# netbt-06.sys-netbt-07.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_1180933432__private_IsEnabledDeviceUsageNoInline](#feature_1180933432__private_isenableddeviceusagenoinline) * [Feature_1180933432__private_IsEnabledFallback](#feature_1180933432__private_isenabledfallback) * [TdiDisconnect_Old](#tdidisconnect_old) * [Modified](#modified) * [DpcNextOutOfRsrcKill](#dpcnextoutofrsrckill) * [TdiDisconnect](#tdidisconnect) * [DelayedNbtDeleteDevice](#delayednbtdeletedevice) * [OutOfRsrcKill](#outofrsrckill) * [SendTcpDisconnect](#sendtcpdisconnect) * [NbtDereferenceLowerConnection](#nbtdereferencelowerconnection) * [NbtDisconnect](#nbtdisconnect) * [DelayedCleanupAfterDisconnect](#delayedcleanupafterdisconnect) * [NbtIndicateDataToClient](#nbtindicatedatatoclient) * [NextKeepAlive](#nextkeepalive) * [DisconnectDone](#disconnectdone) * [NbtDispatchPnP](#nbtdispatchpnp) * [NTReceive](#ntreceive) * [TdiConnect](#tdiconnect) * [IndicateBufferCompletion](#indicatebuffercompletion) * [NbtWorkItemPostIrpToProvider](#nbtworkitempostirptoprovider) * [RsrcKillCompletion](#rsrckillcompletion) * [TdiReceiveHandler](#tdireceivehandler) * [NbtWorkItemPostClientIrpToProvider](#nbtworkitempostclientirptoprovider) * [NbtClientSetTcpInfo](#nbtclientsettcpinfo) * [NTSend](#ntsend) * [TcpDisconnect](#tcpdisconnect) * [RemoteHashTimeout](#remotehashtimeout) * [DisableInboundConnections](#disableinboundconnections) * [NbtDeleteLowerConn](#nbtdeletelowerconn) * [NbtOpenAndAssocConnection](#nbtopenandassocconnection) * [SendCompletion](#sendcompletion) * [DisconnectLower](#disconnectlower) * [NTQueryInformation](#ntqueryinformation) * [NbtQueryWfpAndCleanupConnection](#nbtquerywfpandcleanupconnection) * [Modified (No Code Changes)](#modified-no-code-changes) * [WPP_SF_](#wpp_sf_) * [NbtFreeIrp](#nbtfreeirp) * [WPP_SF_q](#wpp_sf_q) * [DelayedWipeOutLowerconn](#delayedwipeoutlowerconn) * [NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc](#ntoskrnlexekeacquirespinlockraisetodpc) * [NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel](#ntoskrnlexekeacquirespinlockatdpclevel) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [NTOSKRNL.EXE::IoGetRelatedDeviceObject](#ntoskrnlexeiogetrelateddeviceobject) * [NTExecuteWorker](#ntexecuteworker) * [NTOSKRNL.EXE::IofCallDriver](#ntoskrnlexeiofcalldriver) * [NTOSKRNL.EXE::ExQueueWorkItem](#ntoskrnlexeexqueueworkitem) * [NTOSKRNL.EXE::KeReleaseSpinLock](#ntoskrnlexekereleasespinlock) * [WPP_SF_qddds](#wpp_sf_qddds) * [NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel](#ntoskrnlexekereleasespinlockfromdpclevel) * [NTOSKRNL.EXE::ExAllocatePool2](#ntoskrnlexeexallocatepool2) * [GetIrp](#getirp) # Visual Chart Diff ```mermaid flowchart LR DpcNextOutOfRsrcKill-3-old<--Match 98%-->DpcNextOutOfRsrcKill-3-new TdiDisconnect-6-old<--Match 95%-->TdiDisconnect-6-new DelayedNbtDeleteDevice-4-old<--Match 98%-->DelayedNbtDeleteDevice-4-new OutOfRsrcKill-2-old<--Match 87%-->OutOfRsrcKill-2-new SendTcpDisconnect-1-old<--Match 68%-->SendTcpDisconnect-1-new NbtDereferenceLowerConnection-4-old<--Match 34%-->NbtDereferenceLowerConnection-4-new NbtDisconnect-7-old<--Match 78%-->NbtDisconnect-7-new DelayedCleanupAfterDisconnect-4-old<--Match 99%-->DelayedCleanupAfterDisconnect-4-new NbtIndicateDataToClient-8-old<--Match 99%-->NbtIndicateDataToClient-8-new NextKeepAlive-1-old<--Match 98%-->NextKeepAlive-1-new DisconnectDone-2-old<--Match 45%-->DisconnectDone-2-new NbtDispatchPnP-2-old<--Match 38%-->NbtDispatchPnP-2-new NTReceive-2-old<--Match 65%-->NTReceive-2-new TdiConnect-4-old<--Match 67%-->TdiConnect-4-new IndicateBufferCompletion-3-old<--Match 65%-->IndicateBufferCompletion-3-new NbtWorkItemPostIrpToProvider-3-old<--Match 99%-->NbtWorkItemPostIrpToProvider-3-new RsrcKillCompletion-3-old<--Match 98%-->RsrcKillCompletion-3-new TdiReceiveHandler-8-old<--Match 51%-->TdiReceiveHandler-8-new NbtWorkItemPostClientIrpToProvider-2-old<--Match 99%-->NbtWorkItemPostClientIrpToProvider-2-new NbtClientSetTcpInfo-3-old<--Match 74%-->NbtClientSetTcpInfo-3-new NTSend-2-old<--Match 37%-->NTSend-2-new TcpDisconnect-4-old<--Match 64%-->TcpDisconnect-4-new RemoteHashTimeout-3-old<--Match 99%-->RemoteHashTimeout-3-new DisableInboundConnections-2-old<--Match 11%-->DisableInboundConnections-2-new NbtDeleteLowerConn-3-old<--Match 73%-->NbtDeleteLowerConn-3-new NbtOpenAndAssocConnection-4-old<--Match 47%-->NbtOpenAndAssocConnection-4-new netbt-06.sys<--5ommited-->netbt-07.sys subgraph netbt-07.sys DpcNextOutOfRsrcKill-3-new TdiDisconnect-6-new DelayedNbtDeleteDevice-4-new OutOfRsrcKill-2-new SendTcpDisconnect-1-new NbtDereferenceLowerConnection-4-new NbtDisconnect-7-new DelayedCleanupAfterDisconnect-4-new NbtIndicateDataToClient-8-new NextKeepAlive-1-new DisconnectDone-2-new NbtDispatchPnP-2-new NTReceive-2-new TdiConnect-4-new IndicateBufferCompletion-3-new NbtWorkItemPostIrpToProvider-3-new RsrcKillCompletion-3-new TdiReceiveHandler-8-new NbtWorkItemPostClientIrpToProvider-2-new NbtClientSetTcpInfo-3-new NTSend-2-new TcpDisconnect-4-new RemoteHashTimeout-3-new DisableInboundConnections-2-new NbtDeleteLowerConn-3-new NbtOpenAndAssocConnection-4-new subgraph Added direction LR Feature_1180933432__private_IsEnabledDeviceUsageNoInline Feature_1180933432__private_IsEnabledFallback TdiDisconnect_Old end end subgraph netbt-06.sys DpcNextOutOfRsrcKill-3-old TdiDisconnect-6-old DelayedNbtDeleteDevice-4-old OutOfRsrcKill-2-old SendTcpDisconnect-1-old NbtDereferenceLowerConnection-4-old NbtDisconnect-7-old DelayedCleanupAfterDisconnect-4-old NbtIndicateDataToClient-8-old NextKeepAlive-1-old DisconnectDone-2-old NbtDispatchPnP-2-old NTReceive-2-old TdiConnect-4-old IndicateBufferCompletion-3-old NbtWorkItemPostIrpToProvider-3-old RsrcKillCompletion-3-old TdiReceiveHandler-8-old NbtWorkItemPostClientIrpToProvider-2-old NbtClientSetTcpInfo-3-old NTSend-2-old TcpDisconnect-4-old RemoteHashTimeout-3-old DisableInboundConnections-2-old NbtDeleteLowerConn-3-old NbtOpenAndAssocConnection-4-old end ``` ```mermaid pie showData title Function Matches - 99.8300% "unmatched_funcs_len" : 3 "matched_funcs_len" : 1762 ``` ```mermaid pie showData title Matched Function Similarity - 96.7083% "matched_funcs_with_code_changes_len" : 30 "matched_funcs_with_non_code_changes_len" : 28 "matched_funcs_no_changes_len" : 1704 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 netbt-06.sys netbt-07.sys ``` #### Verbose Args
``` --old ['netbt-06.sys'] --new [['netbt-07.sys']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/netbt.sys/28B7309A58000/netbt.sys -O netbt.sys.x64.10.0.26100.8737 wget https://msdl.microsoft.com/download/symbols/netbt.sys/BE7E1E9159000/netbt.sys -O netbt.sys.x64.10.0.26100.8875 ``` ## Binary Metadata Diff ```diff --- netbt-06.sys Meta +++ netbt-07.sys Meta @@ -1,44 +1,44 @@ -Program Name: netbt-06.sys +Program Name: netbt-07.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 364568 +# of Bytes: 368736 # of Memory Blocks: 15 -# of Instructions: 63463 -# of Defined Data: 5583 -# of Functions: 881 -# of Symbols: 7929 +# of Instructions: 63830 +# of Defined Data: 5572 +# of Functions: 884 +# of Symbols: 7955 # of Data Types: 167 # of Data Type Categories: 12 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Fri Aug 28 15:35:19 SGT 2026 +Date Created: Fri Aug 28 15:35:25 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/netbt-06.sys -Executable MD5: b7ed58d6ea17f11ff56ddcd925111c37 -Executable SHA256: 57b9e51d0d72f00ead8f828cb5f3c148c0ea936ae6b663c808f8bb462be6c444 -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/netbt-06.sys?MD5=b7ed58d6ea17f11ff56ddcd925111c37 +Executable Location: /C:/Users/Jacob/Downloads/pdbs/netbt-07.sys +Executable MD5: d3ce55edbdd1add632eeb110e70c0e6b +Executable SHA256: 7ee6c3d274c3dbd7a5ee16268db161e8a46b08eb34b25b90b7add2ea3ca079d7 +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/netbt-07.sys?MD5=d3ce55edbdd1add632eeb110e70c0e6b PDB Age: 1 PDB File: netbt.pdb -PDB GUID: 567b2f36-aeee-572c-288e-06e9b659161c +PDB GUID: 92bfc072-db6c-6617-1b4c-e531e62b88f8 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: MBT Transport driver -PE Property[FileVersion]: 10.0.26100.8737 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8875 (WinBuild.160101.0800) PE Property[InternalName]: netbt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: netbt.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8737 +PE Property[ProductVersion]: 10.0.26100.8875 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra netbt-06.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra netbt-06.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra netbt-06.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra netbt-07.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra netbt-07.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra netbt-07.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|3| |deleted_funcs_len|0| |modified_funcs_len|58| |added_symbols_len|11| |deleted_symbols_len|8| |diff_time|16.41383719444275| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 876, 'ExternalsName': 177, 'ExactBytesFunctionHasher': 2, 'ExactInstructionsFunctionHasher': 2})| |items_to_process|80| |diff_types|Counter({'address': 44, 'length': 37, 'code': 30, 'refcount': 23, 'called': 23, 'calling': 19, 'sig': 18, 'name': 1, 'fullname': 1})| |unmatched_funcs_len|3| |total_funcs_len|1765| |matched_funcs_len|1762| |matched_funcs_with_code_changes_len|30| |matched_funcs_with_non_code_changes_len|28| |matched_funcs_no_changes_len|1704| |match_func_similarity_percent|96.7083%| |func_match_overall_percent|99.8300%| |first_matches|Counter({'SymbolsHash': 876, 'ExactBytesFunctionHasher': 2, 'ExactInstructionsFunctionHasher': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 876 "ExternalsName" : 177 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 2 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 876 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 2 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 3 "deleted_funcs_len" : 0 "modified_funcs_len" : 58 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 11 "deleted_symbols_len" : 8 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_1180933432__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|netbt-07.sys| | :---: | :---: | |name|Feature_1180933432__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1180933432__private_IsEnabledDeviceUsageNoInline| |refcount|31| |length|49| |called|Feature_1180933432__private_IsEnabledFallback| |calling|
Expand for full list:
DisableInboundConnections
DisconnectDone
DisconnectLower
IndicateBufferCompletion
NTQueryInformation
NTReceive
NTSend
NbtClientSetTcpInfo
NbtDeleteLowerConn
NbtDereferenceLowerConnection
NbtDisconnectNbtDispatchPnP
NbtIndicateDataToClient
OutOfRsrcKill
SendTcpDisconnect
TcpDisconnect
TdiConnect
TdiReceiveHandler
| |paramcount|0| |address|1400298e4| |sig|ulonglong __fastcall Feature_1180933432__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1180933432__private_IsEnabledDeviceUsageNoInline +++ Feature_1180933432__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_1180933432__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_1180933432__private_featureState; + if ((Feature_1180933432__private_featureState & 0x10) == 0) { + uVar1 = Feature_1180933432__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_1180933432__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_1180933432__private_IsEnabledFallback ### Function Meta |Key|netbt-07.sys| | :---: | :---: | |name|Feature_1180933432__private_IsEnabledFallback| |fullname|Feature_1180933432__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1180933432__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|14002991c| |sig|undefined __fastcall Feature_1180933432__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1180933432__private_IsEnabledFallback +++ Feature_1180933432__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1180933432__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1180933432__private_descriptor); + return; +} + ``` ## TdiDisconnect_Old ### Function Meta |Key|netbt-07.sys| | :---: | :---: | |name|TdiDisconnect_Old| |fullname|TdiDisconnect_Old| |refcount|2| |length|405| |called|GetIrp
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NbtFreeIrp
SubmitTdiRequest
WPP_SF_
WPP_SF_L
WPP_SF_q
_guard_dispatch_icall| |calling|TcpDisconnect| |paramcount|6| |address|14003092c| |sig|int __fastcall TdiDisconnect_Old(undefined8 * param_1, undefined8 param_2, ulonglong param_3, undefined8 param_4, longlong param_5, char param_6)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- TdiDisconnect_Old +++ TdiDisconnect_Old @@ -0,0 +1,66 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +int TdiDisconnect_Old(undefined8 *param_1,undefined8 param_2,ulonglong param_3,undefined8 param_4, + longlong param_5,char param_6) + +{ + undefined8 uVar1; + longlong lVar2; + longlong lVar3; + int iVar4; + undefined8 uVar5; + undefined8 uVar6; + longlong local_res20; + + uVar1 = *param_1; + local_res20 = 0; + uVar5 = IoGetRelatedDeviceObject(uVar1); + uVar6 = GetIrp(&local_res20); + lVar3 = local_res20; + if ((int)uVar6 < 0) { + if ((DAT_140039461 & 0x10) != 0) { + WPP_SF_(0x40c,0x10,&WPP_7f880de7eb6432df89721dc29693dbd1_Traceguids); + } + if (param_6 != '\0') { + return -0x3fffff66; + } + (*(code *)param_1[1])(param_1[2],0xc000009a,0); + } + else { + uVar6 = param_1[1]; + if (param_5 == 0) { + param_5 = local_res20; + } + *(undefined8 *)(local_res20 + 0x68) = 0; + *(undefined8 *)(local_res20 + 0x58) = uVar6; + *(undefined8 *)(local_res20 + 0x60) = param_1[2]; + lVar2 = *(longlong *)(param_5 + 0xb8); + *(code **)(lVar2 + -0x10) = TcpConnectComplete; + *(longlong *)(lVar2 + -8) = local_res20; + *(undefined1 *)(lVar2 + -0x45) = 0xe0; + lVar2 = *(longlong *)(param_5 + 0xb8); + *(undefined8 *)(lVar2 + -0x38) = 0; + *(undefined8 *)(lVar2 + -0x30) = 0; + *(undefined2 *)(lVar2 + -0x48) = 0x60f; + *(undefined8 *)(lVar2 + -0x20) = uVar5; + *(undefined8 *)(lVar2 + -0x18) = uVar1; + *(ulonglong *)(lVar2 + -0x40) = param_3 & 0xffffffff; + *(undefined8 *)(lVar2 + -0x28) = param_2; + if ((DAT_140039462 & 0x40) != 0) { + WPP_SF_q(0x416,0x11,&WPP_7f880de7eb6432df89721dc29693dbd1_Traceguids,param_5); + } + *(undefined8 *)(lVar3 + 8) = 0; + if (param_6 != '\0') { + iVar4 = SubmitTdiRequest(uVar1,param_5); + if ((iVar4 < 0) && ((DAT_140039461 & 0x10) != 0)) { + WPP_SF_L(0x40c,0x12,&WPP_7f880de7eb6432df89721dc29693dbd1_Traceguids,iVar4); + } + NbtFreeIrp(lVar3); + return iVar4; + } + IofCallDriver(uVar5); + } + return 0x103; +} + ``` # Modified *Modified functions contain code changes* ## DpcNextOutOfRsrcKill ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.93| |i_ratio|0.59| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|DpcNextOutOfRsrcKill|DpcNextOutOfRsrcKill| |fullname|DpcNextOutOfRsrcKill|DpcNextOutOfRsrcKill| |refcount|3|3| |`length`|110|113| |called|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection
OutOfRsrcKill|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection
OutOfRsrcKill| |calling||| |paramcount|3|2| |`address`|14002f4f0|14002f810| |`sig`|undefined __fastcall DpcNextOutOfRsrcKill(undefined8 param_1, longlong * param_2, undefined8 param_3)|undefined __fastcall DpcNextOutOfRsrcKill(undefined8 param_1, longlong * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DpcNextOutOfRsrcKill Diff ```diff --- DpcNextOutOfRsrcKill +++ DpcNextOutOfRsrcKill @@ -1,17 +1,17 @@ -void DpcNextOutOfRsrcKill(undefined8 param_1,longlong *param_2,undefined8 param_3) +void DpcNextOutOfRsrcKill(undefined8 param_1,longlong *param_2) { undefined1 uVar1; undefined7 uVar2; uVar2 = (undefined7)((ulonglong)param_2 >> 8); uVar1 = KeAcquireSpinLockRaiseToDpc(&DAT_0); DAT_1 = param_1; KeReleaseSpinLock(&DAT_0,uVar1); uVar1 = 6; OutOfRsrcKill(param_2,'\x06'); - NbtDereferenceLowerConnection((longlong)param_2,CONCAT71(uVar2,uVar1),param_3,0x10bc); + NbtDereferenceLowerConnection((longlong)param_2,CONCAT71(uVar2,uVar1),'\0'); return; } ``` ## TdiDisconnect ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.84| |i_ratio|0.45| |m_ratio|0.97| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|TdiDisconnect|TdiDisconnect| |fullname|TdiDisconnect|TdiDisconnect| |refcount|2|2| |`length`|405|396| |`called`|GetIrp
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NbtFreeIrp
SubmitTdiRequest
WPP_SF_
WPP_SF_D
WPP_SF_q
_guard_dispatch_icall|GetIrp
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NbtFreeIrp
SubmitTdiRequest
WPP_SF_
WPP_SF_L
WPP_SF_q
_guard_dispatch_icall| |calling|TcpDisconnect|TcpDisconnect| |paramcount|6|5| |`address`|140013a4c|140028020| |`sig`|int __fastcall TdiDisconnect(undefined8 * param_1, undefined8 param_2, ulonglong param_3, undefined8 param_4, longlong param_5, char param_6)|int __fastcall TdiDisconnect(undefined8 * param_1, undefined8 param_2, ulonglong param_3, undefined8 param_4, char param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### TdiDisconnect Called Diff ```diff --- TdiDisconnect called +++ TdiDisconnect called @@ -7 +7 @@ -WPP_SF_D +WPP_SF_L ``` ### TdiDisconnect Diff ```diff --- TdiDisconnect +++ TdiDisconnect @@ -1,66 +1,63 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ int TdiDisconnect(undefined8 *param_1,undefined8 param_2,ulonglong param_3,undefined8 param_4, - longlong param_5,char param_6) + char param_5) { undefined8 uVar1; longlong lVar2; longlong lVar3; int iVar4; undefined8 uVar5; undefined8 uVar6; longlong local_res20; uVar1 = *param_1; local_res20 = 0; uVar5 = IoGetRelatedDeviceObject(uVar1); uVar6 = GetIrp(&local_res20); lVar3 = local_res20; if ((int)uVar6 < 0) { if ((DAT_0 & 0x10) != 0) { - WPP_SF_(0x40c,0xd,&WPP_fa19288d55e93bdc32b2b8b93e71d639_Traceguids); + WPP_SF_(0x40c,0xd,&WPP_7f880de7eb6432df89721dc29693dbd1_Traceguids); } - if (param_6 != '\0') { + if (param_5 != '\0') { return -0x3fffff66; } (*(code *)param_1[1])(param_1[2],0xc000009a,0); } else { uVar6 = param_1[1]; - if (param_5 == 0) { - param_5 = local_res20; - } *(undefined8 *)(local_res20 + 0x68) = 0; *(undefined8 *)(local_res20 + 0x58) = uVar6; *(undefined8 *)(local_res20 + 0x60) = param_1[2]; - lVar2 = *(longlong *)(param_5 + 0xb8); + lVar2 = *(longlong *)(local_res20 + 0xb8); *(code **)(lVar2 + -0x10) = TcpConnectComplete; *(longlong *)(lVar2 + -8) = local_res20; *(undefined1 *)(lVar2 + -0x45) = 0xe0; - lVar2 = *(longlong *)(param_5 + 0xb8); + lVar2 = *(longlong *)(local_res20 + 0xb8); *(undefined8 *)(lVar2 + -0x38) = 0; *(undefined8 *)(lVar2 + -0x30) = 0; *(undefined2 *)(lVar2 + -0x48) = 0x60f; *(undefined8 *)(lVar2 + -0x20) = uVar5; *(undefined8 *)(lVar2 + -0x18) = uVar1; *(ulonglong *)(lVar2 + -0x40) = param_3 & 0xffffffff; *(undefined8 *)(lVar2 + -0x28) = param_2; if ((DAT_1 & 0x40) != 0) { - WPP_SF_q(0x416,0xe,&WPP_fa19288d55e93bdc32b2b8b93e71d639_Traceguids,param_5); + WPP_SF_q(0x416,0xe,&WPP_7f880de7eb6432df89721dc29693dbd1_Traceguids,local_res20); } *(undefined8 *)(lVar3 + 8) = 0; - if (param_6 != '\0') { - iVar4 = SubmitTdiRequest(uVar1,param_5); + if (param_5 != '\0') { + iVar4 = SubmitTdiRequest(uVar1,lVar3); if ((iVar4 < 0) && ((DAT_0 & 0x10) != 0)) { - WPP_SF_D(0x40c,0xf,&WPP_fa19288d55e93bdc32b2b8b93e71d639_Traceguids,iVar4); + WPP_SF_L(0x40c,0xf,&WPP_7f880de7eb6432df89721dc29693dbd1_Traceguids,iVar4); } NbtFreeIrp(lVar3); return iVar4; } IofCallDriver(uVar5); } return 0x103; } ``` ## DelayedNbtDeleteDevice ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.57| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|DelayedNbtDeleteDevice|DelayedNbtDeleteDevice| |fullname|DelayedNbtDeleteDevice|DelayedNbtDeleteDevice| |refcount|3|3| |`length`|2485|2495| |called|
Expand for full list:
CloseAddressesWithTransport
DisableInboundConnections
NBT_DEREFERENCE_DEVICE_LOWER_CONNECTION
NTIoComplete
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeSetEventNTOSKRNL.EXE::KeStackAttachProcess
NTOSKRNL.EXE::KeUnstackDetachProcess
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::PsGetCurrentProcess
NTOSKRNL.EXE::ZwClose
NbtCheckNameAddrTimer
NbtCleanUpAddress
NbtDereferenceAddress
NbtDereferenceClient
NbtDereferenceConnection
NbtDereferenceLowerConnection
NbtRemovePermanentName
StopInitTimers
StopTimer
TDI.SYS::TdiDeregisterDeviceObject
TDI.SYS::TdiDeregisterNetAddress
WPP_SF_
WPP_SF_Z
WPP_SF_ZZd
WPP_SF_q
WPP_SF_qd
WPP_SF_qddds
WPP_SF_sDqqqq
__security_check_cookie
_guard_dispatch_icall
|
Expand for full list:
CloseAddressesWithTransport
DisableInboundConnections
NBT_DEREFERENCE_DEVICE_LOWER_CONNECTION
NTIoComplete
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeSetEventNTOSKRNL.EXE::KeStackAttachProcess
NTOSKRNL.EXE::KeUnstackDetachProcess
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::PsGetCurrentProcess
NTOSKRNL.EXE::ZwClose
NbtCheckNameAddrTimer
NbtCleanUpAddress
NbtDereferenceAddress
NbtDereferenceClient
NbtDereferenceConnection
NbtDereferenceLowerConnection
NbtRemovePermanentName
StopInitTimers
StopTimer
TDI.SYS::TdiDeregisterDeviceObject
TDI.SYS::TdiDeregisterNetAddress
WPP_SF_
WPP_SF_Z
WPP_SF_ZZd
WPP_SF_q
WPP_SF_qd
WPP_SF_qddds
WPP_SF_sDqqqq
__security_check_cookie
_guard_dispatch_icall
| |calling||| |paramcount|4|4| |`address`|140015470|140014c30| |sig|undefined __fastcall DelayedNbtDeleteDevice(undefined8 param_1, longlong * * * * * * * * * * param_2, char * param_3, char * param_4)|undefined __fastcall DelayedNbtDeleteDevice(undefined8 param_1, longlong * * * * * * * * * * param_2, char * param_3, char * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DelayedNbtDeleteDevice Diff ```diff --- DelayedNbtDeleteDevice +++ DelayedNbtDeleteDevice @@ -1,402 +1,399 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void DelayedNbtDeleteDevice (undefined8 param_1,longlong **********param_2,char *param_3,char *param_4) { uint uVar1; longlong *********ppppppppplVar2; longlong **********pppppppppplVar3; code *pcVar4; - undefined1 uVar5; + char cVar5; undefined1 uVar6; - undefined4 uVar7; - longlong lVar8; - char cVar9; - char cVar10; - longlong **********pppppppppplVar11; - code **ppcVar12; - longlong **********pppppppppplVar13; - undefined8 uVar14; - undefined1 *puVar15; + undefined1 uVar7; + undefined4 uVar8; + longlong lVar9; + longlong **********pppppppppplVar10; + code **ppcVar11; + longlong **********pppppppppplVar12; + undefined8 uVar13; + undefined1 *puVar14; + longlong **********pppppppppplVar15; longlong **********pppppppppplVar16; - longlong **********pppppppppplVar17; - longlong *********ppppppppplVar18; - longlong **********pppppppppplVar19; + longlong *********ppppppppplVar17; + char cVar18; bool bVar20; undefined1 auStack_d8 [8]; undefined1 auStack_d0 [24]; longlong **********local_b8; longlong **********local_b0; longlong *********local_a8; longlong *********local_a0; longlong **********local_98; undefined1 local_88; int local_84; longlong local_80; code *local_78; longlong local_70; longlong *********local_68; undefined8 uStack_60; undefined8 local_58; undefined8 uStack_50; undefined8 local_48; undefined8 uStack_40; ulonglong local_38; + longlong **********pppppppppplVar19; - puVar15 = auStack_d8; + puVar14 = auStack_d8; local_38 = __security_cookie ^ (ulonglong)auStack_d8; *(int *)(param_2 + 0x2d) = *(int *)(param_2 + 0x2d) + 10; local_78 = (code *)0x0; local_70 = 0; - pppppppppplVar13 = param_2; + pppppppppplVar12 = param_2; if (param_2[0x49] != (longlong *********)0x0) { - uVar7 = TdiDeregisterNetAddress(); + uVar8 = TdiDeregisterNetAddress(); param_2[0x49] = (longlong *********)0x0; if ((DAT_0 & 1) != 0) { local_b8 = param_2 + 0x39; - local_b0 = (longlong **********)CONCAT44(local_b0._4_4_,uVar7); + local_b0 = (longlong **********)CONCAT44(local_b0._4_4_,uVar8); param_4 = (char *)(param_2 + 0x3b); - pppppppppplVar13 = (longlong **********)0x0; + pppppppppplVar12 = (longlong **********)0x0; param_3 = &WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids; WPP_SF_ZZd(local_b8,0x1e,&WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids,(wchar_t *)param_4); } } if (param_2[0x48] != (longlong *********)0x0) { - uVar7 = TdiDeregisterDeviceObject(); + uVar8 = TdiDeregisterDeviceObject(); param_2[0x48] = (longlong *********)0x0; if ((DAT_0 & 1) != 0) { local_b8 = param_2 + 0x39; - local_b0 = (longlong **********)CONCAT44(local_b0._4_4_,uVar7); + local_b0 = (longlong **********)CONCAT44(local_b0._4_4_,uVar8); param_4 = (char *)(param_2 + 0x3b); - pppppppppplVar13 = (longlong **********)0x0; + pppppppppplVar12 = (longlong **********)0x0; param_3 = &WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids; WPP_SF_ZZd(local_b8,0x1f,&WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids,(wchar_t *)param_4); } } if (*(int *)((longlong)param_2 + 0x154) != 1) { NbtRemovePermanentName((longlong)param_2); } if (*(int *)(param_2 + 0x3d) != 0) { if ((*(int *)((longlong)param_2 + 0x154) == 1) && ((DAT_0 & 1) != 0)) { param_4 = (char *)(param_2 + 0x3b); - pppppppppplVar13 = (longlong **********)0x0; + pppppppppplVar12 = (longlong **********)0x0; param_3 = &WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids; WPP_SF_Z(0x418,0x20,&WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids,(wchar_t *)param_4); } CloseAddressesWithTransport((longlong)param_2); KeEnterCriticalRegion(); - pppppppppplVar13 = (longlong **********)CONCAT71((int7)((ulonglong)pppppppppplVar13 >> 8),1); + pppppppppplVar12 = (longlong **********)CONCAT71((int7)((ulonglong)pppppppppplVar12 >> 8),1); ExAcquireResourceExclusiveLite(&DAT_1); - DisableInboundConnections((longlong)param_2,(ulonglong)pppppppppplVar13); + DisableInboundConnections((longlong)param_2,(longlong *)pppppppppplVar12); ExReleaseResourceLite(&DAT_1); KeLeaveCriticalRegion(); } if (param_2[0x53] != (longlong *********)0x0) { local_68 = (longlong *********)0x0; uStack_60 = 0; local_58 = 0; uStack_50 = 0; local_48 = 0; uStack_40 = 0; - lVar8 = PsGetCurrentProcess(); - bVar20 = lVar8 != NbtFspProcess; + lVar9 = PsGetCurrentProcess(); + bVar20 = lVar9 != NbtFspProcess; if (bVar20) { - pppppppppplVar13 = &local_68; - KeStackAttachProcess(NbtFspProcess,pppppppppplVar13); + pppppppppplVar12 = &local_68; + KeStackAttachProcess(NbtFspProcess,pppppppppplVar12); } ObfDereferenceObject(param_2[0x53]); if ((DAT_2 & 2) != 0) { param_4 = (char *)param_2[0x53]; - pppppppppplVar13 = (longlong **********)0x0; + pppppppppplVar12 = (longlong **********)0x0; param_3 = &WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids; WPP_SF_q(0x411,0x21,&WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids,param_4); } - uVar7 = ZwClose(param_2[0x51]); + uVar8 = ZwClose(param_2[0x51]); if ((DAT_2 & 2) != 0) { param_4 = (char *)param_2[0x51]; - pppppppppplVar13 = (longlong **********)0x0; - local_b8 = (longlong **********)CONCAT44(local_b8._4_4_,uVar7); + pppppppppplVar12 = (longlong **********)0x0; + local_b8 = (longlong **********)CONCAT44(local_b8._4_4_,uVar8); param_3 = &WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids; WPP_SF_qd(0x411,0x22,&WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids,param_4); } param_2[0x53] = (longlong *********)0x0; param_2[0x51] = (longlong *********)0x0; if (bVar20) { KeUnstackDetachProcess(&local_68); } } - uVar5 = KeAcquireSpinLockRaiseToDpc(&DAT_3); + uVar6 = KeAcquireSpinLockRaiseToDpc(&DAT_3); pppppppppplVar3 = param_2 + 0x6a; - local_88 = uVar5; - uVar6 = KeAcquireSpinLockRaiseToDpc(pppppppppplVar3); + local_88 = uVar6; + uVar7 = KeAcquireSpinLockRaiseToDpc(pppppppppplVar3); local_84 = 0; if (0 < *DAT_4) { local_80 = 0; do { - pppppppppplVar17 = (longlong **********)(local_80 + 8 + (longlong)DAT_4); - pppppppppplVar16 = (longlong **********)*pppppppppplVar17; - uVar5 = local_88; - while (pppppppppplVar16 != pppppppppplVar17) { - ppppppppplVar2 = pppppppppplVar16[0xe]; + pppppppppplVar16 = (longlong **********)(local_80 + 8 + (longlong)DAT_4); + pppppppppplVar15 = (longlong **********)*pppppppppplVar16; + uVar6 = local_88; + while (pppppppppplVar15 != pppppppppplVar16) { + ppppppppplVar2 = pppppppppplVar15[0xe]; if (((ppppppppplVar2 == (longlong *********)0x0) || (ppppppppplVar2[6] == (longlong ********)0x0)) || ((longlong **********)ppppppppplVar2[6][4] != param_2)) { - pppppppppplVar16 = (longlong **********)*pppppppppplVar16; + pppppppppplVar15 = (longlong **********)*pppppppppplVar15; } else { - pppppppppplVar16[0xe] = (longlong *********)0x0; + pppppppppplVar15[0xe] = (longlong *********)0x0; param_3 = (char *)&local_70; - ppcVar12 = &local_78; - StopTimer((longlong *)ppppppppplVar2,(longlong *)ppcVar12,(longlong *)param_3); + ppcVar11 = &local_78; + StopTimer((longlong *)ppppppppplVar2,(longlong *)ppcVar11,(longlong *)param_3); if ((DAT_5 & 0x40) != 0) { - uVar1 = *(uint *)((longlong)pppppppppplVar16 + 0x14); - param_3 = &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids; - local_a0 = (longlong *********)0x140033cb0; - ppcVar12 = (code **)0x0; + uVar1 = *(uint *)((longlong)pppppppppplVar15 + 0x14); + param_3 = &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids; + local_a0 = (longlong *********)0x140034cc0; + ppcVar11 = (code **)0x0; local_a8 = (longlong *********)CONCAT44(local_a8._4_4_,0x59f); local_b0 = (longlong **********)CONCAT44(local_b0._4_4_,uVar1 + 1); local_b8 = (longlong **********)CONCAT44(local_b8._4_4_,uVar1); - param_4 = (char *)pppppppppplVar16; - WPP_SF_qddds((ulonglong)uVar1,0xc,&WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids, - pppppppppplVar16); + param_4 = (char *)pppppppppplVar15; + WPP_SF_qddds((ulonglong)uVar1,0xd,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids, + pppppppppplVar15); } LOCK(); - *(int *)((longlong)pppppppppplVar16 + 0x14) = - *(int *)((longlong)pppppppppplVar16 + 0x14) + 1; + *(int *)((longlong)pppppppppplVar15 + 0x14) = + *(int *)((longlong)pppppppppplVar15 + 0x14) + 1; UNLOCK(); - NbtCheckNameAddrTimer((longlong)pppppppppplVar16); - uVar14 = CONCAT71((int7)((ulonglong)ppcVar12 >> 8),uVar6); - KeReleaseSpinLock(pppppppppplVar3,uVar14); - pppppppppplVar13 = (longlong **********)CONCAT71((int7)((ulonglong)uVar14 >> 8),uVar5); - KeReleaseSpinLock(&DAT_3,pppppppppplVar13); + NbtCheckNameAddrTimer((longlong)pppppppppplVar15); + uVar13 = CONCAT71((int7)((ulonglong)ppcVar11 >> 8),uVar7); + KeReleaseSpinLock(pppppppppplVar3,uVar13); + pppppppppplVar12 = (longlong **********)CONCAT71((int7)((ulonglong)uVar13 >> 8),uVar6); + KeReleaseSpinLock(&DAT_3,pppppppppplVar12); if (local_78 != (code *)0x0) { - pppppppppplVar13 = (longlong **********)0x102; + pppppppppplVar12 = (longlong **********)0x102; (*local_78)(local_70,0x102); } if ((DAT_6 & 8) != 0) { - pppppppppplVar13 = (longlong **********)0x0; + pppppppppplVar12 = (longlong **********)0x0; param_3 = &WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids; WPP_SF_(0x403,0x23,&WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids); } - uVar5 = KeAcquireSpinLockRaiseToDpc(&DAT_3); - pppppppppplVar11 = pppppppppplVar3; - uVar6 = KeAcquireSpinLockRaiseToDpc(); - pppppppppplVar19 = (longlong **********)*pppppppppplVar16; + uVar6 = KeAcquireSpinLockRaiseToDpc(&DAT_3); + pppppppppplVar10 = pppppppppplVar3; + uVar7 = KeAcquireSpinLockRaiseToDpc(); + pppppppppplVar19 = (longlong **********)*pppppppppplVar15; if ((DAT_5 & 0x40) != 0) { - pppppppppplVar13 = (longlong **********)0x0; - local_a0 = (longlong *********)0x140033cb0; + pppppppppplVar12 = (longlong **********)0x0; + local_a0 = (longlong *********)0x140034cc0; local_a8 = (longlong *********)CONCAT44(local_a8._4_4_,0x5b5); local_b0 = (longlong **********) - CONCAT44(local_b0._4_4_,*(int *)((longlong)pppppppppplVar16 + 0x14) + 1); + CONCAT44(local_b0._4_4_,*(int *)((longlong)pppppppppplVar15 + 0x14) + 1); local_b8 = (longlong **********) - CONCAT44(local_b8._4_4_,*(int *)((longlong)pppppppppplVar16 + 0x14)); - param_3 = &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids; - param_4 = (char *)pppppppppplVar16; - WPP_SF_qddds(pppppppppplVar11,0xc,&WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids, - pppppppppplVar16); + CONCAT44(local_b8._4_4_,*(int *)((longlong)pppppppppplVar15 + 0x14)); + param_3 = &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids; + param_4 = (char *)pppppppppplVar15; + WPP_SF_qddds(pppppppppplVar10,0xd,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids, + pppppppppplVar15); } LOCK(); - *(int *)((longlong)pppppppppplVar16 + 0x14) = - *(int *)((longlong)pppppppppplVar16 + 0x14) + 1; + *(int *)((longlong)pppppppppplVar15 + 0x14) = + *(int *)((longlong)pppppppppplVar15 + 0x14) + 1; UNLOCK(); - NbtCheckNameAddrTimer((longlong)pppppppppplVar16); - pppppppppplVar16 = pppppppppplVar19; + NbtCheckNameAddrTimer((longlong)pppppppppplVar15); + pppppppppplVar15 = pppppppppplVar19; } } local_84 = local_84 + 1; local_80 = local_80 + 0x10; - local_88 = uVar5; + local_88 = uVar6; } while (local_84 < *DAT_4); } - pppppppppplVar16 = (longlong **********)0x0; - pppppppppplVar13 = (longlong **********)((ulonglong)pppppppppplVar13 & 0xffffffffffffff00); + pppppppppplVar15 = (longlong **********)0x0; + pppppppppplVar12 = (longlong **********)((ulonglong)pppppppppplVar12 & 0xffffffffffffff00); KeReleaseSpinLock(pppppppppplVar3); pppppppppplVar3 = DAT_7; - pppppppppplVar17 = pppppppppplVar16; - pppppppppplVar19 = pppppppppplVar16; + pppppppppplVar16 = pppppppppplVar15; + pppppppppplVar19 = pppppppppplVar15; if ((longlong ***********)DAT_7 != &DAT_7) { do { pppppppppplVar19 = pppppppppplVar3; if ((DAT_5 & 0x40) != 0) { uVar1 = *(uint *)((longlong)pppppppppplVar19 + 0x14); - param_3 = &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids; - local_a0 = (longlong *********)0x140033cb0; - pppppppppplVar13 = (longlong **********)0x0; + param_3 = &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids; + local_a0 = (longlong *********)0x140034cc0; + pppppppppplVar12 = (longlong **********)0x0; local_a8 = (longlong *********)CONCAT44(local_a8._4_4_,0x5cc); local_b0 = (longlong **********)CONCAT44(local_b0._4_4_,uVar1 + 1); local_b8 = (longlong **********)CONCAT44(local_b8._4_4_,uVar1); param_4 = (char *)pppppppppplVar19; - WPP_SF_qddds((ulonglong)uVar1,0xe,&WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids, + WPP_SF_qddds((ulonglong)uVar1,0xf,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids, pppppppppplVar19); } LOCK(); *(int *)((longlong)pppppppppplVar19 + 0x14) = *(int *)((longlong)pppppppppplVar19 + 0x14) + 1; UNLOCK(); - if (pppppppppplVar17 != (longlong **********)0x0) { - pppppppppplVar13 = - (longlong **********)CONCAT71((int7)((ulonglong)pppppppppplVar13 >> 8),uVar5); + if (pppppppppplVar16 != (longlong **********)0x0) { + pppppppppplVar12 = + (longlong **********)CONCAT71((int7)((ulonglong)pppppppppplVar12 >> 8),uVar6); KeReleaseSpinLock(&DAT_3); - if (pppppppppplVar16 != (longlong **********)0x0) { - pppppppppplVar13 = (longlong **********)0x5db; - NbtDereferenceClient((longlong *)pppppppppplVar16,0x5db,"minio\\netbt\\sys\\nt\\ntutil.c") + if (pppppppppplVar15 != (longlong **********)0x0) { + pppppppppplVar12 = (longlong **********)0x5db; + NbtDereferenceClient((longlong *)pppppppppplVar15,0x5db,"minio\\netbt\\sys\\nt\\ntutil.c") ; - pppppppppplVar16 = (longlong **********)0x0; + pppppppppplVar15 = (longlong **********)0x0; } param_4 = "minio\\netbt\\sys\\nt\\ntutil.c"; param_3 = (char *)0x5df; NbtDereferenceAddress - ((longlong *)pppppppppplVar17,pppppppppplVar13,(undefined *)0x5df, + ((longlong *)pppppppppplVar16,pppppppppplVar12,(undefined *)0x5df, (longlong *)"minio\\netbt\\sys\\nt\\ntutil.c"); local_88 = KeAcquireSpinLockRaiseToDpc(&DAT_3); - uVar5 = local_88; + uVar6 = local_88; } pppppppppplVar3 = pppppppppplVar19 + 7; - uVar6 = KeAcquireSpinLockRaiseToDpc(pppppppppplVar3); - param_4 = (char *)CONCAT71((int7)((ulonglong)param_4 >> 8),uVar6); - for (pppppppppplVar17 = (longlong **********)pppppppppplVar19[3]; - pppppppppplVar17 != pppppppppplVar19 + 3; - pppppppppplVar17 = (longlong **********)*pppppppppplVar17) { - if ((longlong **********)pppppppppplVar17[4] == param_2) { - ppppppppplVar2 = pppppppppplVar17[3]; - ppppppppplVar18 = (longlong *********)0x0; + uVar7 = KeAcquireSpinLockRaiseToDpc(pppppppppplVar3); + param_4 = (char *)CONCAT71((int7)((ulonglong)param_4 >> 8),uVar7); + for (pppppppppplVar16 = (longlong **********)pppppppppplVar19[3]; + pppppppppplVar16 != pppppppppplVar19 + 3; + pppppppppplVar16 = (longlong **********)*pppppppppplVar16) { + if ((longlong **********)pppppppppplVar16[4] == param_2) { + ppppppppplVar2 = pppppppppplVar16[3]; + ppppppppplVar17 = (longlong *********)0x0; if ((ppppppppplVar2 != (longlong *********)0x0) && - (ppppppppplVar18 = (longlong *********)0x0, *(char *)ppppppppplVar2[0x17] == '\0')) { - pppppppppplVar17[3] = (longlong *********)0x0; - *(undefined1 *)((longlong)pppppppppplVar17 + 0x112) = 0; - ppppppppplVar18 = ppppppppplVar2; + (ppppppppplVar17 = (longlong *********)0x0, *(char *)ppppppppplVar2[0x17] == '\0')) { + pppppppppplVar16[3] = (longlong *********)0x0; + *(undefined1 *)((longlong)pppppppppplVar16 + 0x112) = 0; + ppppppppplVar17 = ppppppppplVar2; } KeReleaseSpinLock(pppppppppplVar3,(ulonglong)param_4 & 0xff); KeReleaseSpinLock(&DAT_3,local_88); - if (ppppppppplVar18 != (longlong *********)0x0) { + if (ppppppppplVar17 != (longlong *********)0x0) { param_3 = (char *)0x0; - NTIoComplete((longlong)ppppppppplVar18,0x102,0); + NTIoComplete((longlong)ppppppppplVar17,0x102,0); } if ((DAT_0 & 1) != 0) { - local_a0 = pppppppppplVar17[0x16]; + local_a0 = pppppppppplVar16[0x16]; param_4 = (char *)((longlong)pppppppppplVar19[5] + 0xa4); - local_a8 = pppppppppplVar17[0x15]; + local_a8 = pppppppppplVar16[0x15]; local_b8 = (longlong **********) CONCAT44(local_b8._4_4_,(int)*(char *)((longlong)pppppppppplVar19[5] + 0xb3)) ; - local_b0 = pppppppppplVar17; + local_b0 = pppppppppplVar16; local_98 = param_2; WPP_SF_sDqqqq(); } - if (pppppppppplVar16 != (longlong **********)0x0) { + if (pppppppppplVar15 != (longlong **********)0x0) { param_3 = "minio\\netbt\\sys\\nt\\ntutil.c"; NbtDereferenceClient - ((longlong *)pppppppppplVar16,0x612,"minio\\netbt\\sys\\nt\\ntutil.c"); - } - pppppppppplVar17[3] = (longlong *********)0x0; - pppppppppplVar13 = param_2; - NbtCleanUpAddress((longlong)pppppppppplVar17,param_2,param_3,param_4); - uVar5 = KeAcquireSpinLockRaiseToDpc(&DAT_3); - local_88 = uVar5; - uVar6 = KeAcquireSpinLockRaiseToDpc(pppppppppplVar3); - param_4 = (char *)CONCAT71((int7)((ulonglong)param_4 >> 8),uVar6); - pppppppppplVar16 = pppppppppplVar17; + ((longlong *)pppppppppplVar15,0x612,"minio\\netbt\\sys\\nt\\ntutil.c"); + } + pppppppppplVar16[3] = (longlong *********)0x0; + pppppppppplVar12 = param_2; + NbtCleanUpAddress((longlong)pppppppppplVar16,param_2,param_3,param_4); + uVar6 = KeAcquireSpinLockRaiseToDpc(&DAT_3); + local_88 = uVar6; + uVar7 = KeAcquireSpinLockRaiseToDpc(pppppppppplVar3); + param_4 = (char *)CONCAT71((int7)((ulonglong)param_4 >> 8),uVar7); + pppppppppplVar15 = pppppppppplVar16; } } if (*(int *)((longlong)param_2 + 0x154) != 1) { pppppppppplVar19[5][10] = (longlong ********)((ulonglong)pppppppppplVar19[5][10] & ~(ulonglong)param_2[0x46]); pppppppppplVar19[5][0xd] = (longlong ********)((ulonglong)pppppppppplVar19[5][0xd] & ~(ulonglong)param_2[0x46]); } ppppppppplVar2 = pppppppppplVar19[5]; if ((ppppppppplVar2[10] == (longlong ********)0x0) && ((*(uint *)(ppppppppplVar2 + 9) & 0x40) != 0)) { *(uint *)(ppppppppplVar2 + 9) = *(uint *)(ppppppppplVar2 + 9) & 0xffffff0f; *(uint *)(pppppppppplVar19[5] + 9) = *(uint *)(pppppppppplVar19[5] + 9) | 0x10; NbtCheckNameAddrTimer((longlong)pppppppppplVar19[5]); } - pppppppppplVar13 = (longlong **********)((ulonglong)pppppppppplVar13 & 0xffffffffffffff00); + pppppppppplVar12 = (longlong **********)((ulonglong)pppppppppplVar12 & 0xffffffffffffff00); KeReleaseSpinLock(pppppppppplVar19 + 7); pppppppppplVar3 = (longlong **********)*pppppppppplVar19; - pppppppppplVar17 = pppppppppplVar19; + pppppppppplVar16 = pppppppppplVar19; } while ((longlong ***********)*pppppppppplVar19 != &DAT_7); } - uVar14 = CONCAT71((int7)((ulonglong)pppppppppplVar13 >> 8),uVar5); + uVar13 = CONCAT71((int7)((ulonglong)pppppppppplVar12 >> 8),uVar6); KeReleaseSpinLock(&DAT_3); - if (pppppppppplVar16 != (longlong **********)0x0) { - param_3 = "minio\\netbt\\sys\\nt\\ntutil.c"; - uVar14 = 0x634; - NbtDereferenceClient((longlong *)pppppppppplVar16,0x634,"minio\\netbt\\sys\\nt\\ntutil.c"); + if (pppppppppplVar15 != (longlong **********)0x0) { + uVar13 = 0x634; + NbtDereferenceClient((longlong *)pppppppppplVar15,0x634,"minio\\netbt\\sys\\nt\\ntutil.c"); } if (pppppppppplVar19 != (longlong **********)0x0) { - param_3 = (char *)0x638; NbtDereferenceAddress - ((longlong *)pppppppppplVar19,uVar14,(undefined *)0x638, + ((longlong *)pppppppppplVar19,uVar13,(undefined *)0x638, (longlong *)"minio\\netbt\\sys\\nt\\ntutil.c"); } - pppppppppplVar13 = param_2 + 0x30; - while (pppppppppplVar3 = (longlong **********)*pppppppppplVar13, - pppppppppplVar3 != pppppppppplVar13) { - if (((longlong **********)pppppppppplVar3[1] != pppppppppplVar13) || + pppppppppplVar12 = param_2 + 0x30; + while (pppppppppplVar3 = (longlong **********)*pppppppppplVar12, + pppppppppplVar3 != pppppppppplVar12) { + if (((longlong **********)pppppppppplVar3[1] != pppppppppplVar12) || (ppppppppplVar2 = *pppppppppplVar3, (longlong **********)ppppppppplVar2[1] != pppppppppplVar3 )) goto LAB_8; - *pppppppppplVar13 = ppppppppplVar2; - param_3 = (char *)0x642; - ppppppppplVar2[1] = (longlong ********)pppppppppplVar13; - NbtDereferenceConnection((longlong)pppppppppplVar3,uVar14,(undefined *)0x642,0x140033cb0); - } - uVar5 = KeAcquireSpinLockRaiseToDpc(&DAT_3); - uVar6 = KeAcquireSpinLockRaiseToDpc(param_2 + 0x6a); - pppppppppplVar13 = param_2 + 0x32; - while (pppppppppplVar3 = (longlong **********)*pppppppppplVar13, - pppppppppplVar3 != pppppppppplVar13) { - if (((longlong **********)pppppppppplVar3[1] != pppppppppplVar13) || + *pppppppppplVar12 = ppppppppplVar2; + ppppppppplVar2[1] = (longlong ********)pppppppppplVar12; + NbtDereferenceConnection((longlong)pppppppppplVar3,uVar13,(undefined *)0x642,0x140034cc0); + } + uVar6 = KeAcquireSpinLockRaiseToDpc(&DAT_3); + uVar7 = KeAcquireSpinLockRaiseToDpc(param_2 + 0x6a); + pppppppppplVar12 = param_2 + 0x32; + pppppppppplVar19 = (longlong **********)0x1; + cVar18 = '\x01'; + while (pppppppppplVar3 = (longlong **********)*pppppppppplVar12, + pppppppppplVar3 != pppppppppplVar12) { + if (((longlong **********)pppppppppplVar3[1] != pppppppppplVar12) || (ppppppppplVar2 = *pppppppppplVar3, (longlong **********)ppppppppplVar2[1] != pppppppppplVar3 )) goto LAB_8; - *pppppppppplVar13 = ppppppppplVar2; - ppppppppplVar2[1] = (longlong ********)pppppppppplVar13; + *pppppppppplVar12 = ppppppppplVar2; + ppppppppplVar2[1] = (longlong ********)pppppppppplVar12; pppppppppplVar3[1] = (longlong *********)pppppppppplVar3; *pppppppppplVar3 = (longlong *********)pppppppppplVar3; if ((DAT_6 & 8) != 0) { - uVar14 = 0x25; - param_3 = &WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids; + uVar13 = 0x25; WPP_SF_q(0x403,0x25,&WPP_1d2c93b1786938b63d532dd8340deab0_Traceguids,pppppppppplVar3); } - local_b8 = (longlong **********)0x140033cb0; - NbtDereferenceLowerConnection((longlong)pppppppppplVar3,uVar14,param_3,0x650); - } - KeReleaseSpinLock(param_2 + 0x6a,uVar6); - cVar9 = '\x01'; - cVar10 = '\x01'; + local_b8 = (longlong **********)0x140034cc0; + NbtDereferenceLowerConnection((longlong)pppppppppplVar3,uVar13,'\x01'); + } + KeReleaseSpinLock(param_2 + 0x6a,uVar7); + cVar5 = '\x01'; if (*(int *)((longlong)param_2 + 0x154) == 1) goto LAB_9; DAT_10 = DAT_10 + -1; - puVar15 = auStack_d8; + puVar14 = auStack_d8; if (DAT_10 != 0) { - puVar15 = auStack_d8; + puVar14 = auStack_d8; if (DAT_10 == 1) { DAT_11 = 0; - puVar15 = auStack_d8; + puVar14 = auStack_d8; } goto LAB_12; } LAB_13: - *(undefined8 *)(puVar15 + -8) = 0x140015e21; - StopInitTimers(cVar9); + *(undefined8 *)(puVar14 + -8) = 0x1400155eb; + StopInitTimers(cVar18); LAB_12: - *(undefined8 *)(puVar15 + -8) = 0x140015902; - KeReleaseSpinLock(&DAT_3,uVar5); - *(undefined8 *)(puVar15 + -8) = 0x14001590f; + *(undefined8 *)(puVar14 + -8) = 0x1400150c6; + KeReleaseSpinLock(&DAT_3,uVar6); + *(undefined8 *)(puVar14 + -8) = 0x1400150d3; NBT_DEREFERENCE_DEVICE_LOWER_CONNECTION((longlong)param_2); - *(undefined8 *)(puVar15 + -8) = 0x140015922; + *(undefined8 *)(puVar14 + -8) = 0x1400150e6; KeSetEvent(param_2 + 0x54,0,0); - *(undefined8 *)(puVar15 + -8) = 0x140015937; + *(undefined8 *)(puVar14 + -8) = 0x1400150fb; return; LAB_8: - cVar10 = '\x03'; pcVar4 = (code *)swi(0x29); - (*pcVar4)(); - puVar15 = auStack_d0; + (*pcVar4)(3); + puVar14 = auStack_d0; + cVar5 = (char)pppppppppplVar19; LAB_9: - cVar9 = cVar10; - if (DAT_10 != 0) goto LAB_1400158f1; + cVar18 = cVar5; + if (DAT_10 != 0) goto LAB_1400150b5; goto LAB_13; } ``` ## OutOfRsrcKill ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.33| |i_ratio|0.6| |m_ratio|0.92| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|OutOfRsrcKill|OutOfRsrcKill| |fullname|OutOfRsrcKill|OutOfRsrcKill| |refcount|4|4| |`length`|675|785| |`called`|NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtLogEventDetailed
WPP_SF_q
WPP_SF_qddds|Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtLogEventDetailed
WPP_SF_q
WPP_SF_qddds| |calling|DpcNextOutOfRsrcKill
NTReceive
OutOfRsrcKillUnderLock|DpcNextOutOfRsrcKill
NTReceive
OutOfRsrcKillUnderLock| |paramcount|2|2| |`address`|140026e0c|140027898| |sig|undefined4 __fastcall OutOfRsrcKill(longlong * param_1, char param_2)|undefined4 __fastcall OutOfRsrcKill(longlong * param_1, char param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### OutOfRsrcKill Called Diff ```diff --- OutOfRsrcKill called +++ OutOfRsrcKill called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline ``` ### OutOfRsrcKill Diff ```diff --- OutOfRsrcKill +++ OutOfRsrcKill @@ -1,105 +1,138 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ undefined4 OutOfRsrcKill(longlong *param_1,char param_2) { longlong lVar1; - longlong lVar2; - longlong *plVar3; - code *pcVar4; - longlong lVar5; - undefined1 uVar6; - undefined4 uVar7; - undefined8 uVar8; - undefined8 *puVar9; - undefined1 *puVar10; + uint uVar2; + longlong lVar3; + longlong *plVar4; + code *pcVar5; + bool bVar6; + longlong lVar7; + undefined1 uVar8; + undefined4 uVar9; + ulonglong uVar10; + undefined8 uVar11; + undefined *puVar12; + undefined8 *puVar13; + undefined1 *puVar14; + bool bVar15; undefined1 auStackY_68 [8]; undefined1 auStackY_60 [24]; - puVar10 = auStackY_68; - lVar2 = param_1[5]; - lVar1 = lVar2 + 0x350; - uVar6 = KeAcquireSpinLockRaiseToDpc(lVar1); - KeAcquireSpinLockAtDpcLevel(&DAT_0); - lVar5 = _DAT_1; + puVar14 = auStackY_68; + lVar3 = param_1[5]; + lVar1 = lVar3 + 0x350; + uVar8 = KeAcquireSpinLockRaiseToDpc(lVar1); + puVar12 = &DAT_0; + KeAcquireSpinLockAtDpcLevel(); + lVar7 = _DAT_1; if ((*(byte *)(param_1 + 0xf) & 4) != 0) { +LAB_2: KeReleaseSpinLockFromDpcLevel(&DAT_0); - goto LAB_2; + goto LAB_3; } + bVar6 = true; if (((param_2 == '\x06') && (FailuresSinceLastLog = FailuresSinceLastLog + 1, param_1[3] != 0)) && - (36000000000 < (ulonglong)(_DAT_1 - _DAT_140039608))) { + (puVar12 = (undefined *)0x861c46800, + 36000000000 < (ulonglong)(_DAT_1 - _DAT_14003a648))) { + puVar12 = (undefined *)0xc00010e2; NbtLogEventDetailed(0xc00010e2,FailuresSinceLastLog,0x117,(void *)0x0,0,0); - _DAT_3 = lVar5; + _DAT_4 = lVar7; FailuresSinceLastLog = 0; } - if ((DAT_4 & 0x40) != 0) { - WPP_SF_qddds((ulonglong)*(uint *)((longlong)param_1 + 0x14),0xb, - &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,param_1); + uVar10 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar10 == 0) { + if ((DAT_5 & 0x40) != 0) { + WPP_SF_qddds((ulonglong)*(uint *)((longlong)param_1 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,param_1); + } + LOCK(); + *(int *)((longlong)param_1 + 0x14) = *(int *)((longlong)param_1 + 0x14) + 1; + UNLOCK(); } - LOCK(); - *(int *)((longlong)param_1 + 0x14) = *(int *)((longlong)param_1 + 0x14) + 1; - UNLOCK(); + else { + do { + uVar2 = *(uint *)((longlong)param_1 + 0x14); + if ((int)uVar2 < 1) { + bVar6 = false; + break; + } + puVar12 = (undefined *)(ulonglong)(uVar2 + 1); + LOCK(); + bVar15 = uVar2 == *(uint *)((longlong)param_1 + 0x14); + if (bVar15) { + *(uint *)((longlong)param_1 + 0x14) = uVar2 + 1; + } + UNLOCK(); + } while (!bVar15); + if ((DAT_5 & 0x40) != 0) { + WPP_SF_qddds(puVar12,0xc,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,param_1); + } + if (!bVar6) goto LAB_2; + } *(char *)((longlong)param_1 + 0x7d) = param_2; - lVar5 = DAT_5; - if (DAT_5 != 0) { - DAT_5 = 0; - lVar2 = param_1[6]; - uVar8 = IoGetRelatedDeviceObject(lVar2); + lVar7 = DAT_6; + if (DAT_6 != 0) { + DAT_6 = 0; + lVar3 = param_1[6]; + uVar11 = IoGetRelatedDeviceObject(lVar3); KeReleaseSpinLockFromDpcLevel(&DAT_0); - KeReleaseSpinLock(lVar1,uVar6); - lVar1 = *(longlong *)(lVar5 + 0xb8); + KeReleaseSpinLock(lVar1,uVar8); + lVar1 = *(longlong *)(lVar7 + 0xb8); *(code **)(lVar1 + -0x10) = RsrcKillCompletion; *(longlong **)(lVar1 + -8) = param_1; *(undefined1 *)(lVar1 + -0x45) = 0xe0; - lVar1 = *(longlong *)(lVar5 + 0xb8); + lVar1 = *(longlong *)(lVar7 + 0xb8); *(undefined2 *)(lVar1 + -0x48) = 0x60f; - *(undefined8 *)(lVar1 + -0x20) = uVar8; - *(longlong *)(lVar1 + -0x18) = lVar2; + *(undefined8 *)(lVar1 + -0x20) = uVar11; + *(longlong *)(lVar1 + -0x18) = lVar3; *(undefined8 *)(lVar1 + -0x40) = 2; *(undefined8 *)(lVar1 + -0x38) = 0; *(undefined8 *)(lVar1 + -0x30) = 0; *(undefined8 *)(lVar1 + -0x28) = 0; - *(undefined8 *)(lVar5 + 8) = 0; - uVar7 = IofCallDriver(uVar8,lVar5); - if ((DAT_6 & 0x40) == 0) { - return uVar7; + *(undefined8 *)(lVar7 + 8) = 0; + uVar9 = IofCallDriver(uVar11,lVar7); + if ((DAT_7 & 0x40) == 0) { + return uVar9; } - WPP_SF_q(0x40e,0x45,&WPP_a04273e783d935d2bc744d19bba9360b_Traceguids,param_1); - return uVar7; + WPP_SF_q(0x40e,0x45,&WPP_16ccfdefbad536c645c6e4aff08834b9_Traceguids,param_1); + return uVar9; } if ((*(byte *)(param_1 + 0xf) & 2) == 0) { lVar1 = *param_1; if ((*(longlong **)(lVar1 + 8) == param_1) && - (plVar3 = (longlong *)param_1[1], (longlong *)*plVar3 == param_1)) { - *plVar3 = lVar1; - *(longlong **)(lVar1 + 8) = plVar3; + (plVar4 = (longlong *)param_1[1], (longlong *)*plVar4 == param_1)) { + *plVar4 = lVar1; + *(longlong **)(lVar1 + 8) = plVar4; *(byte *)(param_1 + 0xf) = *(byte *)(param_1 + 0xf) | 2; - goto LAB_7; + goto LAB_8; } -LAB_8: - puVar9 = (undefined8 *)0x3; - pcVar4 = (code *)swi(0x29); - DAT_9 = (longlong *)(*pcVar4)(); - puVar10 = auStackY_60; +LAB_9: + puVar13 = (undefined8 *)0x3; + pcVar5 = (code *)swi(0x29); + DAT_10 = (longlong *)(*pcVar5)(); + puVar14 = auStackY_60; } else { -LAB_7: - puVar9 = &DAT_10; +LAB_8: + puVar13 = &DAT_11; param_1[1] = 0x6041; *param_1 = 0x6041; - puVar10 = auStackY_68; - if ((undefined8 *)*DAT_9 != &DAT_1400394d0) goto LAB_14002704e; + puVar14 = auStackY_68; + if ((undefined8 *)*DAT_10 != &DAT_14003a510) goto LAB_140027b30; } - *param_1 = (longlong)puVar9; - param_1[1] = (longlong)DAT_9; - *DAT_9 = (longlong)param_1; - *(undefined8 *)(puVar10 + -8) = 0x140027074; - DAT_9 = param_1; + *param_1 = (longlong)puVar13; + param_1[1] = (longlong)DAT_10; + *DAT_10 = (longlong)param_1; + *(undefined8 *)(puVar14 + -8) = 0x140027b56; + DAT_10 = param_1; KeReleaseSpinLockFromDpcLevel(&DAT_0); -LAB_2: - *(undefined8 *)(puVar10 + -8) = 0x14002708a; - KeReleaseSpinLock(lVar2 + 0x350,uVar6); +LAB_3: + *(undefined8 *)(puVar14 + -8) = 0x140027b84; + KeReleaseSpinLock(lVar3 + 0x350,uVar8); return 0; } ``` ## SendTcpDisconnect ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.65| |i_ratio|0.42| |m_ratio|0.68| |b_ratio|0.68| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|SendTcpDisconnect|SendTcpDisconnect| |fullname|SendTcpDisconnect|SendTcpDisconnect| |refcount|3|3| |`length`|63|139| |`called`|GetTracker
TcpDisconnect|Feature_1180933432__private_IsEnabledDeviceUsageNoInline
GetTracker
TcpDisconnect
WPP_SF_qddds| |calling|DisconnectHndlrNotOs
RejectSession|DisconnectHndlrNotOs
RejectSession| |paramcount|1|1| |`address`|1400220cc|14002090c| |`sig`|undefined __fastcall SendTcpDisconnect(undefined8 param_1)|undefined __fastcall SendTcpDisconnect(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SendTcpDisconnect Called Diff ```diff --- SendTcpDisconnect called +++ SendTcpDisconnect called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline @@ -2,0 +4 @@ +WPP_SF_qddds ``` ### SendTcpDisconnect Diff ```diff --- SendTcpDisconnect +++ SendTcpDisconnect @@ -1,16 +1,27 @@ -void SendTcpDisconnect(undefined8 param_1) +void SendTcpDisconnect(longlong param_1) { undefined8 uVar1; + ulonglong uVar2; longlong local_res10 [3]; local_res10[0] = 0; uVar1 = GetTracker(local_res10,0x10); if (-1 < (int)uVar1) { - *(undefined8 *)(local_res10[0] + 0x60) = param_1; + uVar2 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 != 0) { + if ((DAT_0 & 0x40) != 0) { + WPP_SF_qddds((ulonglong)*(uint *)(param_1 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,param_1); + } + LOCK(); + *(int *)(param_1 + 0x14) = *(int *)(param_1 + 0x14) + 1; + UNLOCK(); + } + *(longlong *)(local_res10[0] + 0x60) = param_1; TcpDisconnect(local_res10[0],0,4,0); } return; } ``` ## NbtDereferenceLowerConnection ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling,called| |ratio|0.12| |i_ratio|0.11| |m_ratio|0.99| |b_ratio|0.34| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtDereferenceLowerConnection|NbtDereferenceLowerConnection| |fullname|NbtDereferenceLowerConnection|NbtDereferenceLowerConnection| |`refcount`|31|37| |`length`|545|520| |`called`|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExQueueWorkItem
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
WPP_SF_qddds|Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NTQueueToWorkerThread
WPP_SF_qddds| |`calling`|
Expand for full list:
DelayedCleanupAfterDisconnect
DelayedNbtDeleteDevice
DisableInboundConnections
DpcNextOutOfRsrcKill
IndicateBufferCompletion
NTQueryInformation
NTReceive
NTSend
NbtCleanUpAddress
NbtClientIrpCompletion
NbtClientSetTcpInfoNbtConnectCommon
NbtDeleteLowerConn
NbtDereferenceConnection
NbtDispatchPnP
NbtOpenAndAssocConnection
NbtQueryWfpAndCleanupConnection
NbtWorkItemPostClientIrpToProvider
NbtWorkItemPostIrpToProvider
NextKeepAlive
RemoteHashTimeout
RsrcKillCompletion
SendCompletion
TdiReceiveHandler
|
Expand for full list:
DelayedCleanupAfterDisconnect
DelayedNbtDeleteDevice
DisableInboundConnections
DisconnectDone
DisconnectLower
DpcNextOutOfRsrcKill
IndicateBufferCompletion
NTQueryInformation
NTReceive
NTSend
NbtCleanUpAddressNbtClientIrpCompletion
NbtClientSetTcpInfo
NbtConnectCommon
NbtDeleteLowerConn
NbtDereferenceConnection
NbtDispatchPnP
NbtOpenAndAssocConnection
NbtQueryWfpAndCleanupConnection
NbtWorkItemPostClientIrpToProvider
NbtWorkItemPostIrpToProvider
NextKeepAlive
RemoteHashTimeout
RsrcKillCompletion
SendCompletion
TdiReceiveHandler
| |paramcount|4|3| |`address`|1400183f0|140017530| |`sig`|undefined __fastcall NbtDereferenceLowerConnection(longlong param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined __fastcall NbtDereferenceLowerConnection(longlong param_1, undefined8 param_2, char param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtDereferenceLowerConnection Called Diff ```diff --- NbtDereferenceLowerConnection called +++ NbtDereferenceLowerConnection called @@ -1,2 +1,2 @@ -NTOSKRNL.EXE::ExAllocatePool2 -NTOSKRNL.EXE::ExQueueWorkItem +Feature_1180933432__private_IsEnabledDeviceUsageNoInline +NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel @@ -4,0 +5,2 @@ +NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel +NTQueueToWorkerThread ``` ### NbtDereferenceLowerConnection Calling Diff ```diff --- NbtDereferenceLowerConnection calling +++ NbtDereferenceLowerConnection calling @@ -3,0 +4,2 @@ +DisconnectDone +DisconnectLower ``` ### NbtDereferenceLowerConnection Diff ```diff --- NbtDereferenceLowerConnection +++ NbtDereferenceLowerConnection @@ -1,129 +1,86 @@ -/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ - -void NbtDereferenceLowerConnection - (longlong param_1,undefined8 param_2,undefined8 param_3,longlong param_4) +void NbtDereferenceLowerConnection(longlong param_1,undefined8 param_2,char param_3) { - int *piVar1; - int iVar2; - uint uVar3; + longlong lVar1; + int *piVar2; + int iVar3; longlong lVar4; - code *pcVar5; - undefined1 uVar6; - undefined8 *puVar7; - undefined *puVar8; - ulonglong uVar9; - undefined1 *puVar10; - undefined1 *puVar11; - longlong lVar12; - undefined4 uVar13; - undefined8 uStack_50; - undefined1 auStack_48 [64]; + undefined1 uVar5; + ulonglong uVar6; + undefined *puVar7; - uVar13 = (undefined4)param_4; - puVar11 = auStack_48; - puVar10 = auStack_48; - lVar12 = param_1; - if ((DAT_1 & 0x40) != 0) goto LAB_1400185a0; - do { - uVar13 = (undefined4)param_4; - puVar8 = (undefined *)(lVar12 + 0x68); - *(undefined8 *)(puVar10 + -8) = 0x14001841d; - uVar6 = KeAcquireSpinLockRaiseToDpc(puVar8); + uVar5 = 0; + if ((DAT_0 & 0x40) != 0) { + WPP_SF_qddds(param_1,0x53,&WPP_f04ed7728b0f3cdfc366e32a01887a95_Traceguids,param_1); + } + uVar6 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 == 0) { + puVar7 = (undefined *)(param_1 + 0x68); + uVar5 = KeAcquireSpinLockRaiseToDpc(puVar7); LOCK(); - piVar1 = (int *)(lVar12 + 0x14); - iVar2 = *piVar1; - *piVar1 = *piVar1 + -1; + piVar2 = (int *)(param_1 + 0x14); + iVar3 = *piVar2; + *piVar2 = *piVar2 + -1; UNLOCK(); - if (iVar2 != 1) { -LAB_2: - *(undefined8 *)(puVar10 + -8) = 0x14001843d; - KeReleaseSpinLock(puVar8,uVar6); + if (iVar3 != 1) goto LAB_1; + LOCK(); + piVar2 = (int *)(*(longlong *)(param_1 + 0x28) + 900); + *piVar2 = *piVar2 + -1; + UNLOCK(); + lVar1 = *(longlong *)(param_1 + 0x18); + *(undefined4 *)(param_1 + 0x14) = 1000; + if ((lVar1 != 0) && + ((*(int *)(lVar1 + 0x10) == 0x316e6f43 || (*(int *)(lVar1 + 0x10) == 0x326e6f43)))) { + *(undefined4 *)(lVar1 + 0x30) = 9; + *(undefined8 *)(lVar1 + 0x18) = 0; + *(undefined8 *)(param_1 + 0x18) = 0; + *(undefined1 *)(lVar1 + 0x10b) = 9; + *(undefined1 *)(param_1 + 0x7c) = 9; + } + } + else { + if (param_3 == '\0') { + uVar5 = KeAcquireSpinLockRaiseToDpc(&DAT_2); + } + lVar1 = param_1 + 0x68; + KeAcquireSpinLockAtDpcLevel(lVar1); + LOCK(); + piVar2 = (int *)(param_1 + 0x14); + iVar3 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar3 != 1) { + KeReleaseSpinLockFromDpcLevel(lVar1); + if (param_3 != '\0') { + return; + } + puVar7 = &DAT_2; +LAB_1: + KeReleaseSpinLock(puVar7,uVar5); return; } LOCK(); - piVar1 = (int *)(*(longlong *)(lVar12 + 0x28) + 900); - *piVar1 = *piVar1 + -1; + piVar2 = (int *)(*(longlong *)(param_1 + 0x28) + 900); + *piVar2 = *piVar2 + -1; UNLOCK(); - lVar4 = *(longlong *)(lVar12 + 0x18); - *(undefined4 *)(lVar12 + 0x14) = 1000; - uVar9 = 0; - if (lVar4 != 0) { - uVar3 = *(uint *)(lVar4 + 0x10); - uVar9 = (ulonglong)uVar3; - if ((uVar3 == 0x316e6f43) || (uVar3 == 0x326e6f43)) { - *(undefined4 *)(lVar4 + 0x30) = 9; - *(undefined8 *)(lVar4 + 0x18) = 0; - *(undefined8 *)(lVar12 + 0x18) = 0; - *(undefined1 *)(lVar4 + 0x10b) = 9; - *(undefined1 *)(lVar12 + 0x7c) = 9; - } + lVar4 = *(longlong *)(param_1 + 0x18); + if ((lVar4 != 0) && + ((*(int *)(lVar4 + 0x10) == 0x316e6f43 || (*(int *)(lVar4 + 0x10) == 0x326e6f43)))) { + *(undefined4 *)(lVar4 + 0x30) = 9; + *(undefined8 *)(lVar4 + 0x18) = 0; + *(undefined8 *)(param_1 + 0x18) = 0; + *(undefined1 *)(lVar4 + 0x10b) = 9; + *(undefined1 *)(param_1 + 0x7c) = 9; } - *(undefined8 *)(puVar10 + -8) = 0x14001847e; - KeReleaseSpinLock(puVar8,CONCAT71((int7)(uVar9 >> 8),uVar6)); - puVar7 = (undefined8 *)(lVar12 + 0x80); - if ((puVar7 == (undefined8 *)0x0) || (*(int *)(lVar12 + 0xc0) != 0)) { - *(undefined8 *)(puVar10 + -8) = 0x140018580; - puVar7 = (undefined8 *)ExAllocatePool2(0x40,0x48,0x3232624e); - if (puVar7 == (undefined8 *)0x0) { - return; - } - *(undefined4 *)((longlong)puVar7 + 0x3c) = 1; - } - else { - *(undefined4 *)(lVar12 + 0xbc) = 0; - } - puVar7[2] = 0; - puVar7[4] = 0; - puVar7[5] = 0; - puVar7[6] = DelayedWipeOutLowerconn; - *(undefined4 *)(puVar7 + 8) = 1; - puVar7[3] = lVar12; - *(undefined1 *)((longlong)puVar7 + 0x44) = 0x20; - puVar7[1] = puVar7; - *puVar7 = puVar7; - *(undefined8 *)(puVar10 + -8) = 0x1400184e0; - uVar6 = KeAcquireSpinLockRaiseToDpc(&DAT_3); - lVar12 = CONCAT71((int7)((ulonglong)lVar12 >> 8),uVar6); - if ((undefined8 *)*DAT_4 == &DAT_140039680) { - *puVar7 = &DAT_5; - puVar7[1] = DAT_4; - *DAT_4 = puVar7; - iVar2 = DAT_6; - LOCK(); - _DAT_7 = _DAT_7 + 1; - UNLOCK(); - DAT_4 = puVar7; - if (DAT_8 == '\0') { - LOCK(); - DAT_6 = 1; - UNLOCK(); - if (iVar2 == 0) { - _DAT_9 = 0; - _DAT_10 = NTExecuteWorker; - _DAT_11 = &DAT_140039698; - *(undefined8 *)(puVar10 + -8) = 0x140018557; - ExQueueWorkItem(&DAT_9,0); - } - } - puVar8 = &DAT_3; - goto LAB_2; - } - param_1 = 3; - pcVar5 = (code *)swi(0x29); - (*pcVar5)(); - puVar11 = puVar10 + 8; -LAB_0: - iVar2 = *(int *)(param_1 + 0x14); - *(undefined8 *)(puVar11 + 0x38) = *(undefined8 *)(puVar11 + 0x70); - *(undefined4 *)(puVar11 + 0x30) = uVar13; - *(int *)(puVar11 + 0x28) = iVar2 + -1; - *(int *)(puVar11 + 0x20) = iVar2; - *(undefined8 *)(puVar11 + -8) = 0x1400185d5; - param_4 = lVar12; - WPP_SF_qddds(param_1,0x53,&WPP_f39b4f1c7a1330e7d55be75e5418037b_Traceguids,lVar12); - puVar10 = puVar11; - } while( true ); + KeReleaseSpinLockFromDpcLevel(lVar1); + if (param_3 != '\0') goto LAB_3; + puVar7 = &DAT_2; + } + KeReleaseSpinLock(puVar7,uVar5); +LAB_3: + NTQueueToWorkerThread + ((undefined8 *)(param_1 + 0x80),DelayedWipeOutLowerconn,0,param_1,0,0,param_3,0x20); + return; } ``` ## NbtDisconnect ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.3| |i_ratio|0.42| |m_ratio|0.93| |b_ratio|0.78| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtDisconnect|NbtDisconnect| |fullname|NbtDisconnect|NbtDisconnect| |refcount|4|4| |`length`|1436|1655| |`called`|
Expand for full list:
CleanupConnectingState
DisconnectLower
FreeRcvBuffers
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtDereferenceConnection
NbtSetCancelRoutine
RelistConnection
StopTimerWPP_SF_qddds
_guard_dispatch_icall
|
Expand for full list:
CleanupConnectingState
DisconnectLower
Feature_1180933432__private_IsEnabledDeviceUsageNoInline
FreeRcvBuffers
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtDereferenceConnection
NbtSetCancelRoutine
RelistConnectionStopTimer
WPP_SF_qddds
_guard_dispatch_icall
| |calling|NTDisconnect
NbtCleanUpConnection
NbtDisassociateAddress|NTDisconnect
NbtCleanUpConnection
NbtDisassociateAddress| |paramcount|7|7| |`address`|140012bf0|140025cfc| |`sig`|ulonglong __fastcall NbtDisconnect(undefined8 * param_1, undefined8 param_2, uint param_3, undefined * param_4, undefined8 param_5, longlong param_6, undefined1 param_7)|ulonglong __fastcall NbtDisconnect(undefined8 * param_1, ulonglong param_2, uint param_3, undefined * param_4, undefined8 param_5, longlong param_6, undefined1 param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtDisconnect Called Diff ```diff --- NbtDisconnect called +++ NbtDisconnect called @@ -2,0 +3 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline ``` ### NbtDisconnect Diff ```diff --- NbtDisconnect +++ NbtDisconnect @@ -1,203 +1,226 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -ulonglong NbtDisconnect(undefined8 *param_1,undefined8 param_2,uint param_3,undefined *param_4, +ulonglong NbtDisconnect(undefined8 *param_1,ulonglong param_2,uint param_3,undefined *param_4, undefined8 param_5,longlong param_6,undefined1 param_7) { - longlong *plVar1; - longlong lVar2; + int iVar1; + longlong *plVar2; longlong lVar3; longlong lVar4; - uint uVar5; - undefined1 uVar6; - int iVar7; - undefined4 extraout_var; + longlong lVar5; + uint uVar6; + undefined1 uVar7; longlong *plVar8; undefined8 uVar9; ulonglong uVar10; ulonglong uVar11; ulonglong local_res8; - undefined8 local_res10; + ulonglong local_res10; code *local_res20; - plVar1 = (longlong *)*param_1; + plVar2 = (longlong *)*param_1; + uVar11 = 0; param_5._0_4_ = 0; - iVar7 = 0; + uVar10 = 0; local_res8 = local_res8 & 0xffffffffffffff00; local_res10 = param_2; local_res20 = (code *)param_4; - uVar6 = KeAcquireSpinLockRaiseToDpc(&DAT_0); - if (*(char *)((longlong)plVar1 + 0x10c) == '\0') { - *(undefined1 *)((longlong)plVar1 + 0x10c) = param_7; - } - local_res20._0_1_ = uVar6; - if ((int)plVar1[6] - 2U < 6) { - plVar8 = plVar1 + 0x1f; + uVar7 = KeAcquireSpinLockRaiseToDpc(&DAT_0); + if (*(char *)((longlong)plVar2 + 0x10c) == '\0') { + *(undefined1 *)((longlong)plVar2 + 0x10c) = param_7; + } + local_res20._0_1_ = uVar7; + if ((int)plVar2[6] - 2U < 6) { + plVar8 = plVar2 + 0x1f; KeAcquireSpinLockAtDpcLevel(); - lVar2 = plVar1[0x16]; - lVar3 = plVar1[3]; - plVar1[0x16] = 0; + lVar3 = plVar2[0x16]; + lVar4 = plVar2[3]; + plVar2[0x16] = 0; if (param_3 != 1) { - if (lVar3 == 0) { + if (lVar4 == 0) { KeReleaseSpinLockFromDpcLevel(plVar8); - KeReleaseSpinLock(&DAT_0,uVar6); + KeReleaseSpinLock(&DAT_0,uVar7); } else { - iVar7 = (int)plVar1[6]; - if (iVar7 < 2) { - plVar1[3] = 0; - *(undefined8 *)(lVar3 + 0x18) = 0; - *(undefined1 *)((longlong)plVar1 + 0x10b) = 8; - *(undefined1 *)(lVar3 + 0x7c) = 8; - KeReleaseSpinLockFromDpcLevel(plVar8); - KeReleaseSpinLock(&DAT_0,uVar6); + iVar1 = (int)plVar2[6]; + if (iVar1 < 2) { + plVar2[3] = 0; + *(undefined8 *)(lVar4 + 0x18) = 0; + *(undefined1 *)((longlong)plVar2 + 0x10b) = 8; + *(undefined1 *)(lVar4 + 0x7c) = 8; + uVar10 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar10 != 0) { + if ((DAT_1 & 0x40) != 0) { + WPP_SF_qddds((ulonglong)*(uint *)(lVar4 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar4); + } + LOCK(); + *(int *)(lVar4 + 0x14) = *(int *)(lVar4 + 0x14) + 1; + UNLOCK(); + uVar7 = local_res20._0_1_; + } + KeReleaseSpinLockFromDpcLevel(plVar2 + 0x1f); + KeReleaseSpinLock(&DAT_0,uVar7); } else { - lVar4 = plVar1[0x17]; - if (iVar7 == 2) { - *(uint *)(lVar4 + 0xf0) = *(uint *)(lVar4 + 0xf0) | 0x40; + lVar5 = plVar2[0x17]; + if (iVar1 == 2) { + *(uint *)(lVar5 + 0xf0) = *(uint *)(lVar5 + 0xf0) | 0x40; KeReleaseSpinLockFromDpcLevel(plVar8); - KeReleaseSpinLock(&DAT_0,uVar6); + KeReleaseSpinLock(&DAT_0,uVar7); local_res20._0_1_ = KeAcquireSpinLockRaiseToDpc(plVar8); - FreeRcvBuffers((longlong)plVar1,(undefined1 *)&local_res20); - uVar6 = local_res20._0_1_; -LAB_1: - KeReleaseSpinLock(plVar8,uVar6); + FreeRcvBuffers((longlong)plVar2,(undefined1 *)&local_res20); + uVar7 = local_res20._0_1_; +LAB_2: + KeReleaseSpinLock(plVar8,uVar7); return 0; } - if (iVar7 == 3) { - uVar11 = CleanupConnectingState((longlong)plVar1,param_2,uVar6); - uVar10 = uVar11 & 0xffffffff; - if ((int)uVar11 == -0x3fffffff) { - *(undefined4 *)(lVar4 + 0xf0) = 0x40; - if (lVar2 == 0) { - plVar1[0x16] = param_6; + if (iVar1 == 3) { + uVar10 = CleanupConnectingState((longlong)plVar2,param_2,uVar7); + uVar11 = uVar10 & 0xffffffff; + if ((int)uVar10 == -0x3fffffff) { + *(undefined4 *)(lVar5 + 0xf0) = 0x40; + if (lVar3 == 0) { + plVar2[0x16] = param_6; } - uVar10 = 0x103; -LAB_2: - KeReleaseSpinLockFromDpcLevel(plVar1 + 0x1f); - KeReleaseSpinLock(&DAT_0,uVar6); - return uVar10; - } - if ((int)uVar11 != 0x103) goto LAB_2; - *(undefined4 *)(lVar4 + 0xf0) = 0x40; - if ((DAT_3 & 0x40) != 0) { + uVar11 = 0x103; +LAB_3: + KeReleaseSpinLockFromDpcLevel(plVar2 + 0x1f); + KeReleaseSpinLock(&DAT_0,uVar7); + return uVar11; + } + if ((int)uVar10 != 0x103) goto LAB_3; + *(undefined4 *)(lVar5 + 0xf0) = 0x40; + if ((DAT_1 & 0x40) != 0) { param_2 = 0; - WPP_SF_qddds((ulonglong)*(uint *)(lVar3 + 0x14),0xb, - &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,lVar3); + WPP_SF_qddds((ulonglong)*(uint *)(lVar4 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar4); } LOCK(); - *(int *)(lVar3 + 0x14) = *(int *)(lVar3 + 0x14) + 1; + *(int *)(lVar4 + 0x14) = *(int *)(lVar4 + 0x14) + 1; UNLOCK(); - uVar6 = local_res20._0_1_; - } - else if (iVar7 == 6) { - plVar1 = *(longlong **)(lVar4 + 0x98); - if (plVar1 != (longlong *)0x0) { + uVar7 = local_res20._0_1_; + } + else if (iVar1 == 6) { + plVar2 = *(longlong **)(lVar5 + 0x98); + if (plVar2 != (longlong *)0x0) { local_res20 = (code *)0x0; local_res8 = 0; - *(undefined8 *)(lVar4 + 0x98) = 0; + *(undefined8 *)(lVar5 + 0x98) = 0; KeReleaseSpinLockFromDpcLevel(plVar8); - StopTimer(plVar1,(longlong *)&local_res20,(longlong *)&local_res8); - KeReleaseSpinLock(&DAT_0,uVar6); + StopTimer(plVar2,(longlong *)&local_res20,(longlong *)&local_res8); + KeReleaseSpinLock(&DAT_0,uVar7); if (local_res20 == (code *)0x0) { return 0; } (*local_res20)(local_res8,0xc0000120); return 0; } - *(uint *)(lVar4 + 0xf0) = *(uint *)(lVar4 + 0xf0) | 0x40; + *(uint *)(lVar5 + 0xf0) = *(uint *)(lVar5 + 0xf0) | 0x40; KeReleaseSpinLockFromDpcLevel(plVar8); plVar8 = (longlong *)&DAT_0; - goto LAB_1; - } - KeAcquireSpinLockAtDpcLevel(lVar3 + 0x68); - lVar2 = plVar1[6]; - *(undefined4 *)(plVar1 + 6) = 1; - uVar5 = 2; - if ((int)lVar2 == 7) { - uVar5 = param_3; - } - param_3 = uVar5; - plVar1[3] = 0; - *(undefined8 *)(lVar3 + 0x18) = 0; - *(undefined1 *)((longlong)plVar1 + 0x10b) = 7; - param_5._0_4_ = *(int *)(lVar3 + 0x58); - *(byte *)(lVar3 + 0x78) = *(byte *)(lVar3 + 0x78) | 0x10; - *(code **)(lVar3 + 200) = RejectAnyData; - *(undefined1 *)(lVar3 + 0x7c) = 7; - *(undefined8 *)(lVar3 + 0x58) = 8; - *(undefined4 *)(lVar3 + 0xd0) = 0x10; - if (plVar1[0x16] == 0) { - *(longlong *)(lVar3 + 0x50) = param_6; - } - KeReleaseSpinLockFromDpcLevel(lVar3 + 0x68); - KeReleaseSpinLockFromDpcLevel(plVar1 + 0x1f); - uVar9 = CONCAT71((int7)((ulonglong)param_2 >> 8),uVar6); + goto LAB_2; + } + KeAcquireSpinLockAtDpcLevel(lVar4 + 0x68); + lVar3 = plVar2[6]; + *(undefined4 *)(plVar2 + 6) = 1; + uVar6 = 2; + if ((int)lVar3 == 7) { + uVar6 = param_3; + } + param_3 = uVar6; + plVar2[3] = 0; + *(undefined8 *)(lVar4 + 0x18) = 0; + *(undefined1 *)((longlong)plVar2 + 0x10b) = 7; + param_5._0_4_ = *(uint *)(lVar4 + 0x58); + *(byte *)(lVar4 + 0x78) = *(byte *)(lVar4 + 0x78) | 0x10; + *(code **)(lVar4 + 200) = RejectAnyData; + *(undefined1 *)(lVar4 + 0x7c) = 7; + *(undefined8 *)(lVar4 + 0x58) = 8; + *(undefined4 *)(lVar4 + 0xd0) = 0x10; + uVar10 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar10 != 0) && (plVar2[0x18] != 0)) { + *(longlong *)(lVar4 + 0x120) = plVar2[0x19]; + plVar2[0x19] = 0; + plVar2[0x18] = 0; + } + if (plVar2[0x16] == 0) { + *(longlong *)(lVar4 + 0x50) = param_6; + } + uVar10 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar10 != 0) { + if ((DAT_1 & 0x40) != 0) { + param_2 = 0; + WPP_SF_qddds((ulonglong)*(uint *)(lVar4 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar4); + } + LOCK(); + *(int *)(lVar4 + 0x14) = *(int *)(lVar4 + 0x14) + 1; + UNLOCK(); + uVar7 = local_res20._0_1_; + } + KeReleaseSpinLockFromDpcLevel(lVar4 + 0x68); + KeReleaseSpinLockFromDpcLevel(plVar2 + 0x1f); + uVar9 = CONCAT71((int7)(param_2 >> 8),uVar7); KeReleaseSpinLock(&DAT_0); - NbtDereferenceConnection((longlong)plVar1,uVar9,(undefined *)0x1a1c,0x140033d10); + NbtDereferenceConnection((longlong)plVar2,uVar9,(undefined *)0x1a35,0x140034d10); local_res8 = CONCAT71(local_res8._1_7_,1); } - if (plVar1[0x18] != 0) { - uVar6 = KeAcquireSpinLockRaiseToDpc(plVar1 + 0x1f); - KeAcquireSpinLockAtDpcLevel(lVar3 + 0x68); - *(longlong *)(lVar3 + 0x120) = plVar1[0x19]; - plVar1[0x19] = 0; - plVar1[0x18] = 0; - KeReleaseSpinLockFromDpcLevel(lVar3 + 0x68); - KeReleaseSpinLock(plVar1 + 0x1f,uVar6); - } - iVar7 = (int)param_5; - if (*(int *)(lVar3 + 0x11c) != 0) { + uVar10 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar10 == 0) && (plVar2[0x18] != 0)) { + uVar7 = KeAcquireSpinLockRaiseToDpc(plVar2 + 0x1f); + KeAcquireSpinLockAtDpcLevel(lVar4 + 0x68); + *(longlong *)(lVar4 + 0x120) = plVar2[0x19]; + plVar2[0x19] = 0; + plVar2[0x18] = 0; + KeReleaseSpinLockFromDpcLevel(lVar4 + 0x68); + KeReleaseSpinLock(plVar2 + 0x1f,uVar7); + } + uVar10 = (ulonglong)(uint)param_5; + if (*(int *)(lVar4 + 0x11c) != 0) { param_3 = 2; } } - uVar6 = KeAcquireSpinLockRaiseToDpc(plVar1 + 0x1f); - local_res20 = (code *)CONCAT71(local_res20._1_7_,uVar6); - FreeRcvBuffers((longlong)plVar1,(undefined1 *)&local_res20); - KeReleaseSpinLock(plVar1 + 0x1f,(ulonglong)local_res20 & 0xff); + uVar7 = KeAcquireSpinLockRaiseToDpc(plVar2 + 0x1f); + local_res20 = (code *)CONCAT71(local_res20._1_7_,uVar7); + FreeRcvBuffers((longlong)plVar2,(undefined1 *)&local_res20); + KeReleaseSpinLock(plVar2 + 0x1f,(ulonglong)local_res20 & 0xff); if ((char)local_res8 != '\0') { - uVar6 = KeAcquireSpinLockRaiseToDpc(&DAT_0); - RelistConnection(plVar1); - KeReleaseSpinLock(&DAT_0,uVar6); - } - iVar7 = DisconnectLower(lVar3,iVar7,param_3,local_res10,param_6 == 0); - if (plVar1[0x16] != 0) { - if (iVar7 != -0x3fffff66) { + uVar7 = KeAcquireSpinLockRaiseToDpc(&DAT_0); + RelistConnection(plVar2); + KeReleaseSpinLock(&DAT_0,uVar7); + } + uVar10 = DisconnectLower(lVar4,uVar10,param_3,local_res10,param_6 == 0); + if (plVar2[0x16] != 0) { + if ((int)uVar10 != -0x3fffff66) { return 0x103; } - return 0xc000009a; - } - return CONCAT44(extraout_var,iVar7); - } - if (((int)plVar1[6] == 7) && (plVar1[0x15] == 0)) { - plVar1[0x15] = param_6; - NbtSetCancelRoutine(param_6,NbtCancelDisconnectWait,*(undefined8 *)(lVar3 + 0x28)); + return uVar10 & 0xffffffff; + } + return uVar10; + } + if (((int)plVar2[6] == 7) && (plVar2[0x15] == 0)) { + plVar2[0x15] = param_6; + NbtSetCancelRoutine(param_6,NbtCancelDisconnectWait,*(undefined8 *)(lVar4 + 0x28)); uVar11 = 0x103; } else { uVar11 = 0xc000023a; } KeReleaseSpinLockFromDpcLevel(plVar8); } - else if (*(char *)((longlong)plVar1 + 0x101) == '\0') { + else if (*(char *)((longlong)plVar2 + 0x101) == '\0') { uVar11 = 0xc000023a; } else { - if (param_3 == 1) { - uVar5 = 0xc000020d; - if (*(char *)((longlong)plVar1 + 0x101) != '\x02') { - uVar5 = 0xc0000237; - } - uVar11 = (ulonglong)uVar5; - } - else { - uVar11 = 0; - } - *(undefined1 *)((longlong)plVar1 + 0x101) = 0; - } - KeReleaseSpinLock(&DAT_0,uVar6); + if ((param_3 == 1) && (uVar11 = 0xc000020d, *(char *)((longlong)plVar2 + 0x101) != '\x02')) { + uVar11 = 0xc0000237; + } + *(undefined1 *)((longlong)plVar2 + 0x101) = 0; + } + KeReleaseSpinLock(&DAT_0,uVar7); return uVar11; } ``` ## DelayedCleanupAfterDisconnect ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.86| |i_ratio|0.62| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|DelayedCleanupAfterDisconnect|DelayedCleanupAfterDisconnect| |fullname|DelayedCleanupAfterDisconnect|DelayedCleanupAfterDisconnect| |refcount|8|8| |`length`|276|279| |`called`|DelayedAllocLowerConn
NbtDeleteLowerConn
NbtDereferenceLowerConnection
WPP_SF_Dq
WPP_SF_qd|DelayedAllocLowerConn
NbtDeleteLowerConn
NbtDereferenceLowerConnection
WPP_SF_dP
WPP_SF_qd| |calling||| |paramcount|4|4| |`address`|140016e30|1400162f0| |`sig`|undefined __fastcall DelayedCleanupAfterDisconnect(undefined8 param_1, longlong * param_2, undefined * param_3, undefined8 * param_4)|undefined __fastcall DelayedCleanupAfterDisconnect(undefined8 param_1, longlong * param_2, undefined8 param_3, undefined8 * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DelayedCleanupAfterDisconnect Called Diff ```diff --- DelayedCleanupAfterDisconnect called +++ DelayedCleanupAfterDisconnect called @@ -4 +4 @@ -WPP_SF_Dq +WPP_SF_dP ``` ### DelayedCleanupAfterDisconnect Diff ```diff --- DelayedCleanupAfterDisconnect +++ DelayedCleanupAfterDisconnect @@ -1,43 +1,39 @@ void DelayedCleanupAfterDisconnect - (undefined8 param_1,longlong *param_2,undefined *param_3,undefined8 *param_4) + (undefined8 param_1,longlong *param_2,undefined8 param_3,undefined8 *param_4) { longlong *plVar1; plVar1 = param_2; if ((DAT_0 & 0x20) != 0) { - param_3 = &WPP_ffc711f4ba0833be1e89b8c0ea368d15_Traceguids; plVar1 = (longlong *)0x36; - WPP_SF_Dq(0x415,0x36,&WPP_ffc711f4ba0833be1e89b8c0ea368d15_Traceguids, + WPP_SF_dP(0x415,0x36,&WPP_ffc711f4ba0833be1e89b8c0ea368d15_Traceguids, *(byte *)(param_2 + 0xf) & 1); } if (((*(byte *)(param_2 + 0xf) & 1) == 0) && (param_4 != (undefined8 *)0x0)) { if ((*(byte *)(param_2 + 0xf) & 8) == 0) { if ((DAT_0 & 0x20) != 0) { - param_3 = &WPP_ffc711f4ba0833be1e89b8c0ea368d15_Traceguids; plVar1 = (longlong *)0x38; WPP_SF_qd(0x415,0x38,&WPP_ffc711f4ba0833be1e89b8c0ea368d15_Traceguids,param_2); } if (*(int *)(param_4 + 0x2d) == 0x43766544) { - param_3 = (undefined *)0x0; plVar1 = (longlong *)0x0; DelayedAllocLowerConn(0,0,0,param_4); } } else { LOCK(); *(int *)(param_4 + 0x37) = *(int *)(param_4 + 0x37) + -1; UNLOCK(); if ((DAT_0 & 0x20) != 0) { - param_3 = &WPP_ffc711f4ba0833be1e89b8c0ea368d15_Traceguids; plVar1 = (longlong *)0x37; WPP_SF_qd(0x415,0x37,&WPP_ffc711f4ba0833be1e89b8c0ea368d15_Traceguids,param_4); } } } - NbtDereferenceLowerConnection((longlong)param_2,plVar1,param_3,0xa5c); - NbtDeleteLowerConn(param_2,plVar1,param_3); + NbtDereferenceLowerConnection((longlong)param_2,plVar1,'\0'); + NbtDeleteLowerConn(param_2,plVar1); return; } ``` ## NbtIndicateDataToClient ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.83| |i_ratio|0.76| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtIndicateDataToClient|NbtIndicateDataToClient| |fullname|NbtIndicateDataToClient|NbtIndicateDataToClient| |refcount|3|3| |`length`|821|834| |`called`|
Expand for full list:
NTIoComplete
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtCopyToStartOfIndicate
NbtDequeueClientIrp
NbtProcessClientIrp
OutOfRsrcKillUnderLock
WPP_SF_qq
WPP_SF_qqddq
WPP_SF_qqdds
_guard_dispatch_icall
|
Expand for full list:
Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NTIoComplete
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtCopyToStartOfIndicate
NbtDequeueClientIrp
NbtProcessClientIrp
OutOfRsrcKillUnderLock
WPP_SF_qq
WPP_SF_qqddq
WPP_SF_qqdds_guard_dispatch_icall
| |calling|NbtProcessNewMessageInIndicateBuffer
NbtTryToIndicateUsingProviderBuffer|NbtProcessNewMessageInIndicateBuffer
NbtTryToIndicateUsingProviderBuffer| |paramcount|8|8| |`address`|140020dc0|140020f10| |sig|ulonglong __fastcall NbtIndicateDataToClient(longlong * param_1, ushort param_2, uint param_3, undefined8 param_4, uint * param_5, undefined8 param_6, longlong * param_7, char param_8)|ulonglong __fastcall NbtIndicateDataToClient(longlong * param_1, ushort param_2, uint param_3, undefined8 param_4, uint * param_5, undefined8 param_6, longlong * param_7, char param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtIndicateDataToClient Called Diff ```diff --- NbtIndicateDataToClient called +++ NbtIndicateDataToClient called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline ``` ### NbtIndicateDataToClient Diff ```diff --- NbtIndicateDataToClient +++ NbtIndicateDataToClient @@ -1,123 +1,127 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ ulonglong NbtIndicateDataToClient (longlong *param_1,ushort param_2,uint param_3,undefined8 param_4,uint *param_5, undefined8 param_6,longlong *param_7,char param_8) { int iVar1; int iVar2; longlong lVar3; longlong lVar4; uint uVar5; uint uVar6; - undefined8 *puVar7; - code *pcVar8; - ulonglong uVar9; + ulonglong uVar7; + undefined8 *puVar8; + code *pcVar9; ulonglong uVar10; ushort uVar11; uint local_res10 [2]; undefined8 in_stack_ffffffffffffff98; longlong lVar12; undefined4 uVar13; uVar13 = (undefined4)((ulonglong)in_stack_ffffffffffffff98 >> 0x20); lVar3 = param_1[3]; lVar4 = *(longlong *)(lVar3 + 0x28); uVar5 = *(uint *)(lVar3 + 0xd0); if (param_3 < *(uint *)(lVar3 + 0xd0)) { uVar5 = param_3; } *param_5 = 0xdeadc0de; if ((DAT_0 & 8) != 0) { lVar12 = lVar3; WPP_SF_qqdds(); uVar13 = (undefined4)((ulonglong)lVar12 >> 0x20); } uVar6 = *(uint *)(lVar3 + 0xd0); *(byte *)(param_1 + 0xf) = *(byte *)(param_1 + 0xf) | 0x20; KeReleaseSpinLockFromDpcLevel(param_1 + 0xd); local_res10[0] = 0; uVar11 = param_2 | 0x400; if (uVar5 != uVar6) { uVar11 = param_2 & 0xfbff; } uVar10 = (ulonglong)uVar11; uVar6 = (**(code **)(lVar4 + 0xa8)) (*(undefined8 *)(lVar4 + 0xb0),*(undefined8 *)(lVar3 + 0x48),uVar10,uVar5, CONCAT44(uVar13,*(undefined4 *)(lVar3 + 0xd0)),local_res10,param_6,param_7); - uVar9 = (ulonglong)uVar6; + uVar7 = (ulonglong)uVar6; KeAcquireSpinLockAtDpcLevel(param_1 + 0xd); *(byte *)(param_1 + 0xf) = *(byte *)(param_1 + 0xf) & 0xdf; if ((DAT_0 & 8) != 0) { WPP_SF_qqddq((ulonglong)local_res10[0],0xc,uVar10,param_1); } *(int *)(lVar3 + 0xd4) = *(int *)(lVar3 + 0xd4) + local_res10[0]; if ((int)param_1[0xb] == 7) { if (local_res10[0] <= param_3) { if (param_8 == '\0') { *param_5 = local_res10[0]; } else { NbtCopyToStartOfIndicate((longlong)param_1,local_res10[0] + 4); *param_5 = 0xffffffff; } if (uVar6 == 0) { iVar1 = *(int *)(lVar3 + 0xd0); - pcVar8 = PartialReceive; + pcVar9 = PartialReceive; iVar2 = *(int *)(lVar3 + 0xd4); if (iVar2 == iVar1) { - pcVar8 = IndicateBuffer; + pcVar9 = IndicateBuffer; } - param_1[0x19] = (longlong)pcVar8; + param_1[0x19] = (longlong)pcVar9; *(undefined4 *)((longlong)param_1 + 0x5c) = 0; *(uint *)(param_1 + 0x1a) = 9 - (uint)(iVar2 != iVar1); } else if (uVar6 == 0xc000021b) { *(undefined4 *)((longlong)param_1 + 0x5c) = 0; param_1[0x19] = (longlong)PartialReceive; - uVar9 = 0; + uVar7 = 0; *(undefined4 *)(param_1 + 0x1a) = 10; } if (*param_7 != 0) { if ((DAT_0 & 8) != 0) { - WPP_SF_qq(0x41b,0xe,&WPP_a04273e783d935d2bc744d19bba9360b_Traceguids,param_1); + WPP_SF_qq(0x41b,0xe,&WPP_16ccfdefbad536c645c6e4aff08834b9_Traceguids,param_1); } - puVar7 = NbtProcessClientIrp((char *)param_1,*(int *)(lVar3 + 0xd0) - *(int *)(lVar3 + 0xd4) + puVar8 = NbtProcessClientIrp((char *)param_1,*(int *)(lVar3 + 0xd0) - *(int *)(lVar3 + 0xd4) ,(undefined8 *)*param_7,'\x01'); - uVar9 = (ulonglong)puVar7 & 0xffffffff; - if ((int)puVar7 != -0x3fffffea) { + uVar7 = (ulonglong)puVar8 & 0xffffffff; + if ((int)puVar8 != -0x3fffffea) { *param_7 = 0; } } if (*param_7 == 0) { if ((DAT_0 & 8) != 0) { - WPP_SF_qq(0x41b,0xf,&WPP_a04273e783d935d2bc744d19bba9360b_Traceguids,param_1); + WPP_SF_qq(0x41b,0xf,&WPP_16ccfdefbad536c645c6e4aff08834b9_Traceguids,param_1); } - puVar7 = NbtDequeueClientIrp((char *)param_1,lVar3); - *param_7 = (longlong)puVar7; - if (puVar7 == (undefined8 *)0x0) { - return uVar9; + puVar8 = NbtDequeueClientIrp((char *)param_1,lVar3); + *param_7 = (longlong)puVar8; + if (puVar8 == (undefined8 *)0x0) { + return uVar7; } } *(undefined4 *)((longlong)param_1 + 0x5c) = 0; param_1[0x19] = (longlong)PostedIrp; *(undefined4 *)(param_1 + 0x1a) = 0xb; return 0xc0000016; } *param_5 = uVar5; if ((DAT_0 & 8) != 0) { - WPP_SF_qq(0x41b,0xd,&WPP_a04273e783d935d2bc744d19bba9360b_Traceguids,param_1); + WPP_SF_qq(0x41b,0xd,&WPP_16ccfdefbad536c645c6e4aff08834b9_Traceguids,param_1); } OutOfRsrcKillUnderLock(param_1,'\b'); } else { if (uVar6 == 0xc0000016) { NTIoComplete(*param_7,0xc000020d,0); + uVar7 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 != 0) { + *param_7 = 0; + } } *param_5 = uVar5; } return 0xc000020d; } ``` ## NextKeepAlive ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.9| |i_ratio|0.8| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NextKeepAlive|NextKeepAlive| |fullname|NextKeepAlive|NextKeepAlive| |refcount|6|6| |`length`|168|174| |called|FreeTracker
GetNextKeepAlive
NTSendSession
NbtDereferenceLowerConnection|FreeTracker
GetNextKeepAlive
NTSendSession
NbtDereferenceLowerConnection| |calling||| |paramcount|1|1| |`address`|14002afa0|14002ba40| |sig|undefined __fastcall NextKeepAlive(longlong * param_1)|undefined __fastcall NextKeepAlive(longlong * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NextKeepAlive Diff ```diff --- NextKeepAlive +++ NextKeepAlive @@ -1,35 +1,33 @@ void NextKeepAlive(longlong *param_1) { undefined8 *puVar1; longlong lVar2; undefined8 uVar3; undefined8 **ppuVar4; longlong lVar5; - undefined8 *puVar6; longlong local_res8; undefined8 *local_res20; local_res8 = 0; ppuVar4 = &local_res20; local_res20 = (undefined8 *)param_1[4]; puVar1 = (undefined8 *)param_1[0xc]; - puVar6 = puVar1; GetNextKeepAlive(local_res20,ppuVar4,puVar1,&local_res8,(longlong)param_1); - NbtDereferenceLowerConnection((longlong)puVar1,ppuVar4,puVar6,0xdd9); + NbtDereferenceLowerConnection((longlong)puVar1,ppuVar4,'\0'); lVar2 = local_res8; if (local_res8 != 0) { param_1[4] = (longlong)local_res20; param_1[0xc] = local_res8; lVar5 = local_res8; uVar3 = NTSendSession((longlong)param_1,local_res8); if (-1 < (int)uVar3) { return; } - NbtDereferenceLowerConnection(lVar2,lVar5,puVar6,0xdf0); + NbtDereferenceLowerConnection(lVar2,lVar5,'\0'); } FreeTracker(param_1,5); return; } ``` ## DisconnectDone ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.53| |i_ratio|0.32| |m_ratio|0.99| |b_ratio|0.45| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|DisconnectDone|DisconnectDone| |fullname|DisconnectDone|DisconnectDone| |refcount|5|5| |`length`|582|534| |`called`|FreeTracker
NTIoComplete
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NTQueueToWorkerThread
WPP_SF_qd
WPP_SF_qqqd|
Expand for full list:
Feature_1180933432__private_IsEnabledDeviceUsageNoInline
FreeTracker
NTIoComplete
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NTQueueToWorkerThread
NbtDereferenceLowerConnection
WPP_SF_qd
WPP_SF_qqqd
| |calling|DisconnectLower|DisconnectLower| |paramcount|2|2| |`address`|140023bf0|140026780| |`sig`|undefined __fastcall DisconnectDone(longlong * param_1, int param_2)|undefined __fastcall DisconnectDone(longlong * param_1, ulonglong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DisconnectDone Called Diff ```diff --- DisconnectDone called +++ DisconnectDone called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline @@ -7,0 +9 @@ +NbtDereferenceLowerConnection ``` ### DisconnectDone Diff ```diff --- DisconnectDone +++ DisconnectDone @@ -1,71 +1,81 @@ -void DisconnectDone(longlong *param_1,int param_2) +void DisconnectDone(longlong *param_1,ulonglong param_2) { longlong lVar1; longlong lVar2; longlong lVar3; - bool bVar4; - undefined1 uVar5; - undefined8 uVar6; - longlong lVar7; - longlong lVar8; - undefined4 uVar9; + uint uVar4; + bool bVar5; + undefined1 uVar6; + ulonglong uVar7; + ulonglong uVar8; + longlong lVar9; + longlong lVar10; + ulonglong uVar11; lVar1 = param_1[0xc]; - lVar8 = 0; - bVar4 = false; - uVar9 = 0xc0000001; + lVar10 = 0; + bVar5 = false; + uVar11 = 0xc0000001; if ((DAT_0 & 0x20) != 0) { - WPP_SF_qqqd(0x415,0xf,&WPP_dc02a1f82c2934b6fc0cb4f28219eafa_Traceguids,param_1); + WPP_SF_qqqd(0x415,0xf,&WPP_adfa7670aac03ca046b0a41c584da091_Traceguids,param_1); } - uVar5 = KeAcquireSpinLockRaiseToDpc(&DAT_1); + uVar6 = KeAcquireSpinLockRaiseToDpc(&DAT_1); KeAcquireSpinLockAtDpcLevel(lVar1 + 0x68); if ((DAT_0 & 0x20) != 0) { - WPP_SF_qd(0x415,0x10,&WPP_dc02a1f82c2934b6fc0cb4f28219eafa_Traceguids,lVar1); + WPP_SF_qd(0x415,0x10,&WPP_adfa7670aac03ca046b0a41c584da091_Traceguids,lVar1); } - if ((((StreamsStack == '\0') && (-1 < param_2)) && ((int)param_1[0x1e] == 4)) && + if ((((StreamsStack == '\0') && (-1 < (int)param_2)) && ((int)param_1[0x1e] == 4)) && (*(int *)(lVar1 + 0x58) == 8)) { *(undefined8 *)(lVar1 + 0x58) = 9; } else if (*(int *)(lVar1 + 0x58) != 0) { *(undefined8 *)(lVar1 + 0x58) = 0; - bVar4 = true; + bVar5 = true; } lVar2 = *(longlong *)(lVar1 + 0x18); - lVar7 = lVar8; + lVar9 = lVar10; if ((lVar2 != 0) && (lVar3 = *(longlong *)(lVar2 + 0xa8), lVar3 != 0)) { *(undefined8 *)(lVar2 + 0xa8) = 0; - lVar7 = lVar3; - uVar9 = 0xc000020d; + uVar4 = 0xc000020d; if (*(char *)(lVar2 + 0x101) != '\x02') { - uVar9 = 0xc0000237; + uVar4 = 0xc0000237; } + uVar11 = (ulonglong)uVar4; + lVar9 = lVar3; } *(byte *)(lVar1 + 0x78) = *(byte *)(lVar1 + 0x78) & 0xef; lVar2 = *(longlong *)(lVar1 + 0x50); if (lVar2 != 0) { *(undefined8 *)(lVar1 + 0x50) = 0; } KeReleaseSpinLockFromDpcLevel(lVar1 + 0x68); - if (bVar4) { + if (bVar5) { lVar3 = *(longlong *)(lVar1 + 0x28); - if ((lVar3 != 0) && (lVar8 = 0, *(int *)(lVar3 + 0x168) == 0x43766544)) { - lVar8 = lVar3; + if ((lVar3 != 0) && (lVar10 = 0, *(int *)(lVar3 + 0x168) == 0x43766544)) { + lVar10 = lVar3; } - uVar6 = NTQueueToWorkerThread - ((undefined8 *)(lVar1 + 0x80),DelayedCleanupAfterDisconnect,0,lVar1,0,lVar8, - '\x01',0xf6); - param_2 = (int)uVar6; + param_2 = NTQueueToWorkerThread + ((undefined8 *)(lVar1 + 0x80),DelayedCleanupAfterDisconnect,0,lVar1,0,lVar10 + ,'\x01',0xf6); } - KeReleaseSpinLock(&DAT_1,uVar5); + uVar8 = param_2 & 0xffffffff; + KeReleaseSpinLock(&DAT_1,uVar6); + uVar7 = 4; FreeTracker(param_1,4); - if (lVar7 != 0) { - NTIoComplete(lVar7,uVar9,0); + if (lVar9 != 0) { + NTIoComplete(lVar9,(int)uVar11,0); + uVar7 = uVar11; } if (lVar2 != 0) { - NTIoComplete(lVar2,param_2,0); + NTIoComplete(lVar2,(int)param_2,0); + uVar7 = uVar8; + } + uVar11 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar11 != 0) { + NbtDereferenceLowerConnection(lVar1,uVar7,'\0'); } return; } ``` ## NbtDispatchPnP ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.2| |i_ratio|0.31| |m_ratio|0.91| |b_ratio|0.38| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtDispatchPnP|NbtDispatchPnP| |fullname|NbtDispatchPnP|NbtDispatchPnP| |refcount|4|4| |`length`|987|1162| |`called`|
Expand for full list:
NBT_DEREFERENCE_DEVICE
NBT_REFERENCE_DEVICE
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTQueueToWorkerThread
NbtDereferenceLowerConnection
ReturnIrp
WPP_SF_qWPP_SF_qddds
|
Expand for full list:
Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NBT_DEREFERENCE_DEVICE
NBT_REFERENCE_DEVICE
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTQueueToWorkerThread
NbtDereferenceLowerConnection
ReturnIrpWPP_SF_q
WPP_SF_qddds
| |calling||| |paramcount|2|2| |`address`|14002d410|14002d5b0| |sig|int __fastcall NbtDispatchPnP(longlong param_1, longlong param_2)|int __fastcall NbtDispatchPnP(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtDispatchPnP Called Diff ```diff --- NbtDispatchPnP called +++ NbtDispatchPnP called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline ``` ### NbtDispatchPnP Diff ```diff --- NbtDispatchPnP +++ NbtDispatchPnP @@ -1,154 +1,194 @@ int NbtDispatchPnP(longlong param_1,longlong param_2) { int iVar1; - undefined8 *puVar2; - longlong lVar3; + uint uVar2; + undefined8 *puVar3; longlong lVar4; longlong lVar5; - int *piVar6; - undefined4 uVar7; - undefined4 uVar8; + longlong lVar6; + longlong lVar7; + int *piVar8; undefined4 uVar9; - undefined1 uVar10; - undefined1 uVar11; - int iVar12; - undefined8 uVar13; - longlong lVar14; - longlong lVar15; - undefined *puVar16; - undefined8 uVar17; - undefined *puVar18; + undefined4 uVar10; + undefined4 uVar11; + undefined1 uVar12; + undefined1 uVar13; + int iVar14; + undefined8 uVar15; + ulonglong uVar16; + ulonglong uVar17; + longlong lVar18; + undefined *puVar19; + undefined8 uVar20; + bool bVar21; + bool bVar22; - puVar2 = *(undefined8 **)(param_2 + 0xb8); - uVar17 = 0; - puVar18 = (undefined *)0x0; - iVar12 = -0x3ffffff0; - uVar13 = NBT_REFERENCE_DEVICE(param_1,0,'\0'); - if ((char)uVar13 == '\0') { + puVar3 = *(undefined8 **)(param_2 + 0xb8); + uVar20 = 0; + iVar14 = -0x3ffffff0; + uVar15 = NBT_REFERENCE_DEVICE(param_1,0,'\0'); + if ((char)uVar15 == '\0') { if ((DAT_0 & 4) != 0) { WPP_SF_q(0x402,0x35,&WPP_8839b5bedc693c9dec360ad60f2a5e91_Traceguids,param_1); } *(undefined4 *)(param_2 + 0x30) = 0xc0000184; IofCompleteRequest(param_2,2); return -0x3ffffe7c; } - if ((*(char *)((longlong)puVar2 + 1) == '\a') && (*(int *)(puVar2 + 1) == 4)) { - iVar1 = *(int *)(puVar2[6] + 0x20); + if ((*(char *)((longlong)puVar3 + 1) == '\a') && (*(int *)(puVar3 + 1) == 4)) { + iVar1 = *(int *)(puVar3[6] + 0x20); if (iVar1 == 2) { - lVar3 = *(longlong *)(puVar2[6] + 0x18); - if ((lVar3 == 0) || ((*(int *)(lVar3 + 0x10) + 0xce9190bdU & 0xfeffffff) != 0)) { - iVar12 = -0x3ffffff8; + lVar4 = *(longlong *)(puVar3[6] + 0x18); + if ((lVar4 == 0) || ((*(int *)(lVar4 + 0x10) + 0xce9190bdU & 0xfeffffff) != 0)) { + iVar14 = -0x3ffffff8; } else { - puVar16 = (undefined *)(lVar3 + 0xf8); - uVar10 = KeAcquireSpinLockRaiseToDpc(puVar16); - lVar3 = *(longlong *)(lVar3 + 0x18); - if ((lVar3 == 0) || (*(int *)(lVar3 + 0x10) != 0x43776f4c)) { - iVar12 = -0x3ffffdc6; + puVar19 = (undefined *)(lVar4 + 0xf8); + uVar12 = KeAcquireSpinLockRaiseToDpc(puVar19); + lVar5 = *(longlong *)(lVar4 + 0x18); + if ((lVar5 == 0) || (*(int *)(lVar5 + 0x10) != 0x43776f4c)) { + iVar14 = -0x3ffffdc6; goto LAB_1; } - lVar15 = lVar3 + 0x68; - uVar11 = KeAcquireSpinLockRaiseToDpc(); - if ((DAT_2 & 0x40) != 0) { - uVar17 = 0; - puVar18 = &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids; - WPP_SF_qddds(lVar15,0xb,&WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,lVar3); + uVar17 = lVar5 + 0x68; + bVar21 = true; + uVar13 = KeAcquireSpinLockRaiseToDpc(); + uVar16 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar16 == 0) { + if ((DAT_2 & 0x40) != 0) { + uVar20 = 0; + WPP_SF_qddds((ulonglong)*(uint *)(lVar5 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar5); + } + LOCK(); + *(int *)(lVar5 + 0x14) = *(int *)(lVar5 + 0x14) + 1; + UNLOCK(); } - LOCK(); - *(int *)(lVar3 + 0x14) = *(int *)(lVar3 + 0x14) + 1; - UNLOCK(); - uVar17 = CONCAT71((int7)((ulonglong)uVar17 >> 8),uVar11); - KeReleaseSpinLock(lVar3 + 0x68,uVar17); - uVar17 = CONCAT71((int7)((ulonglong)uVar17 >> 8),uVar10); - KeReleaseSpinLock(puVar16); - lVar15 = *(longlong *)(lVar3 + 0x30); - if ((lVar15 != 0) && (lVar14 = IoGetRelatedDeviceObject(lVar15), lVar14 != 0)) { - lVar4 = *(longlong *)(param_2 + 0xb8); - uVar17 = puVar2[1]; - *(undefined8 *)(lVar4 + -0x48) = *puVar2; - *(undefined8 *)(lVar4 + -0x40) = uVar17; - uVar17 = puVar2[3]; - *(undefined8 *)(lVar4 + -0x38) = puVar2[2]; - *(undefined8 *)(lVar4 + -0x30) = uVar17; - uVar17 = puVar2[5]; - *(undefined8 *)(lVar4 + -0x28) = puVar2[4]; - *(undefined8 *)(lVar4 + -0x20) = uVar17; - uVar7 = *(undefined4 *)((longlong)puVar2 + 0x34); - uVar8 = *(undefined4 *)(puVar2 + 7); - uVar9 = *(undefined4 *)((longlong)puVar2 + 0x3c); - *(undefined4 *)(lVar4 + -0x18) = *(undefined4 *)(puVar2 + 6); - *(undefined4 *)(lVar4 + -0x14) = uVar7; - *(undefined4 *)(lVar4 + -0x10) = uVar8; - *(undefined4 *)(lVar4 + -0xc) = uVar9; - *(undefined8 *)(lVar4 + -8) = puVar2[8]; - lVar5 = *(longlong *)(param_2 + 0xb8); - *(undefined8 *)(lVar5 + -0x10) = 0; - *(undefined8 *)(lVar5 + -8) = 0; - *(undefined1 *)(lVar5 + -0x45) = 0; - *(longlong *)(lVar4 + -0x18) = lVar15; - *(longlong *)(lVar4 + -0x20) = lVar14; - iVar12 = IofCallDriver(); - NbtDereferenceLowerConnection(lVar3,param_2,puVar18,0x5b8); - goto LAB_3; + else { + do { + uVar2 = *(uint *)(lVar5 + 0x14); + if ((int)uVar2 < 1) { + bVar21 = false; + break; + } + uVar17 = (ulonglong)(uVar2 + 1); + LOCK(); + bVar22 = uVar2 == *(uint *)(lVar5 + 0x14); + if (bVar22) { + *(uint *)(lVar5 + 0x14) = uVar2 + 1; + } + UNLOCK(); + } while (!bVar22); + if ((DAT_2 & 0x40) != 0) { + uVar20 = 0; + WPP_SF_qddds(uVar17,0xc,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar5); + } } - iVar12 = -0x3ffffff8; - NbtDereferenceLowerConnection(lVar3,uVar17,puVar18,0x5c1); + uVar20 = CONCAT71((int7)((ulonglong)uVar20 >> 8),uVar13); + KeReleaseSpinLock(lVar5 + 0x68,uVar20); + uVar20 = CONCAT71((int7)((ulonglong)uVar20 >> 8),uVar12); + KeReleaseSpinLock(lVar4 + 0xf8); + uVar17 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar17 == 0) || (bVar21)) { + lVar4 = *(longlong *)(lVar5 + 0x30); + if ((lVar4 != 0) && (lVar18 = IoGetRelatedDeviceObject(lVar4), lVar18 != 0)) { + lVar6 = *(longlong *)(param_2 + 0xb8); + uVar20 = puVar3[1]; + *(undefined8 *)(lVar6 + -0x48) = *puVar3; + *(undefined8 *)(lVar6 + -0x40) = uVar20; + uVar20 = puVar3[3]; + *(undefined8 *)(lVar6 + -0x38) = puVar3[2]; + *(undefined8 *)(lVar6 + -0x30) = uVar20; + uVar20 = puVar3[5]; + *(undefined8 *)(lVar6 + -0x28) = puVar3[4]; + *(undefined8 *)(lVar6 + -0x20) = uVar20; + uVar9 = *(undefined4 *)((longlong)puVar3 + 0x34); + uVar10 = *(undefined4 *)(puVar3 + 7); + uVar11 = *(undefined4 *)((longlong)puVar3 + 0x3c); + *(undefined4 *)(lVar6 + -0x18) = *(undefined4 *)(puVar3 + 6); + *(undefined4 *)(lVar6 + -0x14) = uVar9; + *(undefined4 *)(lVar6 + -0x10) = uVar10; + *(undefined4 *)(lVar6 + -0xc) = uVar11; + *(undefined8 *)(lVar6 + -8) = puVar3[8]; + lVar7 = *(longlong *)(param_2 + 0xb8); + *(undefined8 *)(lVar7 + -0x10) = 0; + *(undefined8 *)(lVar7 + -8) = 0; + *(undefined1 *)(lVar7 + -0x45) = 0; + *(longlong *)(lVar6 + -0x18) = lVar4; + *(longlong *)(lVar6 + -0x20) = lVar18; + iVar14 = IofCallDriver(); + NbtDereferenceLowerConnection(lVar5,param_2,'\0'); + goto LAB_3; + } + iVar14 = -0x3ffffff8; + uVar17 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar17 != 0) { + NbtDereferenceLowerConnection(lVar5,uVar20,'\0'); + } + } + else { + iVar14 = -0x3ffffdc6; + } + uVar17 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar17 == 0) { + NbtDereferenceLowerConnection(lVar5,uVar20,'\0'); + } } } else if (iVar1 == 1) { - uVar10 = KeAcquireSpinLockRaiseToDpc(&DAT_4); + uVar12 = KeAcquireSpinLockRaiseToDpc(&DAT_4); if ((((*(int *)(param_1 + 0x1e8) != 0) && - (piVar6 = *(int **)(param_1 + 0x268), piVar6 != (int *)0x0)) && - (lVar3 = *(longlong *)(piVar6 + 0xc), lVar3 != 0)) && - (lVar15 = *(longlong *)(piVar6 + 10), lVar15 != 0)) { - *piVar6 = *piVar6 + 1; - lVar14 = *(longlong *)(param_2 + 0xb8); - uVar17 = puVar2[1]; - *(undefined8 *)(lVar14 + -0x48) = *puVar2; - *(undefined8 *)(lVar14 + -0x40) = uVar17; - uVar17 = puVar2[3]; - *(undefined8 *)(lVar14 + -0x38) = puVar2[2]; - *(undefined8 *)(lVar14 + -0x30) = uVar17; - uVar17 = puVar2[5]; - *(undefined8 *)(lVar14 + -0x28) = puVar2[4]; - *(undefined8 *)(lVar14 + -0x20) = uVar17; - uVar7 = *(undefined4 *)((longlong)puVar2 + 0x34); - uVar8 = *(undefined4 *)(puVar2 + 7); - uVar9 = *(undefined4 *)((longlong)puVar2 + 0x3c); - *(undefined4 *)(lVar14 + -0x18) = *(undefined4 *)(puVar2 + 6); - *(undefined4 *)(lVar14 + -0x14) = uVar7; - *(undefined4 *)(lVar14 + -0x10) = uVar8; - *(undefined4 *)(lVar14 + -0xc) = uVar9; - *(undefined8 *)(lVar14 + -8) = puVar2[8]; - lVar4 = *(longlong *)(param_2 + 0xb8); - *(undefined8 *)(lVar4 + -0x10) = 0; - *(undefined8 *)(lVar4 + -8) = 0; - *(undefined1 *)(lVar4 + -0x45) = 0; - *(longlong *)(lVar14 + -0x18) = lVar3; - *(longlong *)(lVar14 + -0x20) = lVar15; - KeReleaseSpinLock(&DAT_4,CONCAT71((int7)((ulonglong)lVar14 >> 8),uVar10)); - iVar12 = IofCallDriver(lVar15); - uVar10 = KeAcquireSpinLockRaiseToDpc(&DAT_4); - *piVar6 = *piVar6 + -1; - if (*piVar6 == 0) { + (piVar8 = *(int **)(param_1 + 0x268), piVar8 != (int *)0x0)) && + (lVar4 = *(longlong *)(piVar8 + 0xc), lVar4 != 0)) && + (lVar5 = *(longlong *)(piVar8 + 10), lVar5 != 0)) { + *piVar8 = *piVar8 + 1; + lVar18 = *(longlong *)(param_2 + 0xb8); + uVar20 = puVar3[1]; + *(undefined8 *)(lVar18 + -0x48) = *puVar3; + *(undefined8 *)(lVar18 + -0x40) = uVar20; + uVar20 = puVar3[3]; + *(undefined8 *)(lVar18 + -0x38) = puVar3[2]; + *(undefined8 *)(lVar18 + -0x30) = uVar20; + uVar20 = puVar3[5]; + *(undefined8 *)(lVar18 + -0x28) = puVar3[4]; + *(undefined8 *)(lVar18 + -0x20) = uVar20; + uVar9 = *(undefined4 *)((longlong)puVar3 + 0x34); + uVar10 = *(undefined4 *)(puVar3 + 7); + uVar11 = *(undefined4 *)((longlong)puVar3 + 0x3c); + *(undefined4 *)(lVar18 + -0x18) = *(undefined4 *)(puVar3 + 6); + *(undefined4 *)(lVar18 + -0x14) = uVar9; + *(undefined4 *)(lVar18 + -0x10) = uVar10; + *(undefined4 *)(lVar18 + -0xc) = uVar11; + *(undefined8 *)(lVar18 + -8) = puVar3[8]; + lVar6 = *(longlong *)(param_2 + 0xb8); + *(undefined8 *)(lVar6 + -0x10) = 0; + *(undefined8 *)(lVar6 + -8) = 0; + *(undefined1 *)(lVar6 + -0x45) = 0; + *(longlong *)(lVar18 + -0x18) = lVar4; + *(longlong *)(lVar18 + -0x20) = lVar5; + KeReleaseSpinLock(&DAT_4,CONCAT71((int7)((ulonglong)lVar18 >> 8),uVar12)); + iVar14 = IofCallDriver(lVar5); + uVar12 = KeAcquireSpinLockRaiseToDpc(&DAT_4); + *piVar8 = *piVar8 + -1; + if (*piVar8 == 0) { NTQueueToWorkerThread - ((undefined8 *)(piVar6 + 0xe),DelayedNbtCloseFileHandles,0,piVar6,0,0,'\x01',1); + ((undefined8 *)(piVar8 + 0xe),DelayedNbtCloseFileHandles,0,piVar8,0,0,'\x01',1); } NBT_DEREFERENCE_DEVICE(param_1,0,'\x01'); - KeReleaseSpinLock(&DAT_4,uVar10); - return iVar12; + KeReleaseSpinLock(&DAT_4,uVar12); + return iVar14; } - puVar16 = &DAT_4; - iVar12 = -0x3ffffff0; + puVar19 = &DAT_4; + iVar14 = -0x3ffffff0; LAB_1: - KeReleaseSpinLock(puVar16,uVar10); + KeReleaseSpinLock(puVar19,uVar12); } } - ReturnIrp(param_2,iVar12); + ReturnIrp(param_2,iVar14); LAB_3: NBT_DEREFERENCE_DEVICE(param_1,0,'\0'); - return iVar12; + return iVar14; } ``` ## NTReceive ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.52| |i_ratio|0.45| |m_ratio|0.91| |b_ratio|0.65| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NTReceive|NTReceive| |fullname|NTReceive|NTReceive| |refcount|2|2| |`length`|1009|1227| |`called`|
Expand for full list:
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtBuildIrpForIndicateBuffer
NbtDequeueClientIrp
NbtDereferenceLowerConnection
NbtProcessClientIrp
NbtQueueClientReceiveIrpOutOfRsrcKill
WPP_SF_qddds
WPP_SF_qqq
WPP_SF_qqqss
|
Expand for full list:
Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NTIoComplete
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtBuildIrpForIndicateBuffer
NbtDequeueClientIrp
NbtDereferenceLowerConnectionNbtProcessClientIrp
NbtQueueClientReceiveIrp
OutOfRsrcKill
WPP_SF_qddds
WPP_SF_qqq
WPP_SF_qqqss
| |calling|NbtDispatchInternalCtrl|NbtDispatchInternalCtrl| |paramcount|2|2| |`address`|14002db44|14002dd94| |sig|int __fastcall NTReceive(undefined8 param_1, undefined8 * param_2)|int __fastcall NTReceive(undefined8 param_1, undefined8 * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NTReceive Called Diff ```diff --- NTReceive called +++ NTReceive called @@ -0,0 +1,2 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline +NTIoComplete ``` ### NTReceive Diff ```diff --- NTReceive +++ NTReceive @@ -1,117 +1,150 @@ int NTReceive(undefined8 param_1,undefined8 *param_2) { undefined8 **ppuVar1; longlong *plVar2; longlong lVar3; undefined1 uVar4; int iVar5; - undefined8 *puVar6; - undefined8 uVar7; - uint uVar8; - undefined8 **ppuVar9; - undefined8 *puVar10; - undefined8 *puVar11; + ulonglong uVar6; + undefined8 *puVar7; + undefined8 uVar8; + longlong *plVar9; + uint uVar10; + undefined8 **ppuVar11; + bool bVar12; undefined8 *local_res10; ppuVar1 = *(undefined8 ***)(*(longlong *)(param_2[0x17] + 0x30) + 0x18); if (ppuVar1 == (undefined8 **)0x0) { return -0x3fffffff; } local_res10 = param_2; uVar4 = KeAcquireSpinLockRaiseToDpc(ppuVar1 + 0x1f); if ((((*(int *)(ppuVar1 + 2) + 0xce9190bdU & 0xfeffffff) != 0) || (*(int *)(ppuVar1 + 6) != 7)) && (ppuVar1[3] == (undefined8 *)0x0)) { KeReleaseSpinLock(ppuVar1 + 0x1f, CONCAT31((int3)(*(int *)(ppuVar1 + 2) + 0xce9190bdU >> 8),uVar4)); return -0x3fffffff; } *(byte *)(param_2[0x17] + 3) = *(byte *)(param_2[0x17] + 3) | 1; plVar2 = ppuVar1[3]; - KeAcquireSpinLockAtDpcLevel(plVar2 + 0xd); + plVar9 = plVar2 + 0xd; + KeAcquireSpinLockAtDpcLevel(); if ((DAT_0 & 8) != 0) { - WPP_SF_qqq(0x41b,0x33,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,plVar2); + plVar9 = (longlong *)0x41b; + WPP_SF_qqq(0x41b,0x33,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,plVar2); } if (((code *)plVar2[0x19] != PartialReceive) || ((*(byte *)(plVar2 + 0xf) & 0x20) != 0)) { if ((DAT_0 & 8) != 0) { WPP_SF_qqqss(); } iVar5 = NbtQueueClientReceiveIrp((longlong)ppuVar1,(longlong)param_2); KeReleaseSpinLockFromDpcLevel(plVar2 + 0xd); KeReleaseSpinLock(ppuVar1 + 0x1f,uVar4); return iVar5; } - if ((DAT_1 & 0x40) != 0) { - WPP_SF_qddds((ulonglong)*(uint *)((longlong)plVar2 + 0x14),0xb, - &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,plVar2); + uVar6 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 == 0) { + if ((DAT_1 & 0x40) != 0) { + WPP_SF_qddds((ulonglong)*(uint *)((longlong)plVar2 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,plVar2); + } + LOCK(); + *(int *)((longlong)plVar2 + 0x14) = *(int *)((longlong)plVar2 + 0x14) + 1; + UNLOCK(); + param_2 = local_res10; } - puVar10 = local_res10; - LOCK(); - *(int *)((longlong)plVar2 + 0x14) = *(int *)((longlong)plVar2 + 0x14) + 1; - UNLOCK(); + else { + uVar10 = *(uint *)((longlong)plVar2 + 0x14); + while (0 < (int)uVar10) { + plVar9 = (longlong *)(ulonglong)(uVar10 + 1); + LOCK(); + bVar12 = uVar10 == *(uint *)((longlong)plVar2 + 0x14); + if (bVar12) { + *(uint *)((longlong)plVar2 + 0x14) = uVar10 + 1; + } + UNLOCK(); + param_2 = local_res10; + if (bVar12) { + bVar12 = true; + goto LAB_2; + } + uVar10 = *(uint *)((longlong)plVar2 + 0x14); + } + bVar12 = false; +LAB_2: + if ((DAT_1 & 0x40) != 0) { + WPP_SF_qddds(plVar9,0xc,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,plVar2); + } + if (!bVar12) { + KeReleaseSpinLockFromDpcLevel(plVar2 + 0xd); + KeReleaseSpinLock(ppuVar1 + 0x1f,uVar4); + param_2[7] = 0; + NTIoComplete((longlong)param_2,0xc000020c,0); + return 0x103; + } + } if ((DAT_0 & 8) != 0) { - WPP_SF_qqq(0x41b,0x35,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,plVar2); + WPP_SF_qqq(0x41b,0x35,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,plVar2); } - uVar8 = *(int *)(ppuVar1 + 0x1a) - *(int *)((longlong)ppuVar1 + 0xd4); - ppuVar9 = (undefined8 **)(ulonglong)uVar8; - puVar11 = puVar10; - puVar6 = NbtProcessClientIrp((char *)plVar2,uVar8,puVar10,'\x01'); - iVar5 = (int)puVar6; + uVar10 = *(int *)(ppuVar1 + 0x1a) - *(int *)((longlong)ppuVar1 + 0xd4); + ppuVar11 = (undefined8 **)(ulonglong)uVar10; + puVar7 = NbtProcessClientIrp((char *)plVar2,uVar10,param_2,'\x01'); + iVar5 = (int)puVar7; if (iVar5 != -0x3fffffea) { if ((DAT_0 & 8) != 0) { - puVar11 = (undefined8 *)&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids; - WPP_SF_qqq(0x41b,0x36,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,plVar2); + WPP_SF_qqq(0x41b,0x36,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,plVar2); } - ppuVar9 = ppuVar1; + ppuVar11 = ppuVar1; local_res10 = NbtDequeueClientIrp((char *)plVar2,(longlong)ppuVar1); - puVar10 = local_res10; + param_2 = local_res10; if ((local_res10 != (undefined8 *)0x0) || - (*(int *)(ppuVar1 + 0x1a) != *(int *)((longlong)ppuVar1 + 0xd4))) goto LAB_2; - ppuVar9 = &local_res10; - uVar7 = NbtBuildIrpForIndicateBuffer((longlong)plVar2,(longlong *)ppuVar9); - puVar10 = local_res10; - iVar5 = (int)uVar7; + (*(int *)(ppuVar1 + 0x1a) != *(int *)((longlong)ppuVar1 + 0xd4))) goto LAB_3; + ppuVar11 = &local_res10; + uVar8 = NbtBuildIrpForIndicateBuffer((longlong)plVar2,(longlong *)ppuVar11); + param_2 = local_res10; + iVar5 = (int)uVar8; if (iVar5 < 0) { KeReleaseSpinLockFromDpcLevel(plVar2 + 0xd); - uVar7 = CONCAT71((int7)((ulonglong)ppuVar9 >> 8),uVar4); - KeReleaseSpinLock(ppuVar1 + 0x1f,uVar7); - ppuVar9 = (undefined8 **)CONCAT71((int7)((ulonglong)uVar7 >> 8),6); + uVar8 = CONCAT71((int7)((ulonglong)ppuVar11 >> 8),uVar4); + KeReleaseSpinLock(ppuVar1 + 0x1f,uVar8); + ppuVar11 = (undefined8 **)CONCAT71((int7)((ulonglong)uVar8 >> 8),6); OutOfRsrcKill(plVar2,'\x06'); uVar4 = KeAcquireSpinLockRaiseToDpc(ppuVar1 + 0x1f); KeAcquireSpinLockAtDpcLevel(plVar2 + 0xd); - puVar10 = local_res10; - if (iVar5 != -0x3fffffea) goto LAB_2; + param_2 = local_res10; + if (iVar5 != -0x3fffffea) goto LAB_3; } else { - if (local_res10 == (undefined8 *)0x0) goto LAB_2; + if (local_res10 == (undefined8 *)0x0) goto LAB_3; if ((DAT_0 & 8) != 0) { - ppuVar9 = (undefined8 **)0x0; - puVar11 = (undefined8 *)&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids; - WPP_SF_qqq(0x41b,0x37,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,plVar2); + ppuVar11 = (undefined8 **)0x0; + WPP_SF_qqq(0x41b,0x37,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,plVar2); } iVar5 = -0x3fffffea; } } *(undefined4 *)((longlong)plVar2 + 0x5c) = 0; plVar2[0x19] = (longlong)PostedIrp; *(undefined4 *)(plVar2 + 0x1a) = 7; - plVar2[0x1b] = (longlong)puVar10; -LAB_2: + plVar2[0x1b] = (longlong)param_2; +LAB_3: lVar3 = plVar2[6]; KeReleaseSpinLockFromDpcLevel(plVar2 + 0xd); - uVar7 = CONCAT71((int7)((ulonglong)ppuVar9 >> 8),uVar4); + uVar8 = CONCAT71((int7)((ulonglong)ppuVar11 >> 8),uVar4); KeReleaseSpinLock(ppuVar1 + 0x1f); if (iVar5 == -0x3fffffea) { if ((DAT_0 & 8) != 0) { - WPP_SF_qqq(0x41b,0x38,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,plVar2); + WPP_SF_qqq(0x41b,0x38,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,plVar2); } - uVar7 = IoGetRelatedDeviceObject(lVar3); - IofCallDriver(uVar7,puVar10); + uVar8 = IoGetRelatedDeviceObject(lVar3); + IofCallDriver(uVar8,param_2); } else { - NbtDereferenceLowerConnection((longlong)plVar2,uVar7,puVar11,0x1327); + NbtDereferenceLowerConnection((longlong)plVar2,uVar8,'\0'); } return 0x103; } ``` ## TdiConnect ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.85| |i_ratio|0.37| |m_ratio|0.98| |b_ratio|0.67| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|TdiConnect|TdiConnect| |fullname|TdiConnect|TdiConnect| |refcount|2|2| |`length`|314|319| |`called`|GetIrp
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
WPP_SF_
WPP_SF_q
_guard_dispatch_icall|Feature_1180933432__private_IsEnabledDeviceUsageNoInline
GetIrp
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
WPP_SF_
WPP_SF_q
_guard_dispatch_icall| |calling|TcpSessionStart|TcpSessionStart| |paramcount|4|4| |`address`|140013be8|140027ed8| |sig|undefined8 __fastcall TdiConnect(undefined8 * param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall TdiConnect(undefined8 * param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### TdiConnect Called Diff ```diff --- TdiConnect called +++ TdiConnect called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline ``` ### TdiConnect Diff ```diff --- TdiConnect +++ TdiConnect @@ -1,49 +1,53 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ undefined8 TdiConnect(undefined8 *param_1,undefined8 param_2,undefined8 param_3,longlong param_4) { undefined8 uVar1; longlong lVar2; longlong lVar3; undefined8 uVar4; undefined8 uVar5; + ulonglong uVar6; longlong local_res8; uVar1 = *param_1; local_res8 = 0; uVar4 = IoGetRelatedDeviceObject(uVar1); uVar5 = GetIrp(&local_res8); - lVar3 = local_res8; if ((int)uVar5 < 0) { if ((DAT_0 & 0x10) != 0) { - WPP_SF_(0x40c,0xb,&WPP_fa19288d55e93bdc32b2b8b93e71d639_Traceguids); + WPP_SF_(0x40c,0xb,&WPP_7f880de7eb6432df89721dc29693dbd1_Traceguids); } (*(code *)param_1[1])(param_1[2],0xc000009a,0); } else { - uVar5 = param_1[1]; + uVar6 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + lVar3 = local_res8; + if (((int)uVar6 != 0) && (param_4 == 0)) { + param_4 = local_res8; + } *(undefined8 *)(local_res8 + 0x68) = 0; - *(undefined8 *)(local_res8 + 0x58) = uVar5; + *(undefined8 *)(local_res8 + 0x58) = param_1[1]; *(undefined8 *)(local_res8 + 0x60) = param_1[2]; lVar2 = *(longlong *)(param_4 + 0xb8); *(code **)(lVar2 + -0x10) = TcpConnectComplete; *(longlong *)(lVar2 + -8) = local_res8; *(undefined1 *)(lVar2 + -0x45) = 0xe0; lVar2 = *(longlong *)(param_4 + 0xb8); *(undefined8 *)(lVar2 + -0x30) = 0; *(undefined2 *)(lVar2 + -0x48) = 0x30f; *(undefined8 *)(lVar2 + -0x20) = uVar4; *(undefined8 *)(lVar2 + -0x18) = uVar1; *(undefined8 *)(lVar2 + -0x38) = param_3; *(undefined8 *)(lVar2 + -0x28) = param_2; if ((DAT_1 & 0x40) != 0) { - WPP_SF_q(0x416,0xc,&WPP_fa19288d55e93bdc32b2b8b93e71d639_Traceguids,param_4); + WPP_SF_q(0x416,0xc,&WPP_7f880de7eb6432df89721dc29693dbd1_Traceguids,param_4); } *(undefined8 *)(lVar3 + 8) = 0; IofCallDriver(uVar4,param_4); } return 0x103; } ``` ## IndicateBufferCompletion ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.31| |i_ratio|0.43| |m_ratio|0.95| |b_ratio|0.65| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|IndicateBufferCompletion|IndicateBufferCompletion| |fullname|IndicateBufferCompletion|IndicateBufferCompletion| |refcount|4|4| |`length`|405|440| |`called`|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection
NbtFreeIrp
NbtProcessNewMessageInIndicateBuffer
NbtQueueDeferredPostIrp
OutOfRsrcKillUnderLock
WPP_SF_qqqddd|Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection
NbtFreeIrp
NbtProcessNewMessageInIndicateBuffer
NbtQueueDeferredPostIrp
OutOfRsrcKillUnderLock
WPP_SF_qqqddd| |calling||| |paramcount|3|3| |`address`|14002f570|14002f890| |`sig`|undefined8 __fastcall IndicateBufferCompletion(undefined8 param_1, longlong param_2, longlong * param_3)|undefined8 __fastcall IndicateBufferCompletion(undefined8 param_1, longlong * param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IndicateBufferCompletion Called Diff ```diff --- IndicateBufferCompletion called +++ IndicateBufferCompletion called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline ``` ### IndicateBufferCompletion Diff ```diff --- IndicateBufferCompletion +++ IndicateBufferCompletion @@ -1,66 +1,80 @@ -undefined8 IndicateBufferCompletion(undefined8 param_1,longlong param_2,longlong *param_3) +undefined8 IndicateBufferCompletion(undefined8 param_1,longlong *param_2,longlong *param_3) { - int iVar1; - uint uVar2; - undefined1 uVar3; - bool bVar4; - ulonglong uVar5; - longlong *plVar6; - undefined8 uVar7; + uint uVar1; + bool bVar2; + longlong lVar3; + undefined1 uVar4; + bool bVar5; + int iVar6; + ulonglong uVar7; longlong *plVar8; longlong *plVar9; + undefined8 uVar10; + longlong *plVar11; int local_res10 [2]; int local_res18 [2]; - longlong *local_res20; + longlong local_res20; - plVar8 = (longlong *)param_3[3]; - iVar1 = *(int *)(param_2 + 0x30); - uVar2 = *(uint *)(param_2 + 0x38); - local_res20 = (longlong *)0x0; + plVar9 = (longlong *)param_3[3]; + lVar3 = param_2[6]; + uVar1 = *(uint *)(param_2 + 7); + local_res20 = 0; local_res18[0] = 0; - bVar4 = true; + bVar2 = true; local_res10[0] = 0; - plVar9 = param_3; - uVar3 = KeAcquireSpinLockRaiseToDpc(param_3 + 0xd); + plVar8 = param_2; + plVar11 = param_3; + uVar4 = KeAcquireSpinLockRaiseToDpc(); if ((DAT_0 & 8) != 0) { - WPP_SF_qqqddd((ulonglong)*(uint *)(param_3 + 0x23),0x17,plVar9,param_3); + plVar8 = (longlong *)0x0; + WPP_SF_qqqddd((ulonglong)*(uint *)(param_3 + 0x23),0x17,plVar11,param_3); } - plVar6 = (longlong *)0x0; - param_3[0x21] = param_3[0x21] + (ulonglong)uVar2; + param_3[0x21] = param_3[0x21] + (ulonglong)uVar1; param_3[0x1b] = 0; - *(uint *)((longlong)param_3 + 0x11c) = - -(uint)(uVar2 < *(uint *)((longlong)param_3 + 0x11c)) & - *(uint *)((longlong)param_3 + 0x11c) - uVar2; - if ((plVar8 != (longlong *)0x0) && ((int)param_3[0xb] == 7)) { - if (iVar1 == 0) { - *(uint *)(param_3 + 0x23) = (int)param_3[0x23] + uVar2; - plVar9 = (longlong *)0x20; - plVar6 = param_3; - uVar5 = NbtProcessNewMessageInIndicateBuffer - (param_1,param_3,0x20,local_res18,param_3[0x1d],(longlong *)&local_res20, - local_res10); - if ((int)uVar5 == -0x3fffffea) { - plVar9 = local_res20; - bVar4 = NbtQueueDeferredPostIrp - (param_3,(longlong)plVar8,(longlong)local_res20,local_res10[0]); - bVar4 = !bVar4; - plVar6 = plVar8; + if (uVar1 < *(uint *)((longlong)param_3 + 0x11c)) { + iVar6 = *(uint *)((longlong)param_3 + 0x11c) - uVar1; + } + else { + iVar6 = 0; + } + *(int *)((longlong)param_3 + 0x11c) = iVar6; + if ((plVar9 != (longlong *)0x0) && ((int)param_3[0xb] == 7)) { + if ((int)lVar3 == 0) { + *(uint *)(param_3 + 0x23) = (int)param_3[0x23] + uVar1; + plVar8 = param_3; + uVar7 = NbtProcessNewMessageInIndicateBuffer + (param_1,param_3,0x20,local_res18,param_3[0x1d],&local_res20,local_res10); + if ((int)uVar7 == -0x3fffffea) { + bVar5 = NbtQueueDeferredPostIrp(param_3,(longlong)plVar9,local_res20,local_res10[0]); + plVar8 = plVar9; + bVar2 = true; + if (bVar5) { + bVar2 = false; + } } } else { - plVar6 = (longlong *)0x0; + plVar8 = (longlong *)CONCAT71((int7)((ulonglong)plVar8 >> 8),8); OutOfRsrcKillUnderLock(param_3,'\b'); } } - uVar7 = CONCAT71((int7)((ulonglong)plVar6 >> 8),uVar3); + uVar10 = CONCAT71((int7)((ulonglong)plVar8 >> 8),uVar4); KeReleaseSpinLock(param_3 + 0xd); - if (bVar4) { - NbtDereferenceLowerConnection((longlong)param_3,uVar7,plVar9,0x453); + uVar7 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 != 0) { + param_2[1] = 0; + NbtFreeIrp((longlong)param_2); } - *(undefined8 *)(param_2 + 8) = 0; - NbtFreeIrp(param_2); + if (bVar2) { + NbtDereferenceLowerConnection((longlong)param_3,uVar10,'\0'); + } + uVar7 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + param_2[1] = 0; + NbtFreeIrp((longlong)param_2); + } return 0xc0000016; } ``` ## NbtWorkItemPostIrpToProvider ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.97| |i_ratio|0.72| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtWorkItemPostIrpToProvider|NbtWorkItemPostIrpToProvider| |fullname|NbtWorkItemPostIrpToProvider|NbtWorkItemPostIrpToProvider| |refcount|3|3| |`length`|212|215| |called|NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection
NbtFreeIrp|NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection
NbtFreeIrp| |calling||| |paramcount|3|2| |`address`|140030160|1400304a0| |`sig`|undefined __fastcall NbtWorkItemPostIrpToProvider(undefined8 param_1, longlong param_2, undefined8 param_3)|undefined __fastcall NbtWorkItemPostIrpToProvider(undefined8 param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtWorkItemPostIrpToProvider Diff ```diff --- NbtWorkItemPostIrpToProvider +++ NbtWorkItemPostIrpToProvider @@ -1,34 +1,34 @@ -void NbtWorkItemPostIrpToProvider(undefined8 param_1,longlong param_2,undefined8 param_3) +void NbtWorkItemPostIrpToProvider(undefined8 param_1,longlong param_2) { longlong lVar1; longlong lVar2; undefined1 uVar3; undefined8 uVar4; longlong lVar5; undefined7 uVar6; lVar5 = param_2; IoFreeWorkItem(*(undefined8 *)(param_2 + 0xe0)); lVar1 = param_2 + 0x68; uVar3 = KeAcquireSpinLockRaiseToDpc(lVar1); *(undefined8 *)(param_2 + 0xe0) = 0; lVar2 = *(longlong *)(param_2 + 0xd8); uVar6 = (undefined7)((ulonglong)lVar5 >> 8); if ((*(longlong *)(param_2 + 0x18) == 0) || (*(int *)(param_2 + 0x58) != 7)) { uVar4 = CONCAT71(uVar6,uVar3); KeReleaseSpinLock(lVar1); *(undefined8 *)(lVar2 + 8) = 0; NbtFreeIrp(lVar2); - NbtDereferenceLowerConnection(param_2,uVar4,param_3,0x232); + NbtDereferenceLowerConnection(param_2,uVar4,'\0'); } else { uVar4 = *(undefined8 *)(param_2 + 0x30); KeReleaseSpinLock(lVar1,CONCAT71(uVar6,uVar3)); uVar4 = IoGetRelatedDeviceObject(uVar4); IofCallDriver(uVar4,lVar2); } return; } ``` ## RsrcKillCompletion ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.94| |i_ratio|0.56| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|RsrcKillCompletion|RsrcKillCompletion| |fullname|RsrcKillCompletion|RsrcKillCompletion| |refcount|4|4| |`length`|277|292| |called|DisconnectHndlrNotOs
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeInitializeDpc
NTOSKRNL.EXE::KeInsertQueueDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection|DisconnectHndlrNotOs
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeInitializeDpc
NTOSKRNL.EXE::KeInsertQueueDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection| |calling||| |paramcount|3|3| |`address`|140030470|1400307b0| |sig|undefined8 __fastcall RsrcKillCompletion(undefined8 param_1, undefined8 param_2, longlong * param_3)|undefined8 __fastcall RsrcKillCompletion(undefined8 param_1, undefined8 param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RsrcKillCompletion Diff ```diff --- RsrcKillCompletion +++ RsrcKillCompletion @@ -1,42 +1,41 @@ undefined8 RsrcKillCompletion(undefined8 param_1,undefined8 param_2,longlong *param_3) { undefined8 *puVar1; code *pcVar2; undefined8 *puVar3; longlong lVar4; undefined1 uVar5; undefined8 uVar6; longlong *plVar7; - uVar6 = 0; plVar7 = param_3; DisconnectHndlrNotOs(0,param_3,0,0,0,0,2,*(undefined1 *)((longlong)param_3 + 0x7d)); - NbtDereferenceLowerConnection((longlong)param_3,plVar7,uVar6,0x106d); + NbtDereferenceLowerConnection((longlong)param_3,plVar7,'\0'); uVar5 = KeAcquireSpinLockRaiseToDpc(&DAT_0); lVar4 = DAT_1; puVar3 = DAT_2; DAT_3 = param_2; - if (((undefined8 **)DAT_2 != &DAT_2) && (DAT_1400394e0 != 0)) { + if (((undefined8 **)DAT_2 != &DAT_2) && (DAT_14003a520 != 0)) { DAT_1 = 0; puVar1 = (undefined8 *)*DAT_2; if (((undefined8 **)DAT_2[1] != &DAT_2) || ((undefined8 *)puVar1[1] != DAT_2)) { pcVar2 = (code *)swi(0x29); (*pcVar2)(3); pcVar2 = (code *)swi(3); uVar6 = (*pcVar2)(); return uVar6; } DAT_2 = puVar1; puVar1[1] = &DAT_2; puVar3[1] = 0x6109; *puVar3 = 0x6109; KeInitializeDpc(lVar4,DpcNextOutOfRsrcKill); KeInsertQueueDpc(lVar4,0,0); } KeReleaseSpinLock(&DAT_0,uVar5); return 0xc0000016; } ``` ## TdiReceiveHandler ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.33| |i_ratio|0.18| |m_ratio|0.94| |b_ratio|0.51| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|TdiReceiveHandler|TdiReceiveHandler| |fullname|TdiReceiveHandler|TdiReceiveHandler| |refcount|3|3| |`length`|762|801| |`called`|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceConnection
NbtDereferenceLowerConnection
NbtValidateReceiveRequest
WPP_SF_qddds
WPP_SF_qqddq
WPP_SF_qqdqdd
WPP_SF_qqdqq
_guard_dispatch_icall|
Expand for full list:
Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceConnection
NbtDereferenceLowerConnection
NbtValidateReceiveRequest
WPP_SF_qddds
WPP_SF_qqddq
WPP_SF_qqdqdd
WPP_SF_qqdqq
_guard_dispatch_icall
| |calling||| |paramcount|8|8| |`address`|140016100|140027bb0| |`sig`|int __fastcall TdiReceiveHandler(undefined8 param_1, longlong param_2, ushort param_3, undefined4 param_4, uint param_5, uint * param_6, undefined8 param_7, longlong * param_8)|int __fastcall TdiReceiveHandler(undefined8 param_1, longlong param_2, undefined * param_3, undefined4 param_4, uint param_5, uint * param_6, undefined8 param_7, longlong * param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### TdiReceiveHandler Called Diff ```diff --- TdiReceiveHandler called +++ TdiReceiveHandler called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline ``` ### TdiReceiveHandler Diff ```diff --- TdiReceiveHandler +++ TdiReceiveHandler @@ -1,98 +1,126 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -int TdiReceiveHandler(undefined8 param_1,longlong param_2,ushort param_3,undefined4 param_4, +int TdiReceiveHandler(undefined8 param_1,longlong param_2,undefined *param_3,undefined4 param_4, uint param_5,uint *param_6,undefined8 param_7,longlong *param_8) { char *pcVar1; longlong *plVar2; - int iVar3; - longlong lVar4; - undefined1 uVar5; - int iVar6; - longlong lVar7; - longlong lVar8; - undefined8 uVar9; - char *pcVar10; - undefined8 in_stack_ffffffffffffff98; - undefined4 uVar11; + uint uVar3; + int iVar4; + longlong lVar5; + undefined1 uVar6; + int iVar7; + ulonglong uVar8; + ulonglong uVar9; + longlong lVar10; + longlong lVar11; + undefined8 uVar12; + undefined *puVar13; + bool bVar14; - uVar11 = (undefined4)((ulonglong)in_stack_ffffffffffffff98 >> 0x20); - iVar6 = -0x3ffffde5; + uVar9 = param_2 + 0x68; + iVar7 = -0x3ffffde5; *param_6 = 0; *param_8 = 0; - lVar8 = param_2; - uVar5 = KeAcquireSpinLockRaiseToDpc(param_2 + 0x68); + lVar11 = param_2; + puVar13 = param_3; + uVar6 = KeAcquireSpinLockRaiseToDpc(); if (*(int *)(param_2 + 0x58) < 8) { - if ((DAT_0 & 0x40) != 0) { - lVar8 = 0; - WPP_SF_qddds((ulonglong)*(uint *)(param_2 + 0x14),0xb, - &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,param_2); - } - pcVar10 = "minio\\netbt\\sys\\nt\\tdihndlr.c"; - LOCK(); - *(int *)(param_2 + 0x14) = *(int *)(param_2 + 0x14) + 1; - UNLOCK(); - lVar4 = *(longlong *)(param_2 + 0x18); - if (lVar4 != 0) { + uVar8 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 == 0) { if ((DAT_0 & 0x40) != 0) { - lVar8 = 0; - pcVar10 = &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids; - WPP_SF_qddds((ulonglong)*(uint *)(lVar4 + 0x14),10, - &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,lVar4); + puVar13 = &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids; + lVar11 = 0; + WPP_SF_qddds((ulonglong)*(uint *)(param_2 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,param_2); } LOCK(); - *(int *)(lVar4 + 0x14) = *(int *)(lVar4 + 0x14) + 1; + *(int *)(param_2 + 0x14) = *(int *)(param_2 + 0x14) + 1; UNLOCK(); } - if ((DAT_1 & 8) != 0) { - lVar7 = lVar4; + else { + do { + uVar3 = *(uint *)(param_2 + 0x14); + if ((int)uVar3 < 1) { + bVar14 = false; + goto LAB_1; + } + uVar9 = (ulonglong)(uVar3 + 1); + LOCK(); + bVar14 = uVar3 == *(uint *)(param_2 + 0x14); + if (bVar14) { + *(uint *)(param_2 + 0x14) = uVar3 + 1; + } + UNLOCK(); + } while (!bVar14); + bVar14 = true; +LAB_1: + if ((DAT_0 & 0x40) != 0) { + puVar13 = &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids; + lVar11 = 0; + WPP_SF_qddds(uVar9,0xc,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,param_2); + } + if (!bVar14) goto LAB_2; + } + lVar5 = *(longlong *)(param_2 + 0x18); + if (lVar5 != 0) { + if ((DAT_0 & 0x40) != 0) { + puVar13 = &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids; + lVar11 = 0; + WPP_SF_qddds((ulonglong)*(uint *)(lVar5 + 0x14),10, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar5); + } + LOCK(); + *(int *)(lVar5 + 0x14) = *(int *)(lVar5 + 0x14) + 1; + UNLOCK(); + } + if ((DAT_3 & 8) != 0) { WPP_SF_qqdqdd(); - uVar11 = (undefined4)((ulonglong)lVar7 >> 0x20); } - iVar3 = *(int *)(param_2 + 0x11c); + iVar4 = *(int *)(param_2 + 0x11c); *(uint *)(param_2 + 0x11c) = param_5; - if (((iVar3 == 0) && (*(longlong *)(param_2 + 0xd8) == 0)) && + if (((iVar4 == 0) && (*(longlong *)(param_2 + 0xd8) == 0)) && (*(longlong *)(param_2 + 0xe0) == 0)) { - pcVar10 = (char *)(ulonglong)param_3; - lVar8 = param_2; - iVar6 = (**(code **)(param_2 + 200)) - (param_1,param_2,pcVar10,param_4,CONCAT44(uVar11,param_5),param_6,param_7, - param_8); + puVar13 = (undefined *)((ulonglong)param_3 & 0xffff); + lVar11 = param_2; + iVar7 = (**(code **)(param_2 + 200)) + (param_1,param_2,puVar13,param_4,param_5,param_6,param_7,param_8); } - else if ((DAT_1 & 8) != 0) { + else if ((DAT_3 & 8) != 0) { WPP_SF_qqdqq(); } *(longlong *)(param_2 + 0x108) = *(longlong *)(param_2 + 0x108) + (ulonglong)*param_6; - if (iVar6 == -0x3fffffea) { + if (iVar7 == -0x3fffffea) { *(longlong *)(param_2 + 0xd8) = *param_8; - lVar7 = *param_8; - pcVar1 = (char *)(lVar7 + 0x43); + lVar10 = *param_8; + pcVar1 = (char *)(lVar10 + 0x43); *pcVar1 = *pcVar1 + -1; - plVar2 = (longlong *)(lVar7 + 0xb8); + plVar2 = (longlong *)(lVar10 + 0xb8); *plVar2 = *plVar2 + -0x48; NbtValidateReceiveRequest(*param_8); } - lVar7 = param_2 + 0x68; - uVar9 = CONCAT71((int7)((ulonglong)lVar8 >> 8),uVar5); + lVar10 = param_2 + 0x68; + uVar12 = CONCAT71((int7)((ulonglong)lVar11 >> 8),uVar6); KeReleaseSpinLock(); - if ((DAT_1 & 8) != 0) { - uVar9 = 0x2c; - WPP_SF_qqddq(lVar7,0x2c,pcVar10,param_2); + if ((DAT_3 & 8) != 0) { + uVar12 = 0x2c; + WPP_SF_qqddq(lVar10,0x2c,puVar13,param_2); } - if (iVar6 != -0x3fffffea) { - NbtDereferenceLowerConnection(param_2,uVar9,pcVar10,0x90e); + if (iVar7 != -0x3fffffea) { + NbtDereferenceLowerConnection(param_2,uVar12,'\0'); } - if (lVar4 != 0) { - NbtDereferenceConnection(lVar4,uVar9,(undefined *)0x912,0x140033c38); + if (lVar5 != 0) { + NbtDereferenceConnection(lVar5,uVar12,(undefined *)0x937,0x1400341a0); } } else { +LAB_2: *param_6 = param_5; - KeReleaseSpinLock(param_2 + 0x68,uVar5); - iVar6 = 0; + KeReleaseSpinLock(param_2 + 0x68,uVar6); + iVar7 = 0; } - return iVar6; + return iVar7; } ``` ## NbtWorkItemPostClientIrpToProvider ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.9| |i_ratio|0.74| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtWorkItemPostClientIrpToProvider|NbtWorkItemPostClientIrpToProvider| |fullname|NbtWorkItemPostClientIrpToProvider|NbtWorkItemPostClientIrpToProvider| |refcount|3|3| |`length`|331|334| |called|NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceConnection
NbtDereferenceLowerConnection|NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceConnection
NbtDereferenceLowerConnection| |calling||| |paramcount|2|2| |`address`|140019cf0|140018ea0| |sig|undefined __fastcall NbtWorkItemPostClientIrpToProvider(undefined8 param_1, longlong param_2)|undefined __fastcall NbtWorkItemPostClientIrpToProvider(undefined8 param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtWorkItemPostClientIrpToProvider Diff ```diff --- NbtWorkItemPostClientIrpToProvider +++ NbtWorkItemPostClientIrpToProvider @@ -1,45 +1,43 @@ void NbtWorkItemPostClientIrpToProvider(undefined8 param_1,longlong param_2) { longlong lVar1; longlong lVar2; undefined1 uVar3; undefined8 uVar4; longlong lVar5; - undefined8 uVar6; lVar5 = param_2; IoFreeWorkItem(*(undefined8 *)(param_2 + 0xe0)); lVar1 = param_2 + 0x68; uVar3 = KeAcquireSpinLockRaiseToDpc(lVar1); *(undefined8 *)(param_2 + 0xe0) = 0; uVar4 = CONCAT71((int7)((ulonglong)lVar5 >> 8),uVar3); lVar5 = *(longlong *)(param_2 + 0xd8); if ((*(longlong *)(param_2 + 0x18) == 0) || (*(int *)(param_2 + 0x58) != 7)) { *(undefined8 *)(lVar5 + 8) = *(undefined8 *)(param_2 + 0x120); lVar2 = *(longlong *)(param_2 + 0x20); *(undefined8 *)(param_2 + 0x20) = 0; *(undefined8 *)(param_2 + 0x120) = 0; *(undefined8 *)(param_2 + 0xd8) = 0; KeReleaseSpinLock(lVar1,uVar4); *(undefined8 *)(lVar5 + 0x38) = 0; uVar4 = CONCAT71((int7)((ulonglong)uVar4 >> 8),2); *(undefined4 *)(lVar5 + 0x30) = 0xc000020d; IofCompleteRequest(lVar5); - uVar6 = 0x1f8; - NbtDereferenceConnection(lVar2,uVar4,(undefined *)0x1f8,0x140033c38); - NbtDereferenceLowerConnection(param_2,uVar4,uVar6,0x1f9); + NbtDereferenceConnection(lVar2,uVar4,(undefined *)0x1fc,0x1400341a0); + NbtDereferenceLowerConnection(param_2,uVar4,'\0'); } else { lVar2 = *(longlong *)(param_2 + 0x20); *(undefined8 *)(param_2 + 0x20) = 0; uVar4 = *(undefined8 *)(param_2 + 0x30); KeReleaseSpinLock(lVar1); uVar4 = IoGetRelatedDeviceObject(uVar4); IofCallDriver(uVar4); - NbtDereferenceConnection(lVar2,lVar5,(undefined *)0x209,0x140033c38); + NbtDereferenceConnection(lVar2,lVar5,(undefined *)0x20d,0x1400341a0); } return; } ``` ## NbtClientSetTcpInfo ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.22| |i_ratio|0.28| |m_ratio|0.84| |b_ratio|0.74| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtClientSetTcpInfo|NbtClientSetTcpInfo| |fullname|NbtClientSetTcpInfo|NbtClientSetTcpInfo| |refcount|2|2| |`length`|409|564| |`called`|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection
SetTcpInfo
WPP_SF_DDDD
WPP_SF_qddds|Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection
SetTcpInfo
WPP_SF_DDDD
WPP_SF_qddds| |calling|DispatchIoctls|DispatchIoctls| |paramcount|3|3| |`address`|140024f0c|140026cf8| |`sig`|ulonglong __fastcall NbtClientSetTcpInfo(longlong param_1, longlong param_2, uint param_3)|ulonglong __fastcall NbtClientSetTcpInfo(longlong param_1, longlong param_2, undefined4 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtClientSetTcpInfo Called Diff ```diff --- NbtClientSetTcpInfo called +++ NbtClientSetTcpInfo called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline ``` ### NbtClientSetTcpInfo Diff ```diff --- NbtClientSetTcpInfo +++ NbtClientSetTcpInfo @@ -1,53 +1,80 @@ -ulonglong NbtClientSetTcpInfo(longlong param_1,longlong param_2,uint param_3) +ulonglong NbtClientSetTcpInfo(longlong param_1,longlong param_2,undefined4 param_3) { - longlong lVar1; - undefined1 uVar2; + uint uVar1; + longlong lVar2; undefined1 uVar3; - ulonglong uVar4; + undefined1 uVar4; ulonglong uVar5; - longlong lVar6; + ulonglong uVar6; undefined8 uVar7; longlong lVar8; - ulonglong uVar9; + bool bVar9; if ((param_1 == 0) || ((*(int *)(param_1 + 0x10) + 0xce9190bdU & 0xfeffffff) != 0)) { - uVar5 = 0xc0000008; + return 0xc0000008; + } + uVar3 = KeAcquireSpinLockRaiseToDpc(param_1 + 0xf8); + uVar5 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + lVar2 = *(longlong *)(param_1 + 0x18); + if (lVar2 == 0) { +LAB_0: + KeReleaseSpinLock(param_1 + 0xf8,uVar3); + return 0xc00000be; + } + if ((int)uVar5 == 0) { + if ((*(int *)(lVar2 + 0x10) != 0x43776f4c) || (500 < *(int *)(lVar2 + 0x14))) + goto LAB_0; + } + else if (*(int *)(lVar2 + 0x10) != 0x43776f4c) goto LAB_0; + uVar5 = lVar2 + 0x68; + uVar4 = KeAcquireSpinLockRaiseToDpc(); + uVar6 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 == 0) { + if ((DAT_1 & 0x40) != 0) { + WPP_SF_qddds((ulonglong)*(uint *)(lVar2 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar2); + } + LOCK(); + *(int *)(lVar2 + 0x14) = *(int *)(lVar2 + 0x14) + 1; + UNLOCK(); } else { - lVar8 = param_1 + 0xf8; - uVar2 = KeAcquireSpinLockRaiseToDpc(lVar8); - lVar1 = *(longlong *)(param_1 + 0x18); - if (((lVar1 == 0) || (*(int *)(lVar1 + 0x10) != 0x43776f4c)) || (500 < *(int *)(lVar1 + 0x14))) - { - KeReleaseSpinLock(lVar8,uVar2); - uVar5 = 0xc00000be; + do { + uVar1 = *(uint *)(lVar2 + 0x14); + if ((int)uVar1 < 1) { + bVar9 = false; + goto LAB_2; + } + uVar5 = (ulonglong)(uVar1 + 1); + LOCK(); + bVar9 = uVar1 == *(uint *)(lVar2 + 0x14); + if (bVar9) { + *(uint *)(lVar2 + 0x14) = uVar1 + 1; + } + UNLOCK(); + } while (!bVar9); + bVar9 = true; +LAB_2: + if ((DAT_1 & 0x40) != 0) { + WPP_SF_qddds(uVar5,0xc,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar2); } - else { - lVar6 = lVar1 + 0x68; - uVar3 = KeAcquireSpinLockRaiseToDpc(); - if ((DAT_0 & 0x40) != 0) { - WPP_SF_qddds(lVar6,0xb,&WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,lVar1); - } - LOCK(); - *(int *)(lVar1 + 0x14) = *(int *)(lVar1 + 0x14) + 1; - UNLOCK(); - KeReleaseSpinLock(lVar1 + 0x68,uVar3); - KeReleaseSpinLock(lVar8,uVar2); - uVar7 = *(undefined8 *)(lVar1 + 0x30); - uVar9 = (ulonglong)param_3; - lVar8 = param_2; - uVar4 = SetTcpInfo(uVar7,param_2,param_3); - uVar5 = uVar4 & 0xffffffff; - if (((int)uVar4 < 0) && ((DAT_1 & 1) != 0)) { - lVar8 = 0x28; - uVar9 = (ulonglong)*(uint *)(param_2 + 0x10); - WPP_SF_DDDD(uVar7,0x28,uVar9,(int)uVar4); - } - NbtDereferenceLowerConnection(lVar1,lVar8,uVar9,0xc7d); + if (!bVar9) { + KeReleaseSpinLock(lVar2 + 0x68,uVar4); + goto LAB_0; } } - return uVar5; + KeReleaseSpinLock(lVar2 + 0x68,uVar4); + KeReleaseSpinLock(param_1 + 0xf8,uVar3); + uVar7 = *(undefined8 *)(lVar2 + 0x30); + lVar8 = param_2; + uVar5 = SetTcpInfo(uVar7,param_2,param_3); + if (((int)uVar5 < 0) && ((DAT_3 & 1) != 0)) { + lVar8 = 0x28; + WPP_SF_DDDD(uVar7,0x28,(ulonglong)*(uint *)(param_2 + 0x10),(int)uVar5); + } + NbtDereferenceLowerConnection(lVar2,lVar8,'\0'); + return uVar5 & 0xffffffff; } ``` ## NTSend ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.46| |i_ratio|0.29| |m_ratio|0.92| |b_ratio|0.37| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NTSend|NTSend| |fullname|NTSend|NTSend| |refcount|5|5| |`length`|994|1225| |`called`|
Expand for full list:
NBT_DEREFERENCE_DEVICE
NBT_REFERENCE_DEVICE
NTIoComplete
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtDereferenceLowerConnection
NbtGetMdlWPP_SF_
WPP_SF_q
WPP_SF_qddds
WPP_SF_qq
_guard_dispatch_icall
|
Expand for full list:
Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NBT_DEREFERENCE_DEVICE
NBT_REFERENCE_DEVICE
NTIoComplete
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtDereferenceLowerConnectionNbtGetMdl
WPP_SF_
WPP_SF_q
WPP_SF_qddds
WPP_SF_qq
_guard_dispatch_icall
| |calling|NbtDispatchInternalCtrl|NbtDispatchInternalCtrl| |paramcount|2|2| |address|14000bac0|14000bac0| |sig|undefined4 __fastcall NTSend(longlong param_1, longlong param_2)|undefined4 __fastcall NTSend(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NTSend Called Diff ```diff --- NTSend called +++ NTSend called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline ``` ### NTSend Diff ```diff --- NTSend +++ NTSend @@ -1,152 +1,189 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ undefined4 NTSend(longlong param_1,longlong param_2) { longlong lVar1; uint uVar2; int iVar3; longlong lVar4; longlong lVar5; longlong lVar6; undefined1 uVar7; undefined1 uVar8; undefined4 uVar9; undefined8 uVar10; - undefined8 uVar11; - longlong lVar12; - undefined8 *puVar13; - undefined *puVar14; - uint *puVar15; - undefined8 *local_res18 [2]; + ulonglong uVar11; + undefined8 uVar12; + ulonglong uVar13; + ushort uVar14; + undefined8 *puVar15; + uint *puVar16; + bool bVar17; + undefined8 *local_res18; + ulonglong local_res20; lVar4 = *(longlong *)(param_2 + 0xb8); - local_res18[0] = (undefined8 *)0x0; - uVar11 = 0; - puVar14 = (undefined *)0x0; + local_res18 = (undefined8 *)0x0; + uVar12 = 0; uVar10 = NBT_REFERENCE_DEVICE(param_1,0,'\0'); if ((char)uVar10 == '\0') { if ((DAT_0 & 4) != 0) { - WPP_SF_q(0x41a,0x3a,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,param_1); + WPP_SF_q(0x41a,0x3a,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,param_1); } uVar9 = 0xc0000184; goto LAB_1; } lVar5 = *(longlong *)(*(longlong *)(lVar4 + 0x30) + 0x18); if ((lVar5 == 0) || ((*(int *)(lVar5 + 0x10) + 0xce9190bdU & 0xfeffffff) != 0)) { LAB_2: uVar9 = 0xc0000008; } else { lVar1 = lVar5 + 0xf8; uVar7 = KeAcquireSpinLockRaiseToDpc(lVar1); lVar6 = *(longlong *)(lVar5 + 0x18); if (lVar6 == 0) { KeReleaseSpinLock(lVar1); if ((DAT_0 & 4) != 0) { - WPP_SF_(0x41a,0x3b,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids); + uVar14 = 0x3b; +LAB_3: + WPP_SF_(0x41a,uVar14,&WPP_1585921e7da334e1460f331ada96a477_Traceguids); } goto LAB_2; } - lVar12 = lVar6 + 0x68; + uVar13 = lVar6 + 0x68; + local_res20 = uVar13; uVar8 = KeAcquireSpinLockRaiseToDpc(); - if ((DAT_3 & 0x40) != 0) { - uVar11 = 0; - puVar14 = &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids; - WPP_SF_qddds(lVar12,0xb,&WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,lVar6); + uVar11 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar11 == 0) { + if ((DAT_4 & 0x40) != 0) { + uVar12 = 0; + WPP_SF_qddds((ulonglong)*(uint *)(lVar6 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar6); + } + LOCK(); + *(int *)(lVar6 + 0x14) = *(int *)(lVar6 + 0x14) + 1; + UNLOCK(); } - LOCK(); - *(int *)(lVar6 + 0x14) = *(int *)(lVar6 + 0x14) + 1; - UNLOCK(); - uVar11 = CONCAT71((int7)((ulonglong)uVar11 >> 8),uVar8); - KeReleaseSpinLock(lVar6 + 0x68,uVar11); + else { + do { + uVar2 = *(uint *)(lVar6 + 0x14); + if ((int)uVar2 < 1) { + bVar17 = false; + goto LAB_5; + } + uVar13 = (ulonglong)(uVar2 + 1); + LOCK(); + bVar17 = uVar2 == *(uint *)(lVar6 + 0x14); + if (bVar17) { + *(uint *)(lVar6 + 0x14) = uVar2 + 1; + } + UNLOCK(); + } while (!bVar17); + bVar17 = true; +LAB_5: + if ((DAT_4 & 0x40) != 0) { + uVar12 = 0; + WPP_SF_qddds(uVar13,0xc,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar6); + } + if (!bVar17) { + KeReleaseSpinLock(local_res20,uVar8); + KeReleaseSpinLock(lVar1); + if ((DAT_0 & 4) != 0) { + uVar14 = 0x3c; + goto LAB_3; + } + goto LAB_2; + } + } + uVar12 = CONCAT71((int7)((ulonglong)uVar12 >> 8),uVar8); + KeReleaseSpinLock(lVar6 + 0x68,uVar12); if (*(int *)(lVar5 + 0x30) == 7) { - puVar14 = *(undefined **)(param_2 + 8); - if ((puVar14 != (undefined *)0x0) && ((*(ushort *)(puVar14 + 10) >> 0xc & 1) != 0)) { - *(int *)(puVar14 + 0x2c) = *(int *)(puVar14 + 0x2c) + -4; - puVar15 = (uint *)(*(longlong *)(puVar14 + 0x18) + -4); - *(int *)(puVar14 + 0x28) = *(int *)(puVar14 + 0x28) + 4; - *(uint **)(puVar14 + 0x18) = puVar15; + lVar1 = *(longlong *)(param_2 + 8); + if ((lVar1 != 0) && ((*(ushort *)(lVar1 + 10) >> 0xc & 1) != 0)) { + *(int *)(lVar1 + 0x2c) = *(int *)(lVar1 + 0x2c) + -4; + puVar16 = (uint *)(*(longlong *)(lVar1 + 0x18) + -4); + *(int *)(lVar1 + 0x28) = *(int *)(lVar1 + 0x28) + 4; + *(uint **)(lVar1 + 0x18) = puVar16; uVar2 = *(uint *)(lVar4 + 8); - *puVar15 = uVar2 >> 0x18 | (uVar2 & 0xff0000) >> 8 | (uVar2 & 0xff00) << 8 | uVar2 << 0x18; + *puVar16 = uVar2 >> 0x18 | (uVar2 & 0xff0000) >> 8 | (uVar2 & 0xff00) << 8 | uVar2 << 0x18; if ((DAT_0 & 4) != 0) { - WPP_SF_qq(0x41a,0x3c,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,puVar15); + WPP_SF_qq(0x41a,0x3d,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,puVar16); } - goto LAB_4; + goto LAB_6; } - KeAcquireSpinLockAtDpcLevel(&DAT_5); - if (DAT_6 == (undefined8 *)0x0) { - NbtGetMdl((longlong *)local_res18); - puVar13 = local_res18[0]; - if (local_res18[0] == (undefined8 *)0x0) { + KeAcquireSpinLockAtDpcLevel(&DAT_7); + if (DAT_8 == (undefined8 *)0x0) { + NbtGetMdl((longlong *)&local_res18); + puVar15 = local_res18; + if (local_res18 == (undefined8 *)0x0) { if ((DAT_0 & 4) != 0) { - uVar11 = 0; - puVar14 = &WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids; - WPP_SF_(0x41a,0x3d,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids); + uVar12 = 0; + WPP_SF_(0x41a,0x3e,&WPP_1585921e7da334e1460f331ada96a477_Traceguids); } uVar9 = 0xc000009a; - KeReleaseSpinLockFromDpcLevel(&DAT_5); - uVar11 = CONCAT71((int7)((ulonglong)uVar11 >> 8),uVar7); - KeReleaseSpinLock(lVar1); - goto LAB_7; + KeReleaseSpinLockFromDpcLevel(&DAT_7); + uVar12 = CONCAT71((int7)((ulonglong)uVar12 >> 8),uVar7); + KeReleaseSpinLock(lVar5 + 0xf8); + goto LAB_9; } } else { - puVar13 = DAT_6; - DAT_6 = (undefined8 *)*DAT_6; + puVar15 = DAT_8; + DAT_8 = (undefined8 *)*DAT_8; } - KeReleaseSpinLockFromDpcLevel(&DAT_5); + KeReleaseSpinLockFromDpcLevel(&DAT_7); uVar2 = *(uint *)(lVar4 + 8); - *(uint *)((ulonglong)*(uint *)((longlong)puVar13 + 0x2c) + puVar13[4]) = + *(uint *)((ulonglong)*(uint *)((longlong)puVar15 + 0x2c) + puVar15[4]) = uVar2 >> 0x18 | (uVar2 & 0xff0000) >> 8 | (uVar2 & 0xff00) << 8 | uVar2 << 0x18; - *puVar13 = *(undefined8 *)(param_2 + 8); - *(undefined8 **)(param_2 + 8) = puVar13; -LAB_4: - lVar5 = *(longlong *)(param_2 + 0xb8); - *(undefined4 *)(lVar5 + -0x3c) = *(undefined4 *)(lVar4 + 0xc); + *puVar15 = *(undefined8 *)(param_2 + 8); + *(undefined8 **)(param_2 + 8) = puVar15; +LAB_6: + lVar1 = *(longlong *)(param_2 + 0xb8); + *(undefined4 *)(lVar1 + -0x3c) = *(undefined4 *)(lVar4 + 0xc); iVar3 = *(int *)(lVar4 + 8); - *(longlong *)(lVar5 + -8) = lVar6; - *(int *)(lVar5 + -0x40) = iVar3 + 4; - *(code **)(lVar5 + -0x10) = SendCompletion; - *(undefined1 *)(lVar5 + -0x45) = 0xe0; - *(undefined2 *)(lVar5 + -0x48) = 0x70f; - uVar11 = *(undefined8 *)(lVar6 + 0x30); + *(longlong *)(lVar1 + -8) = lVar6; + *(int *)(lVar1 + -0x40) = iVar3 + 4; + *(code **)(lVar1 + -0x10) = SendCompletion; + *(undefined1 *)(lVar1 + -0x45) = 0xe0; + *(undefined2 *)(lVar1 + -0x48) = 0x70f; + uVar12 = *(undefined8 *)(lVar6 + 0x30); *(longlong *)(lVar6 + 0x110) = *(longlong *)(lVar6 + 0x110) + (ulonglong)*(uint *)(lVar4 + 8); - *(undefined8 *)(lVar5 + -0x18) = uVar11; - uVar10 = IoGetRelatedDeviceObject(uVar11); - *(undefined8 *)(lVar5 + -0x20) = uVar10; - KeReleaseSpinLock(lVar1,uVar7); + *(undefined8 *)(lVar1 + -0x18) = uVar12; + uVar10 = IoGetRelatedDeviceObject(uVar12); + *(undefined8 *)(lVar1 + -0x20) = uVar10; + KeReleaseSpinLock(lVar5 + 0xf8,uVar7); if (*(longlong *)(lVar6 + 0x60) == 0) { - uVar11 = IoGetRelatedDeviceObject(uVar11); - uVar9 = IofCallDriver(uVar11); + uVar12 = IoGetRelatedDeviceObject(uVar12); + uVar9 = IofCallDriver(uVar12); } else { *(char *)(param_2 + 0x43) = *(char *)(param_2 + 0x43) + -1; *(longlong *)(param_2 + 0xb8) = *(longlong *)(param_2 + 0xb8) + -0x48; if ((DAT_0 & 4) != 0) { - WPP_SF_qq(0x41a,0x40,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,param_2); + WPP_SF_qq(0x41a,0x41,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,param_2); } uVar9 = (**(code **)(lVar6 + 0x60))(param_2); } NBT_DEREFERENCE_DEVICE(param_1,0,'\0'); return uVar9; } - uVar11 = CONCAT71((int7)((ulonglong)uVar11 >> 8),uVar7); - KeReleaseSpinLock(lVar1); + uVar12 = CONCAT71((int7)((ulonglong)uVar12 >> 8),uVar7); + KeReleaseSpinLock(lVar5 + 0xf8); if ((DAT_0 & 4) != 0) { - uVar11 = 0x41; - puVar14 = &WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids; - WPP_SF_q(0x41a,0x41,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,lVar5); + uVar12 = 0x42; + WPP_SF_q(0x41a,0x42,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,lVar5); } uVar9 = 0xc0000008; -LAB_7: - NbtDereferenceLowerConnection(lVar6,uVar11,puVar14,0x149f); +LAB_9: + NbtDereferenceLowerConnection(lVar6,uVar12,'\0'); } NBT_DEREFERENCE_DEVICE(param_1,0,'\0'); LAB_1: *(byte *)(lVar4 + 3) = *(byte *)(lVar4 + 3) & 0xfe; NTIoComplete(param_2,uVar9,0); return uVar9; } ``` ## TcpDisconnect ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.46| |i_ratio|0.15| |m_ratio|0.73| |b_ratio|0.64| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|TcpDisconnect|TcpDisconnect| |fullname|TcpDisconnect|TcpDisconnect| |refcount|3|3| |`length`|131|229| |`called`|TdiDisconnect
WPP_SF_qd|Feature_1180933432__private_IsEnabledDeviceUsageNoInline
TdiDisconnect
TdiDisconnect_Old
WPP_SF_qd| |calling|DisconnectLower
SendTcpDisconnect|DisconnectLower
SendTcpDisconnect| |paramcount|4|4| |`address`|1400139c0|1400269a0| |`sig`|int __fastcall TcpDisconnect(longlong param_1, undefined8 param_2, ulonglong param_3, undefined8 param_4)|int __fastcall TcpDisconnect(longlong param_1, undefined8 param_2, uint param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### TcpDisconnect Called Diff ```diff --- TcpDisconnect called +++ TcpDisconnect called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline @@ -1,0 +3 @@ +TdiDisconnect_Old ``` ### TcpDisconnect Diff ```diff --- TcpDisconnect +++ TcpDisconnect @@ -1,23 +1,40 @@ -int TcpDisconnect(longlong param_1,undefined8 param_2,ulonglong param_3,undefined8 param_4) +int TcpDisconnect(longlong param_1,undefined8 param_2,uint param_3,undefined8 param_4) { - int iVar1; + longlong lVar1; + char cVar2; + int iVar3; + ulonglong uVar4; undefined8 local_28; code *local_20; longlong local_18; undefined8 local_10; local_10 = 0; - local_28 = *(undefined8 *)(*(longlong *)(param_1 + 0x60) + 0x30); + cVar2 = (char)param_4; + lVar1 = *(longlong *)(param_1 + 0x60); + uVar4 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + local_28 = *(undefined8 *)(*(longlong *)(param_1 + 0x60) + 0x30); + } + else { + local_28 = *(undefined8 *)(lVar1 + 0x30); + } local_20 = DisconnectDone; - *(uint *)(param_1 + 0xf0) = (uint)param_3 & 0xffff; + *(uint *)(param_1 + 0xf0) = param_3 & 0xffff; local_18 = param_1; - iVar1 = TdiDisconnect(&local_28,param_2,param_3,param_4, - *(longlong *)(*(longlong *)(param_1 + 0x60) + 0x50),(char)param_4); + uVar4 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + iVar3 = TdiDisconnect_Old(&local_28,param_2,(ulonglong)param_3,param_4, + *(longlong *)(*(longlong *)(param_1 + 0x60) + 0x50),cVar2); + } + else { + iVar3 = TdiDisconnect(&local_28,param_2,(ulonglong)param_3,param_4,cVar2); + } if ((DAT_0 & 0x20) != 0) { - WPP_SF_qd(0x415,0xe,&WPP_dc02a1f82c2934b6fc0cb4f28219eafa_Traceguids,param_1); + WPP_SF_qd(0x415,0xe,&WPP_adfa7670aac03ca046b0a41c584da091_Traceguids,param_1); } - return iVar1; + return iVar3; } ``` ## RemoteHashTimeout ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.88| |i_ratio|0.66| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|RemoteHashTimeout|RemoteHashTimeout| |fullname|RemoteHashTimeout|RemoteHashTimeout| |refcount|9|9| |`length`|930|936| |called|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTQueueToWorkerThread
NbtDereferenceLowerConnection
NbtDereferenceName
NbtIsNameAddrExpired
NbtIsNameAddrTicking|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTQueueToWorkerThread
NbtDereferenceLowerConnection
NbtDereferenceName
NbtIsNameAddrExpired
NbtIsNameAddrTicking| |calling|DelayedNbtResyncRemoteCache|DelayedNbtResyncRemoteCache| |paramcount|3|3| |`address`|140019fa0|140019060| |sig|undefined __fastcall RemoteHashTimeout(int * param_1, undefined8 param_2, ulonglong param_3)|undefined __fastcall RemoteHashTimeout(int * param_1, undefined8 param_2, ulonglong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RemoteHashTimeout Diff ```diff --- RemoteHashTimeout +++ RemoteHashTimeout @@ -1,157 +1,153 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void RemoteHashTimeout(int *param_1,undefined8 param_2,ulonglong param_3) { int *piVar1; longlong *plVar2; undefined8 *puVar3; undefined8 *puVar4; bool bVar5; bool bVar6; undefined8 *puVar7; undefined1 uVar8; byte bVar9; uint uVar10; ulonglong uVar11; longlong *plVar12; code *pcVar13; longlong *plVar14; undefined8 *puVar15; undefined1 *puVar16; undefined1 *puVar17; int iVar18; undefined8 *puVar19; - ulonglong uVar20; - uint uVar21; - ulonglong uVar22; + uint uVar20; + ulonglong uVar21; undefined1 auStackY_78 [8]; undefined1 auStackY_70 [24]; puVar17 = auStackY_78; if (param_1 == DAT_0) { bVar5 = true; bVar6 = true; } else { bVar5 = false; bVar6 = false; if (param_3 == 0) { _DAT_1 = param_3; return; } } - uVar20 = param_3; uVar8 = KeAcquireSpinLockRaiseToDpc(&DAT_2); piVar1 = DAT_0; iVar18 = 0; - uVar22 = _DAT_3 / 10000; + uVar21 = _DAT_3 / 10000; if (0 < *DAT_0) { plVar14 = (longlong *)(DAT_0 + 2); do { KeReleaseSpinLock(&DAT_2,uVar8); uVar8 = KeAcquireSpinLockRaiseToDpc(&DAT_2); plVar2 = (longlong *)*plVar14; while (plVar12 = plVar2, plVar12 != plVar14) { plVar2 = (longlong *)*plVar12; - uVar11 = NbtIsNameAddrExpired((longlong)plVar12,uVar22); + uVar11 = NbtIsNameAddrExpired((longlong)plVar12,uVar21); if (((char)uVar11 != '\0') || ((bVar5 && (uVar11 = NbtIsNameAddrTicking((longlong)plVar12), (char)uVar11 != '\0')))) { - uVar20 = CONCAT71((int7)(uVar20 >> 8),1); NbtDereferenceName(plVar12,1,'\x01'); } } iVar18 = iVar18 + 1; plVar14 = plVar14 + 2; } while (iVar18 < *piVar1); } puVar19 = &NbtConfig; puVar15 = pNbtSmbDevice; if (pNbtSmbDevice != (undefined8 *)0x0) goto LAB_4; if ((undefined8 **)NbtConfig != &NbtConfig) { puVar15 = NbtConfig + -0x2b; puVar19 = NbtConfig; while (puVar15 != (undefined8 *)0x0) { LAB_4: bVar9 = KeAcquireSpinLockRaiseToDpc(puVar15 + 0x6a); - uVar22 = (ulonglong)bVar9; + uVar21 = (ulonglong)bVar9; if (DAT_5 < *(uint *)(puVar15 + 0x36)) { - uVar21 = 1; + uVar20 = 1; } else { - uVar21 = 6; + uVar20 = 6; if (DAT_5 >> 1 < *(uint *)(puVar15 + 0x36)) { - uVar21 = 3; + uVar20 = 3; } } puVar3 = (undefined8 *)puVar15[0x2e]; while (puVar7 = puVar3, puVar7 != puVar15 + 0x2e) { puVar3 = (undefined8 *)*puVar7; uVar10 = *(int *)((longlong)puVar7 + 0x5c) + 1; *(uint *)((longlong)puVar7 + 0x5c) = uVar10; - if (uVar21 < uVar10) { + if (uVar20 < uVar10) { if (((undefined8 *)puVar3[1] != puVar7) || (puVar4 = (undefined8 *)puVar7[1], (undefined8 *)*puVar4 != puVar7)) { pcVar13 = (code *)swi(0x29); (*pcVar13)(3); puVar17 = auStackY_70; goto LAB_6; } *puVar4 = puVar3; pcVar13 = (code *)0x0; puVar3[1] = puVar4; puVar7[1] = puVar7; *puVar7 = puVar7; puVar7[0xb] = 0; if ((*(byte *)(puVar7 + 0xf) & 8) == 0) { - uVar20 = 0; pcVar13 = DelayedAllocLowerConn; NTQueueToWorkerThread ((undefined8 *)0x0,DelayedAllocLowerConn,0,0,0,puVar7[5],'\x01',0x30); } else { LOCK(); piVar1 = (int *)(puVar7[5] + 0x1b8); *piVar1 = *piVar1 + -1; UNLOCK(); } - NbtDereferenceLowerConnection((longlong)puVar7,pcVar13,uVar20,0xd90); - NbtDereferenceLowerConnection((longlong)puVar7,pcVar13,uVar20,0xd91); + NbtDereferenceLowerConnection((longlong)puVar7,pcVar13,'\x01'); + NbtDereferenceLowerConnection((longlong)puVar7,pcVar13,'\x01'); LOCK(); *(int *)(puVar15 + 0x36) = *(int *)(puVar15 + 0x36) + -1; UNLOCK(); LOCK(); DAT_7 = DAT_7 + -1; UNLOCK(); } } - KeReleaseSpinLock(puVar15 + 0x6a,uVar22); + KeReleaseSpinLock(puVar15 + 0x6a,uVar21); puVar19 = (undefined8 *)*puVar19; puVar15 = puVar19 + -0x2b; bVar5 = bVar6; if ((undefined8 **)puVar19 == &NbtConfig) { puVar15 = (undefined8 *)0x0; } } } puVar16 = auStackY_78; if (!bVar5) { puVar16 = auStackY_78; - uVar22 = param_3; + uVar21 = param_3; if (DAT_8 == '\0') { LAB_6: - if ((DAT_7 != 0) || (puVar16 = puVar17, 0x100 < DAT_140039700)) { - *(ushort *)(uVar22 + 0x100) = *(ushort *)(uVar22 + 0x100) | 1; + if ((DAT_7 != 0) || (puVar16 = puVar17, 0x100 < DAT_14003a740)) { + *(ushort *)(uVar21 + 0x100) = *(ushort *)(uVar21 + 0x100) | 1; puVar16 = puVar17; goto LAB_9; } } DAT_10 = 0; } LAB_9: - *(undefined8 *)(puVar16 + -8) = 0x14001a15e; + *(undefined8 *)(puVar16 + -8) = 0x14001921e; KeReleaseSpinLock(&DAT_2,uVar8); return; } ``` ## DisableInboundConnections ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.1| |i_ratio|0.09| |m_ratio|0.9| |b_ratio|0.11| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|DisableInboundConnections|DisableInboundConnections| |fullname|DisableInboundConnections|DisableInboundConnections| |refcount|4|4| |`length`|1639|1285| |`called`|
Expand for full list:
CleanupConnectingState
DisconnectLower
NTIoComplete
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExQueueWorkItem
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtDereferenceConnection
NbtDereferenceLowerConnectionWPP_SF_qddds
_guard_dispatch_icall
|
Expand for full list:
CleanupConnectingState
DisconnectLower
Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NTIoComplete
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtDereferenceConnection
NbtDereferenceLowerConnection
WPP_SF_qddds_guard_dispatch_icall
| |calling|DelayedNbtDeleteDevice
NbtSetNewAddress|DelayedNbtDeleteDevice
NbtSetNewAddress| |paramcount|2|2| |`address`|140018738|140017860| |`sig`|undefined8 __fastcall DisableInboundConnections(longlong param_1, ulonglong param_2)|undefined8 __fastcall DisableInboundConnections(longlong param_1, longlong * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DisableInboundConnections Called Diff ```diff --- DisableInboundConnections called +++ DisableInboundConnections called @@ -2,0 +3 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline @@ -4,2 +4,0 @@ -NTOSKRNL.EXE::ExAllocatePool2 -NTOSKRNL.EXE::ExQueueWorkItem ``` ### DisableInboundConnections Diff ```diff --- DisableInboundConnections +++ DisableInboundConnections @@ -1,331 +1,200 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ - -undefined8 DisableInboundConnections(longlong param_1,ulonglong param_2) + +undefined8 DisableInboundConnections(longlong param_1,longlong *param_2) { - int *piVar1; - uint uVar2; - longlong lVar3; - longlong *plVar4; + uint uVar1; + int iVar2; + longlong *plVar3; + longlong lVar4; longlong *plVar5; - undefined8 uVar6; - code *pcVar7; - undefined1 uVar8; - undefined1 uVar9; - undefined8 *puVar10; - undefined *puVar11; + ulonglong *puVar6; + undefined8 uVar7; + longlong lVar8; + code *pcVar9; + undefined1 uVar10; + ulonglong uVar11; ulonglong uVar12; - undefined7 uVar14; - undefined8 uVar13; - longlong *plVar15; + ulonglong *puVar13; + undefined7 uVar15; + undefined8 uVar14; undefined1 *puVar16; - char *pcVar17; - int iVar18; - int iVar19; - longlong *plVar20; - undefined *puVar21; - longlong *plVar22; - undefined1 auStack_68 [64]; + bool bVar17; + undefined1 auStack_68 [8]; + undefined1 auStack_60 [24]; puVar16 = auStack_68; - uVar8 = KeAcquireSpinLockRaiseToDpc(&DAT_0); + uVar10 = KeAcquireSpinLockRaiseToDpc(&DAT_0); KeAcquireSpinLockAtDpcLevel(param_1 + 0x350); - plVar20 = (longlong *)0xffffffff; - plVar22 = (longlong *)(param_1 + 0x1a0); - puVar21 = &DAT_1; - while( true ) { - plVar15 = (longlong *)*plVar22; - pcVar17 = "minio\\netbt\\sys\\nbtutils.c"; - if (plVar15 == plVar22) break; - lVar3 = *plVar15; - if ((longlong *)*(longlong *)(lVar3 + 8) != plVar15) goto LAB_2; - plVar4 = (longlong *)plVar15[1]; - if ((longlong *)*plVar4 != plVar15) goto LAB_2; - *plVar4 = lVar3; - *(longlong **)(lVar3 + 8) = plVar4; - plVar15[1] = (longlong)plVar15; - *plVar15 = (longlong)plVar15; - if ((DAT_4 & 0x40) != 0) goto LAB_1400189e4; - while( true ) { - puVar11 = (undefined *)((longlong)plVar15 + 0x68); - *(undefined8 *)(puVar16 + -8) = 0x1400187ee; - uVar9 = KeAcquireSpinLockRaiseToDpc(puVar11); - pcVar17 = (char *)CONCAT71((int7)((ulonglong)pcVar17 >> 8),uVar9); - iVar18 = (int)plVar20; + while (plVar3 = *(longlong **)(param_1 + 0x1a0), plVar3 != (longlong *)(param_1 + 0x1a0)) { + lVar4 = *plVar3; + if (((longlong *)*(longlong *)(lVar4 + 8) != plVar3) || + (param_2 = (longlong *)plVar3[1], (longlong *)*param_2 != plVar3)) goto LAB_1; + *param_2 = lVar4; + *(longlong **)(lVar4 + 8) = param_2; + plVar3[1] = (longlong)plVar3; + *plVar3 = (longlong)plVar3; + NbtDereferenceLowerConnection((longlong)plVar3,param_2,'\x01'); + LOCK(); + *(int *)(param_1 + 0x380) = *(int *)(param_1 + 0x380) + -1; + UNLOCK(); + } + while (plVar3 = *(longlong **)(param_1 + 0x170), plVar3 != (longlong *)(param_1 + 0x170)) { + lVar4 = *plVar3; + if (((longlong *)*(longlong *)(lVar4 + 8) != plVar3) || + (plVar5 = (longlong *)plVar3[1], (longlong *)*plVar5 != plVar3)) goto LAB_1; + *plVar5 = lVar4; + *(longlong **)(lVar4 + 8) = plVar5; + *(undefined4 *)(plVar3 + 0xb) = 0; + *(undefined4 *)((longlong)plVar3 + 0x5c) = 0; + plVar3[1] = (longlong)plVar3; + *plVar3 = (longlong)plVar3; + if ((*(byte *)(plVar3 + 0xf) & 8) != 0) { LOCK(); - piVar1 = (int *)((longlong)plVar15 + 0x14); - iVar19 = *piVar1; - *piVar1 = *piVar1 + iVar18; + *(int *)(plVar3[5] + 0x1b8) = *(int *)(plVar3[5] + 0x1b8) + -1; UNLOCK(); - if (iVar19 + iVar18 != 0) break; + } + NbtDereferenceLowerConnection((longlong)plVar3,param_2,'\x01'); + NbtDereferenceLowerConnection((longlong)plVar3,param_2,'\x01'); + LOCK(); + *(int *)(param_1 + 0x1b0) = *(int *)(param_1 + 0x1b0) + -1; + UNLOCK(); + LOCK(); + DAT_2 = DAT_2 + -1; + UNLOCK(); + } +LAB_3: + puVar6 = *(ulonglong **)(param_1 + 400); + if (puVar6 != (ulonglong *)(param_1 + 400)) { + uVar12 = *puVar6; + if ((*(ulonglong **)(uVar12 + 8) == puVar6) && + (puVar13 = (ulonglong *)puVar6[1], (ulonglong *)*puVar13 == puVar6)) { + *puVar13 = uVar12; + *(ulonglong **)(uVar12 + 8) = puVar13; + puVar6[1] = (ulonglong)puVar6; + *puVar6 = (ulonglong)puVar6; + uVar11 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar11 != 0) goto LAB_4; + if ((DAT_5 & 0x40) != 0) { + param_2 = (longlong *)&DAT_6; + WPP_SF_qddds((ulonglong)*(uint *)((longlong)puVar6 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,puVar6); + } LOCK(); - piVar1 = (int *)(*(longlong *)((longlong)plVar15 + 0x28) + 900); - *piVar1 = *piVar1 + iVar18; + *(int *)((longlong)puVar6 + 0x14) = *(int *)((longlong)puVar6 + 0x14) + 1; UNLOCK(); - lVar3 = *(longlong *)((longlong)plVar15 + 0x18); - *(undefined4 *)((longlong)plVar15 + 0x14) = 1000; - uVar12 = 0; - if (lVar3 != 0) { - uVar2 = *(uint *)(lVar3 + 0x10); - uVar12 = (ulonglong)uVar2; - if ((uVar2 == 0x316e6f43) || (uVar2 == 0x326e6f43)) { - *(undefined4 *)(lVar3 + 0x30) = 9; - *(undefined8 *)(lVar3 + 0x18) = 0; - *(undefined8 *)((longlong)plVar15 + 0x18) = 0; - *(undefined1 *)(lVar3 + 0x10b) = 9; - *(undefined1 *)((longlong)plVar15 + 0x7c) = 9; - } + goto LAB_7; + } +LAB_1: + pcVar9 = (code *)swi(0x29); + (*pcVar9)(3); + puVar16 = auStack_60; + } + *(undefined8 *)(puVar16 + -8) = 0x140017d2a; + KeReleaseSpinLockFromDpcLevel(param_1 + 0x350); + *(undefined8 *)(puVar16 + -8) = 0x140017d40; + KeReleaseSpinLock(&DAT_0,uVar10); + return 0; +LAB_4: + do { + uVar1 = *(uint *)((longlong)puVar6 + 0x14); + if ((int)uVar1 < 1) { + bVar17 = false; + goto LAB_8; + } + uVar12 = (ulonglong)(uVar1 + 1); + LOCK(); + bVar17 = uVar1 == *(uint *)((longlong)puVar6 + 0x14); + if (bVar17) { + *(uint *)((longlong)puVar6 + 0x14) = uVar1 + 1; + } + UNLOCK(); + } while (!bVar17); + bVar17 = true; +LAB_8: + if ((DAT_5 & 0x40) != 0) { + param_2 = (longlong *)0xc; + WPP_SF_qddds(uVar12,0xc,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,puVar6); + } + if (!bVar17) goto LAB_3; +LAB_7: + KeReleaseSpinLockFromDpcLevel(param_1 + 0x350); + puVar13 = puVar6 + 0xd; + KeAcquireSpinLockAtDpcLevel(puVar13); + iVar2 = (int)puVar6[0xb]; + if (iVar2 != 7) { + if (iVar2 != 3) { + if (iVar2 == 0) { + KeReleaseSpinLockFromDpcLevel(puVar13); + uVar12 = puVar6[3]; + if (uVar12 == 0) goto LAB_9; + puVar13 = (ulonglong *)(uVar12 + 0xf8); + KeAcquireSpinLockAtDpcLevel(puVar13); + CleanupConnectingState(uVar12,param_2,uVar10); } - param_2 = CONCAT71((int7)(uVar12 >> 8),uVar9); - *(undefined8 *)(puVar16 + -8) = 0x14001884e; - KeReleaseSpinLock(puVar11,param_2); - puVar10 = (undefined8 *)((longlong)plVar15 + 0x80); - if ((puVar10 == (undefined8 *)0x0) || (*(int *)((longlong)plVar15 + 0xc0) != 0)) { - param_2 = 0x48; - pcVar17 = (char *)0x3232624e; - *(undefined8 *)(puVar16 + -8) = 0x140018948; - puVar10 = (undefined8 *)ExAllocatePool2(0x40); - if (puVar10 == (undefined8 *)0x0) goto LAB_5; - *(undefined4 *)((longlong)puVar10 + 0x3c) = 1; - } - else { - *(undefined4 *)((longlong)plVar15 + 0xbc) = 0; - } - *(undefined4 *)(puVar10 + 8) = 1; - puVar10[6] = DelayedWipeOutLowerconn; - puVar10[2] = 0; - puVar10[3] = plVar15; - puVar10[4] = 0; - puVar10[5] = 0; - *(undefined1 *)((longlong)puVar10 + 0x44) = 0x20; - puVar10[1] = puVar10; - *puVar10 = puVar10; - *(undefined8 *)(puVar16 + -8) = 0x1400188aa; - uVar9 = KeAcquireSpinLockRaiseToDpc(&DAT_6); - plVar15 = (longlong *)CONCAT71((int7)((ulonglong)plVar15 >> 8),uVar9); - if ((undefined8 *)*DAT_7 == &DAT_140039680) { - *puVar10 = &DAT_8; - puVar10[1] = DAT_7; - *DAT_7 = puVar10; - iVar19 = DAT_9; - LOCK(); - _DAT_10 = _DAT_10 + 1; - UNLOCK(); - DAT_7 = puVar10; - if (DAT_11 == '\0') { - LOCK(); - DAT_9 = 1; - UNLOCK(); - if (iVar19 == 0) { - param_2 = 0; - _DAT_12 = NTExecuteWorker; - *(undefined8 *)(puVar16 + -8) = 0x140018920; - _DAT_1 = 0; - _DAT_13 = puVar21; - ExQueueWorkItem(puVar21,0); - } - } - param_2 = CONCAT71((int7)(param_2 >> 8),uVar9); - puVar11 = &DAT_6; - goto LAB_14; - } -LAB_2: - pcVar7 = (code *)swi(0x29); - (*pcVar7)(3); - puVar16 = puVar16 + 8; -LAB_3: - uVar2 = *(uint *)((longlong)plVar15 + 0x14); - *(char **)(puVar16 + 0x38) = pcVar17; - *(undefined4 *)(puVar16 + 0x30) = 0x8e3; - pcVar17 = &WPP_f39b4f1c7a1330e7d55be75e5418037b_Traceguids; - *(uint *)(puVar16 + 0x28) = uVar2 - 1; - *(uint *)(puVar16 + 0x20) = uVar2; - *(undefined8 *)(puVar16 + -8) = 0x140018a13; - WPP_SF_qddds((ulonglong)uVar2,0x53,&WPP_f39b4f1c7a1330e7d55be75e5418037b_Traceguids,plVar15); - } - param_2 = (ulonglong)CONCAT31((int3)((uint)(iVar19 + iVar18) >> 8),uVar9); -LAB_14: - *(undefined8 *)(puVar16 + -8) = 0x14001880f; - KeReleaseSpinLock(puVar11); -LAB_5: - LOCK(); - *(int *)(param_1 + 0x380) = *(int *)(param_1 + 0x380) + iVar18; - UNLOCK(); - } - while( true ) { - pcVar17 = "minio\\netbt\\sys\\nbtutils.c"; - plVar15 = *(longlong **)(param_1 + 0x170); - if (plVar15 == (longlong *)(param_1 + 0x170)) break; - lVar3 = *plVar15; - if ((longlong *)*(longlong *)(lVar3 + 8) != plVar15) goto LAB_2; - plVar4 = (longlong *)plVar15[1]; - if ((longlong *)*plVar4 != plVar15) goto LAB_2; - *plVar4 = lVar3; - *(longlong **)(lVar3 + 8) = plVar4; - plVar15[1] = (longlong)plVar15; - *plVar15 = (longlong)plVar15; - plVar15[0xb] = 0; - iVar19 = (int)plVar20; - if ((*(byte *)(plVar15 + 0xf) & 8) != 0) { - LOCK(); - *(int *)(plVar15[5] + 0x1b8) = *(int *)(plVar15[5] + 0x1b8) + iVar19; - UNLOCK(); - } - *(char **)(puVar16 + 0x20) = "minio\\netbt\\sys\\nbtutils.c"; - *(undefined8 *)(puVar16 + -8) = 0x140018a9e; - NbtDereferenceLowerConnection((longlong)plVar15,param_2,"minio\\netbt\\sys\\nbtutils.c",0x8f8); - *(char **)(puVar16 + 0x20) = "minio\\netbt\\sys\\nbtutils.c"; - *(undefined8 *)(puVar16 + -8) = 0x140018ab8; - NbtDereferenceLowerConnection((longlong)plVar15,param_2,"minio\\netbt\\sys\\nbtutils.c",0x8f9); - LOCK(); - *(int *)(param_1 + 0x1b0) = *(int *)(param_1 + 0x1b0) + iVar19; - UNLOCK(); - LOCK(); - DAT_15 = DAT_15 + iVar19; - UNLOCK(); - } - plVar20 = (longlong *)(param_1 + 400); - puVar21 = (undefined *)(param_1 + 0x350); - do { - pcVar17 = "minio\\netbt\\sys\\nbtutils.c"; - plVar4 = (longlong *)*plVar20; - if (plVar4 == plVar20) { - *(undefined8 *)(puVar16 + -8) = 0x1400189a1; - KeReleaseSpinLockFromDpcLevel(param_1 + 0x350); - *(undefined8 *)(puVar16 + -8) = 0x1400189b7; - KeReleaseSpinLock(&DAT_0,uVar8); - return 0; - } - lVar3 = *plVar4; - if ((longlong *)*(longlong *)(lVar3 + 8) != plVar4) goto LAB_2; - plVar5 = (longlong *)plVar4[1]; - if ((longlong *)*plVar5 != plVar4) goto LAB_2; - *plVar5 = lVar3; - *(longlong **)(lVar3 + 8) = plVar5; - plVar4[1] = (longlong)plVar4; - *plVar4 = (longlong)plVar4; - if ((DAT_4 & 0x40) != 0) { - uVar2 = *(uint *)((longlong)plVar4 + 0x14); - param_2 = 0xb; - *(char **)(puVar16 + 0x38) = "minio\\netbt\\sys\\nbtutils.c"; - *(undefined4 *)(puVar16 + 0x30) = 0x910; - pcVar17 = &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids; - *(uint *)(puVar16 + 0x28) = uVar2 + 1; - *(uint *)(puVar16 + 0x20) = uVar2; - *(undefined8 *)(puVar16 + -8) = 0x140018b34; - WPP_SF_qddds((ulonglong)uVar2,0xb,&WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,plVar4); - } - LOCK(); - *(int *)((longlong)plVar4 + 0x14) = *(int *)((longlong)plVar4 + 0x14) + 1; - UNLOCK(); - *(undefined8 *)(puVar16 + -8) = 0x140018b42; - KeReleaseSpinLockFromDpcLevel(puVar21); - plVar15 = plVar4 + 0xd; - *(undefined8 *)(puVar16 + -8) = 0x140018b55; - KeAcquireSpinLockAtDpcLevel(plVar15); - iVar19 = *(int *)(plVar4 + 0xb); - if (iVar19 == 7) { -LAB_16: - plVar15 = (longlong *)plVar4[3]; - plVar22 = *(longlong **)((longlong)plVar15 + 0x28); - if (*(longlong *)((longlong)plVar15 + 0xc0) != 0) { - plVar4[0x24] = *(undefined8 *)((longlong)plVar15 + 200); - *(undefined8 *)((longlong)plVar15 + 200) = 0; - *(undefined8 *)((longlong)plVar15 + 0xc0) = 0; - } - *(undefined8 *)((longlong)plVar15 + 0x18) = 0; - plVar4[3] = 0; - *(undefined1 *)((longlong)plVar15 + 0x10b) = 10; - *(undefined1 *)((longlong)plVar4 + 0x7c) = 10; - *(undefined4 *)(plVar4 + 0xb) = 8; - *(undefined4 *)((longlong)plVar15 + 0x30) = 9; - plVar4[0x19] = (longlong)RejectAnyData; - *(undefined4 *)((longlong)plVar4 + 0x5c) = 0; - *(undefined4 *)(plVar4 + 0x1a) = 0x11; - *(undefined8 *)(puVar16 + -8) = 0x140018cb7; - KeReleaseSpinLockFromDpcLevel(plVar4 + 0xd); - uVar6 = *(undefined8 *)((longlong)plVar15 + 0x48); - uVar14 = (undefined7)(param_2 >> 8); - if ((*(int *)(plVar4 + 0xb) == 7) && - (lVar3 = *(longlong *)((longlong)plVar15 + 0xb8), lVar3 != 0)) { - uVar8 = puVar16[0x70]; - *(undefined8 *)((longlong)plVar15 + 0xb8) = 0; - *(undefined8 *)(puVar16 + -8) = 0x140018cec; - KeReleaseSpinLock(&DAT_0,CONCAT71(uVar14,uVar8)); - uVar13 = 0xc000020d; - *(undefined8 *)(puVar16 + -8) = 0x140018d02; - NTIoComplete(lVar3,0xc000020d,0xffffffff); - } - else { - uVar13 = CONCAT71(uVar14,puVar16[0x70]); - *(undefined8 *)(puVar16 + -8) = 0x140018d18; - KeReleaseSpinLock(&DAT_0); - } - *(undefined8 *)(puVar16 + -8) = 0x140018d32; - NbtDereferenceConnection((longlong)plVar15,uVar13,(undefined *)0x948,0x140033c90); - pcVar7 = (code *)plVar22[0x17]; - if (pcVar7 != (code *)0x0) { - lVar3 = plVar22[0x18]; - *(undefined4 *)(puVar16 + 0x30) = 2; - *(undefined8 *)(puVar16 + 0x28) = 0; - *(undefined4 *)(puVar16 + 0x20) = 0; - *(undefined8 *)(puVar16 + -8) = 0x140018d64; - (*pcVar7)(lVar3,uVar6,0,0); - } - param_2 = 7; - puVar16[0x20] = 1; - pcVar17 = (char *)0x2; - *(undefined8 *)(puVar16 + -8) = 0x140018d81; - DisconnectLower((longlong)plVar4,7,2,&DefaultDisconnectTimeout,puVar16[0x20]); - *(undefined8 *)(puVar16 + -8) = 0x140018d8f; - uVar8 = KeAcquireSpinLockRaiseToDpc(&DAT_0); - puVar16[0x70] = uVar8; - } - else { - if (iVar19 == 3) { - if ((DAT_4 & 0x40) != 0) { - uVar2 = *(uint *)((longlong)plVar4 + 0x14); - *(char **)(puVar16 + 0x38) = "minio\\netbt\\sys\\nbtutils.c"; - param_2 = 0; - *(undefined4 *)(puVar16 + 0x30) = 0x925; - *(uint *)(puVar16 + 0x28) = uVar2 + 1; - *(uint *)(puVar16 + 0x20) = uVar2; - *(undefined8 *)(puVar16 + -8) = 0x140018c3f; - WPP_SF_qddds((ulonglong)uVar2,0xb,&WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,plVar4) - ; - } - LOCK(); - *(int *)((longlong)plVar4 + 0x14) = *(int *)((longlong)plVar4 + 0x14) + 1; - UNLOCK(); - goto LAB_16; - } - if (iVar19 == 0) { - *(undefined8 *)(puVar16 + -8) = 0x140018b7d; - KeReleaseSpinLockFromDpcLevel(); - lVar3 = plVar4[3]; - if (lVar3 != 0) { - plVar15 = (longlong *)(lVar3 + 0xf8); - *(undefined8 *)(puVar16 + -8) = 0x140018b9c; - KeAcquireSpinLockAtDpcLevel(plVar15); - pcVar17 = (char *)CONCAT71((int7)((ulonglong)pcVar17 >> 8),uVar8); - *(undefined8 *)(puVar16 + -8) = 0x140018bac; - CleanupConnectingState(lVar3,param_2,uVar8); - *(undefined8 *)(puVar16 + -8) = 0x140018bb6; - KeReleaseSpinLockFromDpcLevel(plVar15); - } - } - else { - *(undefined8 *)(puVar16 + -8) = 0x140018bf9; - KeReleaseSpinLockFromDpcLevel(plVar15); - } - } - *(undefined8 *)(puVar16 + -8) = 0x140018bc7; - KeAcquireSpinLockAtDpcLevel(puVar21); - *(char **)(puVar16 + 0x20) = "minio\\netbt\\sys\\nbtutils.c"; - *(undefined8 *)(puVar16 + -8) = 0x140018be6; - NbtDereferenceLowerConnection((longlong)plVar4,param_2,pcVar17,0x980); - } while( true ); + KeReleaseSpinLockFromDpcLevel(puVar13); + goto LAB_9; + } + if ((DAT_5 & 0x40) != 0) { + param_2 = (longlong *)0x0; + WPP_SF_qddds((ulonglong)*(uint *)((longlong)puVar6 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,puVar6); + } + LOCK(); + *(int *)((longlong)puVar6 + 0x14) = *(int *)((longlong)puVar6 + 0x14) + 1; + UNLOCK(); + } + uVar12 = puVar6[3]; + lVar4 = *(longlong *)(uVar12 + 0x28); + if (*(longlong *)(uVar12 + 0xc0) != 0) { + puVar6[0x24] = *(ulonglong *)(uVar12 + 200); + *(undefined8 *)(uVar12 + 200) = 0; + *(undefined8 *)(uVar12 + 0xc0) = 0; + } + *(undefined8 *)(uVar12 + 0x18) = 0; + puVar6[3] = 0; + *(undefined1 *)(uVar12 + 0x10b) = 10; + *(undefined1 *)((longlong)puVar6 + 0x7c) = 10; + *(undefined4 *)(puVar6 + 0xb) = 8; + *(undefined4 *)(uVar12 + 0x30) = 9; + *(undefined4 *)((longlong)puVar6 + 0x5c) = 0; + puVar6[0x19] = (ulonglong)RejectAnyData; + *(undefined4 *)(puVar6 + 0x1a) = 0x11; + KeReleaseSpinLockFromDpcLevel(puVar6 + 0xd); + uVar7 = *(undefined8 *)(uVar12 + 0x48); + uVar15 = (undefined7)((ulonglong)param_2 >> 8); + if (((int)puVar6[0xb] == 7) && (lVar8 = *(longlong *)(uVar12 + 0xb8), lVar8 != 0)) { + *(undefined8 *)(uVar12 + 0xb8) = 0; + KeReleaseSpinLock(&DAT_0,CONCAT71(uVar15,uVar10)); + uVar14 = 0xc000020d; + NTIoComplete(lVar8,0xc000020d,0xffffffff); + } + else { + uVar14 = CONCAT71(uVar15,uVar10); + KeReleaseSpinLock(&DAT_0); + } + NbtDereferenceConnection(uVar12,uVar14,(undefined *)0x958,0x140034ca0); + pcVar9 = *(code **)(lVar4 + 0xb8); + if (pcVar9 != (code *)0x0) { + (*pcVar9)(*(undefined8 *)(lVar4 + 0xc0),uVar7,0,0); + } + uVar12 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar12 != 0) { + if ((DAT_5 & 0x40) != 0) { + WPP_SF_qddds((ulonglong)*(uint *)((longlong)puVar6 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,puVar6); + } + LOCK(); + *(int *)((longlong)puVar6 + 0x14) = *(int *)((longlong)puVar6 + 0x14) + 1; + UNLOCK(); + } + param_2 = (longlong *)0x7; + DisconnectLower((longlong)puVar6,7,2,0x14003a410,'\x01'); + uVar10 = KeAcquireSpinLockRaiseToDpc(&DAT_0); +LAB_9: + KeAcquireSpinLockAtDpcLevel(param_1 + 0x350); + NbtDereferenceLowerConnection((longlong)puVar6,param_2,'\x01'); + goto LAB_3; } ``` ## NbtDeleteLowerConn ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.15| |i_ratio|0.58| |m_ratio|0.8| |b_ratio|0.73| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtDeleteLowerConn|NbtDeleteLowerConn| |fullname|NbtDeleteLowerConn|NbtDeleteLowerConn| |refcount|2|2| |`length`|186|291| |`called`|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnection|Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtDereferenceLowerConnection| |calling|DelayedCleanupAfterDisconnect|DelayedCleanupAfterDisconnect| |paramcount|3|2| |`address`|140016f4c|140016410| |`sig`|undefined8 __fastcall NbtDeleteLowerConn(longlong * param_1, undefined8 param_2, undefined8 param_3)|undefined8 __fastcall NbtDeleteLowerConn(longlong * param_1, undefined8 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtDeleteLowerConn Called Diff ```diff --- NbtDeleteLowerConn called +++ NbtDeleteLowerConn called @@ -0,0 +1,2 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline +NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel @@ -2,0 +5 @@ +NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel ``` ### NbtDeleteLowerConn Diff ```diff --- NbtDeleteLowerConn +++ NbtDeleteLowerConn @@ -1,42 +1,72 @@ -undefined8 NbtDeleteLowerConn(longlong *param_1,undefined8 param_2,undefined8 param_3) +undefined8 NbtDeleteLowerConn(longlong *param_1,undefined8 param_2) { longlong lVar1; - longlong lVar2; - longlong *plVar3; - code *pcVar4; - undefined1 uVar5; - undefined8 uVar6; - undefined1 uVar7; - undefined7 uVar8; + longlong *plVar2; + code *pcVar3; + undefined1 uVar4; + ulonglong uVar5; + undefined1 uVar6; + undefined7 uVar7; + undefined1 *puVar8; + undefined1 *puVar9; + undefined *puVar10; + undefined1 auStack_38 [8]; + undefined1 auStack_30 [24]; + char *local_18; - uVar7 = (undefined1)param_2; - uVar8 = (undefined7)((ulonglong)param_2 >> 8); - if ((int)param_1[2] == 0x43776f4c) { - lVar1 = param_1[5]; - uVar5 = KeAcquireSpinLockRaiseToDpc(lVar1 + 0x350); - if (*(int *)((longlong)param_1 + 0x14) < 0x1f5) { - if ((*(byte *)(param_1 + 0xf) & 2) == 0) { - lVar2 = *param_1; - if ((*(longlong **)(lVar2 + 8) != param_1) || - (plVar3 = (longlong *)param_1[1], (longlong *)*plVar3 != param_1)) { - pcVar4 = (code *)swi(0x29); - (*pcVar4)(3); - pcVar4 = (code *)swi(3); - uVar6 = (*pcVar4)(); - return uVar6; - } - *plVar3 = lVar2; - *(longlong **)(lVar2 + 8) = plVar3; - *(byte *)(param_1 + 0xf) = *(byte *)(param_1 + 0xf) | 4; - param_1[1] = 0x9789; - *param_1 = 0x9789; - } - NbtDereferenceLowerConnection((longlong)param_1,CONCAT71(uVar8,uVar7),param_3,0x2d0f); + uVar6 = (undefined1)param_2; + uVar7 = (undefined7)((ulonglong)param_2 >> 8); + puVar8 = auStack_38; + puVar9 = auStack_38; + if ((int)param_1[2] != 0x43776f4c) { + return 0; + } + puVar10 = (undefined *)(param_1[5] + 0x350); + uVar5 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 == 0) { + uVar4 = KeAcquireSpinLockRaiseToDpc(puVar10); + if (500 < *(int *)((longlong)param_1 + 0x14)) goto LAB_0; + } + else { + uVar4 = KeAcquireSpinLockRaiseToDpc(&DAT_1); + KeAcquireSpinLockAtDpcLevel(puVar10); + } + if ((*(byte *)(param_1 + 0xf) & 2) == 0) { + lVar1 = *param_1; + if ((*(longlong **)(lVar1 + 8) == param_1) && + (plVar2 = (longlong *)param_1[1], (longlong *)*plVar2 == param_1)) { + *plVar2 = lVar1; + *(longlong **)(lVar1 + 8) = plVar2; + *(byte *)(param_1 + 0xf) = *(byte *)(param_1 + 0xf) | 4; + param_1[1] = 0x9789; + *param_1 = 0x9789; + goto LAB_2; } - KeReleaseSpinLock(lVar1 + 0x350,uVar5); + param_1 = (longlong *)0x3; + pcVar3 = (code *)swi(0x29); + (*pcVar3)(); + puVar8 = auStack_30; } + else { +LAB_2: + uVar5 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + local_18 = "minio\\netbt\\sys\\name.c"; + if ((int)uVar5 != 0) { + NbtDereferenceLowerConnection((longlong)param_1,CONCAT71(uVar7,uVar6),'\x01'); + KeReleaseSpinLockFromDpcLevel(puVar10); + puVar10 = &DAT_1; + puVar9 = auStack_38; + goto LAB_0; + } + } + *(undefined8 *)(puVar8 + -8) = 0x14001650f; + NbtDereferenceLowerConnection((longlong)param_1,CONCAT71(uVar7,uVar6),'\0'); + puVar9 = puVar8; +LAB_0: + *(undefined8 *)(puVar9 + -8) = 0x14001651c; + KeReleaseSpinLock(puVar10,uVar4); return 0; } ``` ## NbtOpenAndAssocConnection ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.12| |i_ratio|0.41| |m_ratio|0.86| |b_ratio|0.47| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtOpenAndAssocConnection|NbtOpenAndAssocConnection| |fullname|NbtOpenAndAssocConnection|NbtOpenAndAssocConnection| |`refcount`|18|12| |`length`|1910|1415| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInterlockedInsertTailList
NTOSKRNL.EXE::ExQueueWorkItem
NTOSKRNL.EXE::IoBuildDeviceIoControlRequest
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeStackAttachProcessNTOSKRNL.EXE::KeUnstackDetachProcess
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::PsGetCurrentProcess
NbtCleanupPrebindOptions
NbtDereferenceLowerConnection
NbtSetEndpointOptionsPostbind
NbtSetEndpointOptionsPrebind
NbtTdiAssociateConnection
NbtTdiOpenAddress
NbtTdiOpenConnection
WPP_SF_DDDD
WPP_SF_qddds
__security_check_cookie
memset
|
Expand for full list:
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInterlockedInsertTailList
NTOSKRNL.EXE::IoBuildDeviceIoControlRequest
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeStackAttachProcess
NTOSKRNL.EXE::KeUnstackDetachProcess
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::PsGetCurrentProcessNbtCleanupPrebindOptions
NbtDereferenceLowerConnection
NbtSetEndpointOptionsPostbind
NbtSetEndpointOptionsPrebind
NbtTdiAssociateConnection
NbtTdiOpenAddress
NbtTdiOpenConnection
WPP_SF_DDDD
WPP_SF_qddds
__security_check_cookie
memset
| |calling|AllocLowerConn
NbtConnectCommon
NbtOpenConnection
NbtReConnect
NbtSetNewAddress|AllocLowerConn
NbtConnectCommon
NbtOpenConnection
NbtReConnect
NbtSetNewAddress| |paramcount|4|4| |`address`|140017c70|140016fa0| |sig|int __fastcall NbtOpenAndAssocConnection(undefined8 * param_1, longlong param_2, undefined8 * param_3, undefined1 param_4)|int __fastcall NbtOpenAndAssocConnection(undefined8 * param_1, longlong param_2, undefined8 * param_3, undefined1 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtOpenAndAssocConnection Called Diff ```diff --- NbtOpenAndAssocConnection called +++ NbtOpenAndAssocConnection called @@ -4 +3,0 @@ -NTOSKRNL.EXE::ExQueueWorkItem @@ -8 +6,0 @@ -NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc @@ -10 +7,0 @@ -NTOSKRNL.EXE::KeReleaseSpinLock ``` ### NbtOpenAndAssocConnection Diff ```diff --- NbtOpenAndAssocConnection +++ NbtOpenAndAssocConnection @@ -1,299 +1,194 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ int NbtOpenAndAssocConnection (undefined8 *param_1,longlong param_2,undefined8 *param_3,undefined1 param_4) { - int *piVar1; - undefined8 uVar2; - code *pcVar3; - ushort uVar4; - byte bVar5; - int iVar6; - int iVar7; + undefined8 uVar1; + ushort uVar2; + int iVar3; void *_Dst; - longlong lVar8; - undefined8 *puVar9; - undefined8 uVar10; - ulonglong uVar11; - undefined8 *puVar12; - undefined *puVar13; - void *pvVar14; - undefined1 *puVar15; - undefined1 *puVar16; - char *pcVar17; - undefined8 *puVar18; - bool bVar19; - undefined1 auStackY_108 [8]; - undefined1 auStackY_100 [24]; + longlong lVar4; + undefined8 *puVar5; + undefined8 uVar6; + ulonglong uVar7; + undefined8 *puVar8; + void *pvVar9; + int unaff_EBP; + undefined8 *puVar10; + bool bVar11; + undefined1 auStackY_108 [32]; undefined4 in_stack_ffffffffffffff28; undefined4 in_stack_ffffffffffffff2c; undefined4 local_b8; - undefined8 local_a8; - longlong local_a0; - undefined8 local_98; - undefined8 uStack_90; + undefined8 local_b0; + longlong local_a8; + undefined8 local_a0; + undefined8 uStack_98; + undefined8 local_90; undefined8 local_88; - undefined8 local_80; - undefined8 uStack_78; - undefined8 local_70; - undefined8 uStack_68; - undefined8 local_60; - undefined8 uStack_58; - undefined8 local_50; - undefined8 uStack_48; - ulonglong local_40; + undefined8 uStack_80; + undefined8 local_78; + undefined8 uStack_70; + undefined8 local_68; + undefined8 uStack_60; + undefined8 local_58; + undefined8 uStack_50; + ulonglong local_48; - puVar15 = auStackY_108; - puVar16 = auStackY_108; - local_40 = __security_cookie ^ (ulonglong)auStackY_108; - puVar9 = (undefined8 *)0x0; - local_a8 = 0; - local_70 = 0; - uStack_68 = 0; - local_60 = 0; - uStack_58 = 0; - local_50 = 0; - uStack_48 = 0; + local_48 = __security_cookie ^ (ulonglong)auStackY_108; + puVar5 = (undefined8 *)0x0; + local_b0 = 0; + local_78 = 0; + uStack_70 = 0; + local_68 = 0; + uStack_60 = 0; + local_58 = 0; + uStack_50 = 0; if (param_3 != (undefined8 *)0x0) { *param_3 = 0; } local_b8._0_2_ = CONCAT11(0x4c,param_4); - uVar4 = (ushort)local_b8; + uVar2 = (ushort)local_b8; local_b8 = (uint)(ushort)local_b8; - _Dst = (void *)ExAllocatePool2(0x40,0x128,(uVar4 & 0xff00 | local_b8 << 0x10) << 8 | 0x624e); + _Dst = (void *)ExAllocatePool2(0x40,0x128,(uVar2 & 0xff00 | local_b8 << 0x10) << 8 | 0x624e); if (_Dst == (void *)0x0) { - iVar6 = -0x3fffff66; - puVar15 = auStackY_108; - goto LAB_0; + return unaff_EBP; } memset(_Dst,0,0x128); - lVar8 = PsGetCurrentProcess(); - bVar19 = lVar8 != NbtFspProcess; - if (bVar19) { - KeStackAttachProcess(NbtFspProcess,&local_70); + lVar4 = PsGetCurrentProcess(); + bVar11 = lVar4 != NbtFspProcess; + if (bVar11) { + KeStackAttachProcess(NbtFspProcess,&local_78); } - puVar12 = param_1; - iVar6 = NbtTdiOpenConnection(_Dst,(longlong)param_1); - if (iVar6 < 0) { - if (bVar19) { -LAB_1: - *(undefined8 *)(puVar16 + -8) = 0x140018277; - KeUnstackDetachProcess(puVar16 + 0x98); - puVar15 = puVar16; + puVar8 = param_1; + iVar3 = NbtTdiOpenConnection(_Dst,(longlong)param_1); + if (iVar3 < 0) { + if (bVar11) { + KeUnstackDetachProcess(&local_78); } - *(undefined8 *)(puVar15 + -8) = 0x1400181a1; ExFreePoolWithTag(_Dst,0); + return unaff_EBP; + } + if ((DAT_0 & 0x40) != 0) { + puVar8 = (undefined8 *)&DAT_1; + in_stack_ffffffffffffff28 = 0x814; + WPP_SF_qddds((ulonglong)*(uint *)((longlong)_Dst + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,_Dst); + } + LOCK(); + *(int *)((longlong)_Dst + 0x14) = *(int *)((longlong)_Dst + 0x14) + 1; + UNLOCK(); + if ((DAT_0 & 0x40) != 0) { + puVar8 = (undefined8 *)&DAT_1; + in_stack_ffffffffffffff28 = 0x815; + WPP_SF_qddds((ulonglong)*(uint *)((longlong)_Dst + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,_Dst); + } + LOCK(); + *(int *)((longlong)_Dst + 0x14) = *(int *)((longlong)_Dst + 0x14) + 1; + UNLOCK(); + if (param_2 == 0) { + puVar5 = (undefined8 *)param_1[0x4e]; } else { - if ((DAT_2 & 0x40) != 0) { - puVar12 = (undefined8 *)&DAT_3; - in_stack_ffffffffffffff28 = 0x814; - WPP_SF_qddds((ulonglong)*(uint *)((longlong)_Dst + 0x14),0xb, - &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,_Dst); + iVar3 = NbtSetEndpointOptionsPrebind(param_2); + if (-1 < iVar3) { + *(undefined4 *)((longlong)_Dst + 0x5c) = 0; + *(code **)((longlong)_Dst + 200) = RejectAnyData; + *(undefined4 *)((longlong)_Dst + 0xd0) = 0xf; + puVar8 = &local_b0; + uVar7 = NbtTdiOpenAddress((longlong *)((longlong)_Dst + 0x48),puVar8, + (undefined8 *)((longlong)_Dst + 0x38),(longlong)param_1,0, + *(uint *)(param_1 + 0x3d), + CONCAT44(in_stack_ffffffffffffff2c,in_stack_ffffffffffffff28),1); + puVar5 = *(undefined8 **)((longlong)_Dst + 0x48); + iVar3 = (int)uVar7; } - pcVar17 = "minio\\netbt\\sys\\name.c"; - LOCK(); - *(int *)((longlong)_Dst + 0x14) = *(int *)((longlong)_Dst + 0x14) + 1; - UNLOCK(); - if ((DAT_2 & 0x40) != 0) { - puVar12 = (undefined8 *)&DAT_3; - in_stack_ffffffffffffff28 = 0x815; - pcVar17 = &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids; - WPP_SF_qddds((ulonglong)*(uint *)((longlong)_Dst + 0x14),0xb, - &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,_Dst); - } - LOCK(); - *(int *)((longlong)_Dst + 0x14) = *(int *)((longlong)_Dst + 0x14) + 1; - UNLOCK(); - if (param_2 == 0) { - puVar9 = (undefined8 *)param_1[0x4e]; - } - else { - iVar6 = NbtSetEndpointOptionsPrebind(param_2); - if (-1 < iVar6) { - *(undefined4 *)((longlong)_Dst + 0xd0) = 0xf; - *(undefined4 *)((longlong)_Dst + 0x5c) = 0; - *(code **)((longlong)_Dst + 200) = RejectAnyData; - pcVar17 = (char *)((longlong)_Dst + 0x38); - puVar12 = &local_a8; - uVar11 = NbtTdiOpenAddress((longlong *)((longlong)_Dst + 0x48),puVar12,(undefined8 *)pcVar17 - ,(longlong)param_1,0,*(uint *)(param_1 + 0x3d), - CONCAT44(in_stack_ffffffffffffff2c,in_stack_ffffffffffffff28),1); - puVar9 = *(undefined8 **)((longlong)_Dst + 0x48); - iVar6 = (int)uVar11; - } - NbtCleanupPrebindOptions(param_2); - } - if (puVar9 == (undefined8 *)0x0) { - iVar6 = -0x3fffffff; - } - else if ((-1 < iVar6) && - (iVar6 = NbtTdiAssociateConnection(*(longlong *)((longlong)_Dst + 0x30),puVar9), - puVar12 = puVar9, -1 < iVar6)) { - if (*(char *)((longlong)param_1 + 0x38c) == '\0') { - uVar2 = *(undefined8 *)((longlong)_Dst + 0x30); - puVar9 = (undefined8 *)ExAllocatePool2(0x40,0x20,0x3232624e); - if (puVar9 != (undefined8 *)0x0) { - *puVar9 = 0x400; - puVar9[3] = 1; - *(undefined4 *)(puVar9 + 1) = 0x200; - *(undefined4 *)((longlong)puVar9 + 0x14) = 4; - *(undefined4 *)(puVar9 + 2) = 1; - *(undefined4 *)((longlong)puVar9 + 0xc) = 0x300; - local_88 = 0; - local_80 = 0; - uStack_78 = 0; - local_98 = 0; - uStack_90 = 0; - KeInitializeEvent(&local_98,0,0); - uVar10 = IoGetRelatedDeviceObject(uVar2); - puVar12 = (undefined8 *)0x128004; - puVar18 = puVar9; - local_a0 = IoBuildDeviceIoControlRequest(0x128004,uVar10,puVar9,0x20); - if (local_a0 == 0) { - iVar7 = -0x3fffff66; -LAB_4: - if ((DAT_5 & 1) != 0) { - WPP_SF_DDDD(puVar12,0x29,puVar18,iVar7); - } - } - else { - *(undefined8 *)(*(longlong *)(local_a0 + 0xb8) + -0x18) = uVar2; - puVar12 = (undefined8 *)IoGetRelatedDeviceObject(); - iVar7 = IofCallDriver(puVar12,local_a0); - if (iVar7 == 0x103) { - puVar18 = (undefined8 *)0x0; - puVar12 = &local_98; - KeWaitForSingleObject(puVar12,0,0,0); - iVar7 = (int)local_80; - } - if (iVar7 < 0) goto LAB_4; - } - ExFreePoolWithTag(puVar9,0); - } - } - if (param_2 == 0) { - LOCK(); - *(int *)(param_1 + 0x70) = *(int *)(param_1 + 0x70) + 1; - UNLOCK(); - puVar9 = param_1 + 0x34; - } - else { - *(longlong *)((longlong)_Dst + 0x18) = param_2; - puVar9 = param_1 + 0x32; - } - ExInterlockedInsertTailList(puVar9,_Dst,param_1 + 0x6a); - LOCK(); - *(int *)((longlong)param_1 + 900) = *(int *)((longlong)param_1 + 900) + 1; - UNLOCK(); - if (bVar19) { - KeUnstackDetachProcess(&local_70); - } - if (param_3 != (undefined8 *)0x0) { - *param_3 = _Dst; - } - if (param_2 != 0) { - iVar6 = NbtSetEndpointOptionsPostbind(param_2,*(undefined8 *)((longlong)_Dst + 0x38)); - } - if ((DAT_2 & 0x40) != 0) { - WPP_SF_qddds((ulonglong)*(uint *)((longlong)_Dst + 0x14),0x53, - &WPP_f39b4f1c7a1330e7d55be75e5418037b_Traceguids,_Dst); - } - bVar5 = KeAcquireSpinLockRaiseToDpc((longlong)_Dst + 0x68); - LOCK(); - piVar1 = (int *)((longlong)_Dst + 0x14); - iVar7 = *piVar1; - *piVar1 = *piVar1 + -1; - UNLOCK(); - if (iVar7 == 1) { - LOCK(); - piVar1 = (int *)(*(longlong *)((longlong)_Dst + 0x28) + 900); - *piVar1 = *piVar1 + -1; - UNLOCK(); - lVar8 = *(longlong *)((longlong)_Dst + 0x18); - *(undefined4 *)((longlong)_Dst + 0x14) = 1000; - if ((lVar8 != 0) && - ((*(int *)(lVar8 + 0x10) == 0x316e6f43 || (*(int *)(lVar8 + 0x10) == 0x326e6f43)))) { - *(undefined4 *)(lVar8 + 0x30) = 9; - *(undefined8 *)(lVar8 + 0x18) = 0; - *(undefined8 *)((longlong)_Dst + 0x18) = 0; - *(undefined1 *)(lVar8 + 0x10b) = 9; - *(undefined1 *)((longlong)_Dst + 0x7c) = 9; - } - KeReleaseSpinLock((longlong)_Dst + 0x68,bVar5); - puVar9 = (undefined8 *)((longlong)_Dst + 0x80); - if ((puVar9 == (undefined8 *)0x0) || (*(int *)((longlong)_Dst + 0xc0) != 0)) { - puVar9 = (undefined8 *)ExAllocatePool2(0x40,0x48,0x3232624e); - puVar15 = auStackY_108; - if (puVar9 == (undefined8 *)0x0) goto LAB_0; - *(undefined4 *)((longlong)puVar9 + 0x3c) = 1; - } - else { - *(undefined4 *)((longlong)_Dst + 0xbc) = 0; - } - *(undefined4 *)(puVar9 + 8) = 1; - puVar9[6] = DelayedWipeOutLowerconn; - puVar9[2] = 0; - puVar9[3] = _Dst; - puVar9[4] = 0; - puVar9[5] = 0; - *(undefined1 *)((longlong)puVar9 + 0x44) = 0x20; - puVar9[1] = puVar9; - *puVar9 = puVar9; - bVar5 = KeAcquireSpinLockRaiseToDpc(&DAT_6); - pvVar14 = (void *)(ulonglong)bVar5; - if ((undefined8 *)*DAT_7 != &DAT_140039680) { - pcVar3 = (code *)swi(0x29); - (*pcVar3)(3); - puVar16 = auStackY_100; - _Dst = pvVar14; - goto LAB_1; - } - *puVar9 = &DAT_8; - puVar9[1] = DAT_7; - *DAT_7 = puVar9; - iVar7 = DAT_9; - LOCK(); - _DAT_10 = _DAT_10 + 1; - UNLOCK(); - DAT_7 = puVar9; - if (DAT_11 == '\0') { - LOCK(); - DAT_9 = 1; - UNLOCK(); - if (iVar7 == 0) { - _DAT_12 = 0; - _DAT_13 = NTExecuteWorker; - _DAT_14 = &DAT_140039698; - ExQueueWorkItem(&DAT_12,0); - } - } - puVar13 = &DAT_6; - } - else { - pvVar14 = (void *)(ulonglong)bVar5; - puVar13 = (undefined *)((longlong)_Dst + 0x68); - } - KeReleaseSpinLock(puVar13,pvVar14); - puVar15 = auStackY_108; - goto LAB_0; - } + NbtCleanupPrebindOptions(param_2); + } + if (((puVar5 == (undefined8 *)0x0) || (iVar3 < 0)) || + (iVar3 = NbtTdiAssociateConnection(*(longlong *)((longlong)_Dst + 0x30),puVar5), + puVar8 = puVar5, iVar3 < 0)) { LOCK(); *(int *)((longlong)param_1 + 900) = *(int *)((longlong)param_1 + 900) + 1; UNLOCK(); - NbtDereferenceLowerConnection((longlong)_Dst,puVar12,pcVar17,0x87a); - NbtDereferenceLowerConnection((longlong)_Dst,puVar12,pcVar17,0x87b); - puVar15 = auStackY_108; - if (bVar19) { - KeUnstackDetachProcess(&local_70); - puVar15 = auStackY_108; + NbtDereferenceLowerConnection((longlong)_Dst,puVar8,'\0'); + NbtDereferenceLowerConnection((longlong)_Dst,puVar8,'\0'); + if (!bVar11) { + return unaff_EBP; + } + KeUnstackDetachProcess(&local_78); + return unaff_EBP; + } + if (*(char *)((longlong)param_1 + 0x38c) != '\0') goto LAB_2; + uVar1 = *(undefined8 *)((longlong)_Dst + 0x30); + puVar5 = (undefined8 *)ExAllocatePool2(0x40,0x20,0x3232624e); + if (puVar5 == (undefined8 *)0x0) goto LAB_2; + *puVar5 = 0x400; + puVar5[3] = 1; + *(undefined4 *)(puVar5 + 1) = 0x200; + *(undefined4 *)((longlong)puVar5 + 0x14) = 4; + *(undefined4 *)(puVar5 + 2) = 1; + *(undefined4 *)((longlong)puVar5 + 0xc) = 0x300; + local_90 = 0; + local_88 = 0; + uStack_80 = 0; + local_a0 = 0; + uStack_98 = 0; + KeInitializeEvent(&local_a0,0,0); + uVar6 = IoGetRelatedDeviceObject(uVar1); + puVar8 = (undefined8 *)0x128004; + puVar10 = puVar5; + local_a8 = IoBuildDeviceIoControlRequest(0x128004,uVar6,puVar5,0x20); + if (local_a8 == 0) { + iVar3 = -0x3fffff66; +LAB_3: + if ((DAT_4 & 1) != 0) { + WPP_SF_DDDD(puVar8,0x29,puVar10,iVar3); } } -LAB_0: - *(undefined8 *)(puVar15 + -8) = 0x140017fd8; - return iVar6; + else { + *(undefined8 *)(*(longlong *)(local_a8 + 0xb8) + -0x18) = uVar1; + puVar8 = (undefined8 *)IoGetRelatedDeviceObject(uVar1); + iVar3 = IofCallDriver(puVar8,local_a8); + if (iVar3 == 0x103) { + puVar8 = &local_a0; + puVar10 = (undefined8 *)0x0; + KeWaitForSingleObject(puVar8,0,0,0); + iVar3 = (int)local_88; + } + if (iVar3 < 0) goto LAB_3; + } + ExFreePoolWithTag(puVar5,0); +LAB_2: + if (param_2 == 0) { + LOCK(); + *(int *)(param_1 + 0x70) = *(int *)(param_1 + 0x70) + 1; + UNLOCK(); + puVar5 = param_1 + 0x34; + } + else { + *(longlong *)((longlong)_Dst + 0x18) = param_2; + puVar5 = param_1 + 0x32; + } + pvVar9 = _Dst; + ExInterlockedInsertTailList(puVar5); + LOCK(); + *(int *)((longlong)param_1 + 900) = *(int *)((longlong)param_1 + 900) + 1; + UNLOCK(); + if (bVar11) { + KeUnstackDetachProcess(&local_78); + } + if (param_3 != (undefined8 *)0x0) { + *param_3 = _Dst; + } + if (param_2 != 0) { + pvVar9 = *(void **)((longlong)_Dst + 0x38); + NbtSetEndpointOptionsPostbind(param_2,pvVar9); + } + NbtDereferenceLowerConnection((longlong)_Dst,pvVar9,'\0'); + return unaff_EBP; } ``` ## SendCompletion ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.73| |i_ratio|0.56| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|SendCompletion|SendCompletion| |fullname|SendCompletion|SendCompletion| |refcount|4|4| |`length`|237|240| |called|NTOSKRNL.EXE::ExInterlockedPushEntryList
NbtDereferenceLowerConnection
WPP_SF_
WPP_SF_q|NTOSKRNL.EXE::ExInterlockedPushEntryList
NbtDereferenceLowerConnection
WPP_SF_
WPP_SF_q| |calling||| |paramcount|3|3| |`address`|140016d30|1400161f0| |`sig`|undefined8 __fastcall SendCompletion(undefined8 param_1, undefined8 * param_2, undefined * param_3)|undefined8 __fastcall SendCompletion(undefined8 param_1, undefined8 * param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SendCompletion Diff ```diff --- SendCompletion +++ SendCompletion @@ -1,45 +1,40 @@ -undefined8 SendCompletion(undefined8 param_1,undefined8 *param_2,undefined *param_3) +undefined8 SendCompletion(undefined8 param_1,undefined8 *param_2,longlong param_3) { undefined8 *puVar1; undefined8 *puVar2; - undefined *puVar3; if (*(char *)((longlong)param_2 + 0x41) != '\0') { *(byte *)(param_2[0x17] + 3) = *(byte *)(param_2[0x17] + 3) | 1; } puVar1 = (undefined8 *)param_2[1]; if ((*(ushort *)((longlong)puVar1 + 10) >> 0xc & 1) == 0) { - puVar3 = &DAT_0; param_2[1] = *puVar1; - ExInterlockedPushEntryList(&DAT_1); + ExInterlockedPushEntryList(&DAT_0); puVar2 = puVar1; } else { puVar1[3] = puVar1[3] + 4; *(int *)((longlong)puVar1 + 0x2c) = *(int *)((longlong)puVar1 + 0x2c) + 4; *(int *)(puVar1 + 5) = *(int *)(puVar1 + 5) + -4; puVar2 = param_2; - puVar3 = param_3; - if ((DAT_2 & 4) != 0) { - puVar2 = (undefined8 *)0x42; - puVar3 = &WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids; - WPP_SF_q(0x41a,0x42,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,puVar1); + if ((DAT_1 & 4) != 0) { + puVar2 = (undefined8 *)0x43; + WPP_SF_q(0x41a,0x43,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,puVar1); } } if ((ulonglong)param_2[7] < 5) { param_2[7] = 0; - if ((DAT_2 & 4) != 0) { - puVar2 = (undefined8 *)0x43; - puVar3 = &WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids; - WPP_SF_(0x41a,0x43,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids); + if ((DAT_1 & 4) != 0) { + puVar2 = (undefined8 *)0x44; + WPP_SF_(0x41a,0x44,&WPP_1585921e7da334e1460f331ada96a477_Traceguids); } } else { param_2[7] = param_2[7] - 4; } - NbtDereferenceLowerConnection((longlong)param_3,puVar2,puVar3,0x1553); + NbtDereferenceLowerConnection(param_3,puVar2,'\0'); return 0; } ``` ## DisconnectLower ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.31| |i_ratio|0.15| |m_ratio|0.85| |b_ratio|0.64| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|DisconnectLower|DisconnectLower| |fullname|DisconnectLower|DisconnectLower| |refcount|3|3| |`length`|145|215| |`called`|DisconnectDone
GetTracker
TcpDisconnect|DisconnectDone
Feature_1180933432__private_IsEnabledDeviceUsageNoInline
GetTracker
NbtDereferenceLowerConnection
TcpDisconnect| |calling|DisableInboundConnections
NbtDisconnect|DisableInboundConnections
NbtDisconnect| |paramcount|5|5| |`address`|140013928|140025c1c| |`sig`|int __fastcall DisconnectLower(longlong param_1, int param_2, uint param_3, undefined8 param_4, char param_5)|ulonglong __fastcall DisconnectLower(longlong param_1, ulonglong param_2, uint param_3, ulonglong param_4, char param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DisconnectLower Called Diff ```diff --- DisconnectLower called +++ DisconnectLower called @@ -1,0 +2 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline @@ -2,0 +4 @@ +NbtDereferenceLowerConnection ``` ### DisconnectLower Diff ```diff --- DisconnectLower +++ DisconnectLower @@ -1,31 +1,47 @@ -int DisconnectLower(longlong param_1,int param_2,uint param_3,undefined8 param_4,char param_5) +ulonglong DisconnectLower(longlong param_1,ulonglong param_2,uint param_3,ulonglong param_4, + char param_5) { longlong *plVar1; - int iVar2; + uint uVar2; undefined8 uVar3; - undefined7 uVar4; + ulonglong uVar4; + ulonglong uVar5; + bool bVar6; longlong *local_res8; - uVar4 = (undefined7)((ulonglong)param_4 >> 8); - iVar2 = 0; + uVar5 = 0; local_res8 = (longlong *)0x0; - if ((param_1 != 0) && (param_2 - 3U < 5)) { - uVar3 = GetTracker(&local_res8,3); - plVar1 = local_res8; - if ((int)uVar3 < 0) { - iVar2 = -0x3fffff66; - } - else { - local_res8[0xc] = param_1; - iVar2 = TcpDisconnect((longlong)local_res8,param_4,(ulonglong)param_3,CONCAT71(uVar4,param_5)) - ; - if (param_5 != '\0') { - DisconnectDone(plVar1,iVar2); + if (param_1 != 0) { + bVar6 = false; + if ((int)param_2 - 3U < 5) { + param_2 = 3; + uVar5 = param_4; + uVar3 = GetTracker(&local_res8,3); + plVar1 = local_res8; + if ((int)uVar3 < 0) { + uVar5 = 0xc000009a; + } + else { + local_res8[0xc] = param_1; + uVar2 = TcpDisconnect((longlong)local_res8,param_4,param_3, + CONCAT71((int7)(uVar5 >> 8),param_5)); + uVar5 = (ulonglong)uVar2; + uVar4 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + bVar6 = (int)uVar4 != 0; + param_2 = param_4; + if (param_5 != '\0') { + param_2 = uVar5; + DisconnectDone(plVar1,uVar5); + } } } + uVar4 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar4 != 0) && (!bVar6)) { + NbtDereferenceLowerConnection(param_1,param_2,'\0'); + } } - return iVar2; + return uVar5; } ``` ## NTQueryInformation ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.09| |i_ratio|0.26| |m_ratio|0.96| |b_ratio|0.27| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NTQueryInformation|NTQueryInformation| |fullname|NTQueryInformation|NTQueryInformation| |refcount|2|2| |`length`|1728|1851| |`called`|
Expand for full list:
FreeTracker
GetNetBiosNameFromTransportAddress
GetTracker
NTIoComplete
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NbtDereferenceLowerConnectionNbtQueryAdapterStatus
NbtQueryFindName
NbtQueryGetAddressInfo
NbtSendNodeStatus
TDI.SYS::TdiCopyBufferToMdl
WPP_SF_D
WPP_SF_qddds
|
Expand for full list:
Feature_1180933432__private_IsEnabledDeviceUsageNoInline
FreeTracker
GetNetBiosNameFromTransportAddress
GetTracker
NTIoComplete
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLockNbtDereferenceLowerConnection
NbtQueryAdapterStatus
NbtQueryFindName
NbtQueryGetAddressInfo
NbtSendNodeStatus
TDI.SYS::TdiCopyBufferToMdl
WPP_SF_L
WPP_SF_qddds
| |calling|NbtDispatchInternalCtrl|NbtDispatchInternalCtrl| |paramcount|2|2| |`address`|14000c360|14000c440| |sig|ulonglong __fastcall NTQueryInformation(undefined8 * param_1, longlong param_2)|ulonglong __fastcall NTQueryInformation(undefined8 * param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NTQueryInformation Called Diff ```diff --- NTQueryInformation called +++ NTQueryInformation called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline @@ -17 +18 @@ -WPP_SF_D +WPP_SF_L ``` ### NTQueryInformation Diff ```diff --- NTQueryInformation +++ NTQueryInformation @@ -1,237 +1,275 @@ ulonglong NTQueryInformation(undefined8 *param_1,longlong param_2) { int *piVar1; byte *pbVar2; longlong lVar3; int iVar4; longlong lVar5; int *piVar6; - longlong *plVar7; - undefined1 uVar8; + longlong lVar7; + bool bVar8; undefined1 uVar9; - uint uVar10; - undefined4 *puVar11; - ulonglong uVar12; - undefined8 uVar13; - ulonglong uVar14; - uint local_res18 [2]; + undefined1 uVar10; + ulonglong uVar11; + undefined8 uVar12; + undefined4 *puVar13; + longlong *plVar14; + uint uVar15; + ulonglong uVar16; + bool bVar17; uint local_res20 [2]; code *in_stack_ffffffffffffff48; + uint local_94; undefined8 local_90; - int *local_88; + longlong local_88; longlong *local_80; - longlong local_78; - longlong *local_70; - undefined8 local_68; - undefined8 uStack_60; - undefined8 local_58; + longlong *local_78; + undefined8 local_70; + undefined8 uStack_68; + undefined8 local_60; + undefined4 uStack_58; + undefined4 uStack_54; undefined4 uStack_50; undefined4 uStack_4c; - undefined4 uStack_48; - undefined4 uStack_44; - undefined4 local_40; + undefined4 local_48; - uVar14 = 0xc0000001; + uVar16 = 0xc0000001; local_90 = 0; - local_res18[0] = 0; local_res20[0] = 0; + local_94 = 0; if (param_1 == pWinsDeviceContext) { + uVar15 = 0xc0000010; NTIoComplete(param_2,0xc0000010,0); - return 0xc0000010; +LAB_0: + uVar16 = (ulonglong)uVar15; } - lVar5 = *(longlong *)(param_2 + 0xb8); - piVar1 = (int *)(lVar5 + 8); - local_88 = piVar1; - local_78 = lVar5; - if ((DAT_0 & 1) != 0) { - WPP_SF_D(0x408,0x23,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,*piVar1); + else { + lVar5 = *(longlong *)(param_2 + 0xb8); + piVar1 = (int *)(lVar5 + 8); + bVar8 = true; + local_88 = lVar5; + if ((DAT_1 & 1) != 0) { + WPP_SF_L(0x408,0x23,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,*piVar1); + } + iVar4 = *piVar1; + if (iVar4 == 1) { + if ((*(longlong *)(param_2 + 8) == 0) || + (puVar13 = (undefined4 *)ExAllocatePool2(0x40,0x1a,0x6274624e), + puVar13 == (undefined4 *)0x0)) { + uVar16 = 0xc000009a; + } + else { + *puVar13 = 1; + puVar13[1] = 0x110012; + *(undefined2 *)(puVar13 + 2) = 1; + *(undefined8 *)((longlong)puVar13 + 10) = 0; + *(undefined8 *)((longlong)puVar13 + 0x12) = 0; + *(undefined1 *)((longlong)puVar13 + 10) = 0x2a; + in_stack_ffffffffffffff48 = + (code *)((ulonglong)in_stack_ffffffffffffff48 & 0xffffffff00000000); + uVar15 = TdiCopyBufferToMdl(puVar13,0,0x1a,*(undefined8 *)(param_2 + 8), + in_stack_ffffffffffffff48,(uint *)(param_2 + 0x38)); + uVar16 = (ulonglong)uVar15; + local_94 = *(uint *)(param_2 + 0x38); + ExFreePoolWithTag(puVar13,0); + } + } + else if (iVar4 == 2) { + if (*(int *)(param_1 + 0x3d) != 0) { + lVar5 = *(longlong *)(param_2 + 0xb8); + *(code **)(lVar5 + -0x10) = QueryProviderCompletion; + *(undefined8 *)(lVar5 + -8) = 0; + *(undefined1 *)(lVar5 + -0x45) = 0xe0; + if (StreamsStack == '\0') { + lVar5 = *(longlong *)(param_2 + 0xb8); + *(undefined2 *)(lVar5 + -0x48) = 0xc0f; + *(undefined8 *)(lVar5 + -0x20) = param_1[0x52]; + *(undefined8 *)(lVar5 + -0x18) = param_1[0x53]; + *(undefined4 *)(lVar5 + -0x40) = 2; + *(undefined8 *)(lVar5 + -0x38) = 0; + } + else { + lVar5 = *(longlong *)(param_2 + 0xb8); + *(undefined2 *)(lVar5 + -0x48) = 0xc0f; + *(undefined8 *)(lVar5 + -0x20) = *(undefined8 *)(param_1[0x4d] + 0x28); + *(undefined8 *)(lVar5 + -0x18) = *(undefined8 *)(param_1[0x4d] + 0x30); + *(undefined4 *)(lVar5 + -0x40) = 2; + *(undefined8 *)(lVar5 + -0x38) = 0; + } + uVar16 = IofCallDriver(param_1[0x52],param_2); + return uVar16; + } + uVar16 = 0xc0000184; + } + else if (iVar4 == 3) { + if (*(longlong *)(param_2 + 8) != 0) { + uVar15 = NbtQueryGetAddressInfo(lVar5,&local_90,local_res20); +LAB_2: + uVar16 = (ulonglong)uVar15; + } + } + else if (iVar4 == 4) { + lVar5 = *(longlong *)(*(longlong *)(lVar5 + 0x30) + 0x18); + if ((lVar5 == 0) || ((*(int *)(lVar5 + 0x10) + 0xce9190bdU & 0xfeffffff) != 0)) { + uVar16 = 0xc0000008; + } + else { + lVar3 = lVar5 + 0xf8; + local_88 = lVar3; + uVar9 = KeAcquireSpinLockRaiseToDpc(lVar3); + lVar7 = *(longlong *)(lVar5 + 0x18); + if ((lVar7 != 0) && (*(int *)(lVar7 + 0x10) == 0x43776f4c)) { + plVar14 = (longlong *)(lVar7 + 0x68); + local_80 = plVar14; + uVar10 = KeAcquireSpinLockRaiseToDpc(); + uVar16 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar16 == 0) { + if ((DAT_3 & 0x40) != 0) { + WPP_SF_qddds((ulonglong)*(uint *)(lVar7 + 0x14),0xb, + &WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar7); + } + LOCK(); + *(int *)(lVar7 + 0x14) = *(int *)(lVar7 + 0x14) + 1; + UNLOCK(); + } + else { + do { + uVar15 = *(uint *)(lVar7 + 0x14); + if ((int)uVar15 < 1) { + bVar8 = false; + break; + } + plVar14 = (longlong *)(ulonglong)(uVar15 + 1); + LOCK(); + bVar17 = uVar15 == *(uint *)(lVar7 + 0x14); + if (bVar17) { + *(uint *)(lVar7 + 0x14) = uVar15 + 1; + } + UNLOCK(); + } while (!bVar17); + if ((DAT_3 & 0x40) != 0) { + in_stack_ffffffffffffff48 = + (code *)((ulonglong)in_stack_ffffffffffffff48 & 0xffffffff00000000); + WPP_SF_qddds(plVar14,0xc,&WPP_dfe3be2fee42362b1f7bcdefa1300eb5_Traceguids,lVar7); + } + if (!bVar8) { + KeReleaseSpinLock(local_80,uVar10); + KeReleaseSpinLock(local_88,uVar9); + uVar16 = 0xc000020c; + goto LAB_4; + } + } + KeReleaseSpinLock(lVar7 + 0x68,uVar10); + KeReleaseSpinLock(lVar5 + 0xf8,uVar9); + uVar12 = IoGetRelatedDeviceObject(*(undefined8 *)(lVar7 + 0x30)); + lVar5 = *(longlong *)(param_2 + 0xb8); + *(undefined8 *)(lVar5 + -0x10) = 0; + *(undefined8 *)(lVar5 + -8) = 0; + *(undefined1 *)(lVar5 + -0x45) = 0; + lVar5 = *(longlong *)(param_2 + 0xb8); + *(undefined2 *)(lVar5 + -0x48) = 0xc0f; + *(undefined8 *)(lVar5 + -0x20) = uVar12; + *(undefined8 *)(lVar5 + -0x18) = *(undefined8 *)(lVar7 + 0x30); + *(undefined4 *)(lVar5 + -0x40) = 4; + *(undefined8 *)(lVar5 + -0x38) = 0; + uVar15 = IofCallDriver(uVar12); + NbtDereferenceLowerConnection(lVar7,param_2,'\0'); + goto LAB_0; + } + uVar16 = 0xc000020c; + KeReleaseSpinLock(lVar3,uVar9); + } + } + else if (iVar4 == 0x100) { + if (*(longlong *)(param_2 + 8) != 0) { + local_res20[0] = *(uint *)(*(longlong *)(param_2 + 8) + 0x28); + local_80 = (longlong *)(lVar5 + 0x10); + if ((*local_80 == 0) || (*(longlong *)(*local_80 + 0x28) == 0)) { + uVar12 = NbtQueryAdapterStatus((longlong)param_1,&local_90,local_res20,0); + uVar15 = (uint)uVar12; + goto LAB_2; + } + local_78 = (longlong *)0x0; + local_70 = 0; + uStack_68 = 0; + local_60 = 0; + uStack_58 = 0; + uStack_54 = 0; + uStack_50 = 0; + uStack_4c = 0; + local_48 = 0; + pbVar2 = (byte *)(*(longlong *)(param_2 + 0xb8) + 3); + *pbVar2 = *pbVar2 | 1; + uVar16 = GetNetBiosNameFromTransportAddress + (*(longlong *)(*local_80 + 0x28),(ulonglong)*(uint *)(*local_80 + 0x20), + &local_70); + uVar15 = (uint)uVar16; + uVar16 = uVar16 & 0xffffffff; + if (-1 < (int)uVar15) { + if (((short)local_70 == 0) && (local_60._4_2_ == 0x10)) { + uVar12 = GetTracker(&local_78,0x12); + plVar14 = local_78; + uVar15 = (uint)uVar12; + if (-1 < (int)uVar15) { + local_78[0x16] = param_2; + local_78[4] = (longlong)param_1; + in_stack_ffffffffffffff48 = CopyNodeStatusResponseCompletion; + uVar11 = NbtSendNodeStatus(param_1,(byte *)CONCAT44(uStack_50,uStack_54),(uint *)0x0, + (longlong)local_78,0x1400215c0); + if ((int)uVar11 == 0x103) { + return 0x103; + } + uVar16 = uVar11 & 0xffffffff; + if ((int)uVar11 == 0) { + uVar16 = 0xc0000001; + } + FreeTracker(plVar14,4); + goto LAB_5; + } + } + if (-1 < (int)uVar15) { + uVar15 = 0xc000000d; + } + uVar16 = (ulonglong)uVar15; + } +LAB_5: + *(byte *)(lVar5 + 3) = *(byte *)(lVar5 + 3) & 0xfe; + } + } + else if ((iVar4 == 0x200) || (iVar4 != 0x300)) { + if ((DAT_1 & 1) != 0) { + WPP_SF_L(0x408,0x25,&WPP_1585921e7da334e1460f331ada96a477_Traceguids,iVar4); + } + uVar16 = 0xc00000bb; + } + else if (*(longlong *)(param_2 + 8) != 0) { + uVar16 = 0xc0000207; + if ((*(char *)(param_2 + 0x40) != '\0') || + (((piVar6 = *(int **)(*(longlong *)(lVar5 + 0x10) + 0x28), + 0xb < *(uint *)(*(longlong *)(lVar5 + 0x10) + 0x20) && (0 < *piVar6)) && + (*(short *)((longlong)piVar6 + 6) == 0x11)))) { + pbVar2 = (byte *)(*(longlong *)(param_2 + 0xb8) + 3); + *pbVar2 = *pbVar2 | 1; + uVar11 = NbtQueryFindName(*(longlong *)(lVar5 + 0x10),(longlong)param_1,param_2,'\0'); + uVar16 = uVar11 & 0xffffffff; + if ((int)uVar11 == 0x103) { + return 0x103; + } + goto LAB_5; + } + } +LAB_4: + if ((((uint)uVar16 & 0xc0000000) != 0xc0000000) && ((*piVar1 == 0x100 || (*piVar1 == 3)))) { + uVar15 = TdiCopyBufferToMdl(local_90,0,local_res20[0],*(undefined8 *)(param_2 + 8), + (ulonglong)in_stack_ffffffffffffff48 & 0xffffffff00000000, + &local_94); + uVar16 = (ulonglong)uVar15; + ExFreePoolWithTag(local_90,0); + } + NTIoComplete(param_2,(int)uVar16,local_94); } - iVar4 = *piVar1; - if (iVar4 == 1) { - if ((*(longlong *)(param_2 + 8) == 0) || - (puVar11 = (undefined4 *)ExAllocatePool2(0x40,0x1a,0x6274624e), puVar11 == (undefined4 *)0x0) - ) { - uVar14 = 0xc000009a; - } - else { - *puVar11 = 1; - puVar11[1] = 0x110012; - *(undefined2 *)(puVar11 + 2) = 1; - *(undefined8 *)((longlong)puVar11 + 10) = 0; - *(undefined8 *)((longlong)puVar11 + 0x12) = 0; - *(undefined1 *)((longlong)puVar11 + 10) = 0x2a; - in_stack_ffffffffffffff48 = - (code *)((ulonglong)in_stack_ffffffffffffff48 & 0xffffffff00000000); - uVar10 = TdiCopyBufferToMdl(puVar11,0,0x1a,*(undefined8 *)(param_2 + 8), - in_stack_ffffffffffffff48,(uint *)(param_2 + 0x38)); - uVar14 = (ulonglong)uVar10; - local_res20[0] = *(uint *)(param_2 + 0x38); - ExFreePoolWithTag(puVar11,0); - } - goto LAB_1; - } - if (iVar4 == 2) { - if (*(int *)(param_1 + 0x3d) != 0) { - lVar5 = *(longlong *)(param_2 + 0xb8); - *(code **)(lVar5 + -0x10) = QueryProviderCompletion; - *(undefined8 *)(lVar5 + -8) = 0; - *(undefined1 *)(lVar5 + -0x45) = 0xe0; - if (StreamsStack == '\0') { - lVar5 = *(longlong *)(param_2 + 0xb8); - *(undefined2 *)(lVar5 + -0x48) = 0xc0f; - *(undefined8 *)(lVar5 + -0x20) = param_1[0x52]; - *(undefined8 *)(lVar5 + -0x18) = param_1[0x53]; - *(undefined4 *)(lVar5 + -0x40) = 2; - *(undefined8 *)(lVar5 + -0x38) = 0; - } - else { - lVar5 = *(longlong *)(param_2 + 0xb8); - *(undefined2 *)(lVar5 + -0x48) = 0xc0f; - *(undefined8 *)(lVar5 + -0x20) = *(undefined8 *)(param_1[0x4d] + 0x28); - *(undefined8 *)(lVar5 + -0x18) = *(undefined8 *)(param_1[0x4d] + 0x30); - *(undefined4 *)(lVar5 + -0x40) = 2; - *(undefined8 *)(lVar5 + -0x38) = 0; - } - uVar14 = IofCallDriver(param_1[0x52],param_2); - return uVar14; - } - uVar14 = 0xc0000184; - goto LAB_1; - } - if (iVar4 == 3) { - if (*(longlong *)(param_2 + 8) == 0) goto LAB_1; - uVar10 = NbtQueryGetAddressInfo(lVar5,&local_90,local_res18); -LAB_2: - uVar14 = (ulonglong)uVar10; - goto LAB_1; - } - if (iVar4 == 4) { - lVar5 = *(longlong *)(*(longlong *)(lVar5 + 0x30) + 0x18); - if ((lVar5 == 0) || ((*(int *)(lVar5 + 0x10) + 0xce9190bdU & 0xfeffffff) != 0)) { - uVar14 = 0xc0000008; - } - else { - lVar3 = lVar5 + 0xf8; - uVar8 = KeAcquireSpinLockRaiseToDpc(lVar3); - lVar5 = *(longlong *)(lVar5 + 0x18); - if ((lVar5 != 0) && (*(int *)(lVar5 + 0x10) == 0x43776f4c)) { - uVar9 = KeAcquireSpinLockRaiseToDpc(lVar5 + 0x68); - if ((DAT_3 & 0x40) != 0) { - WPP_SF_qddds((ulonglong)(*(int *)(lVar5 + 0x14) + 1),0xb, - &WPP_d1b5c980e8823d44a1ca8055a7722167_Traceguids,lVar5); - } - LOCK(); - *(int *)(lVar5 + 0x14) = *(int *)(lVar5 + 0x14) + 1; - UNLOCK(); - KeReleaseSpinLock(lVar5 + 0x68,uVar9); - KeReleaseSpinLock(lVar3,uVar8); - uVar13 = IoGetRelatedDeviceObject(*(undefined8 *)(lVar5 + 0x30)); - lVar3 = *(longlong *)(param_2 + 0xb8); - *(undefined8 *)(lVar3 + -0x10) = 0; - *(undefined8 *)(lVar3 + -8) = 0; - *(undefined1 *)(lVar3 + -0x45) = 0; - lVar3 = *(longlong *)(param_2 + 0xb8); - *(undefined2 *)(lVar3 + -0x48) = 0xc0f; - *(undefined8 *)(lVar3 + -0x20) = uVar13; - *(undefined8 *)(lVar3 + -0x18) = *(undefined8 *)(lVar5 + 0x30); - *(undefined4 *)(lVar3 + -0x40) = 4; - *(undefined8 *)(lVar3 + -0x38) = 0; - uVar10 = IofCallDriver(uVar13); - NbtDereferenceLowerConnection(lVar5,param_2,uVar13,0xa84); - return (ulonglong)uVar10; - } - uVar14 = 0xc000020c; - KeReleaseSpinLock(lVar3,uVar8); - } - goto LAB_1; - } - if (iVar4 != 0x100) { - if ((iVar4 == 0x200) || (iVar4 != 0x300)) { - if ((DAT_0 & 1) != 0) { - WPP_SF_D(0x408,0x25,&WPP_82c46b8f95ed3dea340636ed821a05ee_Traceguids,iVar4); - } - uVar14 = 0xc00000bb; - goto LAB_1; - } - if (*(longlong *)(param_2 + 8) == 0) goto LAB_1; - uVar14 = 0xc0000207; - if ((*(char *)(param_2 + 0x40) == '\0') && - (((piVar6 = *(int **)(*(longlong *)(lVar5 + 0x10) + 0x28), - *(uint *)(*(longlong *)(lVar5 + 0x10) + 0x20) < 0xc || (*piVar6 < 1)) || - (*(short *)((longlong)piVar6 + 6) != 0x11)))) goto LAB_1; - pbVar2 = (byte *)(*(longlong *)(param_2 + 0xb8) + 3); - *pbVar2 = *pbVar2 | 1; - uVar12 = NbtQueryFindName(*(longlong *)(lVar5 + 0x10),(longlong)param_1,param_2,'\0'); - uVar14 = uVar12 & 0xffffffff; - if ((int)uVar12 == 0x103) { - return 0x103; - } - goto LAB_4; - } - if (*(longlong *)(param_2 + 8) == 0) goto LAB_1; - local_res18[0] = *(uint *)(*(longlong *)(param_2 + 8) + 0x28); - local_70 = (longlong *)(lVar5 + 0x10); - if ((*local_70 == 0) || (*(longlong *)(*local_70 + 0x28) == 0)) { - uVar13 = NbtQueryAdapterStatus((longlong)param_1,&local_90,local_res18,0); - uVar10 = (uint)uVar13; - goto LAB_2; - } - local_80 = (longlong *)0x0; - local_68 = 0; - uStack_60 = 0; - local_58 = 0; - uStack_50 = 0; - uStack_4c = 0; - uStack_48 = 0; - uStack_44 = 0; - local_40 = 0; - pbVar2 = (byte *)(*(longlong *)(param_2 + 0xb8) + 3); - *pbVar2 = *pbVar2 | 1; - uVar14 = GetNetBiosNameFromTransportAddress - (*(longlong *)(*local_70 + 0x28),(ulonglong)*(uint *)(*local_70 + 0x20), - &local_68); - uVar10 = (uint)uVar14; - uVar14 = uVar14 & 0xffffffff; - if (-1 < (int)uVar10) { - if (((short)local_68 == 0) && (local_58._4_2_ == 0x10)) { - uVar13 = GetTracker(&local_80,0x12); - plVar7 = local_80; - uVar10 = (uint)uVar13; - if (-1 < (int)uVar10) { - local_80[0x16] = param_2; - local_80[4] = (longlong)param_1; - in_stack_ffffffffffffff48 = CopyNodeStatusResponseCompletion; - uVar12 = NbtSendNodeStatus(param_1,(byte *)CONCAT44(uStack_48,uStack_4c),(uint *)0x0, - (longlong)local_80,0x1400224b0); - if ((int)uVar12 == 0x103) { - return 0x103; - } - uVar14 = uVar12 & 0xffffffff; - if ((int)uVar12 == 0) { - uVar14 = 0xc0000001; - } - FreeTracker(plVar7,4); - goto LAB_4; - } - } - uVar14 = (ulonglong)uVar10; - if (-1 < (int)uVar10) { - uVar14 = 0xc000000d; - } - } -LAB_4: - *(byte *)(lVar5 + 3) = *(byte *)(lVar5 + 3) & 0xfe; -LAB_1: - if ((((uint)uVar14 & 0xc0000000) != 0xc0000000) && ((*piVar1 == 3 || (*piVar1 == 0x100)))) { - uVar10 = TdiCopyBufferToMdl(local_90,0,local_res18[0],*(undefined8 *)(param_2 + 8), - (ulonglong)in_stack_ffffffffffffff48 & 0xffffffff00000000, - local_res20); - uVar14 = (ulonglong)uVar10; - ExFreePoolWithTag(local_90,0); - } - NTIoComplete(param_2,(int)uVar14,local_res20[0]); - return uVar14; + return uVar16; } ``` ## NbtQueryWfpAndCleanupConnection ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.9| |i_ratio|0.72| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtQueryWfpAndCleanupConnection|NbtQueryWfpAndCleanupConnection| |fullname|NbtQueryWfpAndCleanupConnection|NbtQueryWfpAndCleanupConnection| |refcount|4|4| |`length`|250|253| |called|NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtDereferenceConnection
NbtDereferenceLowerConnection
QueueCleanup
RelistConnection|NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
NbtDereferenceConnection
NbtDereferenceLowerConnection
QueueCleanup
RelistConnection| |calling|DelayedNbtCleanupConnectAttempts
DelayedNbtProcessConnect
NbtpConnectCompletionRoutine|DelayedNbtCleanupConnectAttempts
DelayedNbtProcessConnect
NbtpConnectCompletionRoutine| |paramcount|1|1| |`address`|140015e58|140015628| |sig|undefined __fastcall NbtQueryWfpAndCleanupConnection(longlong param_1)|undefined __fastcall NbtQueryWfpAndCleanupConnection(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtQueryWfpAndCleanupConnection Diff ```diff --- NbtQueryWfpAndCleanupConnection +++ NbtQueryWfpAndCleanupConnection @@ -1,34 +1,32 @@ void NbtQueryWfpAndCleanupConnection(longlong param_1) { longlong lVar1; longlong *plVar2; undefined1 *puVar3; undefined8 uVar4; - undefined8 uVar5; undefined1 local_res8 [8]; lVar1 = *(longlong *)(param_1 + 0x98); plVar2 = *(longlong **)(param_1 + 0x28); if ((*(byte *)(param_1 + 0xae) & 2) != 0) { local_res8[0] = KeAcquireSpinLockRaiseToDpc(&DAT_0); KeAcquireSpinLockAtDpcLevel(plVar2 + 0x1f); puVar3 = local_res8; QueueCleanup((longlong)plVar2,puVar3); KeReleaseSpinLockFromDpcLevel(plVar2 + 0x1f); if ((int)plVar2[6] != 0) { RelistConnection(plVar2); } uVar4 = CONCAT71((int7)((ulonglong)puVar3 >> 8),local_res8[0]); KeReleaseSpinLock(&DAT_0); - uVar5 = 0x58d; - NbtDereferenceConnection((longlong)plVar2,uVar4,(undefined *)0x58d,0x140033c58); - NbtDereferenceLowerConnection(lVar1,uVar4,uVar5,0x593); + NbtDereferenceConnection((longlong)plVar2,uVar4,(undefined *)0x58d,0x140034c68); + NbtDereferenceLowerConnection(lVar1,uVar4,'\0'); *(undefined8 *)(param_1 + 0x98) = 0; *(ushort *)(param_1 + 0xae) = *(ushort *)(param_1 + 0xae) & 0xfffd; *(undefined8 *)(param_1 + 0x90) = 0; } return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## WPP_SF_ ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|WPP_SF_|WPP_SF_| |fullname|WPP_SF_|WPP_SF_| |`refcount`|113|114| |length|23|23| |called|FastWppTraceMessage|FastWppTraceMessage| |`calling`|
Expand for full list:
AddToHashTable
CheckRegistrationFromNet
ConnectHndlrNotOs
CreateHashTable
DelayedNbtDeleteDevice
DestroyHashTables
DispatchIoctls
DriverEntry
ExtractServerNameCompletion
FilterIpAddrsForDevice
FindSessionEndPointGetExtendedAttributes
GetTimerEntry
GetTracker
Inbound
InitiateRefresh
LmFgets
LogTelemetryOnWakeupTimerStartSuccess
LogTelemetryOnWakeupTimerStartTimeout
LookupDeviceInRegistry
MSnodeCompletion
MakeRemoteAddressStructure
NTAccept
NTCleanUpAddress
NTCleanUpWinsAddr
NTListen
NTReReadRegistry
NTReceiveDatagram
NTSend
NTSetInformation
NameReleaseFromNet
NbtAddNewInterface
NbtCancelConnect
NbtCancelDgramSend
NbtCancelDisconnectWait
NbtCancelFindName
NbtCancelListen
NbtCancelLmhSvcIrp
NbtCancelRcvDgram
NbtCancelSession
NbtCancelWaitForLmhSvcIrp
NbtCancelWinsIrp
NbtCancelWinsSendIrp
NbtCompleteLmhSvcRequest
NbtConnect
NbtCreateDeviceObject
NbtCreateSmbDevice
NbtDestroyDevice
NbtGetNewDeviceInfo
NbtInitMdlQ
NbtListen
NbtLogEventDetailed
NbtNotifyTdiClients
NbtPnPPowerComplete
NbtProcessLmhSvcRequest
NbtReadRegistry
NbtRegisterName
NbtSetSmbBindingInfo2
NbtTdiAssociateConnection
NbtTdiOpenAddress
NbtUnload
NbtUpdateRemoteName
NextRefresh
NextTransportAddress
NtProcessLmHSvcIrp
Outbound
PassNamePduToWins
PerformInboundProcessing
PrimeCache
QueryFromNet
ReadNameServerAddresses
RegResponseFromNet
RegisterSmbDevice
SendCompletion
SendNameServiceRequest
SessionKeepAliveTimeout
TdiBindHandler
TdiConnect
TdiConnectHandler
TdiDisconnect
TdiDisconnectHandler
TdiPnPPowerHandler
TdiRcvDatagramHandler
TdiSend
TdiSendDatagram
UpdateNameState
WackFromNet
WinsDgramCompletion
WinsDownTimeout
|
Expand for full list:
AddToHashTable
CheckRegistrationFromNet
ConnectHndlrNotOs
CreateHashTable
DelayedNbtDeleteDevice
DestroyHashTables
DispatchIoctls
DriverEntry
ExtractServerNameCompletion
FilterIpAddrsForDevice
FindSessionEndPointGetExtendedAttributes
GetTimerEntry
GetTracker
Inbound
InitiateRefresh
LmFgets
LogTelemetryOnWakeupTimerStartSuccess
LogTelemetryOnWakeupTimerStartTimeout
LookupDeviceInRegistry
MSnodeCompletion
MakeRemoteAddressStructure
NTAccept
NTCleanUpAddress
NTCleanUpWinsAddr
NTListen
NTReReadRegistry
NTReceiveDatagram
NTSend
NTSetInformation
NameReleaseFromNet
NbtAddNewInterface
NbtCancelConnect
NbtCancelDgramSend
NbtCancelDisconnectWait
NbtCancelFindName
NbtCancelListen
NbtCancelLmhSvcIrp
NbtCancelRcvDgram
NbtCancelSession
NbtCancelWaitForLmhSvcIrp
NbtCancelWinsIrp
NbtCancelWinsSendIrp
NbtCompleteLmhSvcRequest
NbtConnect
NbtCreateDeviceObject
NbtCreateSmbDevice
NbtDestroyDevice
NbtGetNewDeviceInfo
NbtInitMdlQ
NbtListen
NbtLogEventDetailed
NbtNotifyTdiClients
NbtPnPPowerComplete
NbtProcessLmhSvcRequest
NbtReadRegistry
NbtRegisterName
NbtSetSmbBindingInfo2
NbtTdiAssociateConnection
NbtTdiOpenAddress
NbtUnload
NbtUpdateRemoteName
NextRefresh
NextTransportAddress
NtProcessLmHSvcIrp
Outbound
PassNamePduToWins
PerformInboundProcessing
PrimeCache
QueryFromNet
ReadNameServerAddresses
RegResponseFromNet
RegisterSmbDevice
SendCompletion
SendNameServiceRequest
SessionKeepAliveTimeout
TdiBindHandler
TdiConnect
TdiConnectHandler
TdiDisconnect
TdiDisconnectHandler
TdiDisconnect_Old
TdiPnPPowerHandler
TdiRcvDatagramHandler
TdiSend
TdiSendDatagram
UpdateNameState
WackFromNet
WinsDgramCompletion
WinsDownTimeout
| |paramcount|3|3| |`address`|14003f284|140040284| |sig|undefined __fastcall WPP_SF_(undefined2 param_1, ushort param_2, undefined8 param_3)|undefined __fastcall WPP_SF_(undefined2 param_1, ushort param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_ Calling Diff ```diff --- WPP_SF_ calling +++ WPP_SF_ calling @@ -81,0 +82 @@ +TdiDisconnect_Old ``` ## NbtFreeIrp ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.84| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NbtFreeIrp|NbtFreeIrp| |fullname|NbtFreeIrp|NbtFreeIrp| |`refcount`|18|20| |length|123|123| |called|NTOSKRNL.EXE::IoFreeIrp
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock|NTOSKRNL.EXE::IoFreeIrp
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock| |`calling`|
Expand for full list:
AcceptCompletionRoutine
CompletionRcvDgram
IndicateBufferCompletion
NameSrvCompletionRoutine
NbtClientIrpCompletion
NbtWorkItemPostIrpToProvider
SendSessionCompletionRoutine
TcpConnectComplete
TdiConnectHandler
TdiDisconnect
TdiRcvDatagramHandlerTdiRcvNameSrvHandler
TdiSend
TdiSendDatagram
TdiSendDatagramCompletion
|
Expand for full list:
AcceptCompletionRoutine
CompletionRcvDgram
IndicateBufferCompletion
NameSrvCompletionRoutine
NbtClientIrpCompletion
NbtWorkItemPostIrpToProvider
SendSessionCompletionRoutine
TcpConnectComplete
TdiConnectHandler
TdiDisconnect
TdiDisconnect_OldTdiRcvDatagramHandler
TdiRcvNameSrvHandler
TdiSend
TdiSendDatagram
TdiSendDatagramCompletion
| |paramcount|1|1| |address|14000b274|14000b274| |sig|undefined __fastcall NbtFreeIrp(longlong param_1)|undefined __fastcall NbtFreeIrp(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NbtFreeIrp Calling Diff ```diff --- NbtFreeIrp calling +++ NbtFreeIrp calling @@ -10,0 +11 @@ +TdiDisconnect_Old ``` ## WPP_SF_q ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.91| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|WPP_SF_q|WPP_SF_q| |fullname|WPP_SF_q|WPP_SF_q| |`refcount`|52|53| |length|44|44| |called|FastWppTraceMessage|FastWppTraceMessage| |`calling`|
Expand for full list:
CheckAddrNotification
CleanUpPartialConnection
CloseAddressesWithTransport
DelayedNbtCloseFileHandles
DelayedNbtDeleteDevice
DisconnectHndlrNotOs
ExtractServerNameCompletion
FindNameOrQuery
Inbound
NTSend
NbtCancelDgramSendNbtCancelLmhSvcIrp
NbtCancelSession
NbtCancelWaitForLmhSvcIrp
NbtCleanUpConnection
NbtConnectCommon
NbtDispatchClose
NbtDispatchCreate
NbtDispatchDevCtrl
NbtDispatchInternalCtrl
NbtDispatchPnP
NbtReConnect
OutOfRsrcKill
Outbound
ReRegisterLocalNames
SendCompletion
SessionSetupContinue
SessionStartupTimeout
StartLmHostTimer
TdiConnect
TdiDisconnect
TdiPnPPowerHandler
TdiRcvDatagramHandler
UpdateNameState
|
Expand for full list:
CheckAddrNotification
CleanUpPartialConnection
CloseAddressesWithTransport
DelayedNbtCloseFileHandles
DelayedNbtDeleteDevice
DisconnectHndlrNotOs
ExtractServerNameCompletion
FindNameOrQuery
Inbound
NTSend
NbtCancelDgramSendNbtCancelLmhSvcIrp
NbtCancelSession
NbtCancelWaitForLmhSvcIrp
NbtCleanUpConnection
NbtConnectCommon
NbtDispatchClose
NbtDispatchCreate
NbtDispatchDevCtrl
NbtDispatchInternalCtrl
NbtDispatchPnP
NbtReConnect
OutOfRsrcKill
Outbound
ReRegisterLocalNames
SendCompletion
SessionSetupContinue
SessionStartupTimeout
StartLmHostTimer
TdiConnect
TdiDisconnect
TdiDisconnect_Old
TdiPnPPowerHandler
TdiRcvDatagramHandler
UpdateNameState
| |paramcount|4|4| |`address`|14003f250|140040250| |sig|undefined __fastcall WPP_SF_q(undefined2 param_1, ushort param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_q(undefined2 param_1, ushort param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_q Calling Diff ```diff --- WPP_SF_q calling +++ WPP_SF_q calling @@ -31,0 +32 @@ +TdiDisconnect_Old ``` ## DelayedWipeOutLowerconn ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|DelayedWipeOutLowerconn|DelayedWipeOutLowerconn| |fullname|DelayedWipeOutLowerconn|DelayedWipeOutLowerconn| |`refcount`|8|3| |length|150|150| |called|NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::ObfDereferenceObject
NbtTdiCloseAddress
NbtTdiCloseConnection|NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::ObfDereferenceObject
NbtTdiCloseAddress
NbtTdiCloseConnection| |calling||| |paramcount|2|2| |`address`|14001c410|14001b4d0| |sig|undefined __fastcall DelayedWipeOutLowerconn(undefined8 param_1, longlong param_2)|undefined __fastcall DelayedWipeOutLowerconn(undefined8 param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|KeAcquireSpinLockRaiseToDpc|KeAcquireSpinLockRaiseToDpc| |fullname|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc| |`refcount`|384|381| |length|0|0| |called||| |`calling`|
Expand for full list:
AcceptCompletionRoutine
AddToHashTable
AddToRemoteHashTbl
CTECountedAllocMem
CTECountedFreeMem
ChangeStateOfName
CheckIfLocalNameActive
CheckRegistrationFromNet
CheckSetWakeupPattern
CleanupConnectingState
CloseAddressesWithTransportCompleteClientReq
CompleteSessionSetup
CompleteTimerAndWorkerRequests
CompletionRcvDgram
ConnectHndlrNotOs
ContinueQueryNameOnNet
CopyFindNameData
CopyNodeStatusResponseCompletion
CountUpperConnections
DatagramDistribution
DecodeNodeStatusResponse
DelayedNbtDeleteDevice
DelayedNbtProcessDhcpRequests
DelayedNbtStartWakeupTimer
DelayedNextRefresh
DelayedReConnect
DelayedRefreshBegin
DgramDistTimeout
DgramHndlrNotOs
DisableInboundConnections
DisconnectDone
DisconnectHndlrNotOs
DoneDelayedNbtProcessConnect
DpcNextOutOfRsrcKill
ExpireTimer
FindNameOrQuery
FindSessionEndPoint
FreeRcvBuffers
FreeTracker
GetContext
GetDeviceFromInterface
GetIpAddrs
GetIrp
GetIrpIfNotCancelled
GetIrpIfNotCancelled2
GetNameToFind
GetNextKeepAlive
GetTracker
GetTransactId
Inbound
IndicateBufferCompletion
InitiateRefresh
InterlockedCallCompletion
LockAndAddToHashTable
LockAndFindName
MSnodeCompletion
MSnodeRegCompletion
MakeNewListCurrent
NBT_DEREFERENCE_DEVICE
NBT_REFERENCE_DEVICE
NTCleanUpWinsAddr
NTCloseWinsAddr
NTConnect
NTExecuteWorker
NTOpenWinsAddr
NTQueryInformation
NTQueueToWorkerThread
NTReceive
NTSend
NameDgramSendCompleted
NameReleaseDone
NameReleaseFromNet
NbtAccept
NbtAddEntryToRemoteHashTable
NbtAddPermanentName
NbtAssociateAddress
NbtAttemptAutoDial
NbtCancelClientReceive
NbtCancelDisconnectWait
NbtCancelListen
NbtCancelLmhSvcIrp
NbtCancelPreConnect
NbtCancelRcvDgram
NbtCancelSession
NbtCancelWaitForLmhSvcIrp
NbtCancelWinsIrp
NbtCancelWinsSendIrp
NbtCheckSetNameAdapterInfo
NbtCleanUpAddress
NbtCleanUpConnection
NbtClientIrpCompletion
NbtClientSetTcpInfo
NbtConnect
NbtConnectCommon
NbtCreateDeviceObject
NbtDeleteLowerConn
NbtDereferenceAddress
NbtDereferenceClient
NbtDereferenceConnection
NbtDereferenceLowerConnection
NbtDereferenceName
NbtDereferenceTracker
NbtDestroyDevice
NbtDisassociateAddress
NbtDisconnect
NbtDispatchInternalCtrl
NbtDispatchPnP
NbtFindAndReferenceDevice
NbtFindAndReferenceDeviceByLuid
NbtFlushEntryFromRemoteHashTable
NbtFreeIrp
NbtGetInterfaceInfo
NbtListen
NbtOpenAddress
NbtOpenAndAssocConnection
NbtProcessIoControlEndpoint
NbtProcessIpv4AddressChange
NbtProcessLmhSvcRequest
NbtProcessTcpDirectQuery
NbtQueryAdapterStatus
NbtQueryConnectionList
NbtQueryGetAddressInfo
NbtQueryWfpAndCleanupConnection
NbtQueueTdiNotification
NbtReConnect
NbtReceiveDatagram
NbtRegisterCompletion
NbtRegisterName
NbtRemovePermanentName
NbtRetryPreConnect
NbtSetEventHandler
NbtSetSmbBindingInfo
NbtSetSmbBindingInfo2
NbtStopRefreshTimer
NbtUpdateSmbBinding
NbtWorkItemPostClientIrpToProvider
NbtWorkItemPostIrpToProvider
NextRefresh
NodeStatusTimeout
NtProcessLmHSvcIrp
OutOfRsrcKill
Outbound
PassNamePduToWins
PreloadEntry
ProxyTimerComplFn
QueryFromNet
QueryNameOnNet
QueryProviderCompletion
QueueCleanup
RcvIrpFromWins
ReRegisterLocalNames
RefreshRegCompletion
RefreshTimeout
RegOrQueryFromNet
RegResponseFromNet
RejectSession
ReleaseCompletion
ReleaseNameOnNet
RelistConnection
RemoteHashTimeout
RemoveNameAndCompleteReq
RemovePreloads
ReturnTimerToFreeQ
RsrcKillCompletion
SendDgramCompletion
SendDgramContinue
SendNameServiceRequest
SendNextDgramToGroup
SendNodeStatusContinue
SendNodeStatusResponse
SessionSetupContinue
SessionStartupCompletion
SessionStartupContinue
SessionStartupTimeoutCompletion
SetNameState
SetNodeType
SmbNotifyTdiClients
StartLmHostTimer
StartRefresh
StartSessionTimer
StartTimer
StopInitTimers
TcpSessionStart
TdiRcvDatagramHandler
TdiRcvNameSrvHandler
TdiReceiveHandler
TimeoutLmHRequests
TimerExpiry
UdpSendDatagram
UpdateNameState
WackFromNet
WinsDgramCompletion
WinsDownTimeout
WinsSendDatagram
WinsSetInformation
|
Expand for full list:
AcceptCompletionRoutine
AddToHashTable
AddToRemoteHashTbl
CTECountedAllocMem
CTECountedFreeMem
ChangeStateOfName
CheckIfLocalNameActive
CheckRegistrationFromNet
CheckSetWakeupPattern
CleanupConnectingState
CloseAddressesWithTransportCompleteClientReq
CompleteSessionSetup
CompleteTimerAndWorkerRequests
CompletionRcvDgram
ConnectHndlrNotOs
ContinueQueryNameOnNet
CopyFindNameData
CopyNodeStatusResponseCompletion
CountUpperConnections
DatagramDistribution
DecodeNodeStatusResponse
DelayedNbtDeleteDevice
DelayedNbtProcessDhcpRequests
DelayedNbtStartWakeupTimer
DelayedNextRefresh
DelayedReConnect
DelayedRefreshBegin
DgramDistTimeout
DgramHndlrNotOs
DisableInboundConnections
DisconnectDone
DisconnectHndlrNotOs
DoneDelayedNbtProcessConnect
DpcNextOutOfRsrcKill
ExpireTimer
FindNameOrQuery
FindSessionEndPoint
FreeRcvBuffers
FreeTracker
GetContext
GetDeviceFromInterface
GetIpAddrs
GetIrp
GetIrpIfNotCancelled
GetIrpIfNotCancelled2
GetNameToFind
GetNextKeepAlive
GetTracker
GetTransactId
Inbound
IndicateBufferCompletion
InitiateRefresh
InterlockedCallCompletion
LockAndAddToHashTable
LockAndFindName
MSnodeCompletion
MSnodeRegCompletion
MakeNewListCurrent
NBT_DEREFERENCE_DEVICE
NBT_REFERENCE_DEVICE
NTCleanUpWinsAddr
NTCloseWinsAddr
NTConnect
NTExecuteWorker
NTOpenWinsAddr
NTQueryInformation
NTQueueToWorkerThread
NTReceive
NTSend
NameDgramSendCompleted
NameReleaseDone
NameReleaseFromNet
NbtAccept
NbtAddEntryToRemoteHashTable
NbtAddPermanentName
NbtAssociateAddress
NbtAttemptAutoDial
NbtCancelClientReceive
NbtCancelDisconnectWait
NbtCancelListen
NbtCancelLmhSvcIrp
NbtCancelPreConnect
NbtCancelRcvDgram
NbtCancelSession
NbtCancelWaitForLmhSvcIrp
NbtCancelWinsIrp
NbtCancelWinsSendIrp
NbtCheckSetNameAdapterInfo
NbtCleanUpAddress
NbtCleanUpConnection
NbtClientIrpCompletion
NbtClientSetTcpInfo
NbtConnect
NbtConnectCommon
NbtCreateDeviceObject
NbtDeleteLowerConn
NbtDereferenceAddress
NbtDereferenceClient
NbtDereferenceConnection
NbtDereferenceLowerConnection
NbtDereferenceName
NbtDereferenceTracker
NbtDestroyDevice
NbtDisassociateAddress
NbtDisconnect
NbtDispatchInternalCtrl
NbtDispatchPnP
NbtFindAndReferenceDevice
NbtFindAndReferenceDeviceByLuid
NbtFlushEntryFromRemoteHashTable
NbtFreeIrp
NbtGetInterfaceInfo
NbtListen
NbtOpenAddress
NbtProcessIoControlEndpoint
NbtProcessIpv4AddressChange
NbtProcessLmhSvcRequest
NbtProcessTcpDirectQuery
NbtQueryAdapterStatus
NbtQueryConnectionList
NbtQueryGetAddressInfo
NbtQueryWfpAndCleanupConnection
NbtQueueTdiNotification
NbtReConnect
NbtReceiveDatagram
NbtRegisterCompletion
NbtRegisterName
NbtRemovePermanentName
NbtRetryPreConnect
NbtSetEventHandler
NbtSetSmbBindingInfo
NbtSetSmbBindingInfo2
NbtStopRefreshTimer
NbtUpdateSmbBinding
NbtWorkItemPostClientIrpToProvider
NbtWorkItemPostIrpToProvider
NextRefresh
NodeStatusTimeout
NtProcessLmHSvcIrp
OutOfRsrcKill
Outbound
PassNamePduToWins
PreloadEntry
ProxyTimerComplFn
QueryFromNet
QueryNameOnNet
QueryProviderCompletion
QueueCleanup
RcvIrpFromWins
ReRegisterLocalNames
RefreshRegCompletion
RefreshTimeout
RegOrQueryFromNet
RegResponseFromNet
RejectSession
ReleaseCompletion
ReleaseNameOnNet
RelistConnection
RemoteHashTimeout
RemoveNameAndCompleteReq
RemovePreloads
ReturnTimerToFreeQ
RsrcKillCompletion
SendDgramCompletion
SendDgramContinue
SendNameServiceRequest
SendNextDgramToGroup
SendNodeStatusContinue
SendNodeStatusResponse
SessionSetupContinue
SessionStartupCompletion
SessionStartupContinue
SessionStartupTimeoutCompletion
SetNameState
SetNodeType
SmbNotifyTdiClients
StartLmHostTimer
StartRefresh
StartSessionTimer
StartTimer
StopInitTimers
TcpSessionStart
TdiRcvDatagramHandler
TdiRcvNameSrvHandler
TdiReceiveHandler
TimeoutLmHRequests
TimerExpiry
UdpSendDatagram
UpdateNameState
WackFromNet
WinsDgramCompletion
WinsDownTimeout
WinsSendDatagram
WinsSetInformation
| |paramcount|0|0| |address|EXTERNAL:00000080|EXTERNAL:00000080| |sig|undefined KeAcquireSpinLockRaiseToDpc(void)|undefined KeAcquireSpinLockRaiseToDpc(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc Calling Diff ```diff --- NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc calling +++ NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc calling @@ -116 +115,0 @@ -NbtOpenAndAssocConnection ``` ## NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|KeAcquireSpinLockAtDpcLevel|KeAcquireSpinLockAtDpcLevel| |fullname|NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel|NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel| |`refcount`|42|44| |length|0|0| |called||| |`calling`|
Expand for full list:
AcceptCompletionRoutine
CleanupConnectingState
ConnectHndlrNotOs
DisableInboundConnections
DisconnectDone
Inbound
NTReceive
NTSend
NbtAccept
NbtCancelClientReceive
NbtDisconnectNbtIndicateDataToClient
NbtProcessClientIrp
NbtProcessTcpDirectQuery
NbtQueryWfpAndCleanupConnection
OutOfRsrcKill
OutOfRsrcKillUnderLock
Outbound
PerformInboundProcessing
QueueCleanup
SessionStartupContinue
|
Expand for full list:
AcceptCompletionRoutine
CleanupConnectingState
ConnectHndlrNotOs
DisableInboundConnections
DisconnectDone
Inbound
NTReceive
NTSend
NbtAccept
NbtCancelClientReceive
NbtDeleteLowerConnNbtDereferenceLowerConnection
NbtDisconnect
NbtIndicateDataToClient
NbtProcessClientIrp
NbtProcessTcpDirectQuery
NbtQueryWfpAndCleanupConnection
OutOfRsrcKill
OutOfRsrcKillUnderLock
Outbound
PerformInboundProcessing
QueueCleanup
SessionStartupContinue
| |paramcount|0|0| |address|EXTERNAL:0000007d|EXTERNAL:0000007d| |sig|undefined KeAcquireSpinLockAtDpcLevel(void)|undefined KeAcquireSpinLockAtDpcLevel(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel Calling Diff ```diff --- NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel calling +++ NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel calling @@ -10,0 +11,2 @@ +NbtDeleteLowerConn +NbtDereferenceLowerConnection ``` ## wil_details_IsEnabledFallback ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|3|4| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_ModernWpp__private_IsEnabledFallback
Feature_TCPIP_K2_9F_Netbt_Timeout__private_IsEnabledFallback|Feature_1180933432__private_IsEnabledFallback
Feature_ModernWpp__private_IsEnabledFallback
Feature_TCPIP_K2_9F_Netbt_Timeout__private_IsEnabledFallback| |paramcount|3|3| |`address`|14002c21c|14002b584| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledFallback ``` ## NTOSKRNL.EXE::IoGetRelatedDeviceObject ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|IoGetRelatedDeviceObject|IoGetRelatedDeviceObject| |fullname|NTOSKRNL.EXE::IoGetRelatedDeviceObject|NTOSKRNL.EXE::IoGetRelatedDeviceObject| |`refcount`|34|35| |length|0|0| |called||| |`calling`|
Expand for full list:
GetExtendedAttributes
NTQueryInformation
NTReceive
NTSend
NbtBuildIrpForIndicateBuffer
NbtDispatchPnP
NbtOpenAndAssocConnection
NbtProcessClientIrp
NbtProcessTcpDirectQuery
NbtSetEndpointOption
NbtSetTcpInfoNbtTdiAssociateConnection
NbtTdiOpenAddress
NbtTdiOpenControl
NbtWorkItemPostClientIrpToProvider
NbtWorkItemPostIrpToProvider
OutOfRsrcKill
SetEventHandler
SetTcpInfo
SubmitTdiRequest
TdiConnect
TdiConnectHandler
TdiDisconnect
TdiSend
TdiSendDatagram
|
Expand for full list:
GetExtendedAttributes
NTQueryInformation
NTReceive
NTSend
NbtBuildIrpForIndicateBuffer
NbtDispatchPnP
NbtOpenAndAssocConnection
NbtProcessClientIrp
NbtProcessTcpDirectQuery
NbtSetEndpointOption
NbtSetTcpInfoNbtTdiAssociateConnection
NbtTdiOpenAddress
NbtTdiOpenControl
NbtWorkItemPostClientIrpToProvider
NbtWorkItemPostIrpToProvider
OutOfRsrcKill
SetEventHandler
SetTcpInfo
SubmitTdiRequest
TdiConnect
TdiConnectHandler
TdiDisconnect
TdiDisconnect_Old
TdiSend
TdiSendDatagram
| |paramcount|0|0| |address|EXTERNAL:00000083|EXTERNAL:00000083| |sig|undefined IoGetRelatedDeviceObject(void)|undefined IoGetRelatedDeviceObject(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::IoGetRelatedDeviceObject Calling Diff ```diff --- NTOSKRNL.EXE::IoGetRelatedDeviceObject calling +++ NTOSKRNL.EXE::IoGetRelatedDeviceObject calling @@ -23,0 +24 @@ +TdiDisconnect_Old ``` ## NTExecuteWorker ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|NTExecuteWorker|NTExecuteWorker| |fullname|NTExecuteWorker|NTExecuteWorker| |`refcount`|7|4| |length|308|308| |called|NBT_DEREFERENCE_DEVICE
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
_guard_dispatch_icall|NBT_DEREFERENCE_DEVICE
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
_guard_dispatch_icall| |calling|CompleteTimerAndWorkerRequests|CompleteTimerAndWorkerRequests| |paramcount|0|0| |address|14000af80|14000af80| |sig|undefined __fastcall NTExecuteWorker(void)|undefined __fastcall NTExecuteWorker(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::IofCallDriver ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|IofCallDriver|IofCallDriver| |fullname|NTOSKRNL.EXE::IofCallDriver|NTOSKRNL.EXE::IofCallDriver| |`refcount`|25|26| |length|0|0| |called||| |`calling`|
Expand for full list:
DelayedNbtProcessConnect
GetExtendedAttributes
NTQueryInformation
NTReceive
NTSend
NbtAcdBind
NbtAcdUnbind
NbtDispatchPnP
NbtOpenAndAssocConnection
NbtProcessTcpDirectQuery
NbtSetEndpointOptionNbtSetTcpInfo
NbtTdiAssociateConnection
NbtWorkItemPostClientIrpToProvider
NbtWorkItemPostIrpToProvider
OutOfRsrcKill
SetTcpInfo
SubmitTdiRequest
TdiConnect
TdiDisconnect
TdiSend
TdiSendDatagram
|
Expand for full list:
DelayedNbtProcessConnect
GetExtendedAttributes
NTQueryInformation
NTReceive
NTSend
NbtAcdBind
NbtAcdUnbind
NbtDispatchPnP
NbtOpenAndAssocConnection
NbtProcessTcpDirectQuery
NbtSetEndpointOptionNbtSetTcpInfo
NbtTdiAssociateConnection
NbtWorkItemPostClientIrpToProvider
NbtWorkItemPostIrpToProvider
OutOfRsrcKill
SetTcpInfo
SubmitTdiRequest
TdiConnect
TdiDisconnect
TdiDisconnect_Old
TdiSend
TdiSendDatagram
| |paramcount|0|0| |address|EXTERNAL:0000001d|EXTERNAL:0000001d| |sig|undefined IofCallDriver(void)|undefined IofCallDriver(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::IofCallDriver Calling Diff ```diff --- NTOSKRNL.EXE::IofCallDriver calling +++ NTOSKRNL.EXE::IofCallDriver calling @@ -20,0 +21 @@ +TdiDisconnect_Old ``` ## NTOSKRNL.EXE::ExQueueWorkItem ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|ExQueueWorkItem|ExQueueWorkItem| |fullname|NTOSKRNL.EXE::ExQueueWorkItem|NTOSKRNL.EXE::ExQueueWorkItem| |`refcount`|7|4| |length|0|0| |called||| |`calling`|DisableInboundConnections
NTQueueDedicatedWorkitem
NTQueueToWorkerThread
NbtAddressChangeResyncCacheTimeout
NbtDereferenceLowerConnection
NbtOpenAndAssocConnection|NTQueueDedicatedWorkitem
NTQueueToWorkerThread
NbtAddressChangeResyncCacheTimeout| |paramcount|0|0| |address|EXTERNAL:00000044|EXTERNAL:00000044| |sig|undefined ExQueueWorkItem(void)|undefined ExQueueWorkItem(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExQueueWorkItem Calling Diff ```diff --- NTOSKRNL.EXE::ExQueueWorkItem calling +++ NTOSKRNL.EXE::ExQueueWorkItem calling @@ -1 +0,0 @@ -DisableInboundConnections @@ -5,2 +3,0 @@ -NbtDereferenceLowerConnection -NbtOpenAndAssocConnection ``` ## NTOSKRNL.EXE::KeReleaseSpinLock ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|KeReleaseSpinLock|KeReleaseSpinLock| |fullname|NTOSKRNL.EXE::KeReleaseSpinLock|NTOSKRNL.EXE::KeReleaseSpinLock| |`refcount`|597|599| |length|0|0| |called||| |`calling`|
Expand for full list:
AcceptCompletionRoutine
AddToHashTable
AddToRemoteHashTbl
CTECountedAllocMem
CTECountedFreeMem
ChangeStateOfName
CheckIfLocalNameActive
CheckRegistrationFromNet
CheckSetWakeupPattern
CleanUpPartialConnection
CleanupConnectingStateCloseAddressesWithTransport
CompleteClientReq
CompleteSessionSetup
CompleteTimerAndWorkerRequests
CompletionRcvDgram
ConnectHndlrNotOs
ContinueQueryNameOnNet
CopyFindNameData
CopyNodeStatusResponseCompletion
CountUpperConnections
DatagramDistribution
DecodeNodeStatusResponse
DelayedNbtDeleteDevice
DelayedNbtProcessDhcpRequests
DelayedNbtStartWakeupTimer
DelayedNextRefresh
DelayedReConnect
DelayedRefreshBegin
DgramDistTimeout
DgramHndlrNotOs
DisableInboundConnections
DisconnectDone
DisconnectHndlrNotOs
DoneDelayedNbtProcessConnect
DpcNextOutOfRsrcKill
ExpireTimer
FindNameOrQuery
FindSessionEndPoint
FreeRcvBuffers
FreeTracker
GetContext
GetDeviceFromInterface
GetIpAddrs
GetIrp
GetIrpIfNotCancelled
GetIrpIfNotCancelled2
GetNameToFind
GetNextKeepAlive
GetTracker
GetTransactId
Inbound
IndicateBufferCompletion
InitiateRefresh
InterlockedCallCompletion
LockAndAddToHashTable
LockAndFindName
MSnodeCompletion
MSnodeRegCompletion
MakeNewListCurrent
NBT_DEREFERENCE_DEVICE
NBT_REFERENCE_DEVICE
NTCleanUpWinsAddr
NTCloseWinsAddr
NTConnect
NTExecuteWorker
NTOpenWinsAddr
NTQueryInformation
NTQueueToWorkerThread
NTReceive
NTSend
NameDgramSendCompleted
NameReleaseDone
NameReleaseFromNet
NbtAccept
NbtAddEntryToRemoteHashTable
NbtAddPermanentName
NbtAssociateAddress
NbtAttemptAutoDial
NbtCancelClientReceive
NbtCancelDisconnectWait
NbtCancelListen
NbtCancelLmhSvcIrp
NbtCancelPreConnect
NbtCancelRcvDgram
NbtCancelSession
NbtCancelWaitForLmhSvcIrp
NbtCancelWinsIrp
NbtCancelWinsSendIrp
NbtCheckSetNameAdapterInfo
NbtCleanUpAddress
NbtCleanUpConnection
NbtCleanupSessionOrDeferForWfpQuery
NbtClientIrpCompletion
NbtClientSetTcpInfo
NbtConnect
NbtConnectCommon
NbtCreateDeviceObject
NbtDeleteLowerConn
NbtDereferenceAddress
NbtDereferenceClient
NbtDereferenceConnection
NbtDereferenceLowerConnection
NbtDereferenceName
NbtDereferenceTracker
NbtDestroyDevice
NbtDisassociateAddress
NbtDisconnect
NbtDispatchInternalCtrl
NbtDispatchPnP
NbtFindAndReferenceDevice
NbtFindAndReferenceDeviceByLuid
NbtFlushEntryFromRemoteHashTable
NbtFreeIrp
NbtGetInterfaceInfo
NbtListen
NbtOpenAddress
NbtOpenAndAssocConnection
NbtProcessIoControlEndpoint
NbtProcessIpv4AddressChange
NbtProcessLmhSvcRequest
NbtProcessTcpDirectQuery
NbtQueryAdapterStatus
NbtQueryConnectionList
NbtQueryGetAddressInfo
NbtQueryWfpAndCleanupConnection
NbtQueueTdiNotification
NbtReConnect
NbtReceiveDatagram
NbtRegisterCompletion
NbtRegisterName
NbtRemovePermanentName
NbtRetryPreConnect
NbtSetEventHandler
NbtSetSmbBindingInfo
NbtSetSmbBindingInfo2
NbtStopRefreshTimer
NbtUpdateSmbBinding
NbtWorkItemPostClientIrpToProvider
NbtWorkItemPostIrpToProvider
NextRefresh
NodeStatusTimeout
NtProcessLmHSvcIrp
OutOfRsrcKill
Outbound
PassNamePduToWins
PreloadEntry
ProxyTimerComplFn
QueryFromNet
QueryNameOnNet
QueryProviderCompletion
QueueCleanup
RcvIrpFromWins
ReRegisterLocalNames
RefreshRegCompletion
RefreshTimeout
RegOrQueryFromNet
RegResponseFromNet
RejectSession
ReleaseCompletion
ReleaseNameOnNet
RelistConnection
RemoteHashTimeout
RemoveNameAndCompleteReq
RemovePreloads
ReturnTimerToFreeQ
RsrcKillCompletion
SendDgramCompletion
SendDgramContinue
SendNameServiceRequest
SendNextDgramToGroup
SendNodeStatusContinue
SendNodeStatusResponse
SendToResolvingName
SessionSetupContinue
SessionStartupCompletion
SessionStartupContinue
SessionStartupTimeoutCompletion
SetNameState
SetNodeType
SmbNotifyTdiClients
StartLmHostTimer
StartRefresh
StartSessionTimer
StartTimer
StopInitTimers
TcpSessionStart
TdiRcvDatagramHandler
TdiRcvNameSrvHandler
TdiReceiveHandler
TimeoutLmHRequests
TimerExpiry
UdpSendDatagram
UdpSendResponse
UpdateNameState
WackFromNet
WinsDgramCompletion
WinsDownTimeout
WinsSendDatagram
WinsSetInformation
|
Expand for full list:
AcceptCompletionRoutine
AddToHashTable
AddToRemoteHashTbl
CTECountedAllocMem
CTECountedFreeMem
ChangeStateOfName
CheckIfLocalNameActive
CheckRegistrationFromNet
CheckSetWakeupPattern
CleanUpPartialConnection
CleanupConnectingStateCloseAddressesWithTransport
CompleteClientReq
CompleteSessionSetup
CompleteTimerAndWorkerRequests
CompletionRcvDgram
ConnectHndlrNotOs
ContinueQueryNameOnNet
CopyFindNameData
CopyNodeStatusResponseCompletion
CountUpperConnections
DatagramDistribution
DecodeNodeStatusResponse
DelayedNbtDeleteDevice
DelayedNbtProcessDhcpRequests
DelayedNbtStartWakeupTimer
DelayedNextRefresh
DelayedReConnect
DelayedRefreshBegin
DgramDistTimeout
DgramHndlrNotOs
DisableInboundConnections
DisconnectDone
DisconnectHndlrNotOs
DoneDelayedNbtProcessConnect
DpcNextOutOfRsrcKill
ExpireTimer
FindNameOrQuery
FindSessionEndPoint
FreeRcvBuffers
FreeTracker
GetContext
GetDeviceFromInterface
GetIpAddrs
GetIrp
GetIrpIfNotCancelled
GetIrpIfNotCancelled2
GetNameToFind
GetNextKeepAlive
GetTracker
GetTransactId
Inbound
IndicateBufferCompletion
InitiateRefresh
InterlockedCallCompletion
LockAndAddToHashTable
LockAndFindName
MSnodeCompletion
MSnodeRegCompletion
MakeNewListCurrent
NBT_DEREFERENCE_DEVICE
NBT_REFERENCE_DEVICE
NTCleanUpWinsAddr
NTCloseWinsAddr
NTConnect
NTExecuteWorker
NTOpenWinsAddr
NTQueryInformation
NTQueueToWorkerThread
NTReceive
NTSend
NameDgramSendCompleted
NameReleaseDone
NameReleaseFromNet
NbtAccept
NbtAddEntryToRemoteHashTable
NbtAddPermanentName
NbtAssociateAddress
NbtAttemptAutoDial
NbtCancelClientReceive
NbtCancelDisconnectWait
NbtCancelListen
NbtCancelLmhSvcIrp
NbtCancelPreConnect
NbtCancelRcvDgram
NbtCancelSession
NbtCancelWaitForLmhSvcIrp
NbtCancelWinsIrp
NbtCancelWinsSendIrp
NbtCheckSetNameAdapterInfo
NbtCleanUpAddress
NbtCleanUpConnection
NbtCleanupSessionOrDeferForWfpQuery
NbtClientIrpCompletion
NbtClientSetTcpInfo
NbtConnect
NbtConnectCommon
NbtCreateDeviceObject
NbtDeleteLowerConn
NbtDereferenceAddress
NbtDereferenceClient
NbtDereferenceConnection
NbtDereferenceLowerConnection
NbtDereferenceName
NbtDereferenceTracker
NbtDestroyDevice
NbtDisassociateAddress
NbtDisconnect
NbtDispatchInternalCtrl
NbtDispatchPnP
NbtFindAndReferenceDevice
NbtFindAndReferenceDeviceByLuid
NbtFlushEntryFromRemoteHashTable
NbtFreeIrp
NbtGetInterfaceInfo
NbtListen
NbtOpenAddress
NbtProcessIoControlEndpoint
NbtProcessIpv4AddressChange
NbtProcessLmhSvcRequest
NbtProcessTcpDirectQuery
NbtQueryAdapterStatus
NbtQueryConnectionList
NbtQueryGetAddressInfo
NbtQueryWfpAndCleanupConnection
NbtQueueTdiNotification
NbtReConnect
NbtReceiveDatagram
NbtRegisterCompletion
NbtRegisterName
NbtRemovePermanentName
NbtRetryPreConnect
NbtSetEventHandler
NbtSetSmbBindingInfo
NbtSetSmbBindingInfo2
NbtStopRefreshTimer
NbtUpdateSmbBinding
NbtWorkItemPostClientIrpToProvider
NbtWorkItemPostIrpToProvider
NextRefresh
NodeStatusTimeout
NtProcessLmHSvcIrp
OutOfRsrcKill
Outbound
PassNamePduToWins
PreloadEntry
ProxyTimerComplFn
QueryFromNet
QueryNameOnNet
QueryProviderCompletion
QueueCleanup
RcvIrpFromWins
ReRegisterLocalNames
RefreshRegCompletion
RefreshTimeout
RegOrQueryFromNet
RegResponseFromNet
RejectSession
ReleaseCompletion
ReleaseNameOnNet
RelistConnection
RemoteHashTimeout
RemoveNameAndCompleteReq
RemovePreloads
ReturnTimerToFreeQ
RsrcKillCompletion
SendDgramCompletion
SendDgramContinue
SendNameServiceRequest
SendNextDgramToGroup
SendNodeStatusContinue
SendNodeStatusResponse
SendToResolvingName
SessionSetupContinue
SessionStartupCompletion
SessionStartupContinue
SessionStartupTimeoutCompletion
SetNameState
SetNodeType
SmbNotifyTdiClients
StartLmHostTimer
StartRefresh
StartSessionTimer
StartTimer
StopInitTimers
TcpSessionStart
TdiRcvDatagramHandler
TdiRcvNameSrvHandler
TdiReceiveHandler
TimeoutLmHRequests
TimerExpiry
UdpSendDatagram
UdpSendResponse
UpdateNameState
WackFromNet
WinsDgramCompletion
WinsDownTimeout
WinsSendDatagram
WinsSetInformation
| |paramcount|0|0| |address|EXTERNAL:00000081|EXTERNAL:00000081| |sig|undefined KeReleaseSpinLock(void)|undefined KeReleaseSpinLock(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeReleaseSpinLock Calling Diff ```diff --- NTOSKRNL.EXE::KeReleaseSpinLock calling +++ NTOSKRNL.EXE::KeReleaseSpinLock calling @@ -118 +117,0 @@ -NbtOpenAndAssocConnection ``` ## WPP_SF_qddds ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|WPP_SF_qddds|WPP_SF_qddds| |fullname|WPP_SF_qddds|WPP_SF_qddds| |`refcount`|136|146| |length|173|173| |called|FastWppTraceMessage|FastWppTraceMessage| |`calling`|
Expand for full list:
AddToDomainList
AddToHashTable
AddToPendingList
CheckRegistrationFromNet
CompletionRcvDgram
ConnectHndlrNotOs
ContinueQueryNameOnNet
CopyNodeStatusResponseCompletion
DatagramDistribution
DelayedNbtDeleteDevice
DelayedNextRefreshDgramHndlrNotOs
DisableInboundConnections
DisconnectHndlrNotOs
FindInHashTable
FindNameOrQuery
FindSessionEndPoint
GetNextKeepAlive
GetNextName
Inbound
InitDelayedNbtProcessConnect
MSnodeCompletion
MSnodeRegCompletion
MakeNewListCurrent
NTQueryInformation
NTReceive
NTSend
NameDgramSendCompleted
NameReleaseDone
NbtAddEntryToRemoteHashTable
NbtAddPermanentName
NbtCleanUpAddress
NbtCleanupSessionOrDeferForWfpQuery
NbtClientSetTcpInfo
NbtConnectCommon
NbtDereferenceAddress
NbtDereferenceClient
NbtDereferenceConnection
NbtDereferenceLowerConnection
NbtDereferenceName
NbtDereferenceTracker
NbtDisconnect
NbtDispatchPnP
NbtOpenAddress
NbtOpenAndAssocConnection
NbtOpenConnection
NbtQueryAdapterStatus
NbtQueueDeferredPostIrp
NbtReConnect
NbtRegisterCompletion
NbtRegisterName
NbtSendNodeStatus
NodeStatusTimeout
OutOfRsrcKill
PreloadEntry
ProxyTimerComplFn
QueryFromNet
QueryNameOnNet
QueueCleanup
ReRegisterLocalNames
RefreshRegCompletion
RegResponseFromNet
ReleaseCompletion
ReleaseNameOnNet
RemoveNameAndCompleteReq
SendDgramContinue
SendNodeStatusContinue
SessionSetupContinue
SessionStartupCompletion
SessionStartupContinue
SessionStartupTimeoutCompletion
SetNameState
StartRefresh
TdiRcvNameSrvHandler
TdiReceiveHandler
UpdateNameState
|
Expand for full list:
AddToDomainList
AddToHashTable
AddToPendingList
CheckRegistrationFromNet
CompletionRcvDgram
ConnectHndlrNotOs
ContinueQueryNameOnNet
CopyNodeStatusResponseCompletion
DatagramDistribution
DelayedNbtDeleteDevice
DelayedNextRefreshDgramHndlrNotOs
DisableInboundConnections
DisconnectHndlrNotOs
FindInHashTable
FindNameOrQuery
FindSessionEndPoint
GetNextKeepAlive
GetNextName
Inbound
InitDelayedNbtProcessConnect
MSnodeCompletion
MSnodeRegCompletion
MakeNewListCurrent
NTQueryInformation
NTReceive
NTSend
NameDgramSendCompleted
NameReleaseDone
NbtAddEntryToRemoteHashTable
NbtAddPermanentName
NbtCleanUpAddress
NbtCleanupSessionOrDeferForWfpQuery
NbtClientSetTcpInfo
NbtConnectCommon
NbtDereferenceAddress
NbtDereferenceClient
NbtDereferenceConnection
NbtDereferenceLowerConnection
NbtDereferenceName
NbtDereferenceTracker
NbtDisconnect
NbtDispatchPnP
NbtOpenAddress
NbtOpenAndAssocConnection
NbtOpenConnection
NbtQueryAdapterStatus
NbtQueueDeferredPostIrp
NbtReConnect
NbtRegisterCompletion
NbtRegisterName
NbtSendNodeStatus
NodeStatusTimeout
OutOfRsrcKill
PreloadEntry
ProxyTimerComplFn
QueryFromNet
QueryNameOnNet
QueueCleanup
ReRegisterLocalNames
RefreshRegCompletion
RegResponseFromNet
ReleaseCompletion
ReleaseNameOnNet
RemoveNameAndCompleteReq
SendDgramContinue
SendNodeStatusContinue
SendTcpDisconnect
SessionSetupContinue
SessionStartupCompletion
SessionStartupContinue
SessionStartupTimeoutCompletion
SetNameState
StartRefresh
TdiRcvNameSrvHandler
TdiReceiveHandler
UpdateNameState
| |paramcount|4|4| |`address`|14004294c|14004394c| |sig|undefined __fastcall WPP_SF_qddds(undefined8 param_1, ushort param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_qddds(undefined8 param_1, ushort param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_qddds Calling Diff ```diff --- WPP_SF_qddds calling +++ WPP_SF_qddds calling @@ -67,0 +68 @@ +SendTcpDisconnect ``` ## NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|KeReleaseSpinLockFromDpcLevel|KeReleaseSpinLockFromDpcLevel| |fullname|NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel|NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel| |`refcount`|71|74| |length|0|0| |called||| |`calling`|
Expand for full list:
AcceptCompletionRoutine
CleanupConnectingState
ConnectHndlrNotOs
DisableInboundConnections
DisconnectDone
Inbound
NTReceive
NTSend
NbtAccept
NbtCancelClientReceive
NbtCleanupSessionOrDeferForWfpQueryNbtDisconnect
NbtIndicateDataToClient
NbtProcessClientIrp
NbtProcessTcpDirectQuery
NbtQueryWfpAndCleanupConnection
OutOfRsrcKill
OutOfRsrcKillUnderLock
Outbound
PerformInboundProcessing
QueueCleanup
SessionStartupContinue
|
Expand for full list:
AcceptCompletionRoutine
CleanupConnectingState
ConnectHndlrNotOs
DisableInboundConnections
DisconnectDone
Inbound
NTReceive
NTSend
NbtAccept
NbtCancelClientReceive
NbtCleanupSessionOrDeferForWfpQueryNbtDeleteLowerConn
NbtDereferenceLowerConnection
NbtDisconnect
NbtIndicateDataToClient
NbtProcessClientIrp
NbtProcessTcpDirectQuery
NbtQueryWfpAndCleanupConnection
OutOfRsrcKill
OutOfRsrcKillUnderLock
Outbound
PerformInboundProcessing
QueueCleanup
SessionStartupContinue
| |paramcount|0|0| |address|EXTERNAL:0000007e|EXTERNAL:0000007e| |sig|undefined KeReleaseSpinLockFromDpcLevel(void)|undefined KeReleaseSpinLockFromDpcLevel(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel Calling Diff ```diff --- NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel calling +++ NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel calling @@ -11,0 +12,2 @@ +NbtDeleteLowerConn +NbtDereferenceLowerConnection ``` ## NTOSKRNL.EXE::ExAllocatePool2 ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|ExAllocatePool2|ExAllocatePool2| |fullname|NTOSKRNL.EXE::ExAllocatePool2|NTOSKRNL.EXE::ExAllocatePool2| |`refcount`|119|116| |length|0|0| |called||| |`calling`|
Expand for full list:
AddToDomainList
AddToHashTable
AddToPendingList
CTECountedAllocMem
ChooseBestIpAddress
ContinueQueryNameOnNet
CopyFindNameData
CopyNodeStatusResponseCompletion
CreateDeviceString
CreateHashTable
CreatePduDelayedNbtResyncRemoteCache
DelayedScanLmHostFile
DelayedSessionKeepAlive
DgramHndlrNotOs
DisableInboundConnections
DriverEntry
FindNameOrQuery
GetListOfAllAddrs
LmGetFullPath
LmHostQueueRequest
LmOpenFile
LmpMapFile
LookupDeviceInRegistry
MakeRemoteAddressStructure
NTConnect
NTGetLmHostPath
NTOpenWinsAddr
NTQueryInformation
NTQueueDedicatedWorkitem
NTQueueToWorkerThread
NTReadIniString
NTSendSession
NbtAddEntryToRemoteHashTable
NbtAddressChangeResyncCacheTimeout
NbtAllocAndInitDevice
NbtAllocInitTracker
NbtAllocateClientBlock
NbtAppendString
NbtAttemptAutoDial
NbtCancelPostConnect
NbtCancelPreConnect
NbtConnectCommon
NbtCreateAddressObjects
NbtCreateDeviceObject
NbtDereferenceLowerConnection
NbtGetInterfaceInfo
NbtGetMdl
NbtListen
NbtNoteNewConnection
NbtOpenAddress
NbtOpenAndAssocConnection
NbtOpenConnection
NbtQueryAdapterStatus
NbtQueryBcastVsWins
NbtQueryConnectionList
NbtQueryGetAddressInfo
NbtReadLinkageInformation
NbtReadRegistry
NbtReceiveDatagram
NbtSendDatagram
NbtSendNodeStatus
NbtSetSmbBindingInfo
NbtSetSmbBindingInfo2
NbtSetTcpInfo
NbtTdiOpenAddress
NbtTdiOpenConnection
NbtUpdateRemoteName
NewInternalAddressFromNetbios
NewInternalAddressFromNetbiosEX
NewInternalAddressFromUnicodeAddress
PassNamePduToWins
PerformInboundProcessing
ProxyDoDgramDist
QueryFromNet
ReadElement
ReadNameServerAddresses
ReadScope
ReadStringRelative
SendNameServiceRequest
SendNodeStatusResponse
SessionSetupContinue
TcpSendSessionResponse
TdiRcvDatagramHandler
TdiRcvNameSrvHandler
UdpSendResponse
UpdateNameState
WinsAllocMem
|
Expand for full list:
AddToDomainList
AddToHashTable
AddToPendingList
CTECountedAllocMem
ChooseBestIpAddress
ContinueQueryNameOnNet
CopyFindNameData
CopyNodeStatusResponseCompletion
CreateDeviceString
CreateHashTable
CreatePduDelayedNbtResyncRemoteCache
DelayedScanLmHostFile
DelayedSessionKeepAlive
DgramHndlrNotOs
DriverEntry
FindNameOrQuery
GetListOfAllAddrs
LmGetFullPath
LmHostQueueRequest
LmOpenFile
LmpMapFile
LookupDeviceInRegistry
MakeRemoteAddressStructure
NTConnect
NTGetLmHostPath
NTOpenWinsAddr
NTQueryInformation
NTQueueDedicatedWorkitem
NTQueueToWorkerThread
NTReadIniString
NTSendSession
NbtAddEntryToRemoteHashTable
NbtAddressChangeResyncCacheTimeout
NbtAllocAndInitDevice
NbtAllocInitTracker
NbtAllocateClientBlock
NbtAppendString
NbtAttemptAutoDial
NbtCancelPostConnect
NbtCancelPreConnect
NbtConnectCommon
NbtCreateAddressObjects
NbtCreateDeviceObject
NbtGetInterfaceInfo
NbtGetMdl
NbtListen
NbtNoteNewConnection
NbtOpenAddress
NbtOpenAndAssocConnection
NbtOpenConnection
NbtQueryAdapterStatus
NbtQueryBcastVsWins
NbtQueryConnectionList
NbtQueryGetAddressInfo
NbtReadLinkageInformation
NbtReadRegistry
NbtReceiveDatagram
NbtSendDatagram
NbtSendNodeStatus
NbtSetSmbBindingInfo
NbtSetSmbBindingInfo2
NbtSetTcpInfo
NbtTdiOpenAddress
NbtTdiOpenConnection
NbtUpdateRemoteName
NewInternalAddressFromNetbios
NewInternalAddressFromNetbiosEX
NewInternalAddressFromUnicodeAddress
PassNamePduToWins
PerformInboundProcessing
ProxyDoDgramDist
QueryFromNet
ReadElement
ReadNameServerAddresses
ReadScope
ReadStringRelative
SendNameServiceRequest
SendNodeStatusResponse
SessionSetupContinue
TcpSendSessionResponse
TdiRcvDatagramHandler
TdiRcvNameSrvHandler
UdpSendResponse
UpdateNameState
WinsAllocMem
| |paramcount|0|0| |address|EXTERNAL:00000084|EXTERNAL:00000084| |sig|undefined ExAllocatePool2(void)|undefined ExAllocatePool2(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAllocatePool2 Calling Diff ```diff --- NTOSKRNL.EXE::ExAllocatePool2 calling +++ NTOSKRNL.EXE::ExAllocatePool2 calling @@ -16 +15,0 @@ -DisableInboundConnections @@ -46 +44,0 @@ -NbtDereferenceLowerConnection ``` ## GetIrp ### Match Info |Key|netbt-06.sys - netbt-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.68| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|netbt-06.sys|netbt-07.sys| | :---: | :---: | :---: | |name|GetIrp|GetIrp| |fullname|GetIrp|GetIrp| |`refcount`|9|10| |length|151|151| |called|NTOSKRNL.EXE::IoAllocateIrp
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock|NTOSKRNL.EXE::IoAllocateIrp
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock| |`calling`|NbtBuildIrpForIndicateBuffer
TdiConnect
TdiConnectHandler
TdiDisconnect
TdiRcvDatagramHandler
TdiRcvNameSrvHandler
TdiSend
TdiSendDatagram|NbtBuildIrpForIndicateBuffer
TdiConnect
TdiConnectHandler
TdiDisconnect
TdiDisconnect_Old
TdiRcvDatagramHandler
TdiRcvNameSrvHandler
TdiSend
TdiSendDatagram| |paramcount|1|1| |`address`|1400140a8|140013868| |sig|undefined8 __fastcall GetIrp(longlong * param_1)|undefined8 __fastcall GetIrp(longlong * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### GetIrp Calling Diff ```diff --- GetIrp calling +++ GetIrp calling @@ -4,0 +5 @@ +TdiDisconnect_Old ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-28T15:36:17