# ikeext-04.dll-ikeext-05.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_1865663801__private_IsEnabledDeviceUsageNoInline](#feature_1865663801__private_isenableddeviceusagenoinline) * [Modified](#modified) * [IkeParseMMAttributes](#ikeparsemmattributes) * [Modified (No Code Changes)](#modified-no-code-changes) * [IkeCopyIncomingDataQuiet](#ikecopyincomingdataquiet) * [WfpMemFree](#wfpmemfree) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) # Visual Chart Diff ```mermaid flowchart LR IkeParseMMAttributes-4-old<--Match 41%-->IkeParseMMAttributes-4-new subgraph ikeext-05.dll IkeParseMMAttributes-4-new subgraph Added direction LR Feature_1865663801__private_IsEnabledDeviceUsageNoInline end end subgraph ikeext-04.dll IkeParseMMAttributes-4-old end ``` ```mermaid pie showData title Function Matches - 99.9819% "unmatched_funcs_len" : 1 "matched_funcs_len" : 5518 ``` ```mermaid pie showData title Matched Function Similarity - 99.9275% "matched_funcs_with_code_changes_len" : 1 "matched_funcs_with_non_code_changes_len" : 3 "matched_funcs_no_changes_len" : 5514 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 ikeext-04.dll ikeext-05.dll ``` #### Verbose Args

``` --old ['ikeext-04.dll'] --new [['ikeext-05.dll']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/IKEEXT.DLL/DE6865F618D000/IKEEXT.DLL -O ikeext.dll.x64.10.0.26100.8328 wget https://msdl.microsoft.com/download/symbols/IKEEXT.DLL/15FADE9618D000/IKEEXT.DLL -O ikeext.dll.x64.10.0.26100.8457 ``` ## Binary Metadata Diff ```diff --- ikeext-04.dll Meta +++ ikeext-05.dll Meta @@ -1,44 +1,44 @@ -Program Name: ikeext-04.dll +Program Name: ikeext-05.dll Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 1630256 +# of Bytes: 1630264 # of Memory Blocks: 10 -# of Instructions: 269814 -# of Defined Data: 16011 -# of Functions: 2759 -# of Symbols: 45596 -# of Data Types: 865 -# of Data Type Categories: 51 +# of Instructions: 269850 +# of Defined Data: 16022 +# of Functions: 2760 +# of Symbols: 45504 +# of Data Types: 851 +# of Data Type Categories: 48 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Wed Aug 26 21:12:42 SGT 2026 +Date Created: Wed Aug 26 21:12:48 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/ikeext-04.dll -Executable MD5: 82c61d2f183f5f97a69ecaf02e4b8ebe -Executable SHA256: 830d809edbcd972cc48a25670e287a3f11c37e096dd5623257bf8afd86b6eb3c -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/ikeext-04.dll?MD5=82c61d2f183f5f97a69ecaf02e4b8ebe +Executable Location: /C:/Users/Jacob/Downloads/pdbs/ikeext-05.dll +Executable MD5: 329dc04956f1518957988c1bee26cea8 +Executable SHA256: 2960e3ffce29eb46d71abb9edd01791efeac6c2e59d29a692c98869e9153cd77 +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/ikeext-05.dll?MD5=329dc04956f1518957988c1bee26cea8 PDB Age: 1 PDB File: ikeext.pdb -PDB GUID: d27a730c-b54a-fab8-624d-4548bb0cac37 +PDB GUID: 7afa4c47-520d-1b8f-e814-a8d82b383fec PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: IKE extension -PE Property[FileVersion]: 10.0.26100.8328 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8457 (WinBuild.160101.0800) PE Property[InternalName]: IKEEXT.DLL PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: IKEEXT.DLL PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8328 +PE Property[ProductVersion]: 10.0.26100.8457 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra ikeext-04.dll Decompiler Options

Ghidra ikeext-04.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra ikeext-04.dll Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra ikeext-05.dll Decompiler Options

Ghidra ikeext-05.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra ikeext-05.dll Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|1| |deleted_funcs_len|0| |modified_funcs_len|4| |added_symbols_len|7| |deleted_symbols_len|17| |diff_time|17.32248854637146| |deleted_strings_len|1| |added_strings_len|1| |match_types|Counter({'SymbolsHash': 2752, 'ExternalsName': 431, 'ExactBytesFunctionHasher': 2, 'ExactInstructionsFunctionHasher': 1})| |items_to_process|29| |diff_types|Counter({'refcount': 3, 'code': 1, 'length': 1, 'address': 1, 'called': 1, 'calling': 1})| |unmatched_funcs_len|1| |total_funcs_len|5519| |matched_funcs_len|5518| |matched_funcs_with_code_changes_len|1| |matched_funcs_with_non_code_changes_len|3| |matched_funcs_no_changes_len|5514| |match_func_similarity_percent|99.9275%| |func_match_overall_percent|99.9819%| |first_matches|Counter({'SymbolsHash': 2752, 'ExactBytesFunctionHasher': 2, 'ExactInstructionsFunctionHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 2752 "ExternalsName" : 431 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 2752 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 1 "deleted_funcs_len" : 0 "modified_funcs_len" : 4 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 7 "deleted_symbols_len" : 17 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 1 "added_strings_len" : 1 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -1 +1 @@ -wszFontArray +u_Segoe_UI_Light ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | |wszFontArray|6|IkeLicensingInit| #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_Segoe_UI_Light_18014f040|6|IkeLicensingInit| # Deleted # Added ## Feature_1865663801__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|ikeext-05.dll| | :---: | :---: | |name|Feature_1865663801__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1865663801__private_IsEnabledDeviceUsageNoInline| |refcount|1| |length|51| |called|wil_details_IsEnabledFallback| |calling|IkeParseMMAttributes| |paramcount|0| |address|180115f20| |sig|uint __fastcall Feature_1865663801__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1865663801__private_IsEnabledDeviceUsageNoInline +++ Feature_1865663801__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,15 @@ + +uint Feature_1865663801__private_IsEnabledDeviceUsageNoInline(void) + +{ + uint uVar1; + ulonglong local_res8; + + local_res8 = (ulonglong)Feature_1865663801__private_featureState; + if ((Feature_1865663801__private_featureState & 0x10) != 0) { + return Feature_1865663801__private_featureState & 1; + } + uVar1 = wil_details_IsEnabledFallback(local_res8,3,&Feature_1865663801__private_descriptor); + return uVar1; +} + ``` # Modified *Modified functions contain code changes* ## IkeParseMMAttributes ### Match Info |Key|ikeext-04.dll - ikeext-05.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.45| |i_ratio|0.58| |m_ratio|0.97| |b_ratio|0.41| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-04.dll|ikeext-05.dll| | :---: | :---: | :---: | |name|IkeParseMMAttributes|IkeParseMMAttributes| |fullname|IkeParseMMAttributes|IkeParseMMAttributes| |refcount|2|2| |`length`|1909|1973| |`called`|

Expand for full list:
IkeAdjustIkeCipherType
IkeCopyIncomingDataQuiet
IkeGetAttValue
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMHashDoiToInternal
IkeReturnError
NtohAtt

WPP_SF_iS
WPP_SF_iSL
WPP_SF_iSdd
WfpMemFree
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_wchar_t
_tlgWriteTransfer_EtwEventWriteTransfer

Expand for full list:
Feature_1865663801__private_IsEnabledDeviceUsageNoInline
IkeAdjustIkeCipherType
IkeCopyIncomingDataQuiet
IkeGetAttValue
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMHashDoiToInternal
IkeReturnError

NtohAtt
WPP_SF_iS
WPP_SF_iSL
WPP_SF_iSdd
WfpMemFree
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_wchar_t
_tlgWriteTransfer_EtwEventWriteTransfer

| |calling|IkeParseMMTransforms|IkeParseMMTransforms| |paramcount|4|4| |`address`|180117fe4|180118028| |sig|undefined __fastcall IkeParseMMAttributes(longlong * param_1, uint * param_2, uint * param_3, longlong * param_4)|undefined __fastcall IkeParseMMAttributes(longlong * param_1, uint * param_2, uint * param_3, longlong * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeParseMMAttributes Called Diff ```diff --- IkeParseMMAttributes called +++ IkeParseMMAttributes called @@ -0,0 +1 @@ +Feature_1865663801__private_IsEnabledDeviceUsageNoInline ``` ### IkeParseMMAttributes Diff ```diff --- IkeParseMMAttributes +++ IkeParseMMAttributes @@ -1,274 +1,296 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void IkeParseMMAttributes(longlong *param_1,uint *param_2,uint *param_3,longlong *param_4) { ushort uVar1; u_long uVar2; - undefined8 uVar3; - longlong lVar4; - wchar_t *pwVar5; - undefined **ppuVar6; - short sVar7; - uint uVar8; + uint uVar3; + undefined8 uVar4; + ulonglong uVar5; + wchar_t *pwVar6; + undefined **ppuVar7; + short sVar8; uint uVar9; - uint uVar10; + ulonglong uVar10; undefined1 auStackY_168 [32]; + uint local_128; undefined8 local_120; longlong lStack_118; u_long local_110; undefined8 local_10c; uint local_104; uint local_100; uint local_fc; uint local_f8; uint local_f4; undefined8 local_f0; undefined8 local_e8; undefined8 local_e0; undefined8 local_d8; undefined8 local_d0; undefined8 local_c8 [2]; undefined8 local_b8 [4]; undefined8 *local_98; undefined8 local_90; longlong local_88 [2]; uint *local_78; undefined8 local_70; longlong local_68; undefined8 local_60; uint *local_58; undefined8 local_50; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_168; + uVar5 = 0; + param_2[8] = 0xd; local_10c._0_4_ = 0; local_110 = 0; *param_2 = 0xffff; + param_2[3] = 0xffff; param_2[5] = 0xffff; - param_2[3] = 0xffff; - lVar4 = 0; - param_2[8] = 0xd; + local_128 = 0; local_120 = 0; lStack_118 = 0; - uVar10 = 0; - uVar9 = 0; -LAB_0: - uVar3 = IkeCopyIncomingDataQuiet((undefined4 *)&local_10c,param_1); - if ((int)uVar3 == 0) goto LAB_1; - *(short *)((longlong)param_1 + 0xc) = *(short *)((longlong)param_1 + 0xc) + 4; - NtohAtt((u_short *)&local_10c); - param_3 = (uint *)&local_120; - ppuVar6 = (undefined **)&local_10c; - param_4 = param_1; - lVar4 = IkeGetAttValue((ushort *)ppuVar6,&local_110,param_3,param_1); - uVar2 = local_110; - if (lVar4 != 0) goto LAB_1; - uVar8 = (uint)local_10c & 0x7fff; - sVar7 = (short)(uint)local_10c; - uVar1 = (ushort)local_110; - if (uVar8 == 1) { - if (sVar7 < 0) { - lVar4 = IkeMMCipherDoiToInternal - ((ushort)local_110,(ushort *)param_2,(undefined *)param_3,param_4); - if (lVar4 != 0) goto LAB_1; - IkeAdjustIkeCipherType(param_2,(short)uVar9,param_3,param_4); - goto LAB_0; - } - } - else { - if (uVar8 == 2) { - if (-1 < sVar7) goto LAB_2; - lVar4 = IkeMMHashDoiToInternal((ushort)local_110,(ushort *)(param_2 + 3),param_3,param_4); -LAB_3: - if (lVar4 != 0) { + uVar3 = 0; + uVar4 = IkeCopyIncomingDataQuiet((undefined4 *)&local_10c,param_1); + uVar10 = uVar5; + if ((int)uVar4 != 0) { + while( true ) { + *(short *)((longlong)param_1 + 0xc) = *(short *)((longlong)param_1 + 0xc) + 4; + NtohAtt((u_short *)&local_10c); + param_3 = (uint *)&local_120; + ppuVar7 = (undefined **)&local_10c; + param_4 = param_1; + uVar5 = IkeGetAttValue((ushort *)ppuVar7,&local_110,param_3,param_1); + uVar2 = local_110; + if (uVar5 != 0) break; + sVar8 = (short)(uint)local_10c; + uVar9 = (uint)local_10c & 0x7fff; + uVar1 = (ushort)local_110; + if (uVar9 == 1) { + if (sVar8 < 0) { + uVar5 = IkeMMCipherDoiToInternal + ((ushort)local_110,(ushort *)param_2,(undefined *)param_3,param_4); + if (uVar5 == 0) { + IkeAdjustIkeCipherType(param_2,(short)uVar3,param_3,param_4); + goto LAB_0; + } + } + else { LAB_1: - IkeReturnError(lVar4,"IkeParseMMAttributes",param_3,param_4); - return; + param_4 = (longlong *)0x1; + param_3 = (uint *)0x3613; + uVar5 = WfpReportSysErrorAsWinError(ppuVar7,"IkeParseMMAttributes",0x3613,1); + } + break; } - goto LAB_0; - } - if (uVar8 == 3) { - if (sVar7 < 0) { - lVar4 = IkeMMAuthDoiToInternal - ((ushort)local_110,(ushort *)(param_2 + 8),(undefined *)param_3,param_4); - goto LAB_3; + if (uVar9 == 2) { + if (-1 < sVar8) goto LAB_1; + uVar5 = IkeMMHashDoiToInternal((ushort)local_110,(ushort *)(param_2 + 3),param_3,param_4); +LAB_2: + if (uVar5 != 0) break; } - } - else if (uVar8 == 4) { - if (sVar7 < 0) { - lVar4 = IkeMMDhDoiToInternal - ((ushort)local_110,(ushort *)(param_2 + 5),(undefined *)param_3,param_4); - goto LAB_3; - } - } - else { - if (uVar8 != 0xb) { - if (uVar8 == 0xc) { - if (uVar10 == 1) { + else { + if (uVar9 == 3) { + if (-1 < sVar8) goto LAB_1; + uVar5 = IkeMMAuthDoiToInternal + ((ushort)local_110,(ushort *)(param_2 + 8),(undefined *)param_3,param_4) + ; + goto LAB_2; + } + if (uVar9 == 4) { + if (-1 < sVar8) goto LAB_1; + uVar5 = IkeMMDhDoiToInternal + ((ushort)local_110,(ushort *)(param_2 + 5),(undefined *)param_3,param_4) + ; + goto LAB_2; + } + if (uVar9 == 0xb) { + ppuVar7 = &WPP_GLOBAL_Control; + uVar10 = (ulonglong)local_110; + local_128 = local_110; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (3 < (byte)WPP_GLOBAL_Control[0x19])) && ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = (longlong *)IkeGetTlsMmLuid(); + param_3 = (uint *)&WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids; + ppuVar7 = *(undefined ***)(WPP_GLOBAL_Control + 0x10); + WPP_SF_iSL(ppuVar7,0xe,&WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids,param_4,pwVar6); + } + if (4 < DAT_3) { + local_c8[0] = IkeGetTlsMmLuid(); + local_98 = local_c8; + local_90 = 8; + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar6); + local_78 = &local_f4; + local_f4 = uVar2; + ppuVar7 = (undefined **)&DAT_3; + local_70 = 4; + _tlgWriteTransfer_EtwEventWriteTransfer + (0x18017d278,&DAT_4,param_3,param_4,5,local_b8); + } + if (-1 < sVar8) goto LAB_1; + } + else if (uVar9 == 0xc) { + if ((int)uVar10 == 1) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < (byte)WPP_GLOBAL_Control[0x19])) && ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (longlong *)IkeGetTlsMmLuid(); - param_3 = (uint *)&WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids; - WPP_SF_iSL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf, - &WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids,param_4,pwVar5); - } - if (4 < DAT_4) { + param_3 = (uint *)&WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids; + WPP_SF_iSL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),(short)uVar10 + 0xe, + &WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids,param_4,pwVar6); + } + if (4 < DAT_3) { local_d8 = IkeGetTlsMmLuid(); local_98 = &local_d8; local_90 = 8; - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_88,pwVar5); + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar6); local_78 = &local_f8; local_f8 = uVar2; local_70 = 4; _tlgWriteTransfer_EtwEventWriteTransfer (0x18017d278,&DAT_5,param_3,param_4,5,local_b8); } param_2[4] = uVar2; } else { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < (byte)WPP_GLOBAL_Control[0x19])) && ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (longlong *)IkeGetTlsMmLuid(); - param_3 = (uint *)&WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids; + param_3 = (uint *)&WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids; WPP_SF_iS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10, - &WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids,param_4,pwVar5); - } - if (4 < DAT_4) { + &WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids,param_4,pwVar6); + } + if (4 < DAT_3) { local_d0 = IkeGetTlsMmLuid(); local_98 = &local_d0; local_90 = 8; - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_88,pwVar5); + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar6); + local_70 = 0x19; local_78 = (uint *)0x18014c290; - local_70 = 0x19; _tlgWriteTransfer_EtwEventWriteTransfer (0x18017d278,&DAT_6,param_3,param_4,5,local_b8); } } } - else if (uVar8 == 0xe) { - ppuVar6 = &WPP_GLOBAL_Control; + else if (uVar9 == 0xe) { + ppuVar7 = &WPP_GLOBAL_Control; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < (byte)WPP_GLOBAL_Control[0x19])) && ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (longlong *)IkeGetTlsMmLuid(); - param_3 = (uint *)&WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids; - ppuVar6 = *(undefined ***)(WPP_GLOBAL_Control + 0x10); - WPP_SF_iSL(ppuVar6,0xd,&WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids,param_4,pwVar5); - } - if (4 < DAT_4) { + param_3 = (uint *)&WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids; + ppuVar7 = *(undefined ***)(WPP_GLOBAL_Control + 0x10); + WPP_SF_iSL(ppuVar7,0xd,&WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids,param_4,pwVar6); + } + if (4 < DAT_3) { local_e0 = IkeGetTlsMmLuid(); local_98 = &local_e0; local_90 = 8; - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_88,pwVar5); + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar6); local_78 = &local_fc; local_fc = uVar2; - ppuVar6 = (undefined **)&DAT_4; + ppuVar7 = (undefined **)&DAT_3; local_70 = 4; _tlgWriteTransfer_EtwEventWriteTransfer (0x18017d278,&DAT_7,param_3,param_4,5,local_b8); } - if (-1 < sVar7) goto LAB_2; + if (-1 < sVar8) goto LAB_1; IkeAdjustIkeCipherType(param_2,uVar1,param_3,param_4); - uVar9 = uVar2; - } - else if ((uVar8 == 0x4000) || (uVar8 == 0x7d01)) { + uVar3 = uVar2; + } + else if ((uVar9 == 0x4000) || (uVar9 == 0x7d01)) { if (*(longlong *)(param_2 + 0xc) == 0) { - uVar8 = (uint)local_120; + uVar9 = (uint)local_120; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < (byte)WPP_GLOBAL_Control[0x19])) && ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (longlong *)IkeGetTlsMmLuid(); - param_3 = (uint *)&WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids; + param_3 = (uint *)&WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids; WPP_SF_iSL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11, - &WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids,param_4,pwVar5); - } - if (4 < DAT_4) { + &WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids,param_4,pwVar6); + } + if (4 < DAT_3) { local_e8 = IkeGetTlsMmLuid(); local_98 = &local_e8; local_90 = 8; - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_88,pwVar5); + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar6); local_78 = &local_100; - local_100 = uVar8; + local_100 = uVar9; local_70 = 4; _tlgWriteTransfer_EtwEventWriteTransfer (0x18017d278,&DAT_8,param_3,param_4,5,local_b8); } *(undefined8 *)(param_2 + 10) = local_120; *(longlong *)(param_2 + 0xc) = lStack_118; } else { WfpMemFree(&lStack_118); } local_120 = 0; lStack_118 = 0; } else { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < (byte)WPP_GLOBAL_Control[0x19])) && ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (longlong *)IkeGetTlsMmLuid(); - param_3 = (uint *)&WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids; + param_3 = (uint *)&WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids; WPP_SF_iSdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x12, - &WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids,param_4,pwVar5); - } - if (4 < DAT_4) { + &WPP_d5b0d20ba1f734e295141442a9f64ab2_Traceguids,param_4,pwVar6); + } + if (DAT_3 < 5) { + uVar10 = (ulonglong)local_128; + } + else { local_f0 = IkeGetTlsMmLuid(); local_98 = &local_f0; local_90 = 8; - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_88,pwVar5); + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar6); local_68 = (longlong)&local_10c + 4; local_58 = &local_104; local_78 = (uint *)0x18014c2b0; local_70 = 0x12; local_60 = 4; local_104 = uVar2; local_50 = 4; - local_10c._4_4_ = uVar8; + local_10c._4_4_ = uVar9; _tlgWriteTransfer_EtwEventWriteTransfer (0x18017d278,&DAT_9,param_3,param_4,7,local_b8); - } - } - goto LAB_0; + uVar10 = (ulonglong)local_128; + } + } } - ppuVar6 = &WPP_GLOBAL_Control; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (3 < (byte)WPP_GLOBAL_Control[0x19])) && ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); - param_4 = (longlong *)IkeGetTlsMmLuid(); - param_3 = (uint *)&WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids; - ppuVar6 = *(undefined ***)(WPP_GLOBAL_Control + 0x10); - WPP_SF_iSL(ppuVar6,0xe,&WPP_b3ed87fbe85132643a8dd9511d87cb11_Traceguids,param_4,pwVar5); - } - if (4 < DAT_4) { - local_c8[0] = IkeGetTlsMmLuid(); - local_98 = local_c8; - local_90 = 8; - pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_88,pwVar5); - local_78 = &local_f4; - local_f4 = uVar2; - ppuVar6 = (undefined **)&DAT_4; - local_70 = 4; - _tlgWriteTransfer_EtwEventWriteTransfer - (0x18017d278,&DAT_10,param_3,param_4,5,local_b8); - } - uVar10 = uVar2; - if (sVar7 < 0) goto LAB_0; +LAB_0: + uVar4 = IkeCopyIncomingDataQuiet((undefined4 *)&local_10c,param_1); + if ((int)uVar4 == 0) break; } } -LAB_2: - param_4 = (longlong *)0x1; - param_3 = (uint *)0x3613; - lVar4 = WfpReportSysErrorAsWinError(ppuVar6,"IkeParseMMAttributes",0x3613,1); - goto LAB_1; + if ((Feature_1865663801__private_featureState & 0x10) == 0) { + uVar3 = Feature_1865663801__private_IsEnabledDeviceUsageNoInline(); + } + else { + uVar3 = Feature_1865663801__private_featureState & 1; + } + if (((uVar3 != 0) && (uVar5 != 0)) && (*(longlong *)(param_2 + 0xc) != 0)) { + WfpMemFree((longlong *)(param_2 + 0xc)); + param_2[10] = 0; + param_2[0xb] = 0; + param_2[0xc] = 0; + param_2[0xd] = 0; + } + IkeReturnError(uVar5,"IkeParseMMAttributes",param_3,param_4); + return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## IkeCopyIncomingDataQuiet ### Match Info |Key|ikeext-04.dll - ikeext-05.dll| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-04.dll|ikeext-05.dll| | :---: | :---: | :---: | |name|IkeCopyIncomingDataQuiet|IkeCopyIncomingDataQuiet| |fullname|IkeCopyIncomingDataQuiet|IkeCopyIncomingDataQuiet| |`refcount`|5|6| |length|90|90| |called|WfpUINT32Add|WfpUINT32Add| |calling|IkeConvertCfgAttrRfcToRasFormat
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseQMAttributes|IkeConvertCfgAttrRfcToRasFormat
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseQMAttributes| |paramcount|2|2| |address|1800f4f3c|1800f4f3c| |sig|undefined8 __fastcall IkeCopyIncomingDataQuiet(undefined4 * param_1, longlong * param_2)|undefined8 __fastcall IkeCopyIncomingDataQuiet(undefined4 * param_1, longlong * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## WfpMemFree ### Match Info |Key|ikeext-04.dll - ikeext-05.dll| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.97| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-04.dll|ikeext-05.dll| | :---: | :---: | :---: | |name|WfpMemFree|WfpMemFree| |fullname|WfpMemFree|WfpMemFree| |`refcount`|801|802| |length|290|290| |called|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
Feature_BFE_MemAlloc_BugFixes_25B__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgs|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
Feature_BFE_MemAlloc_BugFixes_25B__private_IsEnabledDeviceUsageNoInline
MicrosoftTelemetryAssertTriggeredNoArgs| |calling|

Expand for full list:
CgaCreateCgaCertForKeyInfo
CgaGetCgaCertSubject
FreeDeleteEntry
FreeFragEntry
GetNatHash
GetSidFromToken
GssWrapHash
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IkeAcquireCredentialsHandle
IkeAddInboundSA
IkeAddOutboundSA

IkeAllocAndInitTimerContext
IkeAllocTracingProperties
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginQMInitiator
IkeCalculateCertSig
IkeCalculateEapHash
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCertAltNameExtensionDecode
IkeCertChainBuild
IkeCertNameToStr
IkeCheckCertECDSAKeyType
IkeCheckCertKeyUsage
IkeCheckKMAuthzBypass
IkeClassifyKMAuthorizationEx
IkeCleanupSaDetailsAfterTIInvocation
IkeClearCumulativeHash
IkeCompareCertificateName
IkeConstructAllCertRequestsIkeV2
IkeConstructAndSendMMResponse
IkeConstructCFG
IkeConstructIkeV2MMEapAndCertInitiator
IkeConstructIkeV2MMEapAndCertResponder
IkeConstructIkeV2MMEapAndPskInitiator
IkeConstructIkeV2MMEapAndPskResponder
IkeConstructIkeV2MMMutualCertInitiator
IkeConstructIkeV2MMMutualCertResponder
IkeConstructIkeV2MMMutualEapInitiator
IkeConstructIkeV2MMMutualPskInitiator
IkeConstructIkeV2MMMutualPskResponder
IkeConstructIkeV2MMPskAndCertInitiator
IkeConstructIkeV2MMPskAndCertResponder
IkeConstructKeyDictationPayload
IkeConstructMMHash
IkeConstructNatDiscIkeV2
IkeConstructNonce
IkeConstructOakMMCGAInitiator
IkeConstructOakMMCGAResponder
IkeConstructOakMMCertInitiator
IkeConstructOakMMCertResponder
IkeConstructOakMMHash
IkeConstructOakQMFirstHashInitiator
IkeConstructOakQMFirstHashResponder
IkeConstructOakQMInitiator
IkeConstructOakQMSecondHashResponder
IkeConstructOakQmConnectNotify
IkeConstructUMHash
IkeConstructVendor
IkeConvertCfgAttrRasToRfcFormat
IkeConvertIkeAddrsToVpnTrafficSelectors
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIpsecId
IkeCopyRootPolicyToSA
IkeCopyRootPubKeyToSA
IkeCopySid
IkeCreateAndInsertDeleteQMContext
IkeCreateAndInsertImpersonateEntry
IkeCreateMMSA
IkeCreateQMSA
IkeCreateQMSAResponder
IkeCreateRasTunnelIkeV2
IkeDecryptOakNDPacket
IkeDeleteZombieSas
IkeDerefPeerIPRateLimitState
IkeDerefTimerContext
IkeDeriveSkeyidInplaceIkeV2
IkeDestroyFilterToSAStateUnderLock
IkeDestroyPacketContext
IkeDestroyQMSA
IkeDetermineSspiInfo
IkeDoCertHashesMatch
IkeDownloadCertInfoFromUrl
IkeDumpHeader
IkeDumpPacket
IkeEkuCriteriaMatch
IkeEncodeCertChainPkcs7
IkeEncryptOakNDPacket
IkeEnumContextPushBack
IkeExpandEncryptionKey
IkeFindLocalCGACert
IkeFindLocalCertChain
IkeFindQMPolicy
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFinishPacket
IkeFireEventMMFailurePerError
IkeFireEventQMFailure
IkeFireEventUMFailurePerError
IkeFreeAcquireContext
IkeFreeCRPRootList
IkeFreeCertCredentials
IkeFreeCertCtxtArray
IkeFreeCertInfo
IkeFreeCredCacheEntry
IkeFreeCredential
IkeFreeCrlCtxtArray
IkeFreeCrypto
IkeFreeDH
IkeFreeDestinationTunnelChecksConfig
IkeFreeEkuList
IkeFreeEncodedCertArray
IkeFreeErrorList
IkeFreeFwpmFilterConditions
IkeFreeGetSpi
IkeFreeGroupArray
IkeFreeHashHandle
IkeFreeIPSecSaBundle
IkeFreeIkeSaDetails
IkeFreeIpsecId
IkeFreeIpsecIdSids
IkeFreeKeyDictCrypto
IkeFreeKeyModuleState
IkeFreeMMPolicy
IkeFreeMMSA
IkeFreeMobikeContext
IkeFreeMobikeNotifyInfo
IkeFreeNotifyContext
IkeFreePacket
IkeFreePeerAuthzBypassEntry
IkeFreeQMCrypto
IkeFreeQMExtPolicy
IkeFreeQMKeys
IkeFreeQMRecvPolicy
IkeFreeRasAttrTlvList
IkeFreeRecvPolicy
IkeFreeSspi
IkeFreeTraceParams
IkeFreeUMPolicy
IkeFreeUMSA
IkeFreeZombieQMContextListEntry
IkeGenerateAndStoreQMSAKeysInternal
IkeGenerateBaseKeyOakSspiCert
IkeGenerateBaseKeySspiAuthIp
IkeGenerateBaseKeysIkeV2
IkeGenerateHashMM
IkeGenerateHashUM
IkeGenerateMMCertSignHashInitiatorIkeV2
IkeGenerateMMCertSignHashResponderIkeV2
IkeGenerateMMSignBlobInitiatorIkeV2
IkeGenerateMMSignBlobResponderIkeV2
IkeGenerateNDHash
IkeGenerateOakMMHashInitiator
IkeGenerateOakMMHashResponder
IkeGenerateOakMMIV
IkeGenerateOakNotifyIV
IkeGenerateOakQMFirstHashInitiator
IkeGenerateOakQMFirstHashResponder
IkeGenerateOakQMIV
IkeGenerateOakQMSecondHashInitiator
IkeGenerateOakQMSecondHashResponder
IkeGenerateQMSAKey
IkeGenerateQMSAKeyAuthIp
IkeGenerateQMSAKeyIkeV2
IkeGenerateQMSAKeyNoDH
IkeGenerateSkeyidA
IkeGenerateSkeyidAAuthIp
IkeGenerateSkeyidD
IkeGenerateSkeyidDAuthIp
IkeGenerateSkeyidE
IkeGenerateSkeyidEAuthIp
IkeGetAltNameChoice
IkeGetAttValue
IkeGetCertHash
IkeGetEstablishedIdOak
IkeGetExplicitCred
IkeGetGroupsFromToken
IkeGetIDPayloadFromCert
IkeGetIkeV2QMNotifyData
IkeGetImpersonationHandle
IkeGetMsTcpipProtocolInfo
IkeGetMyNtlmMachineName
IkeGetMySPNAuthIp
IkeGetNegotiatedTrafficSelectorListForQMSA
IkeGetNotifyData
IkeGetOakDeleteData
IkeGetOakMMNotifyData
IkeGetOakQMNotifyData
IkeGetPrimaryGroupFromToken
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUserNameFromToken
IkeGetUserSidFromToken
IkeGetVendorIdHash
IkeHandleDeleteReqIkev2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleOakDelete
IkeHandlePayloadKeyDict
IkeHandlePayloadMMEAP
IkeHandlePayloadMMNonce
IkeHandlePayloadMMVendorId
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHashFinal
IkeHmacInit
IkeIfrCleanupAllContexts
IkeIfrCleanupStaleTunnels
IkeIfrInitializeContext
IkeIfrRecordEvent
IkeIndicateTSsToRas
IkeInitDH
IkeInitDHElliptic
IkeInitDHModp
IkeInitMMResponderPhase1
IkeInitializeMMSAInitiator
IkeInitializeMMSAResponder
IkeInitializeSspi
IkeInitializeTokenInformation
IkeInsertFilterToSAEntry
IkeInsertMMSAToCookieHashIkeV2
IkeInsertNewPeerIPRateLimitState
IkeIpAddressFilterConditionFree
IkeIsAcquireCompatible
IkeIsImpersonationUser
IkeIsKeyModEnabledForTraffic
IkeIsRemoteTokenMachine
IkeIsVendorIdPresent
IkeLoadSaDbSecurity
IkeLogCredCacheEntry
IkeLookupDestinationTunnelChecksConfig
IkeLookupVendorId
IkeMapAcquireIdToInternal
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeObtainSortedRemoteTunnelEndpoint
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalUpdateKMAuthzBypassTable
IkePackS4u
IkeParseMMAttributes
IkeParseQMAttributes
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostClrTxtResponse
IkePostExpire
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessQMTSEx
IkeProcessAcquire
IkeProcessClearTextResponseOak
IkeProcessExpireDispatch
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketCrypto
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessMMFilterChange
IkeProcessMMPolicyChange
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNonce
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPowerEvent
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMSA
IkeProcessQMSAIkeV2
IkeProcessQMTS
IkeProcessSspiComplete
IkeProcessSspiId
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQmSelectorToFwpmFilterConditions
IkeQueueMMNotify
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueRecvRequest
IkeRasProcessEapPacketAsyncCallback
IkeReadIdPayloadFromRegistry
IkeReinjectReassembledPacket
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeResendLastResponseIkeV2
IkeResendReqWithDosCookieIkeV2
IkeRpcInterfaceDestroy
IkeSADestroyEnumContext
IkeSaDbGetSecurityInfo
IkeSendAuthipDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendErrorNotificationInResponseIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeNotify
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendOakDosCookieNotify
IkeSendOakNotify
IkeSendPacketFragment
IkeSetKdcProxySettingsOnCred
IkeSetQMStatus
IkeSetQmSaIPsecId
IkeShutdown
IkeSignAndEncryptPacketAuthip
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeThinCertInfo
IkeThinCrypto
IkeThinMMSA
IkeThinSspi
IkeTraceMMTerminationSuccess
IkeTrafficSelectorListFromIkeQmAddress
IkeTransferAcquireIdToSa
IkeUPNNameDecode
IkeUpdateCumulativeHash
IkeUpdateExhaustedSaForInplaceRekey
IkeV2ConstructCorrelation
IkeV2FreeCorrelationEntry
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateRCookie
IkeVerifyDosCookieIkeV2
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPeerSig
IkeVerifySilentKeyCNG
IkeWorkerTasks
IkepDeriveKeyHMAC
Ikev2ClearFragmentListEntryList
Ikev2CreateSendFragmentEntry
IsTransportFilterTooGeneral
MIDL_user_free
WfpAuditPolicyNotifyDestroy
WfpAuditShutdown
WfpMidlObjectCopy
WfpMidlObjectDestroySafe
WfpMidlObjectEncode
WfpPnPNLInterfaceCallback
WfpPnPQueryAddressList
WfpPnPShutdownProtocolState
WfpPnpThreadPoolCallback
WfpRegQueryBinary
WfpRegQueryString
WfpStringCopyWtoAAlloc
WfpStringDestroy
WfpStringTableDestroy

| |paramcount|1|1| |address|180004730|180004730| |sig|undefined __fastcall WfpMemFree(longlong * param_1)|undefined __fastcall WfpMemFree(longlong * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## wil_details_IsEnabledFallback ### Match Info |Key|ikeext-04.dll - ikeext-05.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-04.dll|ikeext-05.dll| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|6|7| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_3844326713__private_IsEnabledDeviceUsageNoInline
Feature_BFE_MemAlloc_BugFixes_25B__private_IsEnabledDeviceUsageNoInline
Feature_IPSec_Mobike_Retrans_Timeout_Increase__private_IsEnabledDeviceUsageNoInline
Feature_IPSec_Point_To_Site_BugFix_60329226__private_IsEnabledDeviceUsageNoInline
Feature_IPSec_Point_To_Site__private_IsEnabledDeviceUsageNoInline|Feature_1865663801__private_IsEnabledDeviceUsageNoInline
Feature_3844326713__private_IsEnabledDeviceUsageNoInline
Feature_BFE_MemAlloc_BugFixes_25B__private_IsEnabledDeviceUsageNoInline
Feature_IPSec_Mobike_Retrans_Timeout_Increase__private_IsEnabledDeviceUsageNoInline
Feature_IPSec_Point_To_Site_BugFix_60329226__private_IsEnabledDeviceUsageNoInline
Feature_IPSec_Point_To_Site__private_IsEnabledDeviceUsageNoInline| |paramcount|3|3| |address|1800567c8|1800567c8| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_1865663801__private_IsEnabledDeviceUsageNoInline ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-26T21:16:05}