# keyiso.dll KB5023706 vs KB5025239 (CVE-2023-28229) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled](#feature_servicing_keyisopaddingfix_41877749__private_isenabled) * [wil_RtlStagingConfig_QueryFeatureState](#wil_rtlstagingconfig_queryfeaturestate) * [wil_RtlStagingConfig_RecordFeatureUsage](#wil_rtlstagingconfig_recordfeatureusage) * [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache) * [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate) * [wil_details_GetNtDllModuleHandle](#wil_details_getntdllmodulehandle) * [wil_details_MapReportingKind](#wil_details_mapreportingkind) * [FUN_1800060ec](#fun_1800060ec) * [API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW](#api-ms-win-core-libraryloader-l1-2-0dllgetmodulehandlew) * [Added](#added) * [Modified](#modified) * [SrvAddKeyToList](#srvaddkeytolist) * [SrvCryptImportKey](#srvcryptimportkey) * [SrvCryptCreatePersistedKey](#srvcryptcreatepersistedkey) * [SrvCryptSecretAgreement](#srvcryptsecretagreement) * [SrvRemoveKeyFromList](#srvremovekeyfromlist) * [SrvCryptOpenStorageProvider](#srvcryptopenstorageprovider) * [SrvFreeKey](#srvfreekey) * [SrvFreeProvider](#srvfreeprovider) * [SrvRemoveProviderFromList](#srvremoveproviderfromlist) * [SrvCryptFreeProvider](#srvcryptfreeprovider) * [s_SrvRpcCryptEncrypt](#s_srvrpccryptencrypt) * [s_SrvRpcCryptDecrypt](#s_srvrpccryptdecrypt) * [SrvCryptOpenKey](#srvcryptopenkey) * [SrvFreeSecret](#srvfreesecret) * [SrvAddSecretToList](#srvaddsecrettolist) * [SrvRemoveSecretFromList](#srvremovesecretfromlist) * [SrvCryptEnumKeys](#srvcryptenumkeys) * [SrvCryptFreeKey](#srvcryptfreekey) * [WPP_SF_qd](#wpp_sf_qd) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [NormalizeNteStatus](#normalizentestatus) * [__security_check_cookie](#__security_check_cookie) * [API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress](#api-ms-win-core-libraryloader-l1-2-0dllgetprocaddress) * [SrvAddMemoryBufferToList](#srvaddmemorybuffertolist) * [NTDLL.DLL::RtlFreeHeap](#ntdlldllrtlfreeheap) * [SrvCryptLocalFree](#srvcryptlocalfree) * [SrvCreateContext](#srvcreatecontext) # Visual Chart Diff ```mermaid flowchart LR SrvAddKeyToList-2-old<--Match 89%-->SrvAddKeyToList-2-new SrvCryptImportKey-9-old<--Match 20%-->SrvCryptImportKey-9-new SrvCryptCreatePersistedKey-7-old<--Match 98%-->SrvCryptCreatePersistedKey-7-new SrvCryptSecretAgreement-6-old<--Match 96%-->SrvCryptSecretAgreement-6-new SrvRemoveKeyFromList-2-old<--Match 92%-->SrvRemoveKeyFromList-2-new SrvCryptOpenStorageProvider-4-old<--Match 97%-->SrvCryptOpenStorageProvider-4-new SrvFreeKey-3-old<--Match 87%-->SrvFreeKey-3-new SrvFreeProvider-3-old<--Match 86%-->SrvFreeProvider-3-new SrvRemoveProviderFromList-2-old<--Match 92%-->SrvRemoveProviderFromList-2-new SrvCryptFreeProvider-3-old<--Match 14%-->SrvCryptFreeProvider-3-new s_SrvRpcCryptEncrypt-11-old<--Match 94%-->s_SrvRpcCryptEncrypt-11-new s_SrvRpcCryptDecrypt-11-old<--Match 94%-->s_SrvRpcCryptDecrypt-11-new SrvCryptOpenKey-6-old<--Match 49%-->SrvCryptOpenKey-6-new SrvFreeSecret-3-old<--Match 87%-->SrvFreeSecret-3-new SrvAddSecretToList-2-old<--Match 89%-->SrvAddSecretToList-2-new SrvRemoveSecretFromList-2-old<--Match 92%-->SrvRemoveSecretFromList-2-new SrvCryptEnumKeys-6-old<--Match 99%-->SrvCryptEnumKeys-6-new SrvCryptFreeKey-3-old<--Match 46%-->SrvCryptFreeKey-3-new WPP_SF_qd-4-old<--Match 97%-->WPP_SF_qi-4-new subgraph keyiso-10.0.22621.1555.dll SrvAddKeyToList-2-new SrvCryptImportKey-9-new SrvCryptCreatePersistedKey-7-new SrvCryptSecretAgreement-6-new SrvRemoveKeyFromList-2-new SrvCryptOpenStorageProvider-4-new SrvFreeKey-3-new SrvFreeProvider-3-new SrvRemoveProviderFromList-2-new SrvCryptFreeProvider-3-new s_SrvRpcCryptEncrypt-11-new s_SrvRpcCryptDecrypt-11-new SrvCryptOpenKey-6-new SrvFreeSecret-3-new SrvAddSecretToList-2-new SrvRemoveSecretFromList-2-new SrvCryptEnumKeys-6-new SrvCryptFreeKey-3-new WPP_SF_qi-4-new end subgraph keyiso-10.0.22621.819.dll SrvAddKeyToList-2-old SrvCryptImportKey-9-old SrvCryptCreatePersistedKey-7-old SrvCryptSecretAgreement-6-old SrvRemoveKeyFromList-2-old SrvCryptOpenStorageProvider-4-old SrvFreeKey-3-old SrvFreeProvider-3-old SrvRemoveProviderFromList-2-old SrvCryptFreeProvider-3-old s_SrvRpcCryptEncrypt-11-old s_SrvRpcCryptDecrypt-11-old SrvCryptOpenKey-6-old SrvFreeSecret-3-old SrvAddSecretToList-2-old SrvRemoveSecretFromList-2-old SrvCryptEnumKeys-6-old SrvCryptFreeKey-3-old WPP_SF_qd-4-old subgraph Deleted direction LR Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled wil_RtlStagingConfig_QueryFeatureState wil_RtlStagingConfig_RecordFeatureUsage wil_details_FeatureReporting_IncrementOpportunityInCache wil_details_FeatureReporting_IncrementUsageInCache wil_details_FeatureReporting_RecordUsageInCache wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_GetCurrentFeatureEnabledState wil_details_GetNtDllModuleHandle wil_details_MapReportingKind FUN_1800060ec API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0DLL-GetModuleHandleW end end ``` ```mermaid pie showData title Function Matches - 97.7419% "unmatched_funcs_len" : 14 "matched_funcs_len" : 606 ``` ```mermaid pie showData title Matched Function Similarity - 93.3993% "matched_funcs_with_code_changes_len" : 19 "matched_funcs_with_non_code_changes_len" : 21 "matched_funcs_no_changes_len" : 566 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2023-28229\ghidra_projects --project-name CVE-2023-28229 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2023-28229\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title keyiso.dll KB5023706 vs KB5025239 (CVE-2023-28229) keyiso-10.0.22621.819.dll keyiso-10.0.22621.1555.dll ``` #### Verbose Args
``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2023-28229\\keyiso-10.0.22621.819.dll'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2023-28229\\keyiso-10.0.22621.1555.dll']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2023-28229\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2023-28229\ghidra_projects --project-name CVE-2023-28229 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2023-28229\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title keyiso.dll KB5023706 vs KB5025239 (CVE-2023-28229) ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/keyiso.dll/0B8486771D000/keyiso.dll -O keyiso.dll.x64.10.0.23424.1000 wget https://msdl.microsoft.com/download/symbols/keyiso.dll/79CF79D81C000/keyiso.dll -O keyiso.dll.x64.10.0.22621.1918 ``` ## Binary Metadata Diff ```diff --- keyiso-10.0.22621.819.dll Meta +++ keyiso-10.0.22621.1555.dll Meta @@ -1,44 +1,44 @@ -Program Name: keyiso-10.0.22621.819.dll +Program Name: keyiso-10.0.22621.1555.dll Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 125016 +# of Bytes: 120920 # of Memory Blocks: 9 -# of Instructions: 13046 -# of Defined Data: 2320 -# of Functions: 317 -# of Symbols: 2769 -# of Data Types: 311 +# of Instructions: 12315 +# of Defined Data: 2264 +# of Functions: 303 +# of Symbols: 2660 +# of Data Types: 310 # of Data Type Categories: 26 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Sat Jul 25 10:38:10 SGT 2026 +Date Created: Sat Jul 25 10:38:14 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2023-28229/keyiso-10.0.22621.819.dll -Executable MD5: 2352a320e18155d3d00f95a95fa5c2aa -Executable SHA256: 98898339c6e4869455338c38ee2ae5b600dd6b85c661c5e44df83fd03cda1e5e -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2023-28229/keyiso-10.0.22621.819.dll?MD5=2352a320e18155d3d00f95a95fa5c2aa +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2023-28229/keyiso-10.0.22621.1555.dll +Executable MD5: 92117e0fb105ae3b36d5dab4699655d7 +Executable SHA256: 90871f8aba99108e151371443c79f182061b7d0ea83ce438014708798716dfda +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2023-28229/keyiso-10.0.22621.1555.dll?MD5=92117e0fb105ae3b36d5dab4699655d7 PDB Age: 1 PDB File: keyiso.pdb -PDB GUID: 28f87cf0-f791-225e-5794-a929446edd47 +PDB GUID: 1ca1eacb-b720-0a5d-c6c5-b2588e37c417 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: CNG Key Isolation Service -PE Property[FileVersion]: 10.0.23424.1000 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.22621.1918 (WinBuild.160101.0800) PE Property[InternalName]: keyiso.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: keyiso.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.23424.1000 +PE Property[ProductVersion]: 10.0.22621.1918 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra keyiso-10.0.22621.819.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra keyiso-10.0.22621.819.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra keyiso-10.0.22621.819.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra keyiso-10.0.22621.1555.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra keyiso-10.0.22621.1555.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra keyiso-10.0.22621.1555.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|14| |modified_funcs_len|40| |added_symbols_len|3| |deleted_symbols_len|15| |diff_time|17.007228136062622| |deleted_strings_len|3| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 294, 'ExternalsName': 97, 'ExactInstructionsFunctionHasher': 6, 'ExactBytesFunctionHasher': 1, 'StructuralGraphExactHash': 1, 'BSIM': 1})| |items_to_process|72| |diff_types|Counter({'address': 38, 'length': 34, 'called': 20, 'code': 19, 'sig': 14, 'refcount': 11, 'calling': 6, 'name': 1, 'fullname': 1})| |unmatched_funcs_len|14| |total_funcs_len|620| |matched_funcs_len|606| |matched_funcs_with_code_changes_len|19| |matched_funcs_with_non_code_changes_len|21| |matched_funcs_no_changes_len|566| |match_func_similarity_percent|93.3993%| |func_match_overall_percent|97.7419%| |first_matches|Counter({'SymbolsHash': 294, 'ExactInstructionsFunctionHasher': 6, 'ExactBytesFunctionHasher': 1, 'StructuralGraphExactHash': 1, 'BSIM': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 294 "ExternalsName" : 97 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 6 "StructuralGraphExactHash" : 1 "BSIM" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 294 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 6 "StructuralGraphExactHash" : 1 "BSIM" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 14 "modified_funcs_len" : 40 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 3 "deleted_symbols_len" : 15 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 3 "added_strings_len" : 0 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -1,3 +0,0 @@ -s_RtlNotifyFeatureUsage -s_RtlQueryFeatureConfiguration -u_ntdll.dll ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_ntdll.dll|1|wil_details_GetNtDllModuleHandle| |s_RtlQueryFeatureConfiguration|1|wil_RtlStagingConfig_QueryFeatureState| |s_RtlNotifyFeatureUsage|1|wil_RtlStagingConfig_RecordFeatureUsage| #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | # Deleted ## Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled| |fullname|Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled| |refcount|3| |length|96| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|s_SrvRpcCryptDecrypt
s_SrvRpcCryptEncrypt| |paramcount|2| |address|180004594| |sig|uint __fastcall Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled(undefined4 * param_1, ulonglong param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled +++ Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled @@ -1,26 +0,0 @@ - -uint Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled - (undefined4 *param_1,ulonglong param_2) - -{ - uint uVar1; - ulonglong uVar2; - uint uVar3; - undefined4 uStackX_c; - undefined8 in_stack_ffffffffffffffd8; - - uVar1 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_featureState; - if ((Feature_Servicing_KeyIsoPaddingFix_41877749__private_featureState & 1) == 0) { - param_2 = CONCAT44(uStackX_c,Feature_Servicing_KeyIsoPaddingFix_41877749__private_featureState); - param_1 = &Feature_Servicing_KeyIsoPaddingFix_41877749__private_featureState; - uVar2 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - (&Feature_Servicing_KeyIsoPaddingFix_41877749__private_featureState,param_2, - 0x180017398); - uVar1 = (uint)uVar2; - } - uVar3 = uVar1 >> 3 & 1; - wil_details_FeatureReporting_ReportUsageToService - (param_1,param_2,uVar1 >> 8 & 1,uVar1 >> 9 & 1,in_stack_ffffffffffffffd8,uVar3); - return uVar3; -} - ``` ## wil_RtlStagingConfig_QueryFeatureState ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_RtlStagingConfig_QueryFeatureState| |fullname|wil_RtlStagingConfig_QueryFeatureState| |refcount|2| |length|259| |called|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress
__security_check_cookie
_guard_xfg_dispatch_icall_nop
wil_details_GetNtDllModuleHandle| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|3| |address|1800045fc| |sig|undefined4 __fastcall wil_RtlStagingConfig_QueryFeatureState(uint * param_1, undefined4 param_2, int param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_RtlStagingConfig_QueryFeatureState +++ wil_RtlStagingConfig_QueryFeatureState @@ -1,45 +0,0 @@ - -/* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Exceeded maximum restarts with more pending */ - -undefined4 wil_RtlStagingConfig_QueryFeatureState(uint *param_1,undefined4 param_2,int param_3) - -{ - int iVar1; - HMODULE hModule; - undefined1 auStack_68 [48]; - undefined1 local_38 [8]; - undefined8 local_30; - uint local_28; - ulonglong local_20; - - local_20 = __security_cookie ^ (ulonglong)auStack_68; - local_30 = 0; - local_28 = 0; - if (g_wil_details_pfnRtlQueryFeatureConfiguration == (FARPROC)0x0) { - hModule = (HMODULE)wil_details_GetNtDllModuleHandle(); - g_wil_details_pfnRtlQueryFeatureConfiguration = - GetProcAddress(hModule,"RtlQueryFeatureConfiguration"); - if (g_wil_details_pfnRtlQueryFeatureConfiguration == (FARPROC)0x0) { - return 0; - } - } - iVar1 = (*g_wil_details_pfnRtlQueryFeatureConfiguration)(param_2,param_3 == 0,local_38,&local_30); - if (iVar1 == 0) { - *param_1 = local_30._4_4_ >> 4 & 3; - *(byte *)(param_1 + 1) = (byte)((ulonglong)local_30 >> 0x28) & 0x3f; - param_1[3] = local_28; - param_1[2] = local_30._4_4_ >> 0xe & 3; - param_1[5] = local_30._4_4_ >> 6 & 1; - param_1[4] = local_30._4_4_ >> 7 & 1; - } - else { - if (iVar1 != 0x117) { - return 0; - } - param_1[4] = local_30._4_4_ >> 7 & 1; - } - return 1; -} - ``` ## wil_RtlStagingConfig_RecordFeatureUsage ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_RtlStagingConfig_RecordFeatureUsage| |fullname|wil_RtlStagingConfig_RecordFeatureUsage| |refcount|2| |length|117| |called|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress
_guard_xfg_dispatch_icall_nop
wil_details_GetNtDllModuleHandle| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|3| |address|180004708| |sig|undefined8 __fastcall wil_RtlStagingConfig_RecordFeatureUsage(undefined8 param_1, undefined2 param_2, int param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_RtlStagingConfig_RecordFeatureUsage +++ wil_RtlStagingConfig_RecordFeatureUsage @@ -1,30 +0,0 @@ - -/* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ -/* WARNING: Exceeded maximum restarts with more pending */ - -undefined8 -wil_RtlStagingConfig_RecordFeatureUsage(undefined8 param_1,undefined2 param_2,int param_3) - -{ - uint6 uVar1; - HMODULE hModule; - undefined8 uVar2; - undefined8 local_res20; - - local_res20._0_6_ = CONCAT24(param_2,0x27f00f5); - uVar1 = (uint6)local_res20; - local_res20 = (ulonglong)(uint6)local_res20; - if (param_3 != 0) { - local_res20 = CONCAT26(1,uVar1); - } - if (g_wil_details_pfnRtlNotifyFeatureUsage == (FARPROC)0x0) { - hModule = (HMODULE)wil_details_GetNtDllModuleHandle(); - g_wil_details_pfnRtlNotifyFeatureUsage = GetProcAddress(hModule,"RtlNotifyFeatureUsage"); - if (g_wil_details_pfnRtlNotifyFeatureUsage == (FARPROC)0x0) { - return 0xc0000139; - } - } - uVar2 = (*g_wil_details_pfnRtlNotifyFeatureUsage)(&local_res20); - return uVar2; -} - ``` ## wil_details_FeatureReporting_IncrementOpportunityInCache ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementOpportunityInCache| |fullname|wil_details_FeatureReporting_IncrementOpportunityInCache| |refcount|2| |length|233| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|180004784| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(undefined8 param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementOpportunityInCache +++ wil_details_FeatureReporting_IncrementOpportunityInCache @@ -1,56 +0,0 @@ - -void wil_details_FeatureReporting_IncrementOpportunityInCache - (undefined8 param_1,uint param_2,undefined8 param_3,uint *param_4) - -{ - uint uVar1; - uint uVar2; - uint uVar3; - uint uVar4; - bool bVar5; - - uVar3 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - do { - uVar1 = uVar3; - param_4[1] = 0; - uVar2 = uVar1 | 1; - if ((uVar1 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) { - uVar3 = (uVar1 & 0x3f8000) >> 0xf; - if (uVar3 != 0) { - param_4[1] = uVar3; - uVar3 = 5; - if (param_2 != 1) { - uVar3 = 1; - } - uVar2 = uVar1 & 0xffc07fff | 1; - param_4[2] = uVar3; - } - uVar3 = 0; - if (param_2 == 5) { - uVar3 = 0x400000; - } - uVar2 = uVar3 | uVar2 & 0xffbfffff; - } - uVar3 = uVar2 >> 0xf & 0x7f; - uVar4 = uVar3 + 1; - if ((0x7f < uVar4) || (uVar4 < (uVar2 >> 0xf & 0x7f))) { - uVar4 = 1; - param_4[2] = param_2; - param_4[1] = uVar3; - } - LOCK(); - bVar5 = uVar1 != Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - uVar3 = uVar1; - uVar2 = uVar2 ^ (uVar4 << 0xf ^ uVar2) & 0x3f8000; - if (bVar5) { - uVar3 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - uVar2 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - } - Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting = uVar2; - UNLOCK(); - } while (bVar5); - param_4[4] = 0; - *param_4 = ~uVar1 & 1; - return; -} - ``` ## wil_details_FeatureReporting_IncrementUsageInCache ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementUsageInCache| |fullname|wil_details_FeatureReporting_IncrementUsageInCache| |refcount|2| |length|240| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|180004874| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(undefined8 param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementUsageInCache +++ wil_details_FeatureReporting_IncrementUsageInCache @@ -1,52 +0,0 @@ - -void wil_details_FeatureReporting_IncrementUsageInCache - (undefined8 param_1,uint param_2,undefined8 param_3,uint *param_4) - -{ - uint uVar1; - uint uVar2; - uint uVar3; - uint uVar4; - bool bVar5; - - uVar4 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - do { - uVar1 = uVar4; - param_4[1] = 0; - uVar2 = uVar1 | 1; - if ((uVar1 & 0x4000) >> 0xe != (uint)(param_2 == 4)) { - uVar4 = (uVar1 & 0x3fe0) >> 5; - if (uVar4 != 0) { - param_4[1] = uVar4; - param_4[2] = ~-(uint)(param_2 != 0) & 4; - uVar2 = uVar1 & 0xffffc01f | 1; - } - uVar4 = 0; - if (param_2 == 4) { - uVar4 = 0x4000; - } - uVar2 = uVar4 | uVar2 & 0xffffbfff; - } - uVar4 = uVar2 >> 5 & 0x1ff; - uVar3 = uVar4 + 1; - if ((0x1ff < uVar3) || (uVar3 < (uVar2 >> 5 & 0x1ff))) { - uVar3 = 1; - param_4[2] = param_2; - param_4[1] = uVar4; - } - LOCK(); - bVar5 = uVar1 != Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - uVar4 = uVar1; - uVar2 = uVar2 ^ (uVar3 << 5 ^ uVar2) & 0x3fe0; - if (bVar5) { - uVar4 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - uVar2 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - } - Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting = uVar2; - UNLOCK(); - } while (bVar5); - param_4[4] = 0; - *param_4 = ~uVar1 & 1; - return; -} - ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2| |length|337| |called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|3| |address|18000496c| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, undefined8 param_2, undefined8 param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -1,89 +0,0 @@ - -uint * wil_details_FeatureReporting_RecordUsageInCache - (uint *param_1,undefined8 param_2,undefined8 param_3) - -{ - uint uVar1; - uint uVar2; - uint uVar3; - uint uVar4; - uint uVar5; - bool bVar6; - - uVar3 = (uint)param_3; - param_1[0] = 0; - param_1[1] = 0; - param_1[2] = 0; - param_1[3] = 0; - param_1[4] = 0; - param_1[5] = 0; - if (uVar3 == 0) { -LAB_180004aa9: - wil_details_FeatureReporting_IncrementUsageInCache(param_1,uVar3,param_3,param_1); - } - else { - if (uVar3 == 1) { -LAB_180004a9c: - wil_details_FeatureReporting_IncrementOpportunityInCache(param_1,uVar3,param_3,param_1); - return param_1; - } - uVar4 = 0; - if ((uVar3 != 2) && (uVar3 != 3)) { - if (uVar3 == 4) goto LAB_180004aa9; - if (uVar3 == 5) goto LAB_180004a9c; - if ((uVar3 != 6) && (uVar3 != 7)) { - uVar5 = uVar3 - 0x140; - if (uVar5 < 0x40) { - uVar1 = DAT_18001986c; - do { - if (((uVar1 & 0x10) == 0) || (uVar2 = 1, (uVar1 >> 5 & 0x3f) != uVar5)) { - uVar2 = uVar4; - } - param_1[4] = uVar2; - LOCK(); - bVar6 = uVar1 != DAT_18001986c; - uVar2 = uVar1 & 0xfffff81f | (uVar5 & 0x3f) << 5 | 0x10; - if (bVar6) { - uVar1 = DAT_18001986c; - uVar2 = DAT_18001986c; - } - DAT_18001986c = uVar2; - UNLOCK(); - } while (bVar6); - } - param_1[2] = uVar3; - param_1[1] = 1; - param_1[3] = 0; - return param_1; - } - } - if (uVar3 == 2) { - uVar4 = 2; - } - else if (uVar3 == 3) { - uVar4 = 8; - } - else if (uVar3 == 6) { - uVar4 = 4; - } - else if (uVar3 == 7) { - uVar4 = 0x10; - } - uVar3 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - do { - LOCK(); - bVar6 = uVar3 != Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - uVar5 = uVar3 | uVar4 | 1; - if (bVar6) { - uVar3 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - uVar5 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting; - } - Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting = uVar5; - UNLOCK(); - } while (bVar6); - *param_1 = ~uVar3 & 1; - param_1[4] = (uint)((uVar4 & uVar3) == uVar4); - } - return param_1; -} - ``` ## wil_details_FeatureReporting_ReportUsageToService ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService| |refcount|2| |length|134| |called|_guard_xfg_dispatch_icall_nop
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled| |paramcount|6| |address|180004ac4| |sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, int param_3, int param_4, undefined8 param_5, uint param_6)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -1,29 +0,0 @@ - -/* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ - -void wil_details_FeatureReporting_ReportUsageToService - (undefined8 param_1,undefined8 param_2,int param_3,int param_4,undefined8 param_5, - uint param_6) - -{ - bool bVar1; - uint uVar2; - undefined7 extraout_var; - undefined8 uVar3; - ulonglong uVar4; - undefined4 local_res10 [6]; - - uVar4 = (ulonglong)param_6; - uVar3 = 3; - local_res10[0] = 3; - uVar2 = wil_details_MapReportingKind(3,param_6); - bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,uVar4,param_3,param_4,uVar2) - ; - if (((int)CONCAT71(extraout_var,bVar1) != 0) && (g_wil_details_pfnFeatureLoggingHook != 0)) { - (*(code *)g_wil_details_pfnFeatureLoggingHook) - (0x27f00f5,&Feature_Servicing_KeyIsoPaddingFix_41877749_logged_traits,0,param_6, - local_res10,0,0,1); - } - return; -} - ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2| |length|203| |called|__security_check_cookie
_guard_xfg_dispatch_icall_nop
wil_RtlStagingConfig_RecordFeatureUsage
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|5| |address|180004b54| |sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, int param_3, int param_4, uint param_5)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -1,40 +0,0 @@ - -/* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -bool wil_details_FeatureReporting_ReportUsageToServiceDirect - (undefined8 param_1,undefined8 param_2,int param_3,int param_4,uint param_5) - -{ - uint *puVar1; - uint *puVar2; - undefined1 auStack_78 [32]; - uint *local_58; - uint local_48 [6]; - uint local_30; - uint uStack_2c; - uint uStack_28; - uint uStack_24; - undefined8 local_20; - ulonglong local_18; - - local_18 = __security_cookie ^ (ulonglong)auStack_78; - puVar2 = local_48; - puVar1 = wil_details_FeatureReporting_RecordUsageInCache(puVar2,param_2,(ulonglong)param_5); - local_30 = *puVar1; - uStack_2c = puVar1[1]; - uStack_28 = puVar1[2]; - uStack_24 = puVar1[3]; - local_20 = *(undefined8 *)(puVar1 + 4); - if (g_wil_details_recordFeatureUsage != 0) { - local_58 = &local_30; - puVar2 = (uint *)0x27f00f5; - (*(code *)g_wil_details_recordFeatureUsage) - (0x27f00f5,param_5,1,&Feature_Servicing_KeyIsoPaddingFix_41877749__private_reporting); - } - if ((param_3 != 0) && (param_5 != 0xfe)) { - wil_RtlStagingConfig_RecordFeatureUsage(puVar2,(short)param_5,param_4); - } - return (int)local_20 == 0; -} - ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3| |length|265| |called|_guard_xfg_dispatch_icall_nop
wil_details_GetCurrentFeatureEnabledState| |calling|Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled
wil_details_GetCurrentFeatureEnabledState| |paramcount|3| |address|180004c28| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -1,65 +0,0 @@ - -/* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ - -ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - (uint *param_1,ulonglong param_2,longlong param_3) - -{ - int iVar1; - uint uVar2; - ulonglong uVar3; - uint uVar4; - uint uVar5; - ulonglong uVar6; - bool bVar7; - uint local_res8 [2]; - undefined8 local_res10; - - iVar1 = 0; - local_res10 = param_2; - if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != 0) { - iVar1 = (*(code *)g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); - } - uVar2 = wil_details_GetCurrentFeatureEnabledState(param_3,local_res8); - if (*(char *)(param_3 + 0x14) == '\0') { - local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0); - } - uVar3 = param_2 & 0xffffffff; - do { - uVar6 = param_2; - uVar5 = (uint)uVar3; - local_res10 = CONCAT44(local_res10._4_4_,uVar5); - if ((local_res8[0] != 0) && (local_res10 = CONCAT44(local_res10._4_4_,uVar5), (uVar3 & 1) == 0)) - { - uVar4 = (uVar5 ^ uVar2) & 0x278 ^ uVar5; - uVar5 = uVar4 | 1; - local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 1; - } - if ((uVar6 & 2) == 0) { - uVar4 = uVar5 ^ (uVar2 ^ uVar5) & 0x100; - uVar5 = uVar4 | 2; - local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 2; - } - uVar3 = uVar6 & 0xffffffff; - LOCK(); - uVar4 = *param_1; - bVar7 = (uint)uVar6 == uVar4; - if (bVar7) { - *param_1 = uVar5; - } - else { - uVar3 = (ulonglong)uVar4; - } - UNLOCK(); - param_2 = uVar3; - } while (!bVar7); - if (((uVar6 & 2) == 0) && (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != 0)) { - (*(code *)g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) - (param_1,*(undefined1 *)(param_3 + 0x14),iVar1); - } - if (local_res8[0] == 0) { - local_res10 = CONCAT44(local_res10._4_4_,uVar5 ^ (uVar2 ^ uVar5) & 0x278); - } - return local_res10; -} - ``` ## wil_details_GetCurrentFeatureEnabledState ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_details_GetCurrentFeatureEnabledState| |fullname|wil_details_GetCurrentFeatureEnabledState| |refcount|2| |length|308| |called|wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |paramcount|2| |address|180004d38| |sig|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_GetCurrentFeatureEnabledState +++ wil_details_GetCurrentFeatureEnabledState @@ -1,76 +0,0 @@ - -uint wil_details_GetCurrentFeatureEnabledState(longlong param_1,undefined4 *param_2) - -{ - char cVar1; - undefined8 *puVar2; - int iVar3; - ulonglong uVar4; - uint uVar5; - uint uVar6; - longlong *plVar7; - bool bVar8; - uint local_res8; - undefined4 uStackX_14; - uint local_28 [8]; - - cVar1 = *(char *)(param_1 + 0x14); - *param_2 = 1; - local_28[4] = 0; - local_28[5] = 0; - local_28[0] = 0; - local_28[1] = 0; - local_28[2] = 0; - local_28[3] = 0; - iVar3 = wil_RtlStagingConfig_QueryFeatureState - (local_28,*(undefined4 *)(param_1 + 0x10),(uint)((byte)(cVar1 - 2U) < 2)); - uVar6 = -(uint)(iVar3 != 0) & local_28[0] & 3; - if (uVar6 == 0) { - uVar5 = -(uint)(*(char *)(param_1 + 0x17) != '\0') & 0x10; - } - else { - uVar5 = 0; - if (local_28[0] == 2) { - uVar5 = 0x10; - } - } - local_res8 = uVar5 >> 1 | - uVar6 << 5 | -(uint)(local_28[5] != 0) & 0x200 | -(uint)(local_28[4] != 0) & 0x100 | - uVar5; - if ((uVar5 >> 1 != 0) && (plVar7 = *(longlong **)(param_1 + 0x18), plVar7 != (longlong *)0x0)) { - do { - puVar2 = (undefined8 *)*plVar7; - if (puVar2 == (undefined8 *)0x0) { - return local_res8; - } - if ((*(char *)((longlong)puVar2 + 0x16) == '\0') && - (*(char *)((longlong)puVar2 + 0x15) == '\0')) { - uVar6 = *(uint *)*puVar2; - if ((uVar6 & 1) == 0) { - uVar4 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - ((uint *)*puVar2,CONCAT44(uStackX_14,uVar6),(longlong)puVar2); - } - else { - uVar4 = CONCAT44(uStackX_14,uVar6); - } - if ((local_res8 & 8) == 0) goto LAB_180004e48; - bVar8 = (uVar4 & 8) == 0; -LAB_180004e3f: - if (bVar8) goto LAB_180004e48; - uVar6 = 8; - } - else { - if ((local_res8 & 8) != 0) { - bVar8 = *(char *)((longlong)puVar2 + 0x17) == '\0'; - goto LAB_180004e3f; - } -LAB_180004e48: - uVar6 = 0; - } - plVar7 = plVar7 + 1; - local_res8 = local_res8 & 0xfffffff7 | uVar6; - } while (uVar6 != 0); - } - return local_res8; -} - ``` ## wil_details_GetNtDllModuleHandle ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_details_GetNtDllModuleHandle| |fullname|wil_details_GetNtDllModuleHandle| |refcount|3| |length|47| |called|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW| |calling|wil_RtlStagingConfig_QueryFeatureState
wil_RtlStagingConfig_RecordFeatureUsage| |paramcount|0| |address|180004e74| |sig|undefined __fastcall wil_details_GetNtDllModuleHandle(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_GetNtDllModuleHandle +++ wil_details_GetNtDllModuleHandle @@ -1,10 +0,0 @@ - -void wil_details_GetNtDllModuleHandle(void) - -{ - if (g_wil_details_ntdllModuleHandle == (HMODULE)0x0) { - g_wil_details_ntdllModuleHandle = GetModuleHandleW(L"ntdll.dll"); - } - return; -} - ``` ## wil_details_MapReportingKind ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|wil_details_MapReportingKind| |fullname|wil_details_MapReportingKind| |refcount|1| |length|144| |called|| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|2| |address|180004eac| |sig|uint __fastcall wil_details_MapReportingKind(int param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_MapReportingKind +++ wil_details_MapReportingKind @@ -1,33 +0,0 @@ - -uint wil_details_MapReportingKind(int param_1,int param_2) - -{ - byte bVar1; - - if (param_1 != 0) { - if (param_1 == 1) { - return ~-(uint)(param_2 != 0) & 4; - } - if (param_1 == 2) { - return (-(uint)(param_2 != 0) & 0xfffffffc) + 5; - } - if (param_1 == 3) { - return (-(uint)(param_2 != 0) & 0xfffffffc) + 6; - } - if (param_1 == 4) { - return (-(uint)(param_2 != 0) & 0xfffffffc) + 7; - } - if (param_1 == 5) { - return (-(uint)(param_2 != 0) & 0xfffffffe) + 10; - } - if (param_1 == 6) { - return (-(uint)(param_2 != 0) & 0xfffffffe) + 0xb; - } - bVar1 = (char)param_1 + 0x9c; - if (bVar1 < 0x32) { - return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1; - } - } - return 0xff; -} - ``` ## FUN_1800060ec ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|FUN_1800060ec| |fullname|FUN_1800060ec| |refcount|3| |length|57| |called|DebugTraceError
NTDLL.DLL::RtlLeaveCriticalSection| |calling|SrvCryptImportKey| |paramcount|0| |address|1800060ec| |sig|undefined8 __fastcall FUN_1800060ec(void)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_1800060ec +++ FUN_1800060ec @@ -1,12 +0,0 @@ - -undefined8 FUN_1800060ec(void) - -{ - longlong unaff_RBP; - - RtlLeaveCriticalSection(unaff_RBP + 0x28); - DebugTraceError(0x80090026,"Status", - "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - return 0x80090026; -} - ``` ## API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW ### Function Meta |Key|keyiso-10.0.22621.819.dll| | :---: | :---: | |name|GetModuleHandleW| |fullname|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW| |refcount|2| |length|0| |called|| |calling|wil_details_GetNtDllModuleHandle| |paramcount|1| |address|EXTERNAL:00000040| |sig|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW* # Added # Modified *Modified functions contain code changes* ## SrvAddKeyToList ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.34| |i_ratio|0.39| |m_ratio|0.94| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvAddKeyToList|SrvAddKeyToList| |fullname|SrvAddKeyToList|SrvAddKeyToList| |refcount|2|2| |`length`|136|153| |called|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection| |calling|SrvCryptCreatePersistedKey|SrvCryptCreatePersistedKey| |paramcount|2|3| |`address`|18000cdd4|180001a0c| |`sig`|undefined8 __fastcall SrvAddKeyToList(longlong param_1, longlong param_2)|undefined8 __fastcall SrvAddKeyToList(longlong param_1, longlong param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvAddKeyToList Diff ```diff --- SrvAddKeyToList +++ SrvAddKeyToList @@ -1,37 +1,39 @@ -undefined8 SrvAddKeyToList(longlong param_1,longlong param_2) +undefined8 SrvAddKeyToList(longlong param_1,longlong param_2,undefined8 *param_3) { - code *pcVar1; - longlong *plVar2; + undefined8 uVar1; + code *pcVar2; longlong lVar3; - longlong *plVar4; - undefined1 *puVar5; + undefined1 *puVar4; + longlong *plVar5; + longlong *plVar6; undefined1 auStack_28 [8]; undefined1 auStack_20 [24]; - puVar5 = auStack_28; + puVar4 = auStack_28; RtlEnterCriticalSection(param_1 + 0x68); *(longlong *)(param_1 + 0xa0) = *(longlong *)(param_1 + 0xa0) + 1; - plVar4 = (longlong *)(param_1 + 0x90); - *(undefined8 *)(param_2 + 0x30) = *(undefined8 *)(param_1 + 0xa0); - plVar2 = (longlong *)(param_2 + 0x10); - lVar3 = *plVar4; - if (*(longlong **)(lVar3 + 8) != plVar4) { - lVar3 = 3; - pcVar1 = (code *)swi(0x29); - plVar2 = (longlong *)(*pcVar1)(); - puVar5 = auStack_20; + uVar1 = *(undefined8 *)(param_1 + 0xa0); + *(undefined8 *)(param_2 + 0x30) = uVar1; + *param_3 = uVar1; + LOCK(); + *(longlong *)(param_2 + 8) = *(longlong *)(param_2 + 8) + 1; + UNLOCK(); + plVar5 = (longlong *)(param_1 + 0x90); + plVar6 = (longlong *)(param_2 + 0x10); + lVar3 = *plVar5; + if (*(longlong **)(lVar3 + 8) != plVar5) { + pcVar2 = (code *)swi(0x29); + lVar3 = (*pcVar2)(3); + puVar4 = auStack_20; } - *plVar2 = lVar3; - plVar2[1] = (longlong)plVar4; - *(longlong **)(lVar3 + 8) = plVar2; - *plVar4 = (longlong)plVar2; - *(undefined8 *)(puVar5 + -8) = 0x18000ce41; + *plVar6 = lVar3; + *(longlong **)(param_2 + 0x18) = plVar5; + *(longlong **)(lVar3 + 8) = plVar6; + *plVar5 = (longlong)plVar6; + *(undefined8 *)(puVar4 + -8) = 0x180001a89; RtlLeaveCriticalSection(param_1 + 0x68); - LOCK(); - *(int *)(param_2 + 8) = *(int *)(param_2 + 8) + 1; - UNLOCK(); return 0; } ``` ## SrvCryptImportKey ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,called| |ratio|0.06| |i_ratio|0.21| |m_ratio|1.0| |b_ratio|0.2| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvCryptImportKey|SrvCryptImportKey| |fullname|SrvCryptImportKey|SrvCryptImportKey| |`refcount`|5|4| |`length`|1007|929| |`called`|
Expand for full list:
DebugTraceError
FUN_1800060ec
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlFreeHeap
NTDLL.DLL::RtlLeaveCriticalSection
NormalizeNteStatus
SrvDereferenceKey
SrvFreeProvider
SrvLookupAndReferenceKey
_FreeBufferDesc_MapRPCToBufferDesc
_guard_xfg_dispatch_icall_nop
|
Expand for full list:
DebugTraceError
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NormalizeNteStatus
SrvCryptLocalFree
SrvDereferenceKey
SrvFreeProvider
SrvLookupAndReferenceKey
_FreeBufferDesc
_MapRPCToBufferDesc_guard_xfg_dispatch_icall_nop
| |calling|s_SrvRpcCryptImportKey|s_SrvRpcCryptImportKey| |paramcount|9|9| |`address`|180002200|180002630| |`sig`|char * __fastcall SrvCryptImportKey(longlong param_1, longlong param_2, longlong param_3, char * param_4, undefined4 * param_5, undefined8 * param_6, longlong param_7, int param_8, undefined4 param_9)|longlong * __fastcall SrvCryptImportKey(longlong param_1, longlong param_2, longlong param_3, char * param_4, undefined4 * param_5, undefined8 * param_6, longlong param_7, int param_8, undefined4 param_9)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvCryptImportKey Called Diff ```diff --- SrvCryptImportKey called +++ SrvCryptImportKey called @@ -2 +1,0 @@ -FUN_1800060ec @@ -5 +3,0 @@ -NTDLL.DLL::RtlFreeHeap @@ -7,0 +6 @@ +SrvCryptLocalFree ``` ### SrvCryptImportKey Diff ```diff --- SrvCryptImportKey +++ SrvCryptImportKey @@ -1,254 +1,201 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ -char * SrvCryptImportKey(longlong param_1,longlong param_2,longlong param_3,char *param_4, - undefined4 *param_5,undefined8 *param_6,longlong param_7,int param_8, - undefined4 param_9) +longlong * +SrvCryptImportKey(longlong param_1,longlong param_2,longlong param_3,char *param_4, + undefined4 *param_5,undefined8 *param_6,longlong param_7,int param_8, + undefined4 param_9) { - longlong *plVar1; - longlong *plVar2; - longlong lVar3; - undefined8 uVar4; - code *pcVar5; - uint uVar6; - longlong *plVar7; - char *pcVar8; + undefined8 uVar1; + code *pcVar2; + bool bVar3; + uint uVar4; + longlong *plVar5; + longlong *plVar6; + undefined8 *puVar7; + longlong lVar8; undefined4 uVar9; char *pcVar10; - undefined1 *puVar11; + longlong *plVar11; undefined1 *puVar12; longlong *plVar13; - char *pcVar14; - undefined4 *local_res8; - undefined1 auStack_98 [8]; - undefined1 auStack_90 [24]; - char *local_78; - longlong local_70; - int local_68; - undefined4 local_60; - ulonglong local_48; + longlong *plVar14; + longlong *plVar15; + undefined1 auStack_88 [8]; + undefined1 auStack_80 [24]; + undefined8 *local_68; + longlong local_60; + int local_58; + undefined4 local_50; - puVar11 = auStack_98; - puVar12 = auStack_98; - pcVar14 = (char *)0x0; - local_48 = 0; - local_res8 = (undefined4 *)0x0; - if (param_1 == 0) goto LAB_0; + puVar12 = auStack_88; + plVar11 = (longlong *)0x0; + if (param_1 == 0) { +LAB_0: + DebugTraceError(0x80090026,"Status", + "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); + return (longlong *)0x80090026; + } + bVar3 = false; RtlEnterCriticalSection(param_1 + 0x28); - plVar7 = *(longlong **)(param_1 + 0x50); + plVar5 = *(longlong **)(param_1 + 0x50); + plVar15 = plVar11; if (*(longlong **)(param_1 + 0x50) != (longlong *)(param_1 + 0x50)) { - while( true ) { - plVar1 = plVar7 + -2; - plVar2 = (longlong *)*plVar7; - if (plVar7[0x29] == param_2) break; - plVar7 = plVar2; - if (plVar2 == (longlong *)(param_1 + 0x50)) { - pcVar14 = (char *)FUN_1800060ec(); - return pcVar14; - } - } - if ((int)*plVar1 == 0x44444446) { - LOCK(); - *(int *)(plVar7 + -1) = (int)plVar7[-1] + 1; - UNLOCK(); - RtlLeaveCriticalSection(param_1 + 0x28); - if (plVar1 == (longlong *)0x0) goto LAB_0; - if ((param_3 != 0) && (local_48 = SrvLookupAndReferenceKey(param_1,param_3,0), local_48 == 0)) - { + do { + plVar15 = plVar5 + -2; + plVar6 = (longlong *)*plVar5; + if (plVar5[0x29] == param_2) { + if ((int)*plVar15 == 0x44444446) { + LOCK(); + plVar5[-1] = plVar5[-1] + 1; + UNLOCK(); + bVar3 = true; + } + goto LAB_1; + } + plVar5 = plVar6; + } while (plVar6 != (longlong *)(param_1 + 0x50)); + RtlLeaveCriticalSection(param_1 + 0x28); + goto LAB_0; + } +LAB_1: + RtlLeaveCriticalSection(param_1 + 0x28); + if (!bVar3) { + plVar15 = plVar11; + } + if (plVar15 == (longlong *)0x0) goto LAB_0; + plVar5 = plVar11; + if ((param_3 != 0) && + (plVar5 = (longlong *)SrvLookupAndReferenceKey(param_1,param_3,0), plVar5 == (longlong *)0x0)) + { + param_4 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + pcVar10 = "Status"; + plVar11 = (longlong *)0x80090026; + DebugTraceError(0x80090026,"Status", + "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); + puVar12 = auStack_88; + goto LAB_2; + } + if ((param_6 == (undefined8 *)0x0) || ((param_7 == 0 || (param_8 == 0)))) { + plVar11 = (longlong *)0x80090027; + uVar9 = 0x80090027; +LAB_3: + param_4 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + pcVar10 = "Status"; + DebugTraceError(uVar9,"Status", + "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); + puVar12 = auStack_88; + } + else { + plVar6 = plVar11; + if ((param_5 != (undefined4 *)0x0) && + (plVar6 = (longlong *)_MapRPCToBufferDesc(param_5), plVar6 == (longlong *)0x0)) { + plVar11 = (longlong *)0x8009000e; + uVar9 = 0x8009000e; + goto LAB_3; + } + puVar7 = (undefined8 *) + RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,0x38); + if (puVar7 == (undefined8 *)0x0) { + param_4 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + pcVar10 = "Status"; + plVar11 = (longlong *)0x8009000e; + DebugTraceError(0x8009000e,"Status", + "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); + puVar12 = auStack_88; + } + else { + *puVar7 = 0; + puVar7[1] = 0; + puVar7[2] = 0; + puVar7[3] = 0; + puVar7[4] = 0; + puVar7[5] = 0; + puVar7[6] = 0; + pcVar10 = (char *)plVar11; + if (param_3 != 0) { + pcVar10 = (char *)plVar5[5]; + } + local_68 = puVar7 + 5; + local_50 = param_9; + local_58 = param_8; + local_60 = param_7; + uVar4 = (*(code *)plVar15[0x17])(plVar15[0x23],pcVar10,param_4,plVar6); + if (uVar4 == 0) { + *puVar7 = 0x44444447; + puVar7[1] = 1; + LOCK(); + plVar15[1] = plVar15[1] + 1; + UNLOCK(); + puVar7[4] = plVar15; + RtlEnterCriticalSection(param_1 + 0x68); + *(longlong *)(param_1 + 0xa0) = *(longlong *)(param_1 + 0xa0) + 1; + uVar1 = *(undefined8 *)(param_1 + 0xa0); + puVar7[6] = uVar1; + *param_6 = uVar1; + LOCK(); + puVar7[1] = puVar7[1] + 1; + UNLOCK(); + plVar13 = (longlong *)(param_1 + 0x90); + plVar14 = puVar7 + 2; + lVar8 = *plVar13; + puVar12 = auStack_88; + if (*(longlong **)(lVar8 + 8) != plVar13) { + pcVar2 = (code *)swi(0x29); + lVar8 = (*pcVar2)(3); + puVar12 = auStack_80; + } + *plVar14 = lVar8; + puVar7[3] = plVar13; + *(longlong **)(lVar8 + 8) = plVar14; + *plVar13 = (longlong)plVar14; + *(undefined8 *)(puVar12 + -8) = 0x180002936; + RtlLeaveCriticalSection(param_1 + 0x68); + puVar7 = (undefined8 *)0x0; + } + else { param_4 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; pcVar10 = "Status"; - pcVar14 = (char *)0x80090026; - DebugTraceError(0x80090026,"Status", + DebugTraceError(uVar4,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - puVar11 = auStack_98; - goto LAB_1; - } - if ((param_6 == (undefined8 *)0x0) || ((param_7 == 0 || (param_8 == 0)))) { - pcVar14 = (char *)0x80090027; - uVar9 = 0x80090027; + uVar4 = NormalizeNteStatus(uVar4); + plVar11 = (longlong *)(ulonglong)uVar4; + } + } + if (plVar6 != (longlong *)0x0) { + *(undefined8 *)(puVar12 + -8) = 0x18000294b; + _FreeBufferDesc((longlong)plVar6); + } + if (puVar7 != (undefined8 *)0x0) { + *(undefined8 *)(puVar12 + -8) = 0x180002958; + SrvCryptLocalFree((undefined1 *)puVar7); + } + } + if (plVar5 != (longlong *)0x0) { + *(undefined8 *)(puVar12 + -8) = 0x18000298a; + uVar4 = SrvDereferenceKey((undefined1 *)plVar5,pcVar10,param_4); + if (((int)uVar4 < 0) && (-1 < (int)plVar11)) { + plVar11 = (longlong *)(ulonglong)uVar4; + } + } LAB_2: - param_4 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar10 = "Status"; - DebugTraceError(uVar9,"Status", - "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - } - else { - if ((param_5 != (undefined4 *)0x0) && - (local_res8 = _MapRPCToBufferDesc(param_5), local_res8 == (undefined4 *)0x0)) { - pcVar14 = (char *)0x8009000e; - uVar9 = 0x8009000e; - goto LAB_2; - } - pcVar8 = (char *)RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0 - ,0x38); - if (pcVar8 == (char *)0x0) { - param_4 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar10 = "Status"; - pcVar14 = (char *)0x8009000e; - DebugTraceError(0x8009000e,"Status", - "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); -LAB_3: - puVar11 = auStack_98; - if (local_res8 != (undefined4 *)0x0) goto LAB_4; - } - else { - pcVar8[0] = '\0'; - pcVar8[1] = '\0'; - pcVar8[2] = '\0'; - pcVar8[3] = '\0'; - pcVar8[4] = '\0'; - pcVar8[5] = '\0'; - pcVar8[6] = '\0'; - pcVar8[7] = '\0'; - pcVar8[8] = '\0'; - pcVar8[9] = '\0'; - pcVar8[10] = '\0'; - pcVar8[0xb] = '\0'; - pcVar8[0xc] = '\0'; - pcVar8[0xd] = '\0'; - pcVar8[0xe] = '\0'; - pcVar8[0xf] = '\0'; - pcVar8[0x10] = '\0'; - pcVar8[0x11] = '\0'; - pcVar8[0x12] = '\0'; - pcVar8[0x13] = '\0'; - pcVar8[0x14] = '\0'; - pcVar8[0x15] = '\0'; - pcVar8[0x16] = '\0'; - pcVar8[0x17] = '\0'; - pcVar8[0x18] = '\0'; - pcVar8[0x19] = '\0'; - pcVar8[0x1a] = '\0'; - pcVar8[0x1b] = '\0'; - pcVar8[0x1c] = '\0'; - pcVar8[0x1d] = '\0'; - pcVar8[0x1e] = '\0'; - pcVar8[0x1f] = '\0'; - pcVar8[0x20] = '\0'; - pcVar8[0x21] = '\0'; - pcVar8[0x22] = '\0'; - pcVar8[0x23] = '\0'; - pcVar8[0x24] = '\0'; - pcVar8[0x25] = '\0'; - pcVar8[0x26] = '\0'; - pcVar8[0x27] = '\0'; - pcVar8[0x28] = '\0'; - pcVar8[0x29] = '\0'; - pcVar8[0x2a] = '\0'; - pcVar8[0x2b] = '\0'; - pcVar8[0x2c] = '\0'; - pcVar8[0x2d] = '\0'; - pcVar8[0x2e] = '\0'; - pcVar8[0x2f] = '\0'; - pcVar8[0x30] = '\0'; - pcVar8[0x31] = '\0'; - pcVar8[0x32] = '\0'; - pcVar8[0x33] = '\0'; - pcVar8[0x34] = '\0'; - pcVar8[0x35] = '\0'; - pcVar8[0x36] = '\0'; - pcVar8[0x37] = '\0'; - pcVar10 = pcVar14; - if (param_3 != 0) { - pcVar10 = *(char **)(local_48 + 0x28); - } - local_78 = pcVar8 + 0x28; - local_60 = param_9; - local_68 = param_8; - local_70 = param_7; - uVar6 = (*(code *)plVar7[0x15])(plVar7[0x21],pcVar10,param_4,local_res8); - if (uVar6 != 0) { - param_4 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar10 = "Status"; - DebugTraceError(uVar6,"Status", - "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - uVar6 = NormalizeNteStatus(uVar6); - pcVar14 = (char *)(ulonglong)uVar6; - goto LAB_3; - } - pcVar8[0] = 'G'; - pcVar8[1] = 'D'; - pcVar8[2] = 'D'; - pcVar8[3] = 'D'; - pcVar8[4] = '\0'; - pcVar8[5] = '\0'; - pcVar8[6] = '\0'; - pcVar8[7] = '\0'; - pcVar8[8] = '\x01'; - pcVar8[9] = '\0'; - pcVar8[10] = '\0'; - pcVar8[0xb] = '\0'; - *(longlong **)(pcVar8 + 0x20) = plVar1; - LOCK(); - *(int *)(plVar7 + -1) = (int)plVar7[-1] + 1; - UNLOCK(); - RtlEnterCriticalSection(param_1 + 0x68); - *(longlong *)(param_1 + 0xa0) = *(longlong *)(param_1 + 0xa0) + 1; - plVar13 = (longlong *)(param_1 + 0x90); - *(undefined8 *)(pcVar8 + 0x30) = *(undefined8 *)(param_1 + 0xa0); - plVar2 = (longlong *)(pcVar8 + 0x10); - lVar3 = *plVar13; - if (*(longlong **)(lVar3 + 8) == plVar13) { - *plVar2 = lVar3; - *(longlong **)(pcVar8 + 0x18) = plVar13; - *(longlong **)(lVar3 + 8) = plVar2; - *plVar13 = (longlong)plVar2; - RtlLeaveCriticalSection(param_1 + 0x68); - LOCK(); - *(int *)(pcVar8 + 8) = *(int *)(pcVar8 + 8) + 1; - UNLOCK(); - *param_6 = *(undefined8 *)(pcVar8 + 0x30); - pcVar8 = pcVar14; - goto LAB_3; - } - pcVar5 = (code *)swi(0x29); - (*pcVar5)(3); - puVar12 = auStack_90; -LAB_4: - *(undefined8 *)(puVar12 + -8) = 0x180006060; - _FreeBufferDesc((longlong)local_res8); - puVar11 = puVar12; - } - if (pcVar8 != (char *)0x0) { - pcVar10 = (char *)0x0; - uVar4 = *(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30); - *(undefined8 *)(puVar11 + -8) = 0x18000607f; - RtlFreeHeap(uVar4); - param_4 = pcVar8; - } - } - if (*(undefined1 **)(puVar11 + 0x50) != (undefined1 *)0x0) { - *(undefined8 *)(puVar11 + -8) = 0x1800060bb; - uVar6 = SrvDereferenceKey(*(undefined1 **)(puVar11 + 0x50),pcVar10,param_4); - if (((int)uVar6 < 0) && (-1 < (int)pcVar14)) { - pcVar14 = (char *)(ulonglong)uVar6; - } - } -LAB_1: - LOCK(); - plVar7 = plVar7 + -1; - lVar3 = *plVar7; - *(int *)plVar7 = (int)*plVar7 + -1; - UNLOCK(); - if ((int)lVar3 != 1) { - return pcVar14; - } - *(undefined8 *)(puVar11 + -8) = 0x1800060d5; - uVar6 = SrvFreeProvider((undefined1 *)plVar1,pcVar10,param_4); - if (-1 < (int)uVar6) { - return pcVar14; - } - if ((int)pcVar14 < 0) { - return pcVar14; - } - return (char *)(ulonglong)uVar6; - } - } - RtlLeaveCriticalSection(param_1 + 0x28); -LAB_0: - DebugTraceError(0x80090026,"Status", - "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - return (char *)0x80090026; + LOCK(); + plVar5 = plVar15 + 1; + lVar8 = *plVar5; + *plVar5 = *plVar5 + -1; + UNLOCK(); + if (lVar8 != 1) { + return plVar11; + } + *(undefined8 *)(puVar12 + -8) = 0x1800029ae; + uVar4 = SrvFreeProvider((undefined1 *)plVar15,pcVar10,param_4); + if (-1 < (int)uVar4) { + return plVar11; + } + if ((int)plVar11 < 0) { + return plVar11; + } + return (longlong *)(ulonglong)uVar4; } ``` ## SrvCryptCreatePersistedKey ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.41| |i_ratio|0.63| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvCryptCreatePersistedKey|SrvCryptCreatePersistedKey| |fullname|SrvCryptCreatePersistedKey|SrvCryptCreatePersistedKey| |refcount|4|4| |`length`|500|471| |`called`|DebugTraceError
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlFreeHeap
NormalizeNteStatus
SrvAddKeyToList
SrvDereferenceProvider
SrvLookupAndReferenceProvider
_guard_xfg_dispatch_icall_nop|DebugTraceError
NTDLL.DLL::RtlAllocateHeap
NormalizeNteStatus
SrvAddKeyToList
SrvCryptLocalFree
SrvDereferenceProvider
SrvLookupAndReferenceProvider
_guard_xfg_dispatch_icall_nop| |calling|s_SrvRpcCryptCreatePersistedKey|s_SrvRpcCryptCreatePersistedKey| |paramcount|7|7| |`address`|180008000|180007870| |sig|uint __fastcall SrvCryptCreatePersistedKey(longlong param_1, longlong param_2, undefined8 * param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, undefined4 param_7)|uint __fastcall SrvCryptCreatePersistedKey(longlong param_1, longlong param_2, undefined8 * param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, undefined4 param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvCryptCreatePersistedKey Called Diff ```diff --- SrvCryptCreatePersistedKey called +++ SrvCryptCreatePersistedKey called @@ -3 +2,0 @@ -NTDLL.DLL::RtlFreeHeap @@ -5,0 +5 @@ +SrvCryptLocalFree ``` ### SrvCryptCreatePersistedKey Diff ```diff --- SrvCryptCreatePersistedKey +++ SrvCryptCreatePersistedKey @@ -1,134 +1,76 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ uint SrvCryptCreatePersistedKey (longlong param_1,longlong param_2,undefined8 *param_3,undefined8 param_4, undefined8 param_5,undefined4 param_6,undefined4 param_7) { uint uVar1; uint uVar2; undefined1 *puVar3; - undefined4 uVar4; - char *pcVar5; + undefined8 *puVar4; + undefined4 uVar5; char *pcVar6; + char *pcVar7; if ((param_1 == 0) || (puVar3 = (undefined1 *)SrvLookupAndReferenceProvider(param_1,param_2,0), puVar3 == (undefined1 *)0x0)) { DebugTraceError(0x80090026,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); uVar2 = 0x80090026; goto LAB_0; } if (param_3 == (undefined8 *)0x0) { uVar1 = 0x80090027; - uVar4 = 0x80090027; + uVar5 = 0x80090027; LAB_1: - pcVar5 = "Status"; - pcVar6 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - DebugTraceError(uVar4,"Status", + pcVar6 = "Status"; + pcVar7 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + DebugTraceError(uVar5,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); } else { - pcVar6 = (char *)RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0, - 0x38); - if (pcVar6 == (char *)0x0) { + puVar4 = (undefined8 *) + RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,0x38); + if (puVar4 == (undefined8 *)0x0) { uVar1 = 0x8009000e; - uVar4 = 0x8009000e; + uVar5 = 0x8009000e; goto LAB_1; } - pcVar6[0] = '\0'; - pcVar6[1] = '\0'; - pcVar6[2] = '\0'; - pcVar6[3] = '\0'; - pcVar6[4] = '\0'; - pcVar6[5] = '\0'; - pcVar6[6] = '\0'; - pcVar6[7] = '\0'; - pcVar6[8] = '\0'; - pcVar6[9] = '\0'; - pcVar6[10] = '\0'; - pcVar6[0xb] = '\0'; - pcVar6[0xc] = '\0'; - pcVar6[0xd] = '\0'; - pcVar6[0xe] = '\0'; - pcVar6[0xf] = '\0'; - pcVar6[0x10] = '\0'; - pcVar6[0x11] = '\0'; - pcVar6[0x12] = '\0'; - pcVar6[0x13] = '\0'; - pcVar6[0x14] = '\0'; - pcVar6[0x15] = '\0'; - pcVar6[0x16] = '\0'; - pcVar6[0x17] = '\0'; - pcVar6[0x18] = '\0'; - pcVar6[0x19] = '\0'; - pcVar6[0x1a] = '\0'; - pcVar6[0x1b] = '\0'; - pcVar6[0x1c] = '\0'; - pcVar6[0x1d] = '\0'; - pcVar6[0x1e] = '\0'; - pcVar6[0x1f] = '\0'; - pcVar6[0x20] = '\0'; - pcVar6[0x21] = '\0'; - pcVar6[0x22] = '\0'; - pcVar6[0x23] = '\0'; - pcVar6[0x24] = '\0'; - pcVar6[0x25] = '\0'; - pcVar6[0x26] = '\0'; - pcVar6[0x27] = '\0'; - pcVar6[0x28] = '\0'; - pcVar6[0x29] = '\0'; - pcVar6[0x2a] = '\0'; - pcVar6[0x2b] = '\0'; - pcVar6[0x2c] = '\0'; - pcVar6[0x2d] = '\0'; - pcVar6[0x2e] = '\0'; - pcVar6[0x2f] = '\0'; - pcVar6[0x30] = '\0'; - pcVar6[0x31] = '\0'; - pcVar6[0x32] = '\0'; - pcVar6[0x33] = '\0'; - pcVar6[0x34] = '\0'; - pcVar6[0x35] = '\0'; - pcVar6[0x36] = '\0'; - pcVar6[0x37] = '\0'; + *puVar4 = 0; + puVar4[1] = 0; + puVar4[2] = 0; + puVar4[3] = 0; + puVar4[4] = 0; + puVar4[5] = 0; + puVar4[6] = 0; uVar1 = (**(code **)(puVar3 + 0x40)) - (*(undefined8 *)(puVar3 + 0x118),pcVar6 + 0x28,param_4,param_5,param_6,param_7 - ); + (*(undefined8 *)(puVar3 + 0x118),puVar4 + 5,param_4,param_5,param_6,param_7); if (uVar1 == 0) { - pcVar6[4] = '\0'; - pcVar6[5] = '\0'; - pcVar6[6] = '\0'; - pcVar6[7] = '\0'; - pcVar6[0] = 'G'; - pcVar6[1] = 'D'; - pcVar6[2] = 'D'; - pcVar6[3] = 'D'; - pcVar6[8] = '\x01'; - pcVar6[9] = '\0'; - pcVar6[10] = '\0'; - pcVar6[0xb] = '\0'; - *(undefined1 **)(pcVar6 + 0x20) = puVar3; - SrvAddKeyToList(param_1,(longlong)pcVar6); - *param_3 = *(undefined8 *)(pcVar6 + 0x30); + *(undefined4 *)((longlong)puVar4 + 4) = 0; + *(undefined4 *)puVar4 = 0x44444447; + puVar4[1] = 1; + puVar4[4] = puVar3; + SrvAddKeyToList(param_1,(longlong)puVar4,param_3); return 0; } + pcVar7 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; DebugTraceError(uVar1,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - if (*(longlong *)(pcVar6 + 0x28) != 0) { + pcVar6 = (char *)puVar4[5]; + if (pcVar6 != (char *)0x0) { (**(code **)(puVar3 + 0x80))(*(undefined8 *)(puVar3 + 0x118)); } - pcVar5 = (char *)0x0; - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30)); + SrvCryptLocalFree((undefined1 *)puVar4); } - uVar2 = SrvDereferenceProvider(puVar3,pcVar5,pcVar6); + uVar2 = SrvDereferenceProvider(puVar3,pcVar6,pcVar7); if (((-1 < (int)uVar2) || ((int)uVar1 < 0)) && (uVar2 = uVar1, uVar1 == 0)) { return 0; } LAB_0: uVar2 = NormalizeNteStatus(uVar2); return uVar2; } ``` ## SrvCryptSecretAgreement ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.22| |i_ratio|0.57| |m_ratio|0.97| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvCryptSecretAgreement|SrvCryptSecretAgreement| |fullname|SrvCryptSecretAgreement|SrvCryptSecretAgreement| |refcount|4|4| |`length`|550|514| |`called`|DebugTraceError
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlFreeHeap
NormalizeNteStatus
SrvAddSecretToList
SrvDereferenceKey
SrvLookupAndReferenceKey
_guard_xfg_dispatch_icall_nop|DebugTraceError
NTDLL.DLL::RtlAllocateHeap
NormalizeNteStatus
SrvAddSecretToList
SrvCryptLocalFree
SrvDereferenceKey
SrvLookupAndReferenceKey
_guard_xfg_dispatch_icall_nop| |calling|s_SrvRpcCryptSecretAgreement|s_SrvRpcCryptSecretAgreement| |paramcount|6|6| |`address`|1800098f0|180009130| |`sig`|uint __fastcall SrvCryptSecretAgreement(longlong param_1, undefined8 param_2, longlong param_3, longlong param_4, undefined8 * param_5, undefined4 param_6)|uint __fastcall SrvCryptSecretAgreement(longlong param_1, undefined8 param_2, longlong param_3, longlong param_4, char * param_5, undefined4 param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvCryptSecretAgreement Called Diff ```diff --- SrvCryptSecretAgreement called +++ SrvCryptSecretAgreement called @@ -3 +2,0 @@ -NTDLL.DLL::RtlFreeHeap @@ -5,0 +5 @@ +SrvCryptLocalFree ``` ### SrvCryptSecretAgreement Diff ```diff --- SrvCryptSecretAgreement +++ SrvCryptSecretAgreement @@ -1,161 +1,164 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ uint SrvCryptSecretAgreement - (longlong param_1,undefined8 param_2,longlong param_3,longlong param_4, - undefined8 *param_5,undefined4 param_6) + (longlong param_1,undefined8 param_2,longlong param_3,longlong param_4,char *param_5, + undefined4 param_6) { - char *pcVar1; - longlong lVar2; + longlong lVar1; + uint uVar2; uint uVar3; - uint uVar4; + undefined1 *puVar4; undefined1 *puVar5; - undefined1 *puVar6; - char *pcVar7; - undefined4 uVar8; + char *pcVar6; + undefined4 uVar7; + char *pcVar8; char *pcVar9; - char *pcVar10; - pcVar7 = (char *)0x0; + pcVar9 = (char *)0x0; if ((param_1 == 0) || - (puVar5 = (undefined1 *)SrvLookupAndReferenceKey(param_1,param_3,0), - puVar5 == (undefined1 *)0x0)) { + (puVar4 = (undefined1 *)SrvLookupAndReferenceKey(param_1,param_3,0), + puVar4 == (undefined1 *)0x0)) { DebugTraceError(0x80090026,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); return 0x80090026; } - puVar6 = (undefined1 *)SrvLookupAndReferenceKey(param_1,param_4,0); - if (puVar6 == (undefined1 *)0x0) { - pcVar10 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar9 = "Status"; + puVar5 = (undefined1 *)SrvLookupAndReferenceKey(param_1,param_4,0); + if (puVar5 == (undefined1 *)0x0) { + param_5 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + pcVar8 = "Status"; DebugTraceError(0x80090026,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - uVar3 = 0x80090026; + uVar2 = 0x80090026; goto LAB_0; } - lVar2 = *(longlong *)(puVar5 + 0x20); - if (param_5 == (undefined8 *)0x0) { - uVar3 = 0x80090027; - uVar8 = 0x80090027; + lVar1 = *(longlong *)(puVar4 + 0x20); + if (param_5 == (char *)0x0) { + uVar2 = 0x80090027; + uVar7 = 0x80090027; + pcVar6 = pcVar9; LAB_1: - pcVar9 = "Status"; - pcVar10 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - DebugTraceError(uVar8,"Status", + pcVar8 = "Status"; + param_5 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + DebugTraceError(uVar7,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); + pcVar9 = pcVar6; } else { - pcVar7 = (char *)RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0, + pcVar6 = (char *)RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0, 0x38); - if (pcVar7 == (char *)0x0) { - uVar3 = 0x8009000e; - uVar8 = 0x8009000e; + if (pcVar6 == (char *)0x0) { + uVar2 = 0x8009000e; + uVar7 = 0x8009000e; goto LAB_1; } - pcVar7[0] = '\0'; - pcVar7[1] = '\0'; - pcVar7[2] = '\0'; - pcVar7[3] = '\0'; - pcVar7[4] = '\0'; - pcVar7[5] = '\0'; - pcVar7[6] = '\0'; - pcVar7[7] = '\0'; - pcVar7[8] = '\0'; - pcVar7[9] = '\0'; - pcVar7[10] = '\0'; - pcVar7[0xb] = '\0'; - pcVar7[0xc] = '\0'; - pcVar7[0xd] = '\0'; - pcVar7[0xe] = '\0'; - pcVar7[0xf] = '\0'; - pcVar7[0x10] = '\0'; - pcVar7[0x11] = '\0'; - pcVar7[0x12] = '\0'; - pcVar7[0x13] = '\0'; - pcVar7[0x14] = '\0'; - pcVar7[0x15] = '\0'; - pcVar7[0x16] = '\0'; - pcVar7[0x17] = '\0'; - pcVar7[0x18] = '\0'; - pcVar7[0x19] = '\0'; - pcVar7[0x1a] = '\0'; - pcVar7[0x1b] = '\0'; - pcVar7[0x1c] = '\0'; - pcVar7[0x1d] = '\0'; - pcVar7[0x1e] = '\0'; - pcVar7[0x1f] = '\0'; - pcVar7[0x20] = '\0'; - pcVar7[0x21] = '\0'; - pcVar7[0x22] = '\0'; - pcVar7[0x23] = '\0'; - pcVar7[0x24] = '\0'; - pcVar7[0x25] = '\0'; - pcVar7[0x26] = '\0'; - pcVar7[0x27] = '\0'; - pcVar7[0x28] = '\0'; - pcVar7[0x29] = '\0'; - pcVar7[0x2a] = '\0'; - pcVar7[0x2b] = '\0'; - pcVar7[0x2c] = '\0'; - pcVar7[0x2d] = '\0'; - pcVar7[0x2e] = '\0'; - pcVar7[0x2f] = '\0'; - pcVar7[0x30] = '\0'; - pcVar7[0x31] = '\0'; - pcVar7[0x32] = '\0'; - pcVar7[0x33] = '\0'; - pcVar7[0x34] = '\0'; - pcVar7[0x35] = '\0'; - pcVar7[0x36] = '\0'; - pcVar7[0x37] = '\0'; - pcVar10 = *(char **)(puVar6 + 0x28); - uVar3 = (**(code **)(lVar2 + 0xe8)) - (*(undefined8 *)(lVar2 + 0x118),*(undefined8 *)(puVar5 + 0x28),pcVar10, - pcVar7 + 0x28,param_6); - if (uVar3 == 0) { - pcVar7[4] = '\0'; - pcVar7[5] = '\0'; - pcVar7[6] = '\0'; - pcVar7[7] = '\0'; - pcVar7[0] = 'I'; - pcVar7[1] = 'D'; - pcVar7[2] = 'D'; - pcVar7[3] = 'D'; - pcVar7[8] = '\x01'; - pcVar7[9] = '\0'; - pcVar7[10] = '\0'; - pcVar7[0xb] = '\0'; - *(longlong *)(pcVar7 + 0x20) = lVar2; + pcVar6[0] = '\0'; + pcVar6[1] = '\0'; + pcVar6[2] = '\0'; + pcVar6[3] = '\0'; + pcVar6[4] = '\0'; + pcVar6[5] = '\0'; + pcVar6[6] = '\0'; + pcVar6[7] = '\0'; + pcVar6[8] = '\0'; + pcVar6[9] = '\0'; + pcVar6[10] = '\0'; + pcVar6[0xb] = '\0'; + pcVar6[0xc] = '\0'; + pcVar6[0xd] = '\0'; + pcVar6[0xe] = '\0'; + pcVar6[0xf] = '\0'; + pcVar6[0x10] = '\0'; + pcVar6[0x11] = '\0'; + pcVar6[0x12] = '\0'; + pcVar6[0x13] = '\0'; + pcVar6[0x14] = '\0'; + pcVar6[0x15] = '\0'; + pcVar6[0x16] = '\0'; + pcVar6[0x17] = '\0'; + pcVar6[0x18] = '\0'; + pcVar6[0x19] = '\0'; + pcVar6[0x1a] = '\0'; + pcVar6[0x1b] = '\0'; + pcVar6[0x1c] = '\0'; + pcVar6[0x1d] = '\0'; + pcVar6[0x1e] = '\0'; + pcVar6[0x1f] = '\0'; + pcVar6[0x20] = '\0'; + pcVar6[0x21] = '\0'; + pcVar6[0x22] = '\0'; + pcVar6[0x23] = '\0'; + pcVar6[0x24] = '\0'; + pcVar6[0x25] = '\0'; + pcVar6[0x26] = '\0'; + pcVar6[0x27] = '\0'; + pcVar6[0x28] = '\0'; + pcVar6[0x29] = '\0'; + pcVar6[0x2a] = '\0'; + pcVar6[0x2b] = '\0'; + pcVar6[0x2c] = '\0'; + pcVar6[0x2d] = '\0'; + pcVar6[0x2e] = '\0'; + pcVar6[0x2f] = '\0'; + pcVar6[0x30] = '\0'; + pcVar6[0x31] = '\0'; + pcVar6[0x32] = '\0'; + pcVar6[0x33] = '\0'; + pcVar6[0x34] = '\0'; + pcVar6[0x35] = '\0'; + pcVar6[0x36] = '\0'; + pcVar6[0x37] = '\0'; + uVar2 = (**(code **)(lVar1 + 0xe8)) + (*(undefined8 *)(lVar1 + 0x118),*(undefined8 *)(puVar4 + 0x28), + *(undefined8 *)(puVar5 + 0x28),pcVar6 + 0x28,param_6); + if (uVar2 == 0) { + pcVar6[4] = '\0'; + pcVar6[5] = '\0'; + pcVar6[6] = '\0'; + pcVar6[7] = '\0'; + pcVar6[0] = 'I'; + pcVar6[1] = 'D'; + pcVar6[2] = 'D'; + pcVar6[3] = 'D'; + pcVar6[8] = '\x01'; + pcVar6[9] = '\0'; + pcVar6[10] = '\0'; + pcVar6[0xb] = '\0'; + pcVar6[0xc] = '\0'; + pcVar6[0xd] = '\0'; + pcVar6[0xe] = '\0'; + pcVar6[0xf] = '\0'; LOCK(); - *(int *)(lVar2 + 8) = *(int *)(lVar2 + 8) + 1; + *(longlong *)(lVar1 + 8) = *(longlong *)(lVar1 + 8) + 1; UNLOCK(); - pcVar9 = pcVar7; - SrvAddSecretToList(param_1,(longlong)pcVar7); - pcVar1 = pcVar7 + 0x30; - pcVar7 = (char *)0x0; - uVar3 = 0; - *param_5 = *(undefined8 *)pcVar1; + *(longlong *)(pcVar6 + 0x20) = lVar1; + SrvAddSecretToList(param_1,(longlong)pcVar6,(undefined8 *)param_5); + pcVar9 = (char *)0x0; + uVar2 = 0; + pcVar8 = pcVar6; } else { - pcVar10 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar9 = "Status"; - DebugTraceError(uVar3,"Status", + param_5 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + pcVar8 = "Status"; + DebugTraceError(uVar2,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - uVar3 = NormalizeNteStatus(uVar3); + uVar2 = NormalizeNteStatus(uVar2); + pcVar9 = pcVar6; } } - uVar4 = SrvDereferenceKey(puVar6,pcVar9,pcVar10); - if (((int)uVar4 < 0) && (-1 < (int)uVar3)) { - uVar3 = uVar4; + uVar3 = SrvDereferenceKey(puVar5,pcVar8,param_5); + if (((int)uVar3 < 0) && (-1 < (int)uVar2)) { + uVar2 = uVar3; } LAB_0: - uVar4 = SrvDereferenceKey(puVar5,pcVar9,pcVar10); - if (((int)uVar4 < 0) && (-1 < (int)uVar3)) { - uVar3 = uVar4; + uVar3 = SrvDereferenceKey(puVar4,pcVar8,param_5); + if (((int)uVar3 < 0) && (-1 < (int)uVar2)) { + uVar2 = uVar3; } - if (pcVar7 != (char *)0x0) { - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,pcVar7); + if (pcVar9 != (char *)0x0) { + SrvCryptLocalFree(pcVar9); } - return uVar3; + return uVar2; } ``` ## SrvRemoveKeyFromList ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.44| |i_ratio|0.71| |m_ratio|0.95| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvRemoveKeyFromList|SrvRemoveKeyFromList| |fullname|SrvRemoveKeyFromList|SrvRemoveKeyFromList| |refcount|4|4| |`length`|102|107| |called|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
SrvDereferenceKey|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
SrvDereferenceKey| |calling|SrvCryptDeleteKey
SrvCryptRundownContext
SrvRundownKeyList|SrvCryptDeleteKey
SrvCryptRundownContext
SrvRundownKeyList| |paramcount|2|2| |`address`|18000d51c|180001aac| |`sig`|undefined __fastcall SrvRemoveKeyFromList(longlong param_1, undefined1 * param_2)|ulonglong __fastcall SrvRemoveKeyFromList(longlong param_1, undefined1 * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvRemoveKeyFromList Diff ```diff --- SrvRemoveKeyFromList +++ SrvRemoveKeyFromList @@ -1,29 +1,31 @@ -void SrvRemoveKeyFromList(longlong param_1,undefined1 *param_2) +ulonglong SrvRemoveKeyFromList(longlong param_1,undefined1 *param_2) { longlong *plVar1; longlong lVar2; - code *pcVar3; - undefined1 *puVar4; - longlong *plVar5; + longlong *plVar3; + code *pcVar4; + uint uVar5; + ulonglong uVar6; + undefined1 *puVar7; - puVar4 = param_2; + puVar7 = param_2; RtlEnterCriticalSection(param_1 + 0x68); plVar1 = (longlong *)(param_2 + 0x10); lVar2 = *plVar1; if ((*(longlong **)(lVar2 + 8) == plVar1) && - (plVar5 = *(longlong **)(param_2 + 0x18), (longlong *)*plVar5 == plVar1)) { - *plVar5 = lVar2; - *(longlong **)(lVar2 + 8) = plVar5; + (plVar3 = *(longlong **)(param_2 + 0x18), (longlong *)*plVar3 == plVar1)) { + *plVar3 = lVar2; + *(longlong **)(lVar2 + 8) = plVar3; + uVar5 = SrvDereferenceKey(param_2,puVar7,(char *)plVar3); RtlLeaveCriticalSection(param_1 + 0x68); - SrvDereferenceKey(param_2,puVar4,(char *)plVar5); - return; + return (ulonglong)uVar5; } - pcVar3 = (code *)swi(0x29); - (*pcVar3)(3); - pcVar3 = (code *)swi(3); - (*pcVar3)(); - return; + pcVar4 = (code *)swi(0x29); + (*pcVar4)(3); + pcVar4 = (code *)swi(3); + uVar6 = (*pcVar4)(); + return uVar6; } ``` ## SrvCryptOpenStorageProvider ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.59| |i_ratio|0.74| |m_ratio|1.0| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvCryptOpenStorageProvider|SrvCryptOpenStorageProvider| |fullname|SrvCryptOpenStorageProvider|SrvCryptOpenStorageProvider| |refcount|5|5| |`length`|536|532| |called|BCRYPT.DLL::BCryptFreeBuffer
BCRYPT.DLL::BCryptResolveProviders
LoadProviderEx
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlInitializeCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
_guard_xfg_dispatch_icall_nop
memset|BCRYPT.DLL::BCryptFreeBuffer
BCRYPT.DLL::BCryptResolveProviders
LoadProviderEx
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlInitializeCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
_guard_xfg_dispatch_icall_nop
memset| |calling|s_SrvRpcCryptOpenStorageProvider|s_SrvRpcCryptOpenStorageProvider| |paramcount|4|4| |`address`|180001900|180001ba0| |sig|NTSTATUS __fastcall SrvCryptOpenStorageProvider(longlong param_1, undefined8 * param_2, LPCWSTR param_3, uint param_4)|NTSTATUS __fastcall SrvCryptOpenStorageProvider(longlong param_1, undefined8 * param_2, LPCWSTR param_3, uint param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvCryptOpenStorageProvider Diff ```diff --- SrvCryptOpenStorageProvider +++ SrvCryptOpenStorageProvider @@ -1,122 +1,122 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ NTSTATUS SrvCryptOpenStorageProvider (longlong param_1,undefined8 *param_2,LPCWSTR param_3,uint param_4) { longlong lVar1; - longlong *plVar2; - longlong lVar3; - code *pcVar4; - NTSTATUS NVar5; + longlong lVar2; + code *pcVar3; + NTSTATUS NVar4; undefined8 *_Dst; - ulonglong uVar6; - char *pcVar7; - longlong *plVar8; + ulonglong uVar5; + char *pcVar6; + longlong *plVar7; + undefined8 *puVar8; undefined8 uVar9; char *pcVar10; HMODULE hLibModule; undefined8 *unaff_R13; ULONG local_res10 [2]; - undefined8 *puVar11; PCRYPT_PROVIDER_REFS local_38 [2]; hLibModule = (HMODULE)(ulonglong)param_4; local_38[0] = (PCRYPT_PROVIDER_REFS)0x0; local_res10[0] = 0; if (param_2 == (undefined8 *)0x0) { - NVar5 = -0x7ff6ffd9; + NVar4 = -0x7ff6ffd9; DebugTraceError(0x80090027,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); } else if (param_1 == 0) { - NVar5 = -0x7ff6ffda; + NVar4 = -0x7ff6ffda; DebugTraceError(0x80090026,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); } else { - NVar5 = BCryptResolveProviders + NVar4 = BCryptResolveProviders ((LPCWSTR)0x0,0x10001,L"KEY_STORAGE",param_3,1,0,local_res10,local_38); - if (NVar5 < 0) { - DebugTraceError(NVar5,"Status", + if (NVar4 < 0) { + DebugTraceError(NVar4,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); } else { _Dst = (undefined8 *) RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,0x160); if (_Dst == (undefined8 *)0x0) { - NVar5 = -0x7ff6fff2; + NVar4 = -0x7ff6fff2; DebugTraceError(0x8009000e,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); } else { uVar9 = 0x160; memset(_Dst,0,0x160); - puVar11 = _Dst + 5; - uVar6 = LoadProviderEx(&(*local_38[0]->rgpProviders)->dwInterface,puVar11,uVar9,_Dst + 4, - puVar11); - NVar5 = (NTSTATUS)uVar6; - if (((NVar5 < 0) || (NVar5 = (*(code *)_Dst[6])(_Dst + 0x23,param_3,hLibModule), NVar5 < 0)) - || (NVar5 = (*(code *)_Dst[0xb]) + puVar8 = _Dst + 5; + uVar5 = LoadProviderEx(&(*local_38[0]->rgpProviders)->dwInterface,puVar8,uVar9,_Dst + 4, + puVar8); + NVar4 = (NTSTATUS)uVar5; + if (((NVar4 < 0) || (NVar4 = (*(code *)_Dst[6])(_Dst + 0x23,param_3,hLibModule), NVar4 < 0)) + || (NVar4 = (*(code *)_Dst[0xb]) (_Dst[0x23],L"MSSP/Client Process ID",param_1 + 0x10,4, - (ulonglong)puVar11 & 0xffffffff00000000), NVar5 != 0)) { - pcVar7 = "Status"; + (ulonglong)puVar8 & 0xffffffff00000000), NVar4 != 0)) { + pcVar6 = "Status"; pcVar10 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - DebugTraceError(NVar5,"Status", + DebugTraceError(NVar4,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); if ((undefined8 *)_Dst[4] != (undefined8 *)0x0) { - UnloadProvider((undefined8 *)_Dst[4],pcVar7,pcVar10); + UnloadProvider((undefined8 *)_Dst[4],pcVar6,pcVar10); } - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,_Dst); + SrvCryptLocalFree((undefined1 *)_Dst); } else { *_Dst = 0x44444446; - *(undefined4 *)(_Dst + 1) = 1; + _Dst[1] = 1; RtlInitializeCriticalSection(_Dst + 0x24); - puVar11 = _Dst + 0x29; + puVar8 = _Dst + 0x29; lVar1 = param_1 + 0x28; - _Dst[0x2a] = puVar11; - *puVar11 = puVar11; + _Dst[0x2a] = puVar8; + *puVar8 = puVar8; RtlEnterCriticalSection(lVar1); *(longlong *)(param_1 + 0x60) = *(longlong *)(param_1 + 0x60) + 1; - plVar8 = (longlong *)(param_1 + 0x50); - _Dst[0x2b] = *(undefined8 *)(param_1 + 0x60); - plVar2 = _Dst + 2; - lVar3 = *plVar8; - if (*(longlong **)(lVar3 + 8) != plVar8) { - pcVar4 = (code *)swi(0x29); - (*pcVar4)(3); + uVar9 = *(undefined8 *)(param_1 + 0x60); + _Dst[0x2b] = uVar9; + *param_2 = uVar9; + LOCK(); + _Dst[1] = _Dst[1] + 1; + UNLOCK(); + lVar2 = *(longlong *)(param_1 + 0x50); + puVar8 = (undefined8 *)(param_1 + 0x50); + plVar7 = _Dst + 2; + if (*(undefined8 **)(lVar2 + 8) != puVar8) { + pcVar3 = (code *)swi(0x29); + (*pcVar3)(3); DebugTraceError(0xc00000e5,"sResult", "onecore\\ds\\security\\cryptoapi\\ncrypt\\loader\\loader.c"); if (((lVar1 == 0) && (hLibModule != (HMODULE)0x0)) && (hLibModule != g_hInstance)) { FreeLibrary(hLibModule); - NVar5 = FUN_180001dd2(); - return NVar5; + NVar4 = FUN_180002072(); + return NVar4; } *unaff_R13 = 0; if ((int)param_2 != 0) { LeaveCriticalSection((LPCRITICAL_SECTION)&g_csLoaderLock); } return -0x3fffff1b; } - *plVar2 = lVar3; - _Dst[3] = plVar8; - *(longlong **)(lVar3 + 8) = plVar2; - *plVar8 = (longlong)plVar2; - LOCK(); - *(int *)(_Dst + 1) = *(int *)(_Dst + 1) + 1; - UNLOCK(); + *plVar7 = lVar2; + _Dst[3] = puVar8; + *(longlong **)(lVar2 + 8) = plVar7; + *puVar8 = plVar7; RtlLeaveCriticalSection(lVar1); - NVar5 = 0; - *param_2 = _Dst[0x2b]; + NVar4 = 0; } } } } if (local_38[0] != (PCRYPT_PROVIDER_REFS)0x0) { BCryptFreeBuffer(local_38[0]); } - return NVar5; + return NVar4; } ``` ## SrvFreeKey ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,address,calling,called| |ratio|0.68| |i_ratio|0.51| |m_ratio|0.87| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvFreeKey|SrvFreeKey| |fullname|SrvFreeKey|SrvFreeKey| |refcount|5|5| |`length`|174|132| |`called`|DebugTraceError
NTDLL.DLL::RtlFreeHeap
NormalizeNteStatus
SrvDereferenceProvider
_guard_xfg_dispatch_icall_nop|DebugTraceError
NormalizeNteStatus
SrvCryptLocalFree
SrvDereferenceProvider
_guard_xfg_dispatch_icall_nop| |`calling`|FUN_1800069af
SrvCryptExportKey
SrvCryptFreeKey
SrvDereferenceKey|FUN_180006221
SrvCryptExportKey
SrvCryptFreeKey
SrvDereferenceKey| |paramcount|3|3| |`address`|18000a314|1800018f0| |sig|uint __fastcall SrvFreeKey(undefined1 * param_1, undefined8 param_2, char * param_3)|uint __fastcall SrvFreeKey(undefined1 * param_1, undefined8 param_2, char * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvFreeKey Called Diff ```diff --- SrvFreeKey called +++ SrvFreeKey called @@ -2 +1,0 @@ -NTDLL.DLL::RtlFreeHeap @@ -3,0 +3 @@ +SrvCryptLocalFree ``` ### SrvFreeKey Calling Diff ```diff --- SrvFreeKey calling +++ SrvFreeKey calling @@ -1 +1 @@ -FUN_1800069af +FUN_180006221 ``` ### SrvFreeKey Diff ```diff --- SrvFreeKey +++ SrvFreeKey @@ -1,35 +1,28 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ uint SrvFreeKey(undefined1 *param_1,undefined8 param_2,char *param_3) { uint uVar1; uint uVar2; - longlong lVar3; - char *pcVar4; - undefined1 *puVar5; + char *pcVar3; - pcVar4 = *(char **)(param_1 + 0x28); + pcVar3 = *(char **)(param_1 + 0x28); uVar1 = (**(code **)(*(longlong *)(param_1 + 0x20) + 0x80)) (*(undefined8 *)(*(longlong *)(param_1 + 0x20) + 0x118)); if ((int)uVar1 < 0) { param_3 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar4 = "Status"; + pcVar3 = "Status"; DebugTraceError(uVar1,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); uVar1 = NormalizeNteStatus(uVar1); } - uVar2 = SrvDereferenceProvider(*(undefined1 **)(param_1 + 0x20),pcVar4,param_3); + uVar2 = SrvDereferenceProvider(*(undefined1 **)(param_1 + 0x20),pcVar3,param_3); if (((int)uVar2 < 0) && (-1 < (int)uVar1)) { uVar1 = uVar2; } - puVar5 = param_1; - for (lVar3 = 0x38; lVar3 != 0; lVar3 = lVar3 + -1) { - *puVar5 = 0; - puVar5 = puVar5 + 1; - } - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,param_1); + SrvCryptLocalFree(param_1); return uVar1; } ``` ## SrvFreeProvider ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.79| |i_ratio|0.43| |m_ratio|0.86| |b_ratio|0.86| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvFreeProvider|SrvFreeProvider| |fullname|SrvFreeProvider|SrvFreeProvider| |refcount|5|5| |`length`|180|136| |`called`|DebugTraceError
NTDLL.DLL::RtlDeleteCriticalSection
NTDLL.DLL::RtlFreeHeap
NormalizeNteStatus
SrvRundownProviderNotifyEventList
UnloadProvider
_guard_xfg_dispatch_icall_nop|DebugTraceError
NTDLL.DLL::RtlDeleteCriticalSection
NormalizeNteStatus
SrvCryptLocalFree
SrvRundownProviderNotifyEventList
UnloadProvider
_guard_xfg_dispatch_icall_nop| |calling|SrvCryptFreeKey
SrvCryptFreeProvider
SrvCryptImportKey
SrvDereferenceProvider|SrvCryptFreeKey
SrvCryptFreeProvider
SrvCryptImportKey
SrvDereferenceProvider| |paramcount|3|3| |`address`|18000a3cc|18000197c| |sig|uint __fastcall SrvFreeProvider(undefined1 * param_1, char * param_2, char * param_3)|uint __fastcall SrvFreeProvider(undefined1 * param_1, char * param_2, char * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvFreeProvider Called Diff ```diff --- SrvFreeProvider called +++ SrvFreeProvider called @@ -3 +2,0 @@ -NTDLL.DLL::RtlFreeHeap @@ -4,0 +4 @@ +SrvCryptLocalFree ``` ### SrvFreeProvider Diff ```diff --- SrvFreeProvider +++ SrvFreeProvider @@ -1,30 +1,23 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ uint SrvFreeProvider(undefined1 *param_1,char *param_2,char *param_3) { uint uVar1; - longlong lVar2; - undefined1 *puVar3; SrvRundownProviderNotifyEventList((longlong)param_1,param_2,(longlong *)param_3); uVar1 = (**(code **)(param_1 + 0x78))(*(undefined8 *)(param_1 + 0x118)); if ((int)uVar1 < 0) { param_3 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; param_2 = "Status"; DebugTraceError(uVar1,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); uVar1 = NormalizeNteStatus(uVar1); } UnloadProvider(*(undefined8 **)(param_1 + 0x20),param_2,param_3); RtlDeleteCriticalSection(param_1 + 0x120); - puVar3 = param_1; - for (lVar2 = 0x160; lVar2 != 0; lVar2 = lVar2 + -1) { - *puVar3 = 0; - puVar3 = puVar3 + 1; - } - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,param_1); + SrvCryptLocalFree(param_1); return uVar1; } ``` ## SrvRemoveProviderFromList ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.44| |i_ratio|0.71| |m_ratio|0.95| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvRemoveProviderFromList|SrvRemoveProviderFromList| |fullname|SrvRemoveProviderFromList|SrvRemoveProviderFromList| |refcount|3|3| |`length`|102|107| |called|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
SrvDereferenceProvider|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
SrvDereferenceProvider| |calling|SrvCryptRundownContext
SrvRundownProviderList|SrvCryptRundownContext
SrvRundownProviderList| |paramcount|2|2| |`address`|18000d588|180001b20| |`sig`|undefined __fastcall SrvRemoveProviderFromList(longlong param_1, char * param_2)|ulonglong __fastcall SrvRemoveProviderFromList(longlong param_1, char * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvRemoveProviderFromList Diff ```diff --- SrvRemoveProviderFromList +++ SrvRemoveProviderFromList @@ -1,29 +1,31 @@ -void SrvRemoveProviderFromList(longlong param_1,char *param_2) +ulonglong SrvRemoveProviderFromList(longlong param_1,char *param_2) { longlong *plVar1; longlong lVar2; - code *pcVar3; - char *pcVar4; - longlong *plVar5; + longlong *plVar3; + code *pcVar4; + uint uVar5; + ulonglong uVar6; + char *pcVar7; - pcVar4 = param_2; + pcVar7 = param_2; RtlEnterCriticalSection(param_1 + 0x28); plVar1 = (longlong *)(param_2 + 0x10); lVar2 = *plVar1; if ((*(longlong **)(lVar2 + 8) == plVar1) && - (plVar5 = *(longlong **)(param_2 + 0x18), (longlong *)*plVar5 == plVar1)) { - *plVar5 = lVar2; - *(longlong **)(lVar2 + 8) = plVar5; + (plVar3 = *(longlong **)(param_2 + 0x18), (longlong *)*plVar3 == plVar1)) { + *plVar3 = lVar2; + *(longlong **)(lVar2 + 8) = plVar3; + uVar5 = SrvDereferenceProvider(param_2,pcVar7,(char *)plVar3); RtlLeaveCriticalSection(param_1 + 0x28); - SrvDereferenceProvider(param_2,pcVar4,(char *)plVar5); - return; + return (ulonglong)uVar5; } - pcVar3 = (code *)swi(0x29); - (*pcVar3)(3); - pcVar3 = (code *)swi(3); - (*pcVar3)(); - return; + pcVar4 = (code *)swi(0x29); + (*pcVar4)(3); + pcVar4 = (code *)swi(3); + uVar6 = (*pcVar4)(); + return uVar6; } ``` ## SrvCryptFreeProvider ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,called| |ratio|0.1| |i_ratio|0.21| |m_ratio|0.98| |b_ratio|0.14| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvCryptFreeProvider|SrvCryptFreeProvider| |fullname|SrvCryptFreeProvider|SrvCryptFreeProvider| |`refcount`|7|6| |`length`|988|930| |`called`|
Expand for full list:
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::FreeLibrary
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
DebugTraceError
NTDLL.DLL::RtlDeleteCriticalSection
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlFreeHeap
NTDLL.DLL::RtlLeaveCriticalSection
NormalizeNteStatus
SrvFreeProvider
SrvRemoveProviderNotifyEventFromListWPP_SF_qSD
WPP_SF_qq
_guard_xfg_dispatch_icall_nop
|
Expand for full list:
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::FreeLibrary
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
DebugTraceError
NTDLL.DLL::RtlDeleteCriticalSection
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlFreeHeap
NTDLL.DLL::RtlLeaveCriticalSection
NormalizeNteStatus
SrvCryptLocalFree
SrvFreeProviderSrvRemoveProviderNotifyEventFromList
WPP_SF_qSD
WPP_SF_qq
_guard_xfg_dispatch_icall_nop
| |calling|s_SrvRpcCryptFreeProvider|s_SrvRpcCryptFreeProvider| |paramcount|3|3| |`address`|180001fd0|180002280| |`sig`|uint __fastcall SrvCryptFreeProvider(longlong param_1, char * param_2, char * param_3)|ulonglong __fastcall SrvCryptFreeProvider(longlong param_1, longlong param_2, char * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvCryptFreeProvider Called Diff ```diff --- SrvCryptFreeProvider called +++ SrvCryptFreeProvider called @@ -9,0 +10 @@ +SrvCryptLocalFree ``` ### SrvCryptFreeProvider Diff ```diff --- SrvCryptFreeProvider +++ SrvCryptFreeProvider @@ -1,155 +1,148 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ -uint SrvCryptFreeProvider(longlong param_1,char *param_2,char *param_3) +ulonglong SrvCryptFreeProvider(longlong param_1,longlong param_2,char *param_3) { - longlong *plVar1; - longlong *plVar2; - longlong lVar3; - undefined8 *puVar4; + longlong lVar1; + undefined8 *puVar2; HMODULE hLibModule; - code *pcVar5; + code *pcVar3; + bool bVar4; + undefined8 *puVar5; undefined8 *puVar6; - undefined8 *puVar7; - uint uVar8; - longlong *plVar9; - longlong lVar10; - char *pcVar11; - undefined1 *puVar12; - undefined1 *puVar13; - longlong *plVar14; - undefined1 auStackY_58 [8]; - undefined1 auStackY_50 [24]; + uint uVar7; + longlong *plVar8; + char *pcVar9; + longlong *plVar10; + ulonglong uVar11; + longlong *plVar12; - puVar13 = auStackY_58; - puVar12 = auStackY_58; if (param_1 != 0) { - lVar10 = param_1 + 0x28; - pcVar11 = param_2; - RtlEnterCriticalSection(lVar10); - plVar9 = *(longlong **)(param_1 + 0x50); - puVar12 = auStackY_58; - if (*(longlong **)(param_1 + 0x50) != (longlong *)(param_1 + 0x50)) { - while( true ) { - plVar1 = plVar9 + -2; - plVar2 = (longlong *)*plVar9; - if ((char *)plVar9[0x29] == param_2) break; - plVar9 = plVar2; - puVar12 = auStackY_58; - if (plVar2 == (longlong *)(param_1 + 0x50)) goto LAB_0; + bVar4 = false; + RtlEnterCriticalSection(param_1 + 0x28); + plVar8 = *(longlong **)(param_1 + 0x50); + plVar10 = (longlong *)0x0; + if (*(longlong **)(param_1 + 0x50) == (longlong *)(param_1 + 0x50)) { +LAB_0: + RtlLeaveCriticalSection(param_1 + 0x28); + if (!bVar4) { + plVar10 = (longlong *)0x0; } - puVar12 = auStackY_58; - if ((int)*plVar1 != 0x44444446) goto LAB_0; - *(int *)plVar1 = 0x44440006; - RtlLeaveCriticalSection(lVar10); - puVar12 = auStackY_58; - if (plVar1 == (longlong *)0x0) goto LAB_1; - RtlEnterCriticalSection(lVar10); - lVar3 = *plVar9; - if ((*(longlong **)(lVar3 + 8) != plVar9) || - (plVar2 = (longlong *)plVar9[1], (longlong *)*plVar2 != plVar9)) { - pcVar5 = (code *)swi(0x29); - (*pcVar5)(3); - puVar12 = auStackY_50; - goto LAB_0; + if (plVar10 != (longlong *)0x0) { + RtlEnterCriticalSection(param_1 + 0x28); + pcVar9 = (char *)plVar10[2]; + if ((*(longlong **)(pcVar9 + 8) != plVar10 + 2) || + (puVar2 = (undefined8 *)plVar10[3], (longlong *)*puVar2 != plVar10 + 2)) { + pcVar3 = (code *)swi(0x29); + (*pcVar3)(3); + pcVar3 = (code *)swi(3); + uVar11 = (*pcVar3)(); + return uVar11; + } + *puVar2 = pcVar9; + *(undefined8 **)(pcVar9 + 8) = puVar2; + LOCK(); + plVar8 = plVar10 + 1; + lVar1 = *plVar8; + *plVar8 = *plVar8 + -1; + UNLOCK(); + if (lVar1 == 1) { + SrvFreeProvider((undefined1 *)plVar10,pcVar9,param_3); + } + RtlLeaveCriticalSection(param_1 + 0x28); + LOCK(); + plVar8 = plVar10 + 1; + lVar1 = *plVar8; + *plVar8 = *plVar8 + -1; + UNLOCK(); + if (lVar1 != 1) { + return 0; + } + RtlEnterCriticalSection(plVar10 + 0x24); + plVar8 = (longlong *)plVar10[0x29]; + while (plVar12 = plVar8, plVar12 != plVar10 + 0x29) { + plVar8 = (longlong *)*plVar12; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x20) != 0)) { + WPP_SF_qq(*(undefined **)((longlong)WPP_GLOBAL_Control + 0x10),0xb,param_3,plVar10); + } + (*(code *)plVar10[0x1c])(plVar10[0x23],plVar12 + 2,2); + SrvRemoveProviderNotifyEventFromList((longlong)plVar10,plVar12); + pcVar9 = (char *)0x0; + RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30)); + param_3 = (char *)plVar12; + } + RtlLeaveCriticalSection(plVar10 + 0x24); + uVar7 = (*(code *)plVar10[0xf])(plVar10[0x23]); + if ((int)uVar7 < 0) { + param_3 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + pcVar9 = "Status"; + DebugTraceError(uVar7,"Status", + "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); + uVar7 = NormalizeNteStatus(uVar7); + } + uVar11 = (ulonglong)uVar7; + puVar2 = (undefined8 *)plVar10[4]; + if ((g_fLoaderInitialized != 0) && (puVar2 != (undefined8 *)0x0)) { + EnterCriticalSection((LPCRITICAL_SECTION)&g_csLoaderLock); + *(int *)(puVar2 + 2) = *(int *)(puVar2 + 2) + -1; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_qSD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pcVar9,param_3,puVar2, + (wchar_t *)*puVar2); + } + if (*(int *)(puVar2 + 2) == 0) { + hLibModule = (HMODULE)puVar2[1]; + if ((hLibModule != (HMODULE)0x0) && (hLibModule != g_hInstance)) { + FreeLibrary(hLibModule); + } + puVar6 = g_pLoadedProviderList; + if (puVar2 == g_pLoadedProviderList) { + g_pLoadedProviderList = (undefined8 *)puVar2[3]; + } + else { + do { + puVar5 = puVar6; + if (puVar5 == (undefined8 *)0x0) break; + puVar6 = (undefined8 *)puVar5[3]; + } while ((undefined8 *)puVar5[3] != puVar2); + puVar5[3] = puVar2[3]; + } + puVar2[3] = 0; + RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,puVar2); + } + LeaveCriticalSection((LPCRITICAL_SECTION)&g_csLoaderLock); + } + RtlDeleteCriticalSection(plVar10 + 0x24); + SrvCryptLocalFree((undefined1 *)plVar10); + if (-1 < (int)uVar7) { + return 0; + } + goto LAB_1; } - *plVar2 = lVar3; - *(longlong **)(lVar3 + 8) = plVar2; - RtlLeaveCriticalSection(lVar10); - LOCK(); - plVar2 = plVar9 + -1; - lVar10 = *plVar2; - *(int *)plVar2 = (int)*plVar2 + -1; - UNLOCK(); - if ((int)lVar10 == 1) { - SrvFreeProvider((undefined1 *)plVar1,pcVar11,param_3); - } - LOCK(); - plVar2 = plVar9 + -1; - lVar10 = *plVar2; - *(int *)plVar2 = (int)*plVar2 + -1; - UNLOCK(); - if ((int)lVar10 != 1) { - return 0; - } - RtlEnterCriticalSection(plVar9 + 0x22); - plVar2 = (longlong *)plVar9[0x27]; - while (plVar14 = plVar2, plVar14 != plVar9 + 0x27) { - plVar2 = (longlong *)*plVar14; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x20) != 0)) { - WPP_SF_qq(*(undefined **)((longlong)WPP_GLOBAL_Control + 0x10),0xb,param_3,plVar1); + } + else { + do { + plVar10 = plVar8 + -2; + plVar12 = (longlong *)*plVar8; + if (plVar8[0x29] == param_2) { + if ((int)*plVar10 == 0x44444446) { + *(int *)plVar10 = 0x44440006; + bVar4 = true; + } + goto LAB_0; } - (*(code *)plVar9[0x1a])(plVar9[0x21],plVar14 + 2,2); - SrvRemoveProviderNotifyEventFromList((longlong)plVar1,plVar14); - pcVar11 = (char *)0x0; - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30)); - param_3 = (char *)plVar14; - } - RtlLeaveCriticalSection(plVar9 + 0x22); - uVar8 = (*(code *)plVar9[0xd])(plVar9[0x21]); - if ((int)uVar8 < 0) { - param_3 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar11 = "Status"; - DebugTraceError(uVar8,"Status", - "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - uVar8 = NormalizeNteStatus(uVar8); - } - puVar4 = (undefined8 *)plVar9[2]; - if ((g_fLoaderInitialized != 0) && (puVar4 != (undefined8 *)0x0)) { - EnterCriticalSection((LPCRITICAL_SECTION)&g_csLoaderLock); - *(int *)(puVar4 + 2) = *(int *)(puVar4 + 2) + -1; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - WPP_SF_qSD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pcVar11,param_3,puVar4, - (wchar_t *)*puVar4); - } - if (*(int *)(puVar4 + 2) == 0) { - hLibModule = (HMODULE)puVar4[1]; - if ((hLibModule != (HMODULE)0x0) && (hLibModule != g_hInstance)) { - FreeLibrary(hLibModule); - } - puVar7 = g_pLoadedProviderList; - if (puVar4 == g_pLoadedProviderList) { - g_pLoadedProviderList = (undefined8 *)puVar4[3]; - } - else { - do { - puVar6 = puVar7; - if (puVar6 == (undefined8 *)0x0) break; - puVar7 = (undefined8 *)puVar6[3]; - } while ((undefined8 *)puVar6[3] != puVar4); - puVar6[3] = puVar4[3]; - } - puVar4[3] = 0; - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,puVar4); - } - LeaveCriticalSection((LPCRITICAL_SECTION)&g_csLoaderLock); - } - RtlDeleteCriticalSection(plVar9 + 0x22); - plVar9 = plVar1; - for (lVar10 = 0x160; lVar10 != 0; lVar10 = lVar10 + -1) { - *(undefined1 *)plVar9 = 0; - plVar9 = (longlong *)((longlong)plVar9 + 1); - } - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,plVar1); - if (-1 < (int)uVar8) { - return 0; - } - goto LAB_2; + plVar8 = plVar12; + } while (plVar12 != (longlong *)(param_1 + 0x50)); + RtlLeaveCriticalSection(param_1 + 0x28); } -LAB_0: - *(undefined8 *)(puVar12 + -8) = 0x180005f33; - RtlLeaveCriticalSection(lVar10); } + uVar11 = 0x80090026; + uVar7 = 0x80090026; LAB_1: - puVar13 = puVar12; - uVar8 = 0x80090026; -LAB_2: - *(undefined8 *)(puVar13 + -8) = 0x180005f5b; - DebugTraceError(uVar8,"Status","onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c") + DebugTraceError(uVar7,"Status","onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c") ; - return uVar8; + return uVar11; } ``` ## s_SrvRpcCryptEncrypt ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.48| |i_ratio|0.62| |m_ratio|0.95| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|s_SrvRpcCryptEncrypt|s_SrvRpcCryptEncrypt| |fullname|s_SrvRpcCryptEncrypt|s_SrvRpcCryptEncrypt| |refcount|3|3| |`length`|388|362| |`called`|DebugTraceError
Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled
RPCRT4.DLL::RpcImpersonateClient
RPCRT4.DLL::RpcRevertToSelf
SrvCryptEncrypt
_guard_xfg_dispatch_icall_nop|DebugTraceError
RPCRT4.DLL::RpcImpersonateClient
RPCRT4.DLL::RpcRevertToSelf
SrvCryptEncrypt
_guard_xfg_dispatch_icall_nop| |calling||| |paramcount|11|11| |`address`|18000ba50|18000b0b0| |`sig`|int __fastcall s_SrvRpcCryptEncrypt(undefined4 * param_1, ulonglong param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, longlong param_7, undefined8 param_8, undefined4 param_9, undefined4 * param_10, uint param_11)|int __fastcall s_SrvRpcCryptEncrypt(RPC_BINDING_HANDLE param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, longlong param_7, undefined8 param_8, undefined4 param_9, undefined4 * param_10, uint param_11)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### s_SrvRpcCryptEncrypt Called Diff ```diff --- s_SrvRpcCryptEncrypt called +++ s_SrvRpcCryptEncrypt called @@ -2 +1,0 @@ -Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled ``` ### s_SrvRpcCryptEncrypt Diff ```diff --- s_SrvRpcCryptEncrypt +++ s_SrvRpcCryptEncrypt @@ -1,51 +1,49 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ int s_SrvRpcCryptEncrypt - (undefined4 *param_1,ulonglong param_2,undefined8 param_3,undefined8 param_4, + (RPC_BINDING_HANDLE param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4, undefined8 param_5,undefined4 param_6,longlong param_7,undefined8 param_8, undefined4 param_9,undefined4 *param_10,uint param_11) { - uint uVar1; - RPC_STATUS RVar2; - int iVar3; - undefined4 uVar4; - undefined8 uVar5; + RPC_STATUS RVar1; + int iVar2; + undefined4 uVar3; + undefined8 uVar4; if (param_10 == (undefined4 *)0x0) { - iVar3 = -0x7ff6ffd9; - uVar4 = 0x80090027; + iVar2 = -0x7ff6ffd9; + uVar3 = 0x80090027; } else { - uVar1 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled(param_1,param_2); - if ((uVar1 == 0) || ((param_11 & 0x10) == 0)) { - RVar2 = RpcImpersonateClient(param_1); - if (RVar2 != 0) { - DebugTraceError(RVar2,"Status", + if ((param_11 & 0x10) == 0) { + RVar1 = RpcImpersonateClient(param_1); + if (RVar1 != 0) { + DebugTraceError(RVar1,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvrpc.c"); return -0x7ff6ffe0; } *param_10 = 0; - uVar5 = 0; + uVar4 = 0; if (param_7 != 0) { - uVar5 = *(undefined8 *)(param_7 + 8); + uVar4 = *(undefined8 *)(param_7 + 8); } - iVar3 = (*(code *)PTR_SrvCryptEncrypt_180019088) - (param_2,param_3,param_4,param_5,param_6,uVar5,param_8,param_9,param_10, + iVar2 = (*(code *)PTR_SrvCryptEncrypt_180018088) + (param_2,param_3,param_4,param_5,param_6,uVar4,param_8,param_9,param_10, param_11); - if (iVar3 < 0) { - DebugTraceError(iVar3,"Status", + if (iVar2 < 0) { + DebugTraceError(iVar2,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvrpc.c"); } RpcRevertToSelf(); - return iVar3; + return iVar2; } - iVar3 = -0x7ff6fff7; - uVar4 = 0x80090009; + iVar2 = -0x7ff6fff7; + uVar3 = 0x80090009; } - DebugTraceError(uVar4,"Status","onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvrpc.c") + DebugTraceError(uVar3,"Status","onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvrpc.c") ; - return iVar3; + return iVar2; } ``` ## s_SrvRpcCryptDecrypt ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.48| |i_ratio|0.61| |m_ratio|0.95| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|s_SrvRpcCryptDecrypt|s_SrvRpcCryptDecrypt| |fullname|s_SrvRpcCryptDecrypt|s_SrvRpcCryptDecrypt| |refcount|3|3| |`length`|388|362| |`called`|DebugTraceError
Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled
RPCRT4.DLL::RpcImpersonateClient
RPCRT4.DLL::RpcRevertToSelf
SrvCryptDecrypt
_guard_xfg_dispatch_icall_nop|DebugTraceError
RPCRT4.DLL::RpcImpersonateClient
RPCRT4.DLL::RpcRevertToSelf
SrvCryptDecrypt
_guard_xfg_dispatch_icall_nop| |calling||| |paramcount|11|11| |`address`|18000b630|18000acb0| |`sig`|int __fastcall s_SrvRpcCryptDecrypt(undefined4 * param_1, ulonglong param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, longlong param_7, undefined8 param_8, undefined4 param_9, undefined4 * param_10, uint param_11)|int __fastcall s_SrvRpcCryptDecrypt(RPC_BINDING_HANDLE param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, longlong param_7, undefined8 param_8, undefined4 param_9, undefined4 * param_10, uint param_11)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### s_SrvRpcCryptDecrypt Called Diff ```diff --- s_SrvRpcCryptDecrypt called +++ s_SrvRpcCryptDecrypt called @@ -2 +1,0 @@ -Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled ``` ### s_SrvRpcCryptDecrypt Diff ```diff --- s_SrvRpcCryptDecrypt +++ s_SrvRpcCryptDecrypt @@ -1,51 +1,49 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ int s_SrvRpcCryptDecrypt - (undefined4 *param_1,ulonglong param_2,undefined8 param_3,undefined8 param_4, + (RPC_BINDING_HANDLE param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4, undefined8 param_5,undefined4 param_6,longlong param_7,undefined8 param_8, undefined4 param_9,undefined4 *param_10,uint param_11) { - uint uVar1; - RPC_STATUS RVar2; - int iVar3; - undefined4 uVar4; - undefined8 uVar5; + RPC_STATUS RVar1; + int iVar2; + undefined4 uVar3; + undefined8 uVar4; if (param_10 == (undefined4 *)0x0) { - iVar3 = -0x7ff6ffd9; - uVar4 = 0x80090027; + iVar2 = -0x7ff6ffd9; + uVar3 = 0x80090027; } else { - uVar1 = Feature_Servicing_KeyIsoPaddingFix_41877749__private_IsEnabled(param_1,param_2); - if ((uVar1 == 0) || ((param_11 & 0x10) == 0)) { - RVar2 = RpcImpersonateClient(param_1); - if (RVar2 != 0) { - DebugTraceError(RVar2,"Status", + if ((param_11 & 0x10) == 0) { + RVar1 = RpcImpersonateClient(param_1); + if (RVar1 != 0) { + DebugTraceError(RVar1,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvrpc.c"); return -0x7ff6ffe0; } *param_10 = 0; - uVar5 = 0; + uVar4 = 0; if (param_7 != 0) { - uVar5 = *(undefined8 *)(param_7 + 8); + uVar4 = *(undefined8 *)(param_7 + 8); } - iVar3 = (*(code *)PTR_SrvCryptDecrypt_180019090) - (param_2,param_3,param_4,param_5,param_6,uVar5,param_8,param_9,param_10, + iVar2 = (*(code *)PTR_SrvCryptDecrypt_180018090) + (param_2,param_3,param_4,param_5,param_6,uVar4,param_8,param_9,param_10, param_11); - if (iVar3 < 0) { - DebugTraceError(iVar3,"Status", + if (iVar2 < 0) { + DebugTraceError(iVar2,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvrpc.c"); } RpcRevertToSelf(); - return iVar3; + return iVar2; } - iVar3 = -0x7ff6fff7; - uVar4 = 0x80090009; + iVar2 = -0x7ff6fff7; + uVar3 = 0x80090009; } - DebugTraceError(uVar4,"Status","onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvrpc.c") + DebugTraceError(uVar3,"Status","onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvrpc.c") ; - return iVar3; + return iVar2; } ``` ## SrvCryptOpenKey ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.24| |i_ratio|0.18| |m_ratio|0.96| |b_ratio|0.49| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvCryptOpenKey|SrvCryptOpenKey| |fullname|SrvCryptOpenKey|SrvCryptOpenKey| |`refcount`|5|4| |`length`|724|734| |`called`|DebugTraceError
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlFreeHeap
NTDLL.DLL::RtlLeaveCriticalSection
NormalizeNteStatus
SrvDereferenceProvider
_guard_xfg_dispatch_icall_nop|DebugTraceError
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NormalizeNteStatus
SrvCryptLocalFree
SrvDereferenceProvider
_guard_xfg_dispatch_icall_nop| |calling|s_SrvRpcCryptOpenKey|s_SrvRpcCryptOpenKey| |paramcount|6|6| |`address`|180002f70|1800035b0| |sig|uint __fastcall SrvCryptOpenKey(longlong param_1, longlong param_2, undefined8 * param_3, undefined8 param_4, undefined4 param_5, undefined4 param_6)|uint __fastcall SrvCryptOpenKey(longlong param_1, longlong param_2, undefined8 * param_3, undefined8 param_4, undefined4 param_5, undefined4 param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvCryptOpenKey Called Diff ```diff --- SrvCryptOpenKey called +++ SrvCryptOpenKey called @@ -4 +3,0 @@ -NTDLL.DLL::RtlFreeHeap @@ -6,0 +6 @@ +SrvCryptLocalFree ``` ### SrvCryptOpenKey Diff ```diff --- SrvCryptOpenKey +++ SrvCryptOpenKey @@ -1,176 +1,140 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ uint SrvCryptOpenKey(longlong param_1,longlong param_2,undefined8 *param_3,undefined8 param_4, undefined4 param_5,undefined4 param_6) { - int *piVar1; - longlong *plVar2; - longlong lVar3; - code *pcVar4; - undefined8 *puVar5; - undefined8 *puVar6; - uint uVar7; - uint uVar8; - char *pcVar9; + longlong *plVar1; + undefined8 uVar2; + code *pcVar3; + bool bVar4; + uint uVar5; + uint uVar6; + longlong *plVar7; + undefined8 *puVar8; + longlong lVar9; char *pcVar10; - longlong *plVar11; + undefined1 *puVar11; + longlong *plVar12; + char *pcVar13; + undefined1 auStack_58 [8]; + undefined1 auStack_50 [24]; + undefined4 local_38; + puVar11 = auStack_58; if (param_1 != 0) { RtlEnterCriticalSection(param_1 + 0x28); - puVar6 = *(undefined8 **)(param_1 + 0x50); - do { - puVar5 = puVar6; - if (puVar5 == (undefined8 *)(param_1 + 0x50)) goto LAB_0; - piVar1 = (int *)(puVar5 + -2); - puVar6 = (undefined8 *)*puVar5; - } while (puVar5[0x29] != param_2); - if (*piVar1 == 0x44444446) { - LOCK(); - *(int *)(puVar5 + -1) = *(int *)(puVar5 + -1) + 1; - UNLOCK(); + plVar7 = *(longlong **)(param_1 + 0x50); + plVar12 = (longlong *)0x0; + bVar4 = false; + if (plVar7 == (longlong *)(param_1 + 0x50)) { +LAB_0: RtlLeaveCriticalSection(param_1 + 0x28); - if (piVar1 != (int *)0x0) { + if (!bVar4) { + plVar12 = (longlong *)0x0; + } + if (plVar12 != (longlong *)0x0) { if (param_3 == (undefined8 *)0x0) { - pcVar9 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + pcVar13 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; pcVar10 = "Status"; - uVar7 = 0x80090027; + uVar5 = 0x80090027; DebugTraceError(0x80090027,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); } else { - pcVar9 = (char *)RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30) - ,0,0x38); - if (pcVar9 == (char *)0x0) { - pcVar9 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + puVar8 = (undefined8 *) + RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,0x38) + ; + if (puVar8 == (undefined8 *)0x0) { + pcVar13 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; pcVar10 = "Status"; - uVar7 = 0x8009000e; + uVar5 = 0x8009000e; DebugTraceError(0x8009000e,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); } else { - pcVar9[0] = '\0'; - pcVar9[1] = '\0'; - pcVar9[2] = '\0'; - pcVar9[3] = '\0'; - pcVar9[4] = '\0'; - pcVar9[5] = '\0'; - pcVar9[6] = '\0'; - pcVar9[7] = '\0'; - pcVar9[8] = '\0'; - pcVar9[9] = '\0'; - pcVar9[10] = '\0'; - pcVar9[0xb] = '\0'; - pcVar9[0xc] = '\0'; - pcVar9[0xd] = '\0'; - pcVar9[0xe] = '\0'; - pcVar9[0xf] = '\0'; - pcVar9[0x10] = '\0'; - pcVar9[0x11] = '\0'; - pcVar9[0x12] = '\0'; - pcVar9[0x13] = '\0'; - pcVar9[0x14] = '\0'; - pcVar9[0x15] = '\0'; - pcVar9[0x16] = '\0'; - pcVar9[0x17] = '\0'; - pcVar9[0x18] = '\0'; - pcVar9[0x19] = '\0'; - pcVar9[0x1a] = '\0'; - pcVar9[0x1b] = '\0'; - pcVar9[0x1c] = '\0'; - pcVar9[0x1d] = '\0'; - pcVar9[0x1e] = '\0'; - pcVar9[0x1f] = '\0'; - pcVar9[0x20] = '\0'; - pcVar9[0x21] = '\0'; - pcVar9[0x22] = '\0'; - pcVar9[0x23] = '\0'; - pcVar9[0x24] = '\0'; - pcVar9[0x25] = '\0'; - pcVar9[0x26] = '\0'; - pcVar9[0x27] = '\0'; - pcVar9[0x28] = '\0'; - pcVar9[0x29] = '\0'; - pcVar9[0x2a] = '\0'; - pcVar9[0x2b] = '\0'; - pcVar9[0x2c] = '\0'; - pcVar9[0x2d] = '\0'; - pcVar9[0x2e] = '\0'; - pcVar9[0x2f] = '\0'; - pcVar9[0x30] = '\0'; - pcVar9[0x31] = '\0'; - pcVar9[0x32] = '\0'; - pcVar9[0x33] = '\0'; - pcVar9[0x34] = '\0'; - pcVar9[0x35] = '\0'; - pcVar9[0x36] = '\0'; - pcVar9[0x37] = '\0'; - uVar7 = (*(code *)puVar5[5])(puVar5[0x21],pcVar9 + 0x28,param_4,param_5,param_6); - if (uVar7 == 0) { - *(int **)(pcVar9 + 0x20) = piVar1; - pcVar9[0] = 'G'; - pcVar9[1] = 'D'; - pcVar9[2] = 'D'; - pcVar9[3] = 'D'; - pcVar9[4] = '\0'; - pcVar9[5] = '\0'; - pcVar9[6] = '\0'; - pcVar9[7] = '\0'; - pcVar9[8] = '\x01'; - pcVar9[9] = '\0'; - pcVar9[10] = '\0'; - pcVar9[0xb] = '\0'; + *puVar8 = 0; + puVar8[1] = 0; + puVar8[2] = 0; + puVar8[3] = 0; + puVar8[4] = 0; + puVar8[5] = 0; + puVar8[6] = 0; + local_38 = param_6; + uVar5 = (*(code *)plVar12[7])(plVar12[0x23],puVar8 + 5,param_4,param_5); + if (uVar5 == 0) { + puVar8[4] = plVar12; + *puVar8 = 0x44444447; + puVar8[1] = 1; RtlEnterCriticalSection(param_1 + 0x68); *(longlong *)(param_1 + 0xa0) = *(longlong *)(param_1 + 0xa0) + 1; - plVar11 = (longlong *)(param_1 + 0x90); - *(undefined8 *)(pcVar9 + 0x30) = *(undefined8 *)(param_1 + 0xa0); - plVar2 = (longlong *)(pcVar9 + 0x10); - lVar3 = *plVar11; - if (*(longlong **)(lVar3 + 8) == plVar11) { - *plVar2 = lVar3; - *(longlong **)(pcVar9 + 0x18) = plVar11; - *(longlong **)(lVar3 + 8) = plVar2; - *plVar11 = (longlong)plVar2; - RtlLeaveCriticalSection(param_1 + 0x68); - LOCK(); - *(int *)(pcVar9 + 8) = *(int *)(pcVar9 + 8) + 1; - UNLOCK(); - *param_3 = *(undefined8 *)(pcVar9 + 0x30); - return 0; + uVar2 = *(undefined8 *)(param_1 + 0xa0); + puVar8[6] = uVar2; + *param_3 = uVar2; + LOCK(); + puVar8[1] = puVar8[1] + 1; + UNLOCK(); + plVar12 = (longlong *)(param_1 + 0x90); + plVar7 = puVar8 + 2; + lVar9 = *plVar12; + if (*(longlong **)(lVar9 + 8) != plVar12) { + pcVar3 = (code *)swi(0x29); + lVar9 = (*pcVar3)(3); + puVar11 = auStack_50; } - pcVar4 = (code *)swi(0x29); - (*pcVar4)(3); - DebugTraceError(0x80090027,"Status", - "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvrpc.c"); - return 0x80090027; + *plVar7 = lVar9; + puVar8[3] = plVar12; + *(longlong **)(lVar9 + 8) = plVar7; + *plVar12 = (longlong)plVar7; + *(undefined8 *)(puVar11 + -8) = 0x180003867; + RtlLeaveCriticalSection(param_1 + 0x68); + return 0; } - DebugTraceError(uVar7,"Status", + pcVar13 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + DebugTraceError(uVar5,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - if (*(longlong *)(pcVar9 + 0x28) != 0) { - (*(code *)puVar5[0xe])(puVar5[0x21]); + pcVar10 = (char *)puVar8[5]; + if (pcVar10 != (char *)0x0) { + (*(code *)plVar12[0x10])(plVar12[0x23]); } - pcVar10 = (char *)0x0; - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30)); + SrvCryptLocalFree((undefined1 *)puVar8); } } - uVar8 = SrvDereferenceProvider((undefined1 *)piVar1,pcVar10,pcVar9); - if (((-1 < (int)uVar8) || ((int)uVar7 < 0)) && (uVar8 = uVar7, uVar7 == 0)) { + uVar6 = SrvDereferenceProvider((undefined1 *)plVar12,pcVar10,pcVar13); + if (((int)uVar6 < 0) && (-1 < (int)uVar5)) { + uVar5 = NormalizeNteStatus(uVar6); + return uVar5; + } + if (uVar5 == 0) { return 0; } - goto LAB_1; + uVar5 = NormalizeNteStatus(uVar5); + return uVar5; } } else { -LAB_0: + do { + plVar12 = plVar7 + -2; + plVar1 = (longlong *)*plVar7; + if (plVar7[0x29] == param_2) { + bVar4 = false; + if ((int)*plVar12 == 0x44444446) { + LOCK(); + plVar7[-1] = plVar7[-1] + 1; + UNLOCK(); + bVar4 = true; + } + goto LAB_0; + } + plVar7 = plVar1; + } while (plVar1 != (longlong *)(param_1 + 0x50)); RtlLeaveCriticalSection(param_1 + 0x28); } } DebugTraceError(0x80090026,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - uVar8 = 0x80090026; -LAB_1: - uVar8 = NormalizeNteStatus(uVar8); - return uVar8; + uVar5 = NormalizeNteStatus(0x80090026); + return uVar5; } ``` ## SrvFreeSecret ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.68| |i_ratio|0.51| |m_ratio|0.87| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvFreeSecret|SrvFreeSecret| |fullname|SrvFreeSecret|SrvFreeSecret| |refcount|2|2| |`length`|174|132| |`called`|DebugTraceError
NTDLL.DLL::RtlFreeHeap
NormalizeNteStatus
SrvDereferenceProvider
_guard_xfg_dispatch_icall_nop|DebugTraceError
NormalizeNteStatus
SrvCryptLocalFree
SrvDereferenceProvider
_guard_xfg_dispatch_icall_nop| |calling|SrvDereferenceSecret|SrvDereferenceSecret| |paramcount|3|3| |`address`|18000a488|180009b34| |sig|uint __fastcall SrvFreeSecret(undefined1 * param_1, undefined8 param_2, char * param_3)|uint __fastcall SrvFreeSecret(undefined1 * param_1, undefined8 param_2, char * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvFreeSecret Called Diff ```diff --- SrvFreeSecret called +++ SrvFreeSecret called @@ -2 +1,0 @@ -NTDLL.DLL::RtlFreeHeap @@ -3,0 +3 @@ +SrvCryptLocalFree ``` ### SrvFreeSecret Diff ```diff --- SrvFreeSecret +++ SrvFreeSecret @@ -1,35 +1,28 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ uint SrvFreeSecret(undefined1 *param_1,undefined8 param_2,char *param_3) { uint uVar1; uint uVar2; - longlong lVar3; - char *pcVar4; - undefined1 *puVar5; + char *pcVar3; - pcVar4 = *(char **)(param_1 + 0x28); + pcVar3 = *(char **)(param_1 + 0x28); uVar1 = (**(code **)(*(longlong *)(param_1 + 0x20) + 0xf8)) (*(undefined8 *)(*(longlong *)(param_1 + 0x20) + 0x118)); if ((int)uVar1 < 0) { param_3 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar4 = "Status"; + pcVar3 = "Status"; DebugTraceError(uVar1,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); uVar1 = NormalizeNteStatus(uVar1); } - uVar2 = SrvDereferenceProvider(*(undefined1 **)(param_1 + 0x20),pcVar4,param_3); + uVar2 = SrvDereferenceProvider(*(undefined1 **)(param_1 + 0x20),pcVar3,param_3); if (((int)uVar2 < 0) && (-1 < (int)uVar1)) { uVar1 = uVar2; } - puVar5 = param_1; - for (lVar3 = 0x38; lVar3 != 0; lVar3 = lVar3 + -1) { - *puVar5 = 0; - puVar5 = puVar5 + 1; - } - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,param_1); + SrvCryptLocalFree(param_1); return uVar1; } ``` ## SrvAddSecretToList ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.34| |i_ratio|0.39| |m_ratio|0.94| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvAddSecretToList|SrvAddSecretToList| |fullname|SrvAddSecretToList|SrvAddSecretToList| |refcount|2|2| |`length`|139|156| |called|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection| |calling|SrvCryptSecretAgreement|SrvCryptSecretAgreement| |paramcount|2|3| |`address`|18000cf64|18000c524| |`sig`|undefined8 __fastcall SrvAddSecretToList(longlong param_1, longlong param_2)|undefined8 __fastcall SrvAddSecretToList(longlong param_1, longlong param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvAddSecretToList Diff ```diff --- SrvAddSecretToList +++ SrvAddSecretToList @@ -1,37 +1,39 @@ -undefined8 SrvAddSecretToList(longlong param_1,longlong param_2) +undefined8 SrvAddSecretToList(longlong param_1,longlong param_2,undefined8 *param_3) { - code *pcVar1; - longlong *plVar2; + undefined8 uVar1; + code *pcVar2; longlong lVar3; - longlong *plVar4; - undefined1 *puVar5; + undefined1 *puVar4; + longlong *plVar5; + longlong *plVar6; undefined1 auStack_28 [8]; undefined1 auStack_20 [24]; - puVar5 = auStack_28; + puVar4 = auStack_28; RtlEnterCriticalSection(param_1 + 0xa8); *(longlong *)(param_1 + 0xe0) = *(longlong *)(param_1 + 0xe0) + 1; - plVar4 = (longlong *)(param_1 + 0xd0); - *(undefined8 *)(param_2 + 0x30) = *(undefined8 *)(param_1 + 0xe0); - plVar2 = (longlong *)(param_2 + 0x10); - lVar3 = *plVar4; - if (*(longlong **)(lVar3 + 8) != plVar4) { - lVar3 = 3; - pcVar1 = (code *)swi(0x29); - plVar2 = (longlong *)(*pcVar1)(); - puVar5 = auStack_20; + uVar1 = *(undefined8 *)(param_1 + 0xe0); + *(undefined8 *)(param_2 + 0x30) = uVar1; + *param_3 = uVar1; + LOCK(); + *(longlong *)(param_2 + 8) = *(longlong *)(param_2 + 8) + 1; + UNLOCK(); + plVar5 = (longlong *)(param_1 + 0xd0); + plVar6 = (longlong *)(param_2 + 0x10); + lVar3 = *plVar5; + if (*(longlong **)(lVar3 + 8) != plVar5) { + pcVar2 = (code *)swi(0x29); + lVar3 = (*pcVar2)(3); + puVar4 = auStack_20; } - *plVar2 = lVar3; - plVar2[1] = (longlong)plVar4; - *(longlong **)(lVar3 + 8) = plVar2; - *plVar4 = (longlong)plVar2; - *(undefined8 *)(puVar5 + -8) = 0x18000cfd4; + *plVar6 = lVar3; + *(longlong **)(param_2 + 0x18) = plVar5; + *(longlong **)(lVar3 + 8) = plVar6; + *plVar5 = (longlong)plVar6; + *(undefined8 *)(puVar4 + -8) = 0x18000c5a4; RtlLeaveCriticalSection(param_1 + 0xa8); - LOCK(); - *(int *)(param_2 + 8) = *(int *)(param_2 + 8) + 1; - UNLOCK(); return 0; } ``` ## SrvRemoveSecretFromList ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.44| |i_ratio|0.71| |m_ratio|0.95| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvRemoveSecretFromList|SrvRemoveSecretFromList| |fullname|SrvRemoveSecretFromList|SrvRemoveSecretFromList| |refcount|4|4| |`length`|105|110| |called|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
SrvDereferenceSecret|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
SrvDereferenceSecret| |calling|SrvCryptFreeSecret
SrvCryptRundownContext
SrvRundownSecretList|SrvCryptFreeSecret
SrvCryptRundownContext
SrvRundownSecretList| |paramcount|2|2| |`address`|18000d658|18000cb60| |`sig`|undefined __fastcall SrvRemoveSecretFromList(longlong param_1, undefined1 * param_2)|ulonglong __fastcall SrvRemoveSecretFromList(longlong param_1, undefined1 * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvRemoveSecretFromList Diff ```diff --- SrvRemoveSecretFromList +++ SrvRemoveSecretFromList @@ -1,29 +1,31 @@ -void SrvRemoveSecretFromList(longlong param_1,undefined1 *param_2) +ulonglong SrvRemoveSecretFromList(longlong param_1,undefined1 *param_2) { longlong *plVar1; longlong lVar2; - code *pcVar3; - undefined1 *puVar4; - longlong *plVar5; + longlong *plVar3; + code *pcVar4; + uint uVar5; + ulonglong uVar6; + undefined1 *puVar7; - puVar4 = param_2; + puVar7 = param_2; RtlEnterCriticalSection(param_1 + 0xa8); plVar1 = (longlong *)(param_2 + 0x10); lVar2 = *plVar1; if ((*(longlong **)(lVar2 + 8) == plVar1) && - (plVar5 = *(longlong **)(param_2 + 0x18), (longlong *)*plVar5 == plVar1)) { - *plVar5 = lVar2; - *(longlong **)(lVar2 + 8) = plVar5; + (plVar3 = *(longlong **)(param_2 + 0x18), (longlong *)*plVar3 == plVar1)) { + *plVar3 = lVar2; + *(longlong **)(lVar2 + 8) = plVar3; + uVar5 = SrvDereferenceSecret(param_2,puVar7,(char *)plVar3); RtlLeaveCriticalSection(param_1 + 0xa8); - SrvDereferenceSecret(param_2,puVar4,(char *)plVar5); - return; + return (ulonglong)uVar5; } - pcVar3 = (code *)swi(0x29); - (*pcVar3)(3); - pcVar3 = (code *)swi(3); - (*pcVar3)(); - return; + pcVar4 = (code *)swi(0x29); + (*pcVar4)(3); + pcVar4 = (code *)swi(3); + uVar6 = (*pcVar4)(); + return uVar6; } ``` ## SrvCryptEnumKeys ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.33| |i_ratio|0.56| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvCryptEnumKeys|SrvCryptEnumKeys| |fullname|SrvCryptEnumKeys|SrvCryptEnumKeys| |refcount|4|4| |`length`|1334|1307| |`called`|
Expand for full list:
DebugTraceError
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlFreeHeap
NormalizeNteStatus
SrvAddMemoryBufferToList
SrvDereferenceProvider
SrvLookupAndReferenceProvider
SrvLookupMemoryBufferFromList
StringCchCopyW
StringCchLengthW
ULongLongMult_guard_xfg_dispatch_icall_nop
|
Expand for full list:
DebugTraceError
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlFreeHeap
NormalizeNteStatus
SrvAddMemoryBufferToList
SrvCryptLocalFree
SrvDereferenceProvider
SrvLookupAndReferenceProvider
SrvLookupMemoryBufferFromList
StringCchCopyW
StringCchLengthWULongLongMult
_guard_xfg_dispatch_icall_nop
| |calling|s_SrvRpcCryptEnumKeys|s_SrvRpcCryptEnumKeys| |paramcount|6|6| |`address`|180008b60|1800083b0| |`sig`|uint __fastcall SrvCryptEnumKeys(longlong param_1, longlong param_2, undefined8 param_3, undefined8 * param_4, longlong * param_5, undefined4 param_6)|uint __fastcall SrvCryptEnumKeys(longlong param_1, longlong param_2, undefined8 param_3, undefined8 * param_4, char * param_5, undefined4 param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvCryptEnumKeys Called Diff ```diff --- SrvCryptEnumKeys called +++ SrvCryptEnumKeys called @@ -5,0 +6 @@ +SrvCryptLocalFree ``` ### SrvCryptEnumKeys Diff ```diff --- SrvCryptEnumKeys +++ SrvCryptEnumKeys @@ -1,252 +1,237 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ uint SrvCryptEnumKeys(longlong param_1,longlong param_2,undefined8 param_3,undefined8 *param_4, - longlong *param_5,undefined4 param_6) + char *param_5,undefined4 param_6) { - STRSAFE_LPCWSTR pwVar1; - HRESULT HVar2; + HRESULT HVar1; + uint uVar2; uint uVar3; - uint uVar4; - undefined1 *puVar5; - STRSAFE_LPCWSTR pwVar6; - ulonglong uVar7; - STRSAFE_LPCWSTR pwVar8; - undefined8 uVar9; - STRSAFE_LPWSTR pwVar10; - undefined4 uVar11; - char *pcVar12; - char *pszSrc; + undefined1 *puVar4; + ulonglong *puVar5; + ulonglong uVar6; + STRSAFE_LPCWSTR pwVar7; + undefined8 uVar8; + STRSAFE_LPWSTR pwVar9; + undefined4 uVar10; + char *pcVar11; + ulonglong *puVar12; + STRSAFE_LPCWSTR pszSrc; undefined8 *local_res8; undefined4 local_58; undefined4 uStack_54; - longlong local_50; + ulonglong local_50; size_t local_48; - STRSAFE_LPCWSTR local_40; + ulonglong *local_40; - pwVar6 = (STRSAFE_LPCWSTR)0x0; - puVar5 = (undefined1 *)0x0; + puVar5 = (ulonglong *)0x0; + puVar4 = (undefined1 *)0x0; local_50 = 0; - pwVar8 = (STRSAFE_LPCWSTR)0x0; + pwVar7 = (STRSAFE_LPCWSTR)0x0; local_res8 = (undefined8 *)0x0; - uVar7 = 0; + uVar6 = 0; if ((param_1 == 0) || - (puVar5 = (undefined1 *)SrvLookupAndReferenceProvider(param_1,param_2,0), - puVar5 == (undefined1 *)0x0)) { - uVar3 = 0x80090026; - uVar11 = 0x80090026; + (puVar4 = (undefined1 *)SrvLookupAndReferenceProvider(param_1,param_2,0), + puVar4 == (undefined1 *)0x0)) { + uVar2 = 0x80090026; + uVar10 = 0x80090026; } else { - if ((param_4 == (undefined8 *)0x0) || (param_5 == (longlong *)0x0)) { - uVar3 = 0x80090027; - HVar2 = -0x7ff6ffd9; + if ((param_4 == (undefined8 *)0x0) || (param_5 == (char *)0x0)) { + uVar2 = 0x80090027; + HVar1 = -0x7ff6ffd9; goto LAB_0; } - if (*param_5 == 0) { - pwVar6 = (STRSAFE_LPCWSTR) + if (*(longlong *)param_5 == 0) { + puVar5 = (ulonglong *) RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,0x28); - if (pwVar6 != (STRSAFE_LPCWSTR)0x0) { + if (puVar5 != (ulonglong *)0x0) { local_50 = 0; - pwVar6[0] = L'\0'; - pwVar6[1] = L'\0'; - pwVar6[2] = L'\0'; - pwVar6[3] = L'\0'; - pwVar6[4] = L'\0'; - pwVar6[5] = L'\0'; - pwVar6[6] = L'\0'; - pwVar6[7] = L'\0'; - pwVar6[8] = L'\0'; - pwVar6[9] = L'\0'; - pwVar6[10] = L'\0'; - pwVar6[0xb] = L'\0'; - pwVar6[0xc] = L'\0'; - pwVar6[0xd] = L'\0'; - pwVar6[0xe] = L'\0'; - pwVar6[0xf] = L'\0'; - pwVar6[0x10] = L'\0'; - pwVar6[0x11] = L'\0'; - pwVar6[0x12] = L'\0'; - pwVar6[0x13] = L'\0'; + *puVar5 = 0; + puVar5[1] = 0; + puVar5[2] = 0; + puVar5[3] = 0; + puVar5[4] = 0; goto LAB_1; } } else { - uVar7 = SrvLookupMemoryBufferFromList(param_1,*param_5,0); - if (uVar7 == 0) { - uVar3 = 0x80090027; - uVar11 = 0x80090027; + uVar6 = SrvLookupMemoryBufferFromList(param_1,*(longlong *)param_5,0); + if (uVar6 == 0) { + uVar2 = 0x80090027; + uVar10 = 0x80090027; goto LAB_2; } - local_50 = *(longlong *)(uVar7 + 8); + local_50 = *(ulonglong *)(uVar6 + 8); LAB_1: - uVar3 = (**(code **)(puVar5 + 0xb0)) - (*(undefined8 *)(puVar5 + 0x118),param_3,&local_res8,&local_50,param_6); - if (uVar3 != 0) { - pszSrc = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar12 = "Status"; - DebugTraceError(uVar3,"Status", + uVar2 = (**(code **)(puVar4 + 0xb0)) + (*(undefined8 *)(puVar4 + 0x118),param_3,&local_res8,&local_50,param_6); + puVar12 = puVar5; + if (uVar2 != 0) { + param_5 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + pcVar11 = "Status"; + DebugTraceError(uVar2,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - uVar3 = NormalizeNteStatus(uVar3); + uVar2 = NormalizeNteStatus(uVar2); goto LAB_3; } - pwVar8 = (STRSAFE_LPCWSTR) + pwVar7 = (STRSAFE_LPCWSTR) RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,0x18); - if (pwVar8 != (STRSAFE_LPCWSTR)0x0) { - uVar9 = local_res8[1]; - *(undefined8 *)pwVar8 = *local_res8; - *(undefined8 *)(pwVar8 + 4) = uVar9; - *(undefined8 *)(pwVar8 + 8) = local_res8[2]; - pwVar8[4] = L'\0'; - pwVar8[5] = L'\0'; - pwVar8[6] = L'\0'; - pwVar8[7] = L'\0'; - pwVar8[0] = L'\0'; - pwVar8[1] = L'\0'; - pwVar8[2] = L'\0'; - pwVar8[3] = L'\0'; - HVar2 = StringCchLengthW((STRSAFE_PCNZWCH)*local_res8,0x200,&local_48); - if (HVar2 < 0) { - uVar3 = 0x80090020; - pcVar12 = "hr"; + if (pwVar7 != (STRSAFE_LPCWSTR)0x0) { + uVar8 = local_res8[1]; + *(undefined8 *)pwVar7 = *local_res8; + *(undefined8 *)(pwVar7 + 4) = uVar8; + *(undefined8 *)(pwVar7 + 8) = local_res8[2]; + pwVar7[4] = L'\0'; + pwVar7[5] = L'\0'; + pwVar7[6] = L'\0'; + pwVar7[7] = L'\0'; + pwVar7[0] = L'\0'; + pwVar7[1] = L'\0'; + pwVar7[2] = L'\0'; + pwVar7[3] = L'\0'; + HVar1 = StringCchLengthW((STRSAFE_PCNZWCH)*local_res8,0x200,&local_48); + if (HVar1 < 0) { + uVar2 = 0x80090020; + pcVar11 = "hr"; } else { - local_40 = (STRSAFE_LPCWSTR)(local_48 + 1); - uVar9 = ULongLongMult((ulonglong)local_40,2,(undefined8 *)&local_58); - HVar2 = (HRESULT)uVar9; - if (HVar2 < 0) { - uVar3 = 0x80090020; - pcVar12 = "hr"; + local_40 = (ulonglong *)(local_48 + 1); + uVar8 = ULongLongMult((ulonglong)local_40,2,(undefined8 *)&local_58); + HVar1 = (HRESULT)uVar8; + if (HVar1 < 0) { + uVar2 = 0x80090020; + pcVar11 = "hr"; } else if (CONCAT44(uStack_54,local_58) < 0x100000000) { - HVar2 = 0; - pwVar10 = (STRSAFE_LPWSTR) - RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0, - local_58); - *(STRSAFE_LPWSTR *)pwVar8 = pwVar10; - if (pwVar10 == (STRSAFE_LPWSTR)0x0) { - uVar3 = 0x8009000e; - pcVar12 = "hr"; + HVar1 = 0; + pwVar9 = (STRSAFE_LPWSTR) + RtlAllocateHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0, + local_58); + *(STRSAFE_LPWSTR *)pwVar7 = pwVar9; + if (pwVar9 == (STRSAFE_LPWSTR)0x0) { + uVar2 = 0x8009000e; + pcVar11 = "hr"; } else { - HVar2 = StringCchCopyW(pwVar10,(size_t)local_40,(STRSAFE_LPCWSTR)*local_res8); - if (HVar2 < 0) { - uVar3 = 0x80090020; - pcVar12 = "hr"; + HVar1 = StringCchCopyW(pwVar9,(size_t)local_40,(STRSAFE_LPCWSTR)*local_res8); + if (HVar1 < 0) { + uVar2 = 0x80090020; + pcVar11 = "hr"; } else { - HVar2 = StringCchLengthW((STRSAFE_PCNZWCH)local_res8[1],0x200,&local_48); - if (HVar2 < 0) { - uVar3 = 0x80090020; - pcVar12 = "hr"; + HVar1 = StringCchLengthW((STRSAFE_PCNZWCH)local_res8[1],0x200,&local_48); + if (HVar1 < 0) { + uVar2 = 0x80090020; + pcVar11 = "hr"; } else { - local_40 = (STRSAFE_LPCWSTR)(local_48 + 1); - uVar9 = ULongLongMult((ulonglong)local_40,2,(undefined8 *)&local_58); - HVar2 = (HRESULT)uVar9; - if (HVar2 < 0) { - uVar3 = 0x80090020; - pcVar12 = "hr"; + local_40 = (ulonglong *)(local_48 + 1); + uVar8 = ULongLongMult((ulonglong)local_40,2,(undefined8 *)&local_58); + HVar1 = (HRESULT)uVar8; + if (HVar1 < 0) { + uVar2 = 0x80090020; + pcVar11 = "hr"; } else if (CONCAT44(uStack_54,local_58) < 0x100000000) { - pwVar10 = (STRSAFE_LPWSTR) - RtlAllocateHeap(*(undefined8 *) - ((longlong)ProcessEnvironmentBlock + 0x30),0,local_58 - ); - *(STRSAFE_LPWSTR *)(pwVar8 + 4) = pwVar10; - if (pwVar10 == (STRSAFE_LPWSTR)0x0) { - uVar3 = 0x8009000e; - HVar2 = -0x7ff6fff2; + pwVar9 = (STRSAFE_LPWSTR) + RtlAllocateHeap(*(undefined8 *) + ((longlong)ProcessEnvironmentBlock + 0x30),0,local_58) + ; + *(STRSAFE_LPWSTR *)(pwVar7 + 4) = pwVar9; + if (pwVar9 == (STRSAFE_LPWSTR)0x0) { + uVar2 = 0x8009000e; + HVar1 = -0x7ff6fff2; LAB_0: - pcVar12 = "Status"; + pcVar11 = "Status"; + puVar12 = puVar5; } else { - pszSrc = (char *)local_res8[1]; - pcVar12 = (char *)local_40; - HVar2 = StringCchCopyW(pwVar10,(size_t)local_40,(STRSAFE_LPCWSTR)pszSrc); - if (-1 < HVar2) { - if (pwVar6 == (STRSAFE_LPCWSTR)0x0) { - if (local_50 != *(longlong *)(uVar7 + 8)) { - uVar3 = 0x80090020; - HVar2 = -0x7ff6ffe0; + pszSrc = (STRSAFE_LPCWSTR)local_res8[1]; + pcVar11 = (char *)local_40; + HVar1 = StringCchCopyW(pwVar9,(size_t)local_40,pszSrc); + if (-1 < HVar1) { + if (puVar5 == (ulonglong *)0x0) { + param_5 = (char *)pszSrc; + if (local_50 != *(ulonglong *)(uVar6 + 8)) { + uVar2 = 0x80090020; + HVar1 = -0x7ff6ffe0; goto LAB_0; } } else { LOCK(); - *(int *)(puVar5 + 8) = *(int *)(puVar5 + 8) + 1; + *(longlong *)(puVar4 + 8) = *(longlong *)(puVar4 + 8) + 1; UNLOCK(); - *(undefined1 **)pwVar6 = puVar5; - *(longlong *)(pwVar6 + 4) = local_50; - pcVar12 = (char *)pwVar6; - SrvAddMemoryBufferToList(param_1,(longlong)pwVar6); - pwVar1 = pwVar6 + 0x10; - pwVar6 = (STRSAFE_LPCWSTR)0x0; - *param_5 = *(longlong *)pwVar1; + *puVar5 = (ulonglong)puVar4; + puVar5[1] = local_50; + SrvAddMemoryBufferToList(param_1,(longlong)puVar5,(undefined8 *)param_5); + puVar12 = (ulonglong *)0x0; + pcVar11 = (char *)puVar5; } - uVar3 = 0; - *param_4 = pwVar8; + uVar2 = 0; + *param_4 = pwVar7; goto LAB_3; } - uVar3 = 0x80090020; - pcVar12 = "hr"; + uVar2 = 0x80090020; + pcVar11 = "hr"; } } else { - uVar3 = 0x80090020; - pcVar12 = "hr"; - HVar2 = -0x7ff8fdea; + uVar2 = 0x80090020; + pcVar11 = "hr"; + HVar1 = -0x7ff8fdea; } } } } } else { - uVar3 = 0x80090020; - pcVar12 = "hr"; - HVar2 = -0x7ff8fdea; + uVar2 = 0x80090020; + pcVar11 = "hr"; + HVar1 = -0x7ff8fdea; } } - pszSrc = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - DebugTraceError(HVar2,pcVar12, + param_5 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + DebugTraceError(HVar1,pcVar11, "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - if (pwVar8 != (STRSAFE_LPCWSTR)0x0) { - if (*(longlong *)(pwVar8 + 4) != 0) { + if (pwVar7 != (STRSAFE_LPCWSTR)0x0) { + if (*(longlong *)(pwVar7 + 4) != 0) { RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30)); } - if (*(longlong *)pwVar8 != 0) { + if (*(longlong *)pwVar7 != 0) { RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30)); } - pcVar12 = (char *)0x0; + pcVar11 = (char *)0x0; RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30)); - pszSrc = (char *)pwVar8; + param_5 = (char *)pwVar7; } goto LAB_3; } } - uVar3 = 0x8009000e; - uVar11 = 0x8009000e; + uVar2 = 0x8009000e; + uVar10 = 0x8009000e; } LAB_2: - pszSrc = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar12 = "Status"; - DebugTraceError(uVar11,"Status","onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c" + param_5 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + pcVar11 = "Status"; + DebugTraceError(uVar10,"Status","onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c" ); + puVar12 = puVar5; LAB_3: - if (((local_res8 != (undefined8 *)0x0) && (uVar4 = (**(code **)(puVar5 + 0x88))(), (int)uVar4 < 0) - ) && (-1 < (int)uVar3)) { - uVar3 = NormalizeNteStatus(uVar4); - } - if (pwVar6 != (STRSAFE_LPCWSTR)0x0) { - pcVar12 = (char *)0x0; - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30)); - pszSrc = (char *)pwVar6; - } - if (((puVar5 != (undefined1 *)0x0) && - (uVar4 = SrvDereferenceProvider(puVar5,pcVar12,pszSrc), (int)uVar4 < 0)) && (-1 < (int)uVar3)) - { - uVar3 = uVar4; - } - return uVar3; + if (((local_res8 != (undefined8 *)0x0) && (uVar3 = (**(code **)(puVar4 + 0x88))(), (int)uVar3 < 0) + ) && (-1 < (int)uVar2)) { + uVar2 = NormalizeNteStatus(uVar3); + } + if (puVar12 != (ulonglong *)0x0) { + SrvCryptLocalFree((undefined1 *)puVar12); + } + if (((puVar4 != (undefined1 *)0x0) && + (uVar3 = SrvDereferenceProvider(puVar4,pcVar11,param_5), (int)uVar3 < 0)) && (-1 < (int)uVar2) + ) { + uVar2 = uVar3; + } + return uVar2; } ``` ## SrvCryptFreeKey ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,called| |ratio|0.21| |i_ratio|0.22| |m_ratio|0.97| |b_ratio|0.46| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvCryptFreeKey|SrvCryptFreeKey| |fullname|SrvCryptFreeKey|SrvCryptFreeKey| |`refcount`|5|4| |`length`|610|594| |`called`|DebugTraceError
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlFreeHeap
NTDLL.DLL::RtlLeaveCriticalSection
NormalizeNteStatus
SrvFreeKey
SrvFreeProvider
_guard_xfg_dispatch_icall_nop|DebugTraceError
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NormalizeNteStatus
SrvCryptLocalFree
SrvFreeKey
SrvFreeProvider
_guard_xfg_dispatch_icall_nop| |calling|s_SrvRpcCryptFreeKey|s_SrvRpcCryptFreeKey| |paramcount|3|3| |`address`|180002470|1800029e0| |`sig`|uint __fastcall SrvCryptFreeKey(longlong param_1, undefined8 param_2, char * param_3)|ulonglong __fastcall SrvCryptFreeKey(longlong param_1, undefined8 param_2, char * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvCryptFreeKey Called Diff ```diff --- SrvCryptFreeKey called +++ SrvCryptFreeKey called @@ -3 +2,0 @@ -NTDLL.DLL::RtlFreeHeap @@ -5,0 +5 @@ +SrvCryptLocalFree ``` ### SrvCryptFreeKey Diff ```diff --- SrvCryptFreeKey +++ SrvCryptFreeKey @@ -1,119 +1,125 @@ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ -uint SrvCryptFreeKey(longlong param_1,undefined8 param_2,char *param_3) +ulonglong SrvCryptFreeKey(longlong param_1,undefined8 param_2,char *param_3) { - longlong *plVar1; - int *piVar2; - int iVar3; - longlong lVar4; - code *pcVar5; - longlong *plVar6; - uint uVar7; - uint uVar8; - longlong lVar9; - char *pcVar10; - undefined1 *puVar11; - undefined1 *puVar12; - longlong *plVar13; - char *pcVar14; - undefined1 auStack_28 [8]; - undefined1 auStack_20 [24]; + longlong lVar1; + longlong *plVar2; + longlong lVar3; + longlong *plVar4; + longlong lVar5; + undefined1 *puVar6; + code *pcVar7; + bool bVar8; + uint uVar9; + uint uVar10; + longlong *plVar11; + char *pcVar12; + ulonglong uVar13; + longlong *plVar14; + char *pcVar15; - puVar12 = auStack_28; - puVar11 = auStack_28; if (param_1 != 0) { - lVar9 = param_1 + 0x68; - pcVar14 = param_3; - RtlEnterCriticalSection(lVar9); - plVar13 = *(longlong **)(param_1 + 0x90); - do { - plVar6 = plVar13; - puVar11 = auStack_28; - if (plVar6 == (longlong *)(param_1 + 0x90)) goto LAB_0; - plVar1 = plVar6 + -2; - plVar13 = (longlong *)*plVar6; - } while ((char *)plVar6[4] != param_3); - puVar11 = auStack_28; - if ((int)*plVar1 == 0x44444447) { - *(int *)plVar1 = 0x44440007; - RtlLeaveCriticalSection(lVar9); - puVar11 = auStack_28; - if (plVar1 == (longlong *)0x0) goto LAB_1; - RtlEnterCriticalSection(lVar9); - lVar4 = *plVar6; - if ((*(longlong **)(lVar4 + 8) == plVar6) && - (plVar13 = (longlong *)plVar6[1], (longlong *)*plVar13 == plVar6)) { - *plVar13 = lVar4; - *(longlong **)(lVar4 + 8) = plVar13; - RtlLeaveCriticalSection(lVar9); + lVar1 = param_1 + 0x68; + bVar8 = false; + pcVar15 = param_3; + RtlEnterCriticalSection(lVar1); + plVar2 = (longlong *)(param_1 + 0x90); + plVar11 = (longlong *)*plVar2; + plVar14 = (longlong *)0x0; + if (plVar11 == plVar2) { +LAB_0: + RtlLeaveCriticalSection(lVar1); + if (!bVar8) { + plVar14 = (longlong *)0x0; + } + if (plVar14 != (longlong *)0x0) { + RtlEnterCriticalSection(lVar1); + lVar5 = plVar14[2]; + if ((*(longlong **)(lVar5 + 8) != plVar14 + 2) || + (plVar2 = (longlong *)plVar14[3], (longlong *)*plVar2 != plVar14 + 2)) { + pcVar7 = (code *)swi(0x29); + (*pcVar7)(3); + pcVar7 = (code *)swi(3); + uVar13 = (*pcVar7)(); + return uVar13; + } + *plVar2 = lVar5; + *(longlong **)(lVar5 + 8) = plVar2; LOCK(); - plVar13 = plVar6 + -1; - lVar9 = *plVar13; - *(int *)plVar13 = (int)*plVar13 + -1; + plVar2 = plVar14 + 1; + lVar3 = *plVar2; + *plVar2 = *plVar2 + -1; UNLOCK(); - if (((int)lVar9 == 1) && - (uVar7 = SrvFreeKey((undefined1 *)plVar1,param_2,pcVar14), (int)uVar7 < 0)) { - pcVar14 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvutils.c"; - DebugTraceError(uVar7,"Status", + if ((lVar3 == 1) && + (uVar9 = SrvFreeKey((undefined1 *)plVar14,lVar5,pcVar15), (int)uVar9 < 0)) { + pcVar15 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvutils.c"; + DebugTraceError(uVar9,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvutils.c"); } + RtlLeaveCriticalSection(lVar1); LOCK(); - plVar13 = plVar6 + -1; - lVar9 = *plVar13; - *(int *)plVar13 = (int)*plVar13 + -1; + plVar2 = plVar14 + 1; + lVar1 = *plVar2; + *plVar2 = *plVar2 + -1; UNLOCK(); - if ((int)lVar9 != 1) { + if (lVar1 != 1) { return 0; } - pcVar10 = (char *)plVar6[3]; - uVar7 = (**(code **)(plVar6[2] + 0x80))(*(undefined8 *)(plVar6[2] + 0x118)); - if ((int)uVar7 < 0) { - pcVar14 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; - pcVar10 = "Status"; - DebugTraceError(uVar7,"Status", + pcVar12 = (char *)plVar14[5]; + uVar9 = (**(code **)(plVar14[4] + 0x80))(*(undefined8 *)(plVar14[4] + 0x118)); + if ((int)uVar9 < 0) { + pcVar15 = "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"; + pcVar12 = "Status"; + DebugTraceError(uVar9,"Status", "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c"); - uVar7 = NormalizeNteStatus(uVar7); + uVar9 = NormalizeNteStatus(uVar9); } - puVar11 = (undefined1 *)plVar6[2]; + puVar6 = (undefined1 *)plVar14[4]; LOCK(); - piVar2 = (int *)(puVar11 + 8); - iVar3 = *piVar2; - *piVar2 = *piVar2 + -1; + plVar2 = (longlong *)(puVar6 + 8); + lVar1 = *plVar2; + *plVar2 = *plVar2 + -1; UNLOCK(); - if (((iVar3 == 1) && (uVar8 = SrvFreeProvider(puVar11,pcVar10,pcVar14), (int)uVar8 < 0)) && - (-1 < (int)uVar7)) { - uVar7 = uVar8; + if (((lVar1 == 1) && (uVar10 = SrvFreeProvider(puVar6,pcVar12,pcVar15), (int)uVar10 < 0)) && + (-1 < (int)uVar9)) { + SrvCryptLocalFree((undefined1 *)plVar14); + uVar9 = uVar10; } - plVar13 = plVar1; - for (lVar9 = 0x38; lVar9 != 0; lVar9 = lVar9 + -1) { - *(undefined1 *)plVar13 = 0; - plVar13 = (longlong *)((longlong)plVar13 + 1); + else { + SrvCryptLocalFree((undefined1 *)plVar14); + if (-1 < (int)uVar9) { + return 0; + } } - RtlFreeHeap(*(undefined8 *)((longlong)ProcessEnvironmentBlock + 0x30),0,plVar1); - if (-1 < (int)uVar7) { - return 0; + uVar13 = (ulonglong)uVar9; + DebugTraceError(uVar9,"Status", + "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvutils.c"); + goto LAB_1; + } + } + else { + do { + plVar14 = plVar11 + -2; + plVar4 = (longlong *)*plVar11; + if ((char *)plVar11[4] == param_3) { + if ((int)*plVar14 == 0x44444447) { + *(int *)plVar14 = 0x44440007; + bVar8 = true; + } + goto LAB_0; } - DebugTraceError(uVar7,"Status", - "onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvutils.c"); - goto LAB_2; - } - pcVar5 = (code *)swi(0x29); - (*pcVar5)(3); - puVar11 = auStack_20; + plVar11 = plVar4; + } while (plVar4 != plVar2); + RtlLeaveCriticalSection(lVar1); } -LAB_0: - *(undefined8 *)(puVar11 + -8) = 0x1800061d8; - RtlLeaveCriticalSection(lVar9); } + uVar13 = 0x80090026; + uVar9 = 0x80090026; LAB_1: - puVar12 = puVar11; - uVar7 = 0x80090026; -LAB_2: - *(undefined8 *)(puVar12 + -8) = 0x180006200; - DebugTraceError(uVar7,"Status","onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c") + DebugTraceError(uVar9,"Status","onecore\\ds\\security\\cryptoapi\\ncrypt\\iso\\service\\srvapi.c") ; - return uVar7; + return uVar13; } ``` ## WPP_SF_qd ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address| |ratio|0.78| |i_ratio|0.63| |m_ratio|0.97| |b_ratio|0.97| |match_types|StructuralGraphExactHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |`name`|WPP_SF_qd|WPP_SF_qi| |`fullname`|WPP_SF_qd|WPP_SF_qi| |refcount|7|7| |`length`|81|79| |called|NTDLL.DLL::EtwTraceMessage|NTDLL.DLL::EtwTraceMessage| |calling|SrvCryptRundownContext
SrvRundownKeyList
SrvRundownProviderList
SrvRundownSecretList|SrvCryptRundownContext
SrvRundownKeyList
SrvRundownProviderList
SrvRundownSecretList| |paramcount|4|4| |`address`|18000dbac|180004d04| |`sig`|undefined __fastcall WPP_SF_qd(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_qi(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_qd Diff ```diff --- WPP_SF_qd +++ WPP_SF_qi @@ -1,12 +1,12 @@ -void WPP_SF_qd(undefined8 param_1,undefined2 param_2,undefined8 param_3,undefined8 param_4) +void WPP_SF_qi(undefined8 param_1,undefined2 param_2,undefined8 param_3,undefined8 param_4) { undefined8 local_res20; local_res20 = param_4; - EtwTraceMessage(param_1,0x2b,&WPP_5666b59f7d7d3273ad7b095317ebe3d8_Traceguids,param_2,&local_res20 - ,8,&stack0x00000028,4,0); + EtwTraceMessage(param_1,0x2b,&WPP_5aa196680b183b36226bca12dfdec7bf_Traceguids,param_2,&local_res20 + ,8,&stack0x00000028,8,0); return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|5|3| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|1800050c8|180004ed8| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NormalizeNteStatus ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.69| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|NormalizeNteStatus|NormalizeNteStatus| |fullname|NormalizeNteStatus|NormalizeNteStatus| |`refcount`|31|33| |length|362|362| |called||| |calling|
Expand for full list:
SrvCryptCreateClaim
SrvCryptCreatePersistedKey
SrvCryptDecrypt
SrvCryptDeleteKey
SrvCryptDeriveKey
SrvCryptEncrypt
SrvCryptEnumAlgorithms
SrvCryptEnumKeys
SrvCryptExportKey
SrvCryptFreeKey
SrvCryptFreeProviderSrvCryptGetProviderProperty
SrvCryptImportKey
SrvCryptIsAlgSupported
SrvCryptKeyDerivation
SrvCryptNotifyChangeKey
SrvCryptOpenKey
SrvCryptSecretAgreement
SrvCryptSetKeyProperty
SrvCryptSetProviderProperty
SrvCryptSignHash
SrvCryptVerifyClaim
SrvCryptVerifySignature
SrvFreeKey
SrvFreeProvider
SrvFreeSecret
|
Expand for full list:
SrvCryptCreateClaim
SrvCryptCreatePersistedKey
SrvCryptDecrypt
SrvCryptDeleteKey
SrvCryptDeriveKey
SrvCryptEncrypt
SrvCryptEnumAlgorithms
SrvCryptEnumKeys
SrvCryptExportKey
SrvCryptFreeKey
SrvCryptFreeProviderSrvCryptGetProviderProperty
SrvCryptImportKey
SrvCryptIsAlgSupported
SrvCryptKeyDerivation
SrvCryptNotifyChangeKey
SrvCryptOpenKey
SrvCryptSecretAgreement
SrvCryptSetKeyProperty
SrvCryptSetProviderProperty
SrvCryptSignHash
SrvCryptVerifyClaim
SrvCryptVerifySignature
SrvFreeKey
SrvFreeProvider
SrvFreeSecret
| |paramcount|1|1| |`address`|18000e7b4|18000dc74| |sig|uint __fastcall NormalizeNteStatus(uint param_1)|uint __fastcall NormalizeNteStatus(uint param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## __security_check_cookie ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|6|4| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|CheckBasedOnAppContainerAccessRight
_SrvAdjustPrivilege
__GSHandlerCheckCommon
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect|CheckBasedOnAppContainerAccessRight
_SrvAdjustPrivilege
__GSHandlerCheckCommon| |paramcount|1|1| |`address`|180003fa0|180004710| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -4,2 +3,0 @@ -wil_RtlStagingConfig_QueryFeatureState -wil_details_FeatureReporting_ReportUsageToServiceDirect ``` ## API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|GetProcAddress|GetProcAddress| |fullname|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress| |`refcount`|19|17| |length|0|0| |called||| |`calling`|LoadPopKeyFunctionTable
LoadProviderEx
SrvCryptRundownContext
wil_RtlStagingConfig_QueryFeatureState
wil_RtlStagingConfig_RecordFeatureUsage|LoadPopKeyFunctionTable
LoadProviderEx
SrvCryptRundownContext| |paramcount|2|2| |`address`|EXTERNAL:0000003d|EXTERNAL:0000003e| |sig|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress Calling Diff ```diff --- API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress calling +++ API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress calling @@ -4,2 +3,0 @@ -wil_RtlStagingConfig_QueryFeatureState -wil_RtlStagingConfig_RecordFeatureUsage ``` ## SrvAddMemoryBufferToList ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|length,sig,address| |ratio|0.43| |i_ratio|0.28| |m_ratio|0.94| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvAddMemoryBufferToList|SrvAddMemoryBufferToList| |fullname|SrvAddMemoryBufferToList|SrvAddMemoryBufferToList| |refcount|2|2| |`length`|127|143| |called|NTDLL.DLL::RtlEnterCriticalSection|NTDLL.DLL::RtlEnterCriticalSection| |calling|SrvCryptEnumKeys|SrvCryptEnumKeys| |paramcount|2|3| |`address`|18000ce64|18000c414| |`sig`|undefined __fastcall SrvAddMemoryBufferToList(longlong param_1, longlong param_2)|undefined __fastcall SrvAddMemoryBufferToList(longlong param_1, longlong param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTDLL.DLL::RtlFreeHeap ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|RtlFreeHeap|RtlFreeHeap| |fullname|NTDLL.DLL::RtlFreeHeap|NTDLL.DLL::RtlFreeHeap| |`refcount`|44|33| |length|0|0| |called||| |`calling`|
Expand for full list:
GetDllPath
GetFullPath
GetImagePathInReg
LoadDllBasedOnRegistryValue
SrvCreateContext
SrvCryptCreatePersistedKey
SrvCryptEnumAlgorithms
SrvCryptEnumKeys
SrvCryptFreeKey
SrvCryptFreeProvider
SrvCryptImportKeySrvCryptNotifyChangeKey
SrvCryptOpenKey
SrvCryptRundownContext
SrvCryptSecretAgreement
SrvFreeKey
SrvFreeProvider
SrvFreeSecret
SrvRemoveContextFromList
SrvRundownProviderNotifyEventList
TokenBindingGenerateBCryptKeyBlob
TokenBindingGenerateSoftwareKeyAndImportIntoTpm
UnloadProvider
_CreateProviderNotifyEventMapping
_FreeBufferDesc
_GetImagePath
_LoadImage
_MapRPCToBufferDesc
_SrvAdjustPrivilege
|
Expand for full list:
GetDllPath
GetFullPath
GetImagePathInReg
LoadDllBasedOnRegistryValue
SrvCryptEnumAlgorithms
SrvCryptEnumKeys
SrvCryptFreeProvider
SrvCryptLocalFree
SrvCryptNotifyChangeKey
SrvCryptRundownContext
SrvRemoveContextFromListSrvRundownProviderNotifyEventList
TokenBindingGenerateBCryptKeyBlob
TokenBindingGenerateSoftwareKeyAndImportIntoTpm
UnloadProvider
_CreateProviderNotifyEventMapping
_FreeBufferDesc
_GetImagePath
_LoadImage
_MapRPCToBufferDesc
_SrvAdjustPrivilege
| |paramcount|0|0| |address|EXTERNAL:00000012|EXTERNAL:00000012| |sig|undefined RtlFreeHeap(void)|undefined RtlFreeHeap(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTDLL.DLL::RtlFreeHeap Calling Diff ```diff --- NTDLL.DLL::RtlFreeHeap calling +++ NTDLL.DLL::RtlFreeHeap calling @@ -5,2 +4,0 @@ -SrvCreateContext -SrvCryptCreatePersistedKey @@ -9 +6,0 @@ -SrvCryptFreeKey @@ -11 +8 @@ -SrvCryptImportKey +SrvCryptLocalFree @@ -13 +9,0 @@ -SrvCryptOpenKey @@ -15,4 +10,0 @@ -SrvCryptSecretAgreement -SrvFreeKey -SrvFreeProvider -SrvFreeSecret ``` ## SrvCryptLocalFree ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|refcount,length,calling,called| |ratio|0.5| |i_ratio|0.62| |m_ratio|0.92| |b_ratio|0.75| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvCryptLocalFree|SrvCryptLocalFree| |fullname|SrvCryptLocalFree|SrvCryptLocalFree| |`refcount`|3|17| |`length`|88|99| |`called`|NTDLL.DLL::RtlSizeHeap|NTDLL.DLL::RtlFreeHeap
NTDLL.DLL::RtlSizeHeap| |`calling`||SrvCryptCreatePersistedKey
SrvCryptEnumKeys
SrvCryptFreeKey
SrvCryptFreeProvider
SrvCryptImportKey
SrvCryptOpenKey
SrvCryptSecretAgreement
SrvFreeKey
SrvFreeProvider
SrvFreeSecret| |paramcount|1|1| |address|180001010|180001010| |sig|undefined __fastcall SrvCryptLocalFree(undefined1 * param_1)|undefined __fastcall SrvCryptLocalFree(undefined1 * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvCryptLocalFree Called Diff ```diff --- SrvCryptLocalFree called +++ SrvCryptLocalFree called @@ -0,0 +1 @@ +NTDLL.DLL::RtlFreeHeap ``` ### SrvCryptLocalFree Calling Diff ```diff --- SrvCryptLocalFree calling +++ SrvCryptLocalFree calling @@ -0,0 +1,10 @@ +SrvCryptCreatePersistedKey +SrvCryptEnumKeys +SrvCryptFreeKey +SrvCryptFreeProvider +SrvCryptImportKey +SrvCryptOpenKey +SrvCryptSecretAgreement +SrvFreeKey +SrvFreeProvider +SrvFreeSecret ``` ## SrvCreateContext ### Match Info |Key|keyiso-10.0.22621.819.dll - keyiso-10.0.22621.1555.dll| | :---: | :---: | |diff_type|length,address,called| |ratio|1.0| |i_ratio|0.58| |m_ratio|0.8| |b_ratio|0.8| |match_types|SymbolsHash| ### Function Meta Diff |Key|keyiso-10.0.22621.819.dll|keyiso-10.0.22621.1555.dll| | :---: | :---: | :---: | |name|SrvCreateContext|SrvCreateContext| |fullname|SrvCreateContext|SrvCreateContext| |refcount|3|3| |`length`|379|247| |`called`|DebugTraceError
NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlFreeHeap
NTDLL.DLL::RtlLeaveCriticalSection
RPCRT4.DLL::I_RpcBindingInqLocalClientPID
SrvInitContext
memset|NTDLL.DLL::RtlAllocateHeap
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
RPCRT4.DLL::I_RpcBindingInqLocalClientPID
SrvInitContext
memset| |calling|SrvCryptCreateContext|SrvCryptCreateContext| |paramcount|2|2| |`address`|180002b40|180003180| |sig|int __fastcall SrvCreateContext(RPC_BINDING_HANDLE param_1, undefined8 * param_2)|int __fastcall SrvCreateContext(RPC_BINDING_HANDLE param_1, undefined8 * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvCreateContext Called Diff ```diff --- SrvCreateContext called +++ SrvCreateContext called @@ -1 +0,0 @@ -DebugTraceError @@ -4 +2,0 @@ -NTDLL.DLL::RtlFreeHeap ``` Generated with `ghidriff` version: 1.0.0 on 2026-07-25T10:38:56