# kpssvc-05.dll-kpssvc-06.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::ReportUsage](#wildetailsfeatureimpl__wilfeaturetraits_feature_3749982522reportusage) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage](#wildetailsfeatureimpl__wilfeaturetraits_feature_4205429049reportusage) * [Added](#added) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState](#wildetailsfeatureimpl__wilfeaturetraits_feature_886835513getcachedfeatureenabledstate) * [KpsDoHttpCancelRequest](#kpsdohttpcancelrequest) * [KpsDoHttpReceiveClientCert](#kpsdohttpreceiveclientcert) * [KpsDoHttpReceiveRequest](#kpsdohttpreceiverequest) * [KpsDoHttpReceiveRequestEntity](#kpsdohttpreceiverequestentity) * [KpsDoHttpSendPostResponse](#kpsdohttpsendpostresponse) * [KpsDoHttpSendResponse](#kpsdohttpsendresponse) * [KpsDoSocketConnectAndSend](#kpsdosocketconnectandsend) * [KpsDoSocketRecvData](#kpsdosocketrecvdata) * [KpsDoSocketRecvDataLength](#kpsdosocketrecvdatalength) * [KpsForwardKerbRequest](#kpsforwardkerbrequest) * [KpsHttpCancelRequestIoCompletion](#kpshttpcancelrequestiocompletion) * [KpsHttpIoCompletion_Old](#kpshttpiocompletion_old) * [KpsHttpReceiveClientCertIoCompletion](#kpshttpreceiveclientcertiocompletion) * [KpsHttpReceiveRequestEntityIoCompletion](#kpshttpreceiverequestentityiocompletion) * [KpsHttpReceiveRequestIoCompletion](#kpshttpreceiverequestiocompletion) * [KpsHttpSendPostResponseIoCompletion](#kpshttpsendpostresponseiocompletion) * [KpsHttpSendResponseIoCompletion](#kpshttpsendresponseiocompletion) * [KpsProcessProxyRequest](#kpsprocessproxyrequest) * [KpsSocketConnectAndSendIoCompletion](#kpssocketconnectandsendiocompletion) * [wil::details::ReportUsageToService](#wildetailsreportusagetoservice) * [Modified](#modified) * [KpsHttpStart](#kpshttpstart) * [KpsHttpIoCompletion](#kpshttpiocompletion) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled](#wildetailsfeatureimpl__wilfeaturetraits_feature_4205429049__private_isenabled) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled](#wildetailsfeatureimpl__wilfeaturetraits_feature_3749982522__private_isenabled) * [KpsSocketIoCompletion](#kpssocketiocompletion) * [KpsCreateKpsIo](#kpscreatekpsio) * [WPP_SF_LZ](#wpp_sf_lz) * [KpsDoSocketConnectAndSend](#kpsdosocketconnectandsend) * [WPP_SF_qds](#wpp_sf_qds) * [KpsSocketRecvDataLengthIoCompletion](#kpssocketrecvdatalengthiocompletion) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled](#wildetailsfeatureimpl__wilfeaturetraits_feature_4205429049__private_isenabled) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled](#wildetailsfeatureimpl__wilfeaturetraits_feature_4205429049__private_isenabled) * [KpsFreeKpsIo](#kpsfreekpsio) * [KpsSocketRecvDataIoCompletion](#kpssocketrecvdataiocompletion) * [McGenEventWrite_EventWriteTransfer](#mcgeneventwrite_eventwritetransfer) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [KpsUnpackProxyRequest](#kpsunpackproxyrequest) * [KpsPerfUpdate](#kpsperfupdate) * [API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo](#api-ms-win-core-threadpool-l1-2-0dllclosethreadpoolio) * [WPP_SF_](#wpp_sf_) * [SubscribeFeatureStateCacheToConfigurationChanges](#subscribefeaturestatecachetoconfigurationchanges) * [NTDLL.DLL::RtlLeaveCriticalSection](#ntdlldllrtlleavecriticalsection) * [KpsPackProxyResponse](#kpspackproxyresponse) * [HTTPAPI.DLL::HttpReceiveClientCertificate](#httpapidllhttpreceiveclientcertificate) * [KpsCancelTimeoutTimer](#kpscanceltimeouttimer) * [API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo](#api-ms-win-core-threadpool-l1-2-0dllstartthreadpoolio) * [StringCchPrintfA](#stringcchprintfa) * [WS2_32.DLL::ntohl](#ws2_32dllntohl) * [WS2_32.DLL::socket](#ws2_32dllsocket) * [WS2_32.DLL::FreeAddrInfoW](#ws2_32dllfreeaddrinfow) * [WPP_SF_q](#wpp_sf_q) * [WPP_SF_L](#wpp_sf_l) * [HTTPAPI.DLL::HttpSendHttpResponse](#httpapidllhttpsendhttpresponse) * [API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError](#api-ms-win-core-errorhandling-l1-1-0dllgetlasterror) * [KpsStartTimeoutTimer](#kpsstarttimeouttimer) * [WS2_32.DLL::WSARecv](#ws2_32dllwsarecv) * [WPP_SF_Dsd](#wpp_sf_dsd) * [WPP_SF_LL](#wpp_sf_ll) * [EnsureSubscribedToFeatureConfigurationChanges](#ensuresubscribedtofeatureconfigurationchanges) * [HTTPAPI.DLL::HttpReceiveRequestEntityBody](#httpapidllhttpreceiverequestentitybody) * [ReportUsageToServiceDirect](#reportusagetoservicedirect) * [KpsGetKdcBinding](#kpsgetkdcbinding) * [KpsServiceReady](#kpsserviceready) * [__security_check_cookie](#__security_check_cookie) * [WPP_SF_ZDsd](#wpp_sf_zdsd) * [KpsUpdateDomainRediscovery](#kpsupdatedomainrediscovery) * [WS2_32.DLL::htons](#ws2_32dllhtons) * [WS2_32.DLL::bind](#ws2_32dllbind) * [WS2_32.DLL::closesocket](#ws2_32dllclosesocket) * [WS2_32.DLL::WSAGetLastError](#ws2_32dllwsagetlasterror) * [NTDLL.DLL::RtlFreeUnicodeString](#ntdlldllrtlfreeunicodestring) * [API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo](#api-ms-win-core-threadpool-l1-2-0dllcreatethreadpoolio) * [HTTPAPI.DLL::HttpReceiveHttpRequest](#httpapidllhttpreceivehttprequest) * [HTTPAPI.DLL::HttpCancelHttpRequest](#httpapidllhttpcancelhttprequest) * [API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo](#api-ms-win-core-threadpool-l1-2-0dllcancelthreadpoolio) * [NTDLL.DLL::RtlEnterCriticalSection](#ntdlldllrtlentercriticalsection) * [McGenEventWrite_EventWriteTransfer](#mcgeneventwrite_eventwritetransfer) * [WS2_32.DLL::WSAIoctl](#ws2_32dllwsaioctl) # Visual Chart Diff ```mermaid flowchart LR KpsHttpStart-0-old<--Match 98%-->KpsHttpStart-0-new KpsHttpIoCompletion-6-old<--Match 67%-->KpsHttpIoCompletion-6-new wildetailsFeatureImpl__WilFeatureTraits_Feature_4205429049__private_IsEnabled-1-old<--Match 49%-->wildetailsFeatureImpl__WilFeatureTraits_Feature_4205429049__private_IsEnabled-1-new wildetailsFeatureImpl__WilFeatureTraits_Feature_3749982522__private_IsEnabled-1-old<--Match 49%-->wildetailsFeatureImpl__WilFeatureTraits_Feature_3749982522__private_IsEnabled-1-new KpsSocketIoCompletion-6-old<--Match 76%-->KpsSocketIoCompletion-6-new KpsCreateKpsIo-1-old<--Match 98%-->KpsCreateKpsIo-1-new WPP_SF_LZ-5-old<--Match 97%-->WPP_SF_LZ-5-new KpsDoSocketConnectAndSend-1-old<--Match 82%-->KpsDoSocketConnectAndSend-1-new WPP_SF_qds-4-old<--Match 96%-->WPP_SF_qds-4-new KpsSocketRecvDataLengthIoCompletion-3-old<--Match 82%-->KpsSocketRecvDataLengthIoCompletion-3-new wildetailsFeatureImpl__WilFeatureTraits_Feature_4205429049__private_IsEnabled-1-old<--Match 34%-->KpsIoLockedRefRemoveRef-1-new wildetailsFeatureImpl__WilFeatureTraits_Feature_4205429049__private_IsEnabled-1-old<--Match 49%-->wildetailsFeatureImpl__WilFeatureTraits_Feature_886835513__private_IsEnabled-1-new KpsFreeKpsIo-1-old<--Match 25%-->KpsSocketIoCompletion_Old-1-new KpsSocketRecvDataIoCompletion-3-old<--Match 77%-->KpsSocketRecvDataIoCompletion-3-new McGenEventWrite_EventWriteTransfer-5-old<--Match 55%-->McTemplateU0qz_EventWriteTransfer-5-new subgraph kpssvc-06.dll KpsHttpStart-0-new KpsHttpIoCompletion-6-new wildetailsFeatureImpl__WilFeatureTraits_Feature_4205429049__private_IsEnabled-1-new wildetailsFeatureImpl__WilFeatureTraits_Feature_3749982522__private_IsEnabled-1-new KpsSocketIoCompletion-6-new KpsCreateKpsIo-1-new WPP_SF_LZ-5-new KpsDoSocketConnectAndSend-1-new WPP_SF_qds-4-new KpsSocketRecvDataLengthIoCompletion-3-new KpsIoLockedRefRemoveRef-1-new wildetailsFeatureImpl__WilFeatureTraits_Feature_886835513__private_IsEnabled-1-new KpsSocketIoCompletion_Old-1-new KpsSocketRecvDataIoCompletion-3-new McTemplateU0qz_EventWriteTransfer-5-new subgraph Added direction LR wil-details-FeatureImpl__WilFeatureTraits_Feature_886835513-GetCachedFeatureEnabledState KpsDoHttpCancelRequest KpsDoHttpReceiveClientCert KpsDoHttpReceiveRequest KpsDoHttpReceiveRequestEntity KpsDoHttpSendPostResponse KpsDoHttpSendResponse KpsDoSocketConnectAndSend KpsDoSocketRecvData KpsDoSocketRecvDataLength KpsForwardKerbRequest KpsHttpCancelRequestIoCompletion KpsHttpIoCompletion_Old KpsHttpReceiveClientCertIoCompletion KpsHttpReceiveRequestEntityIoCompletion KpsHttpReceiveRequestIoCompletion KpsHttpSendPostResponseIoCompletion KpsHttpSendResponseIoCompletion KpsProcessProxyRequest KpsSocketConnectAndSendIoCompletion wil-details-ReportUsageToService end end subgraph kpssvc-05.dll KpsHttpStart-0-old KpsHttpIoCompletion-6-old wildetailsFeatureImpl__WilFeatureTraits_Feature_4205429049__private_IsEnabled-1-old wildetailsFeatureImpl__WilFeatureTraits_Feature_3749982522__private_IsEnabled-1-old KpsSocketIoCompletion-6-old KpsCreateKpsIo-1-old WPP_SF_LZ-5-old KpsDoSocketConnectAndSend-1-old WPP_SF_qds-4-old KpsSocketRecvDataLengthIoCompletion-3-old wildetailsFeatureImpl__WilFeatureTraits_Feature_4205429049__private_IsEnabled-1-old wildetailsFeatureImpl__WilFeatureTraits_Feature_4205429049__private_IsEnabled-1-old KpsFreeKpsIo-1-old KpsSocketRecvDataIoCompletion-3-old McGenEventWrite_EventWriteTransfer-5-old subgraph Deleted direction LR wil-details-FeatureImpl__WilFeatureTraits_Feature_3749982522-ReportUsage wil-details-FeatureImpl__WilFeatureTraits_Feature_4205429049-ReportUsage end end ``` ```mermaid pie showData title Function Matches - 98.7452% "unmatched_funcs_len" : 23 "matched_funcs_len" : 1810 ``` ```mermaid pie showData title Matched Function Similarity - 96.2983% "matched_funcs_with_code_changes_len" : 15 "matched_funcs_with_non_code_changes_len" : 52 "matched_funcs_no_changes_len" : 1743 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 kpssvc-05.dll kpssvc-06.dll ``` #### Verbose Args
``` --old ['kpssvc-05.dll'] --new [['kpssvc-06.dll']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/kpssvc.dll/3C19C69F43000/kpssvc.dll -O kpssvc.dll.x64.10.0.26100.3912 wget https://msdl.microsoft.com/download/symbols/kpssvc.dll/D4C3FD1546000/kpssvc.dll -O kpssvc.dll.x64.10.0.26100.4343 ``` ## Binary Metadata Diff ```diff --- kpssvc-05.dll Meta +++ kpssvc-06.dll Meta @@ -1,44 +1,44 @@ -Program Name: kpssvc-05.dll +Program Name: kpssvc-06.dll Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 280656 +# of Bytes: 292944 # of Memory Blocks: 10 -# of Instructions: 48461 -# of Defined Data: 3036 -# of Functions: 904 -# of Symbols: 7194 -# of Data Types: 535 +# of Instructions: 52070 +# of Defined Data: 3070 +# of Functions: 929 +# of Symbols: 7522 +# of Data Types: 541 # of Data Type Categories: 39 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Thu Aug 27 21:30:03 SGT 2026 +Date Created: Thu Aug 27 21:30:09 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/kpssvc-05.dll -Executable MD5: 745d167ec1669b02eaf548b928bbb3f7 -Executable SHA256: de28e58abf562d7e1f5946233a6bd20d30fcee22185d791840707a917c341c2b -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/kpssvc-05.dll?MD5=745d167ec1669b02eaf548b928bbb3f7 +Executable Location: /C:/Users/Jacob/Downloads/pdbs/kpssvc-06.dll +Executable MD5: 3c6bb18785e863ba4ded1859ca833278 +Executable SHA256: 3471e19223648c485e1f95f148880bec59b8f4e162f6cd0f2b955b471875308c +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/kpssvc-06.dll?MD5=3c6bb18785e863ba4ded1859ca833278 PDB Age: 1 PDB File: kpssvc.pdb -PDB GUID: 242fe0b6-3326-0a4d-6da2-d63067396c1b +PDB GUID: b344b954-9262-ea12-98cb-8bd9afe0fa13 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: KDC Proxy Service -PE Property[FileVersion]: 10.0.26100.3912 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.4343 (WinBuild.160101.0800) PE Property[InternalName]: kpssvc.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: kpssvc.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.3912 +PE Property[ProductVersion]: 10.0.26100.4343 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra kpssvc-05.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra kpssvc-05.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra kpssvc-05.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra kpssvc-06.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra kpssvc-06.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra kpssvc-06.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|21| |deleted_funcs_len|2| |modified_funcs_len|67| |added_symbols_len|1| |deleted_symbols_len|1| |diff_time|15.522425889968872| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 899, 'ExternalsName': 239, 'Implied Match': 6, 'SigCallingCalledHasher': 2})| |items_to_process|92| |diff_types|Counter({'refcount': 60, 'calling': 59, 'address': 40, 'length': 16, 'code': 15, 'called': 13, 'sig': 8, 'fullname': 4, 'name': 3, 'parent': 2})| |unmatched_funcs_len|23| |total_funcs_len|1833| |matched_funcs_len|1810| |matched_funcs_with_code_changes_len|15| |matched_funcs_with_non_code_changes_len|52| |matched_funcs_no_changes_len|1743| |match_func_similarity_percent|96.2983%| |func_match_overall_percent|98.7452%| |first_matches|Counter({'SymbolsHash': 899, 'Implied Match': 6, 'SigCallingCalledHasher': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 899 "ExternalsName" : 239 "SigCallingCalledHasher" : 2 "Implied-Match" : 6 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 899 "SigCallingCalledHasher" : 2 "Implied-Match" : 6 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 21 "deleted_funcs_len" : 2 "modified_funcs_len" : 67 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 1 "deleted_symbols_len" : 1 ``` ## Strings *No string differences found* # Deleted ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::ReportUsage ### Function Meta |Key|kpssvc-05.dll| | :---: | :---: | |name|ReportUsage| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::ReportUsage| |refcount|2| |length|215| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::GetCachedFeatureEnabledState
wil::details::ReportUsageToServiceDirect| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled| |paramcount|4| |address|180025690| |sig|void __thiscall ReportUsage(FeatureImpl<__WilFeatureTraits_Feature_3749982522> * this, bool param_1, ReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::ReportUsage +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::ReportUsage @@ -1,46 +0,0 @@ - -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ -/* public: void __cdecl wil::details::FeatureImpl::ReportUsage(bool,enum wil::ReportingKind,unsigned - __int64) __ptr64 */ - -void __thiscall -wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::ReportUsage - (FeatureImpl<__WilFeatureTraits_Feature_3749982522> *this,bool param_1, - ReportingKind param_2,__uint64 param_3) - -{ - int iVar1; - ulonglong *puVar2; - ulonglong uVar3; - undefined4 local_res8; - undefined2 local_resc; - undefined4 local_res18 [2]; - __uint64 local_res20; - uint in_stack_ffffffffffffffb0; - undefined1 in_stack_ffffffffffffffb8; - undefined7 in_stack_ffffffffffffffb9; - - local_res18[0] = CONCAT31(local_res18[0]._1_3_,(char)param_2); - uVar3 = (ulonglong)*(uint *)this; - local_res20 = param_3; - if ((*(uint *)this & 4) == 0) { - local_res20 = param_3; - puVar2 = (ulonglong *)GetCachedFeatureEnabledState(this); - uVar3 = *puVar2; - local_res20 = uVar3; - } - local_res8 = 0; - local_resc = 2; - local_res18[0] = 3; - iVar1 = ReportUsageToServiceDirect - ((wil_details_FeatureReportingCache *)(this + 8),0x350bfe9,(uint)uVar3 >> 10 & 1 - ,(uint)(uVar3 >> 0xb) & 1,(param_1 ^ 1) * 4 + 2,in_stack_ffffffffffffffb0, - CONCAT71(in_stack_ffffffffffffffb9,in_stack_ffffffffffffffb8),'\x02'); - if ((iVar1 != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { - (*g_wil_details_pfnFeatureLoggingHook)(0x350bfe9,&local_res8,0,param_1,local_res18,0,0,1); - } - return; -} - ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage ### Function Meta |Key|kpssvc-05.dll| | :---: | :---: | |name|ReportUsage| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage| |refcount|2| |length|215| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState
wil::details::ReportUsageToServiceDirect| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled| |paramcount|4| |address|180025770| |sig|void __thiscall ReportUsage(FeatureImpl<__WilFeatureTraits_Feature_4205429049> * this, bool param_1, ReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage @@ -1,46 +0,0 @@ - -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ -/* public: void __cdecl wil::details::FeatureImpl::ReportUsage(bool,enum wil::ReportingKind,unsigned - __int64) __ptr64 */ - -void __thiscall -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage - (FeatureImpl<__WilFeatureTraits_Feature_4205429049> *this,bool param_1, - ReportingKind param_2,__uint64 param_3) - -{ - int iVar1; - ulonglong *puVar2; - ulonglong uVar3; - undefined4 local_res8; - undefined2 local_resc; - undefined4 local_res18 [2]; - __uint64 local_res20; - uint in_stack_ffffffffffffffb0; - undefined1 in_stack_ffffffffffffffb8; - undefined7 in_stack_ffffffffffffffb9; - - local_res18[0] = CONCAT31(local_res18[0]._1_3_,(char)param_2); - uVar3 = (ulonglong)*(uint *)this; - local_res20 = param_3; - if ((*(uint *)this & 4) == 0) { - local_res20 = param_3; - puVar2 = (ulonglong *)GetCachedFeatureEnabledState(this); - uVar3 = *puVar2; - local_res20 = uVar3; - } - local_res8 = 0; - local_resc = 2; - local_res18[0] = 3; - iVar1 = ReportUsageToServiceDirect - ((wil_details_FeatureReportingCache *)(this + 8),0x32cf420,(uint)uVar3 >> 10 & 1 - ,(uint)(uVar3 >> 0xb) & 1,(param_1 ^ 1) * 4 + 2,in_stack_ffffffffffffffb0, - CONCAT71(in_stack_ffffffffffffffb9,in_stack_ffffffffffffffb8),'\x02'); - if ((iVar1 != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { - (*g_wil_details_pfnFeatureLoggingHook)(0x32cf420,&local_res8,0,param_1,local_res18,0,0,1); - } - return; -} - ``` # Added ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState| |refcount|3| |length|408| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled| |paramcount|1| |address|18001d9b8| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl<__WilFeatureTraits_Feature_886835513> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState @@ -0,0 +1,100 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCachedFeatureEnabledState(void) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState + (FeatureImpl<__WilFeatureTraits_Feature_886835513> *this) + +{ + uint uVar1; + uint uVar2; + code *pcVar3; + uint uVar4; + uint uVar5; + uint *in_RDX; + uint uVar6; + bool bVar7; + int local_res8 [2]; + + in_RDX[0] = 0; + in_RDX[1] = 0; + uVar1 = *(uint *)this; + *in_RDX = uVar1; + if (((byte)uVar1 & 6) == 6) { + return; + } + uVar1 = EnsureSubscribedToFeatureConfigurationChanges(); + local_res8[0] = 0; + pcVar3 = g_wil_details_internalGetFeatureEnabledState; + if ((g_wil_details_internalGetFeatureEnabledState == (code *)0x0) && + (pcVar3 = g_wil_details_apiGetFeatureEnabledState, + g_wil_details_apiGetFeatureEnabledState == (code *)0x0)) { + uVar2 = 0; + } + else { + uVar2 = (*pcVar3)(0x35e6913,3,local_res8); + } + uVar6 = (((uVar2 & 3) << 2 | uVar2 & 0x40) << 2 | uVar2 & 0x80) * 8; + if ((uVar2 & 0xffffff3f) == 0) { + uVar6 = uVar6 | 0x40; + } + else { + uVar4 = 0; + if ((uVar2 & 0xffffff3f) == 2) { + uVar4 = 0x40; + } + uVar6 = uVar6 | uVar4; + } + bVar7 = false; + if ((uVar6 & 0xc00) == 0xc00) { + bVar7 = true; +LAB_18001da81: + if (((uVar6 & 0x40) == 0) || (!bVar7)) { + uVar2 = 0; + goto LAB_18001da93; + } + } + else if ((uVar6 & 0x40) == 0) goto LAB_18001da81; + uVar2 = 1; +LAB_18001da93: + uVar6 = uVar6 | uVar2; + uVar2 = *in_RDX; + do { + uVar5 = uVar2; + *in_RDX = uVar5; + uVar4 = uVar5; + if ((local_res8[0] != 0) && ((uVar5 & 2) == 0)) { + uVar2 = (uVar6 ^ uVar5) & 0x180 ^ uVar5; + uVar2 = (uVar2 ^ uVar6) & 0x40 ^ uVar2; + uVar2 = (uVar2 ^ uVar6) & 1 ^ uVar2; + uVar4 = (uVar2 ^ uVar6) & 0x800 ^ uVar2 | 2; + *in_RDX = uVar4; + } + if ((uVar5 & 4) == 0) { + uVar4 = uVar4 ^ (uVar6 ^ uVar4) & 0x400 | 4; + *in_RDX = uVar4; + } + LOCK(); + uVar2 = *(uint *)this; + bVar7 = uVar5 == uVar2; + if (bVar7) { + *(uint *)this = uVar4; + uVar2 = uVar5; + } + UNLOCK(); + } while (!bVar7); + if ((uVar5 & 4) == 0) { + SubscribeFeatureStateCacheToConfigurationChanges((wil_details_FeatureStateCache *)this,3,uVar1); + } + if ((*in_RDX & 2) == 0) { + uVar1 = (uVar6 ^ *in_RDX) & 0x180 ^ *in_RDX; + uVar1 = (uVar6 ^ uVar1) & 0x40 ^ uVar1; + uVar1 = (uVar1 ^ uVar6) & 1 ^ uVar1; + *in_RDX = (uVar1 ^ uVar6) & 0x800 ^ uVar1; + } + return; +} + ``` ## KpsDoHttpCancelRequest ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsDoHttpCancelRequest| |fullname|KpsDoHttpCancelRequest| |refcount|16| |length|440| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
HTTPAPI.DLL::HttpCancelHttpRequest
KpsIoLockedRef::RemoveRef
KpsPerfUpdate
KpsServiceReady
KpsStartTimeoutTimer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_Dsd
WPP_SF_L
WPP_SF_qwil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled
| |calling|
Expand for full list:
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsForwardKerbRequest
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestIoCompletionKpsProcessProxyRequest
KpsSocketConnectAndSendIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
| |paramcount|1| |address|18001ea84| |sig|void __cdecl KpsDoHttpCancelRequest(KpsIoLockedRef * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsDoHttpCancelRequest +++ KpsDoHttpCancelRequest @@ -0,0 +1,95 @@ + +/* void __cdecl KpsDoHttpCancelRequest(class KpsIoLockedRef & __ptr64) */ + +void __cdecl KpsDoHttpCancelRequest(KpsIoLockedRef *param_1) + +{ + longlong *plVar1; + longlong lVar2; + undefined8 uVar3; + _KPS_IO *p_Var4; + code *pcVar5; + uchar uVar6; + bool bVar7; + int iVar8; + undefined1 *puVar9; + undefined1 auStack_38 [8]; + undefined1 auStack_30 [40]; + + puVar9 = auStack_38; + iVar8 = 0; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc5, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,*(undefined8 *)param_1); + } + KpsPerfUpdate(4); + *(undefined4 *)(*(longlong *)param_1 + 0x20) = 7; + uVar6 = KpsServiceReady(); + if (uVar6 != '\0') { + StartThreadpoolIo(DAT_18003ec10); + puVar9 = auStack_38; + if (*(longlong *)param_1 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_1 + 0x158); + lVar2 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar9 = auStack_38; + if (lVar2 + 1 < 2) { + pcVar5 = (code *)swi(0x29); + (*pcVar5)(0xe); + puVar9 = auStack_30; + } + } + uVar3 = *(undefined8 *)(*(longlong *)(*(longlong *)param_1 + 0x38) + 0x10); + *(undefined8 *)(puVar9 + -8) = 0x18001eb40; + iVar8 = HttpCancelHttpRequest(DAT_18003ec00,uVar3); + if ((iVar8 == 0x3e5) || (iVar8 == 0)) { + *(undefined8 *)(puVar9 + -8) = 0x18001ebb8; + bVar7 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_3749982522> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_3749982522>::GetImpl(void)' + ::__l2::impl); + if (bVar7) { + p_Var4 = *(_KPS_IO **)param_1; + *(undefined8 *)(puVar9 + -8) = 0x18001ebc7; + KpsStartTimeoutTimer(p_Var4); + *(undefined4 *)(p_Var4 + 0x150) = 2; + } + } + else { + *(undefined8 *)(puVar9 + -8) = 0x18001eb60; + CancelThreadpoolIo(DAT_18003ec10); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar3 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar9 + 0x28) = 0xe9e; + *(char **)(puVar9 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar9 + -8) = 0x18001eba2; + WPP_SF_Dsd(uVar3,0xc6,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar8, + *(char **)(puVar9 + 0x20)); + } + *(undefined8 *)(puVar9 + -8) = 0x18001ebaa; + KpsIoLockedRef::RemoveRef(param_1); + } + } + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar9 + -8) = 0x18001ebdf; + bVar7 = KpsIoLockedRef::RemoveRef(param_1); + if (!bVar7) { + lVar2 = *(longlong *)param_1; + *(undefined8 *)(puVar9 + -8) = 0x18001ebf4; + RtlLeaveCriticalSection(lVar2 + 0x120); + } + *(undefined8 *)param_1 = 0; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar3 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar9 + -8) = 0x18001ec27; + WPP_SF_L(uVar3,199,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar8); + } + return; +} + ``` ## KpsDoHttpReceiveClientCert ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsDoHttpReceiveClientCert| |fullname|KpsDoHttpReceiveClientCert| |refcount|2| |length|595| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
HTTPAPI.DLL::HttpReceiveClientCertificate
KpsAllocMem
KpsDoHttpCancelRequest
KpsIoLockedRef::RemoveRef
KpsServiceReady
KpsStartTimeoutTimer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_Dsd
WPP_SF_LWPP_SF_q
wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled
| |calling|KpsHttpReceiveRequestIoCompletion| |paramcount|1| |address|18001edc8| |sig|void __cdecl KpsDoHttpReceiveClientCert(KpsIoLockedRef * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsDoHttpReceiveClientCert +++ KpsDoHttpReceiveClientCert @@ -0,0 +1,124 @@ + +/* void __cdecl KpsDoHttpReceiveClientCert(class KpsIoLockedRef & __ptr64) */ + +void __cdecl KpsDoHttpReceiveClientCert(KpsIoLockedRef *param_1) + +{ + longlong *plVar1; + longlong lVar2; + longlong lVar3; + undefined8 uVar4; + _KPS_IO *p_Var5; + undefined8 uVar6; + code *pcVar7; + uchar uVar8; + bool bVar9; + int iVar10; + void *pvVar11; + undefined1 *puVar12; + undefined1 auStackY_48 [8]; + undefined1 auStackY_40 [24]; + + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb6, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,*(undefined8 *)param_1); + } + uVar8 = KpsServiceReady(); + puVar12 = auStackY_48; + iVar10 = 0; + if (uVar8 != '\0') { + *(undefined4 *)(*(longlong *)param_1 + 0x50) = 0x800; + pvVar11 = KpsAllocMem((ulonglong)*(uint *)(*(longlong *)param_1 + 0x50)); + *(void **)(*(longlong *)param_1 + 0x48) = pvVar11; + if (*(longlong *)(*(longlong *)param_1 + 0x48) == 0) { + puVar12 = auStackY_48; + iVar10 = 8; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar12 = auStackY_48, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb7, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,8, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar12 = auStackY_48; + iVar10 = 8; + } + } + else { + *(undefined4 *)(*(longlong *)param_1 + 0x20) = 2; + StartThreadpoolIo(DAT_18003ec10); + puVar12 = auStackY_48; + if (*(longlong *)param_1 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_1 + 0x158); + lVar2 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar12 = auStackY_48; + if (lVar2 + 1 < 2) { + pcVar7 = (code *)swi(0x29); + (*pcVar7)(0xe); + puVar12 = auStackY_40; + } + } + lVar2 = *(longlong *)param_1; + *(longlong *)(puVar12 + 0x30) = lVar2; + *(undefined8 *)(puVar12 + 0x28) = 0; + lVar3 = *(longlong *)(lVar2 + 0x38); + uVar6 = *(undefined8 *)(lVar2 + 0x48); + *(undefined4 *)(puVar12 + 0x20) = *(undefined4 *)(lVar2 + 0x50); + uVar4 = *(undefined8 *)(lVar3 + 8); + *(undefined8 *)(puVar12 + -8) = 0x18001ef08; + iVar10 = HttpReceiveClientCertificate(DAT_18003ec00,uVar4,0,uVar6); + if ((iVar10 == 0x3e5) || (iVar10 == 0)) { + *(undefined8 *)(puVar12 + -8) = 0x18001ef81; + bVar9 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>:: + __private_IsEnabled((FeatureImpl<__WilFeatureTraits_Feature_3749982522> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_3749982522>::GetImpl(void)' + ::__l2::impl); + if (bVar9) { + p_Var5 = *(_KPS_IO **)param_1; + *(undefined8 *)(puVar12 + -8) = 0x18001ef90; + KpsStartTimeoutTimer(p_Var5); + *(undefined4 *)(p_Var5 + 0x150) = 2; + } + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar12 + -8) = 0x18001efa8; + bVar9 = KpsIoLockedRef::RemoveRef(param_1); + if (!bVar9) { + lVar2 = *(longlong *)param_1; + *(undefined8 *)(puVar12 + -8) = 0x18001efbd; + RtlLeaveCriticalSection(lVar2 + 0x120); + } + *(undefined8 *)param_1 = 0; + } + } + else { + *(undefined8 *)(puVar12 + -8) = 0x18001ef28; + CancelThreadpoolIo(DAT_18003ec10); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar6 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar12 + 0x28) = 0xd76; + *(char **)(puVar12 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar12 + -8) = 0x18001ef6b; + WPP_SF_Dsd(uVar6,0xb8,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar10, + *(char **)(puVar12 + 0x20)); + } + *(undefined8 *)(puVar12 + -8) = 0x18001ef73; + KpsIoLockedRef::RemoveRef(param_1); + } + } + } + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar12 + -8) = 0x18001efdb; + KpsDoHttpCancelRequest(param_1); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar6 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar12 + -8) = 0x18001f005; + WPP_SF_L(uVar6,0xb9,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar10); + } + return; +} + ``` ## KpsDoHttpReceiveRequest ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsDoHttpReceiveRequest| |fullname|KpsDoHttpReceiveRequest| |refcount|3| |length|680| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
HTTPAPI.DLL::HttpReceiveHttpRequest
KpsAllocMem
KpsIoLockedRef::RemoveRef
KpsServiceReady
KpsStartTimeoutTimer
McGenEventWrite_EventWriteTransfer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_Dsd
WPP_SF_LWPP_SF_q
__security_check_cookie
wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled
| |calling|KpsHttpReceiveRequestIoCompletion
KpsHttpStart| |paramcount|1| |address|18001f208| |sig|void __cdecl KpsDoHttpReceiveRequest(KpsIoLockedRef * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsDoHttpReceiveRequest +++ KpsDoHttpReceiveRequest @@ -0,0 +1,134 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* void __cdecl KpsDoHttpReceiveRequest(class KpsIoLockedRef & __ptr64) */ + +void __cdecl KpsDoHttpReceiveRequest(KpsIoLockedRef *param_1) + +{ + longlong *plVar1; + _KPS_IO *p_Var2; + longlong lVar3; + undefined8 uVar4; + code *pcVar5; + uchar uVar6; + bool bVar7; + int iVar8; + void *pvVar9; + PTP_IO p_Var10; + undefined1 *puVar11; + undefined8 uVar12; + undefined1 auStackY_78 [8]; + undefined1 auStackY_70 [24]; + + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xdb, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,*(undefined8 *)param_1); + } + uVar6 = KpsServiceReady(); + puVar11 = auStackY_78; + iVar8 = 0; + if (uVar6 != '\0') { + *(undefined4 *)(*(longlong *)param_1 + 0x40) = 0; + *(undefined4 *)(*(longlong *)param_1 + 0x44) = 0x800; + pvVar9 = KpsAllocMem((ulonglong)*(uint *)(*(longlong *)param_1 + 0x44)); + *(void **)(*(longlong *)param_1 + 0x38) = pvVar9; + if (*(longlong *)(*(longlong *)param_1 + 0x38) == 0) { + puVar11 = auStackY_78; + iVar8 = 8; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar11 = auStackY_78, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xdc, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,8, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar11 = auStackY_78; + iVar8 = 8; + } + } + else { + *(undefined4 *)(*(longlong *)param_1 + 0x20) = 1; + StartThreadpoolIo(DAT_18003ec10); + puVar11 = auStackY_78; + if (*(longlong *)param_1 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_1 + 0x158); + lVar3 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar11 = auStackY_78; + if (lVar3 + 1 < 2) { + pcVar5 = (code *)swi(0x29); + (*pcVar5)(0xe); + puVar11 = auStackY_70; + } + } + lVar3 = *(longlong *)param_1; + uVar12 = 0; + *(longlong *)(puVar11 + 0x30) = lVar3; + *(undefined8 *)(puVar11 + 0x28) = 0; + uVar4 = *(undefined8 *)(lVar3 + 0x38); + *(undefined4 *)(puVar11 + 0x20) = *(undefined4 *)(lVar3 + 0x44); + *(undefined8 *)(puVar11 + -8) = 0x18001f355; + iVar8 = HttpReceiveHttpRequest(DAT_18003ec00,0,0,uVar4); + if ((iVar8 == 0x3e5) || (iVar8 == 0)) { + *(undefined8 *)(puVar11 + -8) = 0x18001f416; + bVar7 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>:: + __private_IsEnabled((FeatureImpl<__WilFeatureTraits_Feature_3749982522> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_3749982522>::GetImpl(void)' + ::__l2::impl); + if (bVar7) { + p_Var2 = *(_KPS_IO **)param_1; + *(undefined8 *)(puVar11 + -8) = 0x18001f425; + KpsStartTimeoutTimer(p_Var2); + *(undefined4 *)(p_Var2 + 0x150) = 2; + } + } + else { + *(undefined8 *)(puVar11 + -8) = 0x18001f37d; + p_Var10 = DAT_18003ec10; + CancelThreadpoolIo(DAT_18003ec10); + if ((Microsoft_Windows_Kerberos_KdcProxyEnableBits & 2) != 0) { + *(undefined4 *)(puVar11 + 100) = 0; + *(undefined1 **)(puVar11 + 0x58) = puVar11 + 0x40; + *(int *)(puVar11 + 0x40) = iVar8; + *(undefined1 **)(puVar11 + 0x20) = puVar11 + 0x48; + *(undefined4 *)(puVar11 + 0x60) = 4; + *(undefined8 *)(puVar11 + -8) = 0x18001f3c2; + McGenEventWrite_EventWriteTransfer + (p_Var10,(PCEVENT_DESCRIPTOR)&HttpReceiveHttpRequestFailure,uVar12,2, + *(PEVENT_DATA_DESCRIPTOR *)(puVar11 + 0x20)); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar11 + 0x28) = 0x103c; + *(char **)(puVar11 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar11 + -8) = 0x18001f400; + WPP_SF_Dsd(uVar4,0xdd,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar8, + *(char **)(puVar11 + 0x20)); + } + *(undefined8 *)(puVar11 + -8) = 0x18001f408; + KpsIoLockedRef::RemoveRef(param_1); + } + } + } + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar11 + -8) = 0x18001f444; + bVar7 = KpsIoLockedRef::RemoveRef(param_1); + if (!bVar7) { + lVar3 = *(longlong *)param_1; + *(undefined8 *)(puVar11 + -8) = 0x18001f459; + RtlLeaveCriticalSection(lVar3 + 0x120); + } + *(undefined8 *)param_1 = 0; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar11 + -8) = 0x18001f48c; + WPP_SF_L(uVar4,0xde,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar8); + } + *(undefined8 *)(puVar11 + -8) = 0x18001f499; + return; +} + ``` ## KpsDoHttpReceiveRequestEntity ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsDoHttpReceiveRequestEntity| |fullname|KpsDoHttpReceiveRequestEntity| |refcount|3| |length|601| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
HTTPAPI.DLL::HttpReceiveRequestEntityBody
KpsAllocMem
KpsDoHttpCancelRequest
KpsIoLockedRef::RemoveRef
KpsServiceReady
KpsStartTimeoutTimer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_Dsd
WPP_SF_LWPP_SF_q
wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled
| |calling|KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveRequestIoCompletion| |paramcount|1| |address|18001f6fc| |sig|void __cdecl KpsDoHttpReceiveRequestEntity(KpsIoLockedRef * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsDoHttpReceiveRequestEntity +++ KpsDoHttpReceiveRequestEntity @@ -0,0 +1,125 @@ + +/* void __cdecl KpsDoHttpReceiveRequestEntity(class KpsIoLockedRef & __ptr64) */ + +void __cdecl KpsDoHttpReceiveRequestEntity(KpsIoLockedRef *param_1) + +{ + longlong *plVar1; + longlong lVar2; + longlong lVar3; + undefined8 uVar4; + _KPS_IO *p_Var5; + undefined8 uVar6; + code *pcVar7; + uchar uVar8; + bool bVar9; + int iVar10; + void *pvVar11; + undefined1 *puVar12; + undefined1 auStackY_48 [8]; + undefined1 auStackY_40 [24]; + + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc1, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,*(undefined8 *)param_1); + } + uVar8 = KpsServiceReady(); + puVar12 = auStackY_48; + iVar10 = 0; + if (uVar8 != '\0') { + *(undefined4 *)(*(longlong *)param_1 + 0x60) = 0; + *(undefined4 *)(*(longlong *)param_1 + 100) = 0xc00; + pvVar11 = KpsAllocMem((ulonglong)*(uint *)(*(longlong *)param_1 + 100)); + *(void **)(*(longlong *)param_1 + 0x58) = pvVar11; + if (*(longlong *)(*(longlong *)param_1 + 0x58) == 0) { + puVar12 = auStackY_48; + iVar10 = 8; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar12 = auStackY_48, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc2, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,8, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar12 = auStackY_48; + iVar10 = 8; + } + } + else { + *(undefined4 *)(*(longlong *)param_1 + 0x20) = 5; + StartThreadpoolIo(DAT_18003ec10); + puVar12 = auStackY_48; + if (*(longlong *)param_1 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_1 + 0x158); + lVar2 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar12 = auStackY_48; + if (lVar2 + 1 < 2) { + pcVar7 = (code *)swi(0x29); + (*pcVar7)(0xe); + puVar12 = auStackY_40; + } + } + lVar2 = *(longlong *)param_1; + *(longlong *)(puVar12 + 0x30) = lVar2; + *(undefined8 *)(puVar12 + 0x28) = 0; + lVar3 = *(longlong *)(lVar2 + 0x38); + uVar6 = *(undefined8 *)(lVar2 + 0x58); + *(undefined4 *)(puVar12 + 0x20) = *(undefined4 *)(lVar2 + 100); + uVar4 = *(undefined8 *)(lVar3 + 0x10); + *(undefined8 *)(puVar12 + -8) = 0x18001f842; + iVar10 = HttpReceiveRequestEntityBody(DAT_18003ec00,uVar4,0,uVar6); + if ((iVar10 == 0x3e5) || (iVar10 == 0)) { + *(undefined8 *)(puVar12 + -8) = 0x18001f8bb; + bVar9 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>:: + __private_IsEnabled((FeatureImpl<__WilFeatureTraits_Feature_3749982522> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_3749982522>::GetImpl(void)' + ::__l2::impl); + if (bVar9) { + p_Var5 = *(_KPS_IO **)param_1; + *(undefined8 *)(puVar12 + -8) = 0x18001f8ca; + KpsStartTimeoutTimer(p_Var5); + *(undefined4 *)(p_Var5 + 0x150) = 2; + } + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar12 + -8) = 0x18001f8e2; + bVar9 = KpsIoLockedRef::RemoveRef(param_1); + if (!bVar9) { + lVar2 = *(longlong *)param_1; + *(undefined8 *)(puVar12 + -8) = 0x18001f8f7; + RtlLeaveCriticalSection(lVar2 + 0x120); + } + *(undefined8 *)param_1 = 0; + } + } + else { + *(undefined8 *)(puVar12 + -8) = 0x18001f862; + CancelThreadpoolIo(DAT_18003ec10); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar6 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar12 + 0x28) = 0xe66; + *(char **)(puVar12 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar12 + -8) = 0x18001f8a5; + WPP_SF_Dsd(uVar6,0xc3,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar10, + *(char **)(puVar12 + 0x20)); + } + *(undefined8 *)(puVar12 + -8) = 0x18001f8ad; + KpsIoLockedRef::RemoveRef(param_1); + } + } + } + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar12 + -8) = 0x18001f915; + KpsDoHttpCancelRequest(param_1); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar6 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar12 + -8) = 0x18001f93f; + WPP_SF_L(uVar6,0xc4,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar10); + } + return; +} + ``` ## KpsDoHttpSendPostResponse ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsDoHttpSendPostResponse| |fullname|KpsDoHttpSendPostResponse| |refcount|2| |length|835| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
HTTPAPI.DLL::HttpSendHttpResponse
KpsDoHttpCancelRequest
KpsIoLockedRef::RemoveRef
KpsServiceReady
KpsStartTimeoutTimer
NTDLL.DLL::RtlLeaveCriticalSection
StringCchPrintfA
WPP_SF_Dsd
WPP_SF_LWPP_SF_q
__security_check_cookie
memset
wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled
| |calling|KpsSocketRecvDataIoCompletion| |paramcount|1| |address|18001fb48| |sig|void __cdecl KpsDoHttpSendPostResponse(KpsIoLockedRef * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsDoHttpSendPostResponse +++ KpsDoHttpSendPostResponse @@ -0,0 +1,158 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* void __cdecl KpsDoHttpSendPostResponse(class KpsIoLockedRef & __ptr64) */ + +void __cdecl KpsDoHttpSendPostResponse(KpsIoLockedRef *param_1) + +{ + longlong *plVar1; + _KPS_IO *p_Var2; + undefined8 uVar3; + code *pcVar4; + longlong lVar5; + uchar uVar6; + bool bVar7; + long lVar8; + longlong lVar9; + undefined1 *puVar11; + undefined1 auStackY_2e8 [8]; + undefined1 auStackY_2e0 [24]; + undefined8 local_298; + undefined8 uStack_290; + undefined8 local_288; + undefined8 uStack_280; + undefined1 local_278 [8]; + undefined4 local_270; + char *local_268; + undefined2 local_180; + char *local_178; + undefined2 local_60; + undefined8 *local_58; + char local_38 [16]; + ulonglong local_28; + longlong lVar10; + + local_28 = __security_cookie ^ (ulonglong)auStackY_2e8; + builtin_strncpy(local_38,"4294967295",0xb); + lVar8 = 0; + memset(local_278,0,0x238); + local_298 = 0; + uStack_290 = 0; + local_288 = 0; + uStack_280 = 0; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xbd, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,*(undefined8 *)param_1); + } + uVar6 = KpsServiceReady(); + puVar11 = auStackY_2e8; + if (uVar6 != '\0') { + local_270 = 0x200c8; + local_268 = "OK"; + lVar8 = StringCchPrintfA(local_38,0xb,"%lu",(ulonglong)*(uint *)(*(longlong *)param_1 + 0x118)); + if (lVar8 < 0) { + puVar11 = auStackY_2e8; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar11 = auStackY_2e8, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xbe, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,lVar8, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar11 = auStackY_2e8; + } + } + else { + local_178 = local_38; + lVar10 = -1; + do { + lVar9 = lVar10 + 1; + lVar5 = lVar10 + 1; + lVar10 = lVar9; + } while (local_38[lVar5] != '\0'); + lVar10 = *(longlong *)param_1; + local_180 = (undefined2)lVar9; + uStack_290 = *(undefined8 *)(lVar10 + 0x110); + local_288 = CONCAT44(local_288._4_4_,*(undefined4 *)(lVar10 + 0x118)); + local_58 = &local_298; + local_60 = 1; + *(undefined4 *)(lVar10 + 0x20) = 4; + StartThreadpoolIo(DAT_18003ec10); + puVar11 = auStackY_2e8; + if (*(longlong *)param_1 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_1 + 0x158); + lVar10 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar11 = auStackY_2e8; + if (lVar10 + 1 < 2) { + pcVar4 = (code *)swi(0x29); + (*pcVar4)(0xe); + puVar11 = auStackY_2e0; + } + } + *(undefined8 *)(puVar11 + 0x48) = 0; + lVar10 = *(longlong *)param_1; + *(longlong *)(puVar11 + 0x40) = lVar10; + *(undefined4 *)(puVar11 + 0x38) = 0; + *(undefined8 *)(puVar11 + 0x30) = 0; + lVar10 = *(longlong *)(lVar10 + 0x38); + *(undefined8 *)(puVar11 + 0x28) = 0; + *(undefined8 *)(puVar11 + 0x20) = 0; + uVar3 = *(undefined8 *)(lVar10 + 0x10); + *(undefined8 *)(puVar11 + -8) = 0x18001fd66; + lVar8 = HttpSendHttpResponse(DAT_18003ec00,uVar3,1,puVar11 + 0x70); + if ((lVar8 == 0x3e5) || (lVar8 == 0)) { + *(undefined8 *)(puVar11 + -8) = 0x18001fdde; + bVar7 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>:: + __private_IsEnabled((FeatureImpl<__WilFeatureTraits_Feature_3749982522> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_3749982522>::GetImpl(void)' + ::__l2::impl); + if (bVar7) { + p_Var2 = *(_KPS_IO **)param_1; + *(undefined8 *)(puVar11 + -8) = 0x18001fded; + KpsStartTimeoutTimer(p_Var2); + *(undefined4 *)(p_Var2 + 0x150) = 2; + } + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar11 + -8) = 0x18001fe02; + bVar7 = KpsIoLockedRef::RemoveRef(param_1); + if (!bVar7) { + lVar10 = *(longlong *)param_1; + *(undefined8 *)(puVar11 + -8) = 0x18001fe17; + RtlLeaveCriticalSection(lVar10 + 0x120); + } + *(undefined8 *)param_1 = 0; + } + } + else { + *(undefined8 *)(puVar11 + -8) = 0x18001fd86; + CancelThreadpoolIo(DAT_18003ec10); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar3 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar11 + 0x28) = 0xe21; + *(char **)(puVar11 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar11 + -8) = 0x18001fdc8; + WPP_SF_Dsd(uVar3,0xbf,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,lVar8, + *(char **)(puVar11 + 0x20)); + } + *(undefined8 *)(puVar11 + -8) = 0x18001fdd0; + KpsIoLockedRef::RemoveRef(param_1); + } + } + } + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar11 + -8) = 0x18001fe35; + KpsDoHttpCancelRequest(param_1); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar3 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar11 + -8) = 0x18001fe5f; + WPP_SF_L(uVar3,0xc0,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,lVar8); + } + *(undefined8 *)(puVar11 + -8) = 0x18001fe6e; + return; +} + ``` ## KpsDoHttpSendResponse ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsDoHttpSendResponse| |fullname|KpsDoHttpSendResponse| |refcount|3| |length|599| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
HTTPAPI.DLL::HttpSendHttpResponse
KpsDoHttpCancelRequest
KpsIoLockedRef::RemoveRef
KpsServiceReady
KpsStartTimeoutTimer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_Dsd
WPP_SF_L
WPP_SF_qds__security_check_cookie
memset
wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled
| |calling|KpsProcessProxyRequest
KpsSocketRecvDataIoCompletion| |paramcount|4| |address|18002016c| |sig|void __cdecl KpsDoHttpSendResponse(KpsIoLockedRef * param_1, ushort param_2, char * param_3, char * param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsDoHttpSendResponse +++ KpsDoHttpSendResponse @@ -0,0 +1,130 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* void __cdecl KpsDoHttpSendResponse(class KpsIoLockedRef & __ptr64,unsigned short,char * + __ptr64,char * __ptr64) */ + +void __cdecl +KpsDoHttpSendResponse(KpsIoLockedRef *param_1,ushort param_2,char *param_3,char *param_4) + +{ + longlong *plVar1; + longlong lVar2; + _KPS_IO *p_Var3; + code *pcVar4; + uchar uVar5; + bool bVar6; + int iVar7; + undefined1 *puVar8; + undefined8 uVar9; + undefined1 auStack_2c8 [8]; + undefined1 auStack_2c0 [72]; + undefined8 local_278; + undefined8 uStack_270; + undefined8 local_268; + undefined8 uStack_260; + undefined1 local_258 [8]; + undefined4 local_250; + char *local_248; + undefined2 local_160; + char *local_158; + ulonglong local_18; + + puVar8 = auStack_2c8; + local_18 = __security_cookie ^ (ulonglong)auStack_2c8; + iVar7 = 0; + uVar9 = 0x238; + memset(local_258,0,0x238); + local_278 = 0; + uStack_270 = 0; + local_268 = 0; + uStack_260 = 0; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_qds(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xba,uVar9,*(undefined8 *)param_1); + } + uVar5 = KpsServiceReady(); + if (uVar5 != '\0') { + local_250 = 0x1a0193; + local_248 = "blocked by KPSSVC policies"; + local_158 = "text/html"; + local_160 = 9; + *(undefined4 *)(*(longlong *)param_1 + 0x20) = 3; + StartThreadpoolIo(DAT_18003ec10); + puVar8 = auStack_2c8; + if (*(longlong *)param_1 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_1 + 0x158); + lVar2 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar8 = auStack_2c8; + if (lVar2 + 1 < 2) { + pcVar4 = (code *)swi(0x29); + (*pcVar4)(0xe); + puVar8 = auStack_2c0; + } + } + *(undefined8 *)(puVar8 + 0x48) = 0; + lVar2 = *(longlong *)param_1; + *(longlong *)(puVar8 + 0x40) = lVar2; + *(undefined4 *)(puVar8 + 0x38) = 0; + *(undefined8 *)(puVar8 + 0x30) = 0; + lVar2 = *(longlong *)(lVar2 + 0x38); + *(undefined8 *)(puVar8 + 0x28) = 0; + *(undefined8 *)(puVar8 + 0x20) = 0; + uVar9 = *(undefined8 *)(lVar2 + 0x10); + *(undefined8 *)(puVar8 + -8) = 0x1800202a4; + iVar7 = HttpSendHttpResponse(DAT_18003ec00,uVar9,0,puVar8 + 0x70); + if ((iVar7 == 0x3e5) || (iVar7 == 0)) { + *(undefined8 *)(puVar8 + -8) = 0x18002031c; + bVar6 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_3749982522> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_3749982522>::GetImpl(void)' + ::__l2::impl); + if (bVar6) { + p_Var3 = *(_KPS_IO **)param_1; + *(undefined8 *)(puVar8 + -8) = 0x18002032b; + KpsStartTimeoutTimer(p_Var3); + *(undefined4 *)(p_Var3 + 0x150) = 2; + } + if (*(longlong *)param_1 == 0) goto LAB_18002036f; + *(undefined8 *)(puVar8 + -8) = 0x180020343; + bVar6 = KpsIoLockedRef::RemoveRef(param_1); + if (!bVar6) { + lVar2 = *(longlong *)param_1; + *(undefined8 *)(puVar8 + -8) = 0x180020358; + RtlLeaveCriticalSection(lVar2 + 0x120); + } + *(undefined8 *)param_1 = 0; + } + else { + *(undefined8 *)(puVar8 + -8) = 0x1800202c4; + CancelThreadpoolIo(DAT_18003ec10); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar9 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar8 + 0x28) = 0xdca; + *(char **)(puVar8 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar8 + -8) = 0x180020306; + WPP_SF_Dsd(uVar9,0xbb,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar7, + *(char **)(puVar8 + 0x20)); + } + *(undefined8 *)(puVar8 + -8) = 0x18002030e; + KpsIoLockedRef::RemoveRef(param_1); + } + } + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar8 + -8) = 0x18002036f; + KpsDoHttpCancelRequest(param_1); + } +LAB_18002036f: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar9 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar8 + -8) = 0x180020399; + WPP_SF_L(uVar9,0xbc,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar7); + } + *(undefined8 *)(puVar8 + -8) = 0x1800203a9; + return; +} + ``` ## KpsDoSocketConnectAndSend ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsDoSocketConnectAndSend| |fullname|KpsDoSocketConnectAndSend| |refcount|4| |length|1712| |called|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
KpsDoHttpCancelRequest
KpsDoSocketConnectAndSend
KpsForwardKerbRequest
KpsIoLockedRef::RemoveRef
KpsServiceReady
KpsStartTimeoutTimerMcTemplateU0qz_EventWriteTransfer
NTDLL.DLL::RtlFreeUnicodeString
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_Dsd
WPP_SF_L
WPP_SF_LZ
WPP_SF_ZDsd
WPP_SF_q
WS2_32.DLL::FreeAddrInfoW
WS2_32.DLL::WSAGetLastError
WS2_32.DLL::WSAIoctl
WS2_32.DLL::bind
WS2_32.DLL::closesocket
WS2_32.DLL::htons
WS2_32.DLL::socket
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
memset
| |calling|KpsDoSocketConnectAndSend
KpsForwardKerbRequest
KpsSocketConnectAndSendIoCompletion| |paramcount|1| |address|1800205dc| |sig|void __cdecl KpsDoSocketConnectAndSend(KpsIoLockedRef * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsDoSocketConnectAndSend +++ KpsDoSocketConnectAndSend @@ -0,0 +1,293 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* void __cdecl KpsDoSocketConnectAndSend(class KpsIoLockedRef & __ptr64) */ + +void __cdecl KpsDoSocketConnectAndSend(KpsIoLockedRef *param_1) + +{ + longlong *plVar1; + longlong lVar2; + longlong lVar3; + undefined8 uVar4; + undefined8 uVar5; + _KPS_IO *p_Var6; + code *pcVar7; + uchar uVar8; + bool bVar9; + DWORD DVar10; + int iVar11; + SOCKET SVar12; + PTP_IO p_Var13; + undefined2 uVar14; + undefined8 uVar15; + int namelen; + undefined1 *puVar16; + DWORD DVar17; + undefined *puVar18; + undefined1 auStackY_128 [8]; + undefined1 auStackY_120 [24]; + undefined8 in_stack_fffffffffffffef8; + undefined4 uVar19; + undefined4 local_d0; + undefined4 local_cc; + undefined4 local_c8; + undefined4 local_c4; + sockaddr local_b8; + undefined8 uStack_a8; + undefined4 local_a0; + ulonglong local_38; + + uVar19 = (undefined4)((ulonglong)in_stack_fffffffffffffef8 >> 0x20); + local_38 = __security_cookie ^ (ulonglong)auStackY_128; + local_d0 = 0x25a207b9; + local_cc = 0x4660ddf3; + local_c8 = 0xe576e98e; + puVar18 = (undefined *)0x80; + local_c4 = 0x3e06748c; + DVar17 = 0; + memset(&local_b8,0,0x80); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + puVar18 = &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids; + WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),200, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,*(undefined8 *)param_1); + } + uVar8 = KpsServiceReady(); + puVar16 = auStackY_128; + DVar10 = 0; + if (uVar8 != '\0') { + lVar2 = *(longlong *)param_1; + uVar15 = 2; + lVar3 = *(longlong *)(lVar2 + 0xd0); + while (((lVar3 != 0 && (lVar3 = *(longlong *)(lVar2 + 0xd0), *(int *)(lVar3 + 4) != 0x17)) && + (*(int *)(lVar3 + 4) != 2))) { + *(undefined8 *)(lVar2 + 0xd0) = *(undefined8 *)(lVar3 + 0x28); + lVar2 = *(longlong *)param_1; + lVar3 = *(longlong *)(lVar2 + 0xd0); + } + lVar3 = *(longlong *)(lVar2 + 0xd0); + DVar10 = DVar17; + if (lVar3 == 0) { + if (*(uint *)(lVar2 + 0xf0) < DAT_18003e9b8) { + RtlFreeUnicodeString(lVar2 + 0xb8); + if (*(longlong *)(*(longlong *)param_1 + 200) != 0) { + FreeAddrInfoW(); + *(undefined8 *)(*(longlong *)param_1 + 200) = 0; + } + if (*(SOCKET *)(*(longlong *)param_1 + 0xd8) != 0xffffffffffffffff) { + closesocket(*(SOCKET *)(*(longlong *)param_1 + 0xd8)); + *(undefined8 *)(*(longlong *)param_1 + 0xd8) = 0xffffffffffffffff; + } + p_Var13 = *(PTP_IO *)(*(longlong *)param_1 + 0xe0); + if (p_Var13 != (PTP_IO)0x0) { + CloseThreadpoolIo(p_Var13); + *(undefined8 *)(*(longlong *)param_1 + 0xe0) = 0; + } + *(int *)(*(longlong *)param_1 + 0xf0) = *(int *)(*(longlong *)param_1 + 0xf0) + 1; + if ((Microsoft_Windows_Kerberos_KdcProxyEnableBits & 4) != 0) { + puVar18 = (undefined *)(ulonglong)*(uint *)(*(longlong *)param_1 + 0xf0); + McTemplateU0qz_EventWriteTransfer + (p_Var13,uVar15,puVar18,*(wchar_t **)(*(longlong *)param_1 + 0x78)); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { + WPP_SF_LZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc9,puVar18, + *(undefined4 *)(*(longlong *)param_1 + 0xf0), + (wchar_t *)(*(longlong *)param_1 + 0x70)); + } + KpsForwardKerbRequest(param_1); + puVar16 = auStackY_128; + } + else { + puVar16 = auStackY_128; + DVar10 = 0x490; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar16 = auStackY_128, (*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 1) != 0)) { + WPP_SF_ZDsd(*(undefined **)((longlong)WPP_GLOBAL_Control + 0x10),0xca, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,(wchar_t *)(lVar2 + 0xb8), + CONCAT44(uVar19,0x490),"ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar16 = auStackY_128; + DVar10 = 0x490; + } + } + } + else { + SVar12 = socket(*(int *)(lVar3 + 4),*(int *)(lVar3 + 8),6); + *(SOCKET *)(*(longlong *)param_1 + 0xd8) = SVar12; + if (*(longlong *)(*(longlong *)param_1 + 0xd8) == -1) { + DVar10 = WSAGetLastError(); + puVar16 = auStackY_128; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar16 = auStackY_128, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_180020bab; + uVar14 = 0xcb; + } + else { + namelen = 0x10; + iVar11 = WSAIoctl(*(longlong *)(*(longlong *)param_1 + 0xd8),0xc8000006,&local_d0,0x10); + if (iVar11 == 0) { + p_Var13 = CreateThreadpoolIo(*(HANDLE *)(*(longlong *)param_1 + 0xd8), + KpsSocketIoCompletion,(PVOID)0x0, + (PTP_CALLBACK_ENVIRON)&DAT_18003ed40); + *(PTP_IO *)(*(longlong *)param_1 + 0xe0) = p_Var13; + if (*(longlong *)(*(longlong *)param_1 + 0xe0) == 0) { + DVar10 = GetLastError(); + puVar16 = auStackY_128; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar16 = auStackY_128, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_180020bab; + uVar14 = 0xcd; + } + else { + local_b8.sa_data[2] = '\0'; + local_b8.sa_data[3] = '\0'; + local_b8.sa_data[4] = '\0'; + local_b8.sa_data[5] = '\0'; + if (*(short *)(*(longlong *)(*(longlong *)param_1 + 0xd0) + 4) == 0x17) { + local_b8.sa_family = 0x17; + uStack_a8 = 0; + local_a0 = 0; + } + else { + local_b8.sa_family = 2; + } + local_b8.sa_data[6] = '\0'; + local_b8.sa_data[7] = '\0'; + local_b8.sa_data[8] = '\0'; + local_b8.sa_data[9] = '\0'; + local_b8.sa_data[10] = '\0'; + local_b8.sa_data[0xb] = '\0'; + local_b8.sa_data[0xc] = '\0'; + local_b8.sa_data[0xd] = '\0'; + local_b8.sa_data._0_2_ = htons(0); + if (local_b8.sa_family == 0x17) { + namelen = 0x1c; + } + iVar11 = bind(*(SOCKET *)(*(longlong *)param_1 + 0xd8),&local_b8,namelen); + if (iVar11 == 0) { + *(undefined4 *)(*(longlong *)param_1 + 0x20) = 8; + StartThreadpoolIo(*(PTP_IO *)(*(longlong *)param_1 + 0xe0)); + puVar16 = auStackY_128; + if (*(longlong *)param_1 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_1 + 0x158); + lVar2 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar16 = auStackY_128; + if (lVar2 + 1 < 2) { + pcVar7 = (code *)swi(0x29); + (*pcVar7)(0xe); + puVar16 = auStackY_120; + } + } + lVar2 = *(longlong *)param_1; + *(longlong *)(puVar16 + 0x30) = lVar2; + *(undefined8 *)(puVar16 + 0x28) = 0; + pcVar7 = *(code **)(lVar2 + 0xe8); + uVar15 = *(undefined8 *)(*(longlong *)(lVar2 + 0x68) + 0x10); + lVar3 = *(longlong *)(lVar2 + 0xd0); + *(undefined4 *)(puVar16 + 0x20) = *(undefined4 *)(*(longlong *)(lVar2 + 0x68) + 8); + uVar19 = *(undefined4 *)(lVar3 + 0x10); + uVar4 = *(undefined8 *)(lVar3 + 0x20); + uVar5 = *(undefined8 *)(lVar2 + 0xd8); + *(undefined8 *)(puVar16 + -8) = 0x180020ae6; + iVar11 = (*pcVar7)(uVar5,uVar4,uVar19,uVar15); + if (iVar11 == 0) { + *(undefined8 *)(puVar16 + -8) = 0x180020af1; + iVar11 = WSAGetLastError(); + if (iVar11 != 0x3e5) { + p_Var13 = *(PTP_IO *)(*(longlong *)param_1 + 0xe0); + *(undefined8 *)(puVar16 + -8) = 0x180020b0e; + CancelThreadpoolIo(p_Var13); + *(undefined8 *)(puVar16 + -8) = 0x180020b1a; + DVar10 = WSAGetLastError(); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar15 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar16 + 0x28) = 0xf30; + *(char **)(puVar16 + 0x20) = + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar16 + -8) = 0x180020b5b; + WPP_SF_Dsd(uVar15,0xcf,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar10, + *(char **)(puVar16 + 0x20)); + } + *(undefined8 *)(puVar16 + -8) = 0x180020b63; + KpsIoLockedRef::RemoveRef(param_1); + goto LAB_180020bab; + } + } + p_Var6 = *(_KPS_IO **)param_1; + *(undefined8 *)(puVar16 + -8) = 0x180020b70; + KpsStartTimeoutTimer(p_Var6); + *(undefined4 *)(p_Var6 + 0x150) = 1; + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar16 + -8) = 0x180020b87; + bVar9 = KpsIoLockedRef::RemoveRef(param_1); + if (!bVar9) { + lVar2 = *(longlong *)param_1; + *(undefined8 *)(puVar16 + -8) = 0x180020b9c; + RtlLeaveCriticalSection(lVar2 + 0x120); + } + *(undefined8 *)param_1 = 0; + } + goto LAB_180020bab; + } + DVar10 = WSAGetLastError(); + puVar16 = auStackY_128; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar16 = auStackY_128, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_180020bab; + uVar14 = 0xce; + } + } + else { + DVar10 = WSAGetLastError(); + puVar16 = auStackY_128; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar16 = auStackY_128, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_180020bab; + uVar14 = 0xcc; + } + } + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar14, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar10, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar16 = auStackY_128; + } + } +LAB_180020bab: + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar16 + -8) = 0x180020bb9; + uVar8 = KpsServiceReady(); + if ((uVar8 == '\0') || (*(longlong *)(*(longlong *)param_1 + 0xd0) == 0)) { + *(undefined8 *)(puVar16 + -8) = 0x180020c39; + KpsDoHttpCancelRequest(param_1); + } + else { + SVar12 = *(SOCKET *)(*(longlong *)param_1 + 0xd8); + if (SVar12 != 0xffffffffffffffff) { + *(undefined8 *)(puVar16 + -8) = 0x180020bdd; + closesocket(SVar12); + *(undefined8 *)(*(longlong *)param_1 + 0xd8) = 0xffffffffffffffff; + } + p_Var13 = *(PTP_IO *)(*(longlong *)param_1 + 0xe0); + if (p_Var13 != (PTP_IO)0x0) { + *(undefined8 *)(puVar16 + -8) = 0x180020c03; + CloseThreadpoolIo(p_Var13); + *(undefined8 *)(*(longlong *)param_1 + 0xe0) = 0; + } + *(undefined8 *)(*(longlong *)param_1 + 0xd0) = + *(undefined8 *)(*(longlong *)(*(longlong *)param_1 + 0xd0) + 0x28); + *(undefined8 *)(puVar16 + -8) = 0x180020c2f; + KpsDoSocketConnectAndSend(param_1); + } + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar15 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar16 + -8) = 0x180020c5f; + WPP_SF_L(uVar15,0xd0,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar10); + } + *(undefined8 *)(puVar16 + -8) = 0x180020c6b; + return; +} + ``` ## KpsDoSocketRecvData ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsDoSocketRecvData| |fullname|KpsDoSocketRecvData| |refcount|2| |length|811| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
KpsDoHttpCancelRequest
KpsIoLockedRef::RemoveRef
KpsReAllocMem
KpsServiceReady
KpsStartTimeoutTimer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_Dsd
WPP_SF_L
WPP_SF_LLWPP_SF_q
WS2_32.DLL::WSAGetLastError
WS2_32.DLL::WSARecv
WS2_32.DLL::ntohl
| |calling|KpsSocketRecvDataLengthIoCompletion| |paramcount|1| |address|1800212ec| |sig|void __cdecl KpsDoSocketRecvData(KpsIoLockedRef * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsDoSocketRecvData +++ KpsDoSocketRecvData @@ -0,0 +1,151 @@ + +/* void __cdecl KpsDoSocketRecvData(class KpsIoLockedRef & __ptr64) */ + +void __cdecl KpsDoSocketRecvData(KpsIoLockedRef *param_1) + +{ + longlong *plVar1; + longlong lVar2; + uint uVar3; + PTP_IO pio; + _KPS_IO *p_Var4; + undefined8 uVar5; + code *pcVar6; + uchar uVar7; + bool bVar8; + u_long uVar9; + int iVar10; + void *pvVar11; + undefined2 uVar12; + undefined1 *puVar13; + int iVar14; + undefined1 auStackY_68 [8]; + undefined1 auStackY_60 [24]; + + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd5, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,*(undefined8 *)param_1); + } + uVar7 = KpsServiceReady(); + puVar13 = auStackY_68; + iVar10 = 0; + if (uVar7 == '\0') goto LAB_1800215cd; + uVar9 = ntohl(**(u_long **)(*(longlong *)param_1 + 0x100)); + *(undefined4 *)(*(longlong *)param_1 + 0x108) = 4; + if (uVar9 + 4 < 4) { + *(undefined4 *)(*(longlong *)param_1 + 0x10c) = 0xffffffff; + iVar14 = -0x3fffff6b; + puVar13 = auStackY_68; + iVar10 = -0x3fffff6b; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar13 = auStackY_68, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1800215cd; + uVar12 = 0xd6; + } + else { + *(u_long *)(*(longlong *)param_1 + 0x10c) = uVar9 + 4; + uVar3 = *(uint *)(*(longlong *)param_1 + 0x10c); + if (DAT_18003e9c0 < uVar3) { + puVar13 = auStackY_68; + iVar10 = 0x6f; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar13 = auStackY_68, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_LL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd7, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar9); + puVar13 = auStackY_68; + iVar10 = 0x6f; + } + goto LAB_1800215cd; + } + pvVar11 = KpsReAllocMem((ulonglong)uVar3,*(void **)(*(longlong *)param_1 + 0x100)); + if (pvVar11 != (void *)0x0) { + *(void **)(*(longlong *)param_1 + 0x100) = pvVar11; + *(undefined4 *)(*(longlong *)param_1 + 0x20) = 10; + StartThreadpoolIo(*(PTP_IO *)(*(longlong *)param_1 + 0xe0)); + puVar13 = auStackY_68; + if (*(longlong *)param_1 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_1 + 0x158); + lVar2 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar13 = auStackY_68; + if (lVar2 + 1 < 2) { + pcVar6 = (code *)swi(0x29); + (*pcVar6)(0xe); + puVar13 = auStackY_60; + } + } + lVar2 = *(longlong *)param_1; + *(undefined8 *)(puVar13 + 0x30) = 0; + *(longlong *)(puVar13 + 0x28) = lVar2; + *(undefined1 **)(puVar13 + 0x20) = puVar13 + 0x70; + uVar5 = *(undefined8 *)(lVar2 + 0xd8); + *(undefined8 *)(puVar13 + -8) = 0x1800214b7; + iVar14 = WSARecv(uVar5,puVar13 + 0x40,1); + if (iVar14 == -1) { + *(undefined8 *)(puVar13 + -8) = 0x1800214c8; + iVar14 = WSAGetLastError(); + if (iVar14 != 0x3e5) { + pio = *(PTP_IO *)(*(longlong *)param_1 + 0xe0); + *(undefined8 *)(puVar13 + -8) = 0x1800214e5; + CancelThreadpoolIo(pio); + *(undefined8 *)(puVar13 + -8) = 0x1800214f1; + iVar10 = WSAGetLastError(); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar13 + 0x28) = 0xff8; + *(char **)(puVar13 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar13 + -8) = 0x180021532; + WPP_SF_Dsd(uVar5,0xd9,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar10, + *(char **)(puVar13 + 0x20)); + } + *(undefined8 *)(puVar13 + -8) = 0x18002153a; + KpsIoLockedRef::RemoveRef(param_1); + goto LAB_1800215cd; + } + } + p_Var4 = *(_KPS_IO **)param_1; + *(undefined8 *)(puVar13 + -8) = 0x18002154a; + KpsStartTimeoutTimer(p_Var4); + *(undefined4 *)(p_Var4 + 0x150) = 1; + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar13 + -8) = 0x180021561; + bVar8 = KpsIoLockedRef::RemoveRef(param_1); + if (!bVar8) { + lVar2 = *(longlong *)param_1; + *(undefined8 *)(puVar13 + -8) = 0x180021576; + RtlLeaveCriticalSection(lVar2 + 0x120); + } + *(undefined8 *)param_1 = 0; + iVar10 = 0; + } + goto LAB_1800215cd; + } + iVar14 = 8; + puVar13 = auStackY_68; + iVar10 = iVar14; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar13 = auStackY_68, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1800215cd; + uVar12 = 0xd8; + } + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar12, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar14, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar13 = auStackY_68; + iVar10 = iVar14; +LAB_1800215cd: + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar13 + -8) = 0x1800215db; + KpsDoHttpCancelRequest(param_1); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar13 + -8) = 0x180021601; + WPP_SF_L(uVar5,0xda,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar10); + } + return; +} + ``` ## KpsDoSocketRecvDataLength ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsDoSocketRecvDataLength| |fullname|KpsDoSocketRecvDataLength| |refcount|2| |length|659| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
KpsAllocMem
KpsDoHttpCancelRequest
KpsIoLockedRef::RemoveRef
KpsServiceReady
KpsStartTimeoutTimer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_Dsd
WPP_SF_L
WPP_SF_qWS2_32.DLL::WSAGetLastError
WS2_32.DLL::WSARecv
| |calling|KpsSocketConnectAndSendIoCompletion| |paramcount|1| |address|180021908| |sig|void __cdecl KpsDoSocketRecvDataLength(KpsIoLockedRef * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsDoSocketRecvDataLength +++ KpsDoSocketRecvDataLength @@ -0,0 +1,124 @@ + +/* void __cdecl KpsDoSocketRecvDataLength(class KpsIoLockedRef & __ptr64) */ + +void __cdecl KpsDoSocketRecvDataLength(KpsIoLockedRef *param_1) + +{ + longlong *plVar1; + longlong lVar2; + PTP_IO pio; + _KPS_IO *p_Var3; + undefined8 uVar4; + code *pcVar5; + uchar uVar6; + bool bVar7; + int iVar8; + int iVar9; + void *pvVar10; + undefined1 *puVar11; + undefined1 auStackY_58 [8]; + undefined1 auStackY_50 [24]; + + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd1, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,*(undefined8 *)param_1); + } + uVar6 = KpsServiceReady(); + puVar11 = auStackY_58; + iVar9 = 0; + if (uVar6 != '\0') { + *(undefined4 *)(*(longlong *)param_1 + 0x10c) = 4; + *(undefined4 *)(*(longlong *)param_1 + 0x108) = 0; + pvVar10 = KpsAllocMem((ulonglong)*(uint *)(*(longlong *)param_1 + 0x10c)); + *(void **)(*(longlong *)param_1 + 0x100) = pvVar10; + if (*(longlong *)(*(longlong *)param_1 + 0x100) == 0) { + puVar11 = auStackY_58; + iVar9 = 8; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar11 = auStackY_58, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd2, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,8, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar11 = auStackY_58; + iVar9 = 8; + } + } + else { + *(undefined4 *)(*(longlong *)param_1 + 0x20) = 9; + StartThreadpoolIo(*(PTP_IO *)(*(longlong *)param_1 + 0xe0)); + puVar11 = auStackY_58; + if (*(longlong *)param_1 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_1 + 0x158); + lVar2 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar11 = auStackY_58; + if (lVar2 + 1 < 2) { + pcVar5 = (code *)swi(0x29); + (*pcVar5)(0xe); + puVar11 = auStackY_50; + } + } + lVar2 = *(longlong *)param_1; + *(undefined8 *)(puVar11 + 0x30) = 0; + *(longlong *)(puVar11 + 0x28) = lVar2; + *(undefined1 **)(puVar11 + 0x20) = puVar11 + 0x60; + uVar4 = *(undefined8 *)(lVar2 + 0xd8); + *(undefined8 *)(puVar11 + -8) = 0x180021a7e; + iVar8 = WSARecv(uVar4,puVar11 + 0x40,1); + if (iVar8 == -1) { + *(undefined8 *)(puVar11 + -8) = 0x180021a8f; + iVar8 = WSAGetLastError(); + if (iVar8 != 0x3e5) { + pio = *(PTP_IO *)(*(longlong *)param_1 + 0xe0); + *(undefined8 *)(puVar11 + -8) = 0x180021aac; + CancelThreadpoolIo(pio); + *(undefined8 *)(puVar11 + -8) = 0x180021ab8; + iVar9 = WSAGetLastError(); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar11 + 0x28) = 0xf8e; + *(char **)(puVar11 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar11 + -8) = 0x180021afd; + WPP_SF_Dsd(uVar4,0xd3,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar9, + *(char **)(puVar11 + 0x20)); + } + *(undefined8 *)(puVar11 + -8) = 0x180021b05; + KpsIoLockedRef::RemoveRef(param_1); + goto LAB_180021b4d; + } + } + p_Var3 = *(_KPS_IO **)param_1; + *(undefined8 *)(puVar11 + -8) = 0x180021b12; + KpsStartTimeoutTimer(p_Var3); + *(undefined4 *)(p_Var3 + 0x150) = 1; + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar11 + -8) = 0x180021b29; + bVar7 = KpsIoLockedRef::RemoveRef(param_1); + if (!bVar7) { + lVar2 = *(longlong *)param_1; + *(undefined8 *)(puVar11 + -8) = 0x180021b3e; + RtlLeaveCriticalSection(lVar2 + 0x120); + } + *(undefined8 *)param_1 = 0; + iVar9 = 0; + } + } + } +LAB_180021b4d: + if (*(longlong *)param_1 != 0) { + *(undefined8 *)(puVar11 + -8) = 0x180021b5b; + KpsDoHttpCancelRequest(param_1); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar11 + -8) = 0x180021b85; + WPP_SF_L(uVar4,0xd4,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar9); + } + return; +} + ``` ## KpsForwardKerbRequest ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsForwardKerbRequest| |fullname|KpsForwardKerbRequest| |refcount|3| |length|212| |called|KpsDoHttpCancelRequest
KpsDoSocketConnectAndSend
KpsGetKdcBinding
WPP_SF_L
WPP_SF_q| |calling|KpsDoSocketConnectAndSend
KpsProcessProxyRequest| |paramcount|1| |address|180021ddc| |sig|void __cdecl KpsForwardKerbRequest(KpsIoLockedRef * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsForwardKerbRequest +++ KpsForwardKerbRequest @@ -0,0 +1,33 @@ + +/* void __cdecl KpsForwardKerbRequest(class KpsIoLockedRef & __ptr64) */ + +void __cdecl KpsForwardKerbRequest(KpsIoLockedRef *param_1) + +{ + ulong uVar1; + + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x118, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,*(undefined8 *)param_1); + } + uVar1 = KpsGetKdcBinding(*(_KPS_IO **)param_1); + if (uVar1 == 0) { + KpsDoSocketConnectAndSend(param_1); + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x119, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar1); + } + if (*(longlong *)param_1 != 0) { + KpsDoHttpCancelRequest(param_1); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11a, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar1); + } + return; +} + ``` ## KpsHttpCancelRequestIoCompletion ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsHttpCancelRequestIoCompletion| |fullname|KpsHttpCancelRequestIoCompletion| |refcount|2| |length|303| |called|KpsIoLockedRef::RemoveRef
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_
WPP_SF_Dsd
WPP_SF_L
WPP_SF_qDI| |calling|KpsHttpIoCompletion| |paramcount|3| |address|180022218| |sig|void __cdecl KpsHttpCancelRequestIoCompletion(ulong param_1, __uint64 param_2, KpsIoLockedRef * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsHttpCancelRequestIoCompletion +++ KpsHttpCancelRequestIoCompletion @@ -0,0 +1,45 @@ + +/* void __cdecl KpsHttpCancelRequestIoCompletion(unsigned long,unsigned __int64,class KpsIoLockedRef + & __ptr64) */ + +void __cdecl +KpsHttpCancelRequestIoCompletion(ulong param_1,__uint64 param_2,KpsIoLockedRef *param_3) + +{ + bool bVar1; + ulong uVar2; + + uVar2 = 0; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x101,param_3,*(undefined8 *)param_3); + } + if (param_1 == 0) { + param_1 = uVar2; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x103, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids); + } + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x102, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + } + if (*(longlong *)param_3 != 0) { + bVar1 = KpsIoLockedRef::RemoveRef(param_3); + if (!bVar1) { + RtlLeaveCriticalSection(*(longlong *)param_3 + 0x120); + } + *(undefined8 *)param_3 = 0; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x104, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1); + } + return; +} + ``` ## KpsHttpIoCompletion_Old ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsHttpIoCompletion_Old| |fullname|KpsHttpIoCompletion_Old| |refcount|2| |length|611| |called|
Expand for full list:
KpsCancelTimeoutTimer
KpsFreeKpsIo
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion_Old
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpSendPostResponseIoCompletionKpsHttpSendPostResponseIoCompletion_Old
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion_Old
KpsServiceReady
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_L
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled
| |calling|KpsHttpIoCompletion| |paramcount|6| |address|18002274c| |sig|void __cdecl KpsHttpIoCompletion_Old(_TP_CALLBACK_INSTANCE * param_1, void * param_2, void * param_3, ulong param_4, __uint64 param_5, _TP_IO * param_6)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsHttpIoCompletion_Old +++ KpsHttpIoCompletion_Old @@ -0,0 +1,132 @@ + +/* void __cdecl KpsHttpIoCompletion_Old(struct _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,void * + __ptr64,unsigned long,unsigned __int64,struct _TP_IO * __ptr64) */ + +void __cdecl +KpsHttpIoCompletion_Old + (_TP_CALLBACK_INSTANCE *param_1,void *param_2,void *param_3,ulong param_4,__uint64 param_5 + ,_TP_IO *param_6) + +{ + int iVar1; + bool bVar2; + uchar uVar3; + _KPS_IO *local_res10; + + local_res10 = param_3; + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + RtlEnterCriticalSection((longlong)param_3 + 0x120); + } + uVar3 = KpsServiceReady(); + if (uVar3 == '\0') { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x85, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_4); + } + } + else { + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if ((bVar2) && (*(int *)((longlong)param_3 + 0x150) != 0)) { + KpsCancelTimeoutTimer(param_3); + } + iVar1 = *(int *)((longlong)param_3 + 0x20); + if (iVar1 == 1) { + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + KpsHttpReceiveRequestIoCompletion(param_4,param_5,&local_res10); + } + else { + KpsHttpReceiveRequestIoCompletion_Old(param_4,param_5,param_3); + } + } + else if (iVar1 == 2) { + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + KpsHttpReceiveClientCertIoCompletion(param_4,param_5,&local_res10); + } + else { + KpsHttpReceiveClientCertIoCompletion_Old(param_4,param_5,param_3); + } + } + else if (iVar1 == 3) { + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + KpsHttpSendResponseIoCompletion(param_4,param_5,&local_res10); + } + else { + KpsHttpSendResponseIoCompletion_Old(param_4,param_5,param_3); + } + } + else if (iVar1 == 4) { + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + KpsHttpSendPostResponseIoCompletion(param_4,param_5,&local_res10); + } + else { + KpsHttpSendPostResponseIoCompletion_Old(param_4,param_5,param_3); + } + } + else if (iVar1 == 5) { + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + KpsHttpReceiveRequestEntityIoCompletion(param_4,param_5,&local_res10); + } + else { + KpsHttpReceiveRequestEntityIoCompletion_Old(param_4,param_5,param_3); + } + } + else if (iVar1 == 7) { + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + KpsHttpCancelRequestIoCompletion(param_4,param_5,&local_res10); + } + else { + KpsHttpCancelRequestIoCompletion_Old(param_4,param_5,param_3); + } + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x86, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar1); + } + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if ((bVar2) && (local_res10 != (_KPS_IO *)0x0)) { + RtlLeaveCriticalSection(local_res10 + 0x120); + } + local_res10 = (_KPS_IO *)0x0; + } + if (local_res10 != (_KPS_IO *)0x0) { + KpsFreeKpsIo(local_res10); + } + return; +} + ``` ## KpsHttpReceiveClientCertIoCompletion ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsHttpReceiveClientCertIoCompletion| |fullname|KpsHttpReceiveClientCertIoCompletion| |refcount|2| |length|1070| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
HTTPAPI.DLL::HttpReceiveClientCertificate
KpsDoHttpCancelRequest
KpsDoHttpReceiveRequestEntity
KpsIoLockedRef::RemoveRef
KpsReAllocMem
KpsStartTimeoutTimer
McGenEventWrite_EventWriteTransfer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_WPP_SF_Dsd
WPP_SF_L
WPP_SF_LL
WPP_SF_qDI
__security_check_cookie
wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled
| |calling|KpsHttpIoCompletion| |paramcount|3| |address|1800229b8| |sig|void __cdecl KpsHttpReceiveClientCertIoCompletion(ulong param_1, __uint64 param_2, KpsIoLockedRef * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsHttpReceiveClientCertIoCompletion +++ KpsHttpReceiveClientCertIoCompletion @@ -0,0 +1,215 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* void __cdecl KpsHttpReceiveClientCertIoCompletion(unsigned long,unsigned __int64,class + KpsIoLockedRef & __ptr64) */ + +void __cdecl +KpsHttpReceiveClientCertIoCompletion(ulong param_1,__uint64 param_2,KpsIoLockedRef *param_3) + +{ + longlong *plVar1; + longlong lVar2; + longlong lVar3; + undefined8 uVar4; + _KPS_IO *p_Var5; + uint *puVar6; + byte *pbVar7; + undefined8 uVar8; + code *pcVar9; + bool bVar10; + void *pvVar11; + uint uVar12; + undefined2 uVar13; + undefined1 *puVar14; + ulong uVar15; + KpsIoLockedRef *pKVar16; + undefined1 auStackY_98 [8]; + undefined1 auStackY_90 [24]; + uint local_58 [2]; + _EVENT_DATA_DESCRIPTOR local_50; + uint *local_40; + undefined4 local_38; + undefined4 local_34; + ulonglong local_30; + + local_30 = __security_cookie ^ (ulonglong)auStackY_98; + uVar15 = 0; + pKVar16 = param_3; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe7,param_3,*(undefined8 *)param_3); + } + if (param_1 != 0xea) { + if (param_1 == 0) { + *(int *)(*(longlong *)param_3 + 0x50) = (int)param_2; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + pKVar16 = (KpsIoLockedRef *)&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids; + WPP_SF_LL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xec, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids, + *(undefined4 *)(*(longlong *)param_3 + 0x50)); + } + puVar6 = *(uint **)(*(longlong *)param_3 + 0x48); + if (*(longlong *)(puVar6 + 2) == 0) { + if ((Microsoft_Windows_Kerberos_KdcProxyEnableBits & 0x10) != 0) { + McGenEventWrite_EventWriteTransfer + (WPP_GLOBAL_Control,(PCEVENT_DESCRIPTOR)&ClientCertRequired,pKVar16,1,&local_50) + ; + } + puVar14 = auStackY_98; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar14 = auStackY_98, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xed, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids); + puVar14 = auStackY_98; + } + } + else { + uVar12 = *puVar6; + if (uVar12 == 0) { + pbVar7 = *(byte **)(*(longlong *)param_3 + 0x38); + puVar14 = auStackY_98; + if ((*(int *)(pbVar7 + 0x24) == 6) && (puVar14 = auStackY_98, (*pbVar7 & 1) != 0)) { + KpsDoHttpReceiveRequestEntity(param_3); + puVar14 = auStackY_98; + } + } + else { + if ((Microsoft_Windows_Kerberos_KdcProxyEnableBits & 0x10) != 0) { + local_34 = 0; + local_40 = local_58; + local_38 = 4; + local_58[0] = uVar12; + McGenEventWrite_EventWriteTransfer + (WPP_GLOBAL_Control,(PCEVENT_DESCRIPTOR)&ClientCertNotValid,(ulonglong)uVar12, + 2,&local_50); + } + puVar14 = auStackY_98; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar14 = auStackY_98, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xee, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids, + **(undefined4 **)(*(longlong *)param_3 + 0x48)); + puVar14 = auStackY_98; + } + } + } + } + else { + puVar14 = auStackY_98; + uVar15 = param_1; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar14 = auStackY_98, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xeb, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar14 = auStackY_98; + } + } + goto LAB_180022d91; + } + lVar2 = *(longlong *)param_3; + uVar12 = *(int *)(*(longlong *)(lVar2 + 0x48) + 4) + 0x20; + if (uVar12 < 0x20) { + *(undefined4 *)(lVar2 + 0x50) = 0xffffffff; + uVar15 = 0xc0000095; + puVar14 = auStackY_98; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar14 = auStackY_98, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_180022d91; + uVar13 = 0xe8; + } + else { + *(uint *)(lVar2 + 0x50) = uVar12; + pvVar11 = KpsReAllocMem((ulonglong)*(uint *)(*(longlong *)param_3 + 0x50), + *(void **)(*(longlong *)param_3 + 0x48)); + if (pvVar11 != (void *)0x0) { + *(void **)(*(longlong *)param_3 + 0x48) = pvVar11; + StartThreadpoolIo(DAT_18003ec10); + puVar14 = auStackY_98; + if (*(longlong *)param_3 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_3 + 0x158); + lVar2 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar14 = auStackY_98; + if (lVar2 + 1 < 2) { + pcVar9 = (code *)swi(0x29); + (*pcVar9)(0xe); + puVar14 = auStackY_90; + } + } + lVar2 = *(longlong *)param_3; + *(longlong *)(puVar14 + 0x30) = lVar2; + *(undefined8 *)(puVar14 + 0x28) = 0; + lVar3 = *(longlong *)(lVar2 + 0x38); + uVar8 = *(undefined8 *)(lVar2 + 0x48); + *(undefined4 *)(puVar14 + 0x20) = *(undefined4 *)(lVar2 + 0x50); + uVar4 = *(undefined8 *)(lVar3 + 8); + *(undefined8 *)(puVar14 + -8) = 0x180022b19; + uVar15 = HttpReceiveClientCertificate(DAT_18003ec00,uVar4,0,uVar8); + if ((uVar15 == 0x3e5) || (uVar15 == 0)) { + *(undefined8 *)(puVar14 + -8) = 0x180022b91; + bVar10 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>:: + __private_IsEnabled((FeatureImpl<__WilFeatureTraits_Feature_3749982522> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_3749982522>::GetImpl(void)' + ::__l2::impl); + if (bVar10) { + p_Var5 = *(_KPS_IO **)param_3; + *(undefined8 *)(puVar14 + -8) = 0x180022ba0; + KpsStartTimeoutTimer(p_Var5); + *(undefined4 *)(p_Var5 + 0x150) = 2; + } + if (*(longlong *)param_3 != 0) { + *(undefined8 *)(puVar14 + -8) = 0x180022bbc; + bVar10 = KpsIoLockedRef::RemoveRef(param_3); + if (!bVar10) { + lVar2 = *(longlong *)param_3; + *(undefined8 *)(puVar14 + -8) = 0x180022bd1; + RtlLeaveCriticalSection(lVar2 + 0x120); + } + *(undefined8 *)param_3 = 0; + } + } + else { + *(undefined8 *)(puVar14 + -8) = 0x180022b39; + CancelThreadpoolIo(DAT_18003ec10); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar8 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar14 + 0x28) = 0x10f8; + *(char **)(puVar14 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar14 + -8) = 0x180022b78; + WPP_SF_Dsd(uVar8,0xea,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar15, + *(char **)(puVar14 + 0x20)); + } + *(undefined8 *)(puVar14 + -8) = 0x180022b80; + KpsIoLockedRef::RemoveRef(param_3); + } + goto LAB_180022d91; + } + uVar15 = 8; + puVar14 = auStackY_98; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar14 = auStackY_98, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_180022d91; + uVar13 = 0xe9; + } + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar13, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar15, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar14 = auStackY_98; +LAB_180022d91: + if (*(longlong *)param_3 != 0) { + *(undefined8 *)(puVar14 + -8) = 0x180022d9f; + KpsDoHttpCancelRequest(param_3); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar8 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar14 + -8) = 0x180022dc5; + WPP_SF_L(uVar8,0xef,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar15); + } + *(undefined8 *)(puVar14 + -8) = 0x180022dd2; + return; +} + ``` ## KpsHttpReceiveRequestEntityIoCompletion ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsHttpReceiveRequestEntityIoCompletion| |fullname|KpsHttpReceiveRequestEntityIoCompletion| |refcount|2| |length|996| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
HTTPAPI.DLL::HttpReceiveRequestEntityBody
KpsDoHttpCancelRequest
KpsIoLockedRef::RemoveRef
KpsProcessProxyRequest
KpsReAllocMem
KpsStartTimeoutTimer
McGenEventWrite_EventWriteTransfer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_DsdWPP_SF_L
WPP_SF_LL
WPP_SF_qDI
__security_check_cookie
wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled
| |calling|KpsHttpIoCompletion| |paramcount|3| |address|180023540| |sig|void __cdecl KpsHttpReceiveRequestEntityIoCompletion(ulong param_1, __uint64 param_2, KpsIoLockedRef * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsHttpReceiveRequestEntityIoCompletion +++ KpsHttpReceiveRequestEntityIoCompletion @@ -0,0 +1,214 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* void __cdecl KpsHttpReceiveRequestEntityIoCompletion(unsigned long,unsigned __int64,class + KpsIoLockedRef & __ptr64) */ + +void __cdecl +KpsHttpReceiveRequestEntityIoCompletion(ulong param_1,__uint64 param_2,KpsIoLockedRef *param_3) + +{ + longlong *plVar1; + undefined4 uVar2; + longlong lVar3; + _KPS_IO *p_Var4; + undefined8 uVar5; + code *pcVar6; + bool bVar7; + uint uVar8; + void *pvVar9; + PTP_IO p_Var10; + undefined2 uVar11; + longlong lVar12; + undefined1 *puVar13; + int iVar14; + undefined8 uVar15; + uint uVar16; + undefined1 auStackY_88 [8]; + undefined1 auStackY_80 [24]; + + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf8,param_3,*(undefined8 *)param_3); + } + if (param_1 == 0) { + lVar3 = *(longlong *)param_3; + uVar16 = *(uint *)(lVar3 + 0x60); + uVar8 = (int)param_2 + uVar16; + if (uVar8 < uVar16) { + param_1 = 0xc0000095; + puVar13 = auStackY_88; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar13 = auStackY_88, (WPP_GLOBAL_Control[0x1c] & 2) == 0)) goto LAB_1800238d7; + uVar11 = 0xfa; + } + else { + if (uVar8 <= DAT_18003e9c0) { + if (uVar8 == *(uint *)(lVar3 + 100)) { + *(uint *)(lVar3 + 0x60) = uVar8; + lVar3 = *(longlong *)param_3; + uVar16 = *(uint *)(lVar3 + 100) + 0xc00; + if (uVar16 < *(uint *)(lVar3 + 100)) { + *(undefined4 *)(lVar3 + 100) = 0xffffffff; + param_1 = 0xc0000095; + puVar13 = auStackY_88; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar13 = auStackY_88, (WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xfc, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids, + *(undefined4 *)(*(longlong *)param_3 + 100)); + puVar13 = auStackY_88; + } + goto LAB_1800238d7; + } + *(uint *)(lVar3 + 100) = uVar16; + pvVar9 = KpsReAllocMem((ulonglong)*(uint *)(*(longlong *)param_3 + 100), + *(void **)(*(longlong *)param_3 + 0x58)); + if (pvVar9 == (void *)0x0) { + param_1 = 8; + puVar13 = auStackY_88; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar13 = auStackY_88, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1800238d7; + uVar11 = 0xfd; + goto LAB_1800235c8; + } + iVar14 = 0xc00; + *(void **)(*(longlong *)param_3 + 0x58) = pvVar9; + lVar12 = (ulonglong)*(uint *)(*(longlong *)param_3 + 0x60) + + *(longlong *)(*(longlong *)param_3 + 0x58); + } + else { + if (*(uint *)(lVar3 + 100) <= uVar8) { + param_1 = 0x54f; + puVar13 = auStackY_88; + goto LAB_1800238d7; + } + *(uint *)(lVar3 + 0x60) = uVar8; + lVar3 = *(longlong *)param_3; + lVar12 = (ulonglong)*(uint *)(lVar3 + 0x60) + *(longlong *)(lVar3 + 0x58); + iVar14 = *(int *)(lVar3 + 100) - *(uint *)(lVar3 + 0x60); + } + StartThreadpoolIo(DAT_18003ec10); + puVar13 = auStackY_88; + if (*(longlong *)param_3 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_3 + 0x158); + lVar3 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar13 = auStackY_88; + if (lVar3 + 1 < 2) { + pcVar6 = (code *)swi(0x29); + (*pcVar6)(0xe); + puVar13 = auStackY_80; + } + } + lVar3 = *(longlong *)param_3; + *(longlong *)(puVar13 + 0x30) = lVar3; + uVar15 = 0; + *(undefined8 *)(puVar13 + 0x28) = 0; + *(int *)(puVar13 + 0x20) = iVar14; + uVar5 = *(undefined8 *)(*(longlong *)(lVar3 + 0x38) + 0x10); + *(undefined8 *)(puVar13 + -8) = 0x18002376d; + param_1 = HttpReceiveRequestEntityBody(DAT_18003ec00,uVar5,0,lVar12); + if (param_1 == 0x26) { + *(undefined8 *)(puVar13 + -8) = 0x180023787; + p_Var10 = DAT_18003ec10; + CancelThreadpoolIo(DAT_18003ec10); + if ((Microsoft_Windows_Kerberos_KdcProxyEnableBits & 0x10) != 0) { + *(undefined1 **)(puVar13 + 0x20) = puVar13 + 0x40; + *(undefined8 *)(puVar13 + -8) = 0x1800237af; + McGenEventWrite_EventWriteTransfer + (p_Var10,(PCEVENT_DESCRIPTOR)&HttpRequestReceived,uVar15,1, + *(PEVENT_DATA_DESCRIPTOR *)(puVar13 + 0x20)); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + uVar2 = *(undefined4 *)(*(longlong *)param_3 + 0x60); + *(undefined8 *)(puVar13 + -8) = 0x1800237d9; + WPP_SF_L(uVar5,0xfe,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar2); + } + *(undefined8 *)(puVar13 + -8) = 0x1800237e1; + KpsIoLockedRef::RemoveRef(param_3); + *(undefined8 *)(puVar13 + -8) = 0x1800237e9; + KpsProcessProxyRequest(param_3); + } + else if ((param_1 == 0x3e5) || (param_1 == 0)) { + *(undefined8 *)(puVar13 + -8) = 0x18002385d; + bVar7 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>:: + __private_IsEnabled((FeatureImpl<__WilFeatureTraits_Feature_3749982522> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_3749982522>::GetImpl(void)' + ::__l2::impl); + if (bVar7) { + p_Var4 = *(_KPS_IO **)param_3; + *(undefined8 *)(puVar13 + -8) = 0x18002386c; + KpsStartTimeoutTimer(p_Var4); + *(undefined4 *)(p_Var4 + 0x150) = 2; + } + if (*(longlong *)param_3 != 0) { + *(undefined8 *)(puVar13 + -8) = 0x180023884; + bVar7 = KpsIoLockedRef::RemoveRef(param_3); + if (!bVar7) { + lVar3 = *(longlong *)param_3; + *(undefined8 *)(puVar13 + -8) = 0x180023899; + RtlLeaveCriticalSection(lVar3 + 0x120); + } + *(undefined8 *)param_3 = 0; + } + } + else { + *(undefined8 *)(puVar13 + -8) = 0x180023808; + CancelThreadpoolIo(DAT_18003ec10); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar13 + 0x28) = 0x11d2; + *(char **)(puVar13 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar13 + -8) = 0x180023847; + WPP_SF_Dsd(uVar5,0xff,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + *(char **)(puVar13 + 0x20)); + } + *(undefined8 *)(puVar13 + -8) = 0x18002384f; + KpsIoLockedRef::RemoveRef(param_3); + } + goto LAB_1800238d7; + } + puVar13 = auStackY_88; + param_1 = 0; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar13 = auStackY_88, param_1 = 0, (WPP_GLOBAL_Control[0x1c] & 2) == 0)) + goto LAB_1800238d7; + uVar11 = 0xfb; + param_1 = 0; + uVar16 = uVar8; + } + WPP_SF_LL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar11, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar16); + puVar13 = auStackY_88; + } + else { + puVar13 = auStackY_88; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (puVar13 = auStackY_88, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1800238d7; + uVar11 = 0xf9; +LAB_1800235c8: + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar11, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar13 = auStackY_88; + } +LAB_1800238d7: + if (*(longlong *)param_3 != 0) { + *(undefined8 *)(puVar13 + -8) = 0x1800238e5; + KpsDoHttpCancelRequest(param_3); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar13 + -8) = 0x18002390b; + WPP_SF_L(uVar5,0x100,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1); + } + *(undefined8 *)(puVar13 + -8) = 0x180023918; + return; +} + ``` ## KpsHttpReceiveRequestIoCompletion ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsHttpReceiveRequestIoCompletion| |fullname|KpsHttpReceiveRequestIoCompletion| |refcount|2| |length|1227| |called|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
HTTPAPI.DLL::HttpReceiveHttpRequest
KpsCreateKpsIo
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsFreeKpsIo
KpsIoLockedRef::RemoveRef
KpsPerfUpdateKpsReAllocMem
KpsStartTimeoutTimer
McGenEventWrite_EventWriteTransfer
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_Dsd
WPP_SF_L
WPP_SF_dS
WPP_SF_qDI
__security_check_cookie
wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled
| |calling|KpsHttpIoCompletion| |paramcount|3| |address|180024020| |sig|void __cdecl KpsHttpReceiveRequestIoCompletion(ulong param_1, __uint64 param_2, KpsIoLockedRef * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsHttpReceiveRequestIoCompletion +++ KpsHttpReceiveRequestIoCompletion @@ -0,0 +1,237 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* void __cdecl KpsHttpReceiveRequestIoCompletion(unsigned long,unsigned __int64,class + KpsIoLockedRef & __ptr64) */ + +void __cdecl +KpsHttpReceiveRequestIoCompletion(ulong param_1,__uint64 param_2,KpsIoLockedRef *param_3) + +{ + longlong *plVar1; + longlong lVar2; + undefined4 uVar3; + undefined8 uVar4; + longlong lVar5; + _KPS_IO *p_Var6; + code *pcVar7; + bool bVar8; + ulong uVar9; + ulong uVar10; + void *pvVar11; + _KPS_IO **pp_Var12; + undefined1 *puVar13; + KpsIoLockedRef *pKVar14; + undefined1 auStackY_a8 [8]; + undefined1 auStackY_a0 [24]; + _KPS_IO *local_68; + _KPS_IO *local_60; + undefined1 local_58 [16]; + _KPS_IO **local_48; + undefined4 local_40; + undefined4 local_3c; + ulonglong local_38; + + local_38 = __security_cookie ^ (ulonglong)auStackY_a8; + uVar9 = 0; + local_60 = (_KPS_IO *)0x0; + pKVar14 = param_3; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xdf,param_3,*(undefined8 *)param_3); + } + KpsPerfUpdate(1); + puVar13 = auStackY_a8; + uVar10 = 0; + if (param_1 == 0xea) { + *(int *)(*(longlong *)param_3 + 0x44) = (int)param_2; + pvVar11 = KpsReAllocMem((ulonglong)*(uint *)(*(longlong *)param_3 + 0x44), + *(void **)(*(longlong *)param_3 + 0x38)); + if (pvVar11 == (void *)0x0) { + puVar13 = auStackY_a8; + uVar10 = 8; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar13 = auStackY_a8, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + pKVar14 = (KpsIoLockedRef *)&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids; + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe0, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,8, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar13 = auStackY_a8; + uVar10 = 8; + } + } + else { + *(void **)(*(longlong *)param_3 + 0x38) = pvVar11; + StartThreadpoolIo(DAT_18003ec10); + puVar13 = auStackY_a8; + if (*(longlong *)param_3 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_3 + 0x158); + lVar2 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar13 = auStackY_a8; + if (lVar2 + 1 < 2) { + pcVar7 = (code *)swi(0x29); + (*pcVar7)(0xe); + puVar13 = auStackY_a0; + } + } + lVar2 = *(longlong *)param_3; + *(longlong *)(puVar13 + 0x30) = lVar2; + *(undefined8 *)(puVar13 + 0x28) = 0; + lVar5 = *(longlong *)(lVar2 + 0x38); + *(undefined4 *)(puVar13 + 0x20) = *(undefined4 *)(lVar2 + 0x44); + pKVar14 = (KpsIoLockedRef *)0x0; + uVar4 = *(undefined8 *)(lVar5 + 0x10); + *(undefined8 *)(puVar13 + -8) = 0x180024218; + uVar10 = HttpReceiveHttpRequest(DAT_18003ec00,uVar4); + if ((uVar10 == 0x3e5) || (uVar10 == 0)) { + *(undefined8 *)(puVar13 + -8) = 0x18002429a; + bVar8 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>:: + __private_IsEnabled((FeatureImpl<__WilFeatureTraits_Feature_3749982522> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_3749982522>::GetImpl(void)' + ::__l2::impl); + if (bVar8) { + p_Var6 = *(_KPS_IO **)param_3; + *(undefined8 *)(puVar13 + -8) = 0x1800242a9; + KpsStartTimeoutTimer(p_Var6); + *(undefined4 *)(p_Var6 + 0x150) = 2; + } + if (*(longlong *)param_3 != 0) { + *(undefined8 *)(puVar13 + -8) = 0x1800242c0; + bVar8 = KpsIoLockedRef::RemoveRef(param_3); + if (!bVar8) { + lVar2 = *(longlong *)param_3; + *(undefined8 *)(puVar13 + -8) = 0x1800242d5; + RtlLeaveCriticalSection(lVar2 + 0x120); + } + *(undefined8 *)param_3 = 0; + } + goto LAB_180024473; + } + *(undefined8 *)(puVar13 + -8) = 0x180024238; + CancelThreadpoolIo(DAT_18003ec10); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar13 + 0x28) = 0x107c; + *(char **)(puVar13 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + pKVar14 = (KpsIoLockedRef *)&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids; + *(undefined8 *)(puVar13 + -8) = 0x180024281; + WPP_SF_Dsd(uVar4,0xe1,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar10, + *(char **)(puVar13 + 0x20)); + } + *(undefined8 *)(puVar13 + -8) = 0x180024289; + KpsIoLockedRef::RemoveRef(param_3); + } + } + pp_Var12 = &local_60; + *(undefined8 *)(puVar13 + -8) = 0x180024116; + uVar9 = KpsCreateKpsIo(pp_Var12); + if (uVar9 == 0) { + local_68 = local_60; + *(undefined8 *)(puVar13 + -8) = 0x18002430b; + RtlEnterCriticalSection(local_60 + 0x120); + local_60 = (_KPS_IO *)0x0; + *(undefined8 *)(puVar13 + -8) = 0x18002431e; + KpsDoHttpReceiveRequest((KpsIoLockedRef *)&local_68); + p_Var6 = local_68; + if (local_68 != (_KPS_IO *)0x0) { + *(undefined8 *)(puVar13 + -8) = 0x180024330; + bVar8 = KpsIoLockedRef::RemoveRef((KpsIoLockedRef *)&local_68); + if (!bVar8) { + *(undefined8 *)(puVar13 + -8) = 0x180024342; + RtlLeaveCriticalSection(p_Var6 + 0x120); + } + } + if (param_1 == 0) { + if (uVar10 == 0) { + *(int *)(*(longlong *)param_3 + 0x40) = (int)param_2; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + uVar3 = *(undefined4 *)(*(longlong *)param_3 + 0x40); + *(undefined8 *)(puVar13 + 0x20) = + *(undefined8 *)(*(longlong *)(*(longlong *)param_3 + 0x38) + 0x48); + *(undefined8 *)(puVar13 + -8) = 0x180024438; + WPP_SF_dS(uVar4,0xe5,pKVar14,uVar3,*(wchar_t **)(puVar13 + 0x20)); + } + if (DAT_18003e9a8 == 0) { + if ((*(int *)(*(byte **)(*(longlong *)param_3 + 0x38) + 0x24) == 6) && + ((**(byte **)(*(longlong *)param_3 + 0x38) & 1) != 0)) { + *(undefined8 *)(puVar13 + -8) = 0x18002446c; + KpsDoHttpReceiveRequestEntity(param_3); + } + } + else { + *(undefined8 *)(puVar13 + -8) = 0x180024450; + KpsDoHttpReceiveClientCert(param_3); + } + } + else { + uVar9 = uVar10; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar13 + 0x28) = 0x10a5; + *(char **)(puVar13 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar13 + -8) = 0x1800243f4; + WPP_SF_Dsd(uVar4,0xe4,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar10, + *(char **)(puVar13 + 0x20)); + } + } + } + else { + uVar9 = param_1; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar13 + 0x28) = 0x109d; + *(char **)(puVar13 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar13 + -8) = 0x180024391; + WPP_SF_Dsd(uVar4,0xe3,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + *(char **)(puVar13 + 0x20)); + } + } + } + else { + if ((Microsoft_Windows_Kerberos_KdcProxyEnableBits & 2) != 0) { + local_3c = 0; + local_68 = (_KPS_IO *)CONCAT44(local_68._4_4_,uVar9); + local_48 = &local_68; + local_40 = 4; + *(undefined1 **)(puVar13 + 0x20) = local_58; + *(undefined8 *)(puVar13 + -8) = 0x18002415b; + McGenEventWrite_EventWriteTransfer + (pp_Var12,(PCEVENT_DESCRIPTOR)&CreateKpsIoFailure,pKVar14,2, + *(PEVENT_DATA_DESCRIPTOR *)(puVar13 + 0x20)); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar13 + 0x28) = 0x108f; + *(char **)(puVar13 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar13 + -8) = 0x1800241a7; + WPP_SF_Dsd(uVar4,0xe2,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar9, + *(char **)(puVar13 + 0x20)); + } + } +LAB_180024473: + if (*(longlong *)param_3 != 0) { + *(undefined8 *)(puVar13 + -8) = 0x180024481; + KpsDoHttpCancelRequest(param_3); + } + if (local_60 != (_KPS_IO *)0x0) { + *(undefined8 *)(puVar13 + -8) = 0x180024499; + KpsFreeKpsIo(local_60); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar13 + -8) = 0x1800244c3; + WPP_SF_L(uVar4,0xe6,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar9); + } + *(undefined8 *)(puVar13 + -8) = 0x1800244cf; + return; +} + ``` ## KpsHttpSendPostResponseIoCompletion ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsHttpSendPostResponseIoCompletion| |fullname|KpsHttpSendPostResponseIoCompletion| |refcount|2| |length|303| |called|KpsIoLockedRef::RemoveRef
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_
WPP_SF_Dsd
WPP_SF_L
WPP_SF_qDI| |calling|KpsHttpIoCompletion| |paramcount|3| |address|180024c94| |sig|void __cdecl KpsHttpSendPostResponseIoCompletion(ulong param_1, __uint64 param_2, KpsIoLockedRef * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsHttpSendPostResponseIoCompletion +++ KpsHttpSendPostResponseIoCompletion @@ -0,0 +1,45 @@ + +/* void __cdecl KpsHttpSendPostResponseIoCompletion(unsigned long,unsigned __int64,class + KpsIoLockedRef & __ptr64) */ + +void __cdecl +KpsHttpSendPostResponseIoCompletion(ulong param_1,__uint64 param_2,KpsIoLockedRef *param_3) + +{ + bool bVar1; + ulong uVar2; + + uVar2 = 0; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf4,param_3,*(undefined8 *)param_3); + } + if (param_1 == 0) { + param_1 = uVar2; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf6, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids); + } + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf5, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + } + if (*(longlong *)param_3 != 0) { + bVar1 = KpsIoLockedRef::RemoveRef(param_3); + if (!bVar1) { + RtlLeaveCriticalSection(*(longlong *)param_3 + 0x120); + } + *(undefined8 *)param_3 = 0; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf7, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1); + } + return; +} + ``` ## KpsHttpSendResponseIoCompletion ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsHttpSendResponseIoCompletion| |fullname|KpsHttpSendResponseIoCompletion| |refcount|2| |length|303| |called|KpsIoLockedRef::RemoveRef
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_
WPP_SF_Dsd
WPP_SF_L
WPP_SF_qDI| |calling|KpsHttpIoCompletion| |paramcount|3| |address|180025000| |sig|void __cdecl KpsHttpSendResponseIoCompletion(ulong param_1, __uint64 param_2, KpsIoLockedRef * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsHttpSendResponseIoCompletion +++ KpsHttpSendResponseIoCompletion @@ -0,0 +1,44 @@ + +/* void __cdecl KpsHttpSendResponseIoCompletion(unsigned long,unsigned __int64,class KpsIoLockedRef + & __ptr64) */ + +void __cdecl KpsHttpSendResponseIoCompletion(ulong param_1,__uint64 param_2,KpsIoLockedRef *param_3) + +{ + bool bVar1; + ulong uVar2; + + uVar2 = 0; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf0,param_3,*(undefined8 *)param_3); + } + if (param_1 == 0) { + param_1 = uVar2; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf2, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids); + } + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf1, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + } + if (*(longlong *)param_3 != 0) { + bVar1 = KpsIoLockedRef::RemoveRef(param_3); + if (!bVar1) { + RtlLeaveCriticalSection(*(longlong *)param_3 + 0x120); + } + *(undefined8 *)param_3 = 0; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf3, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1); + } + return; +} + ``` ## KpsProcessProxyRequest ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsProcessProxyRequest| |fullname|KpsProcessProxyRequest| |refcount|2| |length|259| |called|KpsDoHttpCancelRequest
KpsDoHttpSendResponse
KpsForwardKerbRequest
KpsPerfUpdate
KpsUnpackProxyRequest
WPP_SF_Dsd
WPP_SF_L
WPP_SF_q| |calling|KpsHttpReceiveRequestEntityIoCompletion| |paramcount|1| |address|180025e58| |sig|void __cdecl KpsProcessProxyRequest(KpsIoLockedRef * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsProcessProxyRequest +++ KpsProcessProxyRequest @@ -0,0 +1,44 @@ + +/* void __cdecl KpsProcessProxyRequest(class KpsIoLockedRef & __ptr64) */ + +void __cdecl KpsProcessProxyRequest(KpsIoLockedRef *param_1) + +{ + ulong uVar1; + ushort in_DX; + char *in_R8; + char *in_R9; + + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + in_R9 = *(char **)param_1; + in_R8 = &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids; + in_DX = 0x11b; + WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11b, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,in_R9); + } + uVar1 = KpsUnpackProxyRequest(*(_KPS_IO **)param_1); + if (uVar1 == 0x78f) { + KpsPerfUpdate(4); + KpsDoHttpSendResponse(param_1,in_DX,in_R8,in_R9); + } + else if (uVar1 == 0) { + KpsForwardKerbRequest(param_1); + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11c, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar1, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + } + if (*(longlong *)param_1 != 0) { + KpsDoHttpCancelRequest(param_1); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11d, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar1); + } + return; +} + ``` ## KpsSocketConnectAndSendIoCompletion ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|KpsSocketConnectAndSendIoCompletion| |fullname|KpsSocketConnectAndSendIoCompletion| |refcount|2| |length|460| |called|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo
KpsDoHttpCancelRequest
KpsDoSocketConnectAndSend
KpsDoSocketRecvDataLength
KpsUpdateDomainRediscovery
WPP_SF_Dsd
WPP_SF_L
WPP_SF_ZDsd
WPP_SF_qDI
WS2_32.DLL::closesocket| |calling|KpsSocketIoCompletion| |paramcount|3| |address|180026070| |sig|void __cdecl KpsSocketConnectAndSendIoCompletion(ulong param_1, __uint64 param_2, KpsIoLockedRef * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- KpsSocketConnectAndSendIoCompletion +++ KpsSocketConnectAndSendIoCompletion @@ -0,0 +1,66 @@ + +/* void __cdecl KpsSocketConnectAndSendIoCompletion(unsigned long,unsigned __int64,class + KpsIoLockedRef & __ptr64) */ + +void __cdecl +KpsSocketConnectAndSendIoCompletion(ulong param_1,__uint64 param_2,KpsIoLockedRef *param_3) + +{ + _KPS_IO *p_Var1; + ulong uVar2; + undefined8 in_stack_ffffffffffffffd8; + undefined4 uVar3; + + uVar3 = (undefined4)((ulonglong)in_stack_ffffffffffffffd8 >> 0x20); + uVar2 = 0; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x107,param_3,*(undefined8 *)param_3); + } + p_Var1 = *(_KPS_IO **)param_3; + if (param_1 == 0) { + uVar2 = KpsUpdateDomainRediscovery(p_Var1); + if (uVar2 == 0) { + KpsDoSocketRecvDataLength(param_3); + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_ZDsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x109, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids, + (wchar_t *)(*(longlong *)param_3 + 0x70),CONCAT44(uVar3,uVar2), + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + } + } + else if (*(longlong *)(p_Var1 + 0xd0) == 0) { + uVar2 = param_1; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x108, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + } + } + else { + if (*(SOCKET *)(p_Var1 + 0xd8) != 0xffffffffffffffff) { + closesocket(*(SOCKET *)(p_Var1 + 0xd8)); + *(undefined8 *)(*(longlong *)param_3 + 0xd8) = 0xffffffffffffffff; + } + if (*(PTP_IO *)(*(longlong *)param_3 + 0xe0) != (PTP_IO)0x0) { + CloseThreadpoolIo(*(PTP_IO *)(*(longlong *)param_3 + 0xe0)); + *(undefined8 *)(*(longlong *)param_3 + 0xe0) = 0; + } + *(undefined8 *)(*(longlong *)param_3 + 0xd0) = + *(undefined8 *)(*(longlong *)(*(longlong *)param_3 + 0xd0) + 0x28); + KpsDoSocketConnectAndSend(param_3); + } + if (*(longlong *)param_3 != 0) { + KpsDoHttpCancelRequest(param_3); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10a, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar2); + } + return; +} + ``` ## wil::details::ReportUsageToService ### Function Meta |Key|kpssvc-06.dll| | :---: | :---: | |name|ReportUsageToService| |fullname|wil::details::ReportUsageToService| |refcount|4| |length|147| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled
wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled| |paramcount|8| |address|180029238| |sig|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::ReportUsageToService +++ wil::details::ReportUsageToService @@ -0,0 +1,30 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* void __cdecl wil::details::ReportUsageToService(struct wil_details_FeatureReportingCache * + __ptr64,unsigned int,int,int,struct FEATURE_LOGGED_TRAITS const * __ptr64,int,enum + wil_ReportingKind,unsigned __int64) */ + +void __cdecl +wil::details::ReportUsageToService + (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4, + FEATURE_LOGGED_TRAITS *param_5,int param_6,wil_ReportingKind param_7,__uint64 param_8) + +{ + int iVar1; + uint in_stack_ffffffffffffffd0; + undefined1 in_stack_ffffffffffffffd8; + undefined7 in_stack_ffffffffffffffd9; + + param_7 = 3; + iVar1 = ReportUsageToServiceDirect + (param_1,param_2,param_3,param_4,(-(uint)(param_6 != 0) & 0xfffffffc) + 6, + in_stack_ffffffffffffffd0, + CONCAT71(in_stack_ffffffffffffffd9,in_stack_ffffffffffffffd8),(uchar)param_5[4] + ); + if ((iVar1 != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { + (*g_wil_details_pfnFeatureLoggingHook)(param_2,param_5,0,param_6,¶m_7,0,0,1); + } + return; +} + ``` # Modified *Modified functions contain code changes* ## KpsHttpStart ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.63| |i_ratio|0.45| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsHttpStart|KpsHttpStart| |fullname|KpsHttpStart|KpsHttpStart| |refcount|3|3| |`length`|1931|2041| |`called`|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateEventW
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo
HTTPAPI.DLL::HttpAddUrlToUrlGroup
HTTPAPI.DLL::HttpCloseRequestQueue
HTTPAPI.DLL::HttpCloseServerSession
HTTPAPI.DLL::HttpCloseUrlGroup
HTTPAPI.DLL::HttpCreateRequestQueue
HTTPAPI.DLL::HttpCreateServerSessionHTTPAPI.DLL::HttpCreateUrlGroup
HTTPAPI.DLL::HttpInitialize
HTTPAPI.DLL::HttpSetUrlGroupProperty
HTTPAPI.DLL::HttpTerminate
KpsCreateKpsIo
KpsDoHttpReceiveRequest
KpsFreeKpsIo
McGenEventWrite_EventWriteTransfer
McTemplateU0zq_EventWriteTransfer
NTDLL.DLL::RtlDeleteCriticalSection
NTDLL.DLL::RtlInitializeCriticalSection
WPP_SF_
WPP_SF_L
WPP_SF_SD
WS2_32.DLL::WSACleanup
WS2_32.DLL::WSAStartup
__security_check_cookie
memset
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateEventW
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo
HTTPAPI.DLL::HttpAddUrlToUrlGroup
HTTPAPI.DLL::HttpCloseRequestQueue
HTTPAPI.DLL::HttpCloseServerSession
HTTPAPI.DLL::HttpCloseUrlGroup
HTTPAPI.DLL::HttpCreateRequestQueue
HTTPAPI.DLL::HttpCreateServerSessionHTTPAPI.DLL::HttpCreateUrlGroup
HTTPAPI.DLL::HttpInitialize
HTTPAPI.DLL::HttpSetUrlGroupProperty
HTTPAPI.DLL::HttpTerminate
KpsCreateKpsIo
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsFreeKpsIo
KpsIoLockedRef::RemoveRef
McGenEventWrite_EventWriteTransfer
McTemplateU0zq_EventWriteTransfer
NTDLL.DLL::RtlDeleteCriticalSection
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlInitializeCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_
WPP_SF_L
WPP_SF_SD
WS2_32.DLL::WSACleanup
WS2_32.DLL::WSAStartup
__security_check_cookie
memset
wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled
| |calling|KpsGPCallback
ServiceMain|KpsGPCallback
ServiceMain| |paramcount|0|0| |`address`|180022660|180025658| |sig|ulong __cdecl KpsHttpStart(void)|ulong __cdecl KpsHttpStart(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsHttpStart Called Diff ```diff --- KpsHttpStart called +++ KpsHttpStart called @@ -17,0 +18 @@ +KpsDoHttpReceiveRequest @@ -18,0 +20 @@ +KpsIoLockedRef::RemoveRef @@ -21,0 +24 @@ +NTDLL.DLL::RtlEnterCriticalSection @@ -22,0 +26 @@ +NTDLL.DLL::RtlLeaveCriticalSection @@ -29,0 +34 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled ``` ### KpsHttpStart Diff ```diff --- KpsHttpStart +++ KpsHttpStart @@ -1,247 +1,270 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* unsigned long __cdecl KpsHttpStart(void) */ ulong __cdecl KpsHttpStart(void) { DWORD DVar1; - DWORD DVar2; - undefined8 uVar3; - _KPS_GLOBAL_HTTP_STATE *p_Var4; - _EVENT_DATA_DESCRIPTOR *p_Var5; - undefined2 uVar6; - uint uVar7; - undefined **ppuVar9; + ULONGLONG UVar2; + bool bVar3; + DWORD DVar4; + undefined8 uVar5; + _KPS_GLOBAL_HTTP_STATE *p_Var6; + _EVENT_DATA_DESCRIPTOR *this; + undefined2 uVar7; + uint uVar8; + undefined **ppuVar10; undefined1 auStackY_268 [32]; DWORD local_238 [2]; undefined8 local_230; undefined8 local_228; ulonglong local_220; undefined8 *puStack_218; ulonglong local_210; HANDLE local_208; WSADATA local_1f8; _EVENT_DATA_DESCRIPTOR local_58; DWORD *local_48; undefined8 local_40; ulonglong local_38; - ulonglong uVar8; + ulonglong uVar9; local_38 = __security_cookie ^ (ulonglong)auStackY_268; memset(&local_1f8,0,0x198); - uVar8 = 0; + uVar9 = 0; local_238[0] = 2; local_208 = (HANDLE)0x0; local_220 = 0; puStack_218 = (undefined8 *)0x0; local_230 = 0; local_228 = 0; local_210 = 0; local_58.Ptr = 0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9f, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids); } DAT_0 = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,(LPCWSTR)0x0); if (DAT_0 == (HANDLE)0x0) { - DVar2 = GetLastError(); + DVar4 = GetLastError(); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa0, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); } goto LAB_1; } - DVar2 = RtlInitializeCriticalSection(&DAT_2); - if ((int)DVar2 < 0) { + DVar4 = RtlInitializeCriticalSection(&DAT_2); + if ((int)DVar4 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa1, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); } } else { - _DAT_3 = &DAT_18003bc48; + _DAT_3 = &DAT_18003ec48; DAT_4 = &DAT_4; - DVar2 = WSAStartup(0x202,&local_1f8); + DVar4 = WSAStartup(0x202,&local_1f8); DVar1 = local_238[0]; - if (DVar2 == 0) { - DVar2 = HttpInitialize(local_238[0]); - if (DVar2 == 0) { - DVar2 = HttpCreateServerSession(DVar1,&DAT_5,0); - if (DVar2 == 0) { - DVar2 = HttpCreateRequestQueue(DVar1,0,0,0); - if (DVar2 == 0) { - DVar2 = HttpCreateUrlGroup(DAT_5,&DAT_18003bc08,0); - if (DVar2 == 0) { + if (DVar4 == 0) { + DVar4 = HttpInitialize(local_238[0]); + if (DVar4 == 0) { + DVar4 = HttpCreateServerSession(DVar1,&DAT_5,0); + if (DVar4 == 0) { + DVar4 = HttpCreateRequestQueue(DVar1,0,0,0); + if (DVar4 == 0) { + DVar4 = HttpCreateUrlGroup(DAT_5,&DAT_18003ec08,0); + if (DVar4 == 0) { if (DAT_6 != 0) { do { - uVar3 = DAT_7; - DVar2 = HttpAddUrlToUrlGroup - (DAT_7,*(undefined8 *)(DAT_18003b998 + 8 + uVar8 * 0x10) + uVar5 = DAT_7; + DVar4 = HttpAddUrlToUrlGroup + (DAT_7,*(undefined8 *)(DAT_18003e998 + 8 + uVar9 * 0x10) ,0,0); - if (DVar2 != 0) { + if (DVar4 != 0) { if ((Microsoft_Windows_Kerberos_KdcProxyEnableBits & 1) != 0) { McTemplateU0zq_EventWriteTransfer - (uVar3,(PCEVENT_DESCRIPTOR)&HttpAddUrlFailure, - *(wchar_t **)(DAT_8 + 8 + uVar8 * 0x10),DVar2); + (uVar5,(PCEVENT_DESCRIPTOR)&HttpAddUrlFailure, + *(wchar_t **)(DAT_8 + 8 + uVar9 * 0x10),DVar4); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_SD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa7, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids, - *(wchar_t **)(DAT_8 + 8 + uVar8 * 0x10)); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids, + *(wchar_t **)(DAT_8 + 8 + uVar9 * 0x10)); } goto LAB_9; } - uVar7 = (int)uVar8 + 1; - uVar8 = (ulonglong)uVar7; - } while (uVar7 < DAT_6); + uVar8 = (int)uVar9 + 1; + uVar9 = (ulonglong)uVar8; + } while (uVar8 < DAT_6); } puStack_218 = &local_230; local_220 = local_220 & 0xffffffff; local_230 = CONCAT44(DAT_10,1); - DVar2 = HttpSetUrlGroupProperty(DAT_7,2,&local_220,0x10); - if (DVar2 == 0) { + DVar4 = HttpSetUrlGroupProperty(DAT_7,2,&local_220,0x10); + if (DVar4 == 0) { puStack_218 = &local_228; local_220 = 1; local_228 = CONCAT44(DAT_11,1); - DVar2 = HttpSetUrlGroupProperty(DAT_7,2,&local_220,0x10); - if (DVar2 == 0) { + DVar4 = HttpSetUrlGroupProperty(DAT_7,2,&local_220,0x10); + if (DVar4 == 0) { local_210 = local_210 | 1; local_208 = DAT_12; - DVar2 = HttpSetUrlGroupProperty(DAT_7); - if (DVar2 == 0) { - uVar3 = 0; + DVar4 = HttpSetUrlGroupProperty(DAT_7); + if (DVar4 == 0) { + uVar5 = 0; DAT_13 = CreateThreadpoolIo(DAT_12,KpsHttpIoCompletion,(PVOID)0x0, (PTP_CALLBACK_ENVIRON)&DAT_14); if (DAT_13 == (PTP_IO)0x0) { - DVar2 = GetLastError(); + DVar4 = GetLastError(); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar6 = 0xab; + uVar7 = 0xab; goto LAB_15; } } else { - DVar2 = KpsCreateKpsIo((_KPS_IO **)&local_58); - if (DVar2 == 0) { - p_Var5 = &local_58; - KpsDoHttpReceiveRequest((_KPS_IO **)p_Var5); + DVar4 = KpsCreateKpsIo((_KPS_IO **)&local_58); + if (DVar4 == 0) { + bVar3 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>:: + __private_IsEnabled(( + FeatureImpl<__WilFeatureTraits_Feature_886835513> + *)& + `private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_886835513>::GetImpl(void)' + ::__l2::impl); + if (bVar3) { + RtlEnterCriticalSection((_KPS_IO *)(local_58.Ptr + 0x120)); + this = &local_58; + KpsDoHttpReceiveRequest((KpsIoLockedRef *)this); + UVar2 = local_58.Ptr; + if ((_KPS_IO *)local_58.Ptr != (_KPS_IO *)0x0) { + this = &local_58; + bVar3 = KpsIoLockedRef::RemoveRef((KpsIoLockedRef *)this); + if (!bVar3) { + this = (_EVENT_DATA_DESCRIPTOR *)(UVar2 + 0x120); + RtlLeaveCriticalSection(); + } + } + } + else { + this = &local_58; + KpsDoHttpReceiveRequest((_KPS_IO **)this); + } KpsGlobalHttpState = (_KPS_GLOBAL_HTTP_STATE)0x1; if ((Microsoft_Windows_Kerberos_KdcProxyEnableBits & 8) != 0) { McGenEventWrite_EventWriteTransfer - (p_Var5,(PCEVENT_DESCRIPTOR)&HttpStartSuccess,uVar3,1,&local_58) - ; + (this,(PCEVENT_DESCRIPTOR)&HttpStartSuccess,uVar5,1,&local_58); } if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { if ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xad, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xae, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids); } } return 0; } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xac, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); } if ((_KPS_IO *)local_58.Ptr != (_KPS_IO *)0x0) { KpsFreeKpsIo((_KPS_IO *)local_58.Ptr); } CloseThreadpoolIo(DAT_13); } } else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar6 = 0xaa; + uVar7 = 0xaa; goto LAB_15; } } else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar6 = 0xa9; + uVar7 = 0xa9; goto LAB_15; } } else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar6 = 0xa8; + uVar7 = 0xa8; LAB_15: - WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar6, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); } LAB_9: HttpCloseUrlGroup(DAT_7); } else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa6, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); } HttpCloseRequestQueue(DAT_12); } else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa5, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); } HttpCloseServerSession(DAT_5); } else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa4, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); } HttpTerminate(3); } else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa3, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); } WSACleanup(); } else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa2, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); } RtlDeleteCriticalSection(&DAT_2); } CloseHandle(DAT_0); LAB_1: - ppuVar9 = (undefined **)WPP_GLOBAL_Control; - p_Var4 = &KpsGlobalHttpState; - uVar3 = 0x70; + ppuVar10 = (undefined **)WPP_GLOBAL_Control; + p_Var6 = &KpsGlobalHttpState; + uVar5 = 0x70; memset(&KpsGlobalHttpState,0,0x70); if ((Microsoft_Windows_Kerberos_KdcProxyEnableBits & 1) != 0) { local_48 = local_238; local_40 = 4; - local_238[0] = DVar2; + local_238[0] = DVar4; McGenEventWrite_EventWriteTransfer - (p_Var4,(PCEVENT_DESCRIPTOR)&HttpStartFailure,uVar3,2,&local_58); - ppuVar9 = (undefined **)WPP_GLOBAL_Control; - } - if (ppuVar9 != &WPP_GLOBAL_Control) { - if ((*(byte *)((longlong)ppuVar9 + 0x1c) & 0x10) != 0) { - WPP_SF_L(ppuVar9[2],0xaf,&WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); - ppuVar9 = (undefined **)WPP_GLOBAL_Control; - } - if ((ppuVar9 != &WPP_GLOBAL_Control) && ((*(byte *)((longlong)ppuVar9 + 0x1c) & 0x20) != 0)) { - WPP_SF_L(ppuVar9[2],0xb0,&WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar2); - } - } - return DVar2; + (p_Var6,(PCEVENT_DESCRIPTOR)&HttpStartFailure,uVar5,2,&local_58); + ppuVar10 = (undefined **)WPP_GLOBAL_Control; + } + if (ppuVar10 != &WPP_GLOBAL_Control) { + if ((*(byte *)((longlong)ppuVar10 + 0x1c) & 0x10) != 0) { + WPP_SF_L(ppuVar10[2],0xaf,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); + ppuVar10 = (undefined **)WPP_GLOBAL_Control; + } + if ((ppuVar10 != &WPP_GLOBAL_Control) && ((*(byte *)((longlong)ppuVar10 + 0x1c) & 0x20) != 0)) { + WPP_SF_L(ppuVar10[2],0xb0,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar4); + } + } + return DVar4; } ``` ## KpsHttpIoCompletion ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.16| |i_ratio|0.24| |m_ratio|0.82| |b_ratio|0.67| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsHttpIoCompletion|KpsHttpIoCompletion| |fullname|KpsHttpIoCompletion|KpsHttpIoCompletion| |refcount|3|3| |`length`|607|437| |`called`|
Expand for full list:
KpsCancelTimeoutTimer
KpsFreeKpsIo
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion_Old
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpSendPostResponseIoCompletionKpsHttpSendPostResponseIoCompletion_Old
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion_Old
KpsServiceReady
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_L
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled
|
Expand for full list:
KpsCancelTimeoutTimer
KpsHttpCancelRequestIoCompletion
KpsHttpIoCompletion_Old
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpSendPostResponseIoCompletion
KpsHttpSendResponseIoCompletion
KpsIoLockedRef::RemoveRef
KpsServiceReady
NTDLL.DLL::RtlEnterCriticalSectionNTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_L
wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled
| |calling||| |paramcount|6|6| |`address`|1800206c0|180022590| |sig|void __cdecl KpsHttpIoCompletion(_TP_CALLBACK_INSTANCE * param_1, void * param_2, void * param_3, ulong param_4, __uint64 param_5, _TP_IO * param_6)|void __cdecl KpsHttpIoCompletion(_TP_CALLBACK_INSTANCE * param_1, void * param_2, void * param_3, ulong param_4, __uint64 param_5, _TP_IO * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsHttpIoCompletion Called Diff ```diff --- KpsHttpIoCompletion called +++ KpsHttpIoCompletion called @@ -2 +1,0 @@ -KpsFreeKpsIo @@ -4 +3 @@ -KpsHttpCancelRequestIoCompletion_Old +KpsHttpIoCompletion_Old @@ -6 +4,0 @@ -KpsHttpReceiveClientCertIoCompletion_Old @@ -8 +5,0 @@ -KpsHttpReceiveRequestEntityIoCompletion_Old @@ -10 +6,0 @@ -KpsHttpReceiveRequestIoCompletion_Old @@ -12 +7,0 @@ -KpsHttpSendPostResponseIoCompletion_Old @@ -14 +9 @@ -KpsHttpSendResponseIoCompletion_Old +KpsIoLockedRef::RemoveRef @@ -19 +14 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled +wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled ``` ### KpsHttpIoCompletion Diff ```diff --- KpsHttpIoCompletion +++ KpsHttpIoCompletion @@ -1,131 +1,77 @@ /* void __cdecl KpsHttpIoCompletion(struct _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,void * __ptr64,unsigned long,unsigned __int64,struct _TP_IO * __ptr64) */ void __cdecl KpsHttpIoCompletion(_TP_CALLBACK_INSTANCE *param_1,void *param_2,void *param_3,ulong param_4, __uint64 param_5,_TP_IO *param_6) { int iVar1; bool bVar2; uchar uVar3; - _KPS_IO *local_res18; + FeatureImpl *pFVar4; + _TP_IO *in_stack_ffffffffffffffe0; + _KPS_IO *local_18 [2]; - local_res18 = param_3; - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + pFVar4 = &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_886835513>::GetImpl(void)' + ::__l2::impl; + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_886835513> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_886835513>::GetImpl(void)' ::__l2::impl); if (bVar2) { + local_18[0] = param_3; RtlEnterCriticalSection((longlong)param_3 + 0x120); - } - uVar3 = KpsServiceReady(); - if (uVar3 == '\0') { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x85, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,param_4); + if (*(int *)(local_18[0] + 0x150) != 0) { + KpsCancelTimeoutTimer(local_18[0]); + } + uVar3 = KpsServiceReady(); + if (uVar3 == '\0') { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x105, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_4); + } + } + else { + iVar1 = *(int *)(local_18[0] + 0x20); + if (iVar1 == 1) { + KpsHttpReceiveRequestIoCompletion(param_4,param_5,(KpsIoLockedRef *)local_18); + } + else if (iVar1 == 2) { + KpsHttpReceiveClientCertIoCompletion(param_4,param_5,(KpsIoLockedRef *)local_18); + } + else if (iVar1 == 3) { + KpsHttpSendResponseIoCompletion(param_4,param_5,(KpsIoLockedRef *)local_18); + } + else if (iVar1 == 4) { + KpsHttpSendPostResponseIoCompletion(param_4,param_5,(KpsIoLockedRef *)local_18); + } + else if (iVar1 == 5) { + KpsHttpReceiveRequestEntityIoCompletion(param_4,param_5,(KpsIoLockedRef *)local_18); + } + else if (iVar1 == 7) { + KpsHttpCancelRequestIoCompletion(param_4,param_5,(KpsIoLockedRef *)local_18); + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x106, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar1); + } + } + if (local_18[0] != (_KPS_IO *)0x0) { + bVar2 = KpsIoLockedRef::RemoveRef((KpsIoLockedRef *)local_18); + if (!bVar2) { + RtlLeaveCriticalSection(local_18[0] + 0x120); + } } } else { - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if ((bVar2) && (*(int *)((longlong)param_3 + 0x150) != 0)) { - KpsCancelTimeoutTimer(param_3); - } - iVar1 = *(int *)((longlong)param_3 + 0x20); - if (iVar1 == 1) { - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if (bVar2) { - KpsHttpReceiveRequestIoCompletion(param_4,param_5,&local_res18); - } - else { - KpsHttpReceiveRequestIoCompletion_Old(param_4,param_5,param_3); - } - } - else if (iVar1 == 2) { - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if (bVar2) { - KpsHttpReceiveClientCertIoCompletion(param_4,param_5,&local_res18); - } - else { - KpsHttpReceiveClientCertIoCompletion_Old(param_4,param_5,param_3); - } - } - else if (iVar1 == 3) { - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if (bVar2) { - KpsHttpSendResponseIoCompletion(param_4,param_5,&local_res18); - } - else { - KpsHttpSendResponseIoCompletion_Old(param_4,param_5,param_3); - } - } - else if (iVar1 == 4) { - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if (bVar2) { - KpsHttpSendPostResponseIoCompletion(param_4,param_5,&local_res18); - } - else { - KpsHttpSendPostResponseIoCompletion_Old(param_4,param_5,param_3); - } - } - else if (iVar1 == 5) { - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if (bVar2) { - KpsHttpReceiveRequestEntityIoCompletion(param_4,param_5,&local_res18); - } - else { - KpsHttpReceiveRequestEntityIoCompletion_Old(param_4,param_5,param_3); - } - } - else if (iVar1 == 7) { - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if (bVar2) { - KpsHttpCancelRequestIoCompletion(param_4,param_5,&local_res18); - } - else { - KpsHttpCancelRequestIoCompletion_Old(param_4,param_5,param_3); - } - } - else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x86, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,iVar1); - } - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if ((bVar2) && (local_res18 != (_KPS_IO *)0x0)) { - RtlLeaveCriticalSection(local_res18 + 0x120); - } - local_res18 = (_KPS_IO *)0x0; - } - if (local_res18 != (_KPS_IO *)0x0) { - KpsFreeKpsIo(local_res18); + KpsHttpIoCompletion_Old + ((_TP_CALLBACK_INSTANCE *)pFVar4,param_2,param_3,param_4,param_5, + in_stack_ffffffffffffffe0); } return; } ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,length,address,calling,called| |ratio|0.27| |i_ratio|0.15| |m_ratio|0.6| |b_ratio|0.49| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|__private_IsEnabled|__private_IsEnabled| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled|wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled| |refcount|23|23| |`length`|53|143| |`called`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage|wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |`calling`|KpsCreateKpsIo
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsFreeKpsIo
KpsHttpIoCompletion
KpsSocketIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion|KpsCreateKpsIo
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsFreeKpsIo
KpsHttpIoCompletion_Old
KpsSocketIoCompletion_Old
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion| |paramcount|1|1| |`address`|180026f10|18002a9fc| |sig|bool __thiscall __private_IsEnabled(FeatureImpl<__WilFeatureTraits_Feature_4205429049> * this)|bool __thiscall __private_IsEnabled(FeatureImpl<__WilFeatureTraits_Feature_4205429049> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled Called Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled called +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled called @@ -2 +2 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage +wil::details::ReportUsageToService ``` ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled Calling Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled calling +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled calling @@ -6,2 +6,2 @@ -KpsHttpIoCompletion -KpsSocketIoCompletion +KpsHttpIoCompletion_Old +KpsSocketIoCompletion_Old ``` ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled @@ -1,18 +1,35 @@ /* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ bool __thiscall wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled (FeatureImpl<__WilFeatureTraits_Feature_4205429049> *this) { - ReportingKind in_R8D; - __uint64 in_R9; - undefined1 local_res10; + undefined8 *puVar1; + uint uVar2; + bool bVar3; + undefined4 local_res8; + undefined2 local_resc; + undefined8 local_res10; + wil_ReportingKind in_stack_ffffffffffffffe8; + __uint64 in_stack_fffffffffffffff0; GetCachedFeatureEnabledState(this); - ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); - return (bool)(local_res10 & 1); + uVar2 = *(uint *)this; + bVar3 = (bool)((byte)local_res10 & 1); + if ((uVar2 & 4) == 0) { + puVar1 = (undefined8 *)GetCachedFeatureEnabledState(this); + local_res10 = *puVar1; + uVar2 = (uint)local_res10; + } + local_res8 = 0; + local_resc = 2; + ReportUsageToService + ((wil_details_FeatureReportingCache *)(this + 8),0x32cf420,uVar2 >> 10 & 1, + uVar2 >> 0xb & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)bVar3, + in_stack_ffffffffffffffe8,in_stack_fffffffffffffff0); + return bVar3; } ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.27| |i_ratio|0.15| |m_ratio|0.6| |b_ratio|0.49| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|__private_IsEnabled|__private_IsEnabled| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled| |`refcount`|11|20| |`length`|53|143| |`called`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::ReportUsage|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |`calling`|KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsTimeoutCallback|
Expand for full list:
KpsDoHttpCancelRequest
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsDoHttpSendResponseKpsDoHttpSendResponse
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsTimeoutCallback
| |paramcount|1|1| |`address`|180026ed4|18002a964| |sig|bool __thiscall __private_IsEnabled(FeatureImpl<__WilFeatureTraits_Feature_3749982522> * this)|bool __thiscall __private_IsEnabled(FeatureImpl<__WilFeatureTraits_Feature_3749982522> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled Called Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled called +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled called @@ -2 +2 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::ReportUsage +wil::details::ReportUsageToService ``` ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled Calling Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled calling +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled calling @@ -0,0 +1 @@ +KpsDoHttpCancelRequest @@ -2,0 +4,2 @@ +KpsDoHttpReceiveClientCert +KpsDoHttpReceiveRequest @@ -4,0 +8,2 @@ +KpsDoHttpReceiveRequestEntity +KpsDoHttpSendPostResponse @@ -6,0 +12,2 @@ +KpsDoHttpSendResponse +KpsHttpReceiveClientCertIoCompletion @@ -8,0 +16,2 @@ +KpsHttpReceiveRequestEntityIoCompletion +KpsHttpReceiveRequestIoCompletion ``` ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled @@ -1,18 +1,35 @@ /* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ bool __thiscall wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::__private_IsEnabled (FeatureImpl<__WilFeatureTraits_Feature_3749982522> *this) { - ReportingKind in_R8D; - __uint64 in_R9; - undefined1 local_res10; + undefined8 *puVar1; + uint uVar2; + bool bVar3; + undefined4 local_res8; + undefined2 local_resc; + undefined8 local_res10; + wil_ReportingKind in_stack_ffffffffffffffe8; + __uint64 in_stack_fffffffffffffff0; GetCachedFeatureEnabledState(this); - ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); - return (bool)(local_res10 & 1); + uVar2 = *(uint *)this; + bVar3 = (bool)((byte)local_res10 & 1); + if ((uVar2 & 4) == 0) { + puVar1 = (undefined8 *)GetCachedFeatureEnabledState(this); + local_res10 = *puVar1; + uVar2 = (uint)local_res10; + } + local_res8 = 0; + local_resc = 2; + ReportUsageToService + ((wil_details_FeatureReportingCache *)(this + 8),0x350bfe9,uVar2 >> 10 & 1, + uVar2 >> 0xb & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)bVar3, + in_stack_ffffffffffffffe8,in_stack_fffffffffffffff0); + return bVar3; } ``` ## KpsSocketIoCompletion ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.27| |i_ratio|0.22| |m_ratio|0.97| |b_ratio|0.76| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsSocketIoCompletion|KpsSocketIoCompletion| |fullname|KpsSocketIoCompletion|KpsSocketIoCompletion| |`refcount`|3|4| |`length`|329|356| |`called`|KpsCancelTimeoutTimer
KpsFreeKpsIo
KpsServiceReady
KpsSocketConnectAndSendIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_L
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled|
Expand for full list:
KpsCancelTimeoutTimer
KpsIoLockedRef::RemoveRef
KpsServiceReady
KpsSocketConnectAndSendIoCompletion
KpsSocketIoCompletion_Old
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_L
wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled
| |calling||| |paramcount|6|6| |`address`|1800230e0|180026430| |sig|void __cdecl KpsSocketIoCompletion(_TP_CALLBACK_INSTANCE * param_1, void * param_2, void * param_3, ulong param_4, __uint64 param_5, _TP_IO * param_6)|void __cdecl KpsSocketIoCompletion(_TP_CALLBACK_INSTANCE * param_1, void * param_2, void * param_3, ulong param_4, __uint64 param_5, _TP_IO * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsSocketIoCompletion Called Diff ```diff --- KpsSocketIoCompletion called +++ KpsSocketIoCompletion called @@ -2 +2 @@ -KpsFreeKpsIo +KpsIoLockedRef::RemoveRef @@ -4,0 +5 @@ +KpsSocketIoCompletion_Old @@ -10 +11 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled +wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled ``` ### KpsSocketIoCompletion Diff ```diff --- KpsSocketIoCompletion +++ KpsSocketIoCompletion @@ -1,66 +1,69 @@ /* void __cdecl KpsSocketIoCompletion(struct _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,void * __ptr64,unsigned long,unsigned __int64,struct _TP_IO * __ptr64) */ void __cdecl KpsSocketIoCompletion (_TP_CALLBACK_INSTANCE *param_1,void *param_2,void *param_3,ulong param_4,__uint64 param_5 ,_TP_IO *param_6) { int iVar1; bool bVar2; uchar uVar3; + FeatureImpl *pFVar4; + _TP_IO *in_stack_ffffffffffffffe0; + _KPS_IO *local_18 [2]; - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + pFVar4 = &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_886835513>::GetImpl(void)' + ::__l2::impl; + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_886835513> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_886835513>::GetImpl(void)' ::__l2::impl); if (bVar2) { + local_18[0] = param_3; RtlEnterCriticalSection((longlong)param_3 + 0x120); - } - uVar3 = KpsServiceReady(); - if (uVar3 == '\0') { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x97, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,param_4); + if (*(int *)(local_18[0] + 0x150) != 0) { + KpsCancelTimeoutTimer(local_18[0]); } - if (param_3 != (void *)0x0) { - KpsFreeKpsIo(param_3); + uVar3 = KpsServiceReady(); + if (uVar3 == '\0') { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x116, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_4); + } + } + else { + iVar1 = *(int *)(local_18[0] + 0x20); + if (iVar1 == 8) { + KpsSocketConnectAndSendIoCompletion(param_4,param_5,(KpsIoLockedRef *)local_18); + } + else if (iVar1 == 9) { + KpsSocketRecvDataLengthIoCompletion(param_4,param_5,(KpsIoLockedRef *)local_18); + } + else if (iVar1 == 10) { + KpsSocketRecvDataIoCompletion(param_4,param_5,(KpsIoLockedRef *)local_18); + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x117, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar1); + } + } + if (local_18[0] != (_KPS_IO *)0x0) { + bVar2 = KpsIoLockedRef::RemoveRef((KpsIoLockedRef *)local_18); + if (!bVar2) { + RtlLeaveCriticalSection(local_18[0] + 0x120); + } } } else { - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if ((bVar2) && (*(int *)((longlong)param_3 + 0x150) != 0)) { - KpsCancelTimeoutTimer(param_3); - } - iVar1 = *(int *)((longlong)param_3 + 0x20); - if (iVar1 == 8) { - KpsSocketConnectAndSendIoCompletion(param_4,param_5,param_3); - } - else if (iVar1 == 9) { - KpsSocketRecvDataLengthIoCompletion(param_4,param_5,param_3); - } - else if (iVar1 == 10) { - KpsSocketRecvDataIoCompletion(param_4,param_5,param_3); - } - else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x98, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,iVar1); - } - bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if (bVar2) { - RtlLeaveCriticalSection((longlong)param_3 + 0x120); - } + KpsSocketIoCompletion_Old + ((_TP_CALLBACK_INSTANCE *)pFVar4,param_2,param_3,param_4,param_5, + in_stack_ffffffffffffffe0); } return; } ``` ## KpsCreateKpsIo ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.89| |i_ratio|0.58| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsCreateKpsIo|KpsCreateKpsIo| |fullname|KpsCreateKpsIo|KpsCreateKpsIo| |`refcount`|4|5| |`length`|513|540| |`called`|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolWait
KpsAllocMem
KpsFreeKpsIo
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlInitializeCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_
WPP_SF_Dsd
WPP_SF_L
WPP_SF_q
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled
|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolWait
KpsAllocMem
KpsFreeKpsIo
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlInitializeCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_
WPP_SF_Dsd
WPP_SF_L
WPP_SF_q
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabledwil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled
| |`calling`|KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpStart|KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpStart| |paramcount|1|1| |`address`|18001e6c0|18001e860| |sig|ulong __cdecl KpsCreateKpsIo(_KPS_IO * * param_1)|ulong __cdecl KpsCreateKpsIo(_KPS_IO * * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsCreateKpsIo Called Diff ```diff --- KpsCreateKpsIo called +++ KpsCreateKpsIo called @@ -11,0 +12 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled ``` ### KpsCreateKpsIo Calling Diff ```diff --- KpsCreateKpsIo calling +++ KpsCreateKpsIo calling @@ -0,0 +1 @@ +KpsHttpReceiveRequestIoCompletion ``` ### KpsCreateKpsIo Diff ```diff --- KpsCreateKpsIo +++ KpsCreateKpsIo @@ -1,99 +1,106 @@ /* unsigned long __cdecl KpsCreateKpsIo(struct _KPS_IO * __ptr64 * __ptr64) */ ulong __cdecl KpsCreateKpsIo(_KPS_IO **param_1) { _KPS_IO *p_Var1; undefined8 uVar2; code *pcVar3; bool bVar4; _KPS_IO *pv; PTP_WAIT p_Var5; undefined1 *puVar6; undefined1 *puVar7; ulong uVar8; undefined1 auStackY_38 [8]; undefined1 auStackY_30 [24]; puVar6 = auStackY_38; uVar8 = 0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids); } - pv = KpsAllocMem(0x158); + pv = KpsAllocMem(0x160); if (pv == (_KPS_IO *)0x0) { uVar8 = 8; if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return 8; } puVar7 = auStackY_38; if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,8, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,8, "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); puVar7 = auStackY_38; } goto LAB_0; } *(undefined8 *)(pv + 0xd8) = 0xffffffffffffffff; bVar4 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' ::__l2::impl); if (bVar4) { p_Var1 = pv + 0x120; RtlInitializeCriticalSection(p_Var1); RtlEnterCriticalSection(p_Var1); p_Var5 = CreateThreadpoolWait(KpsTimeoutCallback,pv,(PTP_CALLBACK_ENVIRON)&DAT_1); *(PTP_WAIT *)(pv + 0x148) = p_Var5; if (p_Var5 != (PTP_WAIT)0x0) { + bVar4 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_886835513> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_886835513>::GetImpl(void)' + ::__l2::impl); + if (bVar4) { + *(undefined8 *)(pv + 0x158) = 1; + } *(undefined4 *)(pv + 0x150) = 0; RtlLeaveCriticalSection(p_Var1); goto LAB_2; } } else { LAB_2: RtlEnterCriticalSection(&DAT_3); p_Var1 = pv + 0x28; if ((_KPS_IO **)*(undefined8 **)(DAT_4 + 8) == &DAT_4) { *(_KPS_IO **)p_Var1 = DAT_4; *(_KPS_IO ***)(pv + 0x30) = &DAT_4; *(_KPS_IO **)(DAT_4 + 8) = p_Var1; DAT_4 = p_Var1; RtlLeaveCriticalSection(&DAT_3); LOCK(); DAT_5 = DAT_5 + 1; UNLOCK(); *param_1 = pv; if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return 0; } puVar7 = auStackY_38; if ((WPP_GLOBAL_Control[0x1c] & 4) != 0) { WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,pv); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,pv); puVar7 = auStackY_38; } goto LAB_0; } pcVar3 = (code *)swi(0x29); (*pcVar3)(3); puVar6 = auStackY_30; } - *(undefined8 *)(puVar6 + -8) = 0x18001e81e; + *(undefined8 *)(puVar6 + -8) = 0x18001e9d9; KpsFreeKpsIo(pv); puVar7 = puVar6; LAB_0: if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { uVar2 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); - *(undefined8 *)(puVar7 + -8) = 0x18001e8a4; - WPP_SF_L(uVar2,0xf,&WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,uVar8); + *(undefined8 *)(puVar7 + -8) = 0x18001ea5f; + WPP_SF_L(uVar2,0xf,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,uVar8); } return uVar8; } ``` ## WPP_SF_LZ ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.69| |i_ratio|0.42| |m_ratio|1.0| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WPP_SF_LZ|WPP_SF_LZ| |fullname|WPP_SF_LZ|WPP_SF_LZ| |`refcount`|2|3| |`length`|151|152| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |`calling`|KpsDoSocketConnectAndSend|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend| |paramcount|5|5| |`address`|1800275ac|18002b22c| |`sig`|undefined __fastcall WPP_SF_LZ(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4, wchar_t * param_5)|undefined __fastcall WPP_SF_LZ(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4, wchar_t * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_LZ Calling Diff ```diff --- WPP_SF_LZ calling +++ WPP_SF_LZ calling @@ -1,0 +2 @@ +KpsDoSocketConnectAndSend ``` ### WPP_SF_LZ Diff ```diff --- WPP_SF_LZ +++ WPP_SF_LZ @@ -1,30 +1,30 @@ -void WPP_SF_LZ(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined4 param_4, +void WPP_SF_LZ(undefined8 param_1,undefined2 param_2,undefined8 param_3,undefined4 param_4, wchar_t *param_5) { - wchar_t wVar1; - wchar_t *pwVar2; + wchar_t *pwVar1; + wchar_t wVar2; undefined4 local_res20 [2]; if (param_5 == (wchar_t *)0x0) { - wVar1 = L'\b'; + wVar2 = L'\b'; } else { - wVar1 = *param_5; + wVar2 = *param_5; if (*param_5 != L'\0') { - pwVar2 = *(wchar_t **)(param_5 + 4); + pwVar1 = *(wchar_t **)(param_5 + 4); goto LAB_0; } } - pwVar2 = L"NULL"; + pwVar1 = L"NULL"; LAB_0: if (param_5 == (wchar_t *)0x0) { param_5 = L"\b"; } local_res20[0] = param_4; - TraceMessage(param_1,0x2b,&WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,0x27,local_res20,4, - param_5,2,pwVar2,wVar1,0); + TraceMessage(param_1,0x2b,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_2,local_res20,4, + param_5,2,pwVar1,wVar2,0); return; } ``` ## KpsDoSocketConnectAndSend ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.58| |i_ratio|0.5| |m_ratio|0.97| |b_ratio|0.82| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsDoSocketConnectAndSend|KpsDoSocketConnectAndSend| |fullname|KpsDoSocketConnectAndSend|KpsDoSocketConnectAndSend| |refcount|4|4| |`length`|1719|1615| |`called`|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
KpsDoHttpCancelRequest
KpsDoSocketConnectAndSend
KpsForwardKerbRequest
KpsServiceReady
KpsStartTimeoutTimer
McGenEventWrite_EventWriteTransferNTDLL.DLL::RtlFreeUnicodeString
WPP_SF_Dsd
WPP_SF_L
WPP_SF_LZ
WPP_SF_ZDsd
WPP_SF_q
WS2_32.DLL::FreeAddrInfoW
WS2_32.DLL::WSAGetLastError
WS2_32.DLL::WSAIoctl
WS2_32.DLL::bind
WS2_32.DLL::closesocket
WS2_32.DLL::htons
WS2_32.DLL::socket
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
memset
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
KpsDoHttpCancelRequest
KpsDoSocketConnectAndSend
KpsForwardKerbRequest
KpsServiceReady
KpsStartTimeoutTimer
McTemplateU0qz_EventWriteTransferNTDLL.DLL::RtlFreeUnicodeString
WPP_SF_Dsd
WPP_SF_L
WPP_SF_LZ
WPP_SF_ZDsd
WPP_SF_q
WS2_32.DLL::FreeAddrInfoW
WS2_32.DLL::WSAGetLastError
WS2_32.DLL::WSAIoctl
WS2_32.DLL::bind
WS2_32.DLL::closesocket
WS2_32.DLL::htons
WS2_32.DLL::socket
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
memset
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled
| |calling|KpsDoSocketConnectAndSend
KpsForwardKerbRequest
KpsSocketConnectAndSendIoCompletion|KpsDoSocketConnectAndSend
KpsForwardKerbRequest
KpsSocketConnectAndSendIoCompletion| |paramcount|1|1| |`address`|18001f544|180020c94| |sig|void __cdecl KpsDoSocketConnectAndSend(_KPS_IO * * param_1)|void __cdecl KpsDoSocketConnectAndSend(_KPS_IO * * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsDoSocketConnectAndSend Called Diff ```diff --- KpsDoSocketConnectAndSend called +++ KpsDoSocketConnectAndSend called @@ -11 +11 @@ -McGenEventWrite_EventWriteTransfer +McTemplateU0qz_EventWriteTransfer ``` ### KpsDoSocketConnectAndSend Diff ```diff --- KpsDoSocketConnectAndSend +++ KpsDoSocketConnectAndSend @@ -1,249 +1,224 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* void __cdecl KpsDoSocketConnectAndSend(struct _KPS_IO * __ptr64 * __ptr64) */ void __cdecl KpsDoSocketConnectAndSend(_KPS_IO **param_1) { _KPS_IO *p_Var1; - uchar uVar2; - bool bVar3; - DWORD DVar4; - int iVar5; - longlong lVar6; + longlong lVar2; + uchar uVar3; + bool bVar4; + DWORD DVar5; + int iVar6; SOCKET SVar7; PTP_IO p_Var8; undefined2 uVar9; - undefined *puVar10; + undefined8 uVar10; int namelen; undefined *puVar11; - undefined1 auStackY_158 [32]; - undefined8 in_stack_fffffffffffffec8; + undefined1 auStackY_128 [32]; + undefined8 in_stack_fffffffffffffef8; undefined4 uVar12; - undefined4 local_108 [2]; - undefined4 local_100; - undefined4 local_f8; - undefined4 local_f4; - undefined4 local_f0; - undefined4 local_ec; - sockaddr local_e8; - undefined8 uStack_d8; undefined4 local_d0; - _EVENT_DATA_DESCRIPTOR local_68; - undefined4 *local_58; - undefined8 local_50; - wchar_t *local_48; - int local_40; - undefined4 local_3c; + undefined4 local_cc; + undefined4 local_c8; + undefined4 local_c4; + sockaddr local_b8; + undefined8 uStack_a8; + undefined4 local_a0; ulonglong local_38; - uVar12 = (undefined4)((ulonglong)in_stack_fffffffffffffec8 >> 0x20); - local_38 = __security_cookie ^ (ulonglong)auStackY_158; - local_f8 = 0x25a207b9; - local_100 = 0; - local_f4 = 0x4660ddf3; - local_f0 = 0xe576e98e; + uVar12 = (undefined4)((ulonglong)in_stack_fffffffffffffef8 >> 0x20); + local_38 = __security_cookie ^ (ulonglong)auStackY_128; + local_d0 = 0x25a207b9; + local_cc = 0x4660ddf3; + local_c8 = 0xe576e98e; puVar11 = (undefined *)0x80; - local_ec = 0x3e06748c; - memset(&local_e8,0,0x80); + local_c4 = 0x3e06748c; + memset(&local_b8,0,0x80); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - puVar11 = &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids; + puVar11 = &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids; WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x26, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,*param_1); - } - uVar2 = KpsServiceReady(); - DVar4 = 0; - if (uVar2 != '\0') { + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,*param_1); + } + uVar3 = KpsServiceReady(); + DVar5 = 0; + if (uVar3 != '\0') { p_Var1 = *param_1; - puVar10 = (undefined *)0x2; - lVar6 = *(longlong *)(p_Var1 + 0xd0); - while (((lVar6 != 0 && (lVar6 = *(longlong *)(p_Var1 + 0xd0), *(int *)(lVar6 + 4) != 0x17)) && - (*(int *)(lVar6 + 4) != 2))) { - *(undefined8 *)(p_Var1 + 0xd0) = *(undefined8 *)(lVar6 + 0x28); + uVar10 = 2; + lVar2 = *(longlong *)(p_Var1 + 0xd0); + while (((lVar2 != 0 && (lVar2 = *(longlong *)(p_Var1 + 0xd0), *(int *)(lVar2 + 4) != 0x17)) && + (*(int *)(lVar2 + 4) != 2))) { + *(undefined8 *)(p_Var1 + 0xd0) = *(undefined8 *)(lVar2 + 0x28); p_Var1 = *param_1; - lVar6 = *(longlong *)(p_Var1 + 0xd0); - } - lVar6 = *(longlong *)(p_Var1 + 0xd0); - DVar4 = 0; - if (lVar6 == 0) { + lVar2 = *(longlong *)(p_Var1 + 0xd0); + } + lVar2 = *(longlong *)(p_Var1 + 0xd0); + DVar5 = 0; + if (lVar2 == 0) { if (*(uint *)(p_Var1 + 0xf0) < DAT_0) { RtlFreeUnicodeString(p_Var1 + 0xb8); if (*(longlong *)(*param_1 + 200) != 0) { FreeAddrInfoW(); *(undefined8 *)(*param_1 + 200) = 0; } if (*(SOCKET *)(*param_1 + 0xd8) != 0xffffffffffffffff) { closesocket(*(SOCKET *)(*param_1 + 0xd8)); *(undefined8 *)(*param_1 + 0xd8) = 0xffffffffffffffff; } - if (*(PTP_IO *)(*param_1 + 0xe0) != (PTP_IO)0x0) { - CloseThreadpoolIo(*(PTP_IO *)(*param_1 + 0xe0)); + p_Var8 = *(PTP_IO *)(*param_1 + 0xe0); + if (p_Var8 != (PTP_IO)0x0) { + CloseThreadpoolIo(p_Var8); *(undefined8 *)(*param_1 + 0xe0) = 0; } *(int *)(*param_1 + 0xf0) = *(int *)(*param_1 + 0xf0) + 1; if ((Microsoft_Windows_Kerberos_KdcProxyEnableBits & 4) != 0) { - local_50 = 4; - local_48 = *(wchar_t **)(*param_1 + 0x78); - local_108[0] = *(undefined4 *)(*param_1 + 0xf0); - local_58 = local_108; - if (local_48 == (wchar_t *)0x0) { - local_40 = 10; - local_48 = L"NULL"; - } - else { - lVar6 = -1; - do { - lVar6 = lVar6 + 1; - } while (local_48[lVar6] != L'\0'); - local_40 = (int)lVar6 * 2 + 2; - } - puVar10 = &RetryKdcConnection; - local_3c = 0; - McGenEventWrite_EventWriteTransfer - (local_48,(PCEVENT_DESCRIPTOR)&RetryKdcConnection,puVar11,3,&local_68); + puVar11 = (undefined *)(ulonglong)*(uint *)(*param_1 + 0xf0); + McTemplateU0qz_EventWriteTransfer(p_Var8,uVar10,puVar11,*(wchar_t **)(*param_1 + 0x78)); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - WPP_SF_LZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),puVar10,puVar11, + WPP_SF_LZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x27,puVar11, *(undefined4 *)(*param_1 + 0xf0),(wchar_t *)(*param_1 + 0x70)); } KpsForwardKerbRequest(param_1); } else { - DVar4 = 0x490; + DVar5 = 0x490; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 1) != 0)) { WPP_SF_ZDsd(*(undefined **)((longlong)WPP_GLOBAL_Control + 0x10),0x28, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,(wchar_t *)(p_Var1 + 0xb8), + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,(wchar_t *)(p_Var1 + 0xb8), CONCAT44(uVar12,0x490),"ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); - DVar4 = 0x490; + DVar5 = 0x490; } } } else { - SVar7 = socket(*(int *)(lVar6 + 4),*(int *)(lVar6 + 8),6); + SVar7 = socket(*(int *)(lVar2 + 4),*(int *)(lVar2 + 8),6); *(SOCKET *)(*param_1 + 0xd8) = SVar7; if (*(longlong *)(*param_1 + 0xd8) == -1) { - DVar4 = WSAGetLastError(); + DVar5 = WSAGetLastError(); if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; uVar9 = 0x29; } else { namelen = 0x10; - iVar5 = WSAIoctl(*(longlong *)(*param_1 + 0xd8),0xc8000006,&local_f8,0x10); - if (iVar5 == 0) { + iVar6 = WSAIoctl(*(longlong *)(*param_1 + 0xd8),0xc8000006,&local_d0,0x10); + if (iVar6 == 0) { p_Var8 = CreateThreadpoolIo(*(HANDLE *)(*param_1 + 0xd8),KpsSocketIoCompletion,(PVOID)0x0, (PTP_CALLBACK_ENVIRON)&DAT_2); *(PTP_IO *)(*param_1 + 0xe0) = p_Var8; if (*(longlong *)(*param_1 + 0xe0) == 0) { - DVar4 = GetLastError(); + DVar5 = GetLastError(); if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; uVar9 = 0x2b; } else { - local_e8.sa_data[2] = '\0'; - local_e8.sa_data[3] = '\0'; - local_e8.sa_data[4] = '\0'; - local_e8.sa_data[5] = '\0'; + local_b8.sa_data[2] = '\0'; + local_b8.sa_data[3] = '\0'; + local_b8.sa_data[4] = '\0'; + local_b8.sa_data[5] = '\0'; if (*(short *)(*(longlong *)(*param_1 + 0xd0) + 4) == 0x17) { - local_e8.sa_family = 0x17; - uStack_d8 = 0; - local_d0 = 0; + local_b8.sa_family = 0x17; + uStack_a8 = 0; + local_a0 = 0; } else { - local_e8.sa_family = 2; - } - local_e8.sa_data[6] = '\0'; - local_e8.sa_data[7] = '\0'; - local_e8.sa_data[8] = '\0'; - local_e8.sa_data[9] = '\0'; - local_e8.sa_data[10] = '\0'; - local_e8.sa_data[0xb] = '\0'; - local_e8.sa_data[0xc] = '\0'; - local_e8.sa_data[0xd] = '\0'; - local_e8.sa_data._0_2_ = htons(0); - if (local_e8.sa_family == 0x17) { + local_b8.sa_family = 2; + } + local_b8.sa_data[6] = '\0'; + local_b8.sa_data[7] = '\0'; + local_b8.sa_data[8] = '\0'; + local_b8.sa_data[9] = '\0'; + local_b8.sa_data[10] = '\0'; + local_b8.sa_data[0xb] = '\0'; + local_b8.sa_data[0xc] = '\0'; + local_b8.sa_data[0xd] = '\0'; + local_b8.sa_data._0_2_ = htons(0); + if (local_b8.sa_family == 0x17) { namelen = 0x1c; } - iVar5 = bind(*(SOCKET *)(*param_1 + 0xd8),&local_e8,namelen); - if (iVar5 == 0) { + iVar6 = bind(*(SOCKET *)(*param_1 + 0xd8),&local_b8,namelen); + if (iVar6 == 0) { *(undefined4 *)(*param_1 + 0x20) = 8; StartThreadpoolIo(*(PTP_IO *)(*param_1 + 0xe0)); p_Var1 = *param_1; - iVar5 = (**(code **)(p_Var1 + 0xe8)) + iVar6 = (**(code **)(p_Var1 + 0xe8)) (*(undefined8 *)(p_Var1 + 0xd8), *(undefined8 *)(*(longlong *)(p_Var1 + 0xd0) + 0x20), *(undefined4 *)(*(longlong *)(p_Var1 + 0xd0) + 0x10), *(undefined8 *)(*(longlong *)(p_Var1 + 0x68) + 0x10)); - if ((iVar5 != 0) || (iVar5 = WSAGetLastError(), iVar5 == 0x3e5)) { - bVar3 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>:: + if ((iVar6 != 0) || (iVar6 = WSAGetLastError(), iVar6 == 0x3e5)) { + bVar4 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>:: __private_IsEnabled((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' ::__l2::impl); - if (bVar3) { + if (bVar4) { p_Var1 = *param_1; KpsStartTimeoutTimer(p_Var1); *(undefined4 *)(p_Var1 + 0x150) = 1; } *param_1 = (_KPS_IO *)0x0; goto LAB_1; } CancelThreadpoolIo(*(PTP_IO *)(*param_1 + 0xe0)); - DVar4 = WSAGetLastError(); + DVar5 = WSAGetLastError(); if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; uVar9 = 0x2d; } else { - DVar4 = WSAGetLastError(); + DVar5 = WSAGetLastError(); if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; uVar9 = 0x2c; } } } else { - DVar4 = WSAGetLastError(); + DVar5 = WSAGetLastError(); if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; uVar9 = 0x2a; } } WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar9, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar4, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar5, "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); } } LAB_1: if (*param_1 != (_KPS_IO *)0x0) { - uVar2 = KpsServiceReady(); - if ((uVar2 == '\0') || (*(longlong *)(*param_1 + 0xd0) == 0)) { + uVar3 = KpsServiceReady(); + if ((uVar3 == '\0') || (*(longlong *)(*param_1 + 0xd0) == 0)) { KpsDoHttpCancelRequest(param_1); } else { SVar7 = *(SOCKET *)(*param_1 + 0xd8); if (SVar7 != 0xffffffffffffffff) { closesocket(SVar7); *(undefined8 *)(*param_1 + 0xd8) = 0xffffffffffffffff; } if (*(PTP_IO *)(*param_1 + 0xe0) != (PTP_IO)0x0) { CloseThreadpoolIo(*(PTP_IO *)(*param_1 + 0xe0)); *(undefined8 *)(*param_1 + 0xe0) = 0; } *(undefined8 *)(*param_1 + 0xd0) = *(undefined8 *)(*(longlong *)(*param_1 + 0xd0) + 0x28); KpsDoSocketConnectAndSend(param_1); } } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2e, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,DVar4); + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,DVar5); } return; } ``` ## WPP_SF_qds ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.94| |i_ratio|0.72| |m_ratio|1.0| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WPP_SF_qds|WPP_SF_qds| |fullname|WPP_SF_qds|WPP_SF_qds| |`refcount`|2|3| |`length`|132|131| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |`calling`|KpsDoHttpSendResponse|KpsDoHttpSendResponse
KpsDoHttpSendResponse| |paramcount|4|4| |`address`|180027950|18002b5d0| |`sig`|undefined __fastcall WPP_SF_qds(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_qds(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_qds Calling Diff ```diff --- WPP_SF_qds calling +++ WPP_SF_qds calling @@ -1,0 +2 @@ +KpsDoHttpSendResponse ``` ### WPP_SF_qds Diff ```diff --- WPP_SF_qds +++ WPP_SF_qds @@ -1,21 +1,21 @@ -void WPP_SF_qds(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4) +void WPP_SF_qds(undefined8 param_1,undefined2 param_2,undefined8 param_3,undefined8 param_4) { longlong lVar1; longlong lVar2; undefined8 local_res20; undefined4 local_18 [6]; local_18[0] = 0x193; lVar1 = -1; do { lVar2 = lVar1; lVar1 = lVar2 + 1; } while ("blocked by KPSSVC policies"[lVar2 + 1] != '\0'); local_res20 = param_4; - TraceMessage(param_1,0x2b,&WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,0x18,&local_res20,8, + TraceMessage(param_1,0x2b,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_2,&local_res20,8, local_18,4,"blocked by KPSSVC policies",lVar2 + 2,0); return; } ``` ## KpsSocketRecvDataLengthIoCompletion ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.29| |i_ratio|0.27| |m_ratio|0.93| |b_ratio|0.82| |match_types|Implied Match| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsSocketRecvDataLengthIoCompletion|KpsSocketRecvDataLengthIoCompletion| |fullname|KpsSocketRecvDataLengthIoCompletion|KpsSocketRecvDataLengthIoCompletion| |refcount|2|2| |`length`|651|727| |`called`|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
KpsDoHttpCancelRequest
KpsDoSocketRecvData
KpsStartTimeoutTimer
WPP_SF_DILL
WPP_SF_Dsd
WPP_SF_L
WPP_SF_qDI
WS2_32.DLL::WSAGetLastError
WS2_32.DLL::WSARecvwil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled
|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
KpsDoHttpCancelRequest
KpsDoSocketRecvData
KpsIoLockedRef::RemoveRef
KpsStartTimeoutTimer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_DILL
WPP_SF_Dsd
WPP_SF_L
WPP_SF_qDIWS2_32.DLL::WSAGetLastError
WS2_32.DLL::WSARecv
| |calling|KpsSocketIoCompletion|KpsSocketIoCompletion| |paramcount|3|3| |`address`|180023564|180026d74| |`sig`|void __cdecl KpsSocketRecvDataLengthIoCompletion(ulong param_1, __uint64 param_2, _KPS_IO * param_3)|void __cdecl KpsSocketRecvDataLengthIoCompletion(ulong param_1, __uint64 param_2, KpsIoLockedRef * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsSocketRecvDataLengthIoCompletion Called Diff ```diff --- KpsSocketRecvDataLengthIoCompletion called +++ KpsSocketRecvDataLengthIoCompletion called @@ -4,0 +5 @@ +KpsIoLockedRef::RemoveRef @@ -5,0 +7 @@ +NTDLL.DLL::RtlLeaveCriticalSection @@ -12 +13,0 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled ``` ### KpsSocketRecvDataLengthIoCompletion Diff ```diff --- KpsSocketRecvDataLengthIoCompletion +++ KpsSocketRecvDataLengthIoCompletion @@ -1,93 +1,133 @@ -/* void __cdecl KpsSocketRecvDataLengthIoCompletion(unsigned long,unsigned __int64,struct _KPS_IO * - __ptr64) */ +/* void __cdecl KpsSocketRecvDataLengthIoCompletion(unsigned long,unsigned __int64,class + KpsIoLockedRef & __ptr64) */ -void __cdecl KpsSocketRecvDataLengthIoCompletion(ulong param_1,__uint64 param_2,_KPS_IO *param_3) +void __cdecl +KpsSocketRecvDataLengthIoCompletion(ulong param_1,__uint64 param_2,KpsIoLockedRef *param_3) { - bool bVar1; - int iVar2; - ulong uVar3; - int iVar4; - undefined4 local_res8 [2]; - _KPS_IO *local_res18; - undefined8 local_28; - longlong lStack_20; + longlong *plVar1; + longlong lVar2; + PTP_IO pio; + _KPS_IO *p_Var3; + undefined8 uVar4; + code *pcVar5; + bool bVar6; + int iVar7; + undefined1 *puVar8; + undefined1 auStackY_68 [8]; + undefined1 auStackY_60 [24]; - uVar3 = 0; - local_res8[0] = 0; - local_28 = 0; - lStack_20 = 0; - local_res18 = param_3; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8b,param_3,param_3); + WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10b,param_3,*(undefined8 *)param_3); } if (param_1 == 0) { - iVar2 = *(int *)(param_3 + 0x10c); - if (param_2 < (uint)(iVar2 - *(int *)(param_3 + 0x108))) { + lVar2 = *(longlong *)param_3; + if (param_2 < (uint)(*(int *)(lVar2 + 0x10c) - *(int *)(lVar2 + 0x108))) { if (param_2 == 0) { - uVar3 = 0x2c3; + puVar8 = auStackY_68; + param_1 = 0x2c3; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_DILL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8d); - uVar3 = 0x2c3; + (puVar8 = auStackY_68, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_DILL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10d); + puVar8 = auStackY_68; + param_1 = 0x2c3; } } else { - iVar4 = *(int *)(param_3 + 0x108) + (int)param_2; - *(int *)(param_3 + 0x108) = iVar4; - local_28 = CONCAT44(local_28._4_4_,iVar2 - iVar4); - lStack_20 = (ulonglong)*(uint *)(param_3 + 0x108) + *(longlong *)(param_3 + 0x100); - *(undefined4 *)(param_3 + 0x20) = 9; - StartThreadpoolIo(*(PTP_IO *)(param_3 + 0xe0)); - iVar2 = WSARecv(*(undefined8 *)(param_3 + 0xd8),&local_28,1,0,local_res8,param_3,0); - if ((iVar2 != -1) || (iVar2 = WSAGetLastError(), iVar2 == 0x3e5)) { - bVar1 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>:: - __private_IsEnabled((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if (bVar1) { - KpsStartTimeoutTimer(param_3); - *(undefined4 *)(param_3 + 0x150) = 1; + *(int *)(lVar2 + 0x108) = *(int *)(lVar2 + 0x108) + (int)param_2; + *(undefined4 *)(*(longlong *)param_3 + 0x20) = 9; + StartThreadpoolIo(*(PTP_IO *)(*(longlong *)param_3 + 0xe0)); + puVar8 = auStackY_68; + if (*(longlong *)param_3 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_3 + 0x158); + lVar2 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar8 = auStackY_68; + if (lVar2 + 1 < 2) { + pcVar5 = (code *)swi(0x29); + (*pcVar5)(0xe); + puVar8 = auStackY_60; } - goto LAB_0; } - CancelThreadpoolIo(*(PTP_IO *)(param_3 + 0xe0)); - uVar3 = WSAGetLastError(); - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8e, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,uVar3, - "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + lVar2 = *(longlong *)param_3; + *(undefined8 *)(puVar8 + 0x30) = 0; + *(longlong *)(puVar8 + 0x28) = lVar2; + *(undefined1 **)(puVar8 + 0x20) = puVar8 + 0x70; + uVar4 = *(undefined8 *)(lVar2 + 0xd8); + *(undefined8 *)(puVar8 + -8) = 0x180026f1e; + iVar7 = WSARecv(uVar4,puVar8 + 0x40,1); + if (iVar7 == -1) { + *(undefined8 *)(puVar8 + -8) = 0x180026f2f; + iVar7 = WSAGetLastError(); + if (iVar7 != 0x3e5) { + pio = *(PTP_IO *)(*(longlong *)param_3 + 0xe0); + *(undefined8 *)(puVar8 + -8) = 0x180026f4c; + CancelThreadpoolIo(pio); + *(undefined8 *)(puVar8 + -8) = 0x180026f58; + param_1 = WSAGetLastError(); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar8 + 0x28) = 0x12cb; + *(char **)(puVar8 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar8 + -8) = 0x180026f9d; + WPP_SF_Dsd(uVar4,0x10e,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + *(char **)(puVar8 + 0x20)); + } + *(undefined8 *)(puVar8 + -8) = 0x180026fa5; + KpsIoLockedRef::RemoveRef(param_3); + goto LAB_0; + } + } + p_Var3 = *(_KPS_IO **)param_3; + *(undefined8 *)(puVar8 + -8) = 0x180026fb2; + KpsStartTimeoutTimer(p_Var3); + *(undefined4 *)(p_Var3 + 0x150) = 1; + param_1 = 0; + if (*(longlong *)param_3 != 0) { + *(undefined8 *)(puVar8 + -8) = 0x180026fc9; + bVar6 = KpsIoLockedRef::RemoveRef(param_3); + if (!bVar6) { + lVar2 = *(longlong *)param_3; + *(undefined8 *)(puVar8 + -8) = 0x180026fde; + RtlLeaveCriticalSection(lVar2 + 0x120); + } + *(undefined8 *)param_3 = 0; } } } else { - *(int *)(param_3 + 0x108) = iVar2; - KpsDoSocketRecvData(&local_res18); - param_3 = local_res18; - uVar3 = 0; + *(int *)(lVar2 + 0x108) = *(int *)(lVar2 + 0x10c); + KpsDoSocketRecvData(param_3); + puVar8 = auStackY_68; + param_1 = 0; } } else { - uVar3 = param_1; + puVar8 = auStackY_68; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8c, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,param_1, + (puVar8 = auStackY_68, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10c, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar8 = auStackY_68; } } - if (param_3 != (_KPS_IO *)0x0) { - KpsDoHttpCancelRequest(&local_res18); +LAB_0: + if (*(longlong *)param_3 != 0) { + *(undefined8 *)(puVar8 + -8) = 0x18002700c; + KpsDoHttpCancelRequest(param_3); } -LAB_0: if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8f, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,uVar3); + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar8 + -8) = 0x180027036; + WPP_SF_L(uVar4,0x10f,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1); } return; } ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.14| |i_ratio|0.25| |m_ratio|0.49| |b_ratio|0.34| |match_types|Implied Match| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |`name`|__private_IsEnabled|RemoveRef| |`fullname`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled|KpsIoLockedRef::RemoveRef| |`refcount`|23|37| |`length`|53|174| |`called`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage|KpsFreeKpsIo
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection| |`calling`|KpsCreateKpsIo
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsFreeKpsIo
KpsHttpIoCompletion
KpsSocketIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion|
Expand for full list:
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsHttpCancelRequestIoCompletion
KpsHttpIoCompletionKpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpSendPostResponseIoCompletion
KpsHttpSendResponseIoCompletion
KpsHttpStart
KpsSocketIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
| |paramcount|1|1| |`address`|180026f10|180029180| |`sig`|bool __thiscall __private_IsEnabled(FeatureImpl<__WilFeatureTraits_Feature_4205429049> * this)|bool __thiscall RemoveRef(KpsIoLockedRef * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled Called Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled called +++ KpsIoLockedRef::RemoveRef called @@ -1,2 +1,3 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage +KpsFreeKpsIo +NTDLL.DLL::RtlEnterCriticalSection +NTDLL.DLL::RtlLeaveCriticalSection ``` ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled Calling Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled calling +++ KpsIoLockedRef::RemoveRef calling @@ -1 +1,6 @@ -KpsCreateKpsIo +KpsDoHttpCancelRequest +KpsDoHttpReceiveClientCert +KpsDoHttpReceiveRequest +KpsDoHttpReceiveRequestEntity +KpsDoHttpSendPostResponse +KpsDoHttpSendResponse @@ -5 +10 @@ -KpsFreeKpsIo +KpsHttpCancelRequestIoCompletion @@ -6,0 +12,6 @@ +KpsHttpReceiveClientCertIoCompletion +KpsHttpReceiveRequestEntityIoCompletion +KpsHttpReceiveRequestIoCompletion +KpsHttpSendPostResponseIoCompletion +KpsHttpSendResponseIoCompletion +KpsHttpStart ``` ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled +++ KpsIoLockedRef::RemoveRef @@ -1,18 +1,54 @@ -/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ +/* public: bool __cdecl KpsIoLockedRef::RemoveRef(void) __ptr64 */ -bool __thiscall -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - (FeatureImpl<__WilFeatureTraits_Feature_4205429049> *this) +bool __thiscall KpsIoLockedRef::RemoveRef(KpsIoLockedRef *this) { - ReportingKind in_R8D; - __uint64 in_R9; - undefined1 local_res10; + _KPS_IO *p_Var1; + longlong lVar2; + _KPS_IO *p_Var3; + longlong *plVar4; + code *pcVar5; + undefined1 *puVar6; + undefined1 auStack_28 [8]; + undefined1 auStack_20 [24]; - GetCachedFeatureEnabledState(this); - ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); - return (bool)(local_res10 & 1); + puVar6 = auStack_28; + p_Var3 = *(_KPS_IO **)this; + if (p_Var3 != (_KPS_IO *)0x0) { + LOCK(); + p_Var1 = p_Var3 + 0x158; + lVar2 = *(longlong *)p_Var1; + *(longlong *)p_Var1 = *(longlong *)p_Var1 + -1; + UNLOCK(); + if (lVar2 < 2) { + if (lVar2 == 1) { + KpsFreeKpsIo(p_Var3); + return true; + } + pcVar5 = (code *)swi(0x29); + (*pcVar5)(0xe); + puVar6 = auStack_20; + } + *(undefined8 *)(puVar6 + -8) = 0x1800291c3; + RtlEnterCriticalSection(&DAT_0); + p_Var1 = p_Var3 + 0x28; + lVar2 = *(longlong *)p_Var1; + if ((lVar2 != 0) && (*(longlong *)(p_Var3 + 0x30) != 0)) { + if ((*(_KPS_IO **)(lVar2 + 8) != p_Var1) || + (plVar4 = *(longlong **)(p_Var3 + 0x30), (_KPS_IO *)*plVar4 != p_Var1)) { + pcVar5 = (code *)swi(0x29); + (*pcVar5)(3); + return false; + } + *plVar4 = lVar2; + *(longlong **)(lVar2 + 8) = plVar4; + *(undefined8 *)p_Var1 = 0; + *(undefined8 *)(p_Var3 + 0x30) = 0; + } + *(undefined8 *)(puVar6 + -8) = 0x180029205; + RtlLeaveCriticalSection(&DAT_0); + } + return false; } ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.27| |i_ratio|0.11| |m_ratio|0.6| |b_ratio|0.49| |match_types|Implied Match| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|__private_IsEnabled|__private_IsEnabled| |`fullname`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled|wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled| |`refcount`|23|5| |`length`|53|143| |`called`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage|wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |`calling`|KpsCreateKpsIo
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsFreeKpsIo
KpsHttpIoCompletion
KpsSocketIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion|KpsCreateKpsIo
KpsHttpIoCompletion
KpsHttpStart
KpsSocketIoCompletion| |paramcount|1|1| |`address`|180026f10|18002aa94| |`sig`|bool __thiscall __private_IsEnabled(FeatureImpl<__WilFeatureTraits_Feature_4205429049> * this)|bool __thiscall __private_IsEnabled(FeatureImpl<__WilFeatureTraits_Feature_886835513> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled Called Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled called +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled called @@ -1,2 +1,2 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage +wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState +wil::details::ReportUsageToService ``` ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled Calling Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled calling +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled calling @@ -2,4 +1,0 @@ -KpsDoSocketConnectAndSend -KpsDoSocketRecvData -KpsDoSocketRecvDataLength -KpsFreeKpsIo @@ -6,0 +3 @@ +KpsHttpStart @@ -8,2 +4,0 @@ -KpsSocketRecvDataIoCompletion -KpsSocketRecvDataLengthIoCompletion ``` ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled @@ -1,18 +1,35 @@ /* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ + __WilFeatureTraits_Feature_886835513>::__private_IsEnabled(void) __ptr64 */ bool __thiscall -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - (FeatureImpl<__WilFeatureTraits_Feature_4205429049> *this) +wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::__private_IsEnabled + (FeatureImpl<__WilFeatureTraits_Feature_886835513> *this) { - ReportingKind in_R8D; - __uint64 in_R9; - undefined1 local_res10; + undefined8 *puVar1; + uint uVar2; + bool bVar3; + undefined4 local_res8; + undefined2 local_resc; + undefined8 local_res10; + wil_ReportingKind in_stack_ffffffffffffffe8; + __uint64 in_stack_fffffffffffffff0; GetCachedFeatureEnabledState(this); - ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); - return (bool)(local_res10 & 1); + uVar2 = *(uint *)this; + bVar3 = (bool)((byte)local_res10 & 1); + if ((uVar2 & 4) == 0) { + puVar1 = (undefined8 *)GetCachedFeatureEnabledState(this); + local_res10 = *puVar1; + uVar2 = (uint)local_res10; + } + local_res8 = 0; + local_resc = 2; + ReportUsageToService + ((wil_details_FeatureReportingCache *)(this + 8),0x35e6913,uVar2 >> 10 & 1, + uVar2 >> 0xb & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)bVar3, + in_stack_ffffffffffffffe8,in_stack_fffffffffffffff0); + return bVar3; } ``` ## KpsFreeKpsIo ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.17| |i_ratio|0.1| |m_ratio|0.74| |b_ratio|0.25| |match_types|Implied Match| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |`name`|KpsFreeKpsIo|KpsSocketIoCompletion_Old| |`fullname`|KpsFreeKpsIo|KpsSocketIoCompletion_Old| |`refcount`|15|2| |`length`|634|329| |`called`|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolWait
KpsDerFree
KpsFreeMem
NTDLL.DLL::RtlDeleteCriticalSection
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlFreeUnicodeString
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_
WPP_SF_q
WS2_32.DLL::FreeAddrInfoWWS2_32.DLL::closesocket
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled
|KpsCancelTimeoutTimer
KpsFreeKpsIo
KpsServiceReady
KpsSocketConnectAndSendIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_L
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled| |`calling`|
Expand for full list:
KpsCreateKpsIo
KpsDoHttpCancelRequest
KpsDoHttpReceiveRequest
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion_Old
KpsHttpIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpSendPostResponseIoCompletion
KpsHttpSendPostResponseIoCompletion_Old
KpsHttpSendResponseIoCompletionKpsHttpSendResponseIoCompletion_Old
KpsHttpStart
KpsSocketIoCompletion
|KpsSocketIoCompletion| |paramcount|1|6| |`address`|180020200|18002659c| |`sig`|void __cdecl KpsFreeKpsIo(_KPS_IO * param_1)|void __cdecl KpsSocketIoCompletion_Old(_TP_CALLBACK_INSTANCE * param_1, void * param_2, void * param_3, ulong param_4, __uint64 param_5, _TP_IO * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsFreeKpsIo Called Diff ```diff --- KpsFreeKpsIo called +++ KpsSocketIoCompletion_Old called @@ -1,5 +1,6 @@ -API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo -API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolWait -KpsDerFree -KpsFreeMem -NTDLL.DLL::RtlDeleteCriticalSection +KpsCancelTimeoutTimer +KpsFreeKpsIo +KpsServiceReady +KpsSocketConnectAndSendIoCompletion +KpsSocketRecvDataIoCompletion +KpsSocketRecvDataLengthIoCompletion @@ -7 +7,0 @@ -NTDLL.DLL::RtlFreeUnicodeString @@ -9,4 +9 @@ -WPP_SF_ -WPP_SF_q -WS2_32.DLL::FreeAddrInfoW -WS2_32.DLL::closesocket +WPP_SF_L ``` ### KpsFreeKpsIo Calling Diff ```diff --- KpsFreeKpsIo calling +++ KpsSocketIoCompletion_Old calling @@ -1,13 +0,0 @@ -KpsCreateKpsIo -KpsDoHttpCancelRequest -KpsDoHttpReceiveRequest -KpsHttpCancelRequestIoCompletion -KpsHttpCancelRequestIoCompletion_Old -KpsHttpIoCompletion -KpsHttpReceiveRequestIoCompletion -KpsHttpReceiveRequestIoCompletion_Old -KpsHttpSendPostResponseIoCompletion -KpsHttpSendPostResponseIoCompletion_Old -KpsHttpSendResponseIoCompletion -KpsHttpSendResponseIoCompletion_Old -KpsHttpStart ``` ### KpsFreeKpsIo Diff ```diff --- KpsFreeKpsIo +++ KpsSocketIoCompletion_Old @@ -1,139 +1,66 @@ -/* void __cdecl KpsFreeKpsIo(struct _KPS_IO * __ptr64) */ +/* void __cdecl KpsSocketIoCompletion_Old(struct _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,void + * __ptr64,unsigned long,unsigned __int64,struct _TP_IO * __ptr64) */ -void __cdecl KpsFreeKpsIo(_KPS_IO *param_1) +void __cdecl +KpsSocketIoCompletion_Old + (_TP_CALLBACK_INSTANCE *param_1,void *param_2,void *param_3,ulong param_4,__uint64 param_5 + ,_TP_IO *param_6) { - _KPS_IO *p_Var1; - longlong lVar2; - SOCKET s; - PTP_IO pio; - PTP_WAIT pwa; - void *pvVar3; - undefined8 uVar4; - code *pcVar5; - bool bVar6; - int iVar7; - longlong *in_RDX; - undefined1 *puVar8; - undefined1 *puVar9; - undefined1 auStack_28 [8]; - undefined1 auStack_20 [24]; + int iVar1; + bool bVar2; + uchar uVar3; - puVar9 = auStack_28; - puVar8 = auStack_28; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - in_RDX = (longlong *)0xa; - WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),10, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,param_1); - } - if (param_1 == (_KPS_IO *)0x0) goto LAB_0; - bVar6 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' ::__l2::impl); - if (bVar6) { - RtlLeaveCriticalSection(param_1 + 0x120); - RtlDeleteCriticalSection(param_1 + 0x120); + if (bVar2) { + RtlEnterCriticalSection((longlong)param_3 + 0x120); } - RtlEnterCriticalSection(&DAT_1); - p_Var1 = param_1 + 0x28; - lVar2 = *(longlong *)p_Var1; - if ((lVar2 == 0) || (*(longlong *)(param_1 + 0x30) == 0)) { -LAB_2: - RtlLeaveCriticalSection(&DAT_1); - KpsFreeMem(*(void **)(param_1 + 0x38)); - KpsFreeMem(*(void **)(param_1 + 0x48)); - KpsFreeMem(*(void **)(param_1 + 0x58)); - if (*(void **)(param_1 + 0x68) != (void *)0x0) { - KpsDerFree(0x28,*(void **)(param_1 + 0x68)); + uVar3 = KpsServiceReady(); + if (uVar3 == '\0') { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x97, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_4); } - RtlFreeUnicodeString(param_1 + 0x70); - in_RDX = *(longlong **)(param_1 + 0x88); - puVar9 = auStack_28; - if (in_RDX != (longlong *)0x0) { - iVar7 = *(int *)(param_1 + 0x84); - if (iVar7 != 1) goto LAB_3; - iVar7 = 1; - puVar8 = auStack_28; - goto LAB_4; + if (param_3 != (void *)0x0) { + KpsFreeKpsIo(param_3); } } else { - if ((*(_KPS_IO **)(lVar2 + 8) == p_Var1) && - (in_RDX = *(longlong **)(param_1 + 0x30), (_KPS_IO *)*in_RDX == p_Var1)) { - *in_RDX = lVar2; - *(longlong **)(lVar2 + 8) = in_RDX; - *(longlong *)p_Var1 = 0; - *(undefined8 *)(param_1 + 0x30) = 0; - goto LAB_2; + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if ((bVar2) && (*(int *)((longlong)param_3 + 0x150) != 0)) { + KpsCancelTimeoutTimer(param_3); } - pcVar5 = (code *)swi(0x29); - iVar7 = (*pcVar5)(3); - puVar8 = auStack_20; -LAB_3: - puVar9 = puVar8; - if (iVar7 == 2) { - iVar7 = 2; -LAB_4: - *(undefined8 *)(puVar8 + -8) = 0x180020352; - KpsDerFree(iVar7 + 0x4d,in_RDX); - puVar9 = puVar8; + iVar1 = *(int *)((longlong)param_3 + 0x20); + if (iVar1 == 8) { + KpsSocketConnectAndSendIoCompletion(param_4,param_5,param_3); } - } - *(undefined8 *)(puVar9 + -8) = 0x180020360; - RtlFreeUnicodeString(param_1 + 0x98); - *(undefined8 *)(puVar9 + -8) = 0x180020373; - RtlFreeUnicodeString(param_1 + 0xa8); - *(undefined8 *)(puVar9 + -8) = 0x180020386; - RtlFreeUnicodeString(param_1 + 0xb8); - if (*(longlong *)(param_1 + 200) != 0) { - *(undefined8 *)(puVar9 + -8) = 0x18002039e; - FreeAddrInfoW(); - } - s = *(SOCKET *)(param_1 + 0xd8); - if (s != 0xffffffffffffffff) { - *(undefined8 *)(puVar9 + -8) = 0x1800203b7; - closesocket(s); - } - pio = *(PTP_IO *)(param_1 + 0xe0); - if (pio != (PTP_IO)0x0) { - *(undefined8 *)(puVar9 + -8) = 0x1800203cf; - CloseThreadpoolIo(pio); - } - *(undefined8 *)(puVar9 + -8) = 0x1800203e0; - bVar6 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if ((bVar6) && (pwa = *(PTP_WAIT *)(param_1 + 0x148), pwa != (PTP_WAIT)0x0)) { - *(undefined8 *)(puVar9 + -8) = 0x1800203f7; - CloseThreadpoolWait(pwa); - } - pvVar3 = *(void **)(param_1 + 0xf8); - if ((pvVar3 != (void *)0x0) && (*(int *)(param_1 + 0xf4) == 1)) { - *(undefined8 *)(puVar9 + -8) = 0x18002041b; - KpsDerFree(6,pvVar3); - } - pvVar3 = *(void **)(param_1 + 0x100); - *(undefined8 *)(puVar9 + -8) = 0x180020427; - KpsFreeMem(pvVar3); - pvVar3 = *(void **)(param_1 + 0x110); - *(undefined8 *)(puVar9 + -8) = 0x180020433; - KpsFreeMem(pvVar3); - *(undefined8 *)(puVar9 + -8) = 0x18002043b; - KpsFreeMem(param_1); - LOCK(); - DAT_5 = DAT_5 + -1; - UNLOCK(); -LAB_0: - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); - *(undefined8 *)(puVar9 + -8) = 0x18002046a; - WPP_SF_(uVar4,0xb,&WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids); + else if (iVar1 == 9) { + KpsSocketRecvDataLengthIoCompletion(param_4,param_5,param_3); + } + else if (iVar1 == 10) { + KpsSocketRecvDataIoCompletion(param_4,param_5,param_3); + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x98, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,iVar1); + } + bVar2 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + RtlLeaveCriticalSection((longlong)param_3 + 0x120); + } } return; } ``` ## KpsSocketRecvDataIoCompletion ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.24| |i_ratio|0.13| |m_ratio|0.99| |b_ratio|0.77| |match_types|Implied Match| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsSocketRecvDataIoCompletion|KpsSocketRecvDataIoCompletion| |fullname|KpsSocketRecvDataIoCompletion|KpsSocketRecvDataIoCompletion| |refcount|2|2| |`length`|812|843| |`called`|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
KpsDoHttpCancelRequest
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsPackProxyResponse
KpsPerfUpdate
KpsStartTimeoutTimer
WPP_SF_DILL
WPP_SF_Dsd
WPP_SF_LWPP_SF_LL
WPP_SF_qDI
WS2_32.DLL::WSAGetLastError
WS2_32.DLL::WSARecv
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled
|
Expand for full list:
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo
KpsDoHttpCancelRequest
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsIoLockedRef::RemoveRef
KpsPackProxyResponse
KpsPerfUpdate
KpsStartTimeoutTimer
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_DILLWPP_SF_Dsd
WPP_SF_L
WPP_SF_qDI
WS2_32.DLL::WSAGetLastError
WS2_32.DLL::WSARecv
| |calling|KpsSocketIoCompletion|KpsSocketIoCompletion| |paramcount|3|3| |`address`|180023230|1800266ec| |`sig`|void __cdecl KpsSocketRecvDataIoCompletion(ulong param_1, __uint64 param_2, _KPS_IO * param_3)|void __cdecl KpsSocketRecvDataIoCompletion(ulong param_1, __uint64 param_2, KpsIoLockedRef * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsSocketRecvDataIoCompletion Called Diff ```diff --- KpsSocketRecvDataIoCompletion called +++ KpsSocketRecvDataIoCompletion called @@ -5,0 +6 @@ +KpsIoLockedRef::RemoveRef @@ -8,0 +10 @@ +NTDLL.DLL::RtlLeaveCriticalSection @@ -12 +13,0 @@ -WPP_SF_LL @@ -16 +16,0 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled ``` ### KpsSocketRecvDataIoCompletion Diff ```diff --- KpsSocketRecvDataIoCompletion +++ KpsSocketRecvDataIoCompletion @@ -1,137 +1,159 @@ -/* void __cdecl KpsSocketRecvDataIoCompletion(unsigned long,unsigned __int64,struct _KPS_IO * +/* void __cdecl KpsSocketRecvDataIoCompletion(unsigned long,unsigned __int64,class KpsIoLockedRef & __ptr64) */ -void __cdecl KpsSocketRecvDataIoCompletion(ulong param_1,__uint64 param_2,_KPS_IO *param_3) +void __cdecl KpsSocketRecvDataIoCompletion(ulong param_1,__uint64 param_2,KpsIoLockedRef *param_3) { - uint uVar1; + longlong *plVar1; uint uVar2; - bool bVar3; - ulong uVar4; - int iVar5; - undefined2 uVar6; - ushort uVar7; - __uint64 _Var8; - char *pcVar9; - char *pcVar10; - undefined4 local_res8 [2]; - _KPS_IO *local_res18; - undefined8 local_38; - longlong lStack_30; + uint uVar3; + PTP_IO pio; + _KPS_IO *p_Var4; + undefined8 uVar5; + code *pcVar6; + bool bVar7; + int iVar8; + ushort uVar9; + undefined1 *puVar11; + char *pcVar12; + char *pcVar13; + undefined1 auStackY_68 [8]; + undefined1 auStackY_60 [24]; + longlong lVar10; - uVar4 = 0; - local_res8[0] = 0; - local_38 = 0; - lStack_30 = 0; - _Var8 = param_2; - local_res18 = param_3; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - _Var8 = 0x90; - WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x90,param_3,param_3); + WPP_SF_qDI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x110,param_3,*(undefined8 *)param_3); } - uVar7 = (ushort)_Var8; if (param_1 == 0) { - uVar1 = *(uint *)(param_3 + 0x10c); - pcVar9 = (char *)(ulonglong)uVar1; - uVar2 = *(uint *)(param_3 + 0x108); - pcVar10 = (char *)(ulonglong)uVar2; - if (param_2 < uVar1 - uVar2) { + lVar10 = *(longlong *)param_3; + uVar2 = *(uint *)(lVar10 + 0x10c); + pcVar12 = (char *)(ulonglong)uVar2; + uVar3 = *(uint *)(lVar10 + 0x108); + pcVar13 = (char *)(ulonglong)uVar3; + if (param_2 < uVar2 - uVar3) { if (param_2 == 0) { - uVar4 = 0x2c3; + puVar11 = auStackY_68; + param_1 = 0x2c3; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_DILL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x92); + (puVar11 = auStackY_68, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_DILL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x112); + puVar11 = auStackY_68; + param_1 = 0x2c3; } } else { - iVar5 = uVar2 + (int)param_2; - *(int *)(param_3 + 0x108) = iVar5; - local_38 = CONCAT44(local_38._4_4_,uVar1 - iVar5); - lStack_30 = (ulonglong)*(uint *)(param_3 + 0x108) + *(longlong *)(param_3 + 0x100); - *(undefined4 *)(param_3 + 0x20) = 10; - StartThreadpoolIo(*(PTP_IO *)(param_3 + 0xe0)); - iVar5 = WSARecv(*(undefined8 *)(param_3 + 0xd8),&local_38,1,0,local_res8,param_3,0); - if ((iVar5 != -1) || (iVar5 = WSAGetLastError(), iVar5 == 0x3e5)) { - bVar3 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>:: - __private_IsEnabled((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if (bVar3) { - KpsStartTimeoutTimer(param_3); - *(undefined4 *)(param_3 + 0x150) = 1; + *(uint *)(lVar10 + 0x108) = uVar3 + (int)param_2; + *(undefined4 *)(*(longlong *)param_3 + 0x20) = 10; + StartThreadpoolIo(*(PTP_IO *)(*(longlong *)param_3 + 0xe0)); + puVar11 = auStackY_68; + if (*(longlong *)param_3 != 0) { + LOCK(); + plVar1 = (longlong *)(*(longlong *)param_3 + 0x158); + lVar10 = *plVar1; + *plVar1 = *plVar1 + 1; + UNLOCK(); + puVar11 = auStackY_68; + if (lVar10 + 1 < 2) { + pcVar6 = (code *)swi(0x29); + (*pcVar6)(0xe); + puVar11 = auStackY_60; } - goto LAB_0; } - CancelThreadpoolIo(*(PTP_IO *)(param_3 + 0xe0)); - uVar4 = WSAGetLastError(); - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar6 = 0x93; -LAB_1: - WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar6, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,uVar4, - "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + lVar10 = *(longlong *)param_3; + *(undefined8 *)(puVar11 + 0x30) = 0; + *(longlong *)(puVar11 + 0x28) = lVar10; + *(undefined1 **)(puVar11 + 0x20) = puVar11 + 0x70; + uVar5 = *(undefined8 *)(lVar10 + 0xd8); + *(undefined8 *)(puVar11 + -8) = 0x180026896; + iVar8 = WSARecv(uVar5,puVar11 + 0x40,1); + if (iVar8 == -1) { + *(undefined8 *)(puVar11 + -8) = 0x1800268ab; + iVar8 = WSAGetLastError(); + if (iVar8 != 0x3e5) { + pio = *(PTP_IO *)(*(longlong *)param_3 + 0xe0); + *(undefined8 *)(puVar11 + -8) = 0x1800268c8; + CancelThreadpoolIo(pio); + *(undefined8 *)(puVar11 + -8) = 0x1800268d4; + param_1 = WSAGetLastError(); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined4 *)(puVar11 + 0x28) = 0x1322; + *(char **)(puVar11 + 0x20) = "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"; + *(undefined8 *)(puVar11 + -8) = 0x180026919; + WPP_SF_Dsd(uVar5,0x113,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + *(char **)(puVar11 + 0x20)); + } + *(undefined8 *)(puVar11 + -8) = 0x180026921; + KpsIoLockedRef::RemoveRef(param_3); + goto LAB_0; + } + } + p_Var4 = *(_KPS_IO **)param_3; + *(undefined8 *)(puVar11 + -8) = 0x180026931; + KpsStartTimeoutTimer(p_Var4); + *(undefined4 *)(p_Var4 + 0x150) = 1; + param_1 = 0; + if (*(longlong *)param_3 != 0) { + *(undefined8 *)(puVar11 + -8) = 0x18002694c; + bVar7 = KpsIoLockedRef::RemoveRef(param_3); + if (!bVar7) { + lVar10 = *(longlong *)param_3; + *(undefined8 *)(puVar11 + -8) = 0x180026961; + RtlLeaveCriticalSection(lVar10 + 0x120); + } + *(undefined8 *)param_3 = 0; } } } else { - *(uint *)(param_3 + 0x108) = uVar1; - bVar3 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_4205429049> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_4205429049>::GetImpl(void)' - ::__l2::impl); - if (!bVar3) { - uVar1 = *(uint *)(param_3 + 0x108); - pcVar10 = (char *)(ulonglong)uVar1; - if (DAT_2 < uVar1) { - uVar4 = 0; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_LL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x94, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,uVar1); - uVar4 = 0; - } - goto LAB_3; + *(uint *)(lVar10 + 0x108) = uVar2; + param_1 = KpsPackProxyResponse(*(_KPS_IO **)param_3); + uVar9 = (ushort)lVar10; + if (param_1 == 0x78f) { + KpsPerfUpdate(4); + KpsDoHttpSendResponse(param_3,uVar9,pcVar12,pcVar13); + puVar11 = auStackY_68; + } + else if (param_1 == 0) { + KpsDoHttpSendPostResponse(param_3); + puVar11 = auStackY_68; + } + else { + puVar11 = auStackY_68; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar11 = auStackY_68, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x114, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, + "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar11 = auStackY_68; } - } - uVar4 = KpsPackProxyResponse(param_3); - if (uVar4 == 0x78f) { - KpsPerfUpdate(4); - KpsDoHttpSendResponse(&local_res18,uVar7,pcVar9,pcVar10); - param_3 = local_res18; - } - else if (uVar4 == 0) { - KpsDoHttpSendPostResponse(&local_res18); - param_3 = local_res18; - } - else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar6 = 0x95; - goto LAB_1; } } } else { - uVar4 = param_1; + puVar11 = auStackY_68; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x91, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,param_1, + (puVar11 = auStackY_68, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Dsd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x111, + &WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1, "ds\\security\\protocols\\kerberos\\kps\\kpshttp.cxx"); + puVar11 = auStackY_68; } } -LAB_3: - if (param_3 != (_KPS_IO *)0x0) { - KpsDoHttpCancelRequest(&local_res18); +LAB_0: + if (*(longlong *)param_3 != 0) { + *(undefined8 *)(puVar11 + -8) = 0x1800269f8; + KpsDoHttpCancelRequest(param_3); } -LAB_0: if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x96, - &WPP_d62737ff786d3fa15e567fa29a57a3c5_Traceguids,uVar4); + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x10); + *(undefined8 *)(puVar11 + -8) = 0x180026a22; + WPP_SF_L(uVar5,0x115,&WPP_4b0926a41fe03d4e2368b01f990545ce_Traceguids,param_1); } return; } ``` ## McGenEventWrite_EventWriteTransfer ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.27| |i_ratio|0.07| |m_ratio|0.79| |b_ratio|0.55| |match_types|Implied Match| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |`name`|McGenEventWrite_EventWriteTransfer|McTemplateU0qz_EventWriteTransfer| |`fullname`|McGenEventWrite_EventWriteTransfer|McTemplateU0qz_EventWriteTransfer| |`refcount`|30|3| |`length`|90|150| |`called`|API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL::EventWriteTransfer|McGenEventWrite_EventWriteTransfer
__security_check_cookie| |`calling`|
Expand for full list:
KpsCheckDomainJoinedMachine
KpsDoHttpReceiveRequest
KpsDoSocketConnectAndSend
KpsGPInit
KpsGPRead
KpsGetKdcBinding
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletionKpsHttpReceiveRequestIoCompletion_Old
KpsHttpShutdown
KpsHttpStart
KpsServiceStopCallback
McTemplateU0qqqqqqq_EventWriteTransfer
McTemplateU0zq_EventWriteTransfer
McTemplateU0zz_EventWriteTransfer
McTemplateU0zzqq_EventWriteTransfer
McTemplateU0zzz_EventWriteTransfer
ServiceMain
|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend| |paramcount|5|4| |`address`|18001ada8|18002afdc| |`sig`|undefined __fastcall McGenEventWrite_EventWriteTransfer(undefined8 param_1, PCEVENT_DESCRIPTOR param_2, undefined8 param_3, ULONG param_4, PEVENT_DATA_DESCRIPTOR param_5)|undefined __fastcall McTemplateU0qz_EventWriteTransfer(undefined8 param_1, undefined8 param_2, undefined8 param_3, wchar_t * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### McGenEventWrite_EventWriteTransfer Called Diff ```diff --- McGenEventWrite_EventWriteTransfer called +++ McTemplateU0qz_EventWriteTransfer called @@ -1 +1,2 @@ -API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL::EventWriteTransfer +McGenEventWrite_EventWriteTransfer +__security_check_cookie ``` ### McGenEventWrite_EventWriteTransfer Calling Diff ```diff --- McGenEventWrite_EventWriteTransfer calling +++ McTemplateU0qz_EventWriteTransfer calling @@ -1,2 +0,0 @@ -KpsCheckDomainJoinedMachine -KpsDoHttpReceiveRequest @@ -4,18 +2 @@ -KpsGPInit -KpsGPRead -KpsGetKdcBinding -KpsHttpReceiveClientCertIoCompletion -KpsHttpReceiveClientCertIoCompletion_Old -KpsHttpReceiveRequestEntityIoCompletion -KpsHttpReceiveRequestEntityIoCompletion_Old -KpsHttpReceiveRequestIoCompletion -KpsHttpReceiveRequestIoCompletion_Old -KpsHttpShutdown -KpsHttpStart -KpsServiceStopCallback -McTemplateU0qqqqqqq_EventWriteTransfer -McTemplateU0zq_EventWriteTransfer -McTemplateU0zz_EventWriteTransfer -McTemplateU0zzqq_EventWriteTransfer -McTemplateU0zzz_EventWriteTransfer -ServiceMain +KpsDoSocketConnectAndSend ``` ### McGenEventWrite_EventWriteTransfer Diff ```diff --- McGenEventWrite_EventWriteTransfer +++ McTemplateU0qz_EventWriteTransfer @@ -1,28 +1,42 @@ -void McGenEventWrite_EventWriteTransfer - (undefined8 param_1,PCEVENT_DESCRIPTOR param_2,undefined8 param_3,ULONG param_4, - PEVENT_DATA_DESCRIPTOR param_5) +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void McTemplateU0qz_EventWriteTransfer + (undefined8 param_1,undefined8 param_2,undefined8 param_3,wchar_t *param_4) { - ushort *puVar1; - uint uVar2; - uint uVar3; + longlong lVar1; + undefined4 local_res18 [4]; + undefined1 auStackY_78 [32]; + _EVENT_DATA_DESCRIPTOR local_48; + undefined4 *local_38; + undefined8 local_30; + wchar_t *local_28; + int local_20; + undefined4 local_1c; + ulonglong local_18; - puVar1 = DAT_0; - uVar3 = 0; - if (DAT_0 == (ushort *)0x0) { - param_5->Ptr = 0; - uVar2 = uVar3; + local_res18[0] = (undefined4)param_3; + local_18 = __security_cookie ^ (ulonglong)auStackY_78; + local_30 = 4; + local_38 = local_res18; + if (param_4 == (wchar_t *)0x0) { + local_20 = 10; } else { - param_5->Ptr = (ULONGLONG)DAT_0; - uVar2 = 2; - uVar3 = (uint)*puVar1; + lVar1 = -1; + do { + lVar1 = lVar1 + 1; + } while (param_4[lVar1] != L'\0'); + local_20 = (int)lVar1 * 2 + 2; } - param_5->Size = uVar3; - param_5->Reserved = uVar2; - EventWriteTransfer(Microsoft_Windows_Kerberos_KdcProxy_Context,param_2,(LPCGUID)0x0,(LPCGUID)0x0, - param_4,param_5); + local_1c = 0; + if (param_4 == (wchar_t *)0x0) { + param_4 = L"NULL"; + } + local_28 = param_4; + McGenEventWrite_EventWriteTransfer + (L"NULL",(PCEVENT_DESCRIPTOR)&RetryKdcConnection,param_3,3,&local_48); return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|42|47| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|180031a74|1800356f4| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## KpsUnpackProxyRequest ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsUnpackProxyRequest|KpsUnpackProxyRequest| |fullname|KpsUnpackProxyRequest|KpsUnpackProxyRequest| |`refcount`|2|3| |length|1354|1354| |called|
Expand for full list:
KpsCheckKerbRequest
KpsDerFree
KpsDerUnpack
KpsFreeMem
KpsPerfUpdate
KpsUtf8String2UnicodeString
KpsValidateKpasswdMessage
McTemplateU0zq_EventWriteTransfer
NTDLL.DLL::RtlInitUnicodeString
WPP_SF_DDDsd
WPP_SF_DsdWPP_SF_L
WPP_SF_dZ
WPP_SF_q
WPP_SF_sd
WS2_32.DLL::ntohl
|
Expand for full list:
KpsCheckKerbRequest
KpsDerFree
KpsDerUnpack
KpsFreeMem
KpsPerfUpdate
KpsUtf8String2UnicodeString
KpsValidateKpasswdMessage
McTemplateU0zq_EventWriteTransfer
NTDLL.DLL::RtlInitUnicodeString
WPP_SF_DDDsd
WPP_SF_DsdWPP_SF_L
WPP_SF_dZ
WPP_SF_q
WPP_SF_sd
WS2_32.DLL::ntohl
| |`calling`|KpsProcessProxyRequest|KpsProcessProxyRequest
KpsProcessProxyRequest| |paramcount|1|1| |`address`|18002b5f8|18002f278| |sig|ulong __cdecl KpsUnpackProxyRequest(_KPS_IO * param_1)|ulong __cdecl KpsUnpackProxyRequest(_KPS_IO * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsUnpackProxyRequest Calling Diff ```diff --- KpsUnpackProxyRequest calling +++ KpsUnpackProxyRequest calling @@ -1,0 +2 @@ +KpsProcessProxyRequest ``` ## KpsPerfUpdate ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.52| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsPerfUpdate|KpsPerfUpdate| |fullname|KpsPerfUpdate|KpsPerfUpdate| |`refcount`|9|13| |length|172|172| |called|WPP_SF_
WPP_SF_L|WPP_SF_
WPP_SF_L| |`calling`|KpsCheckAsReq
KpsCheckTgsReq
KpsDoHttpCancelRequest
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsProcessProxyRequest
KpsSocketRecvDataIoCompletion
KpsUnpackProxyRequest|
Expand for full list:
KpsCheckAsReq
KpsCheckTgsReq
KpsDoHttpCancelRequest
KpsDoHttpCancelRequest
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsProcessProxyRequest
KpsProcessProxyRequest
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataIoCompletionKpsUnpackProxyRequest
| |paramcount|1|1| |`address`|180030918|180034598| |sig|void __cdecl KpsPerfUpdate(ulong param_1)|void __cdecl KpsPerfUpdate(ulong param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsPerfUpdate Calling Diff ```diff --- KpsPerfUpdate calling +++ KpsPerfUpdate calling @@ -3,0 +4,2 @@ +KpsDoHttpCancelRequest +KpsHttpReceiveRequestIoCompletion @@ -6,0 +9,2 @@ +KpsProcessProxyRequest +KpsSocketRecvDataIoCompletion ``` ## API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|CloseThreadpoolIo|CloseThreadpoolIo| |fullname|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo| |`refcount`|7|10| |length|0|0| |called||| |`calling`|KpsDoSocketConnectAndSend
KpsFreeKpsIo
KpsHttpShutdown
KpsHttpStart
KpsSocketConnectAndSendIoCompletion|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsFreeKpsIo
KpsHttpShutdown
KpsHttpStart
KpsSocketConnectAndSendIoCompletion
KpsSocketConnectAndSendIoCompletion| |paramcount|1|1| |address|EXTERNAL:00000053|EXTERNAL:00000053| |sig|void __stdcall CloseThreadpoolIo(PTP_IO pio)|void __stdcall CloseThreadpoolIo(PTP_IO pio)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo Calling Diff ```diff --- API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo calling +++ API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolIo calling @@ -0,0 +1 @@ +KpsDoSocketConnectAndSend @@ -5,0 +7 @@ +KpsSocketConnectAndSendIoCompletion ``` ## WPP_SF_ ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WPP_SF_|WPP_SF_| |fullname|WPP_SF_|WPP_SF_| |`refcount`|77|81| |length|36|36| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |`calling`|
Expand for full list:
KpsBucketCleanupUserHashEntry
KpsCheckDomainJoinedMachine
KpsCreateKpsIo
KpsDumpMitRealm
KpsFreeDomainHashEntry
KpsFreeDomainTable
KpsFreeKpsIo
KpsFreeMitRealm
KpsFreeMitServerList
KpsFreeUrlPrefixList
KpsFreeUserHashEntryKpsFreeUserTable
KpsGPCallback
KpsGPInit
KpsGPQuery
KpsGPRead
KpsGPShutdown
KpsGPWatchRegKey
KpsGetKdcBinding
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion_Old
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpSendPostResponseIoCompletion
KpsHttpSendPostResponseIoCompletion_Old
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion_Old
KpsHttpShutdown
KpsHttpStart
KpsKerbInit
KpsKerbShutdown
KpsMitRealmDnsLookup
KpsMitRealmQuery
KpsParseMitRealmSettings
KpsParseMitServerList
KpsParseUrlPrefixList
KpsPerfInit
KpsPerfShutdown
KpsPerfUpdate
KpsPrincipalName2UnicodeString
KpsReadMitRealms
KpsReadNextMitRealmFromGroupPolicy
KpsReadNextMitRealmFromLocalPolicy
KpsServiceStopCallback
KpsSqmFlushAll
KpsUtf8String2UnicodeString
KpsValidateKpasswdMessage
NetpSrvNext
NetpSrvOpen
ServiceMain
SvchostPushServiceGlobals
|
Expand for full list:
KpsBucketCleanupUserHashEntry
KpsCheckDomainJoinedMachine
KpsCreateKpsIo
KpsDumpMitRealm
KpsFreeDomainHashEntry
KpsFreeDomainTable
KpsFreeKpsIo
KpsFreeMitRealm
KpsFreeMitServerList
KpsFreeUrlPrefixList
KpsFreeUserHashEntryKpsFreeUserTable
KpsGPCallback
KpsGPInit
KpsGPQuery
KpsGPRead
KpsGPShutdown
KpsGPWatchRegKey
KpsGetKdcBinding
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion_Old
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpSendPostResponseIoCompletion
KpsHttpSendPostResponseIoCompletion
KpsHttpSendPostResponseIoCompletion_Old
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion_Old
KpsHttpShutdown
KpsHttpStart
KpsKerbInit
KpsKerbShutdown
KpsMitRealmDnsLookup
KpsMitRealmQuery
KpsParseMitRealmSettings
KpsParseMitServerList
KpsParseUrlPrefixList
KpsPerfInit
KpsPerfShutdown
KpsPerfUpdate
KpsPrincipalName2UnicodeString
KpsReadMitRealms
KpsReadNextMitRealmFromGroupPolicy
KpsReadNextMitRealmFromLocalPolicy
KpsServiceStopCallback
KpsSqmFlushAll
KpsUtf8String2UnicodeString
KpsValidateKpasswdMessage
NetpSrvNext
NetpSrvOpen
ServiceMain
SvchostPushServiceGlobals
| |paramcount|3|3| |address|18001ae0c|18001ae0c| |sig|undefined __fastcall WPP_SF_(undefined8 param_1, undefined2 param_2, undefined8 param_3)|undefined __fastcall WPP_SF_(undefined8 param_1, undefined2 param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_ Calling Diff ```diff --- WPP_SF_ calling +++ WPP_SF_ calling @@ -20,0 +21 @@ +KpsHttpCancelRequestIoCompletion @@ -21,0 +23 @@ +KpsHttpReceiveClientCertIoCompletion @@ -24,0 +27 @@ +KpsHttpSendPostResponseIoCompletion @@ -25,0 +29 @@ +KpsHttpSendResponseIoCompletion ``` ## SubscribeFeatureStateCacheToConfigurationChanges ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.69| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|SubscribeFeatureStateCacheToConfigurationChanges|SubscribeFeatureStateCacheToConfigurationChanges| |fullname|wil::details::SubscribeFeatureStateCacheToConfigurationChanges|wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |`refcount`|4|5| |length|158|158| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
wil::details_abi::heap_buffer::push_back|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
wil::details_abi::heap_buffer::push_back| |`calling`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|3|3| |`address`|180026114|180029ba4| |sig|void __cdecl SubscribeFeatureStateCacheToConfigurationChanges(wil_details_FeatureStateCache * param_1, wil_FeatureChangeTime param_2, uint param_3)|void __cdecl SubscribeFeatureStateCacheToConfigurationChanges(wil_details_FeatureStateCache * param_1, wil_FeatureChangeTime param_2, uint param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### SubscribeFeatureStateCacheToConfigurationChanges Calling Diff ```diff --- wil::details::SubscribeFeatureStateCacheToConfigurationChanges calling +++ wil::details::SubscribeFeatureStateCacheToConfigurationChanges calling @@ -2,0 +3 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState ``` ## NTDLL.DLL::RtlLeaveCriticalSection ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|RtlLeaveCriticalSection|RtlLeaveCriticalSection| |fullname|NTDLL.DLL::RtlLeaveCriticalSection|NTDLL.DLL::RtlLeaveCriticalSection| |`refcount`|19|41| |length|0|0| |called||| |`calling`|
Expand for full list:
KpsCancelTimeoutTimer
KpsCheckAsReqForBadPassword
KpsCheckKerbErrorForBadPassword
KpsCreateKpsIo
KpsFreeKpsIo
KpsGPRead
KpsGetKdcBinding
KpsHttpIoCompletion
KpsHttpShutdown
KpsKerbShutdown
KpsSocketIoCompletionKpsUpdateDomainRediscovery
|
Expand for full list:
KpsCancelTimeoutTimer
KpsCheckAsReqForBadPassword
KpsCheckKerbErrorForBadPassword
KpsCreateKpsIo
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSendKpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsFreeKpsIo
KpsGPRead
KpsGetKdcBinding
KpsHttpCancelRequestIoCompletion
KpsHttpIoCompletion
KpsHttpIoCompletion_Old
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpSendPostResponseIoCompletion
KpsHttpSendResponseIoCompletion
KpsHttpShutdown
KpsHttpStart
KpsIoLockedRef::RemoveRef
KpsKerbShutdown
KpsSocketIoCompletion
KpsSocketIoCompletion_Old
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsUpdateDomainRediscovery
| |paramcount|0|0| |address|EXTERNAL:000000d2|EXTERNAL:000000d2| |sig|undefined RtlLeaveCriticalSection(void)|undefined RtlLeaveCriticalSection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTDLL.DLL::RtlLeaveCriticalSection Calling Diff ```diff --- NTDLL.DLL::RtlLeaveCriticalSection calling +++ NTDLL.DLL::RtlLeaveCriticalSection calling @@ -4,0 +5,9 @@ +KpsDoHttpCancelRequest +KpsDoHttpReceiveClientCert +KpsDoHttpReceiveRequest +KpsDoHttpReceiveRequestEntity +KpsDoHttpSendPostResponse +KpsDoHttpSendResponse +KpsDoSocketConnectAndSend +KpsDoSocketRecvData +KpsDoSocketRecvDataLength @@ -7,0 +17 @@ +KpsHttpCancelRequestIoCompletion @@ -8,0 +19,6 @@ +KpsHttpIoCompletion_Old +KpsHttpReceiveClientCertIoCompletion +KpsHttpReceiveRequestEntityIoCompletion +KpsHttpReceiveRequestIoCompletion +KpsHttpSendPostResponseIoCompletion +KpsHttpSendResponseIoCompletion @@ -9,0 +26,2 @@ +KpsHttpStart +KpsIoLockedRef::RemoveRef @@ -11,0 +30,3 @@ +KpsSocketIoCompletion_Old +KpsSocketRecvDataIoCompletion +KpsSocketRecvDataLengthIoCompletion ``` ## KpsPackProxyResponse ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsPackProxyResponse|KpsPackProxyResponse| |fullname|KpsPackProxyResponse|KpsPackProxyResponse| |`refcount`|2|3| |length|372|372| |called|KpsCheckKerbResponse
KpsDerPack
KpsFreeMem
WPP_SF_Dsd
WPP_SF_L
WPP_SF_q|KpsCheckKerbResponse
KpsDerPack
KpsFreeMem
WPP_SF_Dsd
WPP_SF_L
WPP_SF_q| |`calling`|KpsSocketRecvDataIoCompletion|KpsSocketRecvDataIoCompletion
KpsSocketRecvDataIoCompletion| |paramcount|1|1| |`address`|18002af3c|18002ebbc| |sig|ulong __cdecl KpsPackProxyResponse(_KPS_IO * param_1)|ulong __cdecl KpsPackProxyResponse(_KPS_IO * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsPackProxyResponse Calling Diff ```diff --- KpsPackProxyResponse calling +++ KpsPackProxyResponse calling @@ -1,0 +2 @@ +KpsSocketRecvDataIoCompletion ``` ## HTTPAPI.DLL::HttpReceiveClientCertificate ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|HttpReceiveClientCertificate|HttpReceiveClientCertificate| |fullname|HTTPAPI.DLL::HttpReceiveClientCertificate|HTTPAPI.DLL::HttpReceiveClientCertificate| |`refcount`|4|6| |length|0|0| |called||| |`calling`|KpsDoHttpReceiveClientCert
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old|KpsDoHttpReceiveClientCert
KpsDoHttpReceiveClientCert
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old| |paramcount|0|0| |address|EXTERNAL:000000f2|EXTERNAL:000000f2| |sig|undefined HttpReceiveClientCertificate(void)|undefined HttpReceiveClientCertificate(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### HTTPAPI.DLL::HttpReceiveClientCertificate Calling Diff ```diff --- HTTPAPI.DLL::HttpReceiveClientCertificate calling +++ HTTPAPI.DLL::HttpReceiveClientCertificate calling @@ -0,0 +1 @@ +KpsDoHttpReceiveClientCert @@ -2,0 +4 @@ +KpsHttpReceiveClientCertIoCompletion ``` ## KpsCancelTimeoutTimer ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsCancelTimeoutTimer|KpsCancelTimeoutTimer| |fullname|KpsCancelTimeoutTimer|KpsCancelTimeoutTimer| |`refcount`|3|5| |length|133|133| |called|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolWaitEx
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::WaitForThreadpoolWaitCallbacks
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolWaitEx
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::WaitForThreadpoolWaitCallbacks
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection| |`calling`|KpsHttpIoCompletion
KpsSocketIoCompletion|KpsHttpIoCompletion
KpsHttpIoCompletion_Old
KpsSocketIoCompletion
KpsSocketIoCompletion_Old| |paramcount|1|1| |`address`|18001e634|18001e7d4| |sig|void __cdecl KpsCancelTimeoutTimer(_KPS_IO * param_1)|void __cdecl KpsCancelTimeoutTimer(_KPS_IO * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsCancelTimeoutTimer Calling Diff ```diff --- KpsCancelTimeoutTimer calling +++ KpsCancelTimeoutTimer calling @@ -1,0 +2 @@ +KpsHttpIoCompletion_Old @@ -2,0 +4 @@ +KpsSocketIoCompletion_Old ``` ## API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|StartThreadpoolIo|StartThreadpoolIo| |fullname|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo| |`refcount`|18|32| |length|0|0| |called||| |`calling`|
Expand for full list:
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_OldKpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
|
Expand for full list:
KpsDoHttpCancelRequest
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsDoHttpSendResponseKpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsDoSocketRecvDataLength
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsSocketRecvDataLengthIoCompletion
| |paramcount|1|1| |address|EXTERNAL:00000058|EXTERNAL:00000058| |sig|void __stdcall StartThreadpoolIo(PTP_IO pio)|void __stdcall StartThreadpoolIo(PTP_IO pio)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo Calling Diff ```diff --- API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo calling +++ API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::StartThreadpoolIo calling @@ -0,0 +1 @@ +KpsDoHttpCancelRequest @@ -2,0 +4,2 @@ +KpsDoHttpReceiveClientCert +KpsDoHttpReceiveRequest @@ -4,0 +8,2 @@ +KpsDoHttpReceiveRequestEntity +KpsDoHttpSendPostResponse @@ -6,0 +12,2 @@ +KpsDoHttpSendResponse +KpsDoSocketConnectAndSend @@ -8,0 +16 @@ +KpsDoSocketRecvData @@ -9,0 +18,2 @@ +KpsDoSocketRecvDataLength +KpsHttpReceiveClientCertIoCompletion @@ -12,0 +23 @@ +KpsHttpReceiveRequestEntityIoCompletion @@ -13,0 +25 @@ +KpsHttpReceiveRequestIoCompletion @@ -16,0 +29 @@ +KpsSocketRecvDataIoCompletion @@ -17,0 +31 @@ +KpsSocketRecvDataLengthIoCompletion ``` ## StringCchPrintfA ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.78| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|StringCchPrintfA|StringCchPrintfA| |fullname|StringCchPrintfA|StringCchPrintfA| |`refcount`|3|4| |length|109|109| |called|MSVCRT.DLL::_vsnprintf|MSVCRT.DLL::_vsnprintf| |`calling`|KpsDoHttpSendPostResponse
KpsMitRealmDnsLookup|KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsMitRealmDnsLookup| |paramcount|3|3| |`address`|1800260a0|180029b30| |sig|long __cdecl StringCchPrintfA(char * param_1, __uint64 param_2, char * param_3, ...)|long __cdecl StringCchPrintfA(char * param_1, __uint64 param_2, char * param_3, ...)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### StringCchPrintfA Calling Diff ```diff --- StringCchPrintfA calling +++ StringCchPrintfA calling @@ -0,0 +1 @@ +KpsDoHttpSendPostResponse ``` ## WS2_32.DLL::ntohl ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|ntohl|ntohl| |fullname|WS2_32.DLL::ntohl|WS2_32.DLL::ntohl| |`refcount`|4|5| |length|0|0| |called||| |`calling`|KpsCheckKerbResponse
KpsDoSocketRecvData
KpsUnpackProxyRequest|KpsCheckKerbResponse
KpsDoSocketRecvData
KpsDoSocketRecvData
KpsUnpackProxyRequest| |paramcount|1|1| |address|EXTERNAL:0000004e|EXTERNAL:0000004e| |sig|u_long __stdcall ntohl(u_long netlong)|u_long __stdcall ntohl(u_long netlong)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### WS2_32.DLL::ntohl Calling Diff ```diff --- WS2_32.DLL::ntohl calling +++ WS2_32.DLL::ntohl calling @@ -2,0 +3 @@ +KpsDoSocketRecvData ``` ## WS2_32.DLL::socket ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|socket|socket| |fullname|WS2_32.DLL::socket|WS2_32.DLL::socket| |`refcount`|2|3| |length|0|0| |called||| |`calling`|KpsDoSocketConnectAndSend|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend| |paramcount|3|3| |address|EXTERNAL:00000047|EXTERNAL:00000047| |sig|SOCKET __stdcall socket(int af, int type, int protocol)|SOCKET __stdcall socket(int af, int type, int protocol)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### WS2_32.DLL::socket Calling Diff ```diff --- WS2_32.DLL::socket calling +++ WS2_32.DLL::socket calling @@ -1,0 +2 @@ +KpsDoSocketConnectAndSend ``` ## WS2_32.DLL::FreeAddrInfoW ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|FreeAddrInfoW|FreeAddrInfoW| |fullname|WS2_32.DLL::FreeAddrInfoW|WS2_32.DLL::FreeAddrInfoW| |`refcount`|4|5| |length|0|0| |called||| |`calling`|KpsDoSocketConnectAndSend
KpsFreeKpsIo
KpsGetKdcBinding|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsFreeKpsIo
KpsGetKdcBinding| |paramcount|0|0| |address|EXTERNAL:0000004c|EXTERNAL:0000004c| |sig|undefined FreeAddrInfoW(void)|undefined FreeAddrInfoW(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### WS2_32.DLL::FreeAddrInfoW Calling Diff ```diff --- WS2_32.DLL::FreeAddrInfoW calling +++ WS2_32.DLL::FreeAddrInfoW calling @@ -0,0 +1 @@ +KpsDoSocketConnectAndSend ``` ## WPP_SF_q ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.92| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WPP_SF_q|WPP_SF_q| |fullname|WPP_SF_q|WPP_SF_q| |`refcount`|35|45| |length|58|58| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |`calling`|
Expand for full list:
KpsCheckAsRep
KpsCheckAsReq
KpsCheckAsReqForBadPassword
KpsCheckKerbError
KpsCheckKerbErrorForBadPassword
KpsCheckKerbRequest
KpsCheckKerbResponse
KpsCheckTgsReq
KpsCreateKpsIo
KpsDerFree
KpsDoHttpCancelRequestKpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsForwardKerbRequest
KpsFreeDomainHashEntry
KpsFreeDomainTable
KpsFreeKpsIo
KpsFreeUserHashEntry
KpsFreeUserTable
KpsGetKdcBinding
KpsLookupDomainHashEntry
KpsLookupUserHashEntry
KpsPackProxyResponse
KpsProcessProxyRequest
KpsRebalanceHashTable
KpsUnpackProxyRequest
KpsUpdateDomainRediscovery
SvchostPushServiceGlobals
|
Expand for full list:
KpsCheckAsRep
KpsCheckAsReq
KpsCheckAsReqForBadPassword
KpsCheckKerbError
KpsCheckKerbErrorForBadPassword
KpsCheckKerbRequest
KpsCheckKerbResponse
KpsCheckTgsReq
KpsCreateKpsIo
KpsDerFree
KpsDoHttpCancelRequestKpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsDoSocketRecvDataLength
KpsForwardKerbRequest
KpsForwardKerbRequest
KpsFreeDomainHashEntry
KpsFreeDomainTable
KpsFreeKpsIo
KpsFreeUserHashEntry
KpsFreeUserTable
KpsGetKdcBinding
KpsLookupDomainHashEntry
KpsLookupUserHashEntry
KpsPackProxyResponse
KpsProcessProxyRequest
KpsProcessProxyRequest
KpsRebalanceHashTable
KpsUnpackProxyRequest
KpsUpdateDomainRediscovery
SvchostPushServiceGlobals
| |paramcount|4|4| |`address`|1800278a4|18002b524| |sig|undefined __fastcall WPP_SF_q(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_q(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_q Calling Diff ```diff --- WPP_SF_q calling +++ WPP_SF_q calling @@ -11,0 +12,2 @@ +KpsDoHttpCancelRequest +KpsDoHttpReceiveClientCert @@ -13,0 +16,2 @@ +KpsDoHttpReceiveRequest +KpsDoHttpReceiveRequestEntity @@ -15,0 +20,2 @@ +KpsDoHttpSendPostResponse +KpsDoSocketConnectAndSend @@ -17,0 +24 @@ +KpsDoSocketRecvData @@ -18,0 +26,2 @@ +KpsDoSocketRecvDataLength +KpsForwardKerbRequest @@ -29,0 +39 @@ +KpsProcessProxyRequest ``` ## WPP_SF_L ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.92| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WPP_SF_L|WPP_SF_L| |fullname|WPP_SF_L|WPP_SF_L| |`refcount`|148|176| |length|58|58| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |`calling`|
Expand for full list:
KpsAddDomainHashEntry
KpsAddUserHashEntry
KpsBuildUrlPrefix
KpsCheckAsRep
KpsCheckAsReq
KpsCheckAsReqForBadPassword
KpsCheckDomainJoinedMachine
KpsCheckKerbError
KpsCheckKerbErrorForBadPassword
KpsCheckKerbRequest
KpsCheckKerbResponseKpsCheckTgsReq
KpsCreateKpsIo
KpsDerFree
KpsDerPack
KpsDerUnpack
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsDumpMitRealm
KpsForwardKerbRequest
KpsGPCallback
KpsGPCheckDisallowUnprotectedPasswordAuth
KpsGPInit
KpsGPQuery
KpsGPRead
KpsGPWatchRegKey
KpsGetKdcBinding
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion_Old
KpsHttpIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpSendPostResponseIoCompletion
KpsHttpSendPostResponseIoCompletion_Old
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion_Old
KpsHttpStart
KpsKerbAddMitRealm
KpsKerbInit
KpsMitRealmDnsLookup
KpsMitRealmQuery
KpsPackProxyResponse
KpsParseMitRealmSettings
KpsParseMitServerList
KpsParseUrlPrefixList
KpsPerfInit
KpsPerfUpdate
KpsPrincipalName2UnicodeString
KpsProcessProxyRequest
KpsReadMitRealms
KpsReadMitRealmsFromRegistry
KpsReadNextMitRealmFromGroupPolicy
KpsReadNextMitRealmFromLocalPolicy
KpsRebalanceHashTable
KpsServiceCtrlHandler
KpsSocketConnectAndSendIoCompletion
KpsSocketIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsSqmFlushAll
KpsUnpackProxyRequest
KpsUpdateDomainRediscovery
KpsUtf8String2UnicodeString
KpsValidateKpasswdMessage
NetpSrvNext
NetpSrvOpen
ServiceMain
|
Expand for full list:
KpsAddDomainHashEntry
KpsAddUserHashEntry
KpsBuildUrlPrefix
KpsCheckAsRep
KpsCheckAsReq
KpsCheckAsReqForBadPassword
KpsCheckDomainJoinedMachine
KpsCheckKerbError
KpsCheckKerbErrorForBadPassword
KpsCheckKerbRequest
KpsCheckKerbResponseKpsCheckTgsReq
KpsCreateKpsIo
KpsDerFree
KpsDerPack
KpsDerUnpack
KpsDoHttpCancelRequest
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsDoSocketRecvDataLength
KpsDumpMitRealm
KpsForwardKerbRequest
KpsForwardKerbRequest
KpsGPCallback
KpsGPCheckDisallowUnprotectedPasswordAuth
KpsGPInit
KpsGPQuery
KpsGPRead
KpsGPWatchRegKey
KpsGetKdcBinding
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion_Old
KpsHttpIoCompletion
KpsHttpIoCompletion_Old
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpSendPostResponseIoCompletion
KpsHttpSendPostResponseIoCompletion
KpsHttpSendPostResponseIoCompletion_Old
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion_Old
KpsHttpStart
KpsKerbAddMitRealm
KpsKerbInit
KpsMitRealmDnsLookup
KpsMitRealmQuery
KpsPackProxyResponse
KpsParseMitRealmSettings
KpsParseMitServerList
KpsParseUrlPrefixList
KpsPerfInit
KpsPerfUpdate
KpsPrincipalName2UnicodeString
KpsProcessProxyRequest
KpsProcessProxyRequest
KpsReadMitRealms
KpsReadMitRealmsFromRegistry
KpsReadNextMitRealmFromGroupPolicy
KpsReadNextMitRealmFromLocalPolicy
KpsRebalanceHashTable
KpsServiceCtrlHandler
KpsSocketConnectAndSendIoCompletion
KpsSocketConnectAndSendIoCompletion
KpsSocketIoCompletion
KpsSocketIoCompletion_Old
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsSqmFlushAll
KpsUnpackProxyRequest
KpsUpdateDomainRediscovery
KpsUtf8String2UnicodeString
KpsValidateKpasswdMessage
NetpSrvNext
NetpSrvOpen
ServiceMain
| |paramcount|4|4| |address|18001ae38|18001ae38| |sig|undefined __fastcall WPP_SF_L(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_L(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_L Calling Diff ```diff --- WPP_SF_L calling +++ WPP_SF_L calling @@ -17,0 +18,2 @@ +KpsDoHttpCancelRequest +KpsDoHttpReceiveClientCert @@ -19,0 +22,2 @@ +KpsDoHttpReceiveRequest +KpsDoHttpReceiveRequestEntity @@ -21,0 +26,2 @@ +KpsDoHttpSendPostResponse +KpsDoHttpSendResponse @@ -23,0 +30,2 @@ +KpsDoSocketConnectAndSend +KpsDoSocketRecvData @@ -25,0 +34 @@ +KpsDoSocketRecvDataLength @@ -26,0 +36 @@ +KpsForwardKerbRequest @@ -35,0 +46 @@ +KpsHttpCancelRequestIoCompletion @@ -37,0 +49,2 @@ +KpsHttpIoCompletion_Old +KpsHttpReceiveClientCertIoCompletion @@ -40,0 +54 @@ +KpsHttpReceiveRequestEntityIoCompletion @@ -41,0 +56 @@ +KpsHttpReceiveRequestIoCompletion @@ -44,0 +60 @@ +KpsHttpSendPostResponseIoCompletion @@ -45,0 +62 @@ +KpsHttpSendResponseIoCompletion @@ -60,0 +78 @@ +KpsProcessProxyRequest @@ -67,0 +86 @@ +KpsSocketConnectAndSendIoCompletion @@ -68,0 +88 @@ +KpsSocketIoCompletion_Old @@ -69,0 +90,2 @@ +KpsSocketRecvDataIoCompletion +KpsSocketRecvDataLengthIoCompletion ``` ## HTTPAPI.DLL::HttpSendHttpResponse ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|HttpSendHttpResponse|HttpSendHttpResponse| |fullname|HTTPAPI.DLL::HttpSendHttpResponse|HTTPAPI.DLL::HttpSendHttpResponse| |`refcount`|3|5| |length|0|0| |called||| |`calling`|KpsDoHttpSendPostResponse
KpsDoHttpSendResponse|KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoHttpSendResponse| |paramcount|0|0| |address|EXTERNAL:000000ef|EXTERNAL:000000ef| |sig|undefined HttpSendHttpResponse(void)|undefined HttpSendHttpResponse(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### HTTPAPI.DLL::HttpSendHttpResponse Calling Diff ```diff --- HTTPAPI.DLL::HttpSendHttpResponse calling +++ HTTPAPI.DLL::HttpSendHttpResponse calling @@ -0,0 +1 @@ +KpsDoHttpSendPostResponse @@ -2,0 +4 @@ +KpsDoHttpSendResponse ``` ## API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|GetLastError|GetLastError| |fullname|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError| |`refcount`|37|38| |length|0|0| |called||| |`calling`|
Expand for full list:
KpsDoSocketConnectAndSend
KpsGPCallback
KpsGPInit
KpsHttpStart
KpsPerfInit
KpsServiceReady
KpsServiceStopCallback
KpsUtf8String2UnicodeString
ServiceMain
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureStateManager::EnsureStateDatawil::details::FeatureStateManager::EnsureTimerUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::GetLastErrorFail
wil::details::GetLastErrorFailHr
wil::details::ReportFailure_GetLastErrorHr<1>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::SemaphoreValue::CreateFromPointer
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::heap_buffer::reserve
|
Expand for full list:
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsGPCallback
KpsGPInit
KpsHttpStart
KpsPerfInit
KpsServiceReady
KpsServiceStopCallback
KpsUtf8String2UnicodeString
ServiceMain
wil::details::EnabledStateManager::QueueBackgroundUsageReportingwil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureTimerUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::GetLastErrorFail
wil::details::GetLastErrorFailHr
wil::details::ReportFailure_GetLastErrorHr<1>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::SemaphoreValue::CreateFromPointer
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::heap_buffer::reserve
| |paramcount|0|0| |address|EXTERNAL:00000036|EXTERNAL:00000036| |sig|DWORD __stdcall GetLastError(void)|DWORD __stdcall GetLastError(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError Calling Diff ```diff --- API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError calling +++ API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError calling @@ -0,0 +1 @@ +KpsDoSocketConnectAndSend ``` ## KpsStartTimeoutTimer ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.79| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsStartTimeoutTimer|KpsStartTimeoutTimer| |fullname|KpsStartTimeoutTimer|KpsStartTimeoutTimer| |`refcount`|15|29| |length|68|68| |called|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolWait|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolWait| |`calling`|
Expand for full list:
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveRequestEntityIoCompletionKpsHttpReceiveRequestIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
|
Expand for full list:
KpsDoHttpCancelRequest
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsDoHttpSendResponseKpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsDoSocketRecvDataLength
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsSocketRecvDataLengthIoCompletion
| |paramcount|1|1| |`address`|1800237f8|1800272e8| |sig|void __cdecl KpsStartTimeoutTimer(_KPS_IO * param_1)|void __cdecl KpsStartTimeoutTimer(_KPS_IO * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsStartTimeoutTimer Calling Diff ```diff --- KpsStartTimeoutTimer calling +++ KpsStartTimeoutTimer calling @@ -0,0 +1 @@ +KpsDoHttpCancelRequest @@ -2,0 +4,2 @@ +KpsDoHttpReceiveClientCert +KpsDoHttpReceiveRequest @@ -4,0 +8,2 @@ +KpsDoHttpReceiveRequestEntity +KpsDoHttpSendPostResponse @@ -6,0 +12,2 @@ +KpsDoHttpSendResponse +KpsDoSocketConnectAndSend @@ -8,0 +16,2 @@ +KpsDoSocketRecvData +KpsDoSocketRecvDataLength @@ -10,0 +20,2 @@ +KpsHttpReceiveClientCertIoCompletion +KpsHttpReceiveRequestEntityIoCompletion @@ -12,0 +24,2 @@ +KpsHttpReceiveRequestIoCompletion +KpsSocketRecvDataIoCompletion @@ -14,0 +28 @@ +KpsSocketRecvDataLengthIoCompletion ``` ## WS2_32.DLL::WSARecv ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WSARecv|WSARecv| |fullname|WS2_32.DLL::WSARecv|WS2_32.DLL::WSARecv| |`refcount`|5|9| |length|0|0| |called||| |`calling`|KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion|KpsDoSocketRecvData
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsDoSocketRecvDataLength
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsSocketRecvDataLengthIoCompletion| |paramcount|0|0| |address|EXTERNAL:00000051|EXTERNAL:00000051| |sig|undefined WSARecv(void)|undefined WSARecv(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### WS2_32.DLL::WSARecv Calling Diff ```diff --- WS2_32.DLL::WSARecv calling +++ WS2_32.DLL::WSARecv calling @@ -0,0 +1 @@ +KpsDoSocketRecvData @@ -2,0 +4,2 @@ +KpsDoSocketRecvDataLength +KpsSocketRecvDataIoCompletion @@ -4,0 +8 @@ +KpsSocketRecvDataLengthIoCompletion ``` ## WPP_SF_Dsd ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.84| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WPP_SF_Dsd|WPP_SF_Dsd| |fullname|WPP_SF_Dsd|WPP_SF_Dsd| |`refcount`|52|88| |length|143|143| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |`calling`|
Expand for full list:
KpsCheckAsReq
KpsCheckKerbResponse
KpsCreateKpsIo
KpsDerPack
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSendKpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsGetKdcBinding
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion_Old
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpSendPostResponseIoCompletion
KpsHttpSendPostResponseIoCompletion_Old
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion_Old
KpsPackProxyResponse
KpsPrincipalName2UnicodeString
KpsProcessProxyRequest
KpsSocketConnectAndSendIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsUnpackProxyRequest
KpsUtf8String2UnicodeString
KpsValidateKpasswdMessage
|
Expand for full list:
KpsCheckAsReq
KpsCheckKerbResponse
KpsCreateKpsIo
KpsDerPack
KpsDoHttpCancelRequest
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntityKpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsDoSocketRecvDataLength
KpsGetKdcBinding
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion
KpsHttpCancelRequestIoCompletion_Old
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpSendPostResponseIoCompletion
KpsHttpSendPostResponseIoCompletion
KpsHttpSendPostResponseIoCompletion_Old
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion
KpsHttpSendResponseIoCompletion_Old
KpsPackProxyResponse
KpsPrincipalName2UnicodeString
KpsProcessProxyRequest
KpsProcessProxyRequest
KpsSocketConnectAndSendIoCompletion
KpsSocketConnectAndSendIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsUnpackProxyRequest
KpsUtf8String2UnicodeString
KpsValidateKpasswdMessage
| |paramcount|5|5| |`address`|180027514|18002b194| |sig|undefined __fastcall WPP_SF_Dsd(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4, char * param_5)|undefined __fastcall WPP_SF_Dsd(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4, char * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_Dsd Calling Diff ```diff --- WPP_SF_Dsd calling +++ WPP_SF_Dsd calling @@ -5,0 +6,2 @@ +KpsDoHttpCancelRequest +KpsDoHttpReceiveClientCert @@ -7,0 +10,2 @@ +KpsDoHttpReceiveRequest +KpsDoHttpReceiveRequestEntity @@ -9,0 +14,2 @@ +KpsDoHttpSendPostResponse +KpsDoHttpSendResponse @@ -11,0 +18 @@ +KpsDoSocketConnectAndSend @@ -12,0 +20,2 @@ +KpsDoSocketRecvData +KpsDoSocketRecvDataLength @@ -15,0 +25 @@ +KpsHttpCancelRequestIoCompletion @@ -16,0 +27 @@ +KpsHttpReceiveClientCertIoCompletion @@ -19,0 +31 @@ +KpsHttpReceiveRequestEntityIoCompletion @@ -20,0 +33 @@ +KpsHttpReceiveRequestIoCompletion @@ -23,0 +37 @@ +KpsHttpSendPostResponseIoCompletion @@ -24,0 +39 @@ +KpsHttpSendResponseIoCompletion @@ -29,0 +45,2 @@ +KpsProcessProxyRequest +KpsSocketConnectAndSendIoCompletion @@ -31,0 +49,2 @@ +KpsSocketRecvDataIoCompletion +KpsSocketRecvDataLengthIoCompletion ``` ## WPP_SF_LL ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.94| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WPP_SF_LL|WPP_SF_LL| |fullname|WPP_SF_LL|WPP_SF_LL| |`refcount`|15|18| |length|72|72| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |`calling`|
Expand for full list:
KpsDoSocketRecvData
KpsGPCallback
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsReadNextMitRealmFromGroupPolicy
KpsServiceReady
KpsServiceStopCallback
KpsSocketRecvDataIoCompletion
NetpSrvNext
|
Expand for full list:
KpsDoSocketRecvData
KpsDoSocketRecvData
KpsGPCallback
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsReadNextMitRealmFromGroupPolicy
KpsServiceReadyKpsServiceStopCallback
KpsSocketRecvDataIoCompletion
NetpSrvNext
| |paramcount|4|4| |address|18001ae7c|18001ae7c| |sig|undefined __fastcall WPP_SF_LL(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_LL(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_LL Calling Diff ```diff --- WPP_SF_LL calling +++ WPP_SF_LL calling @@ -0,0 +1 @@ +KpsDoSocketRecvData @@ -3,0 +5 @@ +KpsHttpReceiveClientCertIoCompletion @@ -4,0 +7 @@ +KpsHttpReceiveRequestEntityIoCompletion ``` ## EnsureSubscribedToFeatureConfigurationChanges ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChanges|EnsureSubscribedToFeatureConfigurationChanges| |fullname|wil::details::EnsureSubscribedToFeatureConfigurationChanges|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |`refcount`|4|5| |length|215|215| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|0|0| |address|18001d144|18001d144| |sig|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### EnsureSubscribedToFeatureConfigurationChanges Calling Diff ```diff --- wil::details::EnsureSubscribedToFeatureConfigurationChanges calling +++ wil::details::EnsureSubscribedToFeatureConfigurationChanges calling @@ -2,0 +3 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_886835513>::GetCachedFeatureEnabledState ``` ## HTTPAPI.DLL::HttpReceiveRequestEntityBody ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|HttpReceiveRequestEntityBody|HttpReceiveRequestEntityBody| |fullname|HTTPAPI.DLL::HttpReceiveRequestEntityBody|HTTPAPI.DLL::HttpReceiveRequestEntityBody| |`refcount`|4|6| |length|0|0| |called||| |`calling`|KpsDoHttpReceiveRequestEntity
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old|KpsDoHttpReceiveRequestEntity
KpsDoHttpReceiveRequestEntity
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old| |paramcount|0|0| |address|EXTERNAL:000000ee|EXTERNAL:000000ee| |sig|undefined HttpReceiveRequestEntityBody(void)|undefined HttpReceiveRequestEntityBody(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### HTTPAPI.DLL::HttpReceiveRequestEntityBody Calling Diff ```diff --- HTTPAPI.DLL::HttpReceiveRequestEntityBody calling +++ HTTPAPI.DLL::HttpReceiveRequestEntityBody calling @@ -0,0 +1 @@ +KpsDoHttpReceiveRequestEntity @@ -2,0 +4 @@ +KpsHttpReceiveRequestEntityIoCompletion ``` ## ReportUsageToServiceDirect ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.65| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|ReportUsageToServiceDirect|ReportUsageToServiceDirect| |fullname|wil::details::ReportUsageToServiceDirect|wil::details::ReportUsageToServiceDirect| |`refcount`|3|2| |length|453|453| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil_details_FeatureReporting_RecordUsageInCache|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil_details_FeatureReporting_RecordUsageInCache| |`calling`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::ReportUsage
wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage|wil::details::ReportUsageToService| |paramcount|8|8| |`address`|180025850|1800292d4| |sig|int __cdecl ReportUsageToServiceDirect(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, wil_details_ServiceReportingKind param_5, uint param_6, __uint64 param_7, uchar param_8)|int __cdecl ReportUsageToServiceDirect(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, wil_details_ServiceReportingKind param_5, uint param_6, __uint64 param_7, uchar param_8)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ReportUsageToServiceDirect Calling Diff ```diff --- wil::details::ReportUsageToServiceDirect calling +++ wil::details::ReportUsageToServiceDirect calling @@ -1,2 +1 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_3749982522>::ReportUsage -wil::details::FeatureImpl<__WilFeatureTraits_Feature_4205429049>::ReportUsage +wil::details::ReportUsageToService ``` ## KpsGetKdcBinding ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.64| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsGetKdcBinding|KpsGetKdcBinding| |fullname|KpsGetKdcBinding|KpsGetKdcBinding| |`refcount`|2|3| |length|2651|2651| |called|
Expand for full list:
KpsDereferenceDomainHashEntry
KpsFreeMitServerList
KpsLookupDomainHashEntry
KpsMitRealmDnsLookup
LOGONCLI.DLL::DsGetDcNameW
McGenEventWrite_EventWriteTransfer
McTemplateU0zzz_EventWriteTransfer
NETUTILS.DLL::NetApiBufferFree
NTDLL.DLL::RtlDuplicateUnicodeString
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlInitUnicodeStringNTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_
WPP_SF_DDsd
WPP_SF_DZd
WPP_SF_DZsd
WPP_SF_Dsd
WPP_SF_L
WPP_SF_Z
WPP_SF_ZD
WPP_SF_dDsd
WPP_SF_q
WS2_32.DLL::FreeAddrInfoW
WS2_32.DLL::GetAddrInfoW
__security_check_cookie
|
Expand for full list:
KpsDereferenceDomainHashEntry
KpsFreeMitServerList
KpsLookupDomainHashEntry
KpsMitRealmDnsLookup
LOGONCLI.DLL::DsGetDcNameW
McGenEventWrite_EventWriteTransfer
McTemplateU0zzz_EventWriteTransfer
NETUTILS.DLL::NetApiBufferFree
NTDLL.DLL::RtlDuplicateUnicodeString
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlInitUnicodeStringNTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_
WPP_SF_DDsd
WPP_SF_DZd
WPP_SF_DZsd
WPP_SF_Dsd
WPP_SF_L
WPP_SF_Z
WPP_SF_ZD
WPP_SF_dDsd
WPP_SF_q
WS2_32.DLL::FreeAddrInfoW
WS2_32.DLL::GetAddrInfoW
__security_check_cookie
| |`calling`|KpsForwardKerbRequest|KpsForwardKerbRequest
KpsForwardKerbRequest| |paramcount|1|1| |`address`|180029cf4|18002d974| |sig|ulong __cdecl KpsGetKdcBinding(_KPS_IO * param_1)|ulong __cdecl KpsGetKdcBinding(_KPS_IO * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsGetKdcBinding Calling Diff ```diff --- KpsGetKdcBinding calling +++ KpsGetKdcBinding calling @@ -1,0 +2 @@ +KpsForwardKerbRequest ``` ## KpsServiceReady ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.64| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsServiceReady|KpsServiceReady| |fullname|KpsServiceReady|KpsServiceReady| |`refcount`|13|25| |length|126|126| |called|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::WaitForSingleObject
WPP_SF_LL|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::WaitForSingleObject
WPP_SF_LL| |`calling`|
Expand for full list:
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsHttpIoCompletion
KpsSocketIoCompletion
|
Expand for full list:
KpsDoHttpCancelRequest
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsDoHttpSendResponseKpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsDoSocketRecvDataLength
KpsHttpIoCompletion
KpsHttpIoCompletion_Old
KpsSocketIoCompletion
KpsSocketIoCompletion_Old
| |paramcount|0|0| |`address`|18002d74c|1800313cc| |sig|uchar __cdecl KpsServiceReady(void)|uchar __cdecl KpsServiceReady(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsServiceReady Calling Diff ```diff --- KpsServiceReady calling +++ KpsServiceReady calling @@ -0,0 +1 @@ +KpsDoHttpCancelRequest @@ -2,0 +4,2 @@ +KpsDoHttpReceiveClientCert +KpsDoHttpReceiveRequest @@ -4,0 +8,2 @@ +KpsDoHttpReceiveRequestEntity +KpsDoHttpSendPostResponse @@ -6,0 +12,2 @@ +KpsDoHttpSendResponse +KpsDoSocketConnectAndSend @@ -8,0 +16,2 @@ +KpsDoSocketRecvData +KpsDoSocketRecvDataLength @@ -10,0 +20 @@ +KpsHttpIoCompletion_Old @@ -11,0 +22 @@ +KpsSocketIoCompletion_Old ``` ## __security_check_cookie ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|44|52| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
KpsCheckDomainJoinedMachine
KpsDoHttpReceiveRequest
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsGPInit
KpsGPRead
KpsGetKdcBinding
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletionKpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpShutdown
KpsHttpStart
KpsMitRealmDnsLookup
KpsParseMitRealmSettings
KpsReadNextMitRealmFromGroupPolicy
KpsReadNextMitRealmFromLocalPolicy
KpsServiceStopCallback
McTemplateU0qqqqqqq_EventWriteTransfer
McTemplateU0zq_EventWriteTransfer
McTemplateU0zz_EventWriteTransfer
McTemplateU0zzqq_EventWriteTransfer
McTemplateU0zzz_EventWriteTransfer
NetpSrvOpen
ServiceMain
__GSHandlerCheckCommon
wil::GetFailureLogString
wil::details::EnabledStateManager::RecordCachedUsageUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::GetModuleInformation
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromPointer
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::UsageIndexes::Record
wil_QueryFeatureState
wil_details_WriteSRUMWnfUsageBuffer
|
Expand for full list:
KpsCheckDomainJoinedMachine
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsGPInit
KpsGPReadKpsGetKdcBinding
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpShutdown
KpsHttpStart
KpsMitRealmDnsLookup
KpsParseMitRealmSettings
KpsReadNextMitRealmFromGroupPolicy
KpsReadNextMitRealmFromLocalPolicy
KpsServiceStopCallback
McTemplateU0qqqqqqq_EventWriteTransfer
McTemplateU0qz_EventWriteTransfer
McTemplateU0zq_EventWriteTransfer
McTemplateU0zz_EventWriteTransfer
McTemplateU0zzqq_EventWriteTransfer
McTemplateU0zzz_EventWriteTransfer
NetpSrvOpen
ServiceMain
__GSHandlerCheckCommon
wil::GetFailureLogString
wil::details::EnabledStateManager::RecordCachedUsageUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::GetModuleInformation
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromPointer
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::UsageIndexes::Record
wil_QueryFeatureState
wil_details_WriteSRUMWnfUsageBuffer
| |paramcount|1|1| |`address`|180031b50|1800357d0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -2,0 +3,2 @@ +KpsDoHttpReceiveRequest +KpsDoHttpSendPostResponse @@ -4,0 +7,2 @@ +KpsDoHttpSendResponse +KpsDoSocketConnectAndSend @@ -9,0 +14 @@ +KpsHttpReceiveClientCertIoCompletion @@ -11,0 +17 @@ +KpsHttpReceiveRequestEntityIoCompletion @@ -12,0 +19 @@ +KpsHttpReceiveRequestIoCompletion @@ -22,0 +30 @@ +McTemplateU0qz_EventWriteTransfer ``` ## WPP_SF_ZDsd ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WPP_SF_ZDsd|WPP_SF_ZDsd| |fullname|WPP_SF_ZDsd|WPP_SF_ZDsd| |`refcount`|5|7| |length|246|246| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |`calling`|KpsCheckKerbErrorForBadPassword
KpsDoSocketConnectAndSend
KpsSocketConnectAndSendIoCompletion
KpsUpdateDomainRediscovery|KpsCheckKerbErrorForBadPassword
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsSocketConnectAndSendIoCompletion
KpsSocketConnectAndSendIoCompletion
KpsUpdateDomainRediscovery| |paramcount|6|6| |`address`|1800276cc|18002b34c| |sig|undefined __fastcall WPP_SF_ZDsd(undefined8 param_1, undefined2 param_2, undefined8 param_3, wchar_t * param_4, undefined8 param_5, char * param_6)|undefined __fastcall WPP_SF_ZDsd(undefined8 param_1, undefined2 param_2, undefined8 param_3, wchar_t * param_4, undefined8 param_5, char * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_ZDsd Calling Diff ```diff --- WPP_SF_ZDsd calling +++ WPP_SF_ZDsd calling @@ -2,0 +3,2 @@ +KpsDoSocketConnectAndSend +KpsSocketConnectAndSendIoCompletion ``` ## KpsUpdateDomainRediscovery ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.66| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|KpsUpdateDomainRediscovery|KpsUpdateDomainRediscovery| |fullname|KpsUpdateDomainRediscovery|KpsUpdateDomainRediscovery| |`refcount`|2|3| |length|521|521| |called|
Expand for full list:
KpsAddDomainHashEntry
KpsDereferenceDomainHashEntry
KpsLookupDomainHashEntry
KpsRebalanceHashTable
KpsSqmIncrement
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_L
WPP_SF_ZDsd
WPP_SF_ddd
WPP_SF_qWPP_SF_qZ
|
Expand for full list:
KpsAddDomainHashEntry
KpsDereferenceDomainHashEntry
KpsLookupDomainHashEntry
KpsRebalanceHashTable
KpsSqmIncrement
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
WPP_SF_L
WPP_SF_ZDsd
WPP_SF_ddd
WPP_SF_qWPP_SF_qZ
| |`calling`|KpsSocketConnectAndSendIoCompletion|KpsSocketConnectAndSendIoCompletion
KpsSocketConnectAndSendIoCompletion| |paramcount|1|1| |`address`|18002bb4c|18002f7cc| |sig|ulong __cdecl KpsUpdateDomainRediscovery(_KPS_IO * param_1)|ulong __cdecl KpsUpdateDomainRediscovery(_KPS_IO * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### KpsUpdateDomainRediscovery Calling Diff ```diff --- KpsUpdateDomainRediscovery calling +++ KpsUpdateDomainRediscovery calling @@ -1,0 +2 @@ +KpsSocketConnectAndSendIoCompletion ``` ## WS2_32.DLL::htons ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|htons|htons| |fullname|WS2_32.DLL::htons|WS2_32.DLL::htons| |`refcount`|2|3| |length|0|0| |called||| |`calling`|KpsDoSocketConnectAndSend|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend| |paramcount|1|1| |address|EXTERNAL:00000048|EXTERNAL:00000048| |sig|u_short __stdcall htons(u_short hostshort)|u_short __stdcall htons(u_short hostshort)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### WS2_32.DLL::htons Calling Diff ```diff --- WS2_32.DLL::htons calling +++ WS2_32.DLL::htons calling @@ -1,0 +2 @@ +KpsDoSocketConnectAndSend ``` ## WS2_32.DLL::bind ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|bind|bind| |fullname|WS2_32.DLL::bind|WS2_32.DLL::bind| |`refcount`|2|3| |length|0|0| |called||| |`calling`|KpsDoSocketConnectAndSend|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend| |paramcount|3|3| |address|EXTERNAL:0000004d|EXTERNAL:0000004d| |sig|int __stdcall bind(SOCKET s, sockaddr * addr, int namelen)|int __stdcall bind(SOCKET s, sockaddr * addr, int namelen)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### WS2_32.DLL::bind Calling Diff ```diff --- WS2_32.DLL::bind calling +++ WS2_32.DLL::bind calling @@ -1,0 +2 @@ +KpsDoSocketConnectAndSend ``` ## WS2_32.DLL::closesocket ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|closesocket|closesocket| |fullname|WS2_32.DLL::closesocket|WS2_32.DLL::closesocket| |`refcount`|6|9| |length|0|0| |called||| |`calling`|KpsDoSocketConnectAndSend
KpsFreeKpsIo
KpsHttpShutdown
KpsSocketConnectAndSendIoCompletion|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsFreeKpsIo
KpsHttpShutdown
KpsSocketConnectAndSendIoCompletion
KpsSocketConnectAndSendIoCompletion| |paramcount|1|1| |address|EXTERNAL:00000050|EXTERNAL:00000050| |sig|int __stdcall closesocket(SOCKET s)|int __stdcall closesocket(SOCKET s)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### WS2_32.DLL::closesocket Calling Diff ```diff --- WS2_32.DLL::closesocket calling +++ WS2_32.DLL::closesocket calling @@ -0,0 +1 @@ +KpsDoSocketConnectAndSend @@ -4,0 +6 @@ +KpsSocketConnectAndSendIoCompletion ``` ## WS2_32.DLL::WSAGetLastError ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WSAGetLastError|WSAGetLastError| |fullname|WS2_32.DLL::WSAGetLastError|WS2_32.DLL::WSAGetLastError| |`refcount`|14|27| |length|0|0| |called||| |`calling`|KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsDoSocketRecvDataLength
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsSocketRecvDataLengthIoCompletion| |paramcount|0|0| |address|EXTERNAL:0000004b|EXTERNAL:0000004b| |sig|int __stdcall WSAGetLastError(void)|int __stdcall WSAGetLastError(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### WS2_32.DLL::WSAGetLastError Calling Diff ```diff --- WS2_32.DLL::WSAGetLastError calling +++ WS2_32.DLL::WSAGetLastError calling @@ -0,0 +1 @@ +KpsDoSocketConnectAndSend @@ -2,0 +4,2 @@ +KpsDoSocketRecvData +KpsDoSocketRecvDataLength @@ -4,0 +8 @@ +KpsSocketRecvDataIoCompletion @@ -5,0 +10 @@ +KpsSocketRecvDataLengthIoCompletion ``` ## NTDLL.DLL::RtlFreeUnicodeString ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|RtlFreeUnicodeString|RtlFreeUnicodeString| |fullname|NTDLL.DLL::RtlFreeUnicodeString|NTDLL.DLL::RtlFreeUnicodeString| |`refcount`|16|17| |length|0|0| |called||| |`calling`|KpsBuildUrlPrefix
KpsDoSocketConnectAndSend
KpsFreeDomainHashEntry
KpsFreeKpsIo
KpsFreeMitServerList
KpsFreeUserHashEntry
KpsParseMitRealmSettings
KpsReadMitRealmsFromRegistry
KpsReadNextMitRealmFromGroupPolicy
KpsReadNextMitRealmFromLocalPolicy|
Expand for full list:
KpsBuildUrlPrefix
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsFreeDomainHashEntry
KpsFreeKpsIo
KpsFreeMitServerList
KpsFreeUserHashEntry
KpsParseMitRealmSettings
KpsReadMitRealmsFromRegistry
KpsReadNextMitRealmFromGroupPolicy
KpsReadNextMitRealmFromLocalPolicy
| |paramcount|0|0| |address|EXTERNAL:000000d7|EXTERNAL:000000d7| |sig|undefined RtlFreeUnicodeString(void)|undefined RtlFreeUnicodeString(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTDLL.DLL::RtlFreeUnicodeString Calling Diff ```diff --- NTDLL.DLL::RtlFreeUnicodeString calling +++ NTDLL.DLL::RtlFreeUnicodeString calling @@ -1,0 +2 @@ +KpsDoSocketConnectAndSend ``` ## API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|CreateThreadpoolIo|CreateThreadpoolIo| |fullname|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo| |`refcount`|3|4| |length|0|0| |called||| |`calling`|KpsDoSocketConnectAndSend
KpsHttpStart|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsHttpStart| |paramcount|4|4| |address|EXTERNAL:00000061|EXTERNAL:00000061| |sig|PTP_IO __stdcall CreateThreadpoolIo(HANDLE fl, PTP_WIN32_IO_CALLBACK pfnio, PVOID pv, PTP_CALLBACK_ENVIRON pcbe)|PTP_IO __stdcall CreateThreadpoolIo(HANDLE fl, PTP_WIN32_IO_CALLBACK pfnio, PVOID pv, PTP_CALLBACK_ENVIRON pcbe)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo Calling Diff ```diff --- API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo calling +++ API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolIo calling @@ -0,0 +1 @@ +KpsDoSocketConnectAndSend ``` ## HTTPAPI.DLL::HttpReceiveHttpRequest ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|HttpReceiveHttpRequest|HttpReceiveHttpRequest| |fullname|HTTPAPI.DLL::HttpReceiveHttpRequest|HTTPAPI.DLL::HttpReceiveHttpRequest| |`refcount`|4|6| |length|0|0| |called||| |`calling`|KpsDoHttpReceiveRequest
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old|KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old| |paramcount|0|0| |address|EXTERNAL:000000e7|EXTERNAL:000000e7| |sig|undefined HttpReceiveHttpRequest(void)|undefined HttpReceiveHttpRequest(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### HTTPAPI.DLL::HttpReceiveHttpRequest Calling Diff ```diff --- HTTPAPI.DLL::HttpReceiveHttpRequest calling +++ HTTPAPI.DLL::HttpReceiveHttpRequest calling @@ -0,0 +1 @@ +KpsDoHttpReceiveRequest @@ -2,0 +4 @@ +KpsHttpReceiveRequestIoCompletion ``` ## HTTPAPI.DLL::HttpCancelHttpRequest ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|HttpCancelHttpRequest|HttpCancelHttpRequest| |fullname|HTTPAPI.DLL::HttpCancelHttpRequest|HTTPAPI.DLL::HttpCancelHttpRequest| |`refcount`|3|4| |length|0|0| |called||| |`calling`|KpsDoHttpCancelRequest
KpsTimeoutCallback|KpsDoHttpCancelRequest
KpsDoHttpCancelRequest
KpsTimeoutCallback| |paramcount|0|0| |address|EXTERNAL:000000e8|EXTERNAL:000000e8| |sig|undefined HttpCancelHttpRequest(void)|undefined HttpCancelHttpRequest(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### HTTPAPI.DLL::HttpCancelHttpRequest Calling Diff ```diff --- HTTPAPI.DLL::HttpCancelHttpRequest calling +++ HTTPAPI.DLL::HttpCancelHttpRequest calling @@ -0,0 +1 @@ +KpsDoHttpCancelRequest ``` ## API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|CancelThreadpoolIo|CancelThreadpoolIo| |fullname|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo| |`refcount`|20|35| |length|0|0| |called||| |`calling`|
Expand for full list:
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_OldKpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
|
Expand for full list:
KpsDoHttpCancelRequest
KpsDoHttpCancelRequest
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveClientCert
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequestEntity
KpsDoHttpReceiveRequestEntity
KpsDoHttpSendPostResponse
KpsDoHttpSendPostResponse
KpsDoHttpSendResponseKpsDoHttpSendResponse
KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend
KpsDoSocketRecvData
KpsDoSocketRecvData
KpsDoSocketRecvDataLength
KpsDoSocketRecvDataLength
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataIoCompletion
KpsSocketRecvDataLengthIoCompletion
KpsSocketRecvDataLengthIoCompletion
| |paramcount|1|1| |address|EXTERNAL:0000005c|EXTERNAL:0000005c| |sig|void __stdcall CancelThreadpoolIo(PTP_IO pio)|void __stdcall CancelThreadpoolIo(PTP_IO pio)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo Calling Diff ```diff --- API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo calling +++ API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CancelThreadpoolIo calling @@ -0,0 +1 @@ +KpsDoHttpCancelRequest @@ -2,0 +4,2 @@ +KpsDoHttpReceiveClientCert +KpsDoHttpReceiveRequest @@ -4,0 +8,2 @@ +KpsDoHttpReceiveRequestEntity +KpsDoHttpSendPostResponse @@ -6,0 +12,2 @@ +KpsDoHttpSendResponse +KpsDoSocketConnectAndSend @@ -8,0 +16 @@ +KpsDoSocketRecvData @@ -9,0 +18,2 @@ +KpsDoSocketRecvDataLength +KpsHttpReceiveClientCertIoCompletion @@ -12,0 +23 @@ +KpsHttpReceiveRequestEntityIoCompletion @@ -13,0 +25 @@ +KpsHttpReceiveRequestIoCompletion @@ -16,0 +29 @@ +KpsSocketRecvDataIoCompletion @@ -17,0 +31 @@ +KpsSocketRecvDataLengthIoCompletion ``` ## NTDLL.DLL::RtlEnterCriticalSection ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|RtlEnterCriticalSection|RtlEnterCriticalSection| |fullname|NTDLL.DLL::RtlEnterCriticalSection|NTDLL.DLL::RtlEnterCriticalSection| |`refcount`|17|22| |length|0|0| |called||| |`calling`|
Expand for full list:
KpsCancelTimeoutTimer
KpsCheckAsReqForBadPassword
KpsCheckKerbErrorForBadPassword
KpsCreateKpsIo
KpsFreeKpsIo
KpsGPRead
KpsGetKdcBinding
KpsHttpIoCompletion
KpsHttpShutdown
KpsKerbShutdown
KpsSocketIoCompletionKpsTimeoutCallback
KpsUpdateDomainRediscovery
|
Expand for full list:
KpsCancelTimeoutTimer
KpsCheckAsReqForBadPassword
KpsCheckKerbErrorForBadPassword
KpsCreateKpsIo
KpsFreeKpsIo
KpsGPRead
KpsGetKdcBinding
KpsHttpIoCompletion
KpsHttpIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpShutdownKpsHttpStart
KpsIoLockedRef::RemoveRef
KpsKerbShutdown
KpsSocketIoCompletion
KpsSocketIoCompletion_Old
KpsTimeoutCallback
KpsUpdateDomainRediscovery
| |paramcount|0|0| |address|EXTERNAL:000000d4|EXTERNAL:000000d4| |sig|undefined RtlEnterCriticalSection(void)|undefined RtlEnterCriticalSection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTDLL.DLL::RtlEnterCriticalSection Calling Diff ```diff --- NTDLL.DLL::RtlEnterCriticalSection calling +++ NTDLL.DLL::RtlEnterCriticalSection calling @@ -8,0 +9,2 @@ +KpsHttpIoCompletion_Old +KpsHttpReceiveRequestIoCompletion @@ -9,0 +12,2 @@ +KpsHttpStart +KpsIoLockedRef::RemoveRef @@ -11,0 +16 @@ +KpsSocketIoCompletion_Old ``` ## McGenEventWrite_EventWriteTransfer ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.87| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|McGenEventWrite_EventWriteTransfer|McGenEventWrite_EventWriteTransfer| |fullname|McGenEventWrite_EventWriteTransfer|McGenEventWrite_EventWriteTransfer| |`refcount`|30|35| |length|90|90| |called|API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL::EventWriteTransfer|API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL::EventWriteTransfer| |`calling`|
Expand for full list:
KpsCheckDomainJoinedMachine
KpsDoHttpReceiveRequest
KpsDoSocketConnectAndSend
KpsGPInit
KpsGPRead
KpsGetKdcBinding
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletionKpsHttpReceiveRequestIoCompletion_Old
KpsHttpShutdown
KpsHttpStart
KpsServiceStopCallback
McTemplateU0qqqqqqq_EventWriteTransfer
McTemplateU0zq_EventWriteTransfer
McTemplateU0zz_EventWriteTransfer
McTemplateU0zzqq_EventWriteTransfer
McTemplateU0zzz_EventWriteTransfer
ServiceMain
|
Expand for full list:
KpsCheckDomainJoinedMachine
KpsDoHttpReceiveRequest
KpsDoHttpReceiveRequest
KpsGPInit
KpsGPRead
KpsGetKdcBinding
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion
KpsHttpReceiveClientCertIoCompletion_Old
KpsHttpReceiveRequestEntityIoCompletion
KpsHttpReceiveRequestEntityIoCompletionKpsHttpReceiveRequestEntityIoCompletion_Old
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion
KpsHttpReceiveRequestIoCompletion_Old
KpsHttpShutdown
KpsHttpStart
KpsServiceStopCallback
McTemplateU0qqqqqqq_EventWriteTransfer
McTemplateU0qz_EventWriteTransfer
McTemplateU0zq_EventWriteTransfer
McTemplateU0zz_EventWriteTransfer
McTemplateU0zzqq_EventWriteTransfer
McTemplateU0zzz_EventWriteTransfer
ServiceMain
| |paramcount|5|5| |address|18001ada8|18001ada8| |sig|undefined __fastcall McGenEventWrite_EventWriteTransfer(undefined8 param_1, PCEVENT_DESCRIPTOR param_2, undefined8 param_3, ULONG param_4, PEVENT_DATA_DESCRIPTOR param_5)|undefined __fastcall McGenEventWrite_EventWriteTransfer(undefined8 param_1, PCEVENT_DESCRIPTOR param_2, undefined8 param_3, ULONG param_4, PEVENT_DATA_DESCRIPTOR param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### McGenEventWrite_EventWriteTransfer Calling Diff ```diff --- McGenEventWrite_EventWriteTransfer calling +++ McGenEventWrite_EventWriteTransfer calling @@ -3 +3 @@ -KpsDoSocketConnectAndSend +KpsDoHttpReceiveRequest @@ -7,0 +8 @@ +KpsHttpReceiveClientCertIoCompletion @@ -9,0 +11 @@ +KpsHttpReceiveRequestEntityIoCompletion @@ -10,0 +13 @@ +KpsHttpReceiveRequestIoCompletion @@ -16,0 +20 @@ +McTemplateU0qz_EventWriteTransfer ``` ## WS2_32.DLL::WSAIoctl ### Match Info |Key|kpssvc-05.dll - kpssvc-06.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|kpssvc-05.dll|kpssvc-06.dll| | :---: | :---: | :---: | |name|WSAIoctl|WSAIoctl| |fullname|WS2_32.DLL::WSAIoctl|WS2_32.DLL::WSAIoctl| |`refcount`|2|3| |length|0|0| |called||| |`calling`|KpsDoSocketConnectAndSend|KpsDoSocketConnectAndSend
KpsDoSocketConnectAndSend| |paramcount|0|0| |address|EXTERNAL:0000004f|EXTERNAL:0000004f| |sig|undefined WSAIoctl(void)|undefined WSAIoctl(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### WS2_32.DLL::WSAIoctl Calling Diff ```diff --- WS2_32.DLL::WSAIoctl calling +++ WS2_32.DLL::WSAIoctl calling @@ -1,0 +2 @@ +KpsDoSocketConnectAndSend ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-27T21:30:55