeadersClientStream
UcpStreamCancelIrpWorker
UcpStreamProcessFastForwardReceiveDataInternal
UlAddSite
UlAiGetAddressInformation
UlAiPktMonRegisterAddressInformation
UlAllocateBuildTracker
UlCGCreateHashTable
UlCGFindHashTableEntry
UlCGRebuildHashTable
UlCanSatisfyRangesFromCache
UlCaptureHttpResponse
UlCaptureHttpResponseOld
UlCaptureQosParameter
UlCheckoutFragmentCacheEntry
UlCleanupBundle
UlCleanupConfigGroupInfo
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlCompleteWaitForDisconnects
UlConsumeBytesFromConnection
UlCookUrl
UlCopyEntityBodyToBuffer
UlCreateCommChannel
UlCreateConfigGroup
UlCreateConsumer
UlCreateServerSession
UlEgressDisconnectCompletion
UlErrorLog
UlEventFlushResponseCache
UlFastForwardDetachEvent
UlFastForwardIdealBacklogEvent
UlFastForwardIngressDisconnectEvent
UlGenerateMultipleKnownHeaders
UlGetCGroupForRequest
UlGetCommChannel
UlGetConfigGroupInfoForSanitizedUrl
UlGetConsumer
UlGetServerSessionFromId
UlGetUserTokenBindingInfoSize
UlHandleCacheFlushedNotification
UlHttpConnectionTimeout
UlHttpDetachConnection
UlHttpIngressDisconnectEvent
UlHttpReceiveHeadersEvent
UlIncCacheEntryAges
UlInitializeBundle
UlInitializeConfigGroupInfo
UlQueryKnownRequestHeader
UlQueryServiceConfigIoctl
UlQueryUnknownRequestHeader
UlReceiveClientCertIoctl
UlReceiveHttpRequestFastIo
UlReceiveHttpRequestIoctl
UlReferenceRequestQueueByHandle
UlRemoveUrlFromUrlGroupIoctl
UlResumeParsing
UlSendCachedResponse
UlSendHttpResponse
UlSetConnectionsProperty
UlSetLogTimer
UlUnlinkHkeContext
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlVerifyOpaqueUpgradeHeader
UlpAllocateConsumer
UlpAllocateServerSession
UlpBuildEdgePolicyNotifyListForConfigGroup
UlpBuildUriKeyFromCookedUrl
UlpCancelEntityBodyWorker
UlpCheckAndSetRequestQueueExternalId
UlpCleanupCoupling
UlpCopyFragmentInfo
UlpCopyRequestToBuffer
UlpCreateCacheRangeSliceTracker
UlpCreateFastForwardDataContext
UlpCreateFastForwardDataContextBuffer
UlpCreateFastForwardDataContextMdls
UlpCreateFastForwardDataContextMdlsNew
UlpCreateFastForwardTransformChunkedEncodingDataContextMdl
UlpCreateFragmentCacheEntry
UlpCreateHttpRequest
UlpCreateRequestQueue
UlpDeliverHttpRequest
UlpDeliverRequestStageInitial
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFastForwardResponse
UlpFindCoupling
UlpFreeCoupling
UlpFreeHttpRequest
UlpFreeSliceDescriptor
UlpGetCommChannelFromHandle
UlpHandleErrorLogFileRecycle
UlpHandleRecycle
UlpLockRequestQueueAndCoupling
UlpLookupVerb
UlpOpenCoupling
UlpOpenRequestQueue
UlpParseLWS
UlpParseNextRequest
UlpParseTransferEncoding
UlpPrepareHttpResponse
UlpPrepareHttpResponseOld
UlpQueueLoggingRoutineWorker
UlpRedeliverFlushedRequest
UlpSendResponseEntityBodyToExtension
UlpSetRequestQueue503Verbosity
UlpSetRequestQueueLengthLimit
UlpSetRequestQueueState
UlpSubmitRequest
UlpTimerWheelWorker
UlpTreeFindNodeHelper
UlpTreeFindNodeWalker
UlpTreeFindRegistrationNode
UlpTreeFindReservationNode
UlpTreeFindSiteIpMatch
UlpTreeFindWildcardSite
UlpTreeInsert
UxCreateFileCacheEntry
UxDuoAllocateStream
UxDuoAttachConnection
UxGenerateSubdomainWildcardHostname
UxGetInputBuffer
UxGetOutputBufferForBuffered
UxPodCleanupCallback
UxPodSiloCreateCallback
UxPodSiloTerminateCallback
UxQuicAbortConnection
UxQuicConnectionDequeueDecodeTracker
UxQuicConnectionRetrievePeerCertificate
UxQuicConnectionTimeout
UxQuicCreateSession
UxQuicGetTransportIdleConnectionTimeout
UxQuicOpenListener
UxQuicSetConnectionState
UxQuicSetDscpTag
UxQuicSetTransportIdleConnectionTimeout
UxQuicStreamCompleteHeadersDecode
UxQuicStreamConnectionControl
UxQuicStreamIncrementBlockedDecodeCount
UxQuicStreamOpen
UxQuicStreamReceiveSetEnabled
UxQuicStreamStart
UxSslAbortConnection
UxSslAcquireCredentialsHandle
UxSslAllocateAchContext
UxSslAllocateAscContext
UxSslConnectionTimeout
UxSslCreateConfiguration
UxSslDeleteConfigRegistryKey
UxSslDetachConnection
UxSslEndpointVerifyTls13Sync
UxSslFreeConnection
UxSslGetAltSvcInfo
UxSslGetValidatedSniHostname
UxSslIngressDisconnectEvent
UxSslInitiateAbort
UxSslInitiateEgressDisconnect
UxSslInitiateSend
UxSslInsertEndpointConfig
UxSslOpenConfigRegistryKey
UxSslParseSni
UxSslQueueDisconnectEvent
UxSslQueueReceiverWorkItem
UxSslReleaseEndpointConfiguration
UxSslRestartSendRawData
UxSslRetrieveChannelBindingToken
UxSslRetrieveClientCertificate
UxSslScavengeCertificate
UxSslScavengeEndpointConfig
UxSslSetEndpointLookupState
UxSslValidateSni
UxTlConnectionControl
UxTlGetDscpTag
UxTlSetDscpTag
UxWfpConnectionClassify
UxWskAcceptEvent
UxpQuicAbortConnectionLocked
UxpQuicAllocateConfigurationContext
UxpQuicCompleteControlSendTracker
UxpQuicCompleteDecodeControlBytes
UxpQuicCompleteEncodeControlBytes
UxpQuicConnectionCallbackHandler
UxpQuicConnectionCheckServerCert
UxpQuicConnectionConnected
UxpQuicConnectionGetNextDecodeTracker
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionRestartPeerDecodeReceives
UxpQuicConnectionRestartPeerEncodeReceives
UxpQuicConnectionShutdownComplete
UxpQuicConnectionStoreClientCert
UxpQuicCopyPeerCertToIrp
UxpQuicDecodeControlStreamCallbackHandler
UxpQuicEncodeControlStreamCallbackHandler
UxpQuicIndicateStreamStartComplete
UxpQuicListenerCallbackHandler
UxpQuicListenerNewConnection
UxpQuicPeerDecodeControlStreamCallbackHandler
UxpQuicPeerEncodeControlStreamCallbackHandler
UxpQuicQueryConnectionInfo
UxpQuicReceiveControlStreamCallbackHandler
UxpQuicSendControlStreamCallbackHandler
UxpQuicStreamAllDataIndicated
UxpQuicStreamBuildSendTracker
UxpQuicStreamCalculateQuicBufferCount
UxpQuicStreamCallbackHandler
UxpQuicStreamGoawaySync
UxpQuicStreamIndicateHeadersEvent
UxpQuicStreamIndicateReceiveEvent
UxpQuicStreamIngressDisconnectEvent
UxpQuicStreamIsRetriable
UxpQuicStreamParseReceiveBuffer
UxpQuicStreamReceiveEvent
UxpQuicStreamRestartReceives
UxpQuicStreamSendShutdownComplete
UxpQuicUpdateDataIndication
UxpSslAcceptSecurityContext
UxpSslAllocateRegistration
UxpSslCertificateScavenger
UxpSslCleanupConnection
UxpSslCommonSendDataHelper
UxpSslConsumeReceiveBufferSpace
UxpSslCopyClientCertToIrp
UxpSslEndpointIncrementAscCount
UxpSslEndpointInvalidateCertificate
UxpSslEndpointLoadCertificateAsync
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointParseSni
UxpSslEndpointThrottleHandler
UxpSslEndpointUnloadCertificate
UxpSslExpandTransportDataIndication
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindSniHandler
UxpSslGenerateCloseNotify
UxpSslGetAlpnExtension
UxpSslIndicateReceiveEvent
UxpSslInitiateAscHandler
UxpSslLoadConfigurations
UxpSslPrepareSendBuffer
UxpSslQuerySslConnectionInfo
UxpSslQuerySslConnectionPostHandshakeClientAuth
UxpSslQuerySslTokenBindingInfo
UxpSslReceiverAcceptSecurityContextForServerHello
UxpSslReceiverCreateServerHelloMessage
UxpSslReceiverSendServerHelloMessage
UxpSslSetConnectionState
UxpSslSetNotifyCallout
UxpSslUpdateCertificateState
UxpSslWaitForAscHandler
UxpTpDirectTransmitFromMdl
UxpTpDirectTransmitKernelMemory
UxpTpEnqueueTransmitPacket
|
Expand for full list:
FUN_14000ae1a
FUN_140019050
FUN_14001d7f6
FUN_14006f85a
FUN_140153782
FUN_1401548de
FUN_140156674
FUN_14015b4c2
FUN_14015b970
FUN_14015c16d
FUN_14015fcd5HkDecode
HkDecodeLiteral
HkDecodeNumber
HkEncode
HkEncodeString
HkSetEmitterDrain
HttpCopyHost
HttpCopyUrl
HttpNormalizeNamedHost
HttpParseUrl
HttpUnescapePercentHexEncoding
HttppCleanAndCopyUrlByType
HttppNormalizePath
HttppPopCharAbsPathCommonTail
HttppPopCharAbsPathUtf8
HttppRebuildFixedUrl
QkAddPairToTable
QkDecodeControl
QkDecodeData
QkDecodeNumber
QkEncodeControl
QkEncodeData
QkEncodeSetDynamicTableCapacity
QkEncodeString
QkEncodeStringPrefix
QkSetEmitterDrain
UcAbortClientConnectionFastIo
UcAbortClientStreamFastIo
UcConnectionCancelIrpWorker
UcGetNewStreamEntityBodyState
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcSetClientConnectionFastIo
UcSetClientStreamPropertyFastIo
UcStreamFastForwardReceive
UcStreamIngressDisconnectEvent
UcStreamReceiveHeadersEvent
UcStreamSendHeaders
UcpGetSendHeadersPairs
UcpReceiveEntityBodyClientStream
UcpReceiveHeadersClientStream
UcpStreamCancelIrpWorker
UcpStreamProcessFastForwardReceiveDataInternal
UlAddSite
UlAiGetAddressInformation
UlAiPktMonRegisterAddressInformation
UlAllocateBuildTracker
UlCGCreateHashTable
UlCGFindHashTableEntry
UlCGRebuildHashTable
UlCanSatisfyRangesFromCache
UlCaptureHttpResponse
UlCaptureHttpResponseOld
UlCaptureQosParameter
UlCheckoutFragmentCacheEntry
UlCleanupBundle
UlCleanupConfigGroupInfo
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlCompleteWaitForDisconnects
UlConsumeBytesFromConnection
UlCookUrl
UlCopyEntityBodyToBuffer
UlCreateCommChannel
UlCreateConfigGroup
UlCreateConsumer
UlCreateServerSession
UlEgressDisconnectCompletion
UlErrorLog
UlEventFlushResponseCache
UlFastForwardDetachEvent
UlFastForwardIdealBacklogEvent
UlFastForwardIngressDisconnectEvent
UlGenerateMultipleKnownHeaders
UlGetCGroupForRequest
UlGetCommChannel
UlGetConfigGroupInfoForSanitizedUrl
UlGetConsumer
UlGetServerSessionFromId
UlGetUserTokenBindingInfoSize
UlHandleCacheFlushedNotification
UlHttpConnectionTimeout
UlHttpDetachConnection
UlHttpIngressDisconnectEvent
UlHttpReceiveHeadersEvent
UlIncCacheEntryAges
UlInitializeBundle
UlInitializeConfigGroupInfo
UlQueryKnownRequestHeader
UlQueryServiceConfigIoctl
UlQueryUnknownRequestHeader
UlReceiveClientCertIoctl
UlReceiveHttpRequestFastIo
UlReceiveHttpRequestIoctl
UlReferenceRequestQueueByHandle
UlRemoveUrlFromUrlGroupIoctl
UlResumeParsing
UlSendCachedResponse
UlSendHttpResponse
UlSetConnectionsProperty
UlSetLogTimer
UlUnlinkHkeContext
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlVerifyOpaqueUpgradeHeader
UlpAllocateConsumer
UlpAllocateServerSession
UlpBuildEdgePolicyNotifyListForConfigGroup
UlpBuildUriKeyFromCookedUrl
UlpCancelEntityBodyWorker
UlpCheckAndSetRequestQueueExternalId
UlpCheckIfBypassRangeProcessing
UlpCleanupCoupling
UlpCopyFragmentInfo
UlpCopyRequestToBuffer
UlpCreateCacheRangeSliceTracker
UlpCreateFastForwardDataContext
UlpCreateFastForwardDataContextBuffer
UlpCreateFastForwardDataContextMdls
UlpCreateFastForwardDataContextMdlsNew
UlpCreateFastForwardTransformChunkedEncodingDataContextMdl
UlpCreateFragmentCacheEntry
UlpCreateHttpRequest
UlpCreateRequestQueue
UlpDeliverHttpRequest
UlpDeliverRequestStageInitial
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFastForwardResponse
UlpFindCoupling
UlpFreeCoupling
UlpFreeHttpRequest
UlpFreeSliceDescriptor
UlpGetCommChannelFromHandle
UlpHandleErrorLogFileRecycle
UlpHandleRecycle
UlpLockRequestQueueAndCoupling
UlpLookupVerb
UlpOpenCoupling
UlpOpenRequestQueue
UlpParseLWS
UlpParseNextRequest
UlpParseTransferEncoding
UlpPrepareHttpResponse
UlpPrepareHttpResponseOld
UlpQueueLoggingRoutineWorker
UlpRedeliverFlushedRequest
UlpSendResponseEntityBodyToExtension
UlpSetRequestQueue503Verbosity
UlpSetRequestQueueLengthLimit
UlpSetRequestQueueState
UlpSubmitRequest
UlpTimerWheelWorker
UlpTreeFindNodeHelper
UlpTreeFindNodeWalker
UlpTreeFindRegistrationNode
UlpTreeFindReservationNode
UlpTreeFindSiteIpMatch
UlpTreeFindWildcardSite
UlpTreeInsert
UxCreateFileCacheEntry
UxDuoAllocateStream
UxDuoAttachConnection
UxGenerateSubdomainWildcardHostname
UxGetInputBuffer
UxGetOutputBufferForBuffered
UxPodCleanupCallback
UxPodSiloCreateCallback
UxPodSiloTerminateCallback
UxQuicAbortConnection
UxQuicConnectionDequeueDecodeTracker
UxQuicConnectionRetrievePeerCertificate
UxQuicConnectionTimeout
UxQuicCreateSession
UxQuicGetTransportIdleConnectionTimeout
UxQuicOpenListener
UxQuicSetConnectionState
UxQuicSetDscpTag
UxQuicSetTransportIdleConnectionTimeout
UxQuicStreamCompleteHeadersDecode
UxQuicStreamConnectionControl
UxQuicStreamIncrementBlockedDecodeCount
UxQuicStreamOpen
UxQuicStreamReceiveSetEnabled
UxQuicStreamStart
UxSslAbortConnection
UxSslAcquireCredentialsHandle
UxSslAllocateAchContext
UxSslAllocateAscContext
UxSslConnectionTimeout
UxSslCreateConfiguration
UxSslDeleteConfigRegistryKey
UxSslDetachConnection
UxSslEndpointVerifyTls13Sync
UxSslFreeConnection
UxSslGetAltSvcInfo
UxSslGetValidatedSniHostname
UxSslIngressDisconnectEvent
UxSslInitiateAbort
UxSslInitiateEgressDisconnect
UxSslInitiateSend
UxSslInsertEndpointConfig
UxSslOpenConfigRegistryKey
UxSslParseSni
UxSslQueueDisconnectEvent
UxSslQueueReceiverWorkItem
UxSslReleaseEndpointConfiguration
UxSslRestartSendRawData
UxSslRetrieveChannelBindingToken
UxSslRetrieveClientCertificate
UxSslScavengeCertificate
UxSslScavengeEndpointConfig
UxSslSetEndpointLookupState
UxSslValidateSni
UxTlConnectionControl
UxTlGetDscpTag
UxTlSetDscpTag
UxWfpConnectionClassify
UxWskAcceptEvent
UxpQuicAbortConnectionLocked
UxpQuicAllocateConfigurationContext
UxpQuicCompleteControlSendTracker
UxpQuicCompleteDecodeControlBytes
UxpQuicCompleteEncodeControlBytes
UxpQuicConnectionCallbackHandler
UxpQuicConnectionCheckServerCert
UxpQuicConnectionConnected
UxpQuicConnectionGetNextDecodeTracker
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionRestartPeerDecodeReceives
UxpQuicConnectionRestartPeerEncodeReceives
UxpQuicConnectionShutdownComplete
UxpQuicConnectionStoreClientCert
UxpQuicCopyPeerCertToIrp
UxpQuicDecodeControlStreamCallbackHandler
UxpQuicEncodeControlStreamCallbackHandler
UxpQuicIndicateStreamStartComplete
UxpQuicListenerCallbackHandler
UxpQuicListenerNewConnection
UxpQuicPeerDecodeControlStreamCallbackHandler
UxpQuicPeerEncodeControlStreamCallbackHandler
UxpQuicQueryConnectionInfo
UxpQuicReceiveControlStreamCallbackHandler
UxpQuicSendControlStreamCallbackHandler
UxpQuicStreamAllDataIndicated
UxpQuicStreamBuildSendTracker
UxpQuicStreamCalculateQuicBufferCount
UxpQuicStreamCallbackHandler
UxpQuicStreamGoawaySync
UxpQuicStreamIndicateHeadersEvent
UxpQuicStreamIndicateReceiveEvent
UxpQuicStreamIngressDisconnectEvent
UxpQuicStreamIsRetriable
UxpQuicStreamParseReceiveBuffer
UxpQuicStreamReceiveEvent
UxpQuicStreamRestartReceives
UxpQuicStreamSendShutdownComplete
UxpQuicUpdateDataIndication
UxpSslAcceptSecurityContext
UxpSslAllocateRegistration
UxpSslCertificateScavenger
UxpSslCleanupConnection
UxpSslCommonSendDataHelper
UxpSslConsumeReceiveBufferSpace
UxpSslCopyClientCertToIrp
UxpSslEndpointIncrementAscCount
UxpSslEndpointInvalidateCertificate
UxpSslEndpointLoadCertificateAsync
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointParseSni
UxpSslEndpointThrottleHandler
UxpSslEndpointUnloadCertificate
UxpSslExpandTransportDataIndication
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindSniHandler
UxpSslGenerateCloseNotify
UxpSslGetAlpnExtension
UxpSslIndicateReceiveEvent
UxpSslInitiateAscHandler
UxpSslLoadConfigurations
UxpSslPrepareSendBuffer
UxpSslQuerySslConnectionInfo
UxpSslQuerySslConnectionPostHandshakeClientAuth
UxpSslQuerySslTokenBindingInfo
UxpSslReceiverAcceptSecurityContextForServerHello
UxpSslReceiverCreateServerHelloMessage
UxpSslReceiverSendServerHelloMessage
UxpSslSetConnectionState
UxpSslSetNotifyCallout
UxpSslUpdateCertificateState
UxpSslWaitForAscHandler
UxpTpDirectTransmitFromMdl
UxpTpDirectTransmitKernelMemory
UxpTpEnqueueTransmitPacket
| |paramcount|4|4| |`address`|1401b8c1c|1401b8bfc| |sig|undefined __fastcall WPP_SF_id(undefined2 param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_id(undefined2 param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_id Calling Diff ```diff --- WPP_SF_id calling +++ WPP_SF_id calling @@ -1,12 +1,11 @@ -FUN_14000ad3a -FUN_140018f70 -FUN_14001d716 -FUN_14003b046 -FUN_140153016 -FUN_140154172 -FUN_140155f08 -FUN_14015b63c -FUN_14015baea -FUN_14015c2e7 -FUN_14015cda4 -FUN_14015f69d +FUN_14000ae1a +FUN_140019050 +FUN_14001d7f6 +FUN_14006f85a +FUN_140153782 +FUN_1401548de +FUN_140156674 +FUN_14015b4c2 +FUN_14015b970 +FUN_14015c16d +FUN_14015fcd5 @@ -123,0 +123 @@ +UlpCheckIfBypassRangeProcessing ``` ## UlpAssignThreadPoolWork ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.87| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpAssignThreadPoolWork|UlpAssignThreadPoolWork| |fullname|UlpAssignThreadPoolWork|UlpAssignThreadPoolWork| |`refcount`|53|52| |length|121|121| |called|NTOSKRNL.EXE::ExQueryDepthSList|NTOSKRNL.EXE::ExQueryDepthSList| |calling|
Expand for full list:
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlDestroyCapturedResponse
UlFreeBuildTracker
UlHttpIngressDisconnectEvent
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendSimpleStatus
UlThreadPoolEnqueueWorkItem
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueueUlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpLockRequestQueueAndCoupling
UlpQueueFreeHttpRequest
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteRunnerCompletion
UxDuoScheduleStreamSends
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxSslQueueReceiverWorkItemEx
UxSslRestartSendRawData
UxTlDestroyConnection
UxpSslCleanupConnection
UxpSslReceiver
UxpSslReceiverWorker
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
UxpTpRestartMdlRead
UxpTpRestartMdlSend
|
Expand for full list:
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlDestroyCapturedResponse
UlFreeBuildTracker
UlHttpIngressDisconnectEvent
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendSimpleStatus
UlThreadPoolEnqueueWorkItem
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueueUlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpLockRequestQueueAndCoupling
UlpQueueFreeHttpRequest
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteRunnerCompletion
UxDuoScheduleStreamSends
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxSslQueueReceiverWorkItemEx
UxSslRestartSendRawData
UxTlDestroyConnection
UxpSslCleanupConnection
UxpSslReceiver
UxpSslReceiverWorker
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
UxpTpRestartMdlRead
UxpTpRestartMdlSend
| |paramcount|2|2| |`address`|14011b8b0|14011bf00| |sig|uint __fastcall UlpAssignThreadPoolWork(longlong param_1, uint param_2)|uint __fastcall UlpAssignThreadPoolWork(longlong param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::KeGetCurrentProcessorNumberEx ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|KeGetCurrentProcessorNumberEx|KeGetCurrentProcessorNumberEx| |fullname|NTOSKRNL.EXE::KeGetCurrentProcessorNumberEx|NTOSKRNL.EXE::KeGetCurrentProcessorNumberEx| |`refcount`|56|55| |length|0|0| |called||| |calling|
Expand for full list:
UlAllocateConnectionRequestId
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlDestroyCapturedResponse
UlFreeBuildTracker
UlHttpIngressDisconnectEvent
UlPmAssociateTlConnection
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendSimpleStatus
UlThreadPoolEnqueueWorkItemUlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpLockRequestQueueAndCoupling
UlpQueueFreeHttpRequest
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UlpTransformAndQueueRequestBuffers
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteRunnerCompletion
UxDuoReceiveEvent
UxDuoScheduleStreamSends
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxSslQueueReceiverWorkItemEx
UxSslRestartSendRawData
UxTlDestroyConnection
UxpAllocateOpaqueIdEntry
UxpSslCleanupConnection
UxpSslReceiver
UxpSslReceiverWorker
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
UxpTpRestartMdlRead
UxpTpRestartMdlSend
|
Expand for full list:
UlAllocateConnectionRequestId
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlDestroyCapturedResponse
UlFreeBuildTracker
UlHttpIngressDisconnectEvent
UlPmAssociateTlConnection
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendSimpleStatus
UlThreadPoolEnqueueWorkItemUlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpLockRequestQueueAndCoupling
UlpQueueFreeHttpRequest
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UlpTransformAndQueueRequestBuffers
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteRunnerCompletion
UxDuoReceiveEvent
UxDuoScheduleStreamSends
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxSslQueueReceiverWorkItemEx
UxSslRestartSendRawData
UxTlDestroyConnection
UxpAllocateOpaqueIdEntry
UxpSslCleanupConnection
UxpSslReceiver
UxpSslReceiverWorker
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
UxpTpRestartMdlRead
UxpTpRestartMdlSend
| |paramcount|0|0| |address|EXTERNAL:00000094|EXTERNAL:00000094| |sig|undefined KeGetCurrentProcessorNumberEx(void)|undefined KeGetCurrentProcessorNumberEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## NTOSKRNL.EXE::PsGetCurrentServerSilo ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|PsGetCurrentServerSilo|PsGetCurrentServerSilo| |fullname|NTOSKRNL.EXE::PsGetCurrentServerSilo|NTOSKRNL.EXE::PsGetCurrentServerSilo| |`refcount`|65|64| |length|0|0| |called||| |calling|
Expand for full list:
UcSessionContextFromFileObject
UcpAllocateClientSession
UcpCreateClientSession
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlCreateCommChannel
UlDestroyCapturedResponse
UlFreeBuildTracker
UlGetCommChannel
UlGetConsumer
UlHttpIngressDisconnectEventUlReceiveHttpRequestFastIo
UlReceiveHttpRequestIoctl
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendSimpleStatus
UlThreadPoolEnqueueWorkItem
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlpAllocateRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFlushLogFileBufferWorker
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpLockRequestQueueAndCoupling
UlpQueueFreeHttpRequest
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UlpTransformAndQueueRequestBuffers
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteRunnerCompletion
UxDuoScheduleStreamSends
UxPodGetCurrent
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxSslQueueReceiverWorkItemEx
UxSslRestartSendRawData
UxTlDestroyConnection
UxpSslCleanupConnection
UxpSslReceiver
UxpSslReceiverWorker
UxpTlCreateListenEndpoint
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
UxpTpRestartMdlRead
UxpTpRestartMdlSend
|
Expand for full list:
UcSessionContextFromFileObject
UcpAllocateClientSession
UcpCreateClientSession
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlCreateCommChannel
UlDestroyCapturedResponse
UlFreeBuildTracker
UlGetCommChannel
UlGetConsumer
UlHttpIngressDisconnectEventUlReceiveHttpRequestFastIo
UlReceiveHttpRequestIoctl
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlSendSimpleStatus
UlThreadPoolEnqueueWorkItem
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlpAllocateRequestQueue
UlpCleanupCoupling
UlpCompleteCacheBuild
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFlushLogFileBufferWorker
UlpFreeCoupling
UlpFreeHttpRequest
UlpHandleRequest
UlpLockRequestQueueAndCoupling
UlpQueueFreeHttpRequest
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpSynchronizeLanes
UlpTransformAndQueueRequestBuffers
UxDuoDecrementParcelPending
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteRunnerCompletion
UxDuoScheduleStreamSends
UxPodGetCurrent
UxSslAcceptSecurityContextCallback
UxSslDetachComplete
UxSslDetachConnection
UxSslQueueReceiverWorkItemEx
UxSslRestartSendRawData
UxTlDestroyConnection
UxpSslCleanupConnection
UxpSslReceiver
UxpSslReceiverWorker
UxpTlCreateListenEndpoint
UxpTpFreeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartFastTransmit
UxpTpRestartMdlRead
UxpTpRestartMdlSend
| |paramcount|0|0| |address|EXTERNAL:00000131|EXTERNAL:00000131| |sig|undefined PsGetCurrentServerSilo(void)|undefined PsGetCurrentServerSilo(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## UxpPktMonTraceSslDropInternal ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.91| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UxpPktMonTraceSslDropInternal|UxpPktMonTraceSslDropInternal| |fullname|UxpPktMonTraceSslDropInternal|UxpPktMonTraceSslDropInternal| |`refcount`|3|4| |length|199|199| |called|PktMonClientHeaderInfoDropWithContext
UxpPktMonAddressesToHeaderInfo
__security_check_cookie|PktMonClientHeaderInfoDropWithContext
UxpPktMonAddressesToHeaderInfo
__security_check_cookie| |`calling`|UxPktMonTraceDropSslWithNtStatus
UxPktMonTraceQuicDropSslWithNtStatus|UxPktMonTraceDropSslWithNtStatus
UxPktMonTraceQuicDropSslWithNtStatus
UxpSslInitiateAscHandler| |paramcount|7|7| |`address`|140137d2c|1401384fc| |sig|undefined8 * __fastcall UxpPktMonTraceSslDropInternal(longlong param_1, short * param_2, longlong param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, undefined4 param_7)|undefined8 * __fastcall UxpPktMonTraceSslDropInternal(longlong param_1, short * param_2, longlong param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, undefined4 param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxpPktMonTraceSslDropInternal Calling Diff ```diff --- UxpPktMonTraceSslDropInternal calling +++ UxpPktMonTraceSslDropInternal calling @@ -2,0 +3 @@ +UxpSslInitiateAscHandler ``` ## wil_details_FeatureReporting_IncrementOpportunityInCache ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|length,address| |ratio|1.0| |i_ratio|0.79| |m_ratio|0.97| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_IncrementOpportunityInCache|wil_details_FeatureReporting_IncrementOpportunityInCache| |fullname|wil_details_FeatureReporting_IncrementOpportunityInCache|wil_details_FeatureReporting_IncrementOpportunityInCache| |refcount|2|2| |`length`|218|208| |called||| |calling|wil_details_FeatureReporting_RecordUsageInCache|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4|4| |`address`|1400b7058|1400b7758| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## WPP_SF_ ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|WPP_SF_|WPP_SF_| |fullname|WPP_SF_|WPP_SF_| |`refcount`|791|790| |length|26|26| |called|FastWppTraceMessage|FastWppTraceMessage| |`calling`|
Expand for full list:
FUN_1400190c5
FUN_14001d0d0
FUN_14001d716
FUN_14002411e
FUN_14004843c
FUN_140153258
FUN_140153ac6
FUN_1401548b2
FUN_14015497c
FUN_1401549b4
FUN_140154af6FUN_140154dd5
FUN_140157a1a
FUN_140158950
FUN_14015c52c
FUN_14015f69d
FUN_140160db6
FUN_1401620b4
FUN_14016216c
FUN_1401627a4
FUN_140162e56
FUN_140162ee7
FindChunkHeaderEnd
HttpEtwCallback
HttpFindUrlToken
HttpNormalizeNamedHost
HttpParseUrl
HttpStringToULongLong
HttpStringToUShort
HttpValidateHostname
HttppNormalizePath
HttppParseIPv6Address
HttppParseUrlPath
HttppParseUrlPort
HttppParseUrlScheme
HttppRebuildFixedUrl
HttppValidateIpv6Hostname
ParseChunkLength
UcAbortConnection
UcCleanupClientSessionContext
UcClientStreamDereferenceBundle
UcClientStreamReferenceBundle
UcCloseClientConnectionIoctl
UcCloseClientCredentialIoctl
UcCloseClientSessionContext
UcCloseClientStreamIoctl
UcConnectionCancelIrp
UcCreateClientConnectionIoctl
UcCreateClientCredentialIoctl
UcCreateClientStreamIoctl
UcDeleteStream
UcFreeCaptureConnectionParameters
UcFreeCaptureCredentialParameters
UcFreeClientSession
UcFreeConnection
UcFreeCredential
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcReferenceClientConnectionFromId
UcReferenceClientCredentialFromId
UcReferenceClientStreamFromId
UcSendHeadersClientStreamFastIo
UcSetClientConnectionFastIo
UcSetClientStreamPropertyFastIo
UcStreamIngressDisconnectEvent
UcStreamTimeout
UcpAbortClientConnection
UcpAbortClientStream
UcpAbortStream
UcpAbortStreamsFromConnection
UcpAddConnectionToSessionContext
UcpAddCredentialToSessionContext
UcpCancelConnectionIo
UcpCancelStreamIo
UcpCleanupClientSession
UcpCleanupConnection
UcpCoupleSessionContextAndSession
UcpDeleteConnection
UcpDeleteCredential
UcpDestroySendEntityChunks
UcpFlushConnectionsFromSessionContext
UcpFlushCredentialsFromSessionContext
UcpFlushStreamsFromConnection
UcpFreeClientSessionContext
UcpNotifyDisconnectClientStream
UcpReceiveEntityBodyClientStream
UcpReceiveHeadersClientStream
UcpRemoveSessionContextFromSessionList
UcpResetReceiveTimer
UcpSendEntityBodyClientStream
UcpSetReceiveTimer
UcpStreamCancelIrp
UcpStreamProcessFastForwardReceiveDataWorker
UcpStreamSendCompletion
UcpStreamSendHeadersCompletionCommon
UlAccessCheck
UlAddSslBinding
UlAiFreeAddressInformation
UlAiPktMonRegisterAddressInformation
UlAiPktMonUnregisterAddresses
UlAiStartModule
UlAiStartTrackingAddressInformation
UlAiStopModule
UlAllocateCacheTracker
UlAllocateChannelBindToken
UlAllocateConnectionRequestId
UlBeginOpaqueMode
UlBindConfigGroupToServerSession
UlBuildCacheEntryWorker
UlCGAddHashTableEntry
UlCGRebuildHashTable
UlCacheAndSendResponse
UlCancelRequestIo
UlCancelSendHttpResponse
UlCaptureDelegateRequestParameters
UlCheckCacheControlHeaders
UlCheckCachePreconditions
UlCheckProtocolCompliance
UlCheckinUriCacheEntry
UlCleanupCommChannel
UlCleanupConfigGroupInfo
UlCleanupConnectionCouplings
UlCleanupConsumer
UlCleanupConsumerInternal
UlCleanupHttpConnection
UlCloseCommChannel
UlCloseConnection
UlCloseConsumer
UlCompleteReceiveEntityBodyIrp
UlCompleteWaitForDisconnects
UlConnectionCleanupWorker
UlConsumeBytesFromConnection
UlConsumerCleanupCompletion
UlCopyAuthConfig
UlCopyConfigGroupInfoForCache
UlCopyEntityBodyToBuffer
UlCopyGlobalCounters
UlCreateCacheEntryFromResponse
UlDeclarePushIoctl
UlDelegateRequest
UlDeleteAutoServerSession
UlDeleteConsumerCallback
UlDeleteSslBinding
UlDeliverEntityBody
UlDestroyCapturedChunk
UlDestroyCapturedResponse
UlDestroyUriBaseCacheEntry
UlDestroyUriCacheEntry
UlEgressDisconnectCompletion
UlErrorLog
UlEvaluateRequest
UlFastForwardDetachEvent
UlFastForwardIdealBacklogEvent
UlFastForwardLogData
UlFastReceiveHttpRequest
UlFastSendCompleteWorker
UlFlushCache
UlFlushCacheByConfigGroup
UlFlushCacheByConsumer
UlFlushCacheByRequestQueue
UlFlushCacheByServerSession
UlFlushCacheForAddUrl
UlFlushCacheForRemoveUrl
UlFreeBuildTracker
UlFreeCacheTracker
UlFreeChannelBindToken
UlFreeCommChannel
UlFreeConfigGroup
UlFreeFastTracker
UlFreeHttpConnection
UlFreeRequestQueue
UlFreeServerSession
UlFreeUnknownCodingList
UlGetRequestFromId
UlGetTypeAndSubType
UlHandle100Continue
UlHttpAttachConnection
UlHttpConnectionTimeout
UlHttpDetachConnection
UlHttpIdealBacklogEvent
UlHttpIngressDisconnectEvent
UlHttpIoReadyEvent
UlHttpReceiveHeadersEvent
UlIncCacheEntryAges
UlIncrementChunkPointer
UlInitSearchKeyFromRequest
UlInitSearchKeyFromUrl
UlInitializeAnchor
UlInitializeConfigGroupInfo
UlInitializeFastTrackerPool
UlInitializeParsedHeaders
UlLookupAndVerifyCacheEntry
UlLookupHeader
UlLowMemoryCacheScavenger
UlNotifyForAllChannels
UlNotifyForAllConfigGroups
UlNotifyServerSessionAddition
UlNotifyServerSessionRemoval
UlParseHeader
UlPeriodicCacheScavenger
UlPeriodicZombieConnectionListFlush
UlPktMonCleanupCallback
UlPktMonRegister
UlPktMonRegisterComponentsCallback
UlPktMonUnRegisterInterface
UlPktMonUnregister
UlPrepareUrlIoctl
UlPurgeZombieConnections
UlQosDeleteAllFlowCharacterisitics
UlQuerySslBinding
UlQuerySslBindingExtendedProperties
UlReInitializeParsedHeaders
UlReceiveHttpRequest
UlReleaseRequestBuffer
UlRemoveUrlFromConfigGroup
UlRemoveUrlFromUrlGroupIoctl
UlRestartFastSendHttpResponse
UlRestartSendHttpResponseIoctl
UlResumeParsing
UlScFreeEntry
UlScStopCounters
UlScStopFacet
UlSendCacheEntryWorker
UlSendCachedResponse
UlSendErrorResponse
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConnectionsProperty
UlSetErrorCode
UlSetErrorCodeEx
UlSetHttpConnectionTokenBinding
UlSetPreSendState
UlSetResponseTransformerState
UlSetZeroLengthSendState
UlShutdownConsumer
UlStartDataModule
UlStartHttpIdealBacklogFastForwarderNotification
UlStartHttpReceiveModule
UlStartRequestQueueModule
UlStartRequestQueueTimer
UlStartScavenger2Module
UlStartUriCacheFacet
UlStopConfigGroupFacet
UlStopHttpConnFacet
UlStopHttpIdealBacklogFastForwarderNotification
UlStopHttpReceiveModule
UlStopRequestQueueFacet
UlStopRequestQueueTimer
UlStopScavenger2Module
UlStopThreadPoolModule
UlStopUriCacheFacet
UlTransformResponseFiniteBody
UlTransformResponseTail
UlTrimCache
UlUnlinkHkeContext
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlUnlinkUriCacheEntry
UlUpdateParsedHeader
UlUpdateSslBinding
UlWaitForDemandStart
UlpAbortFlushedRequests
UlpAddFragmentCacheCompleteWorker
UlpAiDestroyAddressList
UlpAiInsertAddressInformation
UlpAiIpAddressChangeCallback
UlpAiNlChangeCallback
UlpAiPopulateAddressList
UlpAiRemoveAddress
UlpAiRemoveAddressInformation
UlpAuthenticateRequestCompletion
UlpBindServerSessionToCommChannel
UlpBufferTimerHandler
UlpCacheAndSendResponseWorker
UlpCacheMdlReadCompleteWorker
UlpCancelDemandStartIrp
UlpCancelEntityBody
UlpCancelEntityBodyWorker
UlpCancelHttpReceiveIrp
UlpCancelWaitForDisconnectIrp
UlpCancelWaitForDisconnectWorker
UlpCleanupCoupling
UlpCleanupRequestQueueCouplings
UlpCleanupZombieCacheEntry
UlpCleanupZombieHttpConnection
UlpCloseConnectionWorker
UlpCloseDisconnectedConnection
UlpCompleteCacheBuild
UlpCompleteCacheBuildWorker
UlpCompleteFailedFastForwardResponseWorker
UlpCompleteFastForwardSend
UlpCompleteResponse
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpCompleteSendErrorResponse
UlpCompleteSendResponseToExtension
UlpCompleteSendToExtensionWorker
UlpCompleteWaitForDisconnects
UlpConnectionDisconnectWorker
UlpCopyCacheEntryInfo
UlpCopyIndicatedData
UlpCountRequestsCoupling
UlpCreateHttpRequest
UlpDeferredAddSiteWorker
UlpDeleteServerSession
UlpDeliverHttpRequest
UlpDeliverHttpRequestWorker
UlpDeliverRequestStageInitial
UlpDeliverRequestStagePolicies
UlpDetachConsumerFromRequestQueue
UlpDisableLogFileEntry
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpErrorLogBufferTimerHandler
UlpErrorLogConnectionReset
UlpErrorLogRolloverTimerHandler
UlpEtwEvaluateFilterInternal
UlpFilteredFlushUriCache
UlpFinalizeQValueTable
UlpFlushConsumerCallbacks
UlpFlushCouplingRequests
UlpFlushExcessRequests
UlpFlushFilterClearCentralizedLogged
UlpFlushFilterIncScavengerTicks
UlpFlushHttpPushList
UlpFlushPendingConsumerIo
UlpFlushPendingRequests
UlpFlushWaitForDisconnects
UlpFreeConsumer
UlpFreeCoupling
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpFreeReceiveBufferList
UlpGetFastForwardingContext
UlpGetFastForwardingContextOld
UlpHandleFastForwardChunk
UlpHandleRequest
UlpHttpIdealBacklogFastForwarderNotification
UlpInitErrorLogInfo
UlpInitializeInternalResponseHeaders
UlpInitializeInternalResponseHeadersOld
UlpInsertBuffer
UlpInsertInCommChannelList
UlpInvokeFlushedConsumerCallbacks
UlpLockRequestQueueAndCoupling
UlpLogErrorResposeSendEvent
UlpLogTimerHandler
UlpMergeBuffers
UlpNotifyEdgePolicyChange
UlpNotifyIPListenListChangesOfConfigGroup
UlpNotifyIPListenListChangesOfServerSession
UlpOpenRequestQueue
UlpParseAuthenticationHeader
UlpParseNextRequest
UlpProcessSendCompletion
UlpProcessZeroLengthSend
UlpQosDeleteFlowCharacteristicsOfConfigGroup
UlpQosDeleteFlowCharacteristicsOfServerSession
UlpQueueFreeHttpRequest
UlpRedeliverFlushedRequest
UlpRedeliverFlushedRequests
UlpRejectFlushedRequests
UlpReleaseCurrentChunkBuffer
UlpReleaseReadEntityBodyBuffers
UlpReleaseRemainingEntityBodyBuffers
UlpRemoveEntryStats
UlpRemoveFromCommChannelList
UlpRemoveZombieHttpConnection
UlpReplaceSystemAccessToken
UlpRestartAddFragmentToCache
UlpRestartFastForwardSend
UlpRestartFastForwardSendWorker
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpResumeParsingWorker
UlpRetrieveRequest
UlpScResetSiteCounters
UlpScavengerThread
UlpSendCacheEntry
UlpSendErrorResponse
UlpSendFastForwardDataContext
UlpSendHttpResponseRegular
UlpSendHttpResponseWorker
UlpSendResponseOrEntityBodyFastIo
UlpSendSimpleCleanupWorker
UlpSendSimpleStatusWorker
UlpSetRequestQueue503Verbosity
UlpSetRequestQueueLengthLimit
UlpSetRequestQueueState
UlpSynchronizeLanes
UlpSynchronizeLanesWorker
UlpTerminateZombieList
UlpToggleRequestQueueTimer
UlpUnbindCoupling
UlpUpdateFlushedRequestState
UlpUpdatePerfCountersOnCacheSend
UlpZombifyHttpConnection
UxDuoExecuteDetach
UxDuoExecuteReleaseBuffer
UxDuoExecuteSendGoaway
UxDuoReleaseReceiveBuffers
UxDuoSanitizeDeclarePushParameters
UxDuoSetTransportIdleConnectionTimeout
UxDuoStartFacet
UxDuoStartModule
UxFreeOpaqueId
UxFreeOpaqueIdEx
UxGetActiveCodePage
UxParseAuthBlobSingle
UxPodStopModule
UxQuicAbortConnection
UxQuicBufferShiftData
UxQuicConnectionSetCertSettings
UxQuicInvalidateCertificate
UxQuicLoadCertificateWorker
UxQuicParseFrame
UxQuicPreParser
UxQuicSetConnectionEndpoint
UxQuicSetConnectionState
UxQuicSetTransportIdleConnectionTimeout
UxQuicStartModule
UxQuicStreamAbort
UxQuicStreamCompleteHeadersDecode
UxQuicStreamInitiateReceive
UxQuicUnloadCertificate
UxSslAbortConnection
UxSslAcceptSecurityContextCallback
UxSslAcquireCredentialsHandleLookupCallback
UxSslCompleteRetrieveIrp
UxSslConnectionDisableReconnects
UxSslConnectionTimeout
UxSslConsumerCleanupHandler
UxSslCreateConfiguration
UxSslDeleteEndpointConfig
UxSslDestroyConfiguration
UxSslDetachComplete
UxSslDetachConnection
UxSslEndpointLoadCertificateSync
UxSslFreeAchContext
UxSslFreeAscContext
UxSslFreeBufferIndication
UxSslFreeConnection
UxSslFreeSendBufferList
UxSslFreeTlsExtensions
UxSslGetProperties
UxSslGetTokenBinding
UxSslIdealBacklogEvent
UxSslIngressDisconnectEvent
UxSslInitiateAbort
UxSslInitiateSend
UxSslInvalidateCertificate
UxSslIoReadyEvent
UxSslLogEndpointEvent
UxSslOpenConfigRegistryKey
UxSslPeriodicCertificateScavenger
UxSslPostsendCheck
UxSslQueueDisconnectEvent
UxSslQueueIndicationList
UxSslQueueReceiverWorkItem
UxSslQueueReceiverWorkItemEx
UxSslReadConfigurationPropertiesFromUser
UxSslReceiverQueueServerHelloMessage
UxSslReleaseEndpointConfiguration
UxSslReleaseReceiveBuffers
UxSslReplaceEndpointConfig
UxSslRestartSendRawData
UxSslScavengeCertificate
UxSslSendHelloRequest
UxSslSendRawData
UxSslSetCurrentLookupConfig
UxSslSetEndpointConfig
UxSslSetEndpointLookupState
UxSslStartRenegotiationTimer
UxSslStartSenderModule
UxSslStopReceiverFacet
UxSslStopRenegotiationTimer
UxSslStopSenderModule
UxSslUnloadCertificate
UxSslValidateSni
UxStartEnvironmentModule
UxTpTransmitPacket
UxpQuicAbortConnectionLocked
UxpQuicCompleteDecodeControlBytes
UxpQuicCompleteEncodeControlBytes
UxpQuicConfigurationLoadComplete
UxpQuicCopyPeerCertToIrp
UxpQuicCreateCustomAlpnArray
UxpQuicFreeConfigurationContext
UxpQuicFreeDataIndication
UxpQuicFreeTransportIndication
UxpQuicParseCancelPushFrame
UxpQuicParseDataFrame
UxpQuicParseGoawayFrame
UxpQuicParseHeadersFrame
UxpQuicParseIntegerOnlyFrame
UxpQuicParseMaxPushIdFrame
UxpQuicParsePushPromiseFrame
UxpQuicParseSettingsFrame
UxpQuicReceiveControlStreamReceiveEvent
UxpQuicReceivePeerDecodeControlStreamReceiveEvent
UxpQuicReceivePeerEncodeControlStreamReceiveEvent
UxpQuicStreamAbortLocked
UxpQuicStreamDetach
UxpQuicStreamIndicateHeadersEvent
UxpQuicStreamIndicateIngressDisconnect
UxpQuicStreamPeerReceiveAbort
UxpQuicStreamProcessReceiveWorkItem
UxpQuicStreamReceiveEvent
UxpQuicStreamSendShutdownComplete
UxpQuicStreamShutdownComplete
UxpQuicStreamStartDrain
UxpQuicUnknownStreamReceiveEvent
UxpSslAcquireCredentialsHandleCreationCallback
UxpSslCertificateScavenger
UxpSslCleanupConnection
UxpSslCleanupDecryptPendingList
UxpSslCleanupTransportIndicationList
UxpSslCommonSendDataHelper
UxpSslConnectionDecryptData
UxpSslConsumeReceiveBufferSpace
UxpSslCopyCertificateParam
UxpSslCopyClientCertToIrp
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslDeleteEndpointConfigLocked
UxpSslEndpointFreeTlsExtensions
UxpSslEndpointInvalidateCertificate
UxpSslEndpointLogEvent
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointParseSni
UxpSslEndpointSetNotifyCallout
UxpSslEndpointThrottleHandler
UxpSslEndpointUnloadCertificate
UxpSslEnumerateEndpointConfigs
UxpSslExpandTransportDataIndication
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindSniHandler
UxpSslFreeDataIndication
UxpSslFreeRegistration
UxpSslFreeSendRequestTracker
UxpSslGetHandshakeSizes
UxpSslGetHandshakeTiming
UxpSslHandleRenegotiateRequest
UxpSslIndicateReceiveEvent
UxpSslInitializeCcsConfigurationByRegistryIndex
UxpSslInitializeCcsConfigurationByUserKey
UxpSslInitializeHostConfigByRegistryIndexHelper
UxpSslInitializeHostConfigByUserKeyHelper
UxpSslInitializeIpConfigurationByRegistryIndex
UxpSslInitiateAscHandler
UxpSslLoadCertificateWorker
UxpSslLogHandshakeFailure
UxpSslProcessCloseNotify
UxpSslReceiver
UxpSslReceiverWorker
UxpSslRemoveEndpointConfig
UxpSslRetrieveIrpCancelRoutine
UxpSslScavengerCallback
UxpSslSendStaticServerHello
UxpSslSetAscCountTaken
UxpSslSetConnectionState
UxpSslSetIrpConnection
UxpSslSetNotifyCallout
UxpSslUnloadEndpointCertificateWorker
UxpSslValidateHostConfigurationProperties
UxpSslValidateHostname
UxpSslWaitForAscHandler
UxpSslWriteCcsConfigurationToRegistry
UxpSslWriteHostConfigToRegistryHelper
UxpSslWriteIpConfigurationToRegistry
UxpTpDequeueTransmitPacket
UxpTpEnqueueTransmitPacket
UxpTpProcessMdlRuns
|
Expand for full list:
FUN_1400191a5
FUN_14001d1b0
FUN_14001d7f6
FUN_1400241fe
FUN_14004398c
FUN_1401539c4
FUN_140154232
FUN_14015501e
FUN_1401550e8
FUN_140155120
FUN_140155262FUN_140155541
FUN_1401587d6
FUN_14015c3b2
FUN_14015e14c
FUN_14015fcd5
FUN_1401610ea
FUN_1401623a0
FUN_140162458
FUN_140162a90
FUN_140163142
FUN_1401631d3
FindChunkHeaderEnd
HttpEtwCallback
HttpFindUrlToken
HttpNormalizeNamedHost
HttpParseUrl
HttpStringToULongLong
HttpStringToUShort
HttpValidateHostname
HttppNormalizePath
HttppParseIPv6Address
HttppParseUrlPath
HttppParseUrlPort
HttppParseUrlScheme
HttppRebuildFixedUrl
HttppValidateIpv6Hostname
ParseChunkLength
UcAbortConnection
UcCleanupClientSessionContext
UcClientStreamDereferenceBundle
UcClientStreamReferenceBundle
UcCloseClientConnectionIoctl
UcCloseClientCredentialIoctl
UcCloseClientSessionContext
UcCloseClientStreamIoctl
UcConnectionCancelIrp
UcCreateClientConnectionIoctl
UcCreateClientCredentialIoctl
UcCreateClientStreamIoctl
UcDeleteStream
UcFreeCaptureConnectionParameters
UcFreeCaptureCredentialParameters
UcFreeClientSession
UcFreeConnection
UcFreeCredential
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcReferenceClientConnectionFromId
UcReferenceClientCredentialFromId
UcReferenceClientStreamFromId
UcSendHeadersClientStreamFastIo
UcSetClientConnectionFastIo
UcSetClientStreamPropertyFastIo
UcStreamIngressDisconnectEvent
UcStreamTimeout
UcpAbortClientConnection
UcpAbortClientStream
UcpAbortStream
UcpAbortStreamsFromConnection
UcpAddConnectionToSessionContext
UcpAddCredentialToSessionContext
UcpCancelConnectionIo
UcpCancelStreamIo
UcpCleanupClientSession
UcpCleanupConnection
UcpCoupleSessionContextAndSession
UcpDeleteConnection
UcpDeleteCredential
UcpDestroySendEntityChunks
UcpFlushConnectionsFromSessionContext
UcpFlushCredentialsFromSessionContext
UcpFlushStreamsFromConnection
UcpFreeClientSessionContext
UcpNotifyDisconnectClientStream
UcpReceiveEntityBodyClientStream
UcpReceiveHeadersClientStream
UcpRemoveSessionContextFromSessionList
UcpResetReceiveTimer
UcpSendEntityBodyClientStream
UcpSetReceiveTimer
UcpStreamCancelIrp
UcpStreamProcessFastForwardReceiveDataWorker
UcpStreamSendCompletion
UcpStreamSendHeadersCompletionCommon
UlAccessCheck
UlAddSslBinding
UlAiFreeAddressInformation
UlAiPktMonRegisterAddressInformation
UlAiPktMonUnregisterAddresses
UlAiStartModule
UlAiStartTrackingAddressInformation
UlAiStopModule
UlAllocateCacheTracker
UlAllocateChannelBindToken
UlAllocateConnectionRequestId
UlBeginOpaqueMode
UlBindConfigGroupToServerSession
UlBuildCacheEntryWorker
UlCGAddHashTableEntry
UlCGRebuildHashTable
UlCacheAndSendResponse
UlCancelRequestIo
UlCancelSendHttpResponse
UlCaptureDelegateRequestParameters
UlCheckCacheControlHeaders
UlCheckCachePreconditions
UlCheckProtocolCompliance
UlCheckinUriCacheEntry
UlCleanupCommChannel
UlCleanupConfigGroupInfo
UlCleanupConnectionCouplings
UlCleanupConsumer
UlCleanupConsumerInternal
UlCleanupHttpConnection
UlCloseCommChannel
UlCloseConnection
UlCloseConsumer
UlCompleteReceiveEntityBodyIrp
UlCompleteWaitForDisconnects
UlConnectionCleanupWorker
UlConsumeBytesFromConnection
UlConsumerCleanupCompletion
UlCopyAuthConfig
UlCopyConfigGroupInfoForCache
UlCopyEntityBodyToBuffer
UlCreateCacheEntryFromResponse
UlDeclarePushIoctl
UlDelegateRequest
UlDeleteAutoServerSession
UlDeleteConsumerCallback
UlDeleteSslBinding
UlDeliverEntityBody
UlDestroyCapturedChunk
UlDestroyCapturedResponse
UlDestroyUriBaseCacheEntry
UlDestroyUriCacheEntry
UlEgressDisconnectCompletion
UlErrorLog
UlEvaluateRequest
UlFastForwardDetachEvent
UlFastForwardIdealBacklogEvent
UlFastForwardLogData
UlFastReceiveHttpRequest
UlFastSendCompleteWorker
UlFlushCache
UlFlushCacheByConfigGroup
UlFlushCacheByConsumer
UlFlushCacheByRequestQueue
UlFlushCacheByServerSession
UlFlushCacheForAddUrl
UlFlushCacheForRemoveUrl
UlFreeBuildTracker
UlFreeCacheTracker
UlFreeChannelBindToken
UlFreeCommChannel
UlFreeConfigGroup
UlFreeFastTracker
UlFreeHttpConnection
UlFreeRequestQueue
UlFreeServerSession
UlFreeUnknownCodingList
UlGetRequestFromId
UlGetTypeAndSubType
UlHandle100Continue
UlHttpAttachConnection
UlHttpConnectionTimeout
UlHttpDetachConnection
UlHttpIdealBacklogEvent
UlHttpIngressDisconnectEvent
UlHttpIoReadyEvent
UlHttpReceiveHeadersEvent
UlIncCacheEntryAges
UlIncrementChunkPointer
UlInitSearchKeyFromRequest
UlInitSearchKeyFromUrl
UlInitializeAnchor
UlInitializeConfigGroupInfo
UlInitializeFastTrackerPool
UlInitializeParsedHeaders
UlLookupAndVerifyCacheEntry
UlLookupHeader
UlLowMemoryCacheScavenger
UlNotifyForAllChannels
UlNotifyForAllConfigGroups
UlNotifyServerSessionAddition
UlNotifyServerSessionRemoval
UlParseHeader
UlPeriodicCacheScavenger
UlPeriodicZombieConnectionListFlush
UlPktMonCleanupCallback
UlPktMonRegister
UlPktMonRegisterComponentsCallback
UlPktMonUnRegisterInterface
UlPktMonUnregister
UlPrepareUrlIoctl
UlPurgeZombieConnections
UlQosDeleteAllFlowCharacterisitics
UlQuerySslBinding
UlQuerySslBindingExtendedProperties
UlReInitializeParsedHeaders
UlReceiveHttpRequest
UlReleaseRequestBuffer
UlRemoveUrlFromConfigGroup
UlRemoveUrlFromUrlGroupIoctl
UlRestartFastSendHttpResponse
UlRestartSendHttpResponseIoctl
UlResumeParsing
UlScFreeEntry
UlScStopCounters
UlScStopFacet
UlSendCacheEntryWorker
UlSendCachedResponse
UlSendErrorResponse
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConnectionsProperty
UlSetErrorCode
UlSetErrorCodeEx
UlSetHttpConnectionTokenBinding
UlSetPreSendState
UlSetResponseTransformerState
UlSetZeroLengthSendState
UlShutdownConsumer
UlStartDataModule
UlStartHttpIdealBacklogFastForwarderNotification
UlStartHttpReceiveModule
UlStartRequestQueueModule
UlStartRequestQueueTimer
UlStartScavenger2Module
UlStartUriCacheFacet
UlStopConfigGroupFacet
UlStopHttpConnFacet
UlStopHttpIdealBacklogFastForwarderNotification
UlStopHttpReceiveModule
UlStopRequestQueueFacet
UlStopRequestQueueTimer
UlStopScavenger2Module
UlStopThreadPoolModule
UlStopUriCacheFacet
UlTransformResponseFiniteBody
UlTransformResponseTail
UlTrimCache
UlUnlinkHkeContext
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlUnlinkUriCacheEntry
UlUpdateParsedHeader
UlUpdateSslBinding
UlWaitForDemandStart
UlpAbortFlushedRequests
UlpAddFragmentCacheCompleteWorker
UlpAiDestroyAddressList
UlpAiInsertAddressInformation
UlpAiIpAddressChangeCallback
UlpAiNlChangeCallback
UlpAiPopulateAddressList
UlpAiRemoveAddress
UlpAiRemoveAddressInformation
UlpAuthenticateRequestCompletion
UlpBindServerSessionToCommChannel
UlpBufferTimerHandler
UlpCacheAndSendResponseWorker
UlpCacheMdlReadCompleteWorker
UlpCancelDemandStartIrp
UlpCancelEntityBody
UlpCancelEntityBodyWorker
UlpCancelHttpReceiveIrp
UlpCancelWaitForDisconnectIrp
UlpCancelWaitForDisconnectWorker
UlpCleanupCoupling
UlpCleanupRequestQueueCouplings
UlpCleanupZombieCacheEntry
UlpCleanupZombieHttpConnection
UlpCloseConnectionWorker
UlpCloseDisconnectedConnection
UlpCompleteCacheBuild
UlpCompleteCacheBuildWorker
UlpCompleteFailedFastForwardResponseWorker
UlpCompleteFastForwardSend
UlpCompleteResponse
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpCompleteSendErrorResponse
UlpCompleteSendResponseToExtension
UlpCompleteSendToExtensionWorker
UlpCompleteWaitForDisconnects
UlpConnectionDisconnectWorker
UlpCopyCacheEntryInfo
UlpCopyGlobalCounters
UlpCopyIndicatedData
UlpCountRequestsCoupling
UlpCreateHttpRequest
UlpDeferredAddSiteWorker
UlpDeleteServerSession
UlpDeliverHttpRequest
UlpDeliverHttpRequestWorker
UlpDeliverRequestStageInitial
UlpDeliverRequestStagePolicies
UlpDetachConsumerFromRequestQueue
UlpDisableLogFileEntry
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpErrorLogBufferTimerHandler
UlpErrorLogConnectionReset
UlpErrorLogRolloverTimerHandler
UlpEtwEvaluateFilterInternal
UlpFilteredFlushUriCache
UlpFinalizeQValueTable
UlpFlushConsumerCallbacks
UlpFlushCouplingRequests
UlpFlushExcessRequests
UlpFlushFilterClearCentralizedLogged
UlpFlushFilterIncScavengerTicks
UlpFlushHttpPushList
UlpFlushPendingConsumerIo
UlpFlushPendingRequests
UlpFlushWaitForDisconnects
UlpFreeConsumer
UlpFreeCoupling
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpFreeReceiveBufferList
UlpGetFastForwardingContext
UlpGetFastForwardingContextOld
UlpHandleFastForwardChunk
UlpHandleRequest
UlpHttpIdealBacklogFastForwarderNotification
UlpInitErrorLogInfo
UlpInitializeInternalResponseHeaders
UlpInitializeInternalResponseHeadersOld
UlpInsertBuffer
UlpInsertInCommChannelList
UlpInvokeFlushedConsumerCallbacks
UlpLockRequestQueueAndCoupling
UlpLogErrorResposeSendEvent
UlpLogTimerHandler
UlpMergeBuffers
UlpNotifyEdgePolicyChange
UlpNotifyIPListenListChangesOfConfigGroup
UlpNotifyIPListenListChangesOfServerSession
UlpOpenRequestQueue
UlpParseAuthenticationHeader
UlpParseNextRequest
UlpProcessSendCompletion
UlpProcessZeroLengthSend
UlpQosDeleteFlowCharacteristicsOfConfigGroup
UlpQosDeleteFlowCharacteristicsOfServerSession
UlpQueueFreeHttpRequest
UlpRedeliverFlushedRequest
UlpRedeliverFlushedRequests
UlpRejectFlushedRequests
UlpReleaseCurrentChunkBuffer
UlpReleaseReadEntityBodyBuffers
UlpReleaseRemainingEntityBodyBuffers
UlpRemoveEntryStats
UlpRemoveFromCommChannelList
UlpRemoveZombieHttpConnection
UlpReplaceSystemAccessToken
UlpRestartAddFragmentToCache
UlpRestartFastForwardSend
UlpRestartFastForwardSendWorker
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpResumeParsingWorker
UlpRetrieveRequest
UlpScResetSiteCounters
UlpScavengerThread
UlpSendCacheEntry
UlpSendErrorResponse
UlpSendFastForwardDataContext
UlpSendHttpResponseRegular
UlpSendHttpResponseWorker
UlpSendResponseOrEntityBodyFastIo
UlpSendSimpleCleanupWorker
UlpSendSimpleStatusWorker
UlpSetRequestQueue503Verbosity
UlpSetRequestQueueLengthLimit
UlpSetRequestQueueState
UlpSynchronizeLanes
UlpSynchronizeLanesWorker
UlpTerminateZombieList
UlpToggleRequestQueueTimer
UlpUnbindCoupling
UlpUpdateFlushedRequestState
UlpUpdatePerfCountersOnCacheSend
UlpZombifyHttpConnection
UxDuoExecuteDetach
UxDuoExecuteReleaseBuffer
UxDuoExecuteSendGoaway
UxDuoReleaseReceiveBuffers
UxDuoSanitizeDeclarePushParameters
UxDuoSetTransportIdleConnectionTimeout
UxDuoStartFacet
UxDuoStartModule
UxFreeOpaqueId
UxFreeOpaqueIdEx
UxGetActiveCodePage
UxParseAuthBlobSingle
UxPodStopModule
UxQuicAbortConnection
UxQuicBufferShiftData
UxQuicConnectionSetCertSettings
UxQuicInvalidateCertificate
UxQuicLoadCertificateWorker
UxQuicParseFrame
UxQuicPreParser
UxQuicSetConnectionEndpoint
UxQuicSetConnectionState
UxQuicSetTransportIdleConnectionTimeout
UxQuicStartModule
UxQuicStreamAbort
UxQuicStreamCompleteHeadersDecode
UxQuicStreamInitiateReceive
UxQuicUnloadCertificate
UxSslAbortConnection
UxSslAcceptSecurityContextCallback
UxSslAcquireCredentialsHandleLookupCallback
UxSslCompleteRetrieveIrp
UxSslConnectionDisableReconnects
UxSslConnectionTimeout
UxSslConsumerCleanupHandler
UxSslCreateConfiguration
UxSslDeleteEndpointConfig
UxSslDestroyConfiguration
UxSslDetachComplete
UxSslDetachConnection
UxSslEndpointLoadCertificateSync
UxSslFreeAchContext
UxSslFreeAscContext
UxSslFreeBufferIndication
UxSslFreeConnection
UxSslFreeSendBufferList
UxSslFreeTlsExtensions
UxSslGetProperties
UxSslGetTokenBinding
UxSslIdealBacklogEvent
UxSslIngressDisconnectEvent
UxSslInitiateAbort
UxSslInitiateSend
UxSslInvalidateCertificate
UxSslIoReadyEvent
UxSslLogEndpointEvent
UxSslOpenConfigRegistryKey
UxSslPeriodicCertificateScavenger
UxSslPostsendCheck
UxSslQueueDisconnectEvent
UxSslQueueIndicationList
UxSslQueueReceiverWorkItem
UxSslQueueReceiverWorkItemEx
UxSslReadConfigurationPropertiesFromUser
UxSslReceiverQueueServerHelloMessage
UxSslReleaseEndpointConfiguration
UxSslReleaseReceiveBuffers
UxSslReplaceEndpointConfig
UxSslRestartSendRawData
UxSslScavengeCertificate
UxSslSendHelloRequest
UxSslSendRawData
UxSslSetCurrentLookupConfig
UxSslSetEndpointConfig
UxSslSetEndpointLookupState
UxSslStartRenegotiationTimer
UxSslStartSenderModule
UxSslStopReceiverFacet
UxSslStopRenegotiationTimer
UxSslStopSenderModule
UxSslUnloadCertificate
UxSslValidateSni
UxStartEnvironmentModule
UxTpTransmitPacket
UxpQuicAbortConnectionLocked
UxpQuicCompleteDecodeControlBytes
UxpQuicCompleteEncodeControlBytes
UxpQuicConfigurationLoadComplete
UxpQuicCopyPeerCertToIrp
UxpQuicCreateCustomAlpnArray
UxpQuicFreeConfigurationContext
UxpQuicFreeDataIndication
UxpQuicFreeTransportIndication
UxpQuicParseCancelPushFrame
UxpQuicParseDataFrame
UxpQuicParseGoawayFrame
UxpQuicParseHeadersFrame
UxpQuicParseIntegerOnlyFrame
UxpQuicParseMaxPushIdFrame
UxpQuicParsePushPromiseFrame
UxpQuicParseSettingsFrame
UxpQuicReceiveControlStreamReceiveEvent
UxpQuicReceivePeerDecodeControlStreamReceiveEvent
UxpQuicReceivePeerEncodeControlStreamReceiveEvent
UxpQuicStreamAbortLocked
UxpQuicStreamDetach
UxpQuicStreamIndicateHeadersEvent
UxpQuicStreamIndicateIngressDisconnect
UxpQuicStreamPeerReceiveAbort
UxpQuicStreamProcessReceiveWorkItem
UxpQuicStreamReceiveEvent
UxpQuicStreamSendShutdownComplete
UxpQuicStreamShutdownComplete
UxpQuicStreamStartDrain
UxpQuicUnknownStreamReceiveEvent
UxpSslAcquireCredentialsHandleCreationCallback
UxpSslCertificateScavenger
UxpSslCleanupConnection
UxpSslCleanupDecryptPendingList
UxpSslCleanupTransportIndicationList
UxpSslCommonSendDataHelper
UxpSslConnectionDecryptData
UxpSslConsumeReceiveBufferSpace
UxpSslCopyCertificateParam
UxpSslCopyClientCertToIrp
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslDeleteEndpointConfigLocked
UxpSslEndpointFreeTlsExtensions
UxpSslEndpointInvalidateCertificate
UxpSslEndpointLogEvent
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointParseSni
UxpSslEndpointSetNotifyCallout
UxpSslEndpointThrottleHandler
UxpSslEndpointUnloadCertificate
UxpSslEnumerateEndpointConfigs
UxpSslExpandTransportDataIndication
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindSniHandler
UxpSslFreeDataIndication
UxpSslFreeRegistration
UxpSslFreeSendRequestTracker
UxpSslGetHandshakeSizes
UxpSslGetHandshakeTiming
UxpSslHandleRenegotiateRequest
UxpSslIndicateReceiveEvent
UxpSslInitializeCcsConfigurationByRegistryIndex
UxpSslInitializeCcsConfigurationByUserKey
UxpSslInitializeHostConfigByRegistryIndexHelper
UxpSslInitializeHostConfigByUserKeyHelper
UxpSslInitializeIpConfigurationByRegistryIndex
UxpSslLoadCertificateWorker
UxpSslLogHandshakeFailure
UxpSslProcessCloseNotify
UxpSslReceiver
UxpSslReceiverWorker
UxpSslRemoveEndpointConfig
UxpSslRetrieveIrpCancelRoutine
UxpSslScavengerCallback
UxpSslSendStaticServerHello
UxpSslSetAscCountTaken
UxpSslSetConnectionState
UxpSslSetIrpConnection
UxpSslSetNotifyCallout
UxpSslUnloadEndpointCertificateWorker
UxpSslValidateHostConfigurationProperties
UxpSslValidateHostname
UxpSslWaitForAscHandler
UxpSslWriteCcsConfigurationToRegistry
UxpSslWriteHostConfigToRegistryHelper
UxpSslWriteIpConfigurationToRegistry
UxpTpDequeueTransmitPacket
UxpTpEnqueueTransmitPacket
UxpTpProcessMdlRuns
| |paramcount|4|4| |address|1401a56d0|1401a56d0| |sig|undefined __fastcall WPP_SF_(undefined2 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_(undefined2 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_ Calling Diff ```diff --- WPP_SF_ calling +++ WPP_SF_ calling @@ -1,22 +1,22 @@ -FUN_1400190c5 -FUN_14001d0d0 -FUN_14001d716 -FUN_14002411e -FUN_14004843c -FUN_140153258 -FUN_140153ac6 -FUN_1401548b2 -FUN_14015497c -FUN_1401549b4 -FUN_140154af6 -FUN_140154dd5 -FUN_140157a1a -FUN_140158950 -FUN_14015c52c -FUN_14015f69d -FUN_140160db6 -FUN_1401620b4 -FUN_14016216c -FUN_1401627a4 -FUN_140162e56 -FUN_140162ee7 +FUN_1400191a5 +FUN_14001d1b0 +FUN_14001d7f6 +FUN_1400241fe +FUN_14004398c +FUN_1401539c4 +FUN_140154232 +FUN_14015501e +FUN_1401550e8 +FUN_140155120 +FUN_140155262 +FUN_140155541 +FUN_1401587d6 +FUN_14015c3b2 +FUN_14015e14c +FUN_14015fcd5 +FUN_1401610ea +FUN_1401623a0 +FUN_140162458 +FUN_140162a90 +FUN_140163142 +FUN_1401631d3 @@ -137 +136,0 @@ -UlCopyGlobalCounters @@ -300,0 +300 @@ +UlpCopyGlobalCounters @@ -552 +551,0 @@ -UxpSslInitiateAscHandler ``` ## UlpFlushPendingRequests ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|length,address,called| |ratio|1.0| |i_ratio|0.45| |m_ratio|0.59| |b_ratio|0.59| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlpFlushPendingRequests|UlpFlushPendingRequests| |fullname|UlpFlushPendingRequests|UlpFlushPendingRequests| |refcount|4|4| |`length`|992|410| |`called`|NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
UlpUpdateFlushedRequestState
WPP_SF_
WPP_SF_L
WPP_SF_qII
WPP_SF_qil
WPP_SF_qqZq|NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
UlpUpdateFlushedRequestState
WPP_SF_
WPP_SF_qil| |calling|UlCleanupConsumerInternal
UlpSetRequestQueueState|UlCleanupConsumerInternal
UlpSetRequestQueueState| |paramcount|4|4| |`address`|14006aff8|140066078| |sig|undefined __fastcall UlpFlushPendingRequests(ulonglong * param_1, ulonglong * param_2, ulonglong * param_3, ulonglong * param_4)|undefined __fastcall UlpFlushPendingRequests(ulonglong * param_1, ulonglong * param_2, ulonglong * param_3, ulonglong * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpFlushPendingRequests Called Diff ```diff --- UlpFlushPendingRequests called +++ UlpFlushPendingRequests called @@ -5,2 +4,0 @@ -WPP_SF_L -WPP_SF_qII @@ -8 +5,0 @@ -WPP_SF_qqZq ``` ## UlBugCheckEx ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|UlBugCheckEx|UlBugCheckEx| |fullname|UlBugCheckEx|UlBugCheckEx| |`refcount`|1457|1456| |length|36|36| |called|NTOSKRNL.EXE::KeBugCheckEx|NTOSKRNL.EXE::KeBugCheckEx| |`calling`|
Expand for full list:
FUN_14000ad3a
FUN_1400190c5
FUN_14001d0d0
FUN_1400903ea
FUN_140150dec
FUN_140153258
FUN_140153ac6
FUN_1401542fc
FUN_1401546e4
FUN_1401547a2
FUN_1401566deFUN_140156910
FUN_140157abe
FUN_140157dd2
FUN_140159e13
FUN_14015a796
FUN_14015a838
FUN_14015ab95
FUN_14015b178
FUN_14015b33b
FUN_14015da91
FUN_14015fb0f
FUN_140160ef9
FUN_140161091
FUN_140162630
QkDerefByOrdinal
QkRefByOrdinal
REFCOUNT_ADDREF_SAFE
UcAbortConnection
UcAllocateConnection
UcAllocateCredential
UcAllocateStream
UcCaptureConnectionParameters
UcCaptureCredentialParameters
UcCleanupClientSessionContext
UcClientStreamDereferenceBundle
UcClientStreamReferenceBundle
UcClientWaitForDisconnectCompletion
UcCloseClientConnectionIoctl
UcCloseClientCredentialIoctl
UcCloseClientStreamIoctl
UcConnectionCancelIrp
UcConnectionCancelIrpWorker
UcConnectionGetQuicConnection
UcConnectionPendIrp
UcCreateClientConnectionIoctl
UcCreateClientCredentialIoctl
UcCreateClientStreamIoctl
UcDeleteStream
UcFreeCaptureConnectionParameters
UcFreeConnection
UcFreeCredential
UcFreeStream
UcGetQuicSession
UcQueryClientConnectionProperty
UcQueryClientStreamProperty
UcReferenceClientConnectionFromId
UcReferenceClientCredentialFromId
UcReferenceClientStreamFromId
UcSendHeadersClientStreamFastIo
UcSetClientConnectionProperty
UcSetClientStreamProperty
UcStartClientConnectionCompletion
UcStartClientConnectionIoctl
UcStreamAllocateSendTracker
UcStreamDetachConnection
UcStreamFastForwardReceive
UcStreamFreeSendTracker
UcStreamIngressDisconnectEvent
UcStreamPendIrp
UcStreamReceiveEvent
UcStreamReceiveHeadersEvent
UcStreamSendHeaders
UcWaitForClientConnectionDisconnect
UcpAbortClientConnection
UcpAbortClientStream
UcpAbortStreams
UcpAbortStreamsFromConnection
UcpAllocateClientSession
UcpCleanupClientSession
UcpCleanupConnection
UcpConnectionResetIrpCancellationRoutine
UcpCoupleSessionContextAndSession
UcpCreateClientSession
UcpDeleteConnection
UcpDeleteCredential
UcpFreeClientSessionContext
UcpNotifyDisconnectClientStream
UcpReceiveEntityBodyClientStream
UcpReceiveHeadersClientStream
UcpSendEntityBodyClientStream
UcpStreamCancelIrp
UcpStreamCancelIrpWorker
UcpStreamIndicateFastForwardDetach
UcpStreamProcessFastForwardReceiveDataWorker
UcpStreamResetIrpCancellationRoutine
UcpStreamSendCompletion
UcpStreamSendHeadersCompletionCommon
UcpStreamStartProcessFastForwardReceiveData
UlAddFragmentToCache
UlAddSite
UlAddSslBinding
UlAddToAuthCache
UlAddToHashTable
UlAddUrlToConfigGroup
UlAllocateBuildTracker
UlAllocateCacheEntry
UlAllocateConnectionRequestId
UlAllocateLogDataBuffer
UlBindConfigGroupToServerSession
UlBuildCacheEntryWorker
UlCanSatisfyRangesFromCache
UlCancelHttpRequest
UlCancelSendHttpResponse
UlCaptureChannelBindConfigOld
UlCaptureHttpResponse
UlCaptureHttpResponseOld
UlCheckinUriCacheEntry
UlCheckoutUriCacheEntry
UlCleanupChannelBindConfig
UlCleanupConfigGroupInfo
UlCleanupConnectionCouplings
UlCleanupConsumerInternal
UlCleanupDelegationConsumer
UlCleanupHttpConnection
UlCloseCommChannel
UlCloseConnection
UlCloseLogFile
UlCompleteReceiveEntityBodyIrp
UlCompleteWaitForDisconnects
UlConnectionCleanupWorker
UlCopyAuthConfig
UlCopyChannelBindConfig
UlCopyChannelBindConfigFromPropertyInfo
UlCopyConfigGroupInfoForCache
UlCreateAutoConfigGroup
UlCreateAutoServerSession
UlCreateCacheEntryFromResponse
UlCreateConfigGroup
UlDeclarePushIoctl
UlDelegateRequest
UlDeleteAuthCache
UlDeleteAutoServerSession
UlDeleteConfigGroup
UlDeleteConfigGroupById
UlDeleteConsumerCallback
UlDeleteServerSession
UlDeleteSslBinding
UlDereferenceAlternateCredential
UlDestroyCapturedResponse
UlDestroyLogDataBuffer
UlDestroyLogDataBufferWorker
UlDestroySliceTracker
UlDestroyUriCacheEntry
UlEgressDisconnectCompletion
UlEtwEvaluateFilter
UlEvaluateRequest
UlEventDataTransmissionStats
UlEventRequestDataTransmissionStats
UlExecuteLazyAuthInitialization
UlExtractAndAppendAuthenticationResponseInfo
UlFastForwardDetachEvent
UlFastForwardIdealBacklogEvent
UlFastForwardIngressDisconnectEvent
UlFastForwardReceiveEvent
UlFastReceiveHttpRequest
UlFastSendCompleteWorker
UlFastSendHttpResponse
UlFastSendHttpResponseOld
UlFindUrlGroupId
UlFlushAuthCache
UlFreeBuildTracker
UlFreeConfigGroup
UlFreeHttpConnection
UlFreeServerSession
UlGenericLogTimerDpcRoutine
UlGetFromAuthCache
UlGetServerSessionProperty
UlHkeCreateCalloutContext
UlHkeDereferenceCalloutContext
UlHkeDeregisterExtension
UlHkeDestroyCalloutContext
UlHkeNotifyDetachClient
UlHkeReferenceCalloutContext
UlHttpAttachConnection
UlHttpBufferReceiveEvent
UlHttpDetachConnection
UlHttpIngressDisconnectEvent
UlInvokeCompletionRoutine
UlLinkHkeContext
UlLogZombieConnection
UlLookupAndVerifyCacheEntry
UlNotifyIPListenListChanges
UlNotifyServerSessionAddition
UlNotifyServerSessionRemoval
UlPeriodicAuthCacheScavenger
UlPktMonTraceWskInternal
UlProcessResponseInfo
UlPurgeZombieConnections
UlQueryChannelBindToken
UlQueryConfigGroupProperty
UlQueryRequestProperty
UlQuerySslBinding
UlQuerySslBindingExtendedProperties
UlReceiveClientCertIoctl
UlReceiveEntityBody
UlReceiveEntityBodyFastIo
UlReceiveEntityBodyIoctl
UlReceiveHttpRequest
UlReferenceHttpConnectionFromId
UlReferenceHttpRequestFromId
UlReferenceRequestQueueByHandle
UlRegisterConsumerCallback
UlReleaseRequestBuffer
UlRemoveAllUrlsFromConfigGroup
UlRemoveSendIrpCancelRoutine
UlRemoveUrlFromConfigGroup
UlRestartFastSendHttpResponse
UlRestartSendHttpResponseIoctl
UlResumeParsing
UlScGetSiteCounters
UlScStartCounters
UlScStopCounters
UlSendCacheEntryWorker
UlSendCachedResponse
UlSendEntityBodyIoctlOld
UlSendHttpResponse
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendRangeCacheEntry
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConfigGroupProperty
UlSetPostSendState
UlSetPreSendState
UlSetReceiveEntityBodyIrpCancelRoutine
UlSetRequestProperty
UlSetSendCompleteState
UlSetSendIrpCancelRoutine
UlSetServerSessionProperty
UlSetZeroLengthSendState
UlStartHttpIdealBacklogFastForwarderNotification
UlStopHttpIdealBacklogFastForwarderNotification
UlThreadPoolEnqueueWorkItem
UlTimeoutQueuedRequest
UlUnlinkHkeContext
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlUnlinkUriCacheEntry
UlUpdateChannelBindConfig
UlUpdateSslBinding
UlWaitForDisconnectIoctl
UlpAbortFlushedRequests
UlpAddFragmentCacheCompleteWorker
UlpAiRemoveAddressInformation
UlpAllocateConsumer
UlpAllocateRequestQueue
UlpAttachConsumerToRequestQueue
UlpAuthCacheScavenger
UlpAuthenticateRequest
UlpAuthenticateRequestCompletion
UlpBindServerSessionToCommChannel
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildParsedHeaderRangeResponseFromSlices
UlpBuildSingleRangeMdlChainFromSlices
UlpBuildSlices
UlpCancelEntityBody
UlpCancelEntityBodyWorker
UlpCancelWaitForDisconnectIrp
UlpCancelWaitForDisconnectWorker
UlpCleanupCoupling
UlpCleanupUserTokenWorker
UlpCleanupZombieCacheEntry
UlpCleanupZombieHttpConnection
UlpCloseConnectionWorker
UlpCompleteCacheBuild
UlpCompleteCacheBuildWorker
UlpCompleteCacheSliceBuild
UlpCompleteCacheSliceBuildWorker
UlpCompleteFailedFastForwardResponse
UlpCompleteFailedFastForwardResponseWorker
UlpCompleteFastForwardSend
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpCompleteSendErrorResponse
UlpCompleteSendResponseToExtension
UlpCompleteSendToExtensionWorker
UlpCompleteWaitForDisconnects
UlpConnectionDisconnectWorker
UlpCopyChannelBindTokenToIrp
UlpCopyRequestToBuffer
UlpCreateCacheRangeSliceTracker
UlpCreateFastForwardDataContext
UlpCreateFragmentCacheEntry
UlpCreateHttpRequest
UlpDeleteServerSession
UlpDeleteVariantList
UlpDeliverHttpRequestWorker
UlpDeliverRequestStagePolicies
UlpDereferenceBundle
UlpDereferenceEtwRules
UlpDigestAuthCacheLruRemove
UlpDispatchToRequestQueue
UlpDuplicateChunkRange
UlpDuplicateSliceTrackerForCache
UlpEnumerateCouplings
UlpEventRequestConnectionStats
UlpFastAuthenticate
UlpFastForwardSetResponseCompleted
UlpFastForwardUpdateSendBytesPending
UlpFastForwardUpdateSendBytesPendingOld
UlpFilterFlushHashBucket
UlpFilteredFlushUriCache
UlpFindCoupling
UlpFlatCacheRangeWrapper
UlpFlushFilterPeriodicScavenger
UlpFlushHttpPushList
UlpFlushPendingConsumerIo
UlpFlushVariantList
UlpFlushWaitForDisconnects
UlpFreeConsumer
UlpFreeCoupling
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpGetCommChannelFromHandle
UlpHandleRequest
UlpHkeAcquireQoS
UlpHkeDereferenceClientContext
UlpHkeIndicateHttpRequest
UlpHttpIdealBacklogFastForwarderNotification
UlpLockRequestQueueAndCoupling
UlpMergeSlicesToCache
UlpMetronomeDpcRoutine
UlpNotifyEdgePolicyChange
UlpNotifyEdgePolicyChangeForUrl
UlpOpenCoupling
UlpOpenRequestQueue
UlpParseNextRequest
UlpPcwCleanupInstance
UlpPcwCreateInstance
UlpQueryChannelBindTokenFromConnection
UlpQueryConfigGroupBinding
UlpQueueFreeHttpRequest
UlpRedeliverFlushedRequests
UlpReferenceBundle
UlpReferenceCredentials
UlpRestartAddFragmentToCache
UlpRestartCacheMdlRead
UlpRestartFastForwardSend
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpResumeParsingWorker
UlpSendCacheEntry
UlpSendErrorResponse
UlpSendFastForwardDataContext
UlpSendHttpResponseRegular
UlpSendResponseFromSlices
UlpSendResponseOrEntityBodyFastIo
UlpSendResponseToExtension
UlpSendSimpleCleanupWorker
UlpSendSimpleStatusWorker
UlpSetUrlInfo
UlpSynchronizeLanes
UlpSynchronizeLanesWorker
UlpTerminateZombieList
UlpThreadPoolWorker
UlpTransformAndQueueRequestBuffers
UlpUnbindCoupling
UlpUpdatePerfCountersOnCacheSend
UlpWriteEventStatsWorker
UlpWriteStatsOnEgressDisconnect
UlpZombifyEntry
UxDuoAllocateCatalogParcel
UxDuoAllocateDataIndication
UxDuoAllocateJob
UxDuoAllocateParcel
UxDuoAllocateRunner
UxDuoAllocateStream
UxDuoAllocateStreamEndParcel
UxDuoAllocateTask
UxDuoAttachConnection
UxDuoCaptureDeclarePushParameters
UxDuoCleanupTask
UxDuoDataHandler
UxDuoDeclarePush
UxDuoDecrementParcelPending
UxDuoDereferenceJob
UxDuoDetachComplete
UxDuoDispatchConnectionSends
UxDuoDispatchParcel
UxDuoEgressDisconnectCompletion
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteDeclarePush
UxDuoExecuteDetach
UxDuoExecuteParcelCompletion
UxDuoExecuteRunnerCompletion
UxDuoExecuteStreamCleanup
UxDuoExecuteStreamDisconnect
UxDuoFreeBufferIndication
UxDuoFreeConnection
UxDuoFreeDataIndication
UxDuoFreeJob
UxDuoFreeParcel
UxDuoFreeStream
UxDuoInitiateEgressDisconnect
UxDuoInitiateHeadersSend
UxDuoIoReadyEvent
UxDuoParseCatalog
UxDuoParseContinuation
UxDuoProcessCompleteCatalog
UxDuoReceiveEvent
UxDuoReferenceConnectionFromId
UxDuoRunStreamReceivePump
UxDuoScheduleStreamSends
UxDuoSubmitTaskParcels
UxDuoTaskWorker
UxDuoUpdateDataIndication
UxFileEntryRequest
UxGetServiceTag
UxInvokeCompletionRoutine
UxPodCleanupCallback
UxPodDereferenceSilo
UxPodReferenceSilo
UxPodSiloTerminateCallback
UxQuicCloseListener
UxQuicConfigurationClose
UxQuicConnectionAcceptStream
UxQuicConnectionDecoder
UxQuicConnectionEncoder
UxQuicConnectionGetChannelBindToken
UxQuicConnectionIndicatePush
UxQuicConnectionProcessPush
UxQuicConnectionSetCertSettings
UxQuicConnectionStartPushStream
UxQuicCreateConnection
UxQuicCreateDecodeTracker
UxQuicCreateSession
UxQuicCreateStream
UxQuicFreeConnection
UxQuicFreeDecodeTracker
UxQuicFreeSendTracker
UxQuicFreeSession
UxQuicFreeStream
UxQuicResetEndpointConnections
UxQuicSetCallbackHandler
UxQuicSetConnectionEndpoint
UxQuicSetParam
UxQuicStreamClose
UxQuicStreamCompleteHeadersDecode
UxQuicStreamConnectionControl
UxQuicStreamDetachComplete
UxQuicStreamInitiateReceive
UxQuicStreamOpen
UxQuicStreamPushInjectCreateContext
UxQuicStreamPushInjectDestroyContext
UxQuicStreamPushSendComplete
UxQuicStreamReceiveSetEnabled
UxQuicStreamSend
UxQuicStreamSendDestroyContext
UxQuicStreamShutdown
UxQuicStreamStart
UxSslAcceptSecurityContextCallback
UxSslAcquireCredentialsHandleLookupCallback
UxSslAllocateAchContext
UxSslAllocateAscContext
UxSslAttachConnection
UxSslCompleteRetrieveIrp
UxSslCreateConfiguration
UxSslDestroyConfiguration
UxSslDetachComplete
UxSslDetachConnection
UxSslFreeAchContext
UxSslFreeAscContext
UxSslFreeBufferIndication
UxSslFreeConnection
UxSslInitiateSend
UxSslInsertEndpointConfig
UxSslLookupEndpointConfig
UxSslQueueIndicationList
UxSslQueueReceiverWorkItemEx
UxSslReleaseEndpointConfiguration
UxSslReleaseReceiveBuffers
UxSslRestartSendRawData
UxSslRetrieveClientCertificate
UxSslSendRawData
UxSslSetCurrentLookupConfig
UxTlAllocateConnectionForLookaside
UxTlCleanupConnection
UxTlConnectionControl
UxTlDestroyConnection
UxTlDestroyConnectionWorker
UxTlDetachComplete
UxTlDisconnectCompletion
UxTlDisconnectEvent
UxTlInitiateReceive
UxTlInitiateSend
UxTpCleanupTransmitQueue
UxWfpAllocateThrottleContext
UxWfpFreeThrottleContext
UxWskAcceptEvent
UxWskInitiateSend
UxpQuicAbortStreamList
UxpQuicAllocateConfigurationContext
UxpQuicAllocateDataIndication
UxpQuicCleanupEndpointLookupInfo
UxpQuicCompleteEncodeTracker
UxpQuicConfigurationLoadComplete
UxpQuicConfigurationLoadCredential
UxpQuicConfigurationLoadCredentialClient
UxpQuicConfigurationOpen
UxpQuicConnectionAbortNonAcceptedStreams
UxpQuicConnectionCallbackHandler
UxpQuicConnectionClose
UxpQuicConnectionCreateControlStream
UxpQuicConnectionIdealProcessorChanged
UxpQuicConnectionOpen
UxpQuicConnectionProcessCancelPush
UxpQuicConnectionQueueDecoder
UxpQuicConnectionQueueEncoder
UxpQuicConnectionSetConfiguration
UxpQuicConnectionShutdown
UxpQuicConnectionShutdownComplete
UxpQuicConnectionStart
UxpQuicCreateStream
UxpQuicDecodeControlStreamCallbackHandler
UxpQuicEncodeControlStreamCallbackHandler
UxpQuicFreeBufferIndication
UxpQuicFreeConfigurationContext
UxpQuicFreeDataIndication
UxpQuicGetParam
UxpQuicInitializeEndpointLookupInfo
UxpQuicListenerCallbackHandler
UxpQuicListenerClose
UxpQuicListenerNewConnection
UxpQuicListenerOpen
UxpQuicListenerStart
UxpQuicParseAndCopyDataIndication
UxpQuicPeerDecodeControlStreamCallbackHandler
UxpQuicPeerEncodeControlStreamCallbackHandler
UxpQuicReceiveControlStreamCallbackHandler
UxpQuicSendControlStreamCallbackHandler
UxpQuicStreamAbortSends
UxpQuicStreamCallbackEpilog
UxpQuicStreamCallbackHandler
UxpQuicStreamDetach
UxpQuicStreamIndicateReceiveEvent
UxpQuicStreamInitializePushState
UxpQuicStreamParseReceiveBuffer
UxpQuicStreamProcessReceiveWorkItem
UxpQuicStreamProcessTransportIndicationsList
UxpQuicStreamPushStartComplete
UxpQuicStreamQueueEncodeHeaders
UxpQuicStreamQuicDeclarePushPromise
UxpQuicStreamReceiveEvent
UxpQuicStreamShutdownComplete
UxpQuicStreamStartDrain
UxpQuicUnknownUniDiStreamCallbackHandler
UxpQuicUpdateDataIndication
UxpRestartReadFileEntry
UxpSslAllocateRegistration
UxpSslCleanupConnection
UxpSslCleanupDecryptPendingList
UxpSslCleanupTransportIndicationList
UxpSslCommonSendDataHelper
UxpSslConnectionDecryptData
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslDecryptTransportIndication
UxpSslDeleteEndpointConfigLocked
UxpSslExpandTransportDataIndication
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindScopedCcsHandler
UxpSslFindSniHandler
UxpSslFindWildcardScopedCcsHandler
UxpSslFindWildcardSniHandler
UxpSslFreeDataIndication
UxpSslFreeRegistration
UxpSslIndicateReceiveEvent
UxpSslInitiateAscHandler
UxpSslLoadCertificateSync
UxpSslLoadConfigurations
UxpSslParseAndCopyDataIndication
UxpSslQueryChannelBindingInfo
UxpSslReceiver
UxpSslReceiverWorker
UxpSslRemoveEndpointConfig
UxpSslSetConnectionEndpoint
UxpSslWaitForAscHandler
UxpSslWaitForCcsAchHandler
UxpTlCloseAddressEndpoint
UxpTlCloseListenEndpoint
UxpTlCommenceDetach
UxpTlCreateListenEndpoint
UxpTlInitiateReceiveCompletion
UxpTlResetEndpointConnections
UxpTlSuppressReceiveCompletion
UxpTpAllocateBufferTracker
UxpTpAllocateTransmitPacket
UxpTpDequeueTransmitPacket
UxpTpFastTransmit
UxpTpFlushMdlRuns
UxpTpFreeBufferTracker
UxpTpFreeChunkTracker
UxpTpFreeFileMdlRun
UxpTpFreeTransmitPacket
UxpTpFreeTransmitPacketWorker
UxpTpInitializeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartBufferSend
UxpTpRestartFastTransmit
UxpTpRestartMdlProbe
UxpTpRestartMdlRead
UxpTpRestartMdlReadExtension
UxpTpRestartMdlSend
UxpWfpConnectionClassifyCompletion
UxpWfpQuicConnectionClassifyCompletion
UxpWfpSslConnectionClassifyCompletion
UxpWskCancelPendingIo
UxpWskCleanupIoContext
UxpWskControlSocket
UxpWskCreateIoContext
UxpWskInitializeIoContext
UxpWskQosDetachPodCallback
UxpWskSendCompletion
UxpWskTerminateIoContext
|
Expand for full list:
FUN_14000ae1a
FUN_1400191a5
FUN_14001d1b0
FUN_14008f70a
FUN_140151558
FUN_1401539c4
FUN_140154232
FUN_140154a68
FUN_140154e50
FUN_140154f0e
FUN_140156e4aFUN_14015707c
FUN_140157c58
FUN_140159c99
FUN_14015a61c
FUN_14015a6be
FUN_14015aa1b
FUN_14015affe
FUN_14015b1c1
FUN_14015d741
FUN_14015e5f0
FUN_140160147
FUN_1401611e5
FUN_14016137d
FUN_14016291c
QkDerefByOrdinal
QkRefByOrdinal
REFCOUNT_ADDREF_SAFE
UcAbortConnection
UcAllocateConnection
UcAllocateCredential
UcAllocateStream
UcCaptureConnectionParameters
UcCaptureCredentialParameters
UcCleanupClientSessionContext
UcClientStreamDereferenceBundle
UcClientStreamReferenceBundle
UcClientWaitForDisconnectCompletion
UcCloseClientConnectionIoctl
UcCloseClientCredentialIoctl
UcCloseClientStreamIoctl
UcConnectionCancelIrp
UcConnectionCancelIrpWorker
UcConnectionGetQuicConnection
UcConnectionPendIrp
UcCreateClientConnectionIoctl
UcCreateClientCredentialIoctl
UcCreateClientStreamIoctl
UcDeleteStream
UcFreeCaptureConnectionParameters
UcFreeConnection
UcFreeCredential
UcFreeStream
UcGetQuicSession
UcQueryClientConnectionProperty
UcQueryClientStreamProperty
UcReferenceClientConnectionFromId
UcReferenceClientCredentialFromId
UcReferenceClientStreamFromId
UcSendHeadersClientStreamFastIo
UcSetClientConnectionProperty
UcSetClientStreamProperty
UcStartClientConnectionCompletion
UcStartClientConnectionIoctl
UcStreamAllocateSendTracker
UcStreamDetachConnection
UcStreamFastForwardReceive
UcStreamFreeSendTracker
UcStreamIngressDisconnectEvent
UcStreamPendIrp
UcStreamReceiveEvent
UcStreamReceiveHeadersEvent
UcStreamSendHeaders
UcWaitForClientConnectionDisconnect
UcpAbortClientConnection
UcpAbortClientStream
UcpAbortStreams
UcpAbortStreamsFromConnection
UcpAllocateClientSession
UcpCleanupClientSession
UcpCleanupConnection
UcpConnectionResetIrpCancellationRoutine
UcpCoupleSessionContextAndSession
UcpCreateClientSession
UcpDeleteConnection
UcpDeleteCredential
UcpFreeClientSessionContext
UcpNotifyDisconnectClientStream
UcpReceiveEntityBodyClientStream
UcpReceiveHeadersClientStream
UcpSendEntityBodyClientStream
UcpStreamCancelIrp
UcpStreamCancelIrpWorker
UcpStreamIndicateFastForwardDetach
UcpStreamProcessFastForwardReceiveDataWorker
UcpStreamResetIrpCancellationRoutine
UcpStreamSendCompletion
UcpStreamSendHeadersCompletionCommon
UcpStreamStartProcessFastForwardReceiveData
UlAddFragmentToCache
UlAddSite
UlAddSslBinding
UlAddToAuthCache
UlAddToHashTable
UlAddUrlToConfigGroup
UlAllocateBuildTracker
UlAllocateCacheEntry
UlAllocateConnectionRequestId
UlAllocateLogDataBuffer
UlBindConfigGroupToServerSession
UlBuildCacheEntryWorker
UlCanSatisfyRangesFromCache
UlCancelHttpRequest
UlCancelSendHttpResponse
UlCaptureChannelBindConfigOld
UlCaptureHttpResponse
UlCaptureHttpResponseOld
UlCheckinUriCacheEntry
UlCheckoutUriCacheEntry
UlCleanupChannelBindConfig
UlCleanupConfigGroupInfo
UlCleanupConnectionCouplings
UlCleanupConsumerInternal
UlCleanupDelegationConsumer
UlCleanupHttpConnection
UlCloseCommChannel
UlCloseConnection
UlCloseLogFile
UlCompleteReceiveEntityBodyIrp
UlCompleteWaitForDisconnects
UlConnectionCleanupWorker
UlCopyAuthConfig
UlCopyChannelBindConfig
UlCopyChannelBindConfigFromPropertyInfo
UlCopyConfigGroupInfoForCache
UlCreateAutoConfigGroup
UlCreateAutoServerSession
UlCreateCacheEntryFromResponse
UlCreateConfigGroup
UlDeclarePushIoctl
UlDelegateRequest
UlDeleteAuthCache
UlDeleteAutoServerSession
UlDeleteConfigGroup
UlDeleteConfigGroupById
UlDeleteConsumerCallback
UlDeleteServerSession
UlDeleteSslBinding
UlDereferenceAlternateCredential
UlDestroyCapturedResponse
UlDestroyLogDataBuffer
UlDestroyLogDataBufferWorker
UlDestroySliceTracker
UlDestroyUriCacheEntry
UlEgressDisconnectCompletion
UlEtwEvaluateFilter
UlEvaluateRequest
UlEventDataTransmissionStats
UlEventRequestDataTransmissionStats
UlExecuteLazyAuthInitialization
UlExtractAndAppendAuthenticationResponseInfo
UlFastForwardDetachEvent
UlFastForwardIdealBacklogEvent
UlFastForwardIngressDisconnectEvent
UlFastForwardReceiveEvent
UlFastReceiveHttpRequest
UlFastSendCompleteWorker
UlFastSendHttpResponse
UlFastSendHttpResponseOld
UlFindUrlGroupId
UlFlushAuthCache
UlFreeBuildTracker
UlFreeConfigGroup
UlFreeHttpConnection
UlFreeServerSession
UlGenericLogTimerDpcRoutine
UlGetFromAuthCache
UlGetServerSessionProperty
UlHkeCreateCalloutContext
UlHkeDereferenceCalloutContext
UlHkeDeregisterExtension
UlHkeDestroyCalloutContext
UlHkeNotifyDetachClient
UlHkeReferenceCalloutContext
UlHttpAttachConnection
UlHttpBufferReceiveEvent
UlHttpDetachConnection
UlHttpIngressDisconnectEvent
UlInvokeCompletionRoutine
UlLinkHkeContext
UlLogZombieConnection
UlLookupAndVerifyCacheEntry
UlNotifyIPListenListChanges
UlNotifyServerSessionAddition
UlNotifyServerSessionRemoval
UlPeriodicAuthCacheScavenger
UlPktMonTraceWskInternal
UlProcessResponseInfo
UlPurgeZombieConnections
UlQueryChannelBindToken
UlQueryConfigGroupProperty
UlQueryRequestProperty
UlQuerySslBinding
UlQuerySslBindingExtendedProperties
UlReceiveClientCertIoctl
UlReceiveEntityBody
UlReceiveEntityBodyFastIo
UlReceiveEntityBodyIoctl
UlReceiveHttpRequest
UlReferenceHttpConnectionFromId
UlReferenceHttpRequestFromId
UlReferenceRequestQueueByHandle
UlRegisterConsumerCallback
UlReleaseRequestBuffer
UlRemoveAllUrlsFromConfigGroup
UlRemoveSendIrpCancelRoutine
UlRemoveUrlFromConfigGroup
UlRestartFastSendHttpResponse
UlRestartSendHttpResponseIoctl
UlResumeParsing
UlScGetSiteCounters
UlScStartCounters
UlScStopCounters
UlSendCacheEntryWorker
UlSendCachedResponse
UlSendEntityBodyIoctlOld
UlSendHttpResponse
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendRangeCacheEntry
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConfigGroupProperty
UlSetPostSendState
UlSetPreSendState
UlSetReceiveEntityBodyIrpCancelRoutine
UlSetRequestProperty
UlSetSendCompleteState
UlSetSendIrpCancelRoutine
UlSetServerSessionProperty
UlSetZeroLengthSendState
UlStartHttpIdealBacklogFastForwarderNotification
UlStopHttpIdealBacklogFastForwarderNotification
UlThreadPoolEnqueueWorkItem
UlTimeoutQueuedRequest
UlUnlinkHkeContext
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlUnlinkUriCacheEntry
UlUpdateChannelBindConfig
UlUpdateSslBinding
UlWaitForDisconnectIoctl
UlpAbortFlushedRequests
UlpAddFragmentCacheCompleteWorker
UlpAiRemoveAddressInformation
UlpAllocateConsumer
UlpAllocateRequestQueue
UlpAttachConsumerToRequestQueue
UlpAuthCacheScavenger
UlpAuthenticateRequest
UlpAuthenticateRequestCompletion
UlpBindServerSessionToCommChannel
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildParsedHeaderRangeResponseFromSlices
UlpBuildSingleRangeMdlChainFromSlices
UlpBuildSlices
UlpCancelEntityBody
UlpCancelEntityBodyWorker
UlpCancelWaitForDisconnectIrp
UlpCancelWaitForDisconnectWorker
UlpCleanupCoupling
UlpCleanupUserTokenWorker
UlpCleanupZombieCacheEntry
UlpCleanupZombieHttpConnection
UlpCloseConnectionWorker
UlpCompleteCacheBuild
UlpCompleteCacheBuildWorker
UlpCompleteCacheSliceBuild
UlpCompleteCacheSliceBuildWorker
UlpCompleteFailedFastForwardResponse
UlpCompleteFailedFastForwardResponseWorker
UlpCompleteFastForwardSend
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpCompleteSendErrorResponse
UlpCompleteSendResponseToExtension
UlpCompleteSendToExtensionWorker
UlpCompleteWaitForDisconnects
UlpConnectionDisconnectWorker
UlpCopyChannelBindTokenToIrp
UlpCopyRequestToBuffer
UlpCreateCacheRangeSliceTracker
UlpCreateFastForwardDataContext
UlpCreateFragmentCacheEntry
UlpCreateHttpRequest
UlpDeleteServerSession
UlpDeleteVariantList
UlpDeliverHttpRequestWorker
UlpDeliverRequestStagePolicies
UlpDereferenceBundle
UlpDereferenceEtwRules
UlpDigestAuthCacheLruRemove
UlpDispatchToRequestQueue
UlpDuplicateChunkRange
UlpDuplicateSliceTrackerForCache
UlpEnumerateCouplings
UlpEventRequestConnectionStats
UlpFastAuthenticate
UlpFastForwardSetResponseCompleted
UlpFastForwardUpdateSendBytesPending
UlpFastForwardUpdateSendBytesPendingOld
UlpFilterFlushHashBucket
UlpFilteredFlushUriCache
UlpFindCoupling
UlpFlatCacheRangeWrapper
UlpFlushFilterPeriodicScavenger
UlpFlushHttpPushList
UlpFlushPendingConsumerIo
UlpFlushVariantList
UlpFlushWaitForDisconnects
UlpFreeConsumer
UlpFreeCoupling
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpGetCommChannelFromHandle
UlpHandleRequest
UlpHkeAcquireQoS
UlpHkeDereferenceClientContext
UlpHkeIndicateHttpRequest
UlpHttpIdealBacklogFastForwarderNotification
UlpLockRequestQueueAndCoupling
UlpMergeSlicesToCache
UlpMetronomeDpcRoutine
UlpNotifyEdgePolicyChange
UlpNotifyEdgePolicyChangeForUrl
UlpOpenCoupling
UlpOpenRequestQueue
UlpParseNextRequest
UlpPcwCleanupInstance
UlpPcwCreateInstance
UlpQueryChannelBindTokenFromConnection
UlpQueryConfigGroupBinding
UlpQueueFreeHttpRequest
UlpRedeliverFlushedRequests
UlpReferenceBundle
UlpReferenceCredentials
UlpRejectFlushedRequests
UlpRestartAddFragmentToCache
UlpRestartCacheMdlRead
UlpRestartFastForwardSend
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpResumeParsingWorker
UlpSendCacheEntry
UlpSendErrorResponse
UlpSendFastForwardDataContext
UlpSendHttpResponseRegular
UlpSendResponseFromSlices
UlpSendResponseOrEntityBodyFastIo
UlpSendResponseToExtension
UlpSendSimpleCleanupWorker
UlpSendSimpleStatusWorker
UlpSetUrlInfo
UlpSynchronizeLanes
UlpSynchronizeLanesWorker
UlpTerminateZombieList
UlpThreadPoolWorker
UlpTransformAndQueueRequestBuffers
UlpUnbindCoupling
UlpUpdatePerfCountersOnCacheSend
UlpWriteEventStatsWorker
UlpWriteStatsOnEgressDisconnect
UlpZombifyEntry
UxDuoAllocateCatalogParcel
UxDuoAllocateDataIndication
UxDuoAllocateJob
UxDuoAllocateParcel
UxDuoAllocateRunner
UxDuoAllocateStream
UxDuoAllocateStreamEndParcel
UxDuoAllocateTask
UxDuoAttachConnection
UxDuoCaptureDeclarePushParameters
UxDuoCleanupTask
UxDuoDataHandler
UxDuoDeclarePush
UxDuoDecrementParcelPending
UxDuoDereferenceJob
UxDuoDetachComplete
UxDuoDispatchConnectionSends
UxDuoDispatchParcel
UxDuoEgressDisconnectCompletion
UxDuoEnqueueDisconnectTask
UxDuoEnqueueTask
UxDuoExecuteDeclarePush
UxDuoExecuteDetach
UxDuoExecuteParcelCompletion
UxDuoExecuteRunnerCompletion
UxDuoExecuteStreamCleanup
UxDuoExecuteStreamDisconnect
UxDuoFreeBufferIndication
UxDuoFreeConnection
UxDuoFreeDataIndication
UxDuoFreeJob
UxDuoFreeParcel
UxDuoFreeStream
UxDuoInitiateEgressDisconnect
UxDuoInitiateHeadersSend
UxDuoIoReadyEvent
UxDuoParseCatalog
UxDuoParseContinuation
UxDuoProcessCompleteCatalog
UxDuoReceiveEvent
UxDuoReferenceConnectionFromId
UxDuoRunStreamReceivePump
UxDuoScheduleStreamSends
UxDuoSubmitTaskParcels
UxDuoTaskWorker
UxDuoUpdateDataIndication
UxFileEntryRequest
UxGetServiceTag
UxInvokeCompletionRoutine
UxPodCleanupCallback
UxPodDereferenceSilo
UxPodReferenceSilo
UxPodSiloTerminateCallback
UxQuicCloseListener
UxQuicConfigurationClose
UxQuicConnectionAcceptStream
UxQuicConnectionDecoder
UxQuicConnectionEncoder
UxQuicConnectionGetChannelBindToken
UxQuicConnectionIndicatePush
UxQuicConnectionProcessPush
UxQuicConnectionSetCertSettings
UxQuicConnectionStartPushStream
UxQuicCreateConnection
UxQuicCreateDecodeTracker
UxQuicCreateSession
UxQuicCreateStream
UxQuicFreeConnection
UxQuicFreeDecodeTracker
UxQuicFreeSendTracker
UxQuicFreeSession
UxQuicFreeStream
UxQuicResetEndpointConnections
UxQuicSetCallbackHandler
UxQuicSetConnectionEndpoint
UxQuicSetParam
UxQuicStreamClose
UxQuicStreamCompleteHeadersDecode
UxQuicStreamConnectionControl
UxQuicStreamDetachComplete
UxQuicStreamInitiateReceive
UxQuicStreamOpen
UxQuicStreamPushInjectCreateContext
UxQuicStreamPushInjectDestroyContext
UxQuicStreamPushSendComplete
UxQuicStreamReceiveSetEnabled
UxQuicStreamSend
UxQuicStreamSendDestroyContext
UxQuicStreamShutdown
UxQuicStreamStart
UxSslAcceptSecurityContextCallback
UxSslAcquireCredentialsHandleLookupCallback
UxSslAllocateAchContext
UxSslAllocateAscContext
UxSslAttachConnection
UxSslCompleteRetrieveIrp
UxSslCreateConfiguration
UxSslDestroyConfiguration
UxSslDetachComplete
UxSslDetachConnection
UxSslFreeAchContext
UxSslFreeAscContext
UxSslFreeBufferIndication
UxSslFreeConnection
UxSslInitiateSend
UxSslInsertEndpointConfig
UxSslLookupEndpointConfig
UxSslQueueIndicationList
UxSslQueueReceiverWorkItemEx
UxSslReleaseEndpointConfiguration
UxSslReleaseReceiveBuffers
UxSslRestartSendRawData
UxSslRetrieveClientCertificate
UxSslSendRawData
UxSslSetCurrentLookupConfig
UxTlAllocateConnectionForLookaside
UxTlCleanupConnection
UxTlConnectionControl
UxTlDestroyConnection
UxTlDestroyConnectionWorker
UxTlDetachComplete
UxTlDisconnectCompletion
UxTlDisconnectEvent
UxTlInitiateReceive
UxTlInitiateSend
UxTpCleanupTransmitQueue
UxWfpAllocateThrottleContext
UxWfpFreeThrottleContext
UxWskAcceptEvent
UxWskInitiateSend
UxpQuicAbortStreamList
UxpQuicAllocateConfigurationContext
UxpQuicAllocateDataIndication
UxpQuicCleanupEndpointLookupInfo
UxpQuicCompleteEncodeTracker
UxpQuicConfigurationLoadComplete
UxpQuicConfigurationLoadCredential
UxpQuicConfigurationLoadCredentialClient
UxpQuicConfigurationOpen
UxpQuicConnectionAbortNonAcceptedStreams
UxpQuicConnectionCallbackHandler
UxpQuicConnectionClose
UxpQuicConnectionCreateControlStream
UxpQuicConnectionIdealProcessorChanged
UxpQuicConnectionOpen
UxpQuicConnectionProcessCancelPush
UxpQuicConnectionQueueDecoder
UxpQuicConnectionQueueEncoder
UxpQuicConnectionSetConfiguration
UxpQuicConnectionShutdown
UxpQuicConnectionShutdownComplete
UxpQuicConnectionStart
UxpQuicCreateStream
UxpQuicDecodeControlStreamCallbackHandler
UxpQuicEncodeControlStreamCallbackHandler
UxpQuicFreeBufferIndication
UxpQuicFreeConfigurationContext
UxpQuicFreeDataIndication
UxpQuicGetParam
UxpQuicInitializeEndpointLookupInfo
UxpQuicListenerCallbackHandler
UxpQuicListenerClose
UxpQuicListenerNewConnection
UxpQuicListenerOpen
UxpQuicListenerStart
UxpQuicParseAndCopyDataIndication
UxpQuicPeerDecodeControlStreamCallbackHandler
UxpQuicPeerEncodeControlStreamCallbackHandler
UxpQuicReceiveControlStreamCallbackHandler
UxpQuicSendControlStreamCallbackHandler
UxpQuicStreamAbortSends
UxpQuicStreamCallbackEpilog
UxpQuicStreamCallbackHandler
UxpQuicStreamDetach
UxpQuicStreamIndicateReceiveEvent
UxpQuicStreamInitializePushState
UxpQuicStreamParseReceiveBuffer
UxpQuicStreamProcessReceiveWorkItem
UxpQuicStreamProcessTransportIndicationsList
UxpQuicStreamPushStartComplete
UxpQuicStreamQueueEncodeHeaders
UxpQuicStreamQuicDeclarePushPromise
UxpQuicStreamReceiveEvent
UxpQuicStreamShutdownComplete
UxpQuicStreamStartDrain
UxpQuicUnknownUniDiStreamCallbackHandler
UxpQuicUpdateDataIndication
UxpRestartReadFileEntry
UxpSslAllocateRegistration
UxpSslCleanupConnection
UxpSslCleanupDecryptPendingList
UxpSslCleanupTransportIndicationList
UxpSslCommonSendDataHelper
UxpSslConnectionDecryptData
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslDecryptTransportIndication
UxpSslDeleteEndpointConfigLocked
UxpSslExpandTransportDataIndication
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindScopedCcsHandler
UxpSslFindSniHandler
UxpSslFindWildcardScopedCcsHandler
UxpSslFindWildcardSniHandler
UxpSslFreeDataIndication
UxpSslFreeRegistration
UxpSslIndicateReceiveEvent
UxpSslLoadCertificateSync
UxpSslLoadConfigurations
UxpSslParseAndCopyDataIndication
UxpSslQueryChannelBindingInfo
UxpSslReceiver
UxpSslReceiverWorker
UxpSslRemoveEndpointConfig
UxpSslSetConnectionEndpoint
UxpSslWaitForAscHandler
UxpSslWaitForCcsAchHandler
UxpTlCloseAddressEndpoint
UxpTlCloseListenEndpoint
UxpTlCommenceDetach
UxpTlCreateListenEndpoint
UxpTlInitiateReceiveCompletion
UxpTlResetEndpointConnections
UxpTlSuppressReceiveCompletion
UxpTpAllocateBufferTracker
UxpTpAllocateTransmitPacket
UxpTpDequeueTransmitPacket
UxpTpFastTransmit
UxpTpFlushMdlRuns
UxpTpFreeBufferTracker
UxpTpFreeChunkTracker
UxpTpFreeFileMdlRun
UxpTpFreeTransmitPacket
UxpTpFreeTransmitPacketWorker
UxpTpInitializeChunkTracker
UxpTpMdlSendCompleteWorker
UxpTpRestartBufferSend
UxpTpRestartFastTransmit
UxpTpRestartMdlProbe
UxpTpRestartMdlRead
UxpTpRestartMdlReadExtension
UxpTpRestartMdlSend
UxpWfpConnectionClassifyCompletion
UxpWfpQuicConnectionClassifyCompletion
UxpWfpSslConnectionClassifyCompletion
UxpWskCancelPendingIo
UxpWskCleanupIoContext
UxpWskControlSocket
UxpWskCreateIoContext
UxpWskInitializeIoContext
UxpWskQosDetachPodCallback
UxpWskSendCompletion
UxpWskTerminateIoContext
| |paramcount|4|4| |`address`|14001cc10|14001ccf0| |sig|noreturn undefined __fastcall UlBugCheckEx(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)|noreturn undefined __fastcall UlBugCheckEx(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlBugCheckEx Calling Diff ```diff --- UlBugCheckEx calling +++ UlBugCheckEx calling @@ -1,25 +1,25 @@ -FUN_14000ad3a -FUN_1400190c5 -FUN_14001d0d0 -FUN_1400903ea -FUN_140150dec -FUN_140153258 -FUN_140153ac6 -FUN_1401542fc -FUN_1401546e4 -FUN_1401547a2 -FUN_1401566de -FUN_140156910 -FUN_140157abe -FUN_140157dd2 -FUN_140159e13 -FUN_14015a796 -FUN_14015a838 -FUN_14015ab95 -FUN_14015b178 -FUN_14015b33b -FUN_14015da91 -FUN_14015fb0f -FUN_140160ef9 -FUN_140161091 -FUN_140162630 +FUN_14000ae1a +FUN_1400191a5 +FUN_14001d1b0 +FUN_14008f70a +FUN_140151558 +FUN_1401539c4 +FUN_140154232 +FUN_140154a68 +FUN_140154e50 +FUN_140154f0e +FUN_140156e4a +FUN_14015707c +FUN_140157c58 +FUN_140159c99 +FUN_14015a61c +FUN_14015a6be +FUN_14015aa1b +FUN_14015affe +FUN_14015b1c1 +FUN_14015d741 +FUN_14015e5f0 +FUN_140160147 +FUN_1401611e5 +FUN_14016137d +FUN_14016291c @@ -346,0 +347 @@ +UlpRejectFlushedRequests @@ -582 +582,0 @@ -UxpSslInitiateAscHandler ``` ## WPP_SF_L ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.91| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|WPP_SF_L|WPP_SF_L| |fullname|WPP_SF_L|WPP_SF_L| |`refcount`|1086|1089| |length|45|45| |called|FastWppTraceMessage|FastWppTraceMessage| |`calling`|
Expand for full list:
FUN_1400190c5
FUN_14001be97
FUN_14001d716
FUN_14002411e
FUN_140024535
FUN_140025511
FUN_1400344c0
FUN_14003a0ff
FUN_14003c54e
FUN_140050a2c
FUN_140072678FUN_14007aaa9
FUN_14007ae8c
FUN_14007c94d
FUN_1400903ea
FUN_140152b19
FUN_140152d42
FUN_140152dd9
FUN_140152f92
FUN_14015321d
FUN_140153d20
FUN_140154a6c
FUN_14015761a
FUN_14015a3a2
FUN_14015b26a
FUN_14015cda4
FUN_14015e0be
FUN_1401618f2
FUN_140161c94
FUN_140162127
HttpCleanAndCopyUrl
HttpCopyUrl
HttpFindUrlToken
HttpNormalizeNamedHost
HttpUcs4toUtf16
HttpUtf8RawBytesToUnicode
HttpValidateHostname
HttpVerifyUnicodeToken
HttppCleanAndCopyUrlByType
HttppCopyHostByType
HttppParseIPv6Address
HttppParseUrlPath
HttppParseUrlPort
HttppParseUrlRoutingIp
HttppParseUrlScheme
HttppPostValidateHostname
HttppValidateIpv6Hostname
ParseChunkLength
ParseLastModified
UcAbortClientConnectionIoctl
UcAbortClientStreamIoctl
UcAllocateConnection
UcAllocateConnectionParameters
UcAllocateCredential
UcAllocateCredentialParameters
UcAllocateStream
UcCaptureConnectionParameters
UcCaptureCredentialParameters
UcCloseClientConnectionIoctl
UcCloseClientCredentialIoctl
UcCloseClientStreamIoctl
UcCloseConnection
UcConnectionGetQuicConnection
UcConnectionPendIrp
UcCreateClientConnectionIoctl
UcCreateClientCredentialIoctl
UcCreateClientStreamIoctl
UcCreateSessionContextHelper
UcGetQuicSession
UcLinkConnectionToSessionContext
UcLinkCredentialToSessionContext
UcLinkStreamToConnection
UcNotifyDisconnectClientStreamIoctl
UcQueryClientConnectionIoctl
UcQueryClientConnectionProperty
UcQueryClientStreamIoctl
UcQueryClientStreamProperty
UcReceiveEntityBodyClientStreamIoctl
UcReceiveHeadersClientStreamIoctl
UcSendEntityBodyClientStreamIoctl
UcSessionContextFromFileObject
UcSetClientConnectionIoctl
UcSetClientConnectionProperty
UcSetClientStreamProperty
UcSetClientStreamPropertyIoctl
UcSetIrpCancellationRoutine
UcStartClientConnectionIoctl
UcStreamAllocateSendTracker
UcStreamPendIrp
UcStreamReceiveHeadersEvent
UcStreamRestartReceive
UcUnlinkStreamFromConnection
UcUnusedIoctl
UcWaitForClientConnectionDisconnect
UcWaitForClientConnectionDisconnectIoctl
UcpAbortClientConnection
UcpAbortClientStream
UcpAllocateClientSession
UcpAllocateClientSessionContext
UcpConnectionResetIrpCancellationRoutine
UcpCopyEntityBodyToUserBuffer
UcpCopyHeaderPairsToUser
UcpCreateClientSession
UcpCreateSendEntityChunks
UcpFixUpPair
UcpGetSendEntityBodyStreamInfo
UcpGetSendHeadersPairs
UcpGetSendHeadersStreamInfo
UcpGetStreamIdInfo
UcpInitializeStreamBundle
UcpNotifyDisconnectClientStream
UcpReceiveHeadersClientStream
UcpRemoveConnectionFromSessionContext
UcpRemoveCredentialFromSessionContext
UcpSendEntityBodyClientStream
UcpStreamAllocateReceiveBuffer
UcpStreamCreateHeaderBuffer
UcpStreamIndicateHeaders
UcpStreamIndicateReceive
UcpStreamProcessFastForwardReceiveDataInternal
UcpStreamResetIrpCancellationRoutine
UlAcceptEncodingHeaderHandler
UlAcceptHeaderHandler
UlAccessCheck
UlAddCacheEntry
UlAddFragmentToCache
UlAddFragmentToCacheIoctl
UlAddToHashTable
UlAddUrlToConfigGroup
UlAddUrlToUrlGroupIoctl
UlAiPktMonGetAddressInformation
UlAiStartModule
UlAiStartTrackingAddressInformation
UlAllocateConnectionRequestId
UlAppendHeaderValue
UlAuthCopyUnconfiguredAuthHeaderToBuffer
UlCGRemoveHashTableEntry
UlCancelConsumerCallback
UlCancelHttpRequest
UlCancelHttpRequestIoctl
UlCaptureChannelBindConfigOld
UlCaptureDelegateRequestParameters
UlCaptureHttpResponse
UlCaptureHttpResponseOld
UlCaptureWideString
UlChannelBindConfigParsing
UlChargeRequestQueueQuota
UlCheckCacheControlHeaders
UlCheckCachePreconditions
UlCheckDisconnectInfo
UlCheckFastForwarding
UlCheckProtocolCompliance
UlCheckRawResponseCompatibility
UlCheckReceiveEntityBodyState
UlCheckSendResponseFlags
UlChooseConnectionHeader
UlCleanupConsumerInternal
UlCloseServerSessionIoctl
UlComputeFixedHeaderSizeNew
UlComputeFixedHeaderSizeOld
UlComputeMultipleKnownHeaderSize
UlComputeMultipleKnownHeaderSizeOld
UlConnectionCleanupWorker
UlContentRangeHeaderHandler
UlControlService
UlControlServiceIoctl
UlCookUrl
UlCopyAuthConfigToIrp
UlCopyAuthHeader
UlCopyChannelBindConfigFromPropertyInfo
UlCopyChannelBindConfigToIrp
UlCopyParsedHeaders
UlCopyRequestToBuffer
UlCopyRequestToIrp
UlCopyServiceBindings
UlCopyUserAuthInfoToAuthConfig32
UlCopyUserAuthInfoToAuthConfigNew
UlCreateAutoConfigGroup
UlCreateAutoServerSession
UlCreateCacheEntryFromResponse
UlCreateCommChannelHelper
UlCreateConsumerHelper
UlCreateServerSessionIoctl
UlCreateUrlGroupIoctl
UlDeclarePushIoctl
UlDeepCopyParsedHeaders
UlDelegateRequest
UlDelegateRequestExIoctl
UlDelegateRequestIoctl
UlDeleteConfigGroup
UlDeleteConfigGroupById
UlDeleteServerSession
UlDeleteServiceConfigIoctl
UlDeleteUrlGroupIoctl
UlDisablePeriodicScavenger
UlDispatchRequestToRequestQueue
UlEnablePeriodicScavenger
UlEnumerateRequestQueues
UlEnumerateServerSessions
UlEnumerateUrlGroups
UlEtwEvaluateFilter
UlEtwEvaluateFilterForHost
UlEtwEvaluateFilterForRequestConnection
UlEtwEvaluateQuicConnectionInfoFilter
UlEvaluateRequest
UlEvaluateRequestIoctl
UlEventFlushResponseCache
UlEventLogAddUrl
UlEventLogCreateUrlGroup
UlEventLogDeleteUrlGroup
UlEventLogRemoveAllUrls
UlEventLogRemoveUrl
UlEventLogUrlReservation
UlEventLogWriteFailure
UlEventSetConfigGroupProperty
UlEventSetIpListenList
UlEventSslSettingsCreated
UlEventSslSettingsDeleted
UlEventSslSettingsUpdated
UlExtractAndAppendAuthenticationResponseInfo
UlFastForwardDetachEvent
UlFastForwardIngressDisconnectEvent
UlFastForwardReceiveEvent
UlFastReceiveHttpRequest
UlFastSendHttpResponse
UlFastSendHttpResponseOld
UlFeatureSupportedIoctl
UlFindUrlGroupId
UlFindUrlGroupIdIoctl
UlFlCaptureFlowRateInfo
UlFlCaptureFlowRateInfoOld
UlFlFlowRateInfoProcessing
UlFlushCacheByUri
UlFlushResponseCacheIoctl
UlFreeHttpConnection
UlFreeHttpRequestHeaders
UlGenerateFixedHeaders
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateRoutingToken
UlGenerateSingleVariableHeaders
UlGenerateTrailers
UlGenerateTransferChunkingChunks
UlGenerateVariableHeaders
UlGetAutoConfigGroup
UlGetCGroupForRequest
UlGetChannelBindTokenSize
UlGetConsumerAndApiVersion
UlGetCountersIoctl
UlGetIrpSid
UlGetQuicCreationStatsV2Size
UlGetRequest
UlGetRequestFromId
UlGetServiceBindingInfo
UlGetServiceBindingInfo32
UlGetTransportIdleConnectionTimeout
UlGetUserTokenBindingInfoSize
UlHostHeaderHandler
UlHttpAttachConnection
UlHttpReceiveHeadersEvent
UlInitializeCacheEntry
UlInitializeLogBufferGranularity
UlInitializeResumeParsingFlag
UlIsConsumerShutdown
UlLinkHkeContext
UlLogZombieConnection
UlLookupAndVerifyCacheEntry
UlLookupHostPlusIPSite
UlMgmtFlushCache
UlMultipleHeaderHandler
UlNotifyIPListenListChanges
UlParseAcceptHeaderMatch
UlParseAcceptRangesHeader
UlParseHeader
UlParseHttp
UlParseHttpSendHttpResponseIoctls
UlParsePushHeaderPairs
UlParsePushHeaderPairsOld
UlParseRequestHeaderPairs
UlParseRequestHeaderPairsOld
UlPeriodicCacheScavenger
UlPeriodicThreadPoolWakeup
UlPktMonRegister
UlPktMonRegisterInterface
UlPktMonTraceDropWskReceive
UlPktMonTraceWskInternal
UlPktMonTraceWskReceive
UlPktMonTraceWskSend
UlPktMonUnRegisterInterface
UlPrepareUrlIoctl
UlProbeAndCopyIpPortAddressToStringW
UlProcessResponseInfo
UlPurgeConsumer
UlQosConfigureFlowCharacteristics
UlQueryChannelBindToken
UlQueryConsumerProcessInfo
UlQueryExpectHeader
UlQueryRequestIoctl
UlQueryRequestProperty
UlQueryRequestQueueIoctl
UlQueryRequestQueueSecurityDescriptor
UlQueryServerSessionIoctl
UlQueryServiceConfigIoctl
UlQueryUrlGroupIoctl
UlReadFragmentFromCacheIoctl
UlReceiveClientCertIoctl
UlReceiveEntityBody
UlReceiveEntityBodyIoctl
UlReceiveHttpRequest
UlReceiveHttpRequestIoctl
UlRegisterConsumerCallback
UlRemoveAllUrlsFromConfigGroup
UlRemoveConnectionOptionHeaders
UlRemoveSendIrpCancelRoutine
UlRemoveUrlFromConfigGroup
UlRemoveUrlFromUrlGroupIoctl
UlReplaceHeaderValue
UlResponseInfoParsing
UlSanitizeHeaders
UlScStartCounters
UlScStartFacet
UlSendCacheEntryWorker
UlSendCachedResponse
UlSendData
UlSendEntityBodyIoctlOld
UlSendHttpResponse
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetBooleanRegistryValue
UlSetBufferTimer
UlSetConfigGroupProperty
UlSetConfigSetting
UlSetConnectionsProperty
UlSetEntityBodyType
UlSetHttpConnectionTokenBinding
UlSetParsedHeader
UlSetReceiveEntityBodyIrpCancelRoutine
UlSetRequestIoctl
UlSetRequestProperty
UlSetRequestQueueIoctl
UlSetRequestQueueProperty
UlSetRequestQueueSecurityDescriptor
UlSetResponseDisconnectFlags
UlSetServerSessionIoctl
UlSetServerSessionProperty
UlSetServiceConfigIoctl
UlSetTransportIdleConnectionTimeout
UlSetUrlDelegateInfo
UlSetUrlGroupIoctl
UlShutdownRequestQueueIoctl
UlSingleHeaderHandler
UlStartConfigGroupFacet
UlStartDataModule
UlStartHttpConnFacet
UlStartHttpIdealBacklogFastForwarderNotification
UlStartHttpReceiveModule
UlStartRequestQueueFacet
UlStartRequestQueueModule
UlStartUriCacheFacet
UlThreadPoolHotAddAbort
UlThreadPoolHotAddNotify
UlTimeoutQueuedRequest
UlTraceFilterCompare
UlTransformH1Response
UlTransformResponse
UlUpdateServiceConfigIoctl
UlUserAgentHeaderHandler
UlValidateConfigGroup
UlValidateConfigGroupBoundToRequestQueue
UlValidateHttpConnectionFromId
UlValidateHttpRequestFromId
UlValidateServerSession
UlVerifyOpaqueUpgradeHeader
UlWaitForDemandStart
UlWaitForDemandStartIoctl
UlWaitForDisconnectIoctl
UlpAddCompatibilityHeaders
UlpAdjustBuffers
UlpAiInsertAddress
UlpAiPopulateAddressList
UlpAttachConsumerToRequestQueue
UlpAuthenticateRequest
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCheckSpaceAndAddEntryStats
UlpCleanAllUrls
UlpCommonHeaderHandler
UlpCompleteLogRecordW3C
UlpCompleteSendCacheEntryWorker
UlpComputeAuthHeaderSize
UlpComputeAuthHeaderSizeOld
UlpCopyChannelBindTokenToIrp
UlpCopyDscpInfo
UlpCopyFilterData
UlpCopyInitialPacketTtl
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestInformation
UlpCopyRequestToBuffer
UlpCopySingleMultipleHeader
UlpCopySslProtocolInfo
UlpCopyString
UlpCopyTcpInfoV2
UlpCopyUserDataToFastTracker
UlpCreateFastForwardDataContext
UlpCreateHttpRequest
UlpDeleteReservationEntry
UlpDeliverHttpRequest
UlpDeliverRequestStageInitial
UlpDeliverRequestStageInspection
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateUrlGroupsInServerSession
UlpEtwEvaluateFilterInternal
UlpEventRequestConnectionStats
UlpFastForwardCleanupOnFailure
UlpFindWSToken
UlpFlushFilterForAddUrl
UlpFlushFilterForRemoveUrl
UlpFlushFilterPeriodicScavenger
UlpFlushFilterTrimCache
UlpFlushFilterUriRecursive
UlpFlushLogFileBufferWorker
UlpFlushPendingConsumerIo
UlpFlushPendingRequests
UlpFreeHttpRequest
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpGetAuthInfoNew
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpGetFastForwardingContext
UlpGetFastForwardingContextOld
UlpGetGMTOffset
UlpGetIrpProcessIdAndImageName
UlpGetLogInfo
UlpGetLogInfoOld
UlpGetMultipleKnownHeader
UlpGetResponseInfo
UlpGetSendInfo
UlpGetSendInfoOld
UlpGetUserSidForToken
UlpHkeAcquireQoS
UlpHotAddIncrementalCallback
UlpIndicateCompleteToExtension
UlpInitErrorLogInfo
UlpInitializeInternalResponseHeaders
UlpInitializeInternalResponseHeadersOld
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpInvokeHeaderHandlers
UlpIsLocalRequest
UlpIsRequestFromProxy
UlpLogErrorResposeSendEvent
UlpLogRequestQueueOverflowEvents
UlpLowMemoryCacheScavengerBegin
UlpLowMemoryCacheScavengerEnd
UlpLowMemoryCacheScavengerRun
UlpMediaTypeMatch
UlpMergeCookiePairs
UlpMethodToVerb
UlpNotifyEdgePolicyChange
UlpNotifyEdgePolicyChangeForUrl
UlpParseAuthenticationHeader
UlpParseFullUrl
UlpParseNextRequest
UlpParseTransferEncoding
UlpParseUnknownHeader
UlpPrepareSendFastTracker
UlpProbeChunks
UlpProbeLogDataAndChunksOld
UlpProcessDataSend
UlpQueryConfigGroupBinding
UlpQueryLogFileSecurity
UlpQueryRequestQueue503Verbosity
UlpQueryRequestQueueLengthLimit
UlpQueryRequestQueueState
UlpQueryTranslateHeader
UlpRebuildHeaderChunks
UlpRebuildRequestHeaders
UlpRebuildResponseBody
UlpReceiveData
UlpRemoveRequestFromLane
UlpReplaceSystemAccessToken
UlpRequestQueueStateToErrorCode
UlpRetrieveRequest
UlpSanitizeResponseHeaders
UlpSanitizeTrailerHeaders
UlpScavengerThread
UlpSendCacheEntry
UlpSendHttpResponseRegular
UlpSendResponseOrEntityBodyFastIo
UlpSendResponseToExtension
UlpSendSimpleStatusWorker
UlpSetFilterData
UlpSetResponseCacheClassification
UlpSetUrlInfo
UlpSynchronizeLanesWorker
UlpTerminateBasicAuth
UlpTerminateZombieList
UlpTransformResponseHeaders
UlpTreeDeleteRegistration
UlpTreeDeleteReservation
UlpTreeFindIpOnlyNode
UlpTreeFindNodeHelper
UlpTreeFindNodeWalker
UlpTreeFreeNode
UlpUpdateRequestBytesReceived
UlpUpdateSettingInRegistry
UlpValidateHttpHeaderName
UlpValidateHttpHeaderValue
UlpValidateTrailerHeader
UlpWriteHttp11StatusLine
UlpWriteServerHeader
UlpWriteSingleHeader
UlpWriteUnknownHeaders
UlpZombifyEntry
UlpZombifyHttpConnection
UxCaptureContentLengthHeaderValue
UxCaptureInputBufferForMethodNeither
UxCaptureUserMemory
UxCheckOutputBufferForOutDirect
UxCleanup
UxClose
UxCreate
UxDeviceControl
UxDuoAllocateStream
UxDuoAttachConnection
UxDuoCaptureDeclarePushParameters
UxDuoConnectionControl
UxDuoDispatchParcel
UxDuoDispatchWindowParcel
UxDuoExecuteDetach
UxDuoExecuteIngressDisconnect
UxDuoExecuteIoReady
UxDuoExecuteRetrieveClientCert
UxDuoExecuteRunnerCompletion
UxDuoForceStreamReset
UxDuoInitiateReceive
UxDuoParseCatalog
UxDuoParseData
UxDuoParsePushPromise
UxDuoSanitizeDeclarePushParameters
UxDuoSendGoAway
UxDuoSendGoawayInline
UxDuoSetTokenBinding
UxDuoStartIdleConnectionTimer
UxDuoStartMinBandwidthTimer
UxGetObjectFromOpaqueId
UxGetOutputBufferForInDirect
UxGetOutputBufferForOutDirect
UxPktMonTraceDropHttpReceive
UxPktMonTraceDropHttpSend
UxPktMonTraceHttpReceive
UxPktMonTraceHttpSend
UxPodStartModule
UxQuicBufferInitialize
UxQuicConnectionDequeueDecodeTracker
UxQuicConnectionRetrievePeerCertificate
UxQuicConnectionSendCancelPush
UxQuicConnectionSendGoaway
UxQuicConnectionSetQuicSettings
UxQuicCreateClientConfiguration
UxQuicCreateSendTracker
UxQuicCreateSession
UxQuicCreateStream
UxQuicGetDscpTag
UxQuicGetStatsV2MinimumSize
UxQuicGetStreamStatsMinimumSize
UxQuicGetStreamStatsParam
UxQuicListenerEndpointLookup
UxQuicLoadCertificateAsync
UxQuicLoadCertificateComplete
UxQuicOpenListener
UxQuicSetConnectionEndpoint
UxQuicSetDscpTag
UxQuicSetParam
UxQuicSetSessionKeys
UxQuicStartClientStream
UxQuicStartConnection
UxQuicStartModule
UxQuicStreamConnectionControl
UxQuicStreamIncrementBlockedDecodeCount
UxQuicStreamInitiateEgressDisconnect
UxQuicStreamInitiateHeadersSend
UxQuicStreamInitiateReceive
UxQuicStreamInitiateTrailersSend
UxQuicStreamSend
UxQuicValidateCertificate
UxQuicWaitForConnectionDisconnect
UxSslAcquireCredentialsHandle
UxSslAllocateSendBuffer
UxSslAttachConnection
UxSslCacheTlsClientHello
UxSslCaptureCertConfig
UxSslCaptureErrorHeaders
UxSslConnectionControl
UxSslCopyConfigurationProperties
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCopySniToRequestProperty
UxSslEndpointLoadCertificateSync
UxSslEndpointValidateCertificate
UxSslEndpointVerifyTls13Sync
UxSslGetCertInfo
UxSslGetCertificateParams
UxSslGetTlsCipherInfo
UxSslGetTlsClientHello
UxSslGetTlsExtensions
UxSslInitializeClientCertPolicy
UxSslInitiateEgressDisconnect
UxSslInitiateReceive
UxSslInitiateSend
UxSslLoadCertificateAsync
UxSslLoadCertificateComplete
UxSslParseSni
UxSslParseTlsRestrictions
UxSslReadExtendedConfigurationPropertiesFromUser
UxSslReceiveData
UxSslReceiveEvent
UxSslReplaceEndpointConfig
UxSslRetrieveChannelBindingToken
UxSslRetrieveClientCertificate
UxSslSendDisconnect
UxSslSendRawData
UxSslSetEndpointConfig
UxSslSetTokenBinding
UxSslStartReceiverFacet
UxSslStartSenderModule
UxSslValidateCertConfig
UxSslValidateCertificate
UxSslValidateErrorHeaders
UxSslValidateSni
UxSslValidateTlsRestrictions
UxSslVerifyRequestHost
UxStartEnvironmentModule
UxTlConnectionControl
UxTlGetDscpTag
UxTlInitiateSend
UxTlSetDscpTag
UxTryCopyUserMemory
UxWskInitiateSend
UxWskReceiveEvent
UxpDuoCaptureHostName
UxpPktMonRegisterHttp
UxpQuicBufferExpandBuffer
UxpQuicConnectionCheckServerCert
UxpQuicConnectionConnected
UxpQuicConnectionControlSend
UxpQuicConnectionGetNextDecodeTracker
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicConnectionOpen
UxpQuicConnectionPeerCertReceived
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicDecodeControlStreamCallbackHandler
UxpQuicEncodeControlStreamCallbackHandler
UxpQuicInitializeConfigurationContext
UxpQuicInitializeMsQuic
UxpQuicListenerStart
UxpQuicParseCancelPushFrame
UxpQuicParseDataFrame
UxpQuicParseGoawayFrame
UxpQuicParseHeadersFrame
UxpQuicParseMaxPushIdFrame
UxpQuicParsePushPromiseFrame
UxpQuicParseSettingsFrame
UxpQuicQueryConnectionAddresses
UxpQuicQueryConnectionInfo
UxpQuicReceivePeerDecodeControlStreamReceiveEvent
UxpQuicReceivePeerEncodeControlStreamReceiveEvent
UxpQuicSendControlStreamCallbackHandler
UxpQuicSetClientCertPolicy
UxpQuicStreamCalculateBuffersCount
UxpQuicStreamCalculateQuicBufferCount
UxpQuicStreamCallbackHandler
UxpQuicStreamEgressDisconnect
UxpQuicStreamFillQuicBuf
UxpQuicStreamFillQuicBufFromBuffers
UxpQuicStreamGetStats
UxpQuicStreamGoawaySync
UxpQuicStreamIndicateReceiveEvent
UxpQuicStreamIngressDisconnectEvent
UxpQuicStreamInitializePushState
UxpQuicStreamProcessReceive
UxpQuicStreamQueueEncodeHeaders
UxpQuicStreamQueueHeaders
UxpQuicStreamSendData
UxpSslAcceptSecurityContext
UxpSslCommonSendDataHelper
UxpSslCompareTableNodes
UxpSslConnectionDecryptData
UxpSslCopyCertConfigToUser
UxpSslCopyErrorHeadersToUser
UxpSslCopyExtendedPropertiesToUser
UxpSslCopyExtendedPropertiesToUser32
UxpSslCopyPerformanceParamsToUser
UxpSslCopySniForEtwFiltering
UxpSslCopyTlsRestrictionsToUser
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslCopyVariableConfigurationPropertiesToUser
UxpSslCreateRegistration
UxpSslDecryptTlsRecord
UxpSslDecryptTransportIndication
UxpSslDeleteCertConfigFromRegistry
UxpSslDeleteChildConfigCallback
UxpSslDeleteErrorHeadersFromRegistry
UxpSslDeleteTlsRestrictionsFromRegistry
UxpSslEndpointFoundHandler
UxpSslEndpointGetTlsExtensions
UxpSslEndpointIncrementAscCount
UxpSslEndpointLoadCertificateAsync
UxpSslEndpointLoadCertificateComplete
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointNotFoundHandler
UxpSslEndpointRejectHandler
UxpSslExpandTransportDataIndication
UxpSslGetClientHello
UxpSslIndicateReceiveEvent
UxpSslInitializeEndpointTable
UxpSslInitializeSchCredentials
UxpSslLoadCertificateSync
UxpSslLoadCertificateWorker
UxpSslLoadConfigurations
UxpSslLowMemoryCertificateScavengerCallback
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslProcessApplicationProtocolQuery
UxpSslProcessRenegotiateRecord
UxpSslQuerySni
UxpSslQuerySslConnectionInfo
UxpSslQuerySslConnectionPostHandshakeClientAuth
UxpSslQuerySslTokenBindingInfo
UxpSslReadData
UxpSslReadErrorHeadersFromRegistry
UxpSslReceiver
UxpSslReceiverAcceptSecurityContextForServerHello
UxpSslReceiverCreateServerHelloMessage
UxpSslReceiverSendServerHelloMessage
UxpSslScavengerCallback
UxpSslSetClientCertPolicy
UxpSslSetConnectionEndpoint
UxpSslSetSessionKeys
UxpSslUpdateCertificateState
UxpSslValidateAndCopySniForEtwFiltering
UxpSslValidateCcsConfigExtendedProperties
UxpSslValidateCcsConfigurationProperties
UxpSslVerifyTokenBinding
UxpSslWaitForAscHandler
UxpSslWriteCertConfigToRegistry
UxpSslWriteErrorHeadersToRegistry
UxpSslWriteTlsRestrictionsToRegistry
UxpTpAbortChunkTracker
UxpTpAllocateBufferTracker
UxpTpDirectTransmitFromMdl
UxpTpDirectTransmitKernelMemory
UxpTpFastTransmit
UxpTpFlushMdlRuns
UxpTpMdlSendCompleteWorker
UxpTpSetFlowOnConnection
switchD_14000caa1::caseD_0
switchD_140150f8e::caseD_b
|
Expand for full list:
FUN_1400191a5
FUN_14001bf77
FUN_14001d7f6
FUN_1400241fe
FUN_140024615
FUN_1400255f1
FUN_140033e10
FUN_140037b52
FUN_14004c04c
FUN_14006ed1f
FUN_140073a48FUN_14007b679
FUN_14007ba5c
FUN_14007cfed
FUN_14008f70a
FUN_140153285
FUN_1401534ae
FUN_140153545
FUN_1401536fe
FUN_140153989
FUN_14015448c
FUN_1401551d8
FUN_14015a228
FUN_14015b0f0
FUN_14015e100
FUN_14015e176
FUN_140161bde
FUN_140161f80
FUN_140162413
HttpCleanAndCopyUrl
HttpCopyUrl
HttpFindUrlToken
HttpNormalizeNamedHost
HttpUcs4toUtf16
HttpUtf8RawBytesToUnicode
HttpValidateHostname
HttpVerifyUnicodeToken
HttppCleanAndCopyUrlByType
HttppCopyHostByType
HttppParseIPv6Address
HttppParseUrlPath
HttppParseUrlPort
HttppParseUrlRoutingIp
HttppParseUrlScheme
HttppPostValidateHostname
HttppValidateIpv6Hostname
ParseChunkLength
ParseLastModified
UcAbortClientConnectionIoctl
UcAbortClientStreamIoctl
UcAllocateConnection
UcAllocateConnectionParameters
UcAllocateCredential
UcAllocateCredentialParameters
UcAllocateStream
UcCaptureConnectionParameters
UcCaptureCredentialParameters
UcCloseClientConnectionIoctl
UcCloseClientCredentialIoctl
UcCloseClientStreamIoctl
UcCloseConnection
UcConnectionGetQuicConnection
UcConnectionPendIrp
UcCreateClientConnectionIoctl
UcCreateClientCredentialIoctl
UcCreateClientStreamIoctl
UcCreateSessionContextHelper
UcGetQuicSession
UcLinkConnectionToSessionContext
UcLinkCredentialToSessionContext
UcLinkStreamToConnection
UcNotifyDisconnectClientStreamIoctl
UcQueryClientConnectionIoctl
UcQueryClientConnectionProperty
UcQueryClientStreamIoctl
UcQueryClientStreamProperty
UcReceiveEntityBodyClientStreamIoctl
UcReceiveHeadersClientStreamIoctl
UcSendEntityBodyClientStreamIoctl
UcSessionContextFromFileObject
UcSetClientConnectionIoctl
UcSetClientConnectionProperty
UcSetClientStreamProperty
UcSetClientStreamPropertyIoctl
UcSetIrpCancellationRoutine
UcStartClientConnectionIoctl
UcStreamAllocateSendTracker
UcStreamPendIrp
UcStreamReceiveHeadersEvent
UcStreamRestartReceive
UcUnlinkStreamFromConnection
UcUnusedIoctl
UcWaitForClientConnectionDisconnect
UcWaitForClientConnectionDisconnectIoctl
UcpAbortClientConnection
UcpAbortClientStream
UcpAllocateClientSession
UcpAllocateClientSessionContext
UcpConnectionResetIrpCancellationRoutine
UcpCopyEntityBodyToUserBuffer
UcpCopyHeaderPairsToUser
UcpCreateClientSession
UcpCreateSendEntityChunks
UcpFixUpPair
UcpGetSendEntityBodyStreamInfo
UcpGetSendHeadersPairs
UcpGetSendHeadersStreamInfo
UcpGetStreamIdInfo
UcpInitializeStreamBundle
UcpNotifyDisconnectClientStream
UcpReceiveHeadersClientStream
UcpRemoveConnectionFromSessionContext
UcpRemoveCredentialFromSessionContext
UcpSendEntityBodyClientStream
UcpStreamAllocateReceiveBuffer
UcpStreamCreateHeaderBuffer
UcpStreamIndicateHeaders
UcpStreamIndicateReceive
UcpStreamProcessFastForwardReceiveDataInternal
UcpStreamResetIrpCancellationRoutine
UlAcceptEncodingHeaderHandler
UlAcceptHeaderHandler
UlAccessCheck
UlAddCacheEntry
UlAddFragmentToCache
UlAddFragmentToCacheIoctl
UlAddToHashTable
UlAddUrlToConfigGroup
UlAddUrlToUrlGroupIoctl
UlAiPktMonGetAddressInformation
UlAiStartModule
UlAiStartTrackingAddressInformation
UlAllocateConnectionRequestId
UlAppendHeaderValue
UlAuthCopyUnconfiguredAuthHeaderToBuffer
UlCGRemoveHashTableEntry
UlCancelConsumerCallback
UlCancelHttpRequest
UlCancelHttpRequestIoctl
UlCaptureChannelBindConfigOld
UlCaptureDelegateRequestParameters
UlCaptureHttpResponse
UlCaptureHttpResponseOld
UlCaptureWideString
UlChannelBindConfigParsing
UlChargeRequestQueueQuota
UlCheckCacheControlHeaders
UlCheckCachePreconditions
UlCheckDisconnectInfo
UlCheckFastForwarding
UlCheckProtocolCompliance
UlCheckRawResponseCompatibility
UlCheckReceiveEntityBodyState
UlCheckSendResponseFlags
UlChooseConnectionHeader
UlCleanupConsumerInternal
UlCloseServerSessionIoctl
UlComputeFixedHeaderSizeNew
UlComputeFixedHeaderSizeOld
UlComputeMultipleKnownHeaderSize
UlComputeMultipleKnownHeaderSizeOld
UlConnectionCleanupWorker
UlContentRangeHeaderHandler
UlControlService
UlControlServiceIoctl
UlCookUrl
UlCopyAuthConfigToIrp
UlCopyAuthHeader
UlCopyChannelBindConfigFromPropertyInfo
UlCopyChannelBindConfigToIrp
UlCopyParsedHeaders
UlCopyRequestToBuffer
UlCopyRequestToIrp
UlCopyServiceBindings
UlCopyUserAuthInfoToAuthConfig32
UlCopyUserAuthInfoToAuthConfigNew
UlCreateAutoConfigGroup
UlCreateAutoServerSession
UlCreateCacheEntryFromResponse
UlCreateCommChannelHelper
UlCreateConsumerHelper
UlCreateServerSessionIoctl
UlCreateUrlGroupIoctl
UlDeclarePushIoctl
UlDeepCopyParsedHeaders
UlDelegateRequest
UlDelegateRequestExIoctl
UlDelegateRequestIoctl
UlDeleteConfigGroup
UlDeleteConfigGroupById
UlDeleteServerSession
UlDeleteServiceConfigIoctl
UlDeleteUrlGroupIoctl
UlDisablePeriodicScavenger
UlDispatchRequestToRequestQueue
UlEnablePeriodicScavenger
UlEnumerateRequestQueues
UlEnumerateServerSessions
UlEnumerateUrlGroups
UlEtwEvaluateFilter
UlEtwEvaluateFilterForHost
UlEtwEvaluateFilterForRequestConnection
UlEtwEvaluateQuicConnectionInfoFilter
UlEvaluateRequest
UlEvaluateRequestIoctl
UlEventFlushResponseCache
UlEventLogAddUrl
UlEventLogCreateUrlGroup
UlEventLogDeleteUrlGroup
UlEventLogRemoveAllUrls
UlEventLogRemoveUrl
UlEventLogUrlReservation
UlEventLogWriteFailure
UlEventSetConfigGroupProperty
UlEventSetIpListenList
UlEventSslSettingsCreated
UlEventSslSettingsDeleted
UlEventSslSettingsUpdated
UlExtractAndAppendAuthenticationResponseInfo
UlFastForwardDetachEvent
UlFastForwardIngressDisconnectEvent
UlFastForwardReceiveEvent
UlFastReceiveHttpRequest
UlFastSendHttpResponse
UlFastSendHttpResponseOld
UlFeatureSupportedIoctl
UlFindUrlGroupId
UlFindUrlGroupIdIoctl
UlFlCaptureFlowRateInfo
UlFlCaptureFlowRateInfoOld
UlFlFlowRateInfoProcessing
UlFlushCacheByUri
UlFlushResponseCacheIoctl
UlFreeHttpConnection
UlFreeHttpRequestHeaders
UlGenerateFixedHeaders
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateRoutingToken
UlGenerateSingleVariableHeaders
UlGenerateTrailers
UlGenerateTransferChunkingChunks
UlGenerateVariableHeaders
UlGetAutoConfigGroup
UlGetCGroupForRequest
UlGetChannelBindTokenSize
UlGetConsumerAndApiVersion
UlGetCountersIoctl
UlGetIrpSid
UlGetQuicCreationStatsV2Size
UlGetRequest
UlGetRequestFromId
UlGetServiceBindingInfo
UlGetServiceBindingInfo32
UlGetTransportIdleConnectionTimeout
UlGetUserTokenBindingInfoSize
UlHostHeaderHandler
UlHttpAttachConnection
UlHttpReceiveHeadersEvent
UlInitializeCacheEntry
UlInitializeLogBufferGranularity
UlInitializeResumeParsingFlag
UlIsConsumerShutdown
UlLinkHkeContext
UlLogZombieConnection
UlLookupAndVerifyCacheEntry
UlLookupHostPlusIPSite
UlMgmtFlushCache
UlMultipleHeaderHandler
UlNotifyIPListenListChanges
UlParseAcceptHeaderMatch
UlParseAcceptRangesHeader
UlParseHeader
UlParseHttp
UlParseHttpSendHttpResponseIoctls
UlParsePushHeaderPairs
UlParsePushHeaderPairsOld
UlParseRequestHeaderPairs
UlParseRequestHeaderPairsOld
UlPeriodicCacheScavenger
UlPeriodicThreadPoolWakeup
UlPktMonRegister
UlPktMonRegisterInterface
UlPktMonTraceDropWskReceive
UlPktMonTraceWskInternal
UlPktMonTraceWskReceive
UlPktMonTraceWskSend
UlPktMonUnRegisterInterface
UlPrepareUrlIoctl
UlProbeAndCopyIpPortAddressToStringW
UlProcessResponseInfo
UlPurgeConsumer
UlQosConfigureFlowCharacteristics
UlQueryChannelBindToken
UlQueryConsumerProcessInfo
UlQueryExpectHeader
UlQueryRequestIoctl
UlQueryRequestProperty
UlQueryRequestQueueIoctl
UlQueryRequestQueueSecurityDescriptor
UlQueryServerSessionIoctl
UlQueryServiceConfigIoctl
UlQueryUrlGroupIoctl
UlReadFragmentFromCacheIoctl
UlReceiveClientCertIoctl
UlReceiveEntityBody
UlReceiveEntityBodyIoctl
UlReceiveHttpRequest
UlReceiveHttpRequestIoctl
UlRegisterConsumerCallback
UlRemoveAllUrlsFromConfigGroup
UlRemoveConnectionOptionHeaders
UlRemoveSendIrpCancelRoutine
UlRemoveUrlFromConfigGroup
UlRemoveUrlFromUrlGroupIoctl
UlReplaceHeaderValue
UlResponseInfoParsing
UlSanitizeHeaders
UlScStartCounters
UlScStartFacet
UlSendCacheEntryWorker
UlSendCachedResponse
UlSendData
UlSendEntityBodyIoctlOld
UlSendHttpResponse
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetBooleanRegistryValue
UlSetBufferTimer
UlSetConfigGroupProperty
UlSetConfigSetting
UlSetConnectionsProperty
UlSetEntityBodyType
UlSetHttpConnectionTokenBinding
UlSetParsedHeader
UlSetReceiveEntityBodyIrpCancelRoutine
UlSetRequestIoctl
UlSetRequestProperty
UlSetRequestQueueIoctl
UlSetRequestQueueProperty
UlSetRequestQueueSecurityDescriptor
UlSetResponseDisconnectFlags
UlSetServerSessionIoctl
UlSetServerSessionProperty
UlSetServiceConfigIoctl
UlSetTransportIdleConnectionTimeout
UlSetUrlDelegateInfo
UlSetUrlGroupIoctl
UlShutdownRequestQueueIoctl
UlSingleHeaderHandler
UlStartConfigGroupFacet
UlStartDataModule
UlStartHttpConnFacet
UlStartHttpIdealBacklogFastForwarderNotification
UlStartHttpReceiveModule
UlStartRequestQueueFacet
UlStartRequestQueueModule
UlStartUriCacheFacet
UlThreadPoolHotAddAbort
UlThreadPoolHotAddNotify
UlTimeoutQueuedRequest
UlTraceFilterCompare
UlTransformH1Response
UlTransformResponse
UlUpdateServiceConfigIoctl
UlUserAgentHeaderHandler
UlValidateConfigGroup
UlValidateConfigGroupBoundToRequestQueue
UlValidateHttpConnectionFromId
UlValidateHttpRequestFromId
UlValidateServerSession
UlVerifyOpaqueUpgradeHeader
UlWaitForDemandStart
UlWaitForDemandStartIoctl
UlWaitForDisconnectIoctl
UlpAddCompatibilityHeaders
UlpAdjustBuffers
UlpAiInsertAddress
UlpAiPopulateAddressList
UlpAttachConsumerToRequestQueue
UlpAuthenticateRequest
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCheckIfBypassRangeProcessing
UlpCheckSpaceAndAddEntryStats
UlpCleanAllUrls
UlpCommonHeaderHandler
UlpCompleteLogRecordW3C
UlpCompleteSendCacheEntryWorker
UlpComputeAuthHeaderSize
UlpComputeAuthHeaderSizeOld
UlpCopyChannelBindTokenToIrp
UlpCopyDscpInfo
UlpCopyFilterData
UlpCopyInitialPacketTtl
UlpCopyQuicStats
UlpCopyQuicStatsV2
UlpCopyRequestInformation
UlpCopyRequestToBuffer
UlpCopySingleMultipleHeader
UlpCopySslProtocolInfo
UlpCopyString
UlpCopyTcpInfoV2
UlpCopyUserDataToFastTracker
UlpCreateFastForwardDataContext
UlpCreateHttpRequest
UlpDeleteReservationEntry
UlpDeliverHttpRequest
UlpDeliverRequestStageInitial
UlpDeliverRequestStageInspection
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateUrlGroupsInServerSession
UlpEtwEvaluateFilterInternal
UlpEventRequestConnectionStats
UlpFastForwardCleanupOnFailure
UlpFindWSToken
UlpFlushFilterForAddUrl
UlpFlushFilterForRemoveUrl
UlpFlushFilterPeriodicScavenger
UlpFlushFilterTrimCache
UlpFlushFilterUriRecursive
UlpFlushLogFileBufferWorker
UlpFlushPendingConsumerIo
UlpFreeHttpRequest
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpGetAuthInfoNew
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpGetFastForwardingContext
UlpGetFastForwardingContextOld
UlpGetGMTOffset
UlpGetIrpProcessIdAndImageName
UlpGetLogInfo
UlpGetLogInfoOld
UlpGetMultipleKnownHeader
UlpGetResponseInfo
UlpGetSendInfo
UlpGetSendInfoOld
UlpGetUserSidForToken
UlpHkeAcquireQoS
UlpHotAddIncrementalCallback
UlpIndicateCompleteToExtension
UlpInitErrorLogInfo
UlpInitializeInternalResponseHeaders
UlpInitializeInternalResponseHeadersOld
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpInvokeHeaderHandlers
UlpIsLocalRequest
UlpIsRequestFromProxy
UlpLogErrorResposeSendEvent
UlpLogRequestQueueOverflowEvents
UlpLowMemoryCacheScavengerBegin
UlpLowMemoryCacheScavengerEnd
UlpLowMemoryCacheScavengerRun
UlpMediaTypeMatch
UlpMergeCookiePairs
UlpMethodToVerb
UlpNotifyEdgePolicyChange
UlpNotifyEdgePolicyChangeForUrl
UlpParseAuthenticationHeader
UlpParseFullUrl
UlpParseNextRequest
UlpParseTransferEncoding
UlpParseUnknownHeader
UlpPrepareSendFastTracker
UlpProbeChunks
UlpProbeLogDataAndChunksOld
UlpProcessDataSend
UlpQueryConfigGroupBinding
UlpQueryLogFileSecurity
UlpQueryRequestQueue503Verbosity
UlpQueryRequestQueueLengthLimit
UlpQueryRequestQueueState
UlpQueryTranslateHeader
UlpRebuildHeaderChunks
UlpRebuildRequestHeaders
UlpRebuildResponseBody
UlpReceiveData
UlpRemoveRequestFromLane
UlpReplaceSystemAccessToken
UlpRequestQueueStateToErrorCode
UlpRetrieveRequest
UlpSanitizeResponseHeaders
UlpSanitizeTrailerHeaders
UlpScavengerThread
UlpSendCacheEntry
UlpSendHttpResponseRegular
UlpSendResponseOrEntityBodyFastIo
UlpSendResponseToExtension
UlpSendSimpleStatusWorker
UlpSetFilterData
UlpSetResponseCacheClassification
UlpSetUrlInfo
UlpSynchronizeLanesWorker
UlpTerminateBasicAuth
UlpTerminateZombieList
UlpTransformResponseHeaders
UlpTreeDeleteRegistration
UlpTreeDeleteReservation
UlpTreeFindIpOnlyNode
UlpTreeFindNodeHelper
UlpTreeFindNodeWalker
UlpTreeFreeNode
UlpUpdateRequestBytesReceived
UlpUpdateSettingInRegistry
UlpValidateHttpHeaderName
UlpValidateHttpHeaderValue
UlpValidateTrailerHeader
UlpWriteHttp11StatusLine
UlpWriteServerHeader
UlpWriteSingleHeader
UlpWriteUnknownHeaders
UlpZombifyEntry
UlpZombifyHttpConnection
UxCaptureContentLengthHeaderValue
UxCaptureInputBufferForMethodNeither
UxCaptureUserMemory
UxCheckOutputBufferForOutDirect
UxCleanup
UxClose
UxCreate
UxDeviceControl
UxDuoAllocateStream
UxDuoAttachConnection
UxDuoCaptureDeclarePushParameters
UxDuoConnectionControl
UxDuoDispatchParcel
UxDuoDispatchWindowParcel
UxDuoExecuteDetach
UxDuoExecuteIngressDisconnect
UxDuoExecuteIoReady
UxDuoExecuteRetrieveClientCert
UxDuoExecuteRunnerCompletion
UxDuoForceStreamReset
UxDuoInitiateReceive
UxDuoParseCatalog
UxDuoParseData
UxDuoParsePushPromise
UxDuoSanitizeDeclarePushParameters
UxDuoSendGoAway
UxDuoSendGoawayInline
UxDuoSetTokenBinding
UxDuoStartIdleConnectionTimer
UxDuoStartMinBandwidthTimer
UxGetObjectFromOpaqueId
UxGetOutputBufferForInDirect
UxGetOutputBufferForOutDirect
UxPktMonTraceDropHttpReceive
UxPktMonTraceDropHttpSend
UxPktMonTraceHttpReceive
UxPktMonTraceHttpSend
UxPodStartModule
UxQuicBufferInitialize
UxQuicConnectionDequeueDecodeTracker
UxQuicConnectionRetrievePeerCertificate
UxQuicConnectionSendCancelPush
UxQuicConnectionSendGoaway
UxQuicConnectionSetQuicSettings
UxQuicCreateClientConfiguration
UxQuicCreateSendTracker
UxQuicCreateSession
UxQuicCreateStream
UxQuicGetDscpTag
UxQuicGetStatsV2MinimumSize
UxQuicGetStreamStatsMinimumSize
UxQuicGetStreamStatsParam
UxQuicListenerEndpointLookup
UxQuicLoadCertificateAsync
UxQuicLoadCertificateComplete
UxQuicOpenListener
UxQuicSetConnectionEndpoint
UxQuicSetDscpTag
UxQuicSetParam
UxQuicSetSessionKeys
UxQuicStartClientStream
UxQuicStartConnection
UxQuicStartModule
UxQuicStreamConnectionControl
UxQuicStreamIncrementBlockedDecodeCount
UxQuicStreamInitiateEgressDisconnect
UxQuicStreamInitiateHeadersSend
UxQuicStreamInitiateReceive
UxQuicStreamInitiateTrailersSend
UxQuicStreamSend
UxQuicValidateCertificate
UxQuicWaitForConnectionDisconnect
UxSslAcquireCredentialsHandle
UxSslAllocateSendBuffer
UxSslAttachConnection
UxSslCacheTlsClientHello
UxSslCaptureCertConfig
UxSslCaptureErrorHeaders
UxSslConnectionControl
UxSslCopyConfigurationProperties
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCopySniToRequestProperty
UxSslEndpointLoadCertificateSync
UxSslEndpointValidateCertificate
UxSslEndpointVerifyTls13Sync
UxSslGetCertInfo
UxSslGetCertificateParams
UxSslGetTlsCipherInfo
UxSslGetTlsClientHello
UxSslGetTlsExtensions
UxSslInitializeClientCertPolicy
UxSslInitiateEgressDisconnect
UxSslInitiateReceive
UxSslInitiateSend
UxSslLoadCertificateAsync
UxSslLoadCertificateComplete
UxSslParseSni
UxSslParseTlsRestrictions
UxSslReadExtendedConfigurationPropertiesFromUser
UxSslReceiveData
UxSslReceiveEvent
UxSslReplaceEndpointConfig
UxSslRetrieveChannelBindingToken
UxSslRetrieveClientCertificate
UxSslSendDisconnect
UxSslSendRawData
UxSslSetEndpointConfig
UxSslSetTokenBinding
UxSslStartReceiverFacet
UxSslStartSenderModule
UxSslValidateCertConfig
UxSslValidateCertificate
UxSslValidateErrorHeaders
UxSslValidateSni
UxSslValidateTlsRestrictions
UxSslVerifyRequestHost
UxStartEnvironmentModule
UxTlConnectionControl
UxTlGetDscpTag
UxTlInitiateSend
UxTlSetDscpTag
UxTryCopyUserMemory
UxWskInitiateSend
UxWskReceiveEvent
UxpDuoCaptureHostName
UxpPktMonRegisterHttp
UxpQuicBufferExpandBuffer
UxpQuicConnectionCheckServerCert
UxpQuicConnectionConnected
UxpQuicConnectionControlSend
UxpQuicConnectionGetNextDecodeTracker
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicConnectionOpen
UxpQuicConnectionPeerCertReceived
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicDecodeControlStreamCallbackHandler
UxpQuicEncodeControlStreamCallbackHandler
UxpQuicInitializeConfigurationContext
UxpQuicInitializeMsQuic
UxpQuicListenerStart
UxpQuicParseCancelPushFrame
UxpQuicParseDataFrame
UxpQuicParseGoawayFrame
UxpQuicParseHeadersFrame
UxpQuicParseMaxPushIdFrame
UxpQuicParsePushPromiseFrame
UxpQuicParseSettingsFrame
UxpQuicQueryConnectionAddresses
UxpQuicQueryConnectionInfo
UxpQuicReceivePeerDecodeControlStreamReceiveEvent
UxpQuicReceivePeerEncodeControlStreamReceiveEvent
UxpQuicSendControlStreamCallbackHandler
UxpQuicSetClientCertPolicy
UxpQuicStreamCalculateBuffersCount
UxpQuicStreamCalculateQuicBufferCount
UxpQuicStreamCallbackHandler
UxpQuicStreamEgressDisconnect
UxpQuicStreamFillQuicBuf
UxpQuicStreamFillQuicBufFromBuffers
UxpQuicStreamGetStats
UxpQuicStreamGoawaySync
UxpQuicStreamIndicateReceiveEvent
UxpQuicStreamIngressDisconnectEvent
UxpQuicStreamInitializePushState
UxpQuicStreamProcessReceive
UxpQuicStreamQueueEncodeHeaders
UxpQuicStreamQueueHeaders
UxpQuicStreamSendData
UxpSslAcceptSecurityContext
UxpSslCommonSendDataHelper
UxpSslCompareTableNodes
UxpSslConnectionDecryptData
UxpSslCopyCertConfigToUser
UxpSslCopyErrorHeadersToUser
UxpSslCopyExtendedPropertiesToUser
UxpSslCopyExtendedPropertiesToUser32
UxpSslCopyPerformanceParamsToUser
UxpSslCopySniForEtwFiltering
UxpSslCopyTlsRestrictionsToUser
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslCopyVariableConfigurationPropertiesToUser
UxpSslCreateRegistration
UxpSslDecryptTlsRecord
UxpSslDecryptTransportIndication
UxpSslDeleteCertConfigFromRegistry
UxpSslDeleteChildConfigCallback
UxpSslDeleteErrorHeadersFromRegistry
UxpSslDeleteTlsRestrictionsFromRegistry
UxpSslEndpointFoundHandler
UxpSslEndpointGetTlsExtensions
UxpSslEndpointIncrementAscCount
UxpSslEndpointLoadCertificateAsync
UxpSslEndpointLoadCertificateComplete
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointNotFoundHandler
UxpSslEndpointRejectHandler
UxpSslExpandTransportDataIndication
UxpSslGetClientHello
UxpSslIndicateReceiveEvent
UxpSslInitializeEndpointTable
UxpSslInitializeSchCredentials
UxpSslInitiateAscHandler
UxpSslLoadCertificateSync
UxpSslLoadCertificateWorker
UxpSslLoadConfigurations
UxpSslLowMemoryCertificateScavengerCallback
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslProcessApplicationProtocolQuery
UxpSslProcessRenegotiateRecord
UxpSslQuerySni
UxpSslQuerySslConnectionInfo
UxpSslQuerySslConnectionPostHandshakeClientAuth
UxpSslQuerySslTokenBindingInfo
UxpSslReadData
UxpSslReadErrorHeadersFromRegistry
UxpSslReceiver
UxpSslReceiverAcceptSecurityContextForServerHello
UxpSslReceiverCreateServerHelloMessage
UxpSslReceiverSendServerHelloMessage
UxpSslScavengerCallback
UxpSslSetClientCertPolicy
UxpSslSetConnectionEndpoint
UxpSslSetSessionKeys
UxpSslUpdateCertificateState
UxpSslValidateAndCopySniForEtwFiltering
UxpSslValidateCcsConfigExtendedProperties
UxpSslValidateCcsConfigurationProperties
UxpSslVerifyTokenBinding
UxpSslWaitForAscHandler
UxpSslWriteCertConfigToRegistry
UxpSslWriteErrorHeadersToRegistry
UxpSslWriteTlsRestrictionsToRegistry
UxpTpAbortChunkTracker
UxpTpAllocateBufferTracker
UxpTpDirectTransmitFromMdl
UxpTpDirectTransmitKernelMemory
UxpTpFastTransmit
UxpTpFlushMdlRuns
UxpTpMdlSendCompleteWorker
UxpTpSetFlowOnConnection
switchD_14000cb81::caseD_0
switchD_1401516fa::caseD_b
| |paramcount|3|3| |`address`|1401b910c|1401b90ec| |sig|undefined __fastcall WPP_SF_L(undefined2 param_1, undefined8 param_2, undefined4 param_3)|undefined __fastcall WPP_SF_L(undefined2 param_1, undefined8 param_2, undefined4 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_L Calling Diff ```diff --- WPP_SF_L calling +++ WPP_SF_L calling @@ -1,30 +1,29 @@ -FUN_1400190c5 -FUN_14001be97 -FUN_14001d716 -FUN_14002411e -FUN_140024535 -FUN_140025511 -FUN_1400344c0 -FUN_14003a0ff -FUN_14003c54e -FUN_140050a2c -FUN_140072678 -FUN_14007aaa9 -FUN_14007ae8c -FUN_14007c94d -FUN_1400903ea -FUN_140152b19 -FUN_140152d42 -FUN_140152dd9 -FUN_140152f92 -FUN_14015321d -FUN_140153d20 -FUN_140154a6c -FUN_14015761a -FUN_14015a3a2 -FUN_14015b26a -FUN_14015cda4 -FUN_14015e0be -FUN_1401618f2 -FUN_140161c94 -FUN_140162127 +FUN_1400191a5 +FUN_14001bf77 +FUN_14001d7f6 +FUN_1400241fe +FUN_140024615 +FUN_1400255f1 +FUN_140033e10 +FUN_140037b52 +FUN_14004c04c +FUN_14006ed1f +FUN_140073a48 +FUN_14007b679 +FUN_14007ba5c +FUN_14007cfed +FUN_14008f70a +FUN_140153285 +FUN_1401534ae +FUN_140153545 +FUN_1401536fe +FUN_140153989 +FUN_14015448c +FUN_1401551d8 +FUN_14015a228 +FUN_14015b0f0 +FUN_14015e100 +FUN_14015e176 +FUN_140161bde +FUN_140161f80 +FUN_140162413 @@ -386,0 +386 @@ +UlpCheckIfBypassRangeProcessing @@ -427 +426,0 @@ -UlpFlushPendingRequests @@ -723,0 +723 @@ +UxpSslInitiateAscHandler @@ -763,2 +763,2 @@ -switchD_14000caa1::caseD_0 -switchD_140150f8e::caseD_b +switchD_14000cb81::caseD_0 +switchD_1401516fa::caseD_b ``` ## KSECDD.SYS::SspiCreateAsyncContext ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|SspiCreateAsyncContext|SspiCreateAsyncContext| |fullname|KSECDD.SYS::SspiCreateAsyncContext|KSECDD.SYS::SspiCreateAsyncContext| |`refcount`|5|4| |length|0|0| |called||| |calling|UxSslAllocateAchContext
UxSslAllocateAscContext
UxpSslInitiateAscHandler|UxSslAllocateAchContext
UxSslAllocateAscContext
UxpSslInitiateAscHandler| |paramcount|0|0| |address|EXTERNAL:0000017d|EXTERNAL:0000017d| |sig|undefined SspiCreateAsyncContext(void)|undefined SspiCreateAsyncContext(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## NTOSKRNL.EXE::KeGetCurrentNodeNumber ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|KeGetCurrentNodeNumber|KeGetCurrentNodeNumber| |fullname|NTOSKRNL.EXE::KeGetCurrentNodeNumber|NTOSKRNL.EXE::KeGetCurrentNodeNumber| |`refcount`|151|153| |length|0|0| |called||| |`calling`|
Expand for full list:
FUN_14003c54e
PnlFreeToLookasideList
UlAllocateCacheTracker
UlAllocateFastTracker
UlAllocateGrip
UlAllocateLogDataBuffer
UlAllocateLogFileBuffer
UlAllocateRequestBuffer
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlDestroyCapturedResponseUlFastCreateRangeCacheTracker
UlFastReceiveHttpRequest
UlFreeCacheTracker
UlFreeHttpConnection
UlHkeCreateCalloutContext
UlHttpAttachConnection
UlResumeParsing
UlSendCachedResponse
UlSetSendCompleteState
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlWaitForDemandStart
UlpAllocateInternalResponse
UlpCheckSpaceAndAddEntryStats
UlpCleanupCoupling
UlpCompleteSendCacheEntryWorker
UlpCreateFastForwardDataContext
UlpCreateHttpRequest
UlpDeliverHttpRequest
UlpDeliverRequestStageInitial
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFilteredFlushUriCache
UlpFreeCoupling
UlpFreeHttpRequest
UlpInvokeHeaderHandlers
UlpLockRequestQueueAndCoupling
UlpOpenCoupling
UlpParseNextRequest
UlpRemoveEntryStats
UlpRetrieveRequest
UlpSendCacheEntry
UlpUpdatePerfCountersOnCacheSend
UlpUpdateRequestBytesReceived
UxCaptureString
UxCaptureWideString
UxDuoAllocateDataIndication
UxDuoAllocateStream
UxDuoAllocateTask
UxDuoAttachConnection
UxDuoEnqueueDisconnectTask
UxDuoExecuteReceiver
UxDuoExecuteStreamCleanup
UxDuoExecuteStreamDisconnect
UxDuoHpackAllocateBlock
UxDuoHpackAllocatePairs
UxDuoInitiateEgressDisconnect
UxDuoInitiateHeadersSend
UxDuoIoReadyEvent
UxDuoRunStreamReceivePump
UxQuicCreateDecodeTracker
UxQuicCreateSendTracker
UxSslAllocateSendBuffer
UxSslAllocateTransportDataIndication
UxSslAttachConnection
UxSslFreeAscContext
UxSslFreeSendBufferList
UxSslReleaseReceiveBuffers
UxSslRestartSendRawData
UxTlDestroyConnection
UxTlDestroyConnectionWorker
UxTlInitiateSend
UxWskAcceptEvent
UxWskInitiateSend
UxpAllocateHeaderBufferBlock
UxpQuicAllocateDataIndication
UxpQuicAllocateTransportIndication
UxpQuicCreateStream
UxpQuicStreamIndicateReceiveEvent
UxpSslAllocateDataIndication
UxpSslAllocateSendRequestTracker
UxpSslCommonSendDataHelper
UxpSslConnectionDecryptData
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslFreeDataIndication
UxpSslIndicateReceiveEvent
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpTpAllocateBufferTracker
UxpTpAllocateChunkTracker
UxpTpAllocateTransmitPacket
UxpWskCleanupIoContext
UxpWskCreateIoContext
UxpWskSendCompletion
|
Expand for full list:
FUN_140037b52
PnlFreeToLookasideList
UlAllocateCacheTracker
UlAllocateFastTracker
UlAllocateGrip
UlAllocateLogDataBuffer
UlAllocateLogFileBuffer
UlAllocateRequestBuffer
UlCleanupConnectionCouplings
UlCleanupHttpConnection
UlDestroyCapturedResponseUlFastCreateRangeCacheTracker
UlFastReceiveHttpRequest
UlFreeCacheTracker
UlFreeHttpConnection
UlHkeCreateCalloutContext
UlHttpAttachConnection
UlResumeParsing
UlSendCachedResponse
UlSetSendCompleteState
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlWaitForDemandStart
UlpAllocateInternalResponse
UlpCheckSpaceAndAddEntryStats
UlpCleanupCoupling
UlpCompleteSendCacheEntryWorker
UlpCreateFastForwardDataContext
UlpCreateHttpRequest
UlpDeliverHttpRequest
UlpDeliverRequestStageInitial
UlpDeliverRequestStagePolicies
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpFilteredFlushUriCache
UlpFreeCoupling
UlpFreeHttpRequest
UlpInvokeHeaderHandlers
UlpLockRequestQueueAndCoupling
UlpOpenCoupling
UlpParseNextRequest
UlpRemoveEntryStats
UlpRetrieveRequest
UlpSendCacheEntry
UlpUpdatePerfCountersOnCacheSend
UlpUpdateRequestBytesReceived
UxCaptureString
UxCaptureWideString
UxDuoAllocateDataIndication
UxDuoAllocateStream
UxDuoAllocateTask
UxDuoAttachConnection
UxDuoEnqueueDisconnectTask
UxDuoExecuteReceiver
UxDuoExecuteStreamCleanup
UxDuoExecuteStreamDisconnect
UxDuoHpackAllocateBlock
UxDuoHpackAllocatePairs
UxDuoInitiateEgressDisconnect
UxDuoInitiateHeadersSend
UxDuoIoReadyEvent
UxDuoRunStreamReceivePump
UxQuicCreateDecodeTracker
UxQuicCreateSendTracker
UxSslAllocateSendBuffer
UxSslAllocateTransportDataIndication
UxSslAttachConnection
UxSslFreeAscContext
UxSslFreeSendBufferList
UxSslReleaseReceiveBuffers
UxSslRestartSendRawData
UxTlDestroyConnection
UxTlDestroyConnectionWorker
UxTlInitiateSend
UxWskAcceptEvent
UxWskInitiateSend
UxpAllocateHeaderBufferBlock
UxpQuicAllocateDataIndication
UxpQuicAllocateTransportIndication
UxpQuicCreateStream
UxpQuicStreamIndicateReceiveEvent
UxpSslAllocateDataIndication
UxpSslAllocateSendRequestTracker
UxpSslCommonSendDataHelper
UxpSslConnectionDecryptData
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslFreeDataIndication
UxpSslIncrementHandshakeFailuresCounter
UxpSslIndicateReceiveEvent
UxpSslInitiateAscHandler
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpTpAllocateBufferTracker
UxpTpAllocateChunkTracker
UxpTpAllocateTransmitPacket
UxpWskCleanupIoContext
UxpWskCreateIoContext
UxpWskSendCompletion
| |paramcount|0|0| |address|EXTERNAL:00000140|EXTERNAL:00000140| |sig|undefined KeGetCurrentNodeNumber(void)|undefined KeGetCurrentNodeNumber(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeGetCurrentNodeNumber Calling Diff ```diff --- NTOSKRNL.EXE::KeGetCurrentNodeNumber calling +++ NTOSKRNL.EXE::KeGetCurrentNodeNumber calling @@ -1 +1 @@ -FUN_14003c54e +FUN_140037b52 @@ -87,0 +88 @@ +UxpSslIncrementHandshakeFailuresCounter @@ -88,0 +90 @@ +UxpSslInitiateAscHandler ``` ## KSECDD.SYS::SspiSetAsyncNotifyCallback ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|SspiSetAsyncNotifyCallback|SspiSetAsyncNotifyCallback| |fullname|KSECDD.SYS::SspiSetAsyncNotifyCallback|KSECDD.SYS::SspiSetAsyncNotifyCallback| |`refcount`|4|3| |length|0|0| |called||| |`calling`|UxSslAllocateAchContext
UxSslAllocateAscContext
UxpSslInitiateAscHandler|UxSslAllocateAchContext
UxSslAllocateAscContext| |paramcount|0|0| |address|EXTERNAL:0000017c|EXTERNAL:0000017c| |sig|undefined SspiSetAsyncNotifyCallback(void)|undefined SspiSetAsyncNotifyCallback(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KSECDD.SYS::SspiSetAsyncNotifyCallback Calling Diff ```diff --- KSECDD.SYS::SspiSetAsyncNotifyCallback calling +++ KSECDD.SYS::SspiSetAsyncNotifyCallback calling @@ -3 +2,0 @@ -UxpSslInitiateAscHandler ``` ## NTOSKRNL.EXE::ExAllocatePool3 ### Match Info |Key|http-10.0.26100.7309.sys - http-10.0.26100.7824.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-10.0.26100.7309.sys|http-10.0.26100.7824.sys| | :---: | :---: | :---: | |name|ExAllocatePool3|ExAllocatePool3| |fullname|NTOSKRNL.EXE::ExAllocatePool3|NTOSKRNL.EXE::ExAllocatePool3| |`refcount`|314|313| |length|0|0| |called||| |`calling`|
Expand for full list:
FUN_1401573e0
FUN_1401582ca
FUN_140160a70
FUN_140161abc
HttpNormalizeNamedHost
HttppNormalizePath
HttppRebuildFixedUrl
PplpCreateLookasideListEx
UcAllocateConnection
UcAllocateConnectionParameters
UcAllocateCredentialUcAllocateCredentialParameters
UcAllocateStream
UcCaptureConnectionParameters
UcStreamAllocateSendTracker
UcpAllocateClientSession
UcpAllocateClientSessionContext
UcpGetSendHeadersPairs
UcpStreamAllocateReceiveBuffer
UcpStreamCreateHeaderBuffer
UlAddServiceNameToContainer
UlAllocateBuildTracker
UlAllocateCacheEntry
UlAllocateCacheTracker
UlAllocateChannelBindToken
UlAllocateFastTracker
UlAllocateLogDataBuffer
UlAllocatePerNode
UlAllocateRequestBuffer
UlAllocateServiceNameContainer
UlAllocateToLookaside
UlAllocateWideString
UlAppendHeaderValue
UlAuthenticate
UlCGCreateHashTable
UlCanSatisfyRangesFromCache
UlCaptureTokenUserByHandle
UlCaptureTokenUserByPointer
UlCaptureWideString
UlCheckAuthHeader
UlConfigLogging
UlContentRangeHeaderHandler
UlCookUrl
UlCreateAuthCache
UlCreateCommChannel
UlCreateConsumerHelper
UlCreateSecurityDescriptor
UlEventLogCreateFailure
UlFlAddPerResponseFlow
UlFlCaptureFlowRateInfoOld
UlFlCopyFlowRateParamsToCache
UlFlFlowRateInfoProcessing
UlFlushCacheByUri
UlGenerateDigestChallenge
UlGenerateRoutingToken
UlGetCGroupForRequest
UlGetServerHeader
UlHkeNotifyAttachClient
UlHkeRegisterExtension
UlInitializeHashTable
UlLookupHeader
UlParseCompareUriWithRequestUri
UlPmHotAddNotify
UlPmStartModule
UlPrepare416Response
UlPrepareCacheMissRangeResponse
UlPrepareParsedHeader416Response
UlPrepareParsedHeaderRangeResponse
UlQueryDirectory
UlReadGenericParameter
UlReadStringParameter
UlRefreshFileName
UlReplaceHeaderValue
UlResponseInfoParsing
UlScStartCounters
UlScStartFacet
UlSendCachedResponse
UlSendHttpResponseIoctlOld
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConnectionsProperty
UlStartConfigGroupFacet
UlpAddIpAddressToList
UlpAiInsertAddress
UlpAllocErrorLogBuffer
UlpAllocateAuthCacheEntry
UlpAllocateAuthToken
UlpAllocateConfigGroupObject
UlpAllocateConsumer
UlpAllocateInternalResponse
UlpAllocateParsedParams
UlpAllocateRequestQueue
UlpAllocateServerSession
UlpBindSchemeToPort
UlpBuildEdgePolicyNotifyListForConfigGroup
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildParsedHeaderRangeResponseFromSlices
UlpBuildSingleRangeMdlChainFromSlices
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCaptureSoftwareDirective
UlpCompleteAuthInfo
UlpCompleteLogRecordETW
UlpComputeSecureHash
UlpCopyFilterData
UlpCopyTokenIntegrityLevel
UlpCreateBasicTokenCacheKey
UlpCreateCacheRangeSliceTracker
UlpCreateDigestContextCacheKey
UlpCreateFastForwardDataContext
UlpCreateLoggingConfig
UlpCreateTargetServiceName
UlpDeliverRequestStagePolicies
UlpDuplicateChunksForCacheSlice
UlpDuplicateSliceTrackerForCache
UlpFastAuthenticate
UlpFlatCacheRangeWrapper
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpGetResponseInfo
UlpHandleErrorLogFileRecycle
UlpHandleRecycle
UlpHkeBuilderAddKnownHeader
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpHkeBuilderPrepareForRequest
UlpInitTokenBufferLookaside
UlpInitializeAlternateCredential
UlpInitializeThreadPoolArena
UlpInitializeThreadPoolQueue
UlpInitializeThreadPoolWorkers
UlpInitializeTimerUnit
UlpLogSpecificInitFailure
UlpMergeSlicesToCache
UlpModifyLoggingConfig
UlpParseAcceptEncoding
UlpParseNextRequest
UlpParseUnknownHeader
UlpPcwCreateInstance
UlpQueryAttributeInfo
UlpQueryLogFileSecurity
UlpReadReservations
UlpRebuildResponseHeaders
UlpSendCacheEntry
UlpSetRequestQueueExternalId
UlpTreeInsertEntry
UlpUpdateReservationInRegistry
UxAllocateMdlAndBufferEx
UxAppendCopyToAggregator
UxCaptureString
UxCaptureWideString
UxCopyTrailersChunk32
UxDuoAllocateJob
UxDuoAllocateParcel
UxDuoAllocateRunner
UxDuoAttachConnection
UxDuoBuildCatalogFrames
UxDuoBuildContinuationChain
UxDuoBuildDataFrames
UxDuoBuildStreamEndFrame
UxDuoCaptureDeclarePushParameters
UxDuoDispatchAltSvcParcel
UxDuoDispatchParcel
UxDuoDispatchWindowParcel
UxDuoExecuteStreamDisconnect
UxDuoHpackAllocateBlock
UxDuoHpackAllocateInternal
UxDuoHpackAllocatePairs
UxDuoSanitizeDeclarePushParameters
UxGenerateSubdomainWildcardHostname
UxOpenSubKeyByIndex
UxQuicBufferInitialize
UxQuicConnectionQueueDecoderReset
UxQuicCreateConnection
UxQuicCreateSendTracker
UxQuicCreateSession
UxQuicStreamPushInjectCreateContext
UxQuicStreamPushSendCreateContext
UxReadFileEntry
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslAllocateAchContext
UxSslAllocateAscContext
UxSslAllocateSendBuffer
UxSslAllocateTransportDataIndication
UxSslCaptureCertConfig
UxSslCaptureErrorHeaders
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCreateConfiguration
UxSslGetAltSvcInfo
UxSslInitializeCertificateContext
UxSslInitializeClientCertPolicy
UxSslOpenConfigRegistryKey
UxSslParseSni
UxSslParseTlsRestrictions
UxSslReadExtendedConfigurationPropertiesFromUser
UxSslSetTokenBinding
UxSslStartReceiverFacet
UxSslStartSenderModule
UxStartOpaqueIdModule
UxTlAllocateConnectionForLookaside
UxTlCreateListenAddressList
UxWfpAllocateThrottleContext
UxWskNotifyAttachProvider
UxWskStartFacet
UxpAllocateHeaderBufferBlock
UxpDuoCaptureHostName
UxpExpandOpaqueIdTable
UxpQuicAllocateConfigurationContext
UxpQuicAllocateTransportIndication
UxpQuicBufferExpandBuffer
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicConvertString
UxpQuicCreateCustomAlpnArray
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicQueryConnectionInfo
UxpSslAllocateRegistration
UxpSslAllocateTableNode
UxpSslCommonSendDataHelper
UxpSslConfigToPrincipal
UxpSslCopySniForEtwFiltering
UxpSslDeleteTlsRestrictionsFromRegistry
UxpSslGetClientHello
UxpSslInitializeEndpointTable
UxpSslInitializeSchCredentials
UxpSslInitiateAscHandler
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslReadCertConfigFromRegistry
UxpSslReadConfigurationPropertiesFromRegistry
UxpSslReadErrorHeadersFromRegistry
UxpSslReadTlsRestrictionsFromRegistry
UxpSslWriteHostConfigToRegistryHelper
UxpTlCreateAddressEndpoint
UxpTlCreateListenEndpoint
UxpTpAllocateChunkTracker
UxpTpDirectTransmitFromMdl
UxpTpProcessMemoryBuffer
UxpWskAcquirePortReservation
UxpWskQosNotifyAttachProvider
|
Expand for full list:
FUN_1401579de
FUN_140158150
FUN_140160da4
FUN_140161da8
HttpNormalizeNamedHost
HttppNormalizePath
HttppRebuildFixedUrl
PplpCreateLookasideListEx
UcAllocateConnection
UcAllocateConnectionParameters
UcAllocateCredentialUcAllocateCredentialParameters
UcAllocateStream
UcStreamAllocateSendTracker
UcpAllocateClientSession
UcpAllocateClientSessionContext
UcpGetSendHeadersPairs
UcpStreamAllocateReceiveBuffer
UcpStreamCreateHeaderBuffer
UlAddServiceNameToContainer
UlAllocateBuildTracker
UlAllocateCacheEntry
UlAllocateCacheTracker
UlAllocateChannelBindToken
UlAllocateFastTracker
UlAllocateLogDataBuffer
UlAllocatePerNode
UlAllocateRequestBuffer
UlAllocateServiceNameContainer
UlAllocateToLookaside
UlAllocateWideString
UlAppendHeaderValue
UlAuthenticate
UlCGCreateHashTable
UlCanSatisfyRangesFromCache
UlCaptureTokenUserByHandle
UlCaptureTokenUserByPointer
UlCaptureWideString
UlCheckAuthHeader
UlConfigLogging
UlContentRangeHeaderHandler
UlCookUrl
UlCreateAuthCache
UlCreateCommChannel
UlCreateConsumerHelper
UlCreateSecurityDescriptor
UlEventLogCreateFailure
UlFlAddPerResponseFlow
UlFlCaptureFlowRateInfoOld
UlFlCopyFlowRateParamsToCache
UlFlFlowRateInfoProcessing
UlFlushCacheByUri
UlGenerateDigestChallenge
UlGenerateRoutingToken
UlGetCGroupForRequest
UlGetServerHeader
UlHkeNotifyAttachClient
UlHkeRegisterExtension
UlInitializeHashTable
UlLookupHeader
UlParseCompareUriWithRequestUri
UlPmHotAddNotify
UlPmStartModule
UlPrepare416Response
UlPrepareCacheMissRangeResponse
UlPrepareParsedHeader416Response
UlPrepareParsedHeaderRangeResponse
UlQueryDirectory
UlReadGenericParameter
UlReadStringParameter
UlRefreshFileName
UlReplaceHeaderValue
UlResponseInfoParsing
UlScStartCounters
UlScStartFacet
UlSendCachedResponse
UlSendHttpResponseIoctlOld
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConnectionsProperty
UlStartConfigGroupFacet
UlpAddIpAddressToList
UlpAiInsertAddress
UlpAllocErrorLogBuffer
UlpAllocateAuthCacheEntry
UlpAllocateAuthToken
UlpAllocateConfigGroupObject
UlpAllocateConsumer
UlpAllocateInternalResponse
UlpAllocateParsedParams
UlpAllocateRequestQueue
UlpAllocateServerSession
UlpBindSchemeToPort
UlpBuildEdgePolicyNotifyListForConfigGroup
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildParsedHeaderRangeResponseFromSlices
UlpBuildSingleRangeMdlChainFromSlices
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCaptureSoftwareDirective
UlpCompleteAuthInfo
UlpCompleteLogRecordETW
UlpComputeSecureHash
UlpCopyFilterData
UlpCopyTokenIntegrityLevel
UlpCreateBasicTokenCacheKey
UlpCreateCacheRangeSliceTracker
UlpCreateDigestContextCacheKey
UlpCreateFastForwardDataContext
UlpCreateLoggingConfig
UlpCreateTargetServiceName
UlpDeliverRequestStagePolicies
UlpDuplicateChunksForCacheSlice
UlpDuplicateSliceTrackerForCache
UlpFastAuthenticate
UlpFlatCacheRangeWrapper
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpGetResponseInfo
UlpHandleErrorLogFileRecycle
UlpHandleRecycle
UlpHkeBuilderAddKnownHeader
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpHkeBuilderPrepareForRequest
UlpInitTokenBufferLookaside
UlpInitializeAlternateCredential
UlpInitializeThreadPoolArena
UlpInitializeThreadPoolQueue
UlpInitializeThreadPoolWorkers
UlpInitializeTimerUnit
UlpLogSpecificInitFailure
UlpMergeSlicesToCache
UlpModifyLoggingConfig
UlpParseAcceptEncoding
UlpParseNextRequest
UlpParseUnknownHeader
UlpPcwCreateInstance
UlpQueryAttributeInfo
UlpQueryLogFileSecurity
UlpReadReservations
UlpRebuildResponseHeaders
UlpSendCacheEntry
UlpSetRequestQueueExternalId
UlpTreeInsertEntry
UlpUpdateReservationInRegistry
UxAllocateMdlAndBufferEx
UxAllocateRefBlob
UxAppendCopyToAggregator
UxCaptureString
UxCaptureWideString
UxCopyTrailersChunk32
UxDuoAllocateJob
UxDuoAllocateParcel
UxDuoAllocateRunner
UxDuoAttachConnection
UxDuoBuildCatalogFrames
UxDuoBuildContinuationChain
UxDuoBuildDataFrames
UxDuoBuildStreamEndFrame
UxDuoCaptureDeclarePushParameters
UxDuoDispatchAltSvcParcel
UxDuoDispatchParcel
UxDuoDispatchWindowParcel
UxDuoExecuteStreamDisconnect
UxDuoHpackAllocateBlock
UxDuoHpackAllocateInternal
UxDuoHpackAllocatePairs
UxDuoSanitizeDeclarePushParameters
UxGenerateSubdomainWildcardHostname
UxOpenSubKeyByIndex
UxQuicBufferInitialize
UxQuicConnectionQueueDecoderReset
UxQuicCreateConnection
UxQuicCreateSendTracker
UxQuicCreateSession
UxQuicStreamPushInjectCreateContext
UxQuicStreamPushSendCreateContext
UxReadFileEntry
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslAllocateAchContext
UxSslAllocateAscContext
UxSslAllocateSendBuffer
UxSslAllocateTransportDataIndication
UxSslCaptureCertConfig
UxSslCaptureErrorHeaders
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCreateConfiguration
UxSslGetAltSvcInfo
UxSslInitializeCertificateContext
UxSslInitializeClientCertPolicy
UxSslOpenConfigRegistryKey
UxSslParseSni
UxSslParseTlsRestrictions
UxSslReadExtendedConfigurationPropertiesFromUser
UxSslSetTokenBinding
UxSslStartReceiverFacet
UxSslStartSenderModule
UxStartOpaqueIdModule
UxTlAllocateConnectionForLookaside
UxTlCreateListenAddressList
UxWfpAllocateThrottleContext
UxWskNotifyAttachProvider
UxWskStartFacet
UxpAllocateHeaderBufferBlock
UxpDuoCaptureHostName
UxpExpandOpaqueIdTable
UxpQuicAllocateConfigurationContext
UxpQuicAllocateTransportIndication
UxpQuicBufferExpandBuffer
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicConvertString
UxpQuicCreateCustomAlpnArray
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicQueryConnectionInfo
UxpSslAllocateRegistration
UxpSslAllocateTableNode
UxpSslCommonSendDataHelper
UxpSslConfigToPrincipal
UxpSslCopySniForEtwFiltering
UxpSslDeleteTlsRestrictionsFromRegistry
UxpSslGetClientHello
UxpSslInitializeEndpointTable
UxpSslInitializeSchCredentials
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslReadCertConfigFromRegistry
UxpSslReadConfigurationPropertiesFromRegistry
UxpSslReadErrorHeadersFromRegistry
UxpSslReadTlsRestrictionsFromRegistry
UxpSslWriteHostConfigToRegistryHelper
UxpTlCreateAddressEndpoint
UxpTlCreateListenEndpoint
UxpTpAllocateChunkTracker
UxpTpDirectTransmitFromMdl
UxpTpProcessMemoryBuffer
UxpWskAcquirePortReservation
UxpWskQosNotifyAttachProvider
| |paramcount|0|0| |address|EXTERNAL:00000144|EXTERNAL:00000144| |sig|undefined ExAllocatePool3(void)|undefined ExAllocatePool3(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAllocatePool3 Calling Diff ```diff --- NTOSKRNL.EXE::ExAllocatePool3 calling +++ NTOSKRNL.EXE::ExAllocatePool3 calling @@ -1,4 +1,4 @@ -FUN_1401573e0 -FUN_1401582ca -FUN_140160a70 -FUN_140161abc +FUN_1401579de +FUN_140158150 +FUN_140160da4 +FUN_140161da8 @@ -14 +13,0 @@ -UcCaptureConnectionParameters @@ -150,0 +150 @@ +UxAllocateRefBlob @@ -231 +230,0 @@ -UxpSslInitiateAscHandler ``` Generated with `ghidriff` version: 1.0.0 on 2026-07-24T23:03:17