# srvnet-06.sys-srvnet-07.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [FUN_140004090](#fun_140004090) * [SrvNetHandleUnclaimedSmb1Connection](#srvnethandleunclaimedsmb1connection) * [FUN_14002c061](#fun_14002c061) * [FUN_14002c4cb](#fun_14002c4cb) * [FUN_14005a4a8](#fun_14005a4a8) * [FUN_14005a4be](#fun_14005a4be) * [FUN_14005a4cd](#fun_14005a4cd) * [Added](#added) * [Feature_1180933432__private_IsEnabledDeviceUsageNoInline](#feature_1180933432__private_isenableddeviceusagenoinline) * [Feature_1180933432__private_IsEnabledFallback](#feature_1180933432__private_isenabledfallback) * [Feature_3107684665__private_IsEnabledDeviceUsageNoInline](#feature_3107684665__private_isenableddeviceusagenoinline) * [Feature_3107684665__private_IsEnabledFallback](#feature_3107684665__private_isenabledfallback) * [SrvNetUnpublishClientSlot](#srvnetunpublishclientslot) * [Modified](#modified) * [SrvNetNotifyClientsOfEndpoint](#srvnetnotifyclientsofendpoint) * [SrvNetTdiAllocateEndpoint](#srvnettdiallocateendpoint) * [SrvNetDeregisterClient](#srvnetderegisterclient) * [SrvNetTdiCloseConnection](#srvnettdicloseconnection) * [SrvNetAllocateEndpointCommon](#srvnetallocateendpointcommon) * [SrvNetTdiReceiveHandler](#srvnettdireceivehandler) * [SrvNetTdiReceiveCompletion](#srvnettdireceivecompletion) * [SrvNetEndpointReopenTdiConnections](#srvnetendpointreopentdiconnections) * [SrvNetCommonReceiveHandler](#srvnetcommonreceivehandler) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [SrvNetCloseConnectionWithLock](#srvnetcloseconnectionwithlock) * [NTOSKRNL.EXE::ExAcquireRundownProtection](#ntoskrnlexeexacquirerundownprotection) * [NTOSKRNL.EXE::ExRundownCompleted](#ntoskrnlexeexrundowncompleted) * [WPP_SF_q](#wpp_sf_q) * [NTOSKRNL.EXE::ObfDereferenceObject](#ntoskrnlexeobfdereferenceobject) * [_tlgKeywordOn](#_tlgkeywordon) * [NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc](#ntoskrnlexekeacquirespinlockraisetodpc) * [NTOSKRNL.EXE::ExInitializeRundownProtection](#ntoskrnlexeexinitializerundownprotection) * [NTOSKRNL.EXE::IoFreeIrp](#ntoskrnlexeiofreeirp) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [__security_check_cookie](#__security_check_cookie) * [RtlStringCchLengthA](#rtlstringcchlengtha) * [NTOSKRNL.EXE::ZwClose](#ntoskrnlexezwclose) * [_tlgWriteTransfer_EtwWriteTransfer](#_tlgwritetransfer_etwwritetransfer) * [NTOSKRNL.EXE::ExReleaseRundownProtection](#ntoskrnlexeexreleaserundownprotection) * [NTOSKRNL.EXE::EtwWriteTransfer](#ntoskrnlexeetwwritetransfer) * [NTOSKRNL.EXE::KeReleaseSpinLock](#ntoskrnlexekereleasespinlock) * [NTOSKRNL.EXE::ExWaitForRundownProtectionRelease](#ntoskrnlexeexwaitforrundownprotectionrelease) # Visual Chart Diff ```mermaid flowchart LR SrvNetNotifyClientsOfEndpoint-2-old<--Match 66%-->SrvNetNotifyClientsOfEndpoint-2-new SrvNetTdiAllocateEndpoint-9-old<--Match 24%-->SrvNetTdiAllocateEndpoint-9-new SrvNetDeregisterClient-3-old<--Match 87%-->SrvNetDeregisterClient-3-new SrvNetTdiCloseConnection-1-old<--Match 56%-->SrvNetTdiCloseConnection-1-new SrvNetAllocateEndpointCommon-4-old<--Match 86%-->SrvNetAllocateEndpointCommon-4-new SrvNetTdiReceiveHandler-8-old<--Match 90%-->SrvNetTdiReceiveHandler-8-new SrvNetTdiReceiveCompletion-3-old<--Match 95%-->SrvNetTdiReceiveCompletion-3-new SrvNetEndpointReopenTdiConnections-1-old<--Match 97%-->SrvNetEndpointReopenTdiConnections-1-new SrvNetCommonReceiveHandler-7-old<--Match 9%-->SrvNetCommonReceiveHandler-7-new subgraph srvnet-07.sys SrvNetNotifyClientsOfEndpoint-2-new SrvNetTdiAllocateEndpoint-9-new SrvNetDeregisterClient-3-new SrvNetTdiCloseConnection-1-new SrvNetAllocateEndpointCommon-4-new SrvNetTdiReceiveHandler-8-new SrvNetTdiReceiveCompletion-3-new SrvNetEndpointReopenTdiConnections-1-new SrvNetCommonReceiveHandler-7-new subgraph Added direction LR Feature_1180933432__private_IsEnabledDeviceUsageNoInline Feature_1180933432__private_IsEnabledFallback Feature_3107684665__private_IsEnabledDeviceUsageNoInline Feature_3107684665__private_IsEnabledFallback SrvNetUnpublishClientSlot end end subgraph srvnet-06.sys SrvNetNotifyClientsOfEndpoint-2-old SrvNetTdiAllocateEndpoint-9-old SrvNetDeregisterClient-3-old SrvNetTdiCloseConnection-1-old SrvNetAllocateEndpointCommon-4-old SrvNetTdiReceiveHandler-8-old SrvNetTdiReceiveCompletion-3-old SrvNetEndpointReopenTdiConnections-1-old SrvNetCommonReceiveHandler-7-old subgraph Deleted direction LR FUN_140004090 SrvNetHandleUnclaimedSmb1Connection FUN_14002c061 FUN_14002c4cb FUN_14005a4a8 FUN_14005a4be FUN_14005a4cd end end ``` ```mermaid pie showData title Function Matches - 99.5628% "unmatched_funcs_len" : 12 "matched_funcs_len" : 2733 ``` ```mermaid pie showData title Matched Function Similarity - 98.9389% "matched_funcs_with_code_changes_len" : 9 "matched_funcs_with_non_code_changes_len" : 20 "matched_funcs_no_changes_len" : 2704 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 srvnet-06.sys srvnet-07.sys ``` #### Verbose Args
``` --old ['srvnet-06.sys'] --new [['srvnet-07.sys']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/SRVNET.SYS/B71ED95764000/SRVNET.SYS -O srvnet.sys.x64.10.0.26100.8521 wget https://msdl.microsoft.com/download/symbols/SRVNET.SYS/6C64727F64000/SRVNET.SYS -O srvnet.sys.x64.10.0.26100.8875 ``` ## Binary Metadata Diff ```diff --- srvnet-06.sys Meta +++ srvnet-07.sys Meta @@ -1,44 +1,44 @@ -Program Name: srvnet-06.sys +Program Name: srvnet-07.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 413176 +# of Bytes: 413192 # of Memory Blocks: 15 -# of Instructions: 66258 -# of Defined Data: 8251 -# of Functions: 1374 -# of Symbols: 11002 +# of Instructions: 66473 +# of Defined Data: 8269 +# of Functions: 1371 +# of Symbols: 11031 # of Data Types: 553 # of Data Type Categories: 40 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Tue Aug 25 23:52:37 SGT 2026 +Date Created: Tue Aug 25 23:52:43 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/srvnet-06.sys -Executable MD5: 3b060b96cb7e756fff887e73a33b93db -Executable SHA256: 1f0c2fd6e4f7d624979e47d8a60d748da69cf1d2ba02d22bdd2386a7cf8657ad -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/srvnet-06.sys?MD5=3b060b96cb7e756fff887e73a33b93db +Executable Location: /C:/Users/Jacob/Downloads/pdbs/srvnet-07.sys +Executable MD5: 3258d389aea84f2502ce65ec6e03d8cc +Executable SHA256: d39e9a5f3e0e36943fe2612c76c8514fcd3339943e17768d87f1036e3dd573ed +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/srvnet-07.sys?MD5=3258d389aea84f2502ce65ec6e03d8cc PDB Age: 1 PDB File: srvnet.pdb -PDB GUID: 620767b3-ece7-8c17-e223-553b8ef7c9e3 +PDB GUID: d8621e59-d505-5cf4-081f-e0b6d82a8509 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Server Network driver -PE Property[FileVersion]: 10.0.26100.8521 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8875 (WinBuild.160101.0800) PE Property[InternalName]: SRVNET.SYS PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: SRVNET.SYS PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8521 +PE Property[ProductVersion]: 10.0.26100.8875 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra srvnet-06.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra srvnet-06.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra srvnet-06.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra srvnet-07.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra srvnet-07.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra srvnet-07.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|5| |deleted_funcs_len|7| |modified_funcs_len|29| |added_symbols_len|13| |deleted_symbols_len|7| |diff_time|17.04308319091797| |deleted_strings_len|1| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1299, 'ExternalsName': 319, 'ExactInstructionsFunctionHasher': 44, 'StructuralGraphHash': 29, 'SigCallingCalledHasher': 6, 'ExactBytesFunctionHasher': 2})| |items_to_process|61| |diff_types|Counter({'refcount': 23, 'calling': 18, 'address': 15, 'length': 10, 'called': 10, 'code': 9, 'sig': 2})| |unmatched_funcs_len|12| |total_funcs_len|2745| |matched_funcs_len|2733| |matched_funcs_with_code_changes_len|9| |matched_funcs_with_non_code_changes_len|20| |matched_funcs_no_changes_len|2704| |match_func_similarity_percent|98.9389%| |func_match_overall_percent|99.5628%| |first_matches|Counter({'SymbolsHash': 1299, 'ExactInstructionsFunctionHasher': 44, 'StructuralGraphHash': 29, 'SigCallingCalledHasher': 6, 'ExactBytesFunctionHasher': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 1299 "ExternalsName" : 319 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 44 "SigCallingCalledHasher" : 6 "StructuralGraphHash" : 29 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1299 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 44 "SigCallingCalledHasher" : 6 "StructuralGraphHash" : 29 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 5 "deleted_funcs_len" : 7 "modified_funcs_len" : 29 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 13 "deleted_symbols_len" : 7 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 1 "added_strings_len" : 0 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -1 +0,0 @@ -s_mbRpc ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_mbRpc_140031e01|1|SmbValidateQuicCertificateStoreName| #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | # Deleted ## FUN_140004090 ### Function Meta |Key|srvnet-06.sys| | :---: | :---: | |name|FUN_140004090| |fullname|FUN_140004090| |refcount|2| |length|375| |called|FUN_14002c061
FUN_14002c4cb
SrvNetHandleUnclaimedSmb1Connection
Template_qqbjqb_ex
WPP_SF_
WPP_SF_qd| |calling|| |paramcount|4| |address|140004090| |sig|ulonglong __fastcall FUN_140004090(uint param_1, ulonglong param_2, int * param_3, char * param_4)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_140004090 +++ FUN_140004090 @@ -1,325 +0,0 @@ - -/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Type propagation algorithm not settling */ - -ulonglong FUN_140004090(uint param_1,ulonglong param_2,int *param_3,char *param_4) - -{ - undefined8 *puVar1; - longlong *plVar2; - code *pcVar3; - undefined8 *puVar4; - undefined8 *puVar5; - longlong *plVar6; - byte bVar7; - undefined4 uVar8; - char cVar9; - ushort uVar10; - undefined2 uVar11; - uint uVar12; - int iVar13; - ulonglong uVar14; - char *pcVar15; - longlong lVar16; - ulonglong uVar17; - longlong unaff_RBX; - longlong unaff_RBP; - int *unaff_RSI; - ulonglong unaff_RDI; - int *unaff_R12; - int *unaff_R13; - char *unaff_R14; - longlong unaff_R15; - uint in_stack_00000050; - uint uStack0000000000000054; - undefined8 in_stack_00000058; - undefined2 uStack0000000000000060; - undefined4 in_stack_00000068; - undefined4 in_stack_00000070; - longlong lStack0000000000000078; - - do { - if ((int)param_2 < 0) break; - uStack0000000000000054 = param_1; - if ((param_1 < 0xf000) || - (uStack0000000000000054 = 0xf000, param_3 = unaff_R12, param_1 == 0xf000)) { - param_3 = unaff_R13; - } - param_4 = unaff_R14; - uVar12 = Template_qqbjqb_ex(PROV_SRV2_Context,param_2,(ulonglong)param_3,unaff_R14, - uStack0000000000000054,unaff_R15); - param_2 = (ulonglong)uVar12; - param_1 = in_stack_00000050 - uStack0000000000000054; - unaff_R15 = unaff_R15 + (ulonglong)uStack0000000000000054; - in_stack_00000050 = param_1; - } while (param_1 != 0); - uVar8 = in_stack_00000068; - if (*(int *)(unaff_RBX + 0x1e4) == 3) { - uVar12 = (**(code **)(*(longlong *)(unaff_RBX + 0x1b8) + 8)) - (*(undefined8 *)(unaff_RBX + 0x1c8),*(undefined8 *)(unaff_RBX + 0x1d0), - in_stack_00000068,unaff_RDI & 0xffffffff,in_stack_00000058); - uVar14 = (ulonglong)uVar12; - if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { - return uVar14; - } - if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0) { - if (1 < (byte)WPP_GLOBAL_Control[0x29]) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xb, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(unaff_RBX + 0x1d0)); - return uVar14; - } - return uVar14; - } - return uVar14; - } - if (*(int *)(unaff_RBX + 0x1e4) != 2) { - if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { - return 0xc000021b; - } - if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) == 0) { - return 0xc000021b; - } - if ((byte)WPP_GLOBAL_Control[0x29] < 2) { - return 0xc000021b; - } - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x13, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids); - return 0xc000021b; - } - lStack0000000000000078 = *(longlong *)(unaff_RBX + 0x1c0); - in_stack_00000050 = -0x3ffffde5; - KeAcquireSpinLockAtDpcLevel(SrvNetDeviceExtension + 0x68); - uVar14 = *(ulonglong *)(*(longlong *)(unaff_RBX + 0x1c0) + 0x120); - for (uVar10 = 0; uVar17 = uVar14, uVar10 < 5; uVar10 = uVar10 + 1) { - pcVar15 = *(char **)(SrvNetDeviceExtension + 0x1d0 + (ulonglong)uVar10 * 8); - _uStack0000000000000060 = pcVar15; - if ((pcVar15 != (char *)0x0) && (pcVar15[0xed] != '\0')) { - if (uVar14 != 0) { - if (3 < (byte)pcVar15[0xe1]) { - pcVar3 = (code *)swi(0x2c); - (*pcVar3)(); - uVar14 = FUN_14002c061(pcVar15,uVar14); - return uVar14; - } - if ((*(uint *)(uVar14 + 4) >> ((byte)pcVar15[0xe1] & 0x1f) & 1) == 0) goto LAB_140004026; - } - iVar13 = *(int *)(unaff_RBX + 0x1e0); - if (iVar13 == 0) { - bVar7 = pcVar15[0xe0] & 1; - } - else if (iVar13 == 1) { - bVar7 = pcVar15[0xe0] & 2; - } - else if (iVar13 == 2) { - bVar7 = pcVar15[0xe0] & 4; - } - else { - if (iVar13 != 4) goto LAB_140004026; - bVar7 = pcVar15[0xe0] & 8; - } - if ((bVar7 != 0) && - (*(char *)((ulonglong)*(uint *)(pcVar15 + 0xe8) + 0x150 + lStack0000000000000078) != '\0')) - { - param_4 = *(char **)(lStack0000000000000078 + 0x128 + - (ulonglong)*(uint *)(pcVar15 + 0xe8) * 8); - pcVar3 = *(code **)(pcVar15 + 0xb0); - uVar17 = unaff_RDI & 0xffffffff; - *(char **)(unaff_RBP + -0x80) = param_4; - param_3 = unaff_RSI; - in_stack_00000050 = (*pcVar3)(param_4); - if (-1 < (int)in_stack_00000050) { - *(char **)(unaff_RBX + 0x1b8) = _uStack0000000000000060 + 0xb8; - *(undefined8 *)(unaff_RBX + 0x1c8) = *(undefined8 *)(unaff_RBP + -0x80); - *(char *)(unaff_RBX + 0x1ec) = _uStack0000000000000060[0xe1]; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - param_3 = (int *)&WPP_1dc79513de593dda6c055ed826c3b955_Traceguids; - uVar17 = 0xc; - param_4 = _uStack0000000000000060; - WPP_SF_qdq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xc, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids,_uStack0000000000000060); - } - if ((SrvNetAuditSmb1Access != '\0') && (*(int *)(_uStack0000000000000060 + 0xe8) != 0)) { - if ((DAT_1400394e3 & 0x10) != 0) { - param_4 = (char *)(unaff_RBX + 4); - McTemplateK0s_EtwWriteTransfer - (_uStack0000000000000060,&SRVNET_EVENT_SMB1_ACCESS_AUDIT,param_3,param_4); - } - if ((5 < DAT_140038120) && - (cVar9 = _tlgKeywordOn(0x140038120,0x400000000000), cVar9 != '\0')) { - in_stack_00000068 = 1; - *(undefined4 **)(unaff_RBP + -0x20) = &stack0x00000068; - in_stack_00000070 = *(undefined4 *)(unaff_RBX + 0x1e0); - *(undefined4 **)(unaff_RBP + -0x10) = &stack0x00000070; - *(undefined8 *)(unaff_RBP + -0x18) = 4; - *(undefined8 *)(unaff_RBP + -8) = 4; - _tlgWriteTransfer_EtwWriteTransfer - (0x140038120,&DAT_140032ad1,param_3,param_4,4, - (undefined8 *)(unaff_RBP + -0x40)); - } - KeReleaseSpinLockFromDpcLevel(SrvNetDeviceExtension + 0x68); - goto LAB_14002c1dd; - } - break; - } - } - } -LAB_140004026: - } - KeReleaseSpinLockFromDpcLevel(SrvNetDeviceExtension + 0x68); - if ((int)in_stack_00000050 < 0) { - if ((((0x23 < (uint)unaff_RDI) && (*unaff_RSI == 0x424d53ff)) && ((char)unaff_RSI[1] == 'r')) && - ((undefined *) - ((ulonglong)*(ushort *)((longlong)unaff_RSI + 0x21) + 0x23 + (longlong)unaff_RSI) <= - (undefined *)((longlong)unaff_RSI + unaff_RDI))) { - SrvNetHandleUnclaimedSmb1Connection(unaff_RBX,uVar17,param_3,param_4); - } - *(undefined1 *)(unaff_RBX + 0x265) = 1; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0') - ) { - uVar14 = FUN_14002c4cb((longlong)WPP_GLOBAL_Control); - return uVar14; - } -LAB_14000407c: - SrvNetCloseConnectionWithLock(unaff_RBX); - return 0xc000021b; - } -LAB_14002c1dd: - lVar16 = *(longlong *)(unaff_RBX + 0x1c0); - *(undefined8 *)(unaff_RBP + -0x80) = 0; - *(undefined8 *)(unaff_RBP + -0x78) = 0; - _uStack0000000000000060 = (char *)0x0; - KeAcquireSpinLockAtDpcLevel(lVar16 + 0x18); - cVar9 = *(char *)(*(longlong *)(unaff_RBX + 0x1c0) + 0x91); - if (((uVar14 != 0) && ((*(uint *)(uVar14 + 4) >> (*(byte *)(unaff_RBX + 0x1ec) & 0x1f) & 1) == 0)) - && ((in_stack_00000050 = -0x3ffffde5, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control - && (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0 && - (1 < (byte)WPP_GLOBAL_Control[0x29])))))) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xd, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids,*(undefined8 *)(unaff_RBX + 0x1d0)); - } - plVar2 = (longlong *)(unaff_RBX + 0x200); - lVar16 = *plVar2; - if ((*(longlong **)(lVar16 + 8) == plVar2) && - (plVar6 = *(longlong **)(unaff_RBX + 0x208), (longlong *)*plVar6 == plVar2)) { - *plVar6 = lVar16; - *(longlong **)(lVar16 + 8) = plVar6; - lVar16 = *(longlong *)(unaff_RBX + 0x1c0); - plVar6 = *(longlong **)(lVar16 + 0xe8); - if (*plVar6 == lVar16 + 0xe0) { - *plVar2 = lVar16 + 0xe0; - *(longlong **)(unaff_RBX + 0x208) = plVar6; - *plVar6 = (longlong)plVar2; - *(longlong **)(lVar16 + 0xe8) = plVar2; - KeReleaseSpinLockFromDpcLevel(*(longlong *)(unaff_RBX + 0x1c0) + 0x18); - *(char **)(unaff_RBP + -0x78) = (char *)(unaff_RBX + 4); - uVar12 = RtlStringCchLengthA((char *)(unaff_RBX + 4),0x41,(longlong *)&stack0x00000060); - if ((int)uVar12 < 0) { - uVar11 = 0; - } - else { - uVar11 = uStack0000000000000060; - } - *(undefined2 *)(unaff_RBP + -0x80) = uVar11; - if (-1 < (int)in_stack_00000050) { - if (cVar9 == '\0') { - iVar13 = (*(code *)**(undefined8 **)(unaff_RBX + 0x1b8)) - (*(undefined8 *)(unaff_RBX + 0x1c8)); - } - else { - iVar13 = -0x3ffffdca; - } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xe, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(unaff_RBX + 0x1c8)); - } - if (-1 < iVar13) { - *(undefined4 *)(unaff_RBX + 0x1e4) = 3; - uVar12 = (**(code **)(*(longlong *)(unaff_RBX + 0x1b8) + 8)) - (*(undefined8 *)(unaff_RBX + 0x1c8),*(undefined8 *)(unaff_RBX + 0x1d0), - uVar8,unaff_RDI & 0xffffffff,in_stack_00000058); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xf, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(unaff_RBX + 0x1d0)); - } - if ((uVar12 + 0x80000000 & 0x80000000) != 0) { - return (ulonglong)uVar12; - } - if (uVar12 == 0xc0000011) { - return 0xc0000011; - } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x10, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(unaff_RBX + 0x1d0)); - } - if (uVar12 != 0xc0000016) { - return 0xc000021b; - } - return 0xc0000016; - } - } - *(undefined1 *)(unaff_RBX + 0x265) = 1; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (WPP_GLOBAL_Control[0x29] != '\0')) { - WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x11, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids,unaff_RBX); - } - goto LAB_14000407c; - } - } - lVar16 = 3; - pcVar3 = (code *)swi(0x29); - uVar14 = (*pcVar3)(); - if (((*(uint *)(lVar16 + 0x2c) & 0x400) != 0) && (3 < *(byte *)(lVar16 + 0x29))) { - uVar14 = WPP_SF_qDDDD(*(undefined8 *)(lVar16 + 0x18),0x19, - (ulonglong)*(byte *)(unaff_RBX + 0x264),unaff_RBX); - } - if (*(char *)(unaff_RBX + 0x266) == '\0') { - *(undefined2 *)(unaff_RBX + 0x265) = 0x101; - if (1 < *(int *)(unaff_RBX + 0x1e4) - 5U) { - *(undefined4 *)(unaff_RBX + 0x1e4) = 4; - } - KeAcquireSpinLockAtDpcLevel(*(longlong *)(unaff_RBX + 0x1c0) + 0x18); - puVar1 = (undefined8 *)(unaff_RBX + 0x210); - puVar4 = (undefined8 *)*puVar1; - if (puVar4 != puVar1) { - if (((undefined8 *)puVar4[1] != puVar1) || - (puVar5 = *(undefined8 **)(unaff_RBX + 0x218), (undefined8 *)*puVar5 != puVar1)) - goto LAB_140004411; - *puVar5 = puVar4; - puVar4[1] = puVar5; - } - KeReleaseSpinLockFromDpcLevel(*(longlong *)(unaff_RBX + 0x1c0) + 0x18); - KeAcquireSpinLockAtDpcLevel(&SrvNetConnectionClosingListLock); - if ((undefined8 *)*DAT_1400394d8 != &SrvNetConnectionClosingList) { -LAB_140004411: - pcVar3 = (code *)swi(0x29); - (*pcVar3)(3); - pcVar3 = (code *)swi(3); - uVar14 = (*pcVar3)(); - return uVar14; - } - *puVar1 = &SrvNetConnectionClosingList; - *(undefined8 **)(unaff_RBX + 0x218) = DAT_1400394d8; - *DAT_1400394d8 = puVar1; - DAT_1400394d8 = puVar1; - KeReleaseSpinLockFromDpcLevel(); - uVar14 = SrvNetTriggerScavenger('\0','\x01','\0'); - } - return uVar14; -} - ``` ## SrvNetHandleUnclaimedSmb1Connection ### Function Meta |Key|srvnet-06.sys| | :---: | :---: | |name|SrvNetHandleUnclaimedSmb1Connection| |fullname|SrvNetHandleUnclaimedSmb1Connection| |refcount|2| |length|342| |called|McTemplateK0_EtwWriteTransfer
McTemplateK0s_EtwWriteTransfer
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeQueryTimeIncrement
NTOSKRNL.EXE::KeReleaseSpinLock
__security_check_cookie
_tlgKeywordOn
_tlgWriteTransfer_EtwWriteTransfer| |calling|FUN_140004090| |paramcount|4| |address|14001b384| |sig|undefined __fastcall SrvNetHandleUnclaimedSmb1Connection(longlong param_1, undefined8 param_2, undefined8 param_3, char * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- SrvNetHandleUnclaimedSmb1Connection +++ SrvNetHandleUnclaimedSmb1Connection @@ -1,53 +0,0 @@ - -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ - -void SrvNetHandleUnclaimedSmb1Connection - (longlong param_1,undefined8 param_2,undefined8 param_3,char *param_4) - -{ - longlong lVar1; - undefined1 uVar2; - char cVar3; - uint uVar4; - longlong lVar5; - undefined1 auStackY_68 [32]; - undefined8 local_38 [4]; - ulonglong local_18; - - local_18 = __security_cookie ^ (ulonglong)auStackY_68; - if ((SrvNetAuditSmb1Access != '\0') && ((DAT_1400394e3 & 8) != 0)) { - param_4 = (char *)(param_1 + 4); - McTemplateK0s_EtwWriteTransfer(param_1,&AUDIT_SMB1_ACCESS,param_3,param_4); - } - uVar2 = KeAcquireSpinLockRaiseToDpc(SrvNetDeviceExtension + 0x68); - lVar1 = _DAT_fffff78000000320; - if (SrvNetSmb1DisabledOrUninstalledEventLastWrittenTickCount == 0) { -LAB_14001b441: - lVar5 = SrvNetDeviceExtension + 0x68; - SrvNetSmb1DisabledOrUninstalledEventLastWrittenTickCount = lVar1; - KeReleaseSpinLock(lVar5,uVar2); - if ((DAT_1400394e1 & 0x10) != 0) { - param_3 = 0; - McTemplateK0_EtwWriteTransfer(lVar5,&SRVNET_EVENT_SMB1_DISABLED_OR_NOT_INSTALLED,0); - } - if (5 < DAT_140038120) { - cVar3 = _tlgKeywordOn(0x140038120,0x400000000000); - if (cVar3 != '\0') { - _tlgWriteTransfer_EtwWriteTransfer(0x140038120,&DAT_140032b19,param_3,param_4,2,local_38); - } - } - } - else { - if (SrvNetSmb1DisabledOrUninstalledEventLastWrittenTickCount <= _DAT_fffff78000000320) { - uVar4 = KeQueryTimeIncrement(); - if (863999999999 < - (longlong) - ((lVar1 - SrvNetSmb1DisabledOrUninstalledEventLastWrittenTickCount) * (ulonglong)uVar4)) - goto LAB_14001b441; - } - KeReleaseSpinLock(SrvNetDeviceExtension + 0x68,uVar2); - } - return; -} - ``` ## FUN_14002c061 ### Function Meta |Key|srvnet-06.sys| | :---: | :---: | |name|FUN_14002c061| |fullname|FUN_14002c061| |refcount|2| |length|1230| |called|McTemplateK0s_EtwWriteTransfer
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
RtlStringCchLengthA
WPP_SF_qDDDD
WPP_SF_qd
WPP_SF_qdq
_guard_dispatch_icall
_tlgKeywordOn
_tlgWriteTransfer_EtwWriteTransfer| |calling|FUN_140004090| |paramcount|2| |address|14002c061| |sig|ulonglong __fastcall FUN_14002c061(undefined8 param_1, longlong param_2)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_14002c061 +++ FUN_14002c061 @@ -1,293 +0,0 @@ - -/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -ulonglong FUN_14002c061(undefined8 param_1,longlong param_2) - -{ - undefined8 *puVar1; - longlong *plVar2; - code *pcVar3; - undefined8 *puVar4; - undefined8 *puVar5; - longlong *plVar6; - byte bVar7; - char cVar8; - undefined2 uVar9; - uint in_EAX; - uint uVar10; - int iVar11; - ulonglong uVar12; - char *pcVar13; - longlong lVar14; - longlong unaff_RBX; - longlong unaff_RBP; - int *unaff_RSI; - ulonglong unaff_RDI; - int *in_R8; - char *in_R9; - undefined4 unaff_R15D; - int in_stack_00000050; - ushort in_stack_00000054; - ulonglong in_stack_00000058; - undefined2 uStack0000000000000060; - undefined4 in_stack_00000068; - undefined4 in_stack_00000070; - longlong in_stack_00000078; - - do { - uVar12 = param_2; - if ((*(uint *)(param_2 + 4) >> (in_EAX & 0x1f) & 1) == 0) goto LAB_140003f8c; - do { - iVar11 = *(int *)(unaff_RBX + 0x1e0); - uVar12 = in_stack_00000058; - if (iVar11 == 0) { - bVar7 = _uStack0000000000000060[0xe0] & 1; -joined_r0x00014002c092: - if (bVar7 != 0) { -LAB_140003fe0: - if (*(char *)((ulonglong)*(uint *)(_uStack0000000000000060 + 0xe8) + 0x150 + - in_stack_00000078) != '\0') { - in_R9 = *(char **)(in_stack_00000078 + 0x128 + - (ulonglong)*(uint *)(_uStack0000000000000060 + 0xe8) * 8); - pcVar3 = *(code **)(_uStack0000000000000060 + 0xb0); - param_2 = unaff_RDI & 0xffffffff; - *(char **)(unaff_RBP + -0x80) = in_R9; - in_R8 = unaff_RSI; - in_stack_00000050 = (*pcVar3)(in_R9); - if (-1 < in_stack_00000050) { - *(char **)(unaff_RBX + 0x1b8) = _uStack0000000000000060 + 0xb8; - *(undefined8 *)(unaff_RBX + 0x1c8) = *(undefined8 *)(unaff_RBP + -0x80); - *(char *)(unaff_RBX + 0x1ec) = _uStack0000000000000060[0xe1]; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - in_R8 = (int *)&WPP_1dc79513de593dda6c055ed826c3b955_Traceguids; - param_2 = 0xc; - in_R9 = _uStack0000000000000060; - WPP_SF_qdq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xc, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids,_uStack0000000000000060) - ; - } - if ((SrvNetAuditSmb1Access == '\0') || (*(int *)(_uStack0000000000000060 + 0xe8) == 0) - ) { -LAB_140004033: - KeReleaseSpinLockFromDpcLevel(SrvNetDeviceExtension + 0x68); - if (in_stack_00000050 < 0) { - if ((((0x23 < (uint)unaff_RDI) && (*unaff_RSI == 0x424d53ff)) && - ((char)unaff_RSI[1] == 'r')) && - ((undefined *) - ((ulonglong)*(ushort *)((longlong)unaff_RSI + 0x21) + 0x23 + - (longlong)unaff_RSI) <= (undefined *)((longlong)unaff_RSI + unaff_RDI))) { - SrvNetHandleUnclaimedSmb1Connection(unaff_RBX,param_2,in_R8,in_R9); - } - *(undefined1 *)(unaff_RBX + 0x265) = 1; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (WPP_GLOBAL_Control[0x29] != '\0')) { - uVar12 = FUN_14002c4cb((longlong)WPP_GLOBAL_Control); - return uVar12; - } - goto LAB_14000407c; - } - } - else { - if ((DAT_1400394e3 & 0x10) != 0) { - in_R9 = (char *)(unaff_RBX + 4); - McTemplateK0s_EtwWriteTransfer - (_uStack0000000000000060,&SRVNET_EVENT_SMB1_ACCESS_AUDIT,in_R8,in_R9); - } - if ((5 < DAT_140038120) && - (cVar8 = _tlgKeywordOn(0x140038120,0x400000000000), cVar8 != '\0')) { - in_stack_00000068 = 1; - *(undefined4 **)(unaff_RBP + -0x20) = &stack0x00000068; - in_stack_00000070 = *(undefined4 *)(unaff_RBX + 0x1e0); - *(undefined4 **)(unaff_RBP + -0x10) = &stack0x00000070; - *(undefined8 *)(unaff_RBP + -0x18) = 4; - *(undefined8 *)(unaff_RBP + -8) = 4; - _tlgWriteTransfer_EtwWriteTransfer - (0x140038120,&DAT_140032ad1,in_R8,in_R9,4, - (undefined8 *)(unaff_RBP + -0x40)); - } - KeReleaseSpinLockFromDpcLevel(SrvNetDeviceExtension + 0x68); - } - lVar14 = *(longlong *)(unaff_RBX + 0x1c0); - *(undefined8 *)(unaff_RBP + -0x80) = 0; - *(undefined8 *)(unaff_RBP + -0x78) = 0; - _uStack0000000000000060 = (char *)0x0; - KeAcquireSpinLockAtDpcLevel(lVar14 + 0x18); - cVar8 = *(char *)(*(longlong *)(unaff_RBX + 0x1c0) + 0x91); - if ((((in_stack_00000058 != 0) && - ((*(uint *)(in_stack_00000058 + 4) >> (*(byte *)(unaff_RBX + 0x1ec) & 0x1f) & 1) - == 0)) && - (in_stack_00000050 = -0x3ffffde5, - (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && - (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0 && - (1 < (byte)WPP_GLOBAL_Control[0x29])))) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xd, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(unaff_RBX + 0x1d0)); - } - plVar2 = (longlong *)(unaff_RBX + 0x200); - lVar14 = *plVar2; - if ((*(longlong **)(lVar14 + 8) == plVar2) && - (plVar6 = *(longlong **)(unaff_RBX + 0x208), (longlong *)*plVar6 == plVar2)) { - *plVar6 = lVar14; - *(longlong **)(lVar14 + 8) = plVar6; - lVar14 = *(longlong *)(unaff_RBX + 0x1c0); - plVar6 = *(longlong **)(lVar14 + 0xe8); - if (*plVar6 == lVar14 + 0xe0) { - *plVar2 = lVar14 + 0xe0; - *(longlong **)(unaff_RBX + 0x208) = plVar6; - *plVar6 = (longlong)plVar2; - *(longlong **)(lVar14 + 0xe8) = plVar2; - KeReleaseSpinLockFromDpcLevel(*(longlong *)(unaff_RBX + 0x1c0) + 0x18); - *(char **)(unaff_RBP + -0x78) = (char *)(unaff_RBX + 4); - uVar10 = RtlStringCchLengthA((char *)(unaff_RBX + 4),0x41, - (longlong *)&stack0x00000060); - if ((int)uVar10 < 0) { - uVar9 = 0; - } - else { - uVar9 = uStack0000000000000060; - } - *(undefined2 *)(unaff_RBP + -0x80) = uVar9; - if (-1 < in_stack_00000050) { - if (cVar8 == '\0') { - iVar11 = (*(code *)**(undefined8 **)(unaff_RBX + 0x1b8)) - (*(undefined8 *)(unaff_RBX + 0x1c8)); - } - else { - iVar11 = -0x3ffffdca; - } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xe, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(unaff_RBX + 0x1c8)); - } - if (-1 < iVar11) { - *(undefined4 *)(unaff_RBX + 0x1e4) = 3; - uVar10 = (**(code **)(*(longlong *)(unaff_RBX + 0x1b8) + 8)) - (*(undefined8 *)(unaff_RBX + 0x1c8), - *(undefined8 *)(unaff_RBX + 0x1d0),unaff_R15D, - unaff_RDI & 0xffffffff); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xf, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(unaff_RBX + 0x1d0)); - } - if ((uVar10 + 0x80000000 & 0x80000000) != 0) { - return (ulonglong)uVar10; - } - if (uVar10 == 0xc0000011) { - return 0xc0000011; - } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x10, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(unaff_RBX + 0x1d0)); - } - if (uVar10 != 0xc0000016) { - return 0xc000021b; - } - return 0xc0000016; - } - } - *(undefined1 *)(unaff_RBX + 0x265) = 1; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (WPP_GLOBAL_Control[0x29] != '\0')) { - WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x11, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids,unaff_RBX); - } -LAB_14000407c: - SrvNetCloseConnectionWithLock(unaff_RBX); - return 0xc000021b; - } - } - lVar14 = 3; - pcVar3 = (code *)swi(0x29); - uVar12 = (*pcVar3)(); - if (((*(uint *)(lVar14 + 0x2c) & 0x400) != 0) && (3 < *(byte *)(lVar14 + 0x29))) { - uVar12 = WPP_SF_qDDDD(*(undefined8 *)(lVar14 + 0x18),0x19, - (ulonglong)*(byte *)(unaff_RBX + 0x264),unaff_RBX); - } - if (*(char *)(unaff_RBX + 0x266) == '\0') { - *(undefined2 *)(unaff_RBX + 0x265) = 0x101; - if (1 < *(int *)(unaff_RBX + 0x1e4) - 5U) { - *(undefined4 *)(unaff_RBX + 0x1e4) = 4; - } - KeAcquireSpinLockAtDpcLevel(*(longlong *)(unaff_RBX + 0x1c0) + 0x18); - puVar1 = (undefined8 *)(unaff_RBX + 0x210); - puVar4 = (undefined8 *)*puVar1; - if (puVar4 != puVar1) { - if (((undefined8 *)puVar4[1] != puVar1) || - (puVar5 = *(undefined8 **)(unaff_RBX + 0x218), (undefined8 *)*puVar5 != puVar1) - ) goto LAB_140004411; - *puVar5 = puVar4; - puVar4[1] = puVar5; - } - KeReleaseSpinLockFromDpcLevel(*(longlong *)(unaff_RBX + 0x1c0) + 0x18); - KeAcquireSpinLockAtDpcLevel(&SrvNetConnectionClosingListLock); - if ((undefined8 *)*DAT_1400394d8 != &SrvNetConnectionClosingList) { -LAB_140004411: - pcVar3 = (code *)swi(0x29); - (*pcVar3)(3); - pcVar3 = (code *)swi(3); - uVar12 = (*pcVar3)(); - return uVar12; - } - *puVar1 = &SrvNetConnectionClosingList; - *(undefined8 **)(unaff_RBX + 0x218) = DAT_1400394d8; - *DAT_1400394d8 = puVar1; - DAT_1400394d8 = puVar1; - KeReleaseSpinLockFromDpcLevel(); - uVar12 = SrvNetTriggerScavenger('\0','\x01','\0'); - } - return uVar12; - } - } - } - } - else { - if (iVar11 == 1) { - bVar7 = _uStack0000000000000060[0xe0] & 2; - goto joined_r0x00014002c092; - } - if (iVar11 == 2) { - bVar7 = _uStack0000000000000060[0xe0] & 4; -joined_r0x00014002c080: - if (bVar7 == 0) goto LAB_140003f8c; - goto LAB_140003fe0; - } - if (iVar11 == 4) { - bVar7 = _uStack0000000000000060[0xe0] & 8; - goto joined_r0x00014002c080; - } - } -LAB_140003f8c: - do { - param_2 = uVar12; - in_stack_00000054 = in_stack_00000054 + 1; - if (4 < in_stack_00000054) goto LAB_140004033; - pcVar13 = *(char **)(SrvNetDeviceExtension + 0x1d0 + (ulonglong)in_stack_00000054 * 8); - uVar12 = param_2; - _uStack0000000000000060 = pcVar13; - } while ((pcVar13 == (char *)0x0) || (pcVar13[0xed] == '\0')); - } while (param_2 == 0); - in_EAX = (uint)(byte)pcVar13[0xe1]; - if (3 < (byte)pcVar13[0xe1]) { - pcVar3 = (code *)swi(0x2c); - (*pcVar3)(); - uVar12 = FUN_14002c061(pcVar13,param_2); - return uVar12; - } - } while( true ); -} - ``` ## FUN_14002c4cb ### Function Meta |Key|srvnet-06.sys| | :---: | :---: | |name|FUN_14002c4cb| |fullname|FUN_14002c4cb| |refcount|1| |length|30| |called|WPP_SF_q| |calling|FUN_140004090| |paramcount|1| |address|14002c4cb| |sig|undefined8 __fastcall FUN_14002c4cb(longlong param_1)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_14002c4cb +++ FUN_14002c4cb @@ -1,14 +0,0 @@ - -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -undefined8 FUN_14002c4cb(longlong param_1) - -{ - longlong unaff_RBX; - - WPP_SF_q(*(undefined8 *)(param_1 + 0x18),0x12,&WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - unaff_RBX); - SrvNetCloseConnectionWithLock(unaff_RBX); - return 0xc000021b; -} - ``` ## FUN_14005a4a8 ### Function Meta |Key|srvnet-06.sys| | :---: | :---: | |name|FUN_14005a4a8| |fullname|FUN_14005a4a8| |refcount|4| |length|12| |called|| |calling|SrvNetTdiAllocateEndpoint| |paramcount|0| |address|14005a4a8| |sig|ulonglong __fastcall FUN_14005a4a8(void)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_14005a4a8 +++ FUN_14005a4a8 @@ -1,219 +0,0 @@ - -/* PDB: Separated code (from the compiler): 14005a4a8 - 14005a4fe for parent address: 140054578 */ - -ulonglong FUN_14005a4a8(void) - -{ - longlong *plVar1; - ushort uVar2; - int *piVar3; - longlong *plVar4; - code *pcVar5; - longlong lVar6; - undefined4 uVar7; - uint uVar8; - longlong *plVar9; - longlong lVar10; - undefined8 uVar11; - undefined *puVar12; - uint unaff_ESI; - ushort *unaff_RDI; - longlong *unaff_R12; - ushort *unaff_R14; - ushort *unaff_R15; - undefined1 auStackX_8 [32]; - undefined8 in_stack_00000050; - longlong in_stack_000000b8; - undefined8 *in_stack_000000c0; - - if ((SrvNetEnabledTransports & 1) == 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1c, - &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,SrvNetEnabledTransports); - FUN_14005a4b4(); - return (ulonglong)unaff_RDI; - } - goto LAB_140054845; - } - plVar9 = (longlong *) - SrvNetAllocatePoolWithTag - (0x40,(ulonglong)*unaff_R15 + 0x160 + - (ulonglong)*unaff_R14 + (ulonglong)*unaff_RDI); - if (plVar9 == (longlong *)0x0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0') - ) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x21, - &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids); - } -LAB_14005a4f5: - uVar8 = 0xc000009a; - } - else { - ExInitializeRundownProtection(plVar9 + 8); - KeInitializeSpinLock(plVar9 + 3); - plVar1 = plVar9 + 0x18; - plVar9[0x19] = (longlong)plVar1; - plVar4 = plVar9 + 0x1e; - *plVar1 = (longlong)plVar1; - plVar1 = plVar9 + 0x1a; - plVar9[0x1b] = (longlong)plVar1; - *plVar1 = (longlong)plVar1; - plVar1 = plVar9 + 0x1c; - plVar9[0x1d] = (longlong)plVar1; - *plVar1 = (longlong)plVar1; - plVar9[0x1f] = (longlong)plVar4; - *plVar4 = (longlong)plVar4; - plVar1 = plVar9 + 0x20; - plVar9[0x21] = (longlong)plVar1; - *plVar1 = (longlong)plVar1; - plVar1 = plVar9 + 0x22; - plVar9[0x23] = (longlong)plVar1; - *plVar1 = (longlong)plVar1; - *(undefined2 *)((longlong)plVar9 + 0x91) = 0; - *(undefined4 *)((longlong)plVar9 + 0x7c) = 0; - *(undefined4 *)(plVar9 + 2) = 1; - plVar9[0x24] = in_stack_000000b8; - ExInitializeRundownProtection(plVar9 + 7); - *(undefined4 *)((longlong)plVar9 + 0xac) = SrvNetMaxConnections; - *(undefined4 *)(plVar9 + 0x14) = SrvNetMinFreeConnections; - *(undefined4 *)((longlong)plVar9 + 0xa4) = SrvNetMaxFreeConnections; - *(uint *)((longlong)plVar9 + 0x9c) = unaff_ESI | 0x1000; - uVar7 = SrvNetMaxUnAuthenticatedConnections; - *(undefined2 *)(plVar9 + 0xf) = 0; - *(undefined4 *)((longlong)plVar9 + 0xb4) = uVar7; - lVar10 = unaff_R12[1]; - plVar9[0x10] = *unaff_R12; - plVar9[0x11] = lVar10; - *(undefined1 *)(plVar9 + 0x12) = 0; - uVar2 = *unaff_RDI; - *(ushort *)((longlong)plVar9 + 0x4a) = uVar2; - *(ushort *)(plVar9 + 9) = uVar2; - plVar9[10] = (longlong)(plVar9 + 0x2c); - memmove(plVar9 + 0x2c,*(void **)(unaff_RDI + 4),(ulonglong)*unaff_RDI); - if (*(int *)((longlong)plVar9 + 0xb4) == 0) { - uVar11 = SrvNetCalculateMaxUnAuthenticatedConnections((longlong)plVar9); - if ((int)uVar11 < 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (WPP_GLOBAL_Control[0x29] != '\0')) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1d, - &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,(int)uVar11); - FUN_14005a4be(); - return (ulonglong)unaff_RDI; - } - *(undefined4 *)((longlong)plVar9 + 0xb4) = 10; - } - } - uVar2 = *unaff_R15; - plVar9[0xc] = (longlong)((ulonglong)*(ushort *)(plVar9 + 9) + plVar9[10]); - *(ushort *)(plVar9 + 0xb) = uVar2; - memmove((void *)((ulonglong)*(ushort *)(plVar9 + 9) + plVar9[10]),*(void **)(unaff_R15 + 4), - (ulonglong)*unaff_R15); - uVar2 = *unaff_R14; - plVar9[0xe] = (longlong)((ulonglong)*(ushort *)(plVar9 + 0xb) + plVar9[0xc]); - *(ushort *)(plVar9 + 0xd) = uVar2; - memmove((void *)((ulonglong)*(ushort *)(plVar9 + 0xb) + plVar9[0xc]),*(void **)(unaff_R14 + 4), - (ulonglong)*unaff_R14); - plVar1 = plVar9 + 5; - uVar8 = SrvNetOpenEndpointHandle(unaff_RDI,unaff_R12,&stack0x00000050,plVar1); - if ((int)uVar8 < 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (WPP_GLOBAL_Control[0x29] != '\0')) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x20, - &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,uVar8); - } - } - else { - lVar10 = SrvNetAllocateReferencedHandle(in_stack_00000050); - if (lVar10 == 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (WPP_GLOBAL_Control[0x29] != '\0')) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1e, - &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,uVar8); - FUN_14005a4cd(); - return (ulonglong)uVar8; - } - ZwClose(in_stack_00000050); - ObfDereferenceObject(*plVar1); - SrvNetFreePool((longlong)plVar9); - goto LAB_14005a4f5; - } - plVar9[4] = lVar10; - lVar10 = IoGetRelatedDeviceObject(*plVar1); - uVar8 = 0; - plVar9[6] = lVar10; - if ((int)plVar9[0x14] != 0) { - do { - SrvNetAllocateConnection((longlong)plVar9); - uVar8 = uVar8 + 1; - } while (uVar8 < *(uint *)(plVar9 + 0x14)); - } - uVar8 = SrvNetBindTdiHandlers((longlong)plVar9); - if ((int)uVar8 < 0) { - puVar12 = WPP_GLOBAL_Control; - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) goto LAB_140054a51; - } - else { - if (in_stack_000000c0 != (undefined8 *)0x0) { - SrvNetReferenceEndpoint((longlong)plVar9); - *in_stack_000000c0 = plVar9; - } - if (in_stack_000000b8 != 0) { - SrvNetReferenceListenerRuleEntry(in_stack_000000b8); - } - KeEnterCriticalRegion(); - ExAcquireResourceExclusiveLite(SrvNetDeviceExtension + 0x120,1); - lVar6 = SrvNetDeviceExtension; - lVar10 = SrvNetDeviceExtension + 0x188; - plVar4 = *(longlong **)(SrvNetDeviceExtension + 400); - if (*plVar4 == lVar10) { - plVar9[1] = (longlong)plVar4; - *plVar9 = lVar10; - *plVar4 = (longlong)plVar9; - *(longlong **)(lVar6 + 400) = plVar9; - ExReleaseResourceLite(lVar6 + 0x120); - KeLeaveCriticalRegion(); - SrvNetReferenceDriver(); - SrvNetNotifyClientsOfEndpoint((longlong)plVar9,'\x01'); - uVar8 = 0; - goto LAB_14005482c; - } - puVar12 = (undefined *)0x3; - pcVar5 = (code *)swi(0x29); - (*pcVar5)(); - register0x00000020 = (BADSPACEBASE *)auStackX_8; -LAB_140054a51: - if (((*(uint *)(puVar12 + 0x2c) & 0x100) != 0) && (puVar12[0x29] != '\0')) { - uVar11 = *(undefined8 *)(puVar12 + 0x18); - *(undefined8 *)((longlong)register0x00000020 + -8) = 0x140054a7c; - WPP_SF_D(uVar11,0x1f,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,uVar8); - } - } - piVar3 = (int *)plVar9[4]; - *(undefined8 *)((longlong)register0x00000020 + -8) = 0x140054810; - SrvNetDereferenceHandle(piVar3); - lVar10 = *plVar1; - plVar9[4] = 0; - *(undefined8 *)((longlong)register0x00000020 + -8) = 0x14005481f; - ObfDereferenceObject(lVar10); - } - *(undefined8 *)((longlong)register0x00000020 + -8) = 0x14005482c; - SrvNetFreePool((longlong)plVar9); - } -LAB_14005482c: - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) - { - uVar11 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(undefined8 *)((longlong)register0x00000020 + -8) = 0x140054b3f; - WPP_SF_D(uVar11,0x22,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,uVar8); - } -LAB_140054845: - return *(ulonglong *)((longlong)register0x00000020 + 0x98); -} - ``` ## FUN_14005a4be ### Function Meta |Key|srvnet-06.sys| | :---: | :---: | |name|FUN_14005a4be| |fullname|FUN_14005a4be| |refcount|4| |length|15| |called|| |calling|SrvNetTdiAllocateEndpoint| |paramcount|0| |address|14005a4be| |sig|ulonglong __fastcall FUN_14005a4be(void)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_14005a4be +++ FUN_14005a4be @@ -1,134 +0,0 @@ - -ulonglong FUN_14005a4be(void) - -{ - longlong *plVar1; - ushort uVar2; - int *piVar3; - longlong *plVar4; - undefined8 uVar5; - code *pcVar6; - longlong lVar7; - uint uVar8; - longlong lVar9; - ulonglong uVar10; - undefined *puVar11; - longlong *unaff_RBX; - longlong unaff_RBP; - undefined8 unaff_RSI; - undefined8 unaff_RDI; - undefined8 unaff_R12; - ushort *unaff_R14; - ushort *unaff_R15; - undefined1 auStackX_8 [32]; - undefined8 in_stack_00000050; - undefined8 *in_stack_000000c0; - - *(undefined4 *)((longlong)unaff_RBX + 0xb4) = 10; - uVar2 = *unaff_R15; - unaff_RBX[0xc] = (longlong)((ulonglong)*(ushort *)(unaff_RBX + 9) + unaff_RBX[10]); - *(ushort *)(unaff_RBX + 0xb) = uVar2; - memmove((void *)((ulonglong)*(ushort *)(unaff_RBX + 9) + unaff_RBX[10]),*(void **)(unaff_R15 + 4), - (ulonglong)*unaff_R15); - uVar2 = *unaff_R14; - unaff_RBX[0xe] = (longlong)((ulonglong)*(ushort *)(unaff_RBX + 0xb) + unaff_RBX[0xc]); - *(ushort *)(unaff_RBX + 0xd) = uVar2; - memmove((void *)((ulonglong)*(ushort *)(unaff_RBX + 0xb) + unaff_RBX[0xc]), - *(void **)(unaff_R14 + 4),(ulonglong)*unaff_R14); - plVar1 = unaff_RBX + 5; - uVar8 = SrvNetOpenEndpointHandle(unaff_RDI,unaff_R12,&stack0x00000050,plVar1); - if ((int)uVar8 < 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0') - ) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x20,unaff_RSI,uVar8); - } - } - else { - lVar9 = SrvNetAllocateReferencedHandle(in_stack_00000050); - if (lVar9 == 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (WPP_GLOBAL_Control[0x29] != '\0')) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1e,unaff_RSI,uVar8); - uVar10 = FUN_14005a4cd(); - return uVar10; - } - ZwClose(in_stack_00000050); - ObfDereferenceObject(*plVar1); - SrvNetFreePool((longlong)unaff_RBX); - uVar8 = 0xc000009a; - goto LAB_14005482c; - } - unaff_RBX[4] = lVar9; - lVar9 = IoGetRelatedDeviceObject(*plVar1); - uVar8 = 0; - unaff_RBX[6] = lVar9; - if ((int)unaff_RBX[0x14] != 0) { - do { - SrvNetAllocateConnection((longlong)unaff_RBX); - uVar8 = uVar8 + 1; - } while (uVar8 < *(uint *)(unaff_RBX + 0x14)); - } - uVar8 = SrvNetBindTdiHandlers((longlong)unaff_RBX); - if ((int)uVar8 < 0) { - puVar11 = WPP_GLOBAL_Control; - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) goto LAB_140054a51; - } - else { - if (in_stack_000000c0 != (undefined8 *)0x0) { - SrvNetReferenceEndpoint((longlong)unaff_RBX); - *in_stack_000000c0 = unaff_RBX; - } - if (unaff_RBP != 0) { - SrvNetReferenceListenerRuleEntry(unaff_RBP); - } - KeEnterCriticalRegion(); - ExAcquireResourceExclusiveLite(SrvNetDeviceExtension + 0x120,1); - lVar7 = SrvNetDeviceExtension; - lVar9 = SrvNetDeviceExtension + 0x188; - plVar4 = *(longlong **)(SrvNetDeviceExtension + 400); - if (*plVar4 == lVar9) { - unaff_RBX[1] = (longlong)plVar4; - *unaff_RBX = lVar9; - *plVar4 = (longlong)unaff_RBX; - *(longlong **)(lVar7 + 400) = unaff_RBX; - ExReleaseResourceLite(lVar7 + 0x120); - KeLeaveCriticalRegion(); - SrvNetReferenceDriver(); - SrvNetNotifyClientsOfEndpoint((longlong)unaff_RBX,'\x01'); - uVar8 = 0; - goto LAB_14005482c; - } - puVar11 = (undefined *)0x3; - pcVar6 = (code *)swi(0x29); - (*pcVar6)(); - register0x00000020 = (BADSPACEBASE *)auStackX_8; -LAB_140054a51: - if (((*(uint *)(puVar11 + 0x2c) & 0x100) != 0) && (puVar11[0x29] != '\0')) { - uVar5 = *(undefined8 *)(puVar11 + 0x18); - *(undefined8 *)((longlong)register0x00000020 + -8) = 0x140054a7c; - WPP_SF_D(uVar5,0x1f,unaff_RSI,uVar8); - } - } - piVar3 = (int *)unaff_RBX[4]; - *(undefined8 *)((longlong)register0x00000020 + -8) = 0x140054810; - SrvNetDereferenceHandle(piVar3); - lVar9 = *plVar1; - unaff_RBX[4] = 0; - *(undefined8 *)((longlong)register0x00000020 + -8) = 0x14005481f; - ObfDereferenceObject(lVar9); - } - *(undefined8 *)((longlong)register0x00000020 + -8) = 0x14005482c; - SrvNetFreePool((longlong)unaff_RBX); -LAB_14005482c: - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) - { - uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(undefined8 *)((longlong)register0x00000020 + -8) = 0x140054b3f; - WPP_SF_D(uVar5,0x22,unaff_RSI,uVar8); - } - return (ulonglong)uVar8; -} - ``` ## FUN_14005a4cd ### Function Meta |Key|srvnet-06.sys| | :---: | :---: | |name|FUN_14005a4cd| |fullname|FUN_14005a4cd| |refcount|4| |length|50| |called|NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ZwClose
SrvNetFreePool| |calling|SrvNetTdiAllocateEndpoint| |paramcount|0| |address|14005a4cd| |sig|undefined8 __fastcall FUN_14005a4cd(void)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_14005a4cd +++ FUN_14005a4cd @@ -1,20 +0,0 @@ - -undefined8 FUN_14005a4cd(void) - -{ - longlong unaff_RBX; - undefined8 unaff_RSI; - undefined8 *unaff_R14; - undefined8 in_stack_00000050; - - ZwClose(in_stack_00000050); - ObfDereferenceObject(*unaff_R14); - SrvNetFreePool(unaff_RBX); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) - { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x22,unaff_RSI,0xc000009a); - } - return 0xc000009a; -} - ``` # Added ## Feature_1180933432__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|srvnet-07.sys| | :---: | :---: | |name|Feature_1180933432__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1180933432__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_1180933432__private_IsEnabledFallback| |calling|SrvNetEndpointReopenTdiConnections| |paramcount|0| |address|140016124| |sig|ulonglong __fastcall Feature_1180933432__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1180933432__private_IsEnabledDeviceUsageNoInline +++ Feature_1180933432__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_1180933432__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_1180933432__private_featureState; + if ((Feature_1180933432__private_featureState & 0x10) == 0) { + uVar1 = Feature_1180933432__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_1180933432__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_1180933432__private_IsEnabledFallback ### Function Meta |Key|srvnet-07.sys| | :---: | :---: | |name|Feature_1180933432__private_IsEnabledFallback| |fullname|Feature_1180933432__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1180933432__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|14001615c| |sig|undefined __fastcall Feature_1180933432__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1180933432__private_IsEnabledFallback +++ Feature_1180933432__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1180933432__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1180933432__private_descriptor); + return; +} + ``` ## Feature_3107684665__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|srvnet-07.sys| | :---: | :---: | |name|Feature_3107684665__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3107684665__private_IsEnabledDeviceUsageNoInline| |refcount|11| |length|49| |called|Feature_3107684665__private_IsEnabledFallback| |calling|SrvNetAllocateEndpointCommon
SrvNetCommonReceiveHandler
SrvNetDeregisterClient
SrvNetNotifyClientsOfEndpoint
SrvNetTdiAllocateEndpoint
SrvNetTdiCloseConnection
SrvNetTdiReceiveCompletion
SrvNetTdiReceiveHandler| |paramcount|0| |address|140016178| |sig|ulonglong __fastcall Feature_3107684665__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3107684665__private_IsEnabledDeviceUsageNoInline +++ Feature_3107684665__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3107684665__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3107684665__private_featureState; + if ((Feature_3107684665__private_featureState & 0x10) == 0) { + uVar1 = Feature_3107684665__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3107684665__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3107684665__private_IsEnabledFallback ### Function Meta |Key|srvnet-07.sys| | :---: | :---: | |name|Feature_3107684665__private_IsEnabledFallback| |fullname|Feature_3107684665__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3107684665__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400161b0| |sig|undefined __fastcall Feature_3107684665__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3107684665__private_IsEnabledFallback +++ Feature_3107684665__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3107684665__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3107684665__private_descriptor); + return; +} + ``` ## SrvNetUnpublishClientSlot ### Function Meta |Key|srvnet-07.sys| | :---: | :---: | |name|SrvNetUnpublishClientSlot| |fullname|SrvNetUnpublishClientSlot| |refcount|2| |length|91| |called|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock| |calling|SrvNetDeregisterClient| |paramcount|2| |address|140019700| |sig|undefined __fastcall SrvNetUnpublishClientSlot(longlong param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- SrvNetUnpublishClientSlot +++ SrvNetUnpublishClientSlot @@ -0,0 +1,15 @@ + +void SrvNetUnpublishClientSlot(longlong param_1,uint param_2) + +{ + longlong lVar1; + undefined1 uVar2; + + uVar2 = KeAcquireSpinLockRaiseToDpc(SrvNetDeviceExtension + 0x68); + lVar1 = SrvNetDeviceExtension; + *(undefined8 *)(param_1 + 0x128 + (ulonglong)param_2 * 8) = 0; + *(undefined1 *)((ulonglong)param_2 + 0x150 + param_1) = 0; + KeReleaseSpinLock(lVar1 + 0x68,uVar2); + return; +} + ``` # Modified *Modified functions contain code changes* ## SrvNetNotifyClientsOfEndpoint ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.89| |i_ratio|0.28| |m_ratio|0.95| |b_ratio|0.66| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|SrvNetNotifyClientsOfEndpoint|SrvNetNotifyClientsOfEndpoint| |fullname|SrvNetNotifyClientsOfEndpoint|SrvNetNotifyClientsOfEndpoint| |`refcount`|6|5| |`length`|626|721| |`called`|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeReleaseSpinLock
SrvNetDereferenceClient
SrvNetReferenceClient
_guard_dispatch_icall|
Expand for full list:
Feature_3107684665__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExInitializeRundownProtection
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeReleaseSpinLock
SrvNetDereferenceClient
SrvNetReferenceClient_guard_dispatch_icall
| |calling|SrvNetAllocateEndpointCommon
SrvNetCloseEndpoint
SrvNetNotifyClientsOfEndpoints
SrvNetTdiAllocateEndpoint|SrvNetAllocateEndpointCommon
SrvNetCloseEndpoint
SrvNetNotifyClientsOfEndpoints
SrvNetTdiAllocateEndpoint| |paramcount|2|2| |`address`|140009bd0|14000a2a0| |sig|undefined __fastcall SrvNetNotifyClientsOfEndpoint(longlong param_1, char param_2)|undefined __fastcall SrvNetNotifyClientsOfEndpoint(longlong param_1, char param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvNetNotifyClientsOfEndpoint Called Diff ```diff --- SrvNetNotifyClientsOfEndpoint called +++ SrvNetNotifyClientsOfEndpoint called @@ -0,0 +1 @@ +Feature_3107684665__private_IsEnabledDeviceUsageNoInline @@ -1,0 +3 @@ +NTOSKRNL.EXE::ExInitializeRundownProtection @@ -2,0 +5 @@ +NTOSKRNL.EXE::ExWaitForRundownProtectionRelease ``` ### SrvNetNotifyClientsOfEndpoint Diff ```diff --- SrvNetNotifyClientsOfEndpoint +++ SrvNetNotifyClientsOfEndpoint @@ -1,75 +1,87 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void SrvNetNotifyClientsOfEndpoint(longlong param_1,char param_2) { char cVar1; longlong lVar2; undefined1 uVar3; longlong lVar4; ulonglong uVar5; undefined7 in_register_00000011; longlong lVar6; longlong lVar7; KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite(SrvNetDeviceExtension,CONCAT71(in_register_00000011,1)); lVar6 = 0x1d0; lVar7 = 5; do { lVar2 = *(longlong *)(lVar6 + SrvNetDeviceExtension); if (lVar2 != 0) { if (param_2 == '\0') { if (((*(char *)((ulonglong)*(uint *)(lVar2 + 0xe8) + 0x150 + param_1) == '\x01') && - (*(code **)(lVar2 + 0xa8) != (code *)0x0)) && + (*(longlong *)(lVar2 + 0xa8) != 0)) && (*(longlong *)(param_1 + 0x128 + (ulonglong)*(uint *)(lVar2 + 0xe8) * 8) != 0)) { - (**(code **)(lVar2 + 0xa8))(param_1 + 0x48,param_1 + 0x58); + uVar5 = Feature_3107684665__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 != 0) { + ExWaitForRundownProtectionRelease + (param_1 + ((ulonglong)*(uint *)(lVar2 + 0xe8) + 0x2b) * 8); + } + (**(code **)(lVar2 + 0xa8)) + (param_1 + 0x48,param_1 + 0x58, + *(undefined8 *)(param_1 + 0x128 + (ulonglong)*(uint *)(lVar2 + 0xe8) * 8)); *(undefined1 *)((ulonglong)*(uint *)(lVar2 + 0xe8) + 0x150 + param_1) = 0; LAB_0: SrvNetDereferenceClient(lVar2); } LAB_1: *(undefined8 *)(param_1 + 0x128 + (ulonglong)*(uint *)(lVar2 + 0xe8) * 8) = 0; } else if (*(int *)(lVar2 + 0x84) == 0) { if ((*(char *)((ulonglong)*(uint *)(lVar2 + 0xe8) + 0x150 + param_1) != '\x01') && (*(code **)(lVar2 + 0xa0) != (code *)0x0)) { lVar4 = (**(code **)(lVar2 + 0xa0)) (*(undefined8 *)(lVar2 + 0x98),param_1 + 0x48,param_1 + 0x58, param_1 + 0x68,param_1 + 0x80,*(undefined4 *)(param_1 + 0x9c), *(undefined1 *)(param_1 + 0x79),*(undefined1 *)(param_1 + 0x78)); if (lVar4 != 0) { SrvNetReferenceClient(lVar2); + uVar5 = Feature_3107684665__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 != 0) { + ExInitializeRundownProtection + (param_1 + ((ulonglong)*(uint *)(lVar2 + 0xe8) + 0x2b) * 8); + } uVar3 = KeAcquireSpinLockRaiseToDpc(SrvNetDeviceExtension + 0x68); *(longlong *)(param_1 + 0x128 + (ulonglong)*(uint *)(lVar2 + 0xe8) * 8) = lVar4; *(undefined1 *)((ulonglong)*(uint *)(lVar2 + 0xe8) + 0x150 + param_1) = 1; KeReleaseSpinLock(SrvNetDeviceExtension + 0x68,uVar3); } } } else if (*(int *)(lVar2 + 0x84) == 1) { uVar3 = KeAcquireSpinLockRaiseToDpc(SrvNetDeviceExtension + 0x68); uVar5 = (ulonglong)*(uint *)(lVar2 + 0xe8); lVar4 = *(longlong *)(param_1 + 0x128 + uVar5 * 8); cVar1 = *(char *)(uVar5 + 0x150 + param_1); *(undefined8 *)(param_1 + 0x128 + uVar5 * 8) = 0; *(undefined1 *)((ulonglong)*(uint *)(lVar2 + 0xe8) + 0x150 + param_1) = 0; KeReleaseSpinLock(SrvNetDeviceExtension + 0x68,uVar3); if (((cVar1 == '\x01') && (*(code **)(lVar2 + 0xa8) != (code *)0x0)) && (lVar4 != 0)) { (**(code **)(lVar2 + 0xa8))(param_1 + 0x48,param_1 + 0x58,lVar4); goto LAB_0; } goto LAB_1; } } lVar6 = lVar6 + 8; lVar7 = lVar7 + -1; if (lVar7 == 0) { ExReleaseResourceLite(SrvNetDeviceExtension); KeLeaveCriticalRegion(); return; } } while( true ); } ``` ## SrvNetTdiAllocateEndpoint ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,called| |ratio|0.15| |i_ratio|0.39| |m_ratio|0.98| |b_ratio|0.24| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|SrvNetTdiAllocateEndpoint|SrvNetTdiAllocateEndpoint| |fullname|SrvNetTdiAllocateEndpoint|SrvNetTdiAllocateEndpoint| |`refcount`|3|2| |`length`|1483|1428| |`called`|
Expand for full list:
FUN_14005a4a8
FUN_14005a4b4
FUN_14005a4be
FUN_14005a4cd
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExInitializeRundownProtection
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeSpinLock
NTOSKRNL.EXE::KeLeaveCriticalRegionNTOSKRNL.EXE::ObfDereferenceObject
SrvNetAllocateConnection
SrvNetAllocatePoolWithTag
SrvNetAllocateReferencedHandle
SrvNetBindTdiHandlers
SrvNetCalculateMaxUnAuthenticatedConnections
SrvNetDereferenceHandle
SrvNetFreePool
SrvNetNotifyClientsOfEndpoint
SrvNetOpenEndpointHandle
SrvNetReferenceDriver
SrvNetReferenceEndpoint
SrvNetReferenceListenerRuleEntry
WPP_SF_
WPP_SF_D
WPP_SF_ZZZDcc
memmove
|
Expand for full list:
Feature_3107684665__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExInitializeRundownProtection
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeSpinLock
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ZwClose
SrvNetAllocateConnectionSrvNetAllocatePoolWithTag
SrvNetAllocateReferencedHandle
SrvNetBindTdiHandlers
SrvNetCalculateMaxUnAuthenticatedConnections
SrvNetDereferenceHandle
SrvNetFreePool
SrvNetNotifyClientsOfEndpoint
SrvNetOpenEndpointHandle
SrvNetReferenceDriver
SrvNetReferenceEndpoint
SrvNetReferenceListenerRuleEntry
WPP_SF_
WPP_SF_L
WPP_SF_ZZZDcc
memcpy
| |calling|SrvNetAllocateEndpoint|SrvNetAllocateEndpoint| |paramcount|9|9| |`address`|140054578|140057cf0| |`sig`|ulonglong __fastcall SrvNetTdiAllocateEndpoint(wchar_t * param_1, wchar_t * param_2, ushort * param_3, longlong * param_4, uint param_5, undefined8 param_6, undefined8 param_7, longlong param_8, undefined8 * param_9)|int __fastcall SrvNetTdiAllocateEndpoint(wchar_t * param_1, wchar_t * param_2, ushort * param_3, longlong * param_4, uint param_5, undefined8 param_6, undefined8 param_7, longlong param_8, undefined8 * param_9)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvNetTdiAllocateEndpoint Called Diff ```diff --- SrvNetTdiAllocateEndpoint called +++ SrvNetTdiAllocateEndpoint called @@ -1,4 +1 @@ -FUN_14005a4a8 -FUN_14005a4b4 -FUN_14005a4be -FUN_14005a4cd +Feature_3107684665__private_IsEnabledDeviceUsageNoInline @@ -12,0 +10 @@ +NTOSKRNL.EXE::ZwClose @@ -26 +24 @@ -WPP_SF_D +WPP_SF_L @@ -28 +26 @@ -memmove +memcpy ``` ### SrvNetTdiAllocateEndpoint Diff ```diff --- SrvNetTdiAllocateEndpoint +++ SrvNetTdiAllocateEndpoint @@ -1,233 +1,223 @@ -ulonglong SrvNetTdiAllocateEndpoint - (wchar_t *param_1,wchar_t *param_2,ushort *param_3,longlong *param_4, - uint param_5,undefined8 param_6,undefined8 param_7,longlong param_8, - undefined8 *param_9) +int SrvNetTdiAllocateEndpoint + (wchar_t *param_1,wchar_t *param_2,ushort *param_3,longlong *param_4,uint param_5, + undefined8 param_6,undefined8 param_7,longlong param_8,undefined8 *param_9) { - longlong *plVar1; - wchar_t wVar2; - ushort uVar3; - int *piVar4; + wchar_t wVar1; + ushort uVar2; + code *pcVar3; + int iVar4; longlong *plVar5; - code *pcVar6; - longlong lVar7; - undefined4 uVar8; - uint uVar9; - longlong *plVar10; + ulonglong uVar6; + undefined8 uVar7; + longlong *plVar8; + undefined1 *puVar9; + longlong lVar10; longlong lVar11; - undefined8 uVar12; - ulonglong extraout_RAX; - ulonglong uVar13; - undefined *puVar14; - undefined1 *puVar15; - undefined1 *puVar16; - undefined1 auStackY_78 [8]; - undefined1 auStackY_70 [24]; - undefined8 local_28 [2]; + uint uVar12; + undefined1 auStackY_88 [8]; + undefined1 auStackY_80 [24]; + undefined8 local_38 [2]; - puVar16 = auStackY_78; - puVar15 = auStackY_78; - local_28[0] = 0; + puVar9 = auStackY_88; + lVar11 = 0; + local_38[0] = 0; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29]) ) { WPP_SF_ZZZDcc(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1b,param_3,param_1,param_2, (wchar_t *)param_3); - FUN_14005a4a8(); - return extraout_RAX; } if ((SrvNetEnabledTransports & 1) == 0) { + puVar9 = auStackY_88; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1c, - &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,SrvNetEnabledTransports); - uVar13 = FUN_14005a4b4(); - return uVar13; - } - return 0xc0000022; - } - plVar10 = (longlong *) - SrvNetAllocatePoolWithTag - (0x40,(ulonglong)(ushort)*param_2 + 0x160 + - (ulonglong)*param_3 + (ulonglong)(ushort)*param_1); - if (plVar10 == (longlong *)0x0) { + (puVar9 = auStackY_88, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (puVar9 = auStackY_88, 1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1c, + &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,SrvNetEnabledTransports); + puVar9 = auStackY_88; + } + goto LAB_0; + } + plVar5 = (longlong *) + SrvNetAllocatePoolWithTag + (0x40,(ulonglong)(ushort)*param_2 + 0x188 + + (ulonglong)*param_3 + (ulonglong)(ushort)*param_1); + if (plVar5 == (longlong *)0x0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0') ) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x21, - &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids); - } -LAB_0: - uVar9 = 0xc000009a; - goto LAB_1; - } - ExInitializeRundownProtection(plVar10 + 8); - KeInitializeSpinLock(plVar10 + 3); - plVar1 = plVar10 + 0x18; - plVar10[0x19] = (longlong)plVar1; - plVar5 = plVar10 + 0x1e; - *plVar1 = (longlong)plVar1; - plVar1 = plVar10 + 0x1a; - plVar10[0x1b] = (longlong)plVar1; - *plVar1 = (longlong)plVar1; - plVar1 = plVar10 + 0x1c; - plVar10[0x1d] = (longlong)plVar1; - *plVar1 = (longlong)plVar1; - plVar10[0x1f] = (longlong)plVar5; - *plVar5 = (longlong)plVar5; - plVar1 = plVar10 + 0x20; - plVar10[0x21] = (longlong)plVar1; - *plVar1 = (longlong)plVar1; - plVar1 = plVar10 + 0x22; - plVar10[0x23] = (longlong)plVar1; - *plVar1 = (longlong)plVar1; - *(undefined2 *)((longlong)plVar10 + 0x91) = 0; - *(undefined4 *)((longlong)plVar10 + 0x7c) = 0; - *(undefined4 *)(plVar10 + 2) = 1; - plVar10[0x24] = param_8; - ExInitializeRundownProtection(plVar10 + 7); - *(undefined4 *)((longlong)plVar10 + 0xac) = SrvNetMaxConnections; - *(undefined4 *)(plVar10 + 0x14) = SrvNetMinFreeConnections; - *(undefined4 *)((longlong)plVar10 + 0xa4) = SrvNetMaxFreeConnections; - *(uint *)((longlong)plVar10 + 0x9c) = param_5 | 0x1000; - uVar8 = SrvNetMaxUnAuthenticatedConnections; - *(undefined2 *)(plVar10 + 0xf) = 0; - *(undefined4 *)((longlong)plVar10 + 0xb4) = uVar8; - lVar11 = param_4[1]; - plVar10[0x10] = *param_4; - plVar10[0x11] = lVar11; - *(undefined1 *)(plVar10 + 0x12) = 0; - wVar2 = *param_1; - *(wchar_t *)((longlong)plVar10 + 0x4a) = wVar2; - *(wchar_t *)(plVar10 + 9) = wVar2; - plVar10[10] = (longlong)(plVar10 + 0x2c); - memmove(plVar10 + 0x2c,*(void **)(param_1 + 4),(ulonglong)(ushort)*param_1); - if (*(int *)((longlong)plVar10 + 0xb4) == 0) { - uVar12 = SrvNetCalculateMaxUnAuthenticatedConnections((longlong)plVar10); - if ((int)uVar12 < 0) { + &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids); + } +LAB_1: + puVar9 = auStackY_88; + iVar4 = -0x3fffff66; + } + else { + ExInitializeRundownProtection(plVar5 + 8); + KeInitializeSpinLock(plVar5 + 3); + plVar8 = plVar5 + 0x18; + plVar5[0x19] = (longlong)plVar8; + *plVar8 = (longlong)plVar8; + plVar8 = plVar5 + 0x1a; + plVar5[0x1b] = (longlong)plVar8; + *plVar8 = (longlong)plVar8; + plVar8 = plVar5 + 0x1c; + plVar5[0x1d] = (longlong)plVar8; + *plVar8 = (longlong)plVar8; + plVar8 = plVar5 + 0x1e; + plVar5[0x1f] = (longlong)plVar8; + *plVar8 = (longlong)plVar8; + plVar8 = plVar5 + 0x20; + plVar5[0x21] = (longlong)plVar8; + *plVar8 = (longlong)plVar8; + plVar8 = plVar5 + 0x22; + plVar5[0x23] = (longlong)plVar8; + *plVar8 = (longlong)plVar8; + *(int *)(plVar5 + 2) = 1; + *(undefined2 *)((longlong)plVar5 + 0x91) = 0; + *(int *)((longlong)plVar5 + 0x7c) = 0; + plVar5[0x24] = param_8; + ExInitializeRundownProtection(plVar5 + 7); + *(int *)((longlong)plVar5 + 0xac) = SrvNetMaxConnections; + *(int *)(plVar5 + 0x14) = SrvNetMinFreeConnections; + *(int *)((longlong)plVar5 + 0xa4) = SrvNetMaxFreeConnections; + *(uint *)((longlong)plVar5 + 0x9c) = param_5 | 0x1000; + *(int *)((longlong)plVar5 + 0xb4) = SrvNetMaxUnAuthenticatedConnections; + *(undefined2 *)(plVar5 + 0xf) = 0; + lVar10 = param_4[1]; + plVar5[0x10] = *param_4; + plVar5[0x11] = lVar10; + *(undefined1 *)(plVar5 + 0x12) = 0; + uVar6 = Feature_3107684665__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 != 0) { + lVar10 = 5; + do { + ExInitializeRundownProtection((longlong)plVar5 + lVar11 + 0x158); + lVar11 = lVar11 + 8; + lVar10 = lVar10 + -1; + } while (lVar10 != 0); + } + wVar1 = *param_1; + *(wchar_t *)((longlong)plVar5 + 0x4a) = wVar1; + *(wchar_t *)(plVar5 + 9) = wVar1; + plVar5[10] = (longlong)(plVar5 + 0x31); + memcpy(plVar5 + 0x31,*(void **)(param_1 + 4),(ulonglong)(ushort)*param_1); + if (*(int *)((longlong)plVar5 + 0xb4) == 0) { + uVar7 = SrvNetCalculateMaxUnAuthenticatedConnections((longlong)plVar5); + if ((int)uVar7 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (WPP_GLOBAL_Control[0x29] != '\0')) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1d, + &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,(int)uVar7); + } + *(int *)((longlong)plVar5 + 0xb4) = 10; + } + } + wVar1 = *param_2; + plVar5[0xc] = (longlong)((ulonglong)*(ushort *)(plVar5 + 9) + plVar5[10]); + *(wchar_t *)(plVar5 + 0xb) = wVar1; + memcpy((void *)((ulonglong)*(ushort *)(plVar5 + 9) + plVar5[10]),*(void **)(param_2 + 4), + (ulonglong)(ushort)*param_2); + uVar2 = *param_3; + plVar5[0xe] = (longlong)((ulonglong)*(ushort *)(plVar5 + 0xb) + plVar5[0xc]); + *(ushort *)(plVar5 + 0xd) = uVar2; + memcpy((void *)((ulonglong)*(ushort *)(plVar5 + 0xb) + plVar5[0xc]),*(void **)(param_3 + 4), + (ulonglong)*param_3); + plVar8 = plVar5 + 5; + iVar4 = SrvNetOpenEndpointHandle(param_1,param_4,local_38,plVar8); + if (iVar4 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1d, - &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,(int)uVar12); - uVar13 = FUN_14005a4be(); - return uVar13; - } - *(undefined4 *)((longlong)plVar10 + 0xb4) = 10; - } - } - wVar2 = *param_2; - plVar10[0xc] = (longlong)((ulonglong)*(ushort *)(plVar10 + 9) + plVar10[10]); - *(wchar_t *)(plVar10 + 0xb) = wVar2; - memmove((void *)((ulonglong)*(ushort *)(plVar10 + 9) + plVar10[10]),*(void **)(param_2 + 4), - (ulonglong)(ushort)*param_2); - uVar3 = *param_3; - plVar10[0xe] = (longlong)((ulonglong)*(ushort *)(plVar10 + 0xb) + plVar10[0xc]); - *(ushort *)(plVar10 + 0xd) = uVar3; - memmove((void *)((ulonglong)*(ushort *)(plVar10 + 0xb) + plVar10[0xc]),*(void **)(param_3 + 4), - (ulonglong)*param_3); - plVar1 = plVar10 + 5; - uVar9 = SrvNetOpenEndpointHandle(param_1,param_4,local_28,plVar1); - if ((int)uVar9 < 0) { - puVar15 = auStackY_78; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (puVar15 = auStackY_78, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (puVar15 = auStackY_78, WPP_GLOBAL_Control[0x29] != '\0')) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x20, - &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,uVar9); - puVar15 = auStackY_78; - } - } - else { - lVar11 = SrvNetAllocateReferencedHandle(local_28[0]); - if (lVar11 == 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (WPP_GLOBAL_Control[0x29] != '\0')) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1e, - &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,uVar9); - uVar13 = FUN_14005a4cd(); - return uVar13; - } - ZwClose(local_28[0]); - ObfDereferenceObject(*plVar1); - SrvNetFreePool((longlong)plVar10); - goto LAB_0; - } - plVar10[4] = lVar11; - lVar11 = IoGetRelatedDeviceObject(*plVar1); - uVar9 = 0; - plVar10[6] = lVar11; - if ((int)plVar10[0x14] != 0) { - do { - SrvNetAllocateConnection((longlong)plVar10); - uVar9 = uVar9 + 1; - } while (uVar9 < *(uint *)(plVar10 + 0x14)); - } - uVar9 = SrvNetBindTdiHandlers((longlong)plVar10); - if ((int)uVar9 < 0) { - puVar14 = WPP_GLOBAL_Control; - puVar15 = auStackY_78; - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) goto LAB_2; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x20, + &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,iVar4); + } +LAB_2: + SrvNetFreePool((longlong)plVar5); } else { + lVar11 = SrvNetAllocateReferencedHandle(local_38[0]); + if (lVar11 == 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (WPP_GLOBAL_Control[0x29] != '\0')) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1e, + &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,iVar4); + } + ZwClose(local_38[0]); + ObfDereferenceObject(*plVar8); + SrvNetFreePool((longlong)plVar5); + goto LAB_1; + } + plVar5[4] = lVar11; + lVar11 = IoGetRelatedDeviceObject(*plVar8); + uVar12 = 0; + plVar5[6] = lVar11; + if ((int)plVar5[0x14] != 0) { + do { + SrvNetAllocateConnection((longlong)plVar5); + uVar12 = uVar12 + 1; + } while (uVar12 < *(uint *)(plVar5 + 0x14)); + } + iVar4 = SrvNetBindTdiHandlers((longlong)plVar5); + if (iVar4 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (WPP_GLOBAL_Control[0x29] != '\0')) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1f, + &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,iVar4); + } + SrvNetDereferenceHandle((int *)plVar5[4]); + plVar5[4] = 0; + ObfDereferenceObject(*plVar8); + goto LAB_2; + } if (param_9 != (undefined8 *)0x0) { - SrvNetReferenceEndpoint((longlong)plVar10); - *param_9 = plVar10; + SrvNetReferenceEndpoint((longlong)plVar5); + *param_9 = plVar5; } if (param_8 != 0) { SrvNetReferenceListenerRuleEntry(param_8); } KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite(SrvNetDeviceExtension + 0x120,1); - lVar7 = SrvNetDeviceExtension; lVar11 = SrvNetDeviceExtension + 0x188; - plVar5 = *(longlong **)(SrvNetDeviceExtension + 400); - if (*plVar5 == lVar11) { - plVar10[1] = (longlong)plVar5; - *plVar10 = lVar11; - *plVar5 = (longlong)plVar10; - *(longlong **)(lVar7 + 400) = plVar10; - ExReleaseResourceLite(lVar7 + 0x120); - KeLeaveCriticalRegion(); - SrvNetReferenceDriver(); - SrvNetNotifyClientsOfEndpoint((longlong)plVar10,'\x01'); - uVar9 = 0; - puVar15 = auStackY_78; - goto LAB_1; - } - puVar14 = (undefined *)0x3; - pcVar6 = (code *)swi(0x29); - (*pcVar6)(); - puVar16 = auStackY_70; -LAB_2: - puVar15 = puVar16; - if (((*(uint *)(puVar14 + 0x2c) & 0x100) != 0) && (puVar14[0x29] != '\0')) { - uVar12 = *(undefined8 *)(puVar14 + 0x18); - *(undefined8 *)(puVar16 + -8) = 0x140054a7c; - WPP_SF_D(uVar12,0x1f,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,uVar9); - } - } - piVar4 = (int *)plVar10[4]; - *(undefined8 *)(puVar15 + -8) = 0x140054810; - SrvNetDereferenceHandle(piVar4); - lVar11 = *plVar1; - plVar10[4] = 0; - *(undefined8 *)(puVar15 + -8) = 0x14005481f; - ObfDereferenceObject(lVar11); - } - *(undefined8 *)(puVar15 + -8) = 0x14005482c; - SrvNetFreePool((longlong)plVar10); -LAB_1: + plVar8 = *(longlong **)(SrvNetDeviceExtension + 400); + lVar10 = SrvNetDeviceExtension; + puVar9 = auStackY_88; + if (*plVar8 != lVar11) { + plVar8 = (longlong *)0x3; + pcVar3 = (code *)swi(0x29); + lVar11 = (*pcVar3)(); + puVar9 = auStackY_80; + } + plVar5[1] = (longlong)plVar8; + *plVar5 = lVar11; + *plVar8 = (longlong)plVar5; + *(longlong **)(lVar11 + 8) = plVar5; + *(undefined8 *)(puVar9 + -8) = 0x140058134; + ExReleaseResourceLite(lVar10 + 0x120); + *(undefined8 *)(puVar9 + -8) = 0x140058140; + KeLeaveCriticalRegion(); + *(undefined8 *)(puVar9 + -8) = 0x14005814a; + SrvNetReferenceDriver(); + *(undefined8 *)(puVar9 + -8) = 0x140058154; + SrvNetNotifyClientsOfEndpoint((longlong)plVar5,'\x01'); + iVar4 = 0; + } + } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) { - uVar12 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(undefined8 *)(puVar15 + -8) = 0x140054b3f; - WPP_SF_D(uVar12,0x22,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,uVar9); - } - return (ulonglong)uVar9; + uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(undefined8 *)(puVar9 + -8) = 0x140058264; + WPP_SF_L(uVar7,0x22,&WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,iVar4); + } +LAB_0: + return (int)*(undefined8 *)(puVar9 + 0x80); } ``` ## SrvNetDeregisterClient ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.6| |i_ratio|0.43| |m_ratio|0.88| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|SrvNetDeregisterClient|SrvNetDeregisterClient| |fullname|SrvNetDeregisterClient|SrvNetDeregisterClient| |refcount|4|4| |`length`|429|557| |`called`|
Expand for full list:
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
SrvNetDereferenceClient
SrvNetFlushBufferLookasides
SrvNetTriggerScavenger
WPP_SF_q
WPP_SF_qZ
_guard_dispatch_icall
|
Expand for full list:
Feature_3107684665__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
SrvNetDereferenceClient
SrvNetFlushBufferLookasides
SrvNetTriggerScavenger
SrvNetUnpublishClientSlotWPP_SF_q
WPP_SF_qZ
_guard_dispatch_icall
| |calling||| |paramcount|3|3| |`address`|1400467f0|140046820| |sig|undefined __fastcall SrvNetDeregisterClient(longlong param_1, undefined8 param_2, undefined8 param_3)|undefined __fastcall SrvNetDeregisterClient(longlong param_1, undefined8 param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvNetDeregisterClient Called Diff ```diff --- SrvNetDeregisterClient called +++ SrvNetDeregisterClient called @@ -0,0 +1 @@ +Feature_3107684665__private_IsEnabledDeviceUsageNoInline @@ -3,0 +5 @@ +NTOSKRNL.EXE::ExWaitForRundownProtectionRelease @@ -8,0 +11 @@ +SrvNetUnpublishClientSlot ``` ### SrvNetDeregisterClient Diff ```diff --- SrvNetDeregisterClient +++ SrvNetDeregisterClient @@ -1,56 +1,68 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void SrvNetDeregisterClient(longlong param_1,undefined8 param_2,undefined8 param_3) { bool bVar1; - undefined8 *puVar2; - longlong lVar3; - undefined8 uVar4; - undefined8 *puVar5; + ulonglong uVar2; + undefined8 *puVar3; + longlong lVar4; + undefined8 uVar5; + undefined8 *puVar6; + ulonglong uVar7; - /* 0x467f0 164 SrvNetDeregisterClient */ + /* 0x46820 164 SrvNetDeregisterClient */ bVar1 = false; KeEnterCriticalRegion(); - uVar4 = CONCAT71((int7)((ulonglong)param_2 >> 8),1); + uVar5 = CONCAT71((int7)((ulonglong)param_2 >> 8),1); ExAcquireResourceExclusiveLite(SrvNetDeviceExtension); if (*(int *)(param_1 + 0x84) == 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x1000) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar4,param_3,param_1, + WPP_SF_qZ(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar5,param_3,param_1, (wchar_t *)(param_1 + 0x88)); } - lVar3 = SrvNetDeviceExtension + 0x120; + lVar4 = SrvNetDeviceExtension + 0x120; *(undefined4 *)(param_1 + 0x84) = 1; - ExAcquireResourceSharedLite(lVar3); - puVar2 = (undefined8 *)(SrvNetDeviceExtension + 0x188); - for (puVar5 = (undefined8 *)*puVar2; puVar5 != puVar2; puVar5 = (undefined8 *)*puVar5) { - if (puVar5[(ulonglong)*(uint *)(param_1 + 0xe8) + 0x25] != 0) { - (**(code **)(param_1 + 0xa8))(puVar5 + 9); - puVar5[(ulonglong)*(uint *)(param_1 + 0xe8) + 0x25] = 0; - *(undefined1 *)((ulonglong)*(uint *)(param_1 + 0xe8) + 0x150 + (longlong)puVar5) = 0; + ExAcquireResourceSharedLite(lVar4); + puVar3 = (undefined8 *)(SrvNetDeviceExtension + 0x188); + for (puVar6 = (undefined8 *)*puVar3; puVar6 != puVar3; puVar6 = (undefined8 *)*puVar6) { + if (puVar6[(ulonglong)*(uint *)(param_1 + 0xe8) + 0x25] != 0) { + uVar2 = Feature_3107684665__private_IsEnabledDeviceUsageNoInline(); + uVar7 = (ulonglong)*(uint *)(param_1 + 0xe8); + if ((int)uVar2 == 0) { + (**(code **)(param_1 + 0xa8))(puVar6 + 9,puVar6 + 0xb,puVar6[uVar7 + 0x25]); + puVar6[(ulonglong)*(uint *)(param_1 + 0xe8) + 0x25] = 0; + *(undefined1 *)((ulonglong)*(uint *)(param_1 + 0xe8) + 0x150 + (longlong)puVar6) = 0; + } + else { + uVar5 = puVar6[uVar7 + 0x25]; + ExWaitForRundownProtectionRelease(puVar6 + uVar7 + 0x2b); + SrvNetUnpublishClientSlot((longlong)puVar6,*(uint *)(param_1 + 0xe8)); + (**(code **)(param_1 + 0xa8))(puVar6 + 9,puVar6 + 0xb,uVar5); + } SrvNetDereferenceClient(param_1); } - puVar2 = (undefined8 *)(SrvNetDeviceExtension + 0x188); + puVar3 = (undefined8 *)(SrvNetDeviceExtension + 0x188); } ExReleaseResourceLite(SrvNetDeviceExtension + 0x120); SrvNetDereferenceClient(param_1); bVar1 = true; SrvNetFlushBufferLookasides(); } else if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x1000) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) { WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xe, - &WPP_b2c5afd6f6c2384decec4e1014c730bc_Traceguids,param_1); + &WPP_45c4f77a1aa8354f46f930247257519a_Traceguids,param_1); } ExReleaseResourceLite(); KeLeaveCriticalRegion(); if (bVar1) { SrvNetTriggerScavenger('\0','\0','\x01'); } return; } ``` ## SrvNetTdiCloseConnection ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.26| |i_ratio|0.27| |m_ratio|0.57| |b_ratio|0.57| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|SrvNetTdiCloseConnection|SrvNetTdiCloseConnection| |fullname|SrvNetTdiCloseConnection|SrvNetTdiCloseConnection| |refcount|6|6| |`length`|87|232| |`called`|NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ZwClose|Feature_3107684665__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExRundownCompleted
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ZwClose| |calling|SrvNetAllocateConnection
SrvNetCloseEndpoint
SrvNetEndpointReopenTdiConnections
SrvNetFinalDereferenceInternal
SrvNetTdiOpenConnection|SrvNetAllocateConnection
SrvNetCloseEndpoint
SrvNetEndpointReopenTdiConnections
SrvNetFinalDereferenceInternal
SrvNetTdiOpenConnection| |paramcount|1|1| |`address`|140054318|1400543c8| |sig|undefined __fastcall SrvNetTdiCloseConnection(longlong param_1)|undefined __fastcall SrvNetTdiCloseConnection(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvNetTdiCloseConnection Called Diff ```diff --- SrvNetTdiCloseConnection called +++ SrvNetTdiCloseConnection called @@ -0,0 +1,3 @@ +Feature_3107684665__private_IsEnabledDeviceUsageNoInline +NTOSKRNL.EXE::ExRundownCompleted +NTOSKRNL.EXE::ExWaitForRundownProtectionRelease ``` ### SrvNetTdiCloseConnection Diff ```diff --- SrvNetTdiCloseConnection +++ SrvNetTdiCloseConnection @@ -1,16 +1,37 @@ void SrvNetTdiCloseConnection(longlong param_1) { - if (*(longlong *)(param_1 + 400) != 0) { - ObfDereferenceObject(); - *(undefined8 *)(param_1 + 400) = 0; - *(undefined8 *)(param_1 + 0x198) = 0; + ulonglong uVar1; + + uVar1 = Feature_3107684665__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar1 == 0) { + if (*(longlong *)(param_1 + 400) != 0) { + ObfDereferenceObject(); + *(undefined8 *)(param_1 + 400) = 0; + *(undefined8 *)(param_1 + 0x198) = 0; + } + if (*(longlong *)(param_1 + 0x188) != 0) { + ZwClose(); + *(undefined8 *)(param_1 + 0x188) = 0; + } } - if (*(longlong *)(param_1 + 0x188) != 0) { - ZwClose(); - *(undefined8 *)(param_1 + 0x188) = 0; + else { + if (*(longlong *)(param_1 + 0x188) != 0) { + ZwClose(); + *(undefined8 *)(param_1 + 0x188) = 0; + } + if (*(char *)(param_1 + 0x267) == '\0') { + *(undefined1 *)(param_1 + 0x267) = 1; + ExWaitForRundownProtectionRelease(param_1 + 0x288); + ExRundownCompleted(param_1 + 0x288); + } + if (*(longlong *)(param_1 + 400) != 0) { + ObfDereferenceObject(); + *(undefined8 *)(param_1 + 400) = 0; + *(undefined8 *)(param_1 + 0x198) = 0; + } } return; } ``` ## SrvNetAllocateEndpointCommon ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.39| |i_ratio|0.47| |m_ratio|0.98| |b_ratio|0.86| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|SrvNetAllocateEndpointCommon|SrvNetAllocateEndpointCommon| |fullname|SrvNetAllocateEndpointCommon|SrvNetAllocateEndpointCommon| |refcount|2|2| |`length`|1794|1834| |`called`|
Expand for full list:
McTemplateK0qd_EtwWriteTransfer
McTemplateK0qqhzr2_EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeSpinLock
NTOSKRNL.EXE::KeLeaveCriticalRegion
SrvNetAllocateConnection
SrvNetAllocatePoolWithTag
SrvNetCalculateMaxUnAuthenticatedConnections
SrvNetFreePoolSrvNetGetDefaultPortForTransportType
SrvNetNotifyClientsOfEndpoint
SrvNetQUICListenerOpen
SrvNetRdmaCreateListener
SrvNetReferenceDriver
SrvNetReferenceEndpoint
SrvNetReferenceListenerRuleEntry
SrvNetSetInterfaceEndpoint
SrvNetWskOpenListenSocket
WPP_SF_
WPP_SF_D
WPP_SF_Z
WPP_SF_ZZZDcc
WPP_SF_dD
__security_check_cookie
memmove
memset
|
Expand for full list:
Feature_3107684665__private_IsEnabledDeviceUsageNoInline
McTemplateK0qd_EtwWriteTransfer
McTemplateK0qqhzr2_EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExInitializeRundownProtection
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeSpinLock
NTOSKRNL.EXE::KeLeaveCriticalRegion
SrvNetAllocateConnection
SrvNetAllocatePoolWithTagSrvNetCalculateMaxUnAuthenticatedConnections
SrvNetFreePool
SrvNetGetDefaultPortForTransportType
SrvNetNotifyClientsOfEndpoint
SrvNetQUICListenerOpen
SrvNetRdmaCreateListener
SrvNetReferenceDriver
SrvNetReferenceEndpoint
SrvNetReferenceListenerRuleEntry
SrvNetSetInterfaceEndpoint
SrvNetWskOpenListenSocket
WPP_SF_
WPP_SF_L
WPP_SF_Ld
WPP_SF_Z
WPP_SF_ZZZDcc
__security_check_cookie
memcpy
memset
| |calling|SrvNetAllocateEndpoint|SrvNetAllocateEndpoint| |paramcount|4|4| |address|140044c28|140044c28| |sig|uint __fastcall SrvNetAllocateEndpointCommon(wchar_t * param_1, ushort * param_2, ushort * param_3, undefined8 param_4)|uint __fastcall SrvNetAllocateEndpointCommon(wchar_t * param_1, ushort * param_2, ushort * param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvNetAllocateEndpointCommon Called Diff ```diff --- SrvNetAllocateEndpointCommon called +++ SrvNetAllocateEndpointCommon called @@ -0,0 +1 @@ +Feature_3107684665__private_IsEnabledDeviceUsageNoInline @@ -3,0 +5 @@ +NTOSKRNL.EXE::ExInitializeRundownProtection @@ -22 +24,2 @@ -WPP_SF_D +WPP_SF_L +WPP_SF_Ld @@ -25 +27,0 @@ -WPP_SF_dD @@ -27 +29 @@ -memmove +memcpy ``` ### SrvNetAllocateEndpointCommon Diff ```diff --- SrvNetAllocateEndpointCommon +++ SrvNetAllocateEndpointCommon @@ -1,373 +1,376 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ uint SrvNetAllocateEndpointCommon (wchar_t *param_1,ushort *param_2,ushort *param_3,undefined8 param_4) { - longlong *plVar1; + ushort uVar1; ushort uVar2; - ushort uVar3; - wchar_t wVar4; - void *pvVar5; - code *pcVar6; + wchar_t wVar3; + void *pvVar4; + code *pcVar5; + ushort uVar6; uint extraout_EAX; undefined8 uVar7; longlong *plVar8; ulonglong uVar9; - longlong lVar10; - longlong *plVar11; - undefined *puVar12; - undefined8 *puVar13; - longlong lVar14; - int iVar15; - undefined1 *puVar16; - undefined1 *puVar17; - ushort uVar18; - uint uVar19; - uint uVar20; - char cVar21; + longlong *plVar10; + undefined *puVar11; + undefined8 *puVar12; + int iVar13; + undefined1 *puVar14; + undefined1 *puVar15; + longlong lVar16; + uint uVar17; + longlong lVar18; + char cVar19; + ushort *puVar20; undefined *_Size; - wchar_t *pwVar22; - ushort *puVar23; - int iVar24; + wchar_t *pwVar21; + int iVar22; + int iVar23; uint in_stack_00000040; ushort *in_stack_00000048; undefined8 uStack_140; undefined1 auStack_138 [8]; undefined1 auStack_130 [24]; int aiStack_118 [2]; ushort local_110 [4]; undefined8 local_108 [4]; - ushort *local_e8; - undefined8 local_e0; + undefined8 local_e8; + ushort *local_e0; + ushort *local_d8; ulonglong local_48; - int iVar25; - puVar16 = auStack_138; + puVar14 = auStack_138; local_48 = __security_cookie ^ (ulonglong)auStack_138; - iVar24 = 0; - iVar25 = 0; - puVar23 = param_3; - local_e8 = param_3; - local_e0 = param_4; + iVar23 = 0; + iVar22 = 0; + puVar20 = param_3; + local_e8 = param_4; + local_e0 = param_2; + local_d8 = param_3; uVar7 = SrvNetGetDefaultPortForTransportType(in_stack_00000040); - uVar18 = (ushort)uVar7; - puVar17 = auStack_138; + uVar6 = (ushort)uVar7; + puVar15 = auStack_138; if (in_stack_00000048 != (ushort *)0x0) { if ((byte)in_stack_00000048[1] != in_stack_00000040) { - pcVar6 = (code *)swi(0x2c); - (*pcVar6)(); - puVar16 = auStack_130; - } - uVar18 = *in_stack_00000048; - puVar17 = puVar16; + pcVar5 = (code *)swi(0x2c); + (*pcVar5)(); + puVar14 = auStack_130; + } + uVar6 = *in_stack_00000048; + puVar15 = puVar14; } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29]) ) { uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - puVar17[0x40] = (-(puVar17[0x168] != '\0') & 0xbU) + 0x4e; - uVar9 = CONCAT71((int7)((ulonglong)param_3 >> 8),-(puVar17[0x160] != '\0')) & 0xffffffffffffff0b + puVar15[0x40] = (-(puVar15[0x168] != '\0') & 0xbU) + 0x4e; + uVar9 = CONCAT71((int7)((ulonglong)puVar20 >> 8),-(puVar15[0x160] != '\0')) & 0xffffffffffffff0b ; - cVar21 = (char)uVar9 + 'N'; - puVar17[0x38] = cVar21; - *(undefined4 *)(puVar17 + 0x30) = *(undefined4 *)(puVar17 + 0x170); - *(ushort **)(puVar17 + 0x28) = puVar23; - *(ushort **)(puVar17 + 0x20) = param_2; - *(undefined8 *)(puVar17 + -8) = 0x140044d1c; - WPP_SF_ZZZDcc(uVar7,0x11,CONCAT71((int7)(uVar9 >> 8),cVar21),param_1, - *(wchar_t **)(puVar17 + 0x20),*(wchar_t **)(puVar17 + 0x28)); - puVar23 = *(ushort **)(puVar17 + 0x50); - } - pwVar22 = (wchar_t *)(ulonglong)SrvNetEnabledTransports; + cVar19 = (char)uVar9 + 'N'; + puVar15[0x38] = cVar19; + *(undefined4 *)(puVar15 + 0x30) = *(undefined4 *)(puVar15 + 0x170); + *(ushort **)(puVar15 + 0x28) = param_3; + *(ushort **)(puVar15 + 0x20) = param_2; + *(undefined8 *)(puVar15 + -8) = 0x140044d21; + WPP_SF_ZZZDcc(uVar7,0x11,CONCAT71((int7)(uVar9 >> 8),cVar19),param_1, + *(wchar_t **)(puVar15 + 0x20),*(wchar_t **)(puVar15 + 0x28)); + } + pwVar21 = (wchar_t *)(ulonglong)SrvNetEnabledTransports; if ((SrvNetEnabledTransports >> (in_stack_00000040 & 0x1f) & 1) == 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(undefined8 *)(puVar17 + -8) = 0x140044d65; - WPP_SF_D(uVar7,0x12,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,SrvNetEnabledTransports); - } - uVar19 = 0xc0000022; + *(undefined8 *)(puVar15 + -8) = 0x140044d65; + WPP_SF_L(uVar7,0x12,&WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,SrvNetEnabledTransports); + } + uVar17 = 0xc0000022; goto LAB_0; } - uVar2 = *puVar23; + uVar1 = *param_3; _Size = (undefined *)0x6662534c; - uVar3 = *param_2; - wVar4 = *param_1; - *(undefined8 *)(puVar17 + -8) = 0x140044d98; + uVar2 = *param_2; + wVar3 = *param_1; + *(undefined8 *)(puVar15 + -8) = 0x140044d96; plVar8 = (longlong *) SrvNetAllocatePoolWithTag - (0x40,(ulonglong)(ushort)wVar4 + 0x160 + (ulonglong)uVar2 + (ulonglong)uVar3); + (0x40,(ulonglong)(ushort)wVar3 + 0x188 + (ulonglong)uVar1 + (ulonglong)uVar2); if (plVar8 == (longlong *)0x0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0') ) { uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - _Size = &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids; - *(undefined8 *)(puVar17 + -8) = 0x140045272; - WPP_SF_(uVar7,0x17,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids); - } - uVar19 = 0xc000009a; + _Size = &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids; + *(undefined8 *)(puVar15 + -8) = 0x140045293; + WPP_SF_(uVar7,0x17,&WPP_9aecb02171d13363b9502c8e6523378b_Traceguids); + } + uVar17 = 0xc000009a; LAB_1: - puVar12 = WPP_GLOBAL_Control; + puVar11 = WPP_GLOBAL_Control; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - puVar12 = *(undefined **)(WPP_GLOBAL_Control + 0x18); - _Size = &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids; - *(undefined8 *)(puVar17 + -8) = 0x1400452ad; - WPP_SF_D(puVar12,0x19,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,uVar19); + puVar11 = *(undefined **)(WPP_GLOBAL_Control + 0x18); + _Size = &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids; + *(undefined8 *)(puVar15 + -8) = 0x1400452ce; + WPP_SF_L(puVar11,0x19,&WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,uVar17); } if ((in_stack_00000040 == 2) && ((DAT_2 & 0x10) != 0)) { - *(uint *)(puVar17 + 0x20) = uVar19; - *(undefined8 *)(puVar17 + -8) = 0x1400452cf; + *(uint *)(puVar15 + 0x20) = uVar17; + *(undefined8 *)(puVar15 + -8) = 0x1400452ef; McTemplateK0qd_EtwWriteTransfer - (puVar12,&SRV2_EVENT_RDMA_ENDPOINT_ALLOCATION_FAILURE,_Size,iVar24); + (puVar11,&SRV2_EVENT_RDMA_ENDPOINT_ALLOCATION_FAILURE,_Size,iVar23); } } else { - *(undefined8 *)(puVar17 + -8) = 0x140044daf; - KeInitializeSpinLock(plVar8 + 3); - plVar11 = plVar8 + 0x1a; - plVar8[0x1b] = (longlong)plVar11; - plVar1 = plVar8 + 0x20; - *plVar11 = (longlong)plVar11; - plVar11 = plVar8 + 0x1c; - plVar8[0x1d] = (longlong)plVar11; - *plVar11 = (longlong)plVar11; - plVar11 = plVar8 + 0x1e; - plVar8[0x1f] = (longlong)plVar11; - *plVar11 = (longlong)plVar11; - plVar8[0x21] = (longlong)plVar1; - *plVar1 = (longlong)plVar1; - plVar11 = plVar8 + 0x22; - plVar8[0x23] = (longlong)plVar11; - *plVar11 = (longlong)plVar11; + *(undefined8 *)(puVar15 + -8) = 0x140044dad; + KeInitializeSpinLock(); + *(int *)(plVar8 + 2) = 1; + plVar10 = plVar8 + 0x1a; + plVar8[0x1b] = (longlong)plVar10; + *plVar10 = (longlong)plVar10; + plVar10 = plVar8 + 0x1c; + plVar8[0x1d] = (longlong)plVar10; + *plVar10 = (longlong)plVar10; + plVar10 = plVar8 + 0x1e; + plVar8[0x1f] = (longlong)plVar10; + *plVar10 = (longlong)plVar10; + plVar10 = plVar8 + 0x20; + plVar8[0x21] = (longlong)plVar10; + *plVar10 = (longlong)plVar10; + plVar10 = plVar8 + 0x22; + plVar8[0x23] = (longlong)plVar10; + *plVar10 = (longlong)plVar10; *(undefined2 *)((longlong)plVar8 + 0x91) = 0; - *(int *)(plVar8 + 2) = 1; *(uint *)((longlong)plVar8 + 0x7c) = in_stack_00000040; plVar8[0x24] = (longlong)in_stack_00000048; *(int *)((longlong)plVar8 + 0xac) = SrvNetMaxConnections; *(int *)(plVar8 + 0x14) = SrvNetMinFreeConnections; *(int *)((longlong)plVar8 + 0xa4) = SrvNetMaxFreeConnections; - *(int *)((longlong)plVar8 + 0x9c) = *(int *)(puVar17 + 0x170); + *(int *)((longlong)plVar8 + 0x9c) = *(int *)(puVar15 + 0x170); *(int *)((longlong)plVar8 + 0xb4) = SrvNetMaxUnAuthenticatedConnections; - *(undefined1 *)(plVar8 + 0xf) = puVar17[0x160]; - *(undefined1 *)((longlong)plVar8 + 0x79) = puVar17[0x168]; - lVar10 = (*(longlong **)(puVar17 + 0x58))[1]; - plVar8[0x10] = **(longlong **)(puVar17 + 0x58); - plVar8[0x11] = lVar10; + *(undefined1 *)(plVar8 + 0xf) = puVar15[0x160]; + *(undefined1 *)((longlong)plVar8 + 0x79) = puVar15[0x168]; + lVar16 = (*(longlong **)(puVar15 + 0x50))[1]; + plVar8[0x10] = **(longlong **)(puVar15 + 0x50); + plVar8[0x11] = lVar16; *(undefined1 *)(plVar8 + 0x12) = 0; - wVar4 = *param_1; - *(wchar_t *)((longlong)plVar8 + 0x4a) = wVar4; - *(wchar_t *)(plVar8 + 9) = wVar4; - plVar8[10] = (longlong)(plVar8 + 0x2c); - wVar4 = *param_1; - pvVar5 = *(void **)(param_1 + 4); - *(undefined8 *)(puVar17 + -8) = 0x140044ea0; - memmove(plVar8 + 0x2c,pvVar5,(ulonglong)(ushort)wVar4); - uVar2 = *param_2; - uVar3 = *(ushort *)(plVar8 + 9); - lVar10 = plVar8[10]; - plVar8[0xc] = (longlong)((ulonglong)uVar3 + lVar10); - *(ushort *)((longlong)plVar8 + 0x5a) = uVar2; - *(ushort *)(plVar8 + 0xb) = uVar2; - uVar2 = *param_2; - pvVar5 = *(void **)(param_2 + 4); - *(undefined8 *)(puVar17 + -8) = 0x140044ec6; - memmove((void *)((ulonglong)uVar3 + lVar10),pvVar5,(ulonglong)uVar2); - puVar23 = *(ushort **)(puVar17 + 0x50); + *(undefined8 *)(puVar15 + -8) = 0x140044e7e; + uVar9 = Feature_3107684665__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 != 0) { + lVar18 = 0; + lVar16 = 5; + do { + *(undefined8 *)(puVar15 + -8) = 0x140044e98; + ExInitializeRundownProtection((longlong)plVar8 + lVar18 + 0x158); + lVar18 = lVar18 + 8; + lVar16 = lVar16 + -1; + } while (lVar16 != 0); + param_2 = *(ushort **)(puVar15 + 0x58); + param_3 = *(ushort **)(puVar15 + 0x60); + } + wVar3 = *param_1; + *(wchar_t *)((longlong)plVar8 + 0x4a) = wVar3; + *(wchar_t *)(plVar8 + 9) = wVar3; + plVar8[10] = (longlong)(plVar8 + 0x31); + wVar3 = *param_1; + pvVar4 = *(void **)(param_1 + 4); + *(undefined8 *)(puVar15 + -8) = 0x140044ed5; + memcpy(plVar8 + 0x31,pvVar4,(ulonglong)(ushort)wVar3); + uVar1 = *param_2; + uVar2 = *(ushort *)(plVar8 + 9); + lVar16 = plVar8[10]; + plVar8[0xc] = (longlong)((ulonglong)uVar2 + lVar16); + *(ushort *)((longlong)plVar8 + 0x5a) = uVar1; + *(ushort *)(plVar8 + 0xb) = uVar1; + uVar1 = *param_2; + pvVar4 = *(void **)(param_2 + 4); + *(undefined8 *)(puVar15 + -8) = 0x140044ef9; + memcpy((void *)((ulonglong)uVar2 + lVar16),pvVar4,(ulonglong)uVar1); + uVar1 = *param_3; uVar2 = *(ushort *)(plVar8 + 0xb); - lVar10 = plVar8[0xc]; - uVar3 = *puVar23; - *(ushort *)((longlong)plVar8 + 0x6a) = uVar3; - *(ushort *)(plVar8 + 0xd) = uVar3; - plVar8[0xe] = (longlong)((ulonglong)uVar2 + lVar10); - _Size = (undefined *)(ulonglong)*puVar23; - pvVar5 = *(void **)(puVar23 + 4); - *(undefined8 *)(puVar17 + -8) = 0x140044eef; - memmove((void *)((ulonglong)uVar2 + lVar10),pvVar5,(size_t)_Size); + lVar16 = plVar8[0xc]; + plVar8[0xe] = (longlong)((ulonglong)uVar2 + lVar16); + *(ushort *)((longlong)plVar8 + 0x6a) = uVar1; + *(ushort *)(plVar8 + 0xd) = uVar1; + _Size = (undefined *)(ulonglong)*param_3; + pvVar4 = *(void **)(param_3 + 4); + *(undefined8 *)(puVar15 + -8) = 0x140044f1d; + memcpy((void *)((ulonglong)uVar2 + lVar16),pvVar4,(size_t)_Size); + uVar17 = 0; if (*(int *)((longlong)plVar8 + 0xb4) == 0) { - *(undefined8 *)(puVar17 + -8) = 0x140044f07; + *(undefined8 *)(puVar15 + -8) = 0x140044f36; uVar9 = SrvNetCalculateMaxUnAuthenticatedConnections((longlong)plVar8); if ((int)uVar9 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) { uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - pwVar22 = (wchar_t *)(uVar9 & 0xffffffff); - _Size = &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids; - *(undefined8 *)(puVar17 + -8) = 0x140044f41; - WPP_SF_D(uVar7,0x13,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,(int)uVar9); + pwVar21 = (wchar_t *)(uVar9 & 0xffffffff); + _Size = &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids; + *(undefined8 *)(puVar15 + -8) = 0x140044f6e; + WPP_SF_L(uVar7,0x13,&WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,(int)uVar9); } *(int *)((longlong)plVar8 + 0xb4) = 10; } } if (in_stack_00000040 == 1) { - if (puVar17[0x168] != '\0') { - uVar19 = 0; - iVar25 = iVar24; - goto LAB_3; - } + if (puVar15[0x168] != '\0') goto LAB_3; _Size = (undefined *)0x80; - *(undefined8 *)(puVar17 + -8) = 0x140044f73; - memset(puVar17 + 0x70,0,0x80); - *(undefined4 *)(puVar17 + 0x74) = 0; - *(undefined4 *)(puVar17 + 0x88) = 0; - *(undefined2 *)(puVar17 + 0x70) = 0x17; - *(undefined8 *)(puVar17 + 0x78) = 0; - *(undefined8 *)(puVar17 + 0x80) = 0; - *(ushort *)(puVar17 + 0x72) = uVar18 >> 8 | uVar18 << 8; - *(undefined8 *)(puVar17 + -8) = 0x140044fa7; - iVar15 = SrvNetWskOpenListenSocket((longlong)plVar8,(short *)(puVar17 + 0x70)); - plVar8 = (longlong *)CONCAT44((int)((ulonglong)plVar8 >> 0x20),iVar15); + *(undefined8 *)(puVar15 + -8) = 0x140044f9f; + memset(puVar15 + 0x70,0,0x80); + *(undefined2 *)(puVar15 + 0x70) = 0x17; + *(undefined4 *)(puVar15 + 0x74) = 0; + *(undefined4 *)(puVar15 + 0x88) = 0; + *(undefined8 *)(puVar15 + 0x78) = 0; + *(undefined8 *)(puVar15 + 0x80) = 0; + *(ushort *)(puVar15 + 0x72) = uVar6 >> 8 | uVar6 << 8; + *(undefined8 *)(puVar15 + -8) = 0x140044fd2; + iVar13 = SrvNetWskOpenListenSocket((longlong)plVar8,(short *)(puVar15 + 0x70)); + plVar8 = (longlong *)CONCAT44((int)((ulonglong)plVar8 >> 0x20),iVar13); if ((int)extraout_EAX < 0) { - uVar19 = extraout_EAX; + uVar17 = extraout_EAX; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (iVar24 = iVar25, uVar19 = extraout_EAX, - (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (uVar19 = extraout_EAX, WPP_GLOBAL_Control[0x29] != '\0')) { + (iVar23 = iVar22, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (WPP_GLOBAL_Control[0x29] != '\0')) { uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - _Size = &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids; - *(undefined8 *)(puVar17 + -8) = 0x140044ffc; - WPP_SF_D(uVar7,0x14,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,extraout_EAX); - uVar19 = extraout_EAX; + _Size = &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids; + *(undefined8 *)(puVar15 + -8) = 0x140045024; + WPP_SF_L(uVar7,0x14,&WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,extraout_EAX); } LAB_4: if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) { uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(uint *)(puVar17 + 0x20) = uVar19; - _Size = &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids; - *(undefined8 *)(puVar17 + -8) = 0x140045181; - WPP_SF_dD(uVar7,0x16,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,in_stack_00000040); + *(uint *)(puVar15 + 0x20) = uVar17; + _Size = &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids; + *(undefined8 *)(puVar15 + -8) = 0x1400451a3; + WPP_SF_Ld(uVar7,0x16,&WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,in_stack_00000040); } goto LAB_5; } - *(undefined8 *)(puVar17 + -8) = 0x140044fb5; + *(undefined8 *)(puVar15 + -8) = 0x140044fe0; SrvNetSetInterfaceEndpoint((longlong)plVar8); - iVar25 = iVar24; LAB_6: - if ((*(char *)((longlong)plVar8 + 0x79) == '\0') && (uVar19 = 0, (int)plVar8[0x14] != 0)) { + if ((*(char *)((longlong)plVar8 + 0x79) == '\0') && (uVar17 = 0, (int)plVar8[0x14] != 0)) { do { - *(undefined8 *)(puVar17 + -8) = 0x140045053; + *(undefined8 *)(puVar15 + -8) = 0x140045075; SrvNetAllocateConnection((longlong)plVar8); - uVar19 = uVar19 + 1; - } while (uVar19 < *(uint *)(plVar8 + 0x14)); - } - puVar13 = *(undefined8 **)(puVar17 + 0x60); - if (puVar13 != (undefined8 *)0x0) { - *(undefined8 *)(puVar17 + -8) = 0x14004506f; + uVar17 = uVar17 + 1; + } while (uVar17 < *(uint *)(plVar8 + 0x14)); + } + puVar12 = *(undefined8 **)(puVar15 + 0x68); + if (puVar12 != (undefined8 *)0x0) { + *(undefined8 *)(puVar15 + -8) = 0x140045091; SrvNetReferenceEndpoint((longlong)plVar8); - *puVar13 = plVar8; + *puVar12 = plVar8; } if (in_stack_00000048 != (ushort *)0x0) { - *(undefined8 *)(puVar17 + -8) = 0x14004507f; + *(undefined8 *)(puVar15 + -8) = 0x1400450a1; SrvNetReferenceListenerRuleEntry((longlong)in_stack_00000048); } - *(undefined8 *)(puVar17 + -8) = 0x140045086; + *(undefined8 *)(puVar15 + -8) = 0x1400450a8; KeEnterCriticalRegion(); - *(undefined8 *)(puVar17 + -8) = 0x1400450a2; + *(undefined8 *)(puVar15 + -8) = 0x1400450c4; ExAcquireResourceExclusiveLite(SrvNetDeviceExtension + 0x120,1); - lVar10 = SrvNetDeviceExtension + 0x188; - plVar11 = *(longlong **)(SrvNetDeviceExtension + 400); - lVar14 = SrvNetDeviceExtension; - if (*plVar11 != lVar10) { - plVar11 = (longlong *)0x3; - pcVar6 = (code *)swi(0x29); - lVar10 = (*pcVar6)(); - puVar17 = puVar17 + 8; - } - plVar8[1] = (longlong)plVar11; - *plVar8 = lVar10; - *plVar11 = (longlong)plVar8; - *(longlong **)(lVar10 + 8) = plVar8; - *(undefined8 *)(puVar17 + -8) = 0x1400450e1; - ExReleaseResourceLite(lVar14 + 0x120); - *(undefined8 *)(puVar17 + -8) = 0x1400450ed; + lVar16 = SrvNetDeviceExtension + 0x188; + plVar10 = *(longlong **)(SrvNetDeviceExtension + 400); + lVar18 = SrvNetDeviceExtension; + if (*plVar10 != lVar16) { + plVar10 = (longlong *)0x3; + pcVar5 = (code *)swi(0x29); + lVar16 = (*pcVar5)(); + puVar15 = puVar15 + 8; + } + plVar8[1] = (longlong)plVar10; + *plVar8 = lVar16; + *plVar10 = (longlong)plVar8; + *(longlong **)(lVar16 + 8) = plVar8; + *(undefined8 *)(puVar15 + -8) = 0x140045103; + ExReleaseResourceLite(lVar18 + 0x120); + *(undefined8 *)(puVar15 + -8) = 0x14004510f; KeLeaveCriticalRegion(); - *(undefined8 *)(puVar17 + -8) = 0x1400450f7; + *(undefined8 *)(puVar15 + -8) = 0x140045119; SrvNetReferenceDriver(); - *(undefined8 *)(puVar17 + -8) = 0x140045101; + *(undefined8 *)(puVar15 + -8) = 0x140045123; SrvNetNotifyClientsOfEndpoint((longlong)plVar8,'\x01'); - uVar19 = 0; - iVar24 = iVar25; + uVar17 = 0; } else { if (in_stack_00000040 == 2) { - *(undefined8 *)(puVar17 + -8) = 0x140045016; - uVar19 = SrvNetRdmaCreateListener((longlong)plVar8,(ushort *)param_1,_Size,pwVar22); - iVar25 = (int)plVar8[5]; + *(undefined8 *)(puVar15 + -8) = 0x140045039; + uVar17 = SrvNetRdmaCreateListener((longlong)plVar8,(ushort *)param_1,_Size,pwVar21); + iVar23 = (int)plVar8[5]; LAB_3: - iVar24 = iVar25; - if ((int)uVar19 < 0) goto LAB_4; + if ((int)uVar17 < 0) goto LAB_4; goto LAB_6; } if (in_stack_00000040 == 4) { - *(undefined8 *)(puVar17 + -8) = 0x140045031; + *(undefined8 *)(puVar15 + -8) = 0x140045053; uVar9 = SrvNetQUICListenerOpen((longlong)plVar8,(ushort *)param_1); - uVar19 = (uint)uVar9; + uVar17 = (uint)uVar9; + iVar23 = iVar22; goto LAB_3; } - uVar20 = 0xc000000d; - uVar19 = 0xc000000d; + uVar17 = 0xc000000d; if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - uVar19 = uVar20; if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0) && - (iVar24 = iVar25, WPP_GLOBAL_Control[0x29] != '\0')) { + (iVar23 = iVar22, WPP_GLOBAL_Control[0x29] != '\0')) { uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(undefined4 *)(puVar17 + 0x20) = 0xc000000d; - _Size = &WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids; - *(undefined8 *)(puVar17 + -8) = 0x140045147; - WPP_SF_dD(uVar7,0x15,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,in_stack_00000040); + *(undefined4 *)(puVar15 + 0x20) = 0xc000000d; + _Size = &WPP_9aecb02171d13363b9502c8e6523378b_Traceguids; + *(undefined8 *)(puVar15 + -8) = 0x140045169; + WPP_SF_Ld(uVar7,0x15,&WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,in_stack_00000040); } goto LAB_4; } LAB_5: - *(undefined8 *)(puVar17 + -8) = 0x140045189; + *(undefined8 *)(puVar15 + -8) = 0x1400451ab; SrvNetFreePool((longlong)plVar8); - if ((int)uVar19 < 0) goto LAB_1; - } - if (puVar17[0x160] == '\0') { - if (puVar17[0x168] != '\0') { + if ((int)uVar17 < 0) goto LAB_1; + } + if (puVar15[0x160] == '\0') { + if (puVar15[0x168] != '\0') { LOCK(); *(int *)(SrvNetDeviceExtension + 0x1cc) = *(int *)(SrvNetDeviceExtension + 0x1cc) + 1; UNLOCK(); } } else { LOCK(); *(int *)(SrvNetDeviceExtension + 0x1c8) = *(int *)(SrvNetDeviceExtension + 0x1c8) + 1; UNLOCK(); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(undefined8 *)(puVar17 + -8) = 0x1400451f9; - WPP_SF_Z(uVar7,0x18,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,param_1); + *(undefined8 *)(puVar15 + -8) = 0x14004521b; + WPP_SF_Z(uVar7,0x18,&WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,param_1); } if ((in_stack_00000040 == 2) && ((DAT_2 & 8) != 0)) { - wVar4 = *param_1; - *(undefined8 *)(puVar17 + 0x30) = *(undefined8 *)(param_1 + 4); - *(ushort *)(puVar17 + 0x28) = (ushort)wVar4 >> 1; - *(int *)(puVar17 + 0x20) = iVar24; - *(undefined8 *)(puVar17 + -8) = 0x140045233; + wVar3 = *param_1; + *(undefined8 *)(puVar15 + 0x30) = *(undefined8 *)(param_1 + 4); + *(ushort *)(puVar15 + 0x28) = (ushort)wVar3 >> 1; + *(int *)(puVar15 + 0x20) = iVar23; + *(undefined8 *)(puVar15 + -8) = 0x140045254; McTemplateK0qqhzr2_EtwWriteTransfer(); } } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) { uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(undefined8 *)(puVar17 + -8) = 0x140045305; - WPP_SF_D(uVar7,0x1a,&WPP_e02e606dc2c23f433fe91df2b9f0027e_Traceguids,uVar19); + *(undefined8 *)(puVar15 + -8) = 0x140045325; + WPP_SF_L(uVar7,0x1a,&WPP_9aecb02171d13363b9502c8e6523378b_Traceguids,uVar17); } LAB_0: - *(undefined8 *)(puVar17 + -8) = 0x140045317; - return uVar19; + *(undefined8 *)(puVar15 + -8) = 0x140045337; + return uVar17; } ``` ## SrvNetTdiReceiveHandler ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.38| |i_ratio|0.56| |m_ratio|0.94| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|SrvNetTdiReceiveHandler|SrvNetTdiReceiveHandler| |fullname|SrvNetTdiReceiveHandler|SrvNetTdiReceiveHandler| |refcount|3|3| |`length`|491|551| |`called`|NTOSKRNL.EXE::IoAllocateIrp
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
SrvNetAllocateBuffer
SrvNetDisconnectConnectionInternalEx
SrvNetFreeBuffer
SrvNetIndicateData
WPP_SF_dqq
memmove|
Expand for full list:
Feature_3107684665__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::IoAllocateIrp
NTOSKRNL.EXE::IoFreeIrp
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
SrvNetAllocateBuffer
SrvNetDisconnectConnectionInternalEx
SrvNetFreeBuffer
SrvNetIndicateData
WPP_SF_dqqmemcpy
| |calling||| |paramcount|8|8| |`address`|140017160|140018310| |sig|undefined8 __fastcall SrvNetTdiReceiveHandler(undefined8 param_1, longlong param_2, undefined8 param_3, uint param_4, uint param_5, undefined4 * param_6, void * param_7, longlong * param_8)|undefined8 __fastcall SrvNetTdiReceiveHandler(undefined8 param_1, longlong param_2, undefined8 param_3, uint param_4, uint param_5, undefined4 * param_6, void * param_7, longlong * param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvNetTdiReceiveHandler Called Diff ```diff --- SrvNetTdiReceiveHandler called +++ SrvNetTdiReceiveHandler called @@ -0,0 +1,2 @@ +Feature_3107684665__private_IsEnabledDeviceUsageNoInline +NTOSKRNL.EXE::ExAcquireRundownProtection @@ -1,0 +4 @@ +NTOSKRNL.EXE::IoFreeIrp @@ -9 +12 @@ -memmove +memcpy ``` ### SrvNetTdiReceiveHandler Diff ```diff --- SrvNetTdiReceiveHandler +++ SrvNetTdiReceiveHandler @@ -1,93 +1,103 @@ undefined8 SrvNetTdiReceiveHandler (undefined8 param_1,longlong param_2,undefined8 param_3,uint param_4,uint param_5, undefined4 *param_6,void *param_7,longlong *param_8) { longlong lVar1; undefined8 uVar2; code *pcVar3; undefined1 uVar4; - undefined8 *puVar5; + char cVar5; undefined8 *puVar6; - longlong lVar7; - undefined8 *puVar8; - undefined8 *puVar9; - undefined1 *puVar10; + undefined8 *puVar7; + longlong lVar8; + ulonglong uVar9; + undefined8 *puVar10; + undefined8 *puVar11; + undefined1 *puVar12; undefined1 auStack_48 [8]; undefined1 auStack_40 [24]; undefined8 local_28; longlong local_20; - puVar10 = auStack_48; - puVar5 = (undefined8 *)SrvNetAllocateBuffer((ulonglong)param_5,0); - if (puVar5 != (undefined8 *)0x0) { + puVar12 = auStack_48; + puVar6 = (undefined8 *)SrvNetAllocateBuffer((ulonglong)param_5,0); + if (puVar6 != (undefined8 *)0x0) { if (param_4 == param_5) { - memmove((void *)puVar5[3],param_7,(ulonglong)param_5); - *(uint *)((longlong)puVar5 + 0x24) = param_5; + memcpy((void *)puVar6[3],param_7,(ulonglong)param_5); + *(uint *)((longlong)puVar6 + 0x24) = param_5; uVar4 = KeAcquireSpinLockRaiseToDpc(param_2 + 0x50); - puVar8 = (undefined8 *)(param_2 + 0x58); - puVar9 = *(undefined8 **)(param_2 + 0x60); - puVar6 = (undefined8 *)*puVar8; - if ((undefined8 *)*puVar9 != puVar8) { - puVar8 = (undefined8 *)0x3; + puVar10 = (undefined8 *)(param_2 + 0x58); + puVar11 = *(undefined8 **)(param_2 + 0x60); + puVar7 = (undefined8 *)*puVar10; + if ((undefined8 *)*puVar11 != puVar10) { + puVar10 = (undefined8 *)0x3; pcVar3 = (code *)swi(0x29); - puVar6 = (undefined8 *)(*pcVar3)(); - puVar10 = auStack_40; + puVar7 = (undefined8 *)(*pcVar3)(); + puVar12 = auStack_40; } - *puVar5 = puVar8; - puVar5[1] = puVar9; - *puVar9 = puVar5; - puVar8[1] = puVar5; - if (puVar6 == puVar8) { - *(undefined8 *)(puVar10 + -8) = 0x1400171fa; + *puVar6 = puVar10; + puVar6[1] = puVar11; + *puVar11 = puVar6; + puVar10[1] = puVar6; + if (puVar7 == puVar10) { + *(undefined8 *)(puVar12 + -8) = 0x1400183aa; SrvNetIndicateData(param_2); } - *(undefined8 *)(puVar10 + -8) = 0x140017208; + *(undefined8 *)(puVar12 + -8) = 0x1400183b8; KeReleaseSpinLock(param_2 + 0x50,uVar4); - **(uint **)(puVar10 + 0x78) = param_5; + **(uint **)(puVar12 + 0x78) = param_5; return 0; } - lVar7 = IoAllocateIrp(CONCAT71((int7)((ulonglong)*(longlong *)(param_2 + 0x198) >> 8), - *(undefined1 *)(*(longlong *)(param_2 + 0x198) + 0x4c)),0); - if (lVar7 != 0) { - *(undefined8 *)(lVar7 + 0x18) = 0; - *(undefined1 *)(lVar7 + 0x40) = 0; - *(undefined4 *)(lVar7 + 0x10) = 0x10; - puVar5[0xb] = param_2; - lVar1 = *(longlong *)(lVar7 + 0xb8); - *(code **)(lVar1 + -0x10) = SrvNetTdiReceiveCompletion; - *(undefined8 **)(lVar1 + -8) = puVar5; - *(undefined1 *)(lVar1 + -0x45) = 0xe0; - lVar1 = *(longlong *)(lVar7 + 0xb8); - *(undefined2 *)(lVar1 + -0x48) = 0x80f; - *(undefined8 *)(lVar1 + -0x20) = *(undefined8 *)(param_2 + 0x198); - *(undefined8 *)(lVar1 + -0x18) = *(undefined8 *)(param_2 + 400); - *(undefined4 *)(lVar1 + -0x3c) = 0x20; - *(uint *)(lVar1 + -0x40) = param_5; - uVar2 = puVar5[7]; - *(char *)(lVar7 + 0x43) = *(char *)(lVar7 + 0x43) + -1; - *(longlong *)(lVar7 + 0xb8) = *(longlong *)(lVar7 + 0xb8) + -0x48; - *(undefined8 *)(lVar7 + 8) = uVar2; - *param_8 = lVar7; - *param_6 = 0; - return 0xc0000016; + lVar8 = IoAllocateIrp(CONCAT71((int7)((ulonglong)*(longlong *)(param_2 + 0x198) >> 8), + *(undefined1 *)(*(longlong *)(param_2 + 0x198) + 0x4c))); + if (lVar8 != 0) { + *(undefined8 *)(lVar8 + 0x18) = 0; + *(undefined1 *)(lVar8 + 0x40) = 0; + *(undefined4 *)(lVar8 + 0x10) = 0x10; + uVar9 = Feature_3107684665__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar9 == 0) || (cVar5 = ExAcquireRundownProtection(param_2 + 0x288), cVar5 != '\0')) + { + puVar6[0xb] = param_2; + lVar1 = *(longlong *)(lVar8 + 0xb8); + *(code **)(lVar1 + -0x10) = SrvNetTdiReceiveCompletion; + *(undefined8 **)(lVar1 + -8) = puVar6; + *(undefined1 *)(lVar1 + -0x45) = 0xe0; + lVar1 = *(longlong *)(lVar8 + 0xb8); + *(undefined2 *)(lVar1 + -0x48) = 0x80f; + *(undefined8 *)(lVar1 + -0x20) = *(undefined8 *)(param_2 + 0x198); + *(undefined8 *)(lVar1 + -0x18) = *(undefined8 *)(param_2 + 400); + *(undefined4 *)(lVar1 + -0x3c) = 0x20; + *(uint *)(lVar1 + -0x40) = param_5; + uVar2 = puVar6[7]; + *(char *)(lVar8 + 0x43) = *(char *)(lVar8 + 0x43) + -1; + *(longlong *)(lVar8 + 0xb8) = *(longlong *)(lVar8 + 0xb8) + -0x48; + *(undefined8 *)(lVar8 + 8) = uVar2; + *param_8 = lVar8; + *param_6 = 0; + return 0xc0000016; + } + IoFreeIrp(lVar8); + SrvNetFreeBuffer((longlong)puVar6); + goto LAB_0; } } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) { local_28 = param_1; local_20 = param_2; WPP_SF_dqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x18, - &WPP_5f168678fbca3bbc23775afb8d6e9a10_Traceguids,0xc000009a); + &WPP_9765075cfac73e391792090c0ed19e33_Traceguids,0xc000009a); } - if (puVar5 != (undefined8 *)0x0) { - SrvNetFreeBuffer((longlong)puVar5); + if (puVar6 != (undefined8 *)0x0) { + SrvNetFreeBuffer((longlong)puVar6); } SrvNetDisconnectConnectionInternalEx(param_2,0); +LAB_0: *param_6 = 0; return 0xc000021b; } ``` ## SrvNetTdiReceiveCompletion ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.57| |i_ratio|0.83| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|SrvNetTdiReceiveCompletion|SrvNetTdiReceiveCompletion| |fullname|SrvNetTdiReceiveCompletion|SrvNetTdiReceiveCompletion| |refcount|4|4| |`length`|208|236| |`called`|NTOSKRNL.EXE::IoFreeIrp
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
SrvNetDisconnectConnectionInternalEx
SrvNetFreeBuffer
SrvNetIndicateData|Feature_3107684665__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoFreeIrp
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
SrvNetDisconnectConnectionInternalEx
SrvNetFreeBuffer
SrvNetIndicateData| |calling||| |paramcount|3|3| |`address`|140017080|140018210| |sig|undefined8 __fastcall SrvNetTdiReceiveCompletion(undefined8 param_1, longlong param_2, undefined8 * param_3)|undefined8 __fastcall SrvNetTdiReceiveCompletion(undefined8 param_1, longlong param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvNetTdiReceiveCompletion Called Diff ```diff --- SrvNetTdiReceiveCompletion called +++ SrvNetTdiReceiveCompletion called @@ -0,0 +1,2 @@ +Feature_3107684665__private_IsEnabledDeviceUsageNoInline +NTOSKRNL.EXE::ExReleaseRundownProtection ``` ### SrvNetTdiReceiveCompletion Diff ```diff --- SrvNetTdiReceiveCompletion +++ SrvNetTdiReceiveCompletion @@ -1,50 +1,57 @@ undefined8 SrvNetTdiReceiveCompletion(undefined8 param_1,longlong param_2,undefined8 *param_3) { longlong lVar1; code *pcVar2; undefined1 uVar3; undefined8 *puVar4; - undefined8 *puVar5; + ulonglong uVar5; undefined8 *puVar6; - undefined1 *puVar7; + undefined8 *puVar7; + undefined1 *puVar8; undefined1 auStack_28 [8]; undefined1 auStack_20 [24]; - puVar7 = auStack_28; + puVar8 = auStack_28; lVar1 = param_3[0xb]; param_3[0xb] = 0; if (*(int *)(param_2 + 0x30) < 0) { SrvNetFreeBuffer((longlong)param_3); SrvNetDisconnectConnectionInternalEx(lVar1,0); } else { *(undefined4 *)((longlong)param_3 + 0x24) = *(undefined4 *)(param_2 + 0x38); uVar3 = KeAcquireSpinLockRaiseToDpc(lVar1 + 0x50); - puVar5 = (undefined8 *)(lVar1 + 0x58); - puVar6 = *(undefined8 **)(lVar1 + 0x60); - puVar4 = (undefined8 *)*puVar5; - puVar7 = auStack_28; - if ((undefined8 *)*puVar6 != puVar5) { - puVar5 = (undefined8 *)0x3; + puVar6 = (undefined8 *)(lVar1 + 0x58); + puVar7 = *(undefined8 **)(lVar1 + 0x60); + puVar4 = (undefined8 *)*puVar6; + puVar8 = auStack_28; + if ((undefined8 *)*puVar7 != puVar6) { + puVar6 = (undefined8 *)0x3; pcVar2 = (code *)swi(0x29); puVar4 = (undefined8 *)(*pcVar2)(); - puVar7 = auStack_20; + puVar8 = auStack_20; } - *param_3 = puVar5; - param_3[1] = puVar6; - *puVar6 = param_3; - puVar5[1] = param_3; - if (puVar4 == puVar5) { - *(undefined8 *)(puVar7 + -8) = 0x1400170fa; + *param_3 = puVar6; + param_3[1] = puVar7; + *puVar7 = param_3; + puVar6[1] = param_3; + if (puVar4 == puVar6) { + *(undefined8 *)(puVar8 + -8) = 0x14001828a; SrvNetIndicateData(lVar1); } - *(undefined8 *)(puVar7 + -8) = 0x140017108; + *(undefined8 *)(puVar8 + -8) = 0x140018298; KeReleaseSpinLock(lVar1 + 0x50,uVar3); } - *(undefined8 *)(puVar7 + -8) = 0x14001712b; + *(undefined8 *)(puVar8 + -8) = 0x1400182b6; + uVar5 = Feature_3107684665__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 != 0) { + *(undefined8 *)(puVar8 + -8) = 0x1400182c8; + ExReleaseRundownProtection(lVar1 + 0x288); + } + *(undefined8 *)(puVar8 + -8) = 0x1400182d7; IoFreeIrp(param_2); return 0xc0000016; } ``` ## SrvNetEndpointReopenTdiConnections ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.58| |i_ratio|0.62| |m_ratio|0.97| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|SrvNetEndpointReopenTdiConnections|SrvNetEndpointReopenTdiConnections| |fullname|SrvNetEndpointReopenTdiConnections|SrvNetEndpointReopenTdiConnections| |refcount|2|2| |`length`|496|515| |`called`|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
RfsAppendList
SrvNetFreeConnection
SrvNetTdiCloseConnection
SrvNetTdiOpenConnection|Feature_1180933432__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeReleaseSpinLock
RfsAppendList
SrvNetFreeConnection
SrvNetTdiCloseConnection
SrvNetTdiOpenConnection| |calling|SrvNetAllocateScavengerThread|SrvNetAllocateScavengerThread| |paramcount|1|1| |`address`|140016098|140016900| |sig|undefined __fastcall SrvNetEndpointReopenTdiConnections(longlong param_1)|undefined __fastcall SrvNetEndpointReopenTdiConnections(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvNetEndpointReopenTdiConnections Called Diff ```diff --- SrvNetEndpointReopenTdiConnections called +++ SrvNetEndpointReopenTdiConnections called @@ -0,0 +1 @@ +Feature_1180933432__private_IsEnabledDeviceUsageNoInline ``` ### SrvNetEndpointReopenTdiConnections Diff ```diff --- SrvNetEndpointReopenTdiConnections +++ SrvNetEndpointReopenTdiConnections @@ -1,91 +1,101 @@ void SrvNetEndpointReopenTdiConnections(longlong param_1) { longlong lVar1; longlong ****pppplVar2; longlong ****pppplVar3; longlong ****pppplVar4; code *pcVar5; longlong ***ppplVar6; undefined1 uVar7; ulonglong uVar8; int iVar9; int iVar10; - longlong ***local_48; + bool bVar11; + undefined8 ***local_48; longlong ***local_40; - undefined8 ***local_38; + longlong ***local_38; longlong ***local_30; longlong ***local_28; longlong ***local_20; local_20 = (longlong ***)&local_28; lVar1 = param_1 + 0x18; local_28 = (longlong ***)&local_28; iVar10 = 0; + local_40 = (longlong ***)&local_48; + iVar9 = 0; + local_48 = &local_48; local_30 = (longlong ***)&local_38; - iVar9 = 0; - local_38 = &local_38; - local_40 = (longlong ***)&local_48; - local_48 = (longlong ***)&local_48; + local_38 = (longlong ***)&local_38; uVar7 = KeAcquireSpinLockRaiseToDpc(lVar1); if (*(char *)(param_1 + 0x91) == '\0') { RfsAppendList((longlong)&local_28,(longlong *)(param_1 + 0xc0)); } KeReleaseSpinLock(lVar1,uVar7); while (ppplVar6 = local_28, pppplVar3 = (longlong ****)local_28, (longlong ****)local_28 != &local_28) { if (((longlong ****)local_28[1] != &local_28) || (pppplVar4 = (longlong ****)*local_28, pppplVar4[1] != local_28)) goto LAB_0; pppplVar4[1] = (longlong ***)&local_28; pppplVar2 = (longlong ****)(local_28 + -0x40); local_28 = (longlong ***)pppplVar4; uVar8 = SrvNetTdiOpenConnection((longlong)pppplVar2); if ((int)uVar8 < 0) { - if ((longlong ****)*local_40 != &local_48) goto LAB_0; + if ((longlong ****)*local_30 != &local_38) goto LAB_0; + ppplVar6[1] = (longlong **)local_30; + *ppplVar6 = (longlong **)&local_38; + iVar9 = iVar9 + 1; + *local_30 = (longlong **)ppplVar6; + local_30 = (longlong ***)pppplVar3; + } + else { + if ((undefined8 ****)*local_40 != &local_48) goto LAB_0; ppplVar6[1] = (longlong **)local_40; *ppplVar6 = (longlong **)&local_48; - iVar9 = iVar9 + 1; + iVar10 = iVar10 + 1; *local_40 = (longlong **)ppplVar6; local_40 = (longlong ***)pppplVar3; } - else { - if ((undefined8 ****)*local_30 != &local_38) goto LAB_0; - ppplVar6[1] = (longlong **)local_30; - *ppplVar6 = (longlong **)&local_38; - iVar10 = iVar10 + 1; - *local_30 = (longlong **)ppplVar6; - local_30 = (longlong ***)pppplVar3; - } } - if ((undefined8 ****)local_38 != &local_38) { - uVar7 = KeAcquireSpinLockRaiseToDpc(lVar1); - if (*(char *)(param_1 + 0x91) == '\0') { - RfsAppendList(param_1 + 0xd0,(longlong *)&local_38); - } - else { - RfsAppendList((longlong)&local_48,(longlong *)&local_38); - iVar9 = iVar9 + iVar10; - } - *(int *)(param_1 + 0xa8) = *(int *)(param_1 + 0xa8) - iVar9; - KeReleaseSpinLock(lVar1,uVar7); + uVar8 = Feature_1180933432__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 == 0) { + bVar11 = (undefined8 ****)local_48 == &local_48; +LAB_1: + if (bVar11) goto LAB_2; } + else if ((undefined8 ****)local_48 == &local_48) { + bVar11 = iVar9 == 0; + goto LAB_1; + } + uVar7 = KeAcquireSpinLockRaiseToDpc(lVar1); + if (*(char *)(param_1 + 0x91) == '\0') { + RfsAppendList(param_1 + 0xd0,(longlong *)&local_48); + } + else { + RfsAppendList((longlong)&local_38,(longlong *)&local_48); + iVar9 = iVar9 + iVar10; + } + *(int *)(param_1 + 0xa8) = *(int *)(param_1 + 0xa8) - iVar9; + KeReleaseSpinLock(lVar1,uVar7); +LAB_2: while( true ) { - ppplVar6 = local_48; - if ((longlong ****)local_48 == &local_48) { + ppplVar6 = local_38; + if ((longlong ****)local_38 == &local_38) { return; } - if (((longlong ****)local_48[1] != &local_48) || - (pppplVar3 = (longlong ****)*local_48, pppplVar3[1] != local_48)) break; - pppplVar3[1] = (longlong ***)&local_48; - pppplVar4 = (longlong ****)(local_48 + -0x40); - local_48 = (longlong ***)pppplVar3; + if (((longlong ****)local_38[1] != &local_38) || + (pppplVar3 = (longlong ****)*local_38, pppplVar3[1] != local_38)) break; + pppplVar3[1] = (longlong ***)&local_38; + pppplVar4 = (longlong ****)(local_38 + -0x40); + local_38 = (longlong ***)pppplVar3; SrvNetTdiCloseConnection((longlong)pppplVar4); SrvNetFreeConnection((longlong)(ppplVar6 + -0x40)); } LAB_0: pcVar5 = (code *)swi(0x29); (*pcVar5)(3); return; } ``` ## SrvNetCommonReceiveHandler ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,called| |ratio|0.08| |i_ratio|0.05| |m_ratio|0.41| |b_ratio|0.09| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|SrvNetCommonReceiveHandler|SrvNetCommonReceiveHandler| |fullname|SrvNetCommonReceiveHandler|SrvNetCommonReceiveHandler| |`refcount`|7|6| |`length`|829|3103| |`called`|NTOSKRNL.EXE::EtwProviderEnabled
NTOSKRNL.EXE::IoGetActivityIdThread
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
SrvNetCloseConnectionWithLock
Template_qqbqb_ex
__security_check_cookie
_guard_dispatch_icall|
Expand for full list:
Feature_3107684665__private_IsEnabledDeviceUsageNoInline
McTemplateK0_EtwWriteTransfer
McTemplateK0s_EtwWriteTransfer
NTOSKRNL.EXE::EtwProviderEnabled
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoGetActivityIdThread
NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeQueryTimeIncrementNTOSKRNL.EXE::KeReleaseSpinLock
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
SrvNetCloseConnectionWithLock
Template_qqbjqb_ex
Template_qqbqb_ex
WPP_SF_
WPP_SF_q
WPP_SF_qDq
WPP_SF_qd
WPP_SF_qdq
__security_check_cookie
_guard_dispatch_icall
| |calling|SrvNetIndicateData
SrvNetRdmaReceiveEvent
SrvNetWskReceiveComplete
SrvNetWskReceiveEvent|SrvNetIndicateData
SrvNetRdmaReceiveEvent
SrvNetWskReceiveComplete
SrvNetWskReceiveEvent| |paramcount|7|7| |`address`|140003d50|140003fd0| |`sig`|ulonglong __fastcall SrvNetCommonReceiveHandler(longlong param_1, uint param_2, undefined8 param_3, undefined4 param_4, int * param_5, undefined8 param_6, undefined8 param_7)|int __fastcall SrvNetCommonReceiveHandler(longlong param_1, ulonglong param_2, int * param_3, undefined4 param_4, int * param_5, undefined8 param_6, undefined8 param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvNetCommonReceiveHandler Called Diff ```diff --- SrvNetCommonReceiveHandler called +++ SrvNetCommonReceiveHandler called @@ -0,0 +1,3 @@ +Feature_3107684665__private_IsEnabledDeviceUsageNoInline +McTemplateK0_EtwWriteTransfer +McTemplateK0s_EtwWriteTransfer @@ -1,0 +5,3 @@ +NTOSKRNL.EXE::EtwWriteTransfer +NTOSKRNL.EXE::ExAcquireRundownProtection +NTOSKRNL.EXE::ExReleaseRundownProtection @@ -3,0 +10,3 @@ +NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc +NTOSKRNL.EXE::KeQueryTimeIncrement +NTOSKRNL.EXE::KeReleaseSpinLock @@ -5,0 +15 @@ +Template_qqbjqb_ex @@ -6,0 +17,5 @@ +WPP_SF_ +WPP_SF_q +WPP_SF_qDq +WPP_SF_qd +WPP_SF_qdq ``` ### SrvNetCommonReceiveHandler Diff ```diff --- SrvNetCommonReceiveHandler +++ SrvNetCommonReceiveHandler @@ -1,377 +1,491 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Type propagation algorithm not settling */ +/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -ulonglong SrvNetCommonReceiveHandler - (longlong param_1,uint param_2,int *param_3,undefined4 param_4,int *param_5, - undefined8 param_6,undefined8 param_7) +int SrvNetCommonReceiveHandler + (longlong param_1,ulonglong param_2,int *param_3,undefined4 param_4,int *param_5, + undefined8 param_6,undefined8 param_7) { - undefined8 *puVar1; - longlong *plVar2; - undefined8 *puVar3; - undefined8 *puVar4; + int iVar1; + undefined4 uVar2; + longlong lVar3; + undefined8 uVar4; longlong *plVar5; code *pcVar6; - byte bVar7; - char cVar8; - ushort uVar9; - undefined2 uVar10; - uint uVar11; - int iVar12; - char *******pppppppcVar13; - ulonglong uVar14; - char *******pppppppcVar15; - longlong lVar16; + char cVar7; + undefined1 uVar8; + int iVar9; + uint uVar10; + longlong *plVar11; + char *pcVar12; + longlong lVar13; + undefined *puVar14; + longlong lVar15; + undefined8 uVar16; ulonglong uVar17; - int *piVar18; - undefined4 in_register_0000008c; - undefined8 auStackY_158 [4]; - undefined8 in_stack_fffffffffffffec8; - undefined4 uVar19; - uint local_108; - char *******local_f8; - undefined4 local_f0 [2]; - undefined8 local_e8; - longlong local_e0; - char *******local_d8; - char *pcStack_d0; - uint auStack_c8 [2]; - undefined8 uStack_c0; - undefined8 uStack_b8; - undefined8 uStack_b0; - undefined4 uStack_a8; - uint uStack_a4; - undefined8 auStack_98 [4]; - undefined4 *puStack_78; - undefined8 uStack_70; - undefined8 *puStack_68; - undefined8 uStack_60; + undefined1 *puVar18; + ushort uVar19; + int *piVar20; + bool bVar21; + undefined1 auStackY_198 [32]; + undefined8 in_stack_fffffffffffffe88; + undefined4 uVar22; + char local_148 [48]; + int *local_118; + undefined8 local_110; + undefined8 local_108; + undefined8 local_100; + longlong local_f8 [2]; + uint local_e8 [2]; + undefined8 local_e0; + undefined8 uStack_d8; + undefined8 local_d0; + undefined4 local_c8; + uint local_c4; + undefined *local_c0; + undefined8 local_b8; + undefined *local_b0; + undefined4 local_a8; + undefined4 local_a4; + undefined *local_98; + uint local_90; + undefined4 local_8c; + undefined *local_88; + undefined4 local_80; + undefined4 local_7c; + undefined1 *local_78; + undefined8 local_70; + undefined1 *local_68; + undefined8 local_60; ulonglong local_58; - uVar19 = (undefined4)((ulonglong)in_stack_fffffffffffffec8 >> 0x20); - pppppppcVar13 = (char *******)CONCAT44(in_register_0000008c,param_4); - local_58 = __security_cookie ^ (ulonglong)auStackY_158; - local_e8 = param_6; - local_e0 = param_7; - local_f0[0] = param_4; + uVar22 = (undefined4)((ulonglong)in_stack_fffffffffffffe88 >> 0x20); + puVar18 = auStackY_198; + local_58 = __security_cookie ^ (ulonglong)auStackY_198; + uVar17 = param_2 & 0xffffffff; + local_100 = param_6; + local_108 = param_7; + local_118 = param_3; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29]) ) { - pppppppcVar13 = (char *******)param_1; - WPP_SF_qDq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),&WPP_GLOBAL_Control,param_3,param_1); + WPP_SF_qDq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),param_2,param_3,param_1); } - uVar9 = *(ushort *)(param_1 + 0x1e0); - local_d8 = (char *******)0x0; - pcStack_d0 = (char *)0x0; + uVar19 = *(ushort *)(param_1 + 0x1e0); + local_f8[0] = 0; + local_f8[1] = 0; if ((DAT_0 & 4) != 0) { param_3 = (int *)0x200000000; - cVar8 = EtwProviderEnabled(PROV_SRV2_Context,0); - if (cVar8 != '\0') { - cVar8 = EtwProviderEnabled(PROV_SRV2_Context,0,0x800000000000); - local_108 = param_2; - if (((cVar8 == '\0') && (0x3f < param_2)) && - ((*param_5 == 0x424d53fe && (local_108 = param_5[5] + 0x240, param_2 < local_108)))) { - local_108 = param_2; - } - pppppppcVar13 = (char *******)IoGetActivityIdThread(); - if (pppppppcVar13 == (char *******)0x0) { - pcStack_d0 = (char *)0x0; + cVar7 = EtwProviderEnabled(); + if (cVar7 != '\0') { + uVar16 = 0; + cVar7 = EtwProviderEnabled(PROV_SRV2_Context,0,0x800000000000); + if (((cVar7 == '\0') && (0x3f < (uint)param_2)) && + ((*param_5 == 0x424d53fe && + (uVar17 = (ulonglong)(param_5[5] + 0x240U), (uint)param_2 < param_5[5] + 0x240U)))) { + uVar17 = param_2 & 0xffffffff; + } + plVar11 = (longlong *)IoGetActivityIdThread(); + if (plVar11 == (longlong *)0x0) { + uVar16 = 0; + local_f8[1] = 0; LOCK(); UNLOCK(); - local_d8 = (char *******)(Correlation + 1); - pppppppcVar13 = (char *******)&local_d8; + local_f8[0] = Correlation + 1; + plVar11 = local_f8; Correlation = Correlation + 1; } - auStack_c8[0] = (uint)uVar9; - local_f8 = pppppppcVar13; - if (0xefff < local_108) { - uStack_a8 = *(undefined4 *)(param_1 + 0x98); - uStack_c0 = *(undefined8 *)(param_1 + 0x80); - uStack_b8 = *(undefined8 *)(param_1 + 0x88); - uStack_b0 = *(undefined8 *)(param_1 + 0x90); - piVar18 = (int *)0x240000000; - uStack_a4 = local_108; - auStack_c8[1] = 0x1c; - uVar11 = Template_qqbjqb_ex(PROV_SRV2_Context,pppppppcVar13,0x240000000,pppppppcVar13,0x28, - auStack_c8); - uVar14 = FUN_140004090(local_108,(ulonglong)uVar11,piVar18,(char *)pppppppcVar13); - return uVar14; - } - param_3 = (int *)0x200000000; - Template_qqbqb_ex(PROV_SRV2_Context,pppppppcVar13,0x200000000,pppppppcVar13, - CONCAT44(uVar19,auStack_c8[0]),0x1c,param_1 + 0x80,local_108,param_5); + uVar10 = (uint)uVar17; + if (uVar10 < 0xf000) { + param_3 = (int *)0x200000000; + Template_qqbqb_ex(PROV_SRV2_Context,uVar16,0x200000000,plVar11,CONCAT44(uVar22,(uint)uVar19) + ,0x1c,(undefined8 *)(param_1 + 0x80),uVar10,param_5); + } + else { + local_c8 = *(undefined4 *)(param_1 + 0x98); + param_3 = (int *)0x240000000; + local_e0 = *(undefined8 *)(param_1 + 0x80); + uStack_d8 = *(undefined8 *)(param_1 + 0x88); + local_d0 = *(undefined8 *)(param_1 + 0x90); + local_e8[1] = 0x1c; + local_e8[0] = (uint)uVar19; + local_c4 = uVar10; + iVar9 = Template_qqbjqb_ex(PROV_SRV2_Context,uVar16,0x240000000,plVar11,0x28,local_e8); + piVar20 = param_5; + do { + if (iVar9 < 0) break; + param_3 = (int *)0x200000000; + uVar10 = (uint)uVar17; + if ((uVar10 < 0xf000) || (uVar17 = 0xf000, uVar10 == 0xf000)) { + param_3 = (int *)0x280000000; + } + iVar9 = Template_qqbjqb_ex(PROV_SRV2_Context,uVar16,(ulonglong)param_3,plVar11,(int)uVar17 + ,piVar20); + piVar20 = (int *)((longlong)piVar20 + uVar17); + uVar10 = uVar10 - (int)uVar17; + uVar17 = (ulonglong)uVar10; + } while (uVar10 != 0); + } } } if (*(int *)(param_1 + 0x1e4) == 3) { - uVar11 = (**(code **)(*(longlong *)(param_1 + 0x1b8) + 8)) - (*(undefined8 *)(param_1 + 0x1c8),*(undefined8 *)(param_1 + 0x1d0),param_4, - param_2); - uVar14 = (ulonglong)uVar11; - if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { - return uVar14; - } - if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0) { - if (1 < (byte)WPP_GLOBAL_Control[0x29]) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xb, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids,*(undefined8 *)(param_1 + 0x1d0)) - ; - return uVar14; - } - return uVar14; - } - return uVar14; + iVar9 = (**(code **)(*(longlong *)(param_1 + 0x1b8) + 8)) + (*(undefined8 *)(param_1 + 0x1c8),*(undefined8 *)(param_1 + 0x1d0),param_4, + param_2 & 0xffffffff); + puVar18 = auStackY_198; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar18 = auStackY_198, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && + (puVar18 = auStackY_198, 1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xb, + &WPP_ffef5984912937d6253a54052cecd4cd_Traceguids,*(undefined8 *)(param_1 + 0x1d0)); + puVar18 = auStackY_198; + } + goto LAB_1; } - if (*(int *)(param_1 + 0x1e4) != 2) { - if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { - return 0xc000021b; - } - if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) == 0) { - return 0xc000021b; - } - if ((byte)WPP_GLOBAL_Control[0x29] < 2) { - return 0xc000021b; - } - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x13, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids); - return 0xc000021b; - } - local_e0 = *(longlong *)(param_1 + 0x1c0); - local_108 = -0x3ffffde5; - KeAcquireSpinLockAtDpcLevel(SrvNetDeviceExtension + 0x68); - uVar14 = *(ulonglong *)(*(longlong *)(param_1 + 0x1c0) + 0x120); - for (uVar9 = 0; uVar17 = uVar14, uVar9 < 5; uVar9 = uVar9 + 1) { - pppppppcVar15 = *(char ********)(SrvNetDeviceExtension + 0x1d0 + (ulonglong)uVar9 * 8); - local_f8 = pppppppcVar15; - if ((pppppppcVar15 != (char *******)0x0) && (*(char *)((longlong)pppppppcVar15 + 0xed) != '\0')) - { - if (uVar14 != 0) { - if (3 < *(byte *)((longlong)pppppppcVar15 + 0xe1)) { - pcVar6 = (code *)swi(0x2c); - (*pcVar6)(); - uVar14 = FUN_14002c061(pppppppcVar15,uVar14); - return uVar14; - } - if ((*(uint *)(uVar14 + 4) >> (*(byte *)((longlong)pppppppcVar15 + 0xe1) & 0x1f) & 1) == 0) - goto LAB_1; - } - iVar12 = *(int *)(param_1 + 0x1e0); - if (iVar12 == 0) { - bVar7 = *(byte *)(pppppppcVar15 + 0x1c) & 1; - } - else if (iVar12 == 1) { - bVar7 = *(byte *)(pppppppcVar15 + 0x1c) & 2; - } - else if (iVar12 == 2) { - bVar7 = *(byte *)(pppppppcVar15 + 0x1c) & 4; + if (*(int *)(param_1 + 0x1e4) == 2) { + lVar15 = *(longlong *)(param_1 + 0x1c0); + iVar9 = -0x3ffffde5; + KeAcquireSpinLockAtDpcLevel(SrvNetDeviceExtension + 0x68); + uVar19 = 0; + lVar13 = *(longlong *)(*(longlong *)(param_1 + 0x1c0) + 0x120); + do { + lVar3 = *(longlong *)(SrvNetDeviceExtension + 0x1d0 + (ulonglong)uVar19 * 8); + if ((lVar3 != 0) && (*(char *)(lVar3 + 0xed) != '\0')) { + if (lVar13 != 0) { + uVar10 = (uint)*(byte *)(lVar3 + 0xe1); + if (3 < *(byte *)(lVar3 + 0xe1)) { + pcVar6 = (code *)swi(0x2c); + uVar10 = (*pcVar6)(); + puVar18 = puVar18 + 8; + } + if ((*(uint *)(lVar13 + 4) >> (uVar10 & 0x1f) & 1) == 0) goto LAB_2; + } + iVar1 = *(int *)(param_1 + 0x1e0); + if (iVar1 == 0) { + bVar21 = (*(byte *)(lVar3 + 0xe0) & 1) == 0; + } + else if (iVar1 == 1) { + bVar21 = (*(byte *)(lVar3 + 0xe0) & 2) == 0; + } + else if (iVar1 == 2) { + bVar21 = (*(byte *)(lVar3 + 0xe0) & 4) == 0; + } + else { + if (iVar1 != 4) goto LAB_2; + bVar21 = (*(byte *)(lVar3 + 0xe0) & 8) == 0; + } + if ((!bVar21) && (*(char *)((ulonglong)*(uint *)(lVar3 + 0xe8) + 0x150 + lVar15) != '\0')) { + uVar16 = *(undefined8 *)(lVar15 + 0x128 + (ulonglong)*(uint *)(lVar3 + 0xe8) * 8); + pcVar6 = *(code **)(lVar3 + 0xb0); + *(undefined8 *)(puVar18 + -8) = 0x1400043e9; + param_3 = param_5; + iVar9 = (*pcVar6)(uVar16,*(undefined4 *)(puVar18 + 0x54)); + if (-1 < iVar9) { + *(undefined8 *)(puVar18 + -8) = 0x1400043f5; + uVar17 = Feature_3107684665__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar17 != 0) { + uVar10 = *(uint *)(lVar3 + 0xe8); + *(undefined8 *)(puVar18 + -8) = 0x140004419; + cVar7 = ExAcquireRundownProtection + (*(longlong *)(puVar18 + 0x70) + 0x158 + (ulonglong)uVar10 * 8); + puVar18[0x50] = cVar7; + if (cVar7 == '\0') { + iVar9 = -0x3ffffde5; + goto LAB_3; + } + *(undefined4 *)(puVar18 + 0x6c) = *(undefined4 *)(lVar3 + 0xe8); + } + *(undefined8 *)(param_1 + 0x1c8) = uVar16; + *(longlong *)(param_1 + 0x1b8) = lVar3 + 0xb8; + *(undefined1 *)(param_1 + 0x1ec) = *(undefined1 *)(lVar3 + 0xe1); + puVar14 = WPP_GLOBAL_Control; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar22 = *(undefined4 *)(lVar3 + 0xe8); + param_3 = (int *)&WPP_ffef5984912937d6253a54052cecd4cd_Traceguids; + puVar14 = *(undefined **)(WPP_GLOBAL_Control + 0x18); + *(longlong *)(puVar18 + 0x28) = param_1; + *(undefined4 *)(puVar18 + 0x20) = uVar22; + *(undefined8 *)(puVar18 + -8) = 0x140004612; + WPP_SF_qdq(puVar14,0xc,&WPP_ffef5984912937d6253a54052cecd4cd_Traceguids,lVar3); + } + if ((SrvNetAuditSmb1Access != '\0') && (*(int *)(lVar3 + 0xe8) != 0)) { + if ((DAT_0 & 0x10) != 0) { + *(undefined8 *)(puVar18 + -8) = 0x140004645; + McTemplateK0s_EtwWriteTransfer + (puVar14,&SRVNET_EVENT_SMB1_ACCESS_AUDIT,param_3,(char *)(param_1 + 4)); + } + if (5 < DAT_4) { + if (((_DAT_5 & 0x400000000000) == 0) || + ((DAT_6 & 0x400000000000) != DAT_6)) { + bVar21 = false; + } + else { + bVar21 = true; + } + if (bVar21) { + local_b8 = 0x400000000000; + local_78 = puVar18 + 0x78; + *(undefined4 *)(puVar18 + 0x7c) = *(undefined4 *)(param_1 + 0x1e0); + *(undefined4 *)(puVar18 + 0x78) = 1; + param_3 = (int *)0x0; + local_98 = PTR_DAT_7; + local_70 = 4; + local_60 = 4; + local_c0 = (undefined *)0x50b000000; + local_90 = (uint)*(ushort *)PTR_DAT_7; + local_88 = &DAT_8; + local_8c = 2; + local_80 = 0x3c; + local_7c = 1; + local_68 = puVar18 + 0x7c; + *(undefined4 *)(puVar18 + 0x58) = 0x5bd; + *(undefined ***)(puVar18 + 0x28) = &local_98; + *(undefined4 *)(puVar18 + 0x20) = 4; + *(undefined8 *)(puVar18 + -8) = 0x140004741; + EtwWriteTransfer(DAT_9,&local_c0,0,0); + } + } + *(undefined8 *)(puVar18 + -8) = 0x140004758; + KeReleaseSpinLockFromDpcLevel(SrvNetDeviceExtension + 0x68); + goto LAB_10; + } + break; + } +LAB_3: + lVar15 = *(longlong *)(puVar18 + 0x70); + } + } +LAB_2: + uVar19 = uVar19 + 1; + } while (uVar19 < 5); + *(undefined8 *)(puVar18 + -8) = 0x14000445b; + KeReleaseSpinLockFromDpcLevel(SrvNetDeviceExtension + 0x68); + if (-1 < iVar9) { +LAB_10: + lVar15 = *(longlong *)(param_1 + 0x1c0); + *(undefined8 *)(puVar18 + 0x58) = 0; + *(undefined8 *)(puVar18 + 0x60) = 0; + *(undefined8 *)(puVar18 + -8) = 0x140004483; + KeAcquireSpinLockAtDpcLevel(lVar15 + 0x18); + cVar7 = *(char *)(*(longlong *)(param_1 + 0x1c0) + 0x91); + if ((((lVar13 != 0) && + ((*(uint *)(lVar13 + 4) >> (*(byte *)(param_1 + 0x1ec) & 0x1f) & 1) == 0)) && + (iVar9 = -0x3ffffde5, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0 && + (1 < (byte)WPP_GLOBAL_Control[0x29])))) { + uVar16 = *(undefined8 *)(param_1 + 0x1d0); + param_3 = (int *)&WPP_ffef5984912937d6253a54052cecd4cd_Traceguids; + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(undefined4 *)(puVar18 + 0x20) = 0xc000021b; + *(undefined8 *)(puVar18 + -8) = 0x1400044ed; + WPP_SF_qd(uVar4,0xd,&WPP_ffef5984912937d6253a54052cecd4cd_Traceguids,uVar16); + } + plVar11 = (longlong *)(param_1 + 0x200); + lVar13 = *plVar11; + if ((*(longlong **)(lVar13 + 8) == plVar11) && + (plVar5 = *(longlong **)(param_1 + 0x208), (longlong *)*plVar5 == plVar11)) { + *plVar5 = lVar13; + *(longlong **)(lVar13 + 8) = plVar5; + lVar13 = *(longlong *)(param_1 + 0x1c0); + plVar5 = *(longlong **)(lVar13 + 0xe8); + if (*plVar5 == lVar13 + 0xe0) { + *plVar11 = lVar13 + 0xe0; + *(longlong **)(param_1 + 0x208) = plVar5; + *plVar5 = (longlong)plVar11; + *(longlong **)(lVar13 + 0xe8) = plVar11; + lVar13 = *(longlong *)(param_1 + 0x1c0); + *(undefined8 *)(puVar18 + -8) = 0x140004550; + KeReleaseSpinLockFromDpcLevel(lVar13 + 0x18); + pcVar12 = (char *)(param_1 + 4); + *(char **)(puVar18 + 0x60) = pcVar12; + if (pcVar12 == (char *)0x0) { +LAB_11: + *(undefined2 *)(puVar18 + 0x58) = 0; + } + else { + lVar13 = 0x41; + do { + if (*pcVar12 == '\0') break; + pcVar12 = pcVar12 + 1; + lVar13 = lVar13 + -1; + } while (lVar13 != 0); + if (lVar13 == 0) goto LAB_11; + *(short *)(puVar18 + 0x58) = 0x41 - (short)lVar13; + } + if (iVar9 < 0) { +LAB_12: + *(undefined1 *)(param_1 + 0x265) = 1; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && + (WPP_GLOBAL_Control[0x29] != '\0')) { + uVar16 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(undefined8 *)(puVar18 + -8) = 0x14000490f; + WPP_SF_q(uVar16,0x11,&WPP_ffef5984912937d6253a54052cecd4cd_Traceguids,param_1); + } + *(undefined8 *)(puVar18 + -8) = 0x140004917; + SrvNetCloseConnectionWithLock(param_1); +LAB_13: + iVar9 = -0x3ffffde5; + } + else { + if (cVar7 == '\0') { + uVar16 = *(undefined8 *)(param_1 + 0x1c8); + pcVar6 = (code *)**(undefined8 **)(param_1 + 0x1b8); + *(undefined8 *)(puVar18 + -8) = 0x1400047a0; + iVar9 = (*pcVar6)(uVar16,param_1,puVar18 + 0x58,param_1 + 0x1d0); + } + else { + iVar9 = -0x3ffffdca; + } + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar16 = *(undefined8 *)(param_1 + 0x1c8); + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(int *)(puVar18 + 0x20) = iVar9; + *(undefined8 *)(puVar18 + -8) = 0x1400047dd; + WPP_SF_qd(uVar4,0xe,&WPP_ffef5984912937d6253a54052cecd4cd_Traceguids,uVar16); + } + if (iVar9 < 0) goto LAB_12; + lVar13 = *(longlong *)(param_1 + 0x1b8); + uVar22 = *(undefined4 *)(puVar18 + 0x54); + uVar2 = *(undefined4 *)(puVar18 + 0x68); + uVar16 = *(undefined8 *)(param_1 + 0x1d0); + *(undefined8 *)(puVar18 + 0x38) = local_108; + *(undefined8 *)(puVar18 + 0x30) = local_100; + piVar20 = local_118; + *(undefined4 *)(param_1 + 0x1e4) = 3; + pcVar6 = *(code **)(lVar13 + 8); + *(int **)(puVar18 + 0x28) = param_5; + *(int **)(puVar18 + 0x20) = piVar20; + uVar4 = *(undefined8 *)(param_1 + 0x1c8); + *(undefined8 *)(puVar18 + -8) = 0x140004837; + iVar9 = (*pcVar6)(uVar4,uVar16,uVar2,uVar22); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar16 = *(undefined8 *)(param_1 + 0x1d0); + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(int *)(puVar18 + 0x20) = iVar9; + *(undefined8 *)(puVar18 + -8) = 0x140004874; + WPP_SF_qd(uVar4,0xf,&WPP_ffef5984912937d6253a54052cecd4cd_Traceguids,uVar16); + } + if (((iVar9 + 0x80000000U & 0x80000000) == 0) && (iVar9 != -0x3fffffef)) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0 && + (1 < (byte)WPP_GLOBAL_Control[0x29])))) { + uVar16 = *(undefined8 *)(param_1 + 0x1d0); + uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(int *)(puVar18 + 0x20) = iVar9; + *(undefined8 *)(puVar18 + -8) = 0x1400048cb; + WPP_SF_qd(uVar4,0x10,&WPP_ffef5984912937d6253a54052cecd4cd_Traceguids,uVar16); + } + if (iVar9 == -0x3fffffea) goto LAB_14; + goto LAB_13; + } + } +LAB_14: + *(undefined8 *)(puVar18 + -8) = 0x140004921; + uVar17 = Feature_3107684665__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar17 != 0) && (puVar18[0x50] != '\0')) { + *(undefined8 *)(puVar18 + -8) = 0x14000494f; + ExReleaseRundownProtection + (*(longlong *)(puVar18 + 0x70) + (ulonglong)*(uint *)(puVar18 + 0x6c) * 8 + + 0x158); + } + goto LAB_1; + } + } + pcVar6 = (code *)swi(0x29); + (*pcVar6)(3); + puVar18 = puVar18 + 8; + } + if ((((0x23 < *(uint *)(puVar18 + 0x54)) && (*param_5 == 0x424d53ff)) && + ((char)param_5[1] == 'r')) && + (uVar17 = (ulonglong)*(ushort *)((longlong)param_5 + 0x21) + 0x23 + (longlong)param_5, + uVar17 <= (longlong)param_5 + (ulonglong)*(uint *)(puVar18 + 0x54))) { + if ((SrvNetAuditSmb1Access != '\0') && ((DAT_0 & 8) != 0)) { + *(undefined8 *)(puVar18 + -8) = 0x1400049c3; + McTemplateK0s_EtwWriteTransfer(uVar17,&AUDIT_SMB1_ACCESS,param_3,(char *)(param_1 + 4)); + } + *(undefined8 *)(puVar18 + -8) = 0x1400049d5; + uVar8 = KeAcquireSpinLockRaiseToDpc(SrvNetDeviceExtension + 0x68); + lVar13 = _DAT_15; + if (SrvNetSmb1DisabledOrUninstalledEventLastWrittenTickCount == 0) { +LAB_16: + lVar15 = SrvNetDeviceExtension + 0x68; + SrvNetSmb1DisabledOrUninstalledEventLastWrittenTickCount = lVar13; + *(undefined8 *)(puVar18 + -8) = 0x140004a63; + KeReleaseSpinLock(lVar15,uVar8); + if ((DAT_17 & 0x10) != 0) { + *(undefined8 *)(puVar18 + -8) = 0x140004a80; + McTemplateK0_EtwWriteTransfer(lVar15,&SRVNET_EVENT_SMB1_DISABLED_OR_NOT_INSTALLED,0); + } + if (5 < DAT_4) { + if (((_DAT_5 & 0x400000000000) == 0) || + ((DAT_6 & 0x400000000000) != DAT_6)) { + bVar21 = false; + } + else { + bVar21 = true; + } + if (bVar21) { + local_c0 = PTR_DAT_7; + local_110 = 0x400000000000; + local_118 = (int *)0x50b000000; + local_b0 = &DAT_18; + local_b8 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_7); + local_a8 = 0x15; + local_a4 = 1; + *(undefined4 *)(puVar18 + 0x58) = 0x5bd; + *(undefined ***)(puVar18 + 0x28) = &local_c0; + *(undefined4 *)(puVar18 + 0x20) = 2; + *(undefined8 *)(puVar18 + -8) = 0x140004b48; + EtwWriteTransfer(DAT_9,&local_118,0,0); + } + } } else { - if (iVar12 != 4) goto LAB_1; - bVar7 = *(byte *)(pppppppcVar15 + 0x1c) & 8; - } - if ((bVar7 != 0) && - (*(char *)((ulonglong)*(uint *)(pppppppcVar15 + 0x1d) + 0x150 + local_e0) != '\0')) { - pppppppcVar13 = - *(char ********)(local_e0 + 0x128 + (ulonglong)*(uint *)(pppppppcVar15 + 0x1d) * 8); - uVar17 = (ulonglong)param_2; - param_3 = param_5; - local_d8 = pppppppcVar13; - local_108 = (*(code *)pppppppcVar15[0x16])(pppppppcVar13); - if (-1 < (int)local_108) { - *(char ********)(param_1 + 0x1b8) = local_f8 + 0x17; - *(char ********)(param_1 + 0x1c8) = local_d8; - *(char *)(param_1 + 0x1ec) = *(char *)((longlong)local_f8 + 0xe1); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - param_3 = (int *)&WPP_1dc79513de593dda6c055ed826c3b955_Traceguids; - uVar17 = 0xc; - pppppppcVar13 = local_f8; - WPP_SF_qdq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xc, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids,local_f8); - } - if ((SrvNetAuditSmb1Access != '\0') && (*(int *)(local_f8 + 0x1d) != 0)) { - if ((DAT_0 & 0x10) != 0) { - pppppppcVar13 = (char *******)(param_1 + 4); - McTemplateK0s_EtwWriteTransfer - (local_f8,&SRVNET_EVENT_SMB1_ACCESS_AUDIT,param_3,(char *)pppppppcVar13); - } - if ((5 < DAT_2) && - (cVar8 = _tlgKeywordOn(0x140038120,0x400000000000), cVar8 != '\0')) { - puStack_78 = local_f0; - local_f0[0] = 1; - local_e8 = CONCAT44(local_e8._4_4_,*(undefined4 *)(param_1 + 0x1e0)); - puStack_68 = &local_e8; - uStack_70 = 4; - uStack_60 = 4; - _tlgWriteTransfer_EtwWriteTransfer - (0x140038120,&DAT_3,param_3,pppppppcVar13,4,auStack_98); - } - KeReleaseSpinLockFromDpcLevel(SrvNetDeviceExtension + 0x68); - goto LAB_4; - } - break; - } - } - } -LAB_1: - } - KeReleaseSpinLockFromDpcLevel(SrvNetDeviceExtension + 0x68); - if ((int)local_108 < 0) { - if ((((0x23 < param_2) && (*param_5 == 0x424d53ff)) && ((char)param_5[1] == 'r')) && - ((ulonglong)*(ushort *)((longlong)param_5 + 0x21) + 0x23 + (longlong)param_5 <= - (longlong)param_5 + (ulonglong)param_2)) { - SrvNetHandleUnclaimedSmb1Connection(param_1,uVar17,param_3,(char *)pppppppcVar13); + if (SrvNetSmb1DisabledOrUninstalledEventLastWrittenTickCount <= _DAT_15) { + *(undefined8 *)(puVar18 + -8) = 0x140004a22; + uVar10 = KeQueryTimeIncrement(); + if (863999999999 < + (longlong) + ((lVar13 - SrvNetSmb1DisabledOrUninstalledEventLastWrittenTickCount) * + (ulonglong)uVar10)) goto LAB_16; + } + *(undefined8 *)(puVar18 + -8) = 0x140004a11; + KeReleaseSpinLock(SrvNetDeviceExtension + 0x68,uVar8); + } } *(undefined1 *)(param_1 + 0x265) = 1; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0') ) { - uVar14 = FUN_14002c4cb((longlong)WPP_GLOBAL_Control); - return uVar14; - } -LAB_5: + uVar16 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(undefined8 *)(puVar18 + -8) = 0x140004b87; + WPP_SF_q(uVar16,0x12,&WPP_ffef5984912937d6253a54052cecd4cd_Traceguids,param_1); + } + *(undefined8 *)(puVar18 + -8) = 0x140004b8f; SrvNetCloseConnectionWithLock(param_1); - return 0xc000021b; } -LAB_4: - local_d8 = (char *******)0x0; - pcStack_d0 = (char *)0x0; - local_f8 = (char *******)0x0; - KeAcquireSpinLockAtDpcLevel(*(longlong *)(param_1 + 0x1c0) + 0x18); - cVar8 = *(char *)(*(longlong *)(param_1 + 0x1c0) + 0x91); - if (((uVar14 != 0) && ((*(uint *)(uVar14 + 4) >> (*(byte *)(param_1 + 0x1ec) & 0x1f) & 1) == 0)) - && ((local_108 = -0x3ffffde5, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control && - (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0 && - (1 < (byte)WPP_GLOBAL_Control[0x29])))))) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xd, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids,*(undefined8 *)(param_1 + 0x1d0)); + else { + puVar18 = auStackY_198; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar18 = auStackY_198, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && + (puVar18 = auStackY_198, 1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x13, + &WPP_ffef5984912937d6253a54052cecd4cd_Traceguids); + puVar18 = auStackY_198; + } } - plVar2 = (longlong *)(param_1 + 0x200); - lVar16 = *plVar2; - if ((*(longlong **)(lVar16 + 8) == plVar2) && - (plVar5 = *(longlong **)(param_1 + 0x208), (longlong *)*plVar5 == plVar2)) { - *plVar5 = lVar16; - *(longlong **)(lVar16 + 8) = plVar5; - lVar16 = *(longlong *)(param_1 + 0x1c0); - plVar5 = *(longlong **)(lVar16 + 0xe8); - if (*plVar5 == lVar16 + 0xe0) { - *plVar2 = lVar16 + 0xe0; - *(longlong **)(param_1 + 0x208) = plVar5; - *plVar5 = (longlong)plVar2; - *(longlong **)(lVar16 + 0xe8) = plVar2; - KeReleaseSpinLockFromDpcLevel(*(longlong *)(param_1 + 0x1c0) + 0x18); - pcStack_d0 = (char *)(param_1 + 4); - uVar11 = RtlStringCchLengthA(pcStack_d0,0x41,(longlong *)&local_f8); - if ((int)uVar11 < 0) { - uVar10 = 0; - } - else { - uVar10 = local_f8._0_2_; - } - local_d8 = (char *******)CONCAT62(local_d8._2_6_,uVar10); - if (-1 < (int)local_108) { - if (cVar8 == '\0') { - iVar12 = (*(code *)**(undefined8 **)(param_1 + 0x1b8)) - (*(undefined8 *)(param_1 + 0x1c8),param_1,&local_d8,param_1 + 0x1d0); - } - else { - iVar12 = -0x3ffffdca; - } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xe, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(param_1 + 0x1c8)); - } - if (-1 < iVar12) { - *(undefined4 *)(param_1 + 0x1e4) = 3; - uVar11 = (**(code **)(*(longlong *)(param_1 + 0x1b8) + 8)) - (*(undefined8 *)(param_1 + 0x1c8),*(undefined8 *)(param_1 + 0x1d0), - param_4,param_2); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xf, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(param_1 + 0x1d0)); - } - if ((uVar11 + 0x80000000 & 0x80000000) != 0) { - return (ulonglong)uVar11; - } - if (uVar11 == 0xc0000011) { - return 0xc0000011; - } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x10, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids, - *(undefined8 *)(param_1 + 0x1d0)); - } - if (uVar11 != 0xc0000016) { - return 0xc000021b; - } - return 0xc0000016; - } - } - *(undefined1 *)(param_1 + 0x265) = 1; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x200) != 0)) && - (WPP_GLOBAL_Control[0x29] != '\0')) { - WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x11, - &WPP_1dc79513de593dda6c055ed826c3b955_Traceguids,param_1); - } - goto LAB_5; - } - } - lVar16 = 3; - pcVar6 = (code *)swi(0x29); - uVar14 = (*pcVar6)(); - if (((*(uint *)(lVar16 + 0x2c) & 0x400) != 0) && (3 < *(byte *)(lVar16 + 0x29))) { - auStackY_158[0] = 0x14002c547; - uVar14 = WPP_SF_qDDDD(*(undefined8 *)(lVar16 + 0x18),0x19,(ulonglong)*(byte *)(param_1 + 0x264), - param_1); - } - if (*(char *)(param_1 + 0x266) == '\0') { - *(undefined2 *)(param_1 + 0x265) = 0x101; - if (1 < *(int *)(param_1 + 0x1e4) - 5U) { - *(undefined4 *)(param_1 + 0x1e4) = 4; - } - auStackY_158[0] = 0x140004352; - KeAcquireSpinLockAtDpcLevel(*(longlong *)(param_1 + 0x1c0) + 0x18); - puVar1 = (undefined8 *)(param_1 + 0x210); - puVar3 = (undefined8 *)*puVar1; - if (puVar3 != puVar1) { - if (((undefined8 *)puVar3[1] != puVar1) || - (puVar4 = *(undefined8 **)(param_1 + 0x218), (undefined8 *)*puVar4 != puVar1)) - goto LAB_6; - *puVar4 = puVar3; - puVar3[1] = puVar4; - } - auStackY_158[0] = 0x14000437c; - KeReleaseSpinLockFromDpcLevel(*(longlong *)(param_1 + 0x1c0) + 0x18); - auStackY_158[0] = 0x14000438f; - KeAcquireSpinLockAtDpcLevel(&SrvNetConnectionClosingListLock); - if ((undefined8 *)*DAT_7 != &SrvNetConnectionClosingList) { -LAB_6: - pcVar6 = (code *)swi(0x29); - (*pcVar6)(3); - pcVar6 = (code *)swi(3); - uVar14 = (*pcVar6)(); - return uVar14; - } - *puVar1 = &SrvNetConnectionClosingList; - *(undefined8 **)(param_1 + 0x218) = DAT_7; - *DAT_7 = puVar1; - auStackY_158[0] = 0x1400043c6; - DAT_7 = puVar1; - KeReleaseSpinLockFromDpcLevel(); - auStackY_158[0] = 0x1400043db; - uVar14 = SrvNetTriggerScavenger('\0','\x01','\0'); - } - return uVar14; + iVar9 = -0x3ffffde5; +LAB_1: + *(undefined8 *)(puVar18 + -8) = 0x140004bdb; + return iVar9; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|128|127| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|14002b058|14002b838| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## SrvNetCloseConnectionWithLock ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,length,address,called| |ratio|1.0| |i_ratio|0.74| |m_ratio|0.88| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|SrvNetCloseConnectionWithLock|SrvNetCloseConnectionWithLock| |fullname|SrvNetCloseConnectionWithLock|SrvNetCloseConnectionWithLock| |`refcount`|5|6| |`length`|292|385| |`called`|NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
SrvNetTriggerScavenger|NTOSKRNL.EXE::KeAcquireSpinLockAtDpcLevel
NTOSKRNL.EXE::KeReleaseSpinLockFromDpcLevel
SrvNetTriggerScavenger
WPP_SF_qDDDD| |calling|SrvNetCloseConnection
SrvNetCommonReceiveHandler
SrvNetDiscardPartiallyInitializedConnection|SrvNetCloseConnection
SrvNetCommonReceiveHandler
SrvNetDiscardPartiallyInitializedConnection| |paramcount|1|1| |`address`|1400042f4|140004c54| |sig|undefined __fastcall SrvNetCloseConnectionWithLock(longlong param_1)|undefined __fastcall SrvNetCloseConnectionWithLock(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SrvNetCloseConnectionWithLock Called Diff ```diff --- SrvNetCloseConnectionWithLock called +++ SrvNetCloseConnectionWithLock called @@ -3,0 +4 @@ +WPP_SF_qDDDD ``` ## NTOSKRNL.EXE::ExAcquireRundownProtection ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|ExAcquireRundownProtection|ExAcquireRundownProtection| |fullname|NTOSKRNL.EXE::ExAcquireRundownProtection|NTOSKRNL.EXE::ExAcquireRundownProtection| |`refcount`|17|19| |length|0|0| |called||| |`calling`|
Expand for full list:
InvalidationCompleteThread
InvalidationThread
PdcPortSendMessageSynchronously
SrvAdminNodeInvalidateFile
SrvAdminNodeInvalidateSession
SrvNetAcquireRdmaRundownProtection
SrvNetEndpointGetTransportHandle
SrvNetFreeEndpoint
SrvNetGetRdmaNicInfo
SrvNetRdmaDisconnectConnection
SrvNetRdmaGetLocalAddressSrvNetRdmaGetPeerAddress
SrvNetRdmaReadDirectData
SrvNetRdmaSendData
SrvNetRdmaWriteDirectData
SrvNetTdiConnectHandler
|
Expand for full list:
InvalidationCompleteThread
InvalidationThread
PdcPortSendMessageSynchronously
SrvAdminNodeInvalidateFile
SrvAdminNodeInvalidateSession
SrvNetAcquireRdmaRundownProtection
SrvNetCommonReceiveHandler
SrvNetEndpointGetTransportHandle
SrvNetFreeEndpoint
SrvNetGetRdmaNicInfo
SrvNetRdmaDisconnectConnectionSrvNetRdmaGetLocalAddress
SrvNetRdmaGetPeerAddress
SrvNetRdmaReadDirectData
SrvNetRdmaSendData
SrvNetRdmaWriteDirectData
SrvNetTdiConnectHandler
SrvNetTdiReceiveHandler
| |paramcount|0|0| |address|EXTERNAL:000000f8|EXTERNAL:000000f8| |sig|undefined ExAcquireRundownProtection(void)|undefined ExAcquireRundownProtection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAcquireRundownProtection Calling Diff ```diff --- NTOSKRNL.EXE::ExAcquireRundownProtection calling +++ NTOSKRNL.EXE::ExAcquireRundownProtection calling @@ -6,0 +7 @@ +SrvNetCommonReceiveHandler @@ -16,0 +18 @@ +SrvNetTdiReceiveHandler ``` ## NTOSKRNL.EXE::ExRundownCompleted ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|ExRundownCompleted|ExRundownCompleted| |fullname|NTOSKRNL.EXE::ExRundownCompleted|NTOSKRNL.EXE::ExRundownCompleted| |`refcount`|5|6| |length|0|0| |called||| |`calling`|PdcPortClose
SrvNetCloseEndpoint
SrvNetRdmaCloseSocket|PdcPortClose
SrvNetCloseEndpoint
SrvNetRdmaCloseSocket
SrvNetTdiCloseConnection| |paramcount|0|0| |address|EXTERNAL:00000004|EXTERNAL:00000004| |sig|undefined ExRundownCompleted(void)|undefined ExRundownCompleted(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExRundownCompleted Calling Diff ```diff --- NTOSKRNL.EXE::ExRundownCompleted calling +++ NTOSKRNL.EXE::ExRundownCompleted calling @@ -3,0 +4 @@ +SrvNetTdiCloseConnection ``` ## WPP_SF_q ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.92| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|WPP_SF_q|WPP_SF_q| |fullname|WPP_SF_q|WPP_SF_q| |`refcount`|31|32| |length|58|58| |called|_guard_dispatch_icall|_guard_dispatch_icall| |`calling`|
Expand for full list:
FUN_14002c4cb
SrvAdminDereferenceInstance
SrvAdminProcessFsctl
SrvIdSegRequestNodeInvalidationComplete
SrvNetAllocateConnection
SrvNetCloseEndpoint
SrvNetDeregisterClient
SrvNetDisconnectSelectedEndpointConnections
SrvNetEndpointAcceptNewConnection
SrvNetEndpointProcessDisconnects
SrvNetEndpointProcessPdcActivationSrvNetFinalDereferenceInternal
SrvNetFreeConnection
SrvNetIssueTdiDisconnectRequest
SrvNetQUICClientCertificatesAccessCheckWorker
SrvNetQUICPostClientCertificatesAccessCheck
SrvNetQuicServerReceiveEvent
SrvNetQuicServerStreamCallback
SrvNetRdmaDisconnectEvent
SrvNetScavengerCloseConnection
SrvNetScavengerDisconnectConnection
SrvNetTdiAcceptCompletion
SrvNetTdiConnectHandler
SrvNetWskAcceptEvent
SrvNetWskDisconnectEvent
SrvNetWskReceiveEvent
|
Expand for full list:
SrvAdminDereferenceInstance
SrvAdminProcessFsctl
SrvIdSegRequestNodeInvalidationComplete
SrvNetAllocateConnection
SrvNetCloseEndpoint
SrvNetCommonReceiveHandler
SrvNetDeregisterClient
SrvNetDisconnectSelectedEndpointConnections
SrvNetEndpointAcceptNewConnection
SrvNetEndpointProcessDisconnects
SrvNetEndpointProcessPdcActivationSrvNetFinalDereferenceInternal
SrvNetFreeConnection
SrvNetIssueTdiDisconnectRequest
SrvNetQUICClientCertificatesAccessCheckWorker
SrvNetQUICPostClientCertificatesAccessCheck
SrvNetQuicServerReceiveEvent
SrvNetQuicServerStreamCallback
SrvNetRdmaDisconnectEvent
SrvNetScavengerCloseConnection
SrvNetScavengerDisconnectConnection
SrvNetTdiAcceptCompletion
SrvNetTdiConnectHandler
SrvNetWskAcceptEvent
SrvNetWskDisconnectEvent
SrvNetWskReceiveEvent
| |paramcount|4|4| |`address`|140016bf0|14001746c| |sig|undefined __fastcall WPP_SF_q(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_q(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_q Calling Diff ```diff --- WPP_SF_q calling +++ WPP_SF_q calling @@ -1 +0,0 @@ -FUN_14002c4cb @@ -6,0 +6 @@ +SrvNetCommonReceiveHandler ``` ## NTOSKRNL.EXE::ObfDereferenceObject ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|ObfDereferenceObject|ObfDereferenceObject| |fullname|NTOSKRNL.EXE::ObfDereferenceObject|NTOSKRNL.EXE::ObfDereferenceObject| |`refcount`|12|13| |length|0|0| |called||| |`calling`|FUN_14005a4cd
SrvLibAuditForceAccess
SrvNetBuildNetname
SrvNetDeregisterPnpCallbacks
SrvNetFreeEndpoint
SrvNetRegisterPnpCallbacks
SrvNetTdiAllocateEndpoint
SrvNetTdiCloseConnection|SrvLibAuditForceAccess
SrvNetBuildNetname
SrvNetDeregisterPnpCallbacks
SrvNetFreeEndpoint
SrvNetRegisterPnpCallbacks
SrvNetTdiAllocateEndpoint
SrvNetTdiCloseConnection| |paramcount|0|0| |address|EXTERNAL:0000000a|EXTERNAL:0000000a| |sig|undefined ObfDereferenceObject(void)|undefined ObfDereferenceObject(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ObfDereferenceObject Calling Diff ```diff --- NTOSKRNL.EXE::ObfDereferenceObject calling +++ NTOSKRNL.EXE::ObfDereferenceObject calling @@ -1 +0,0 @@ -FUN_14005a4cd ``` ## _tlgKeywordOn ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|_tlgKeywordOn|_tlgKeywordOn| |fullname|_tlgKeywordOn|_tlgKeywordOn| |`refcount`|7|5| |length|36|36| |called||| |`calling`|FUN_14002c061
SrvAdminSMBSharesReportingRoutine
SrvNetHandleUnclaimedSmb1Connection
SrvNetQuicServerConnectionCallback
SrvNetRdmaCloseSocket
SrvNetRefreshLanmanServerParameters|SrvAdminSMBSharesReportingRoutine
SrvNetQuicServerConnectionCallback
SrvNetRdmaCloseSocket
SrvNetRefreshLanmanServerParameters| |paramcount|2|2| |address|140001008|140001008| |sig|undefined1 __fastcall _tlgKeywordOn(longlong param_1, ulonglong param_2)|undefined1 __fastcall _tlgKeywordOn(longlong param_1, ulonglong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### _tlgKeywordOn Calling Diff ```diff --- _tlgKeywordOn calling +++ _tlgKeywordOn calling @@ -1 +0,0 @@ -FUN_14002c061 @@ -3 +1,0 @@ -SrvNetHandleUnclaimedSmb1Connection ``` ## NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|KeAcquireSpinLockRaiseToDpc|KeAcquireSpinLockRaiseToDpc| |fullname|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc| |`refcount`|70|71| |length|0|0| |called||| |`calling`|
Expand for full list:
FUN_14002ccb1
PplpLazyInitializeLookasideList
SrvNetAllocateScavengerThread
SrvNetAllocateStatisticsQueuesEx
SrvNetCleanupConnectionScavenger
SrvNetCleanupStatisticsQueues
SrvNetCloseConnection
SrvNetCloseConnectionsInClosingList
SrvNetCloseEndpoint
SrvNetCloseRandomConnection
SrvNetConnectionScavengerThreadSrvNetDereferenceConnection
SrvNetDereferenceConnectionsInDereferenceList
SrvNetDisableStatisticsQueue
SrvNetDiscardPartiallyInitializedConnection
SrvNetDisconnectConnectionByServerName
SrvNetDisconnectConnectionInternalEx
SrvNetDisconnectSelectedEndpointConnections
SrvNetEndpointAcceptNewConnection
SrvNetEndpointAllocateConnections
SrvNetEndpointGetFreeConnection
SrvNetEndpointInsertFreeConnection
SrvNetEndpointProcessDisconnects
SrvNetEndpointProcessPdcActivation
SrvNetEndpointReopenTdiConnections
SrvNetFinalDereferenceInternal
SrvNetFreeClient
SrvNetFreeConnection
SrvNetFreeScavengerThread
SrvNetGetQueueStatistics
SrvNetHandleUnclaimedSmb1Connection
SrvNetInitializeStatisticsQueues
SrvNetMarkConnectionAuthenticated
SrvNetNotifyClientsOfEndpoint
SrvNetQuicServerReceiveEvent
SrvNetRdmaCloseSocket
SrvNetRdmaDisconnectEvent
SrvNetRdmaReceiveEvent
SrvNetReceiveData
SrvNetRegisterClient
SrvNetScavengerCloseConnection
SrvNetScavengerDisconnectConnection
SrvNetSetConnectionServerName
SrvNetSignalConnectionScavengerCheck
SrvNetStartClient
SrvNetStopClient
SrvNetTdiDisconnectHandler
SrvNetTdiReceiveCompletion
SrvNetTdiReceiveHandler
SrvNetTerminateIdleConnections
SrvNetTerminateScavenger
SrvNetTriggerScavenger
SrvNetUpdateStatisticsFromQueues
SrvNetWskDisconnectEvent
SrvNetWskReceiveComplete
SrvNetWskReceiveEvent
|
Expand for full list:
FUN_14002cfa5
PplpLazyInitializeLookasideList
SrvNetAllocateScavengerThread
SrvNetAllocateStatisticsQueuesEx
SrvNetCleanupConnectionScavenger
SrvNetCleanupStatisticsQueues
SrvNetCloseConnection
SrvNetCloseConnectionsInClosingList
SrvNetCloseEndpoint
SrvNetCloseRandomConnection
SrvNetCommonReceiveHandlerSrvNetConnectionScavengerThread
SrvNetDereferenceConnection
SrvNetDereferenceConnectionsInDereferenceList
SrvNetDisableStatisticsQueue
SrvNetDiscardPartiallyInitializedConnection
SrvNetDisconnectConnectionByServerName
SrvNetDisconnectConnectionInternalEx
SrvNetDisconnectSelectedEndpointConnections
SrvNetEndpointAcceptNewConnection
SrvNetEndpointAllocateConnections
SrvNetEndpointGetFreeConnection
SrvNetEndpointInsertFreeConnection
SrvNetEndpointProcessDisconnects
SrvNetEndpointProcessPdcActivation
SrvNetEndpointReopenTdiConnections
SrvNetFinalDereferenceInternal
SrvNetFreeClient
SrvNetFreeConnection
SrvNetFreeScavengerThread
SrvNetGetQueueStatistics
SrvNetInitializeStatisticsQueues
SrvNetMarkConnectionAuthenticated
SrvNetNotifyClientsOfEndpoint
SrvNetQuicServerReceiveEvent
SrvNetRdmaCloseSocket
SrvNetRdmaDisconnectEvent
SrvNetRdmaReceiveEvent
SrvNetReceiveData
SrvNetRegisterClient
SrvNetScavengerCloseConnection
SrvNetScavengerDisconnectConnection
SrvNetSetConnectionServerName
SrvNetSignalConnectionScavengerCheck
SrvNetStartClient
SrvNetStopClient
SrvNetTdiDisconnectHandler
SrvNetTdiReceiveCompletion
SrvNetTdiReceiveHandler
SrvNetTerminateIdleConnections
SrvNetTerminateScavenger
SrvNetTriggerScavenger
SrvNetUnpublishClientSlot
SrvNetUpdateStatisticsFromQueues
SrvNetWskDisconnectEvent
SrvNetWskReceiveComplete
SrvNetWskReceiveEvent
| |paramcount|0|0| |address|EXTERNAL:00000075|EXTERNAL:00000075| |sig|undefined KeAcquireSpinLockRaiseToDpc(void)|undefined KeAcquireSpinLockRaiseToDpc(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc Calling Diff ```diff --- NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc calling +++ NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc calling @@ -1 +1 @@ -FUN_14002ccb1 +FUN_14002cfa5 @@ -10,0 +11 @@ +SrvNetCommonReceiveHandler @@ -31 +31,0 @@ -SrvNetHandleUnclaimedSmb1Connection @@ -52,0 +53 @@ +SrvNetUnpublishClientSlot ``` ## NTOSKRNL.EXE::ExInitializeRundownProtection ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|ExInitializeRundownProtection|ExInitializeRundownProtection| |fullname|NTOSKRNL.EXE::ExInitializeRundownProtection|NTOSKRNL.EXE::ExInitializeRundownProtection| |`refcount`|8|11| |length|0|0| |called||| |`calling`|DriverEntry
PdcPortOpenCommon
SrvAdminNodeInitialize
SrvNetAllocateConnection
SrvNetEndpointGetFreeConnection
SrvNetTdiAllocateEndpoint|DriverEntry
PdcPortOpenCommon
SrvAdminNodeInitialize
SrvNetAllocateConnection
SrvNetAllocateEndpointCommon
SrvNetEndpointGetFreeConnection
SrvNetNotifyClientsOfEndpoint
SrvNetTdiAllocateEndpoint| |paramcount|0|0| |address|EXTERNAL:00000066|EXTERNAL:00000066| |sig|undefined ExInitializeRundownProtection(void)|undefined ExInitializeRundownProtection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExInitializeRundownProtection Calling Diff ```diff --- NTOSKRNL.EXE::ExInitializeRundownProtection calling +++ NTOSKRNL.EXE::ExInitializeRundownProtection calling @@ -4,0 +5 @@ +SrvNetAllocateEndpointCommon @@ -5,0 +7 @@ +SrvNetNotifyClientsOfEndpoint ``` ## NTOSKRNL.EXE::IoFreeIrp ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|IoFreeIrp|IoFreeIrp| |fullname|NTOSKRNL.EXE::IoFreeIrp|NTOSKRNL.EXE::IoFreeIrp| |`refcount`|11|12| |length|0|0| |called||| |`calling`|SrvNetCompleteSendData
SrvNetEndpointGetFreeConnection
SrvNetFreeConnection
SrvNetFreeEndpoint
SrvNetIssueSendDatagramRequest
SrvNetTdiReceiveCompletion
SrvNetWskReceiveComplete
SrvNetWskSetKeepAlive
SrvNetWskSetMaxRT
SrvNetWskTwiddleInterface|
Expand for full list:
SrvNetCompleteSendData
SrvNetEndpointGetFreeConnection
SrvNetFreeConnection
SrvNetFreeEndpoint
SrvNetIssueSendDatagramRequest
SrvNetTdiReceiveCompletion
SrvNetTdiReceiveHandler
SrvNetWskReceiveComplete
SrvNetWskSetKeepAlive
SrvNetWskSetMaxRT
SrvNetWskTwiddleInterface
| |paramcount|0|0| |address|EXTERNAL:00000008|EXTERNAL:00000008| |sig|undefined IoFreeIrp(void)|undefined IoFreeIrp(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::IoFreeIrp Calling Diff ```diff --- NTOSKRNL.EXE::IoFreeIrp calling +++ NTOSKRNL.EXE::IoFreeIrp calling @@ -6,0 +7 @@ +SrvNetTdiReceiveHandler ``` ## wil_details_IsEnabledFallback ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|3|5| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_869219643__private_IsEnabledFallback
Feature_Servicing_SMBFixS2DAccessDeniedIssues__private_IsEnabledFallback|Feature_1180933432__private_IsEnabledFallback
Feature_3107684665__private_IsEnabledFallback
Feature_869219643__private_IsEnabledFallback
Feature_Servicing_SMBFixS2DAccessDeniedIssues__private_IsEnabledFallback| |paramcount|3|3| |`address`|14001882c|140017d54| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1,2 @@ +Feature_1180933432__private_IsEnabledFallback +Feature_3107684665__private_IsEnabledFallback ``` ## __security_check_cookie ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|168|167| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
FUN_140007ea8
LoadUserDefinedFsctlPropertyList
McTemplateK0_EtwWriteTransfer
McTemplateK0d_EtwWriteTransfer
McTemplateK0dd_EtwWriteTransfer
McTemplateK0hhhzr2hzr4_EtwWriteTransfer
McTemplateK0hqq_EtwWriteTransfer
McTemplateK0hzr0dq_EtwWriteTransfer
McTemplateK0hzr0hqqd_EtwWriteTransfer
McTemplateK0hzr0hzr2_EtwWriteTransfer
McTemplateK0hzr0hzr2hzr4_EtwWriteTransferMcTemplateK0hzr0hzr2hzr4d_EtwWriteTransfer
McTemplateK0hzr0q_EtwWriteTransfer
McTemplateK0hzr0qqbr3qbr5qbr7qq_EtwWriteTransfer
McTemplateK0hzr0zttq_EtwWriteTransfer
McTemplateK0id_EtwWriteTransfer
McTemplateK0idddd_EtwWriteTransfer
McTemplateK0jdddd_EtwWriteTransfer
McTemplateK0qd_EtwWriteTransfer
McTemplateK0qhzr1_EtwWriteTransfer
McTemplateK0qhzr1d_EtwWriteTransfer
McTemplateK0qhzr1qqbr4qbr6qbr8_EtwWriteTransfer
McTemplateK0qi_EtwWriteTransfer
McTemplateK0qq_EtwWriteTransfer
McTemplateK0qqd_EtwWriteTransfer
McTemplateK0qqdhzr3q_EtwWriteTransfer
McTemplateK0qqh_EtwWriteTransfer
McTemplateK0qqhzr2_EtwWriteTransfer
McTemplateK0qqq_EtwWriteTransfer
McTemplateK0qqzr1_EtwWriteTransfer
McTemplateK0s_EtwWriteTransfer
McTemplateK0t_EtwWriteTransfer
McTemplateK0tdhzr2hzr4_EtwWriteTransfer
McTemplateK0tttttt_EtwWriteTransfer
McTemplateK0xhzr1_EtwWriteTransfer
McTemplateK0xhzr1hzr3hzr5hzr7hzr9hzr11hzr13xx_EtwWriteTransfer
McTemplateK0xhzr1xx_EtwWriteTransfer
McTemplateK0xqzr1uu_EtwWriteTransfer
McTemplateU0qqqqzr3_EtwWriteTransfer
McTemplateU0qqzr1qzr3qqqqpqqzr11_EtwWriteTransfer
McTemplateU0qqzr1qzr3qqqxqpqqqzr13q_EtwWriteTransfer
McTemplateU0qqzr1qzr3qqqxqqqpqzr13q_EtwWriteTransfer
McTemplateU0qqzr1qzr3qqxqpqqzr11q_EtwWriteTransfer
Pdcv2EventWrite_ACTIVATION_CLIENT_CALLBACK
Pdcv2EventWrite_ACTIVATION_CLIENT_DEACTIVATE
RfsRegGetDWord
SATrace
SmbCompressionCompress
SmbCompressionReadCompressionAlgorithmSuiteOrderPolicySetting
SmbCryptoCalculateAndSetIV
SmbCryptoCreateApplicationKey
SmbCryptoCreateCipherKeys
SmbCryptoCreateSigningKey
SmbCryptoInitializeCipher
SmbCryptoKeyTableFind
SmbCryptoKeyTableRemove
SmbCryptoReadCipherSuiteOrderPolicySetting
SmbCryptoReadSigningAlgorithmOrderPolicySetting
SmbCryptoSp800108CtrHmacSha256DeriveKey
SrvAdminCheckSpn
SrvAdminCloseFile
SrvAdminCloseSession
SrvAdminInitInstance
SrvAdminInitialize
SrvAdminIsScopedNameEx
SrvAdminNodeInvalidateFile
SrvAdminNodeInvalidateSession
SrvAdminNotifyCloseFile
SrvAdminProcessFsctl
SrvAdminProcessFsctlFsp
SrvAdminSMBSharesReportingRoutine
SrvAdminSetInstanceProperties
SrvAdminStartInstanceEx
SrvGrovelerConnect
SrvIdSegInitialize
SrvLibApplyDeviceAcl
SrvLibApplySrvDeviceAcl
SrvLibAuditShareAccess
SrvLibAuditShareAddOrDelete
SrvLibAuditShareConnect
SrvLibAuditShareModification
SrvLibAuditSpnCheck
SrvLibCheckDesiredAccess
SrvLibCreateSelfSD
SrvLibGenerateSrvServiceSD
SrvLibGetSelfSid
SrvLibInitializeSecurityDescriptors
SrvLibIsNetworkAddress
SrvLibS4U2SelfAuth
SrvLibSeAccessCheck
SrvLibStandardizeIpAddress
SrvLibTruncateDnsName
SrvNetAddServedName
SrvNetAllocateEndpointCommon
SrvNetBuildNetname
SrvNetBuildQUICDeviceName
SrvNetCalculateMaxUnAuthenticatedConnections
SrvNetCheckLoopbackConnection
SrvNetCommonReceiveHandler
SrvNetCreateAndPadNetBiosName
SrvNetCreateListenersBasedOnListenerRuleEntry
SrvNetDeleteServedName
SrvNetDisconnectConnectionByServerName
SrvNetGetSMBDirectDeviceName
SrvNetGetSMBDirectServicePath
SrvNetHandleUnclaimedSmb1Connection
SrvNetHostAddressAndPortToStringA
SrvNetHostAddressAndPortToStringW
SrvNetIsAddressLoopback
SrvNetListenerEnumEndpoints
SrvNetMarkClusterEndpointsOffline
SrvNetOpenEndpointHandle
SrvNetQUICAddCertHelper
SrvNetQUICAddCertificates
SrvNetQUICCreateNewConfiguration
SrvNetQUICGetConfiguration
SrvNetQUICListenerOpen
SrvNetQUICRemoveConfiguration
SrvNetQUICSetKeepAlive
SrvNetQUICSetMAXRT
SrvNetQUICUpdateConfiguration
SrvNetQUICUpdateConfigurationFlags
SrvNetQUICUpdateOrAddCertificates
SrvNetQueryConnectionInformation
SrvNetQueryLbfoTeamCapability
SrvNetQuicServerConnectionCallback
SrvNetQuicServerListenerCallback
SrvNetRdmaAcceptEvent
SrvNetRdmaCloseSocket
SrvNetRdmaCreateListener
SrvNetRefreshLanmanServerParameters
SrvNetRefreshRdmaStateOnInterface
SrvNetSendData
SrvNetSendQUICEndpointNotification
SrvNetSetConnectionServerName
SrvNetSetEndpointFlag
SrvNetSmbdRunOnceInitialize
SrvNetTdiNotifyChangesToNetBt
SrvNetTdiOpenConnection
SrvNetTdiPnPBindingHandler
SrvNetUpdateIPAddressListWorkerRoutine
SrvNetUpdateIPInterface
SrvNetUpdateNetNameWorkerRoutine
SrvNetWskAcceptEvent
SrvNetWskOpenListenSocket
SrvNetWskReceiveEvent
SrvNotifyGroveler
SrvXsAddPrintJob
SrvXsClosePrinter
SrvXsConnect
SrvXsDownLevelAPI
SrvXsOpenPrinter
SrvXsPnpOperation
SrvXsSchedulePrintJob
SumTraceIPAddress
SvcShareEnum
Template_qqbjqb_ex
Template_qqbqb_ex
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
UlStrPrintUlongA
UlStrPrintUlongW
__GSHandlerCheckCommon
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates
|
Expand for full list:
FUN_140008578
LoadUserDefinedFsctlPropertyList
McTemplateK0_EtwWriteTransfer
McTemplateK0d_EtwWriteTransfer
McTemplateK0dd_EtwWriteTransfer
McTemplateK0hhhzr2hzr4_EtwWriteTransfer
McTemplateK0hqq_EtwWriteTransfer
McTemplateK0hzr0dq_EtwWriteTransfer
McTemplateK0hzr0hqqd_EtwWriteTransfer
McTemplateK0hzr0hzr2_EtwWriteTransfer
McTemplateK0hzr0hzr2hzr4_EtwWriteTransferMcTemplateK0hzr0hzr2hzr4d_EtwWriteTransfer
McTemplateK0hzr0q_EtwWriteTransfer
McTemplateK0hzr0qqbr3qbr5qbr7qq_EtwWriteTransfer
McTemplateK0hzr0zttq_EtwWriteTransfer
McTemplateK0id_EtwWriteTransfer
McTemplateK0idddd_EtwWriteTransfer
McTemplateK0jdddd_EtwWriteTransfer
McTemplateK0q_EtwWriteTransfer
McTemplateK0qd_EtwWriteTransfer
McTemplateK0qhzr1_EtwWriteTransfer
McTemplateK0qhzr1d_EtwWriteTransfer
McTemplateK0qhzr1qqbr4qbr6qbr8_EtwWriteTransfer
McTemplateK0qi_EtwWriteTransfer
McTemplateK0qq_EtwWriteTransfer
McTemplateK0qqd_EtwWriteTransfer
McTemplateK0qqdhzr3q_EtwWriteTransfer
McTemplateK0qqh_EtwWriteTransfer
McTemplateK0qqhzr2_EtwWriteTransfer
McTemplateK0qqq_EtwWriteTransfer
McTemplateK0qqzr1_EtwWriteTransfer
McTemplateK0s_EtwWriteTransfer
McTemplateK0tdhzr2hzr4_EtwWriteTransfer
McTemplateK0tttttt_EtwWriteTransfer
McTemplateK0xhzr1_EtwWriteTransfer
McTemplateK0xhzr1hzr3hzr5hzr7hzr9hzr11hzr13xx_EtwWriteTransfer
McTemplateK0xhzr1xx_EtwWriteTransfer
McTemplateK0xqzr1uu_EtwWriteTransfer
McTemplateU0qqqqzr3_EtwWriteTransfer
McTemplateU0qqzr1qzr3qqqqpqqzr11_EtwWriteTransfer
McTemplateU0qqzr1qzr3qqqxqpqqqzr13q_EtwWriteTransfer
McTemplateU0qqzr1qzr3qqqxqqqpqzr13q_EtwWriteTransfer
McTemplateU0qqzr1qzr3qqxqpqqzr11q_EtwWriteTransfer
Pdcv2EventWrite_ACTIVATION_CLIENT_CALLBACK
Pdcv2EventWrite_ACTIVATION_CLIENT_DEACTIVATE
RfsRegGetDWord
SATrace
SmbCompressionCompress
SmbCompressionReadCompressionAlgorithmSuiteOrderPolicySetting
SmbCryptoCalculateAndSetIV
SmbCryptoCreateApplicationKey
SmbCryptoCreateCipherKeys
SmbCryptoCreateSigningKey
SmbCryptoInitializeCipher
SmbCryptoKeyTableFind
SmbCryptoKeyTableRemove
SmbCryptoReadCipherSuiteOrderPolicySetting
SmbCryptoReadSigningAlgorithmOrderPolicySetting
SmbCryptoSp800108CtrHmacSha256DeriveKey
SrvAdminCheckSpn
SrvAdminCloseFile
SrvAdminCloseSession
SrvAdminInitInstance
SrvAdminInitialize
SrvAdminIsScopedNameEx
SrvAdminNodeInvalidateFile
SrvAdminNodeInvalidateSession
SrvAdminNotifyCloseFile
SrvAdminProcessFsctl
SrvAdminProcessFsctlFsp
SrvAdminSMBSharesReportingRoutine
SrvAdminSetInstanceProperties
SrvAdminStartInstanceEx
SrvGrovelerConnect
SrvIdSegInitialize
SrvLibApplyDeviceAcl
SrvLibApplySrvDeviceAcl
SrvLibAuditShareAccess
SrvLibAuditShareAddOrDelete
SrvLibAuditShareConnect
SrvLibAuditShareModification
SrvLibAuditSpnCheck
SrvLibCheckDesiredAccess
SrvLibCreateSelfSD
SrvLibGenerateSrvServiceSD
SrvLibGetSelfSid
SrvLibInitializeSecurityDescriptors
SrvLibIsNetworkAddress
SrvLibS4U2SelfAuth
SrvLibSeAccessCheck
SrvLibStandardizeIpAddress
SrvLibTruncateDnsName
SrvNetAddServedName
SrvNetAllocateEndpointCommon
SrvNetBuildNetname
SrvNetBuildQUICDeviceName
SrvNetCalculateMaxUnAuthenticatedConnections
SrvNetCheckLoopbackConnection
SrvNetCommonReceiveHandler
SrvNetCreateAndPadNetBiosName
SrvNetCreateListenersBasedOnListenerRuleEntry
SrvNetDeleteServedName
SrvNetDisconnectConnectionByServerName
SrvNetGetSMBDirectDeviceName
SrvNetGetSMBDirectServicePath
SrvNetHostAddressAndPortToStringA
SrvNetHostAddressAndPortToStringW
SrvNetIsAddressLoopback
SrvNetListenerEnumEndpoints
SrvNetMarkClusterEndpointsOffline
SrvNetOpenEndpointHandle
SrvNetQUICAddCertHelper
SrvNetQUICAddCertificates
SrvNetQUICCreateNewConfiguration
SrvNetQUICGetConfiguration
SrvNetQUICListenerOpen
SrvNetQUICRemoveConfiguration
SrvNetQUICSetKeepAlive
SrvNetQUICSetMAXRT
SrvNetQUICUpdateConfiguration
SrvNetQUICUpdateConfigurationFlags
SrvNetQUICUpdateOrAddCertificates
SrvNetQueryConnectionInformation
SrvNetQueryLbfoTeamCapability
SrvNetQuicServerConnectionCallback
SrvNetQuicServerListenerCallback
SrvNetRdmaAcceptEvent
SrvNetRdmaCloseSocket
SrvNetRdmaCreateListener
SrvNetRefreshLanmanServerParameters
SrvNetRefreshRdmaStateOnInterface
SrvNetSendData
SrvNetSendQUICEndpointNotification
SrvNetSetConnectionServerName
SrvNetSetEndpointFlag
SrvNetSmbdRunOnceInitialize
SrvNetTdiNotifyChangesToNetBt
SrvNetTdiOpenConnection
SrvNetTdiPnPBindingHandler
SrvNetUpdateIPAddressListWorkerRoutine
SrvNetUpdateIPInterface
SrvNetUpdateNetNameWorkerRoutine
SrvNetWskAcceptEvent
SrvNetWskOpenListenSocket
SrvNetWskReceiveEvent
SrvNotifyGroveler
SrvXsAddPrintJob
SrvXsClosePrinter
SrvXsConnect
SrvXsDownLevelAPI
SrvXsOpenPrinter
SrvXsPnpOperation
SrvXsSchedulePrintJob
SumTraceIPAddress
SvcShareEnum
Template_qqbjqb_ex
Template_qqbqb_ex
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
UlStrPrintUlongA
UlStrPrintUlongW
__GSHandlerCheckCommon
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates
| |paramcount|1|1| |`address`|14002b250|14002ba30| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -1 +1 @@ -FUN_140007ea8 +FUN_140008578 @@ -18,0 +19 @@ +McTemplateK0q_EtwWriteTransfer @@ -32 +32,0 @@ -McTemplateK0t_EtwWriteTransfer @@ -106 +105,0 @@ -SrvNetHandleUnclaimedSmb1Connection ``` ## RtlStringCchLengthA ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|RtlStringCchLengthA|RtlStringCchLengthA| |fullname|RtlStringCchLengthA|RtlStringCchLengthA| |`refcount`|5|4| |length|95|95| |called||| |`calling`|FUN_14002c061
SrvNetProcessFsctlFsp
SrvNetQUICAddCertHelper
SrvNetQUICCreateNewConfiguration|SrvNetProcessFsctlFsp
SrvNetQUICAddCertHelper
SrvNetQUICCreateNewConfiguration| |paramcount|3|3| |`address`|140013e14|1400145d4| |sig|uint __fastcall RtlStringCchLengthA(char * param_1, ulonglong param_2, longlong * param_3)|uint __fastcall RtlStringCchLengthA(char * param_1, ulonglong param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RtlStringCchLengthA Calling Diff ```diff --- RtlStringCchLengthA calling +++ RtlStringCchLengthA calling @@ -1 +0,0 @@ -FUN_14002c061 ``` ## NTOSKRNL.EXE::ZwClose ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|ZwClose|ZwClose| |fullname|NTOSKRNL.EXE::ZwClose|NTOSKRNL.EXE::ZwClose| |`refcount`|21|22| |length|0|0| |called||| |`calling`|
Expand for full list:
DriverUnload
FUN_14005a4cd
LoadUserDefinedFsctlPropertyList
ReserveLocalMajorSequence
RfsRegGetDWord
RfsRegGetMultiSZList
RfsRegKeyExists
RfsRegQueryValue
RfsRegSetDWord
SrvAdminIssueFsctl
SrvLibGetSelfSidSrvNetDereferenceHandle
SrvNetDisableRdmaListenSocketsAndUnlinkSmbDirect
SrvNetOpenEndpointHandle
SrvNetQueryLbfoTeamCapability
SrvNetSmbdRunOnceInitialize
SrvNetTdiCloseConnection
|
Expand for full list:
DriverUnload
LoadUserDefinedFsctlPropertyList
ReserveLocalMajorSequence
RfsRegGetDWord
RfsRegGetMultiSZList
RfsRegKeyExists
RfsRegQueryValue
RfsRegSetDWord
SrvAdminIssueFsctl
SrvLibGetSelfSid
SrvNetDereferenceHandleSrvNetDisableRdmaListenSocketsAndUnlinkSmbDirect
SrvNetOpenEndpointHandle
SrvNetQueryLbfoTeamCapability
SrvNetSmbdRunOnceInitialize
SrvNetTdiAllocateEndpoint
SrvNetTdiCloseConnection
| |paramcount|0|0| |address|EXTERNAL:00000083|EXTERNAL:00000083| |sig|undefined ZwClose(void)|undefined ZwClose(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ZwClose Calling Diff ```diff --- NTOSKRNL.EXE::ZwClose calling +++ NTOSKRNL.EXE::ZwClose calling @@ -2 +1,0 @@ -FUN_14005a4cd @@ -16,0 +16 @@ +SrvNetTdiAllocateEndpoint ``` ## _tlgWriteTransfer_EtwWriteTransfer ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|_tlgWriteTransfer_EtwWriteTransfer|_tlgWriteTransfer_EtwWriteTransfer| |fullname|_tlgWriteTransfer_EtwWriteTransfer|_tlgWriteTransfer_EtwWriteTransfer| |`refcount`|9|7| |length|161|161| |called|NTOSKRNL.EXE::EtwWriteTransfer|NTOSKRNL.EXE::EtwWriteTransfer| |`calling`|FUN_14002c061
Pdcv2EventWrite_ACTIVATION_CLIENT_CALLBACK
Pdcv2EventWrite_ACTIVATION_CLIENT_DEACTIVATE
SrvAdminSMBSharesReportingRoutine
SrvNetHandleUnclaimedSmb1Connection
SrvNetQuicServerConnectionCallback
SrvNetRdmaCloseSocket
SrvNetRefreshLanmanServerParameters|Pdcv2EventWrite_ACTIVATION_CLIENT_CALLBACK
Pdcv2EventWrite_ACTIVATION_CLIENT_DEACTIVATE
SrvAdminSMBSharesReportingRoutine
SrvNetQuicServerConnectionCallback
SrvNetRdmaCloseSocket
SrvNetRefreshLanmanServerParameters| |paramcount|6|6| |address|140001034|140001034| |sig|undefined __fastcall _tlgWriteTransfer_EtwWriteTransfer(longlong param_1, byte * param_2, undefined8 param_3, undefined8 param_4, undefined4 param_5, undefined8 * param_6)|undefined __fastcall _tlgWriteTransfer_EtwWriteTransfer(longlong param_1, byte * param_2, undefined8 param_3, undefined8 param_4, undefined4 param_5, undefined8 * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### _tlgWriteTransfer_EtwWriteTransfer Calling Diff ```diff --- _tlgWriteTransfer_EtwWriteTransfer calling +++ _tlgWriteTransfer_EtwWriteTransfer calling @@ -1 +0,0 @@ -FUN_14002c061 @@ -5 +3,0 @@ -SrvNetHandleUnclaimedSmb1Connection ``` ## NTOSKRNL.EXE::ExReleaseRundownProtection ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|ExReleaseRundownProtection|ExReleaseRundownProtection| |fullname|NTOSKRNL.EXE::ExReleaseRundownProtection|NTOSKRNL.EXE::ExReleaseRundownProtection| |`refcount`|16|18| |length|0|0| |called||| |`calling`|
Expand for full list:
InvalidationCompleteThread
InvalidationThread
PdcPortSendMessageSynchronously
SrvNetEndpointGetTransportHandle
SrvNetFreeEndpoint
SrvNetGetRdmaNicInfo
SrvNetRdmaDisconnectConnection
SrvNetRdmaGetLocalAddress
SrvNetRdmaGetPeerAddress
SrvNetRdmaReadDirectData
SrvNetRdmaSendDataSrvNetRdmaWriteDirectData
SrvNetReleaseRdmaRundownProtection
SrvNetTdiAcceptCompletion
SrvNetTdiConnectHandler
|
Expand for full list:
InvalidationCompleteThread
InvalidationThread
PdcPortSendMessageSynchronously
SrvNetCommonReceiveHandler
SrvNetEndpointGetTransportHandle
SrvNetFreeEndpoint
SrvNetGetRdmaNicInfo
SrvNetRdmaDisconnectConnection
SrvNetRdmaGetLocalAddress
SrvNetRdmaGetPeerAddress
SrvNetRdmaReadDirectDataSrvNetRdmaSendData
SrvNetRdmaWriteDirectData
SrvNetReleaseRdmaRundownProtection
SrvNetTdiAcceptCompletion
SrvNetTdiConnectHandler
SrvNetTdiReceiveCompletion
| |paramcount|0|0| |address|EXTERNAL:0000007f|EXTERNAL:0000007f| |sig|undefined ExReleaseRundownProtection(void)|undefined ExReleaseRundownProtection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExReleaseRundownProtection Calling Diff ```diff --- NTOSKRNL.EXE::ExReleaseRundownProtection calling +++ NTOSKRNL.EXE::ExReleaseRundownProtection calling @@ -3,0 +4 @@ +SrvNetCommonReceiveHandler @@ -15,0 +17 @@ +SrvNetTdiReceiveCompletion ``` ## NTOSKRNL.EXE::EtwWriteTransfer ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|EtwWriteTransfer|EtwWriteTransfer| |fullname|NTOSKRNL.EXE::EtwWriteTransfer|NTOSKRNL.EXE::EtwWriteTransfer| |`refcount`|3|5| |length|0|0| |called||| |`calling`|McGenEventWrite_EtwWriteTransfer
_tlgWriteTransfer_EtwWriteTransfer|McGenEventWrite_EtwWriteTransfer
SrvNetCommonReceiveHandler
_tlgWriteTransfer_EtwWriteTransfer| |paramcount|0|0| |address|EXTERNAL:00000059|EXTERNAL:00000059| |sig|undefined EtwWriteTransfer(void)|undefined EtwWriteTransfer(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::EtwWriteTransfer Calling Diff ```diff --- NTOSKRNL.EXE::EtwWriteTransfer calling +++ NTOSKRNL.EXE::EtwWriteTransfer calling @@ -1,0 +2 @@ +SrvNetCommonReceiveHandler ``` ## NTOSKRNL.EXE::KeReleaseSpinLock ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|KeReleaseSpinLock|KeReleaseSpinLock| |fullname|NTOSKRNL.EXE::KeReleaseSpinLock|NTOSKRNL.EXE::KeReleaseSpinLock| |`refcount`|88|89| |length|0|0| |called||| |`calling`|
Expand for full list:
FUN_14002ccb1
PplpLazyInitializeLookasideList
SrvNetAllocateScavengerThread
SrvNetAllocateStatisticsQueuesEx
SrvNetCleanupConnectionScavenger
SrvNetCleanupStatisticsQueues
SrvNetCloseConnection
SrvNetCloseConnectionsInClosingList
SrvNetCloseEndpoint
SrvNetCloseRandomConnection
SrvNetConnectionScavengerThreadSrvNetDereferenceConnection
SrvNetDereferenceConnectionsInDereferenceList
SrvNetDisableStatisticsQueue
SrvNetDiscardPartiallyInitializedConnection
SrvNetDisconnectConnectionByServerName
SrvNetDisconnectConnectionInternalEx
SrvNetDisconnectSelectedEndpointConnections
SrvNetEndpointAcceptNewConnection
SrvNetEndpointAllocateConnections
SrvNetEndpointGetFreeConnection
SrvNetEndpointInsertFreeConnection
SrvNetEndpointProcessDisconnects
SrvNetEndpointProcessPdcActivation
SrvNetEndpointReopenTdiConnections
SrvNetFinalDereferenceInternal
SrvNetFreeClient
SrvNetFreeConnection
SrvNetFreeScavengerThread
SrvNetGetQueueStatistics
SrvNetHandleUnclaimedSmb1Connection
SrvNetInitializeStatisticsQueues
SrvNetMarkConnectionAuthenticated
SrvNetNotifyClientsOfEndpoint
SrvNetQuicServerReceiveEvent
SrvNetRdmaCloseSocket
SrvNetRdmaDisconnectEvent
SrvNetRdmaReceiveEvent
SrvNetReceiveData
SrvNetRegisterClient
SrvNetScavengerCloseConnection
SrvNetScavengerDisconnectConnection
SrvNetSetConnectionServerName
SrvNetSignalConnectionScavengerCheck
SrvNetStartClient
SrvNetStopClient
SrvNetTdiDisconnectHandler
SrvNetTdiReceiveCompletion
SrvNetTdiReceiveHandler
SrvNetTerminateIdleConnections
SrvNetTerminateScavenger
SrvNetTriggerScavenger
SrvNetUpdateStatisticsFromQueues
SrvNetWskDisconnectEvent
SrvNetWskReceiveComplete
SrvNetWskReceiveEvent
|
Expand for full list:
FUN_14002cfa5
PplpLazyInitializeLookasideList
SrvNetAllocateScavengerThread
SrvNetAllocateStatisticsQueuesEx
SrvNetCleanupConnectionScavenger
SrvNetCleanupStatisticsQueues
SrvNetCloseConnection
SrvNetCloseConnectionsInClosingList
SrvNetCloseEndpoint
SrvNetCloseRandomConnection
SrvNetCommonReceiveHandlerSrvNetConnectionScavengerThread
SrvNetDereferenceConnection
SrvNetDereferenceConnectionsInDereferenceList
SrvNetDisableStatisticsQueue
SrvNetDiscardPartiallyInitializedConnection
SrvNetDisconnectConnectionByServerName
SrvNetDisconnectConnectionInternalEx
SrvNetDisconnectSelectedEndpointConnections
SrvNetEndpointAcceptNewConnection
SrvNetEndpointAllocateConnections
SrvNetEndpointGetFreeConnection
SrvNetEndpointInsertFreeConnection
SrvNetEndpointProcessDisconnects
SrvNetEndpointProcessPdcActivation
SrvNetEndpointReopenTdiConnections
SrvNetFinalDereferenceInternal
SrvNetFreeClient
SrvNetFreeConnection
SrvNetFreeScavengerThread
SrvNetGetQueueStatistics
SrvNetInitializeStatisticsQueues
SrvNetMarkConnectionAuthenticated
SrvNetNotifyClientsOfEndpoint
SrvNetQuicServerReceiveEvent
SrvNetRdmaCloseSocket
SrvNetRdmaDisconnectEvent
SrvNetRdmaReceiveEvent
SrvNetReceiveData
SrvNetRegisterClient
SrvNetScavengerCloseConnection
SrvNetScavengerDisconnectConnection
SrvNetSetConnectionServerName
SrvNetSignalConnectionScavengerCheck
SrvNetStartClient
SrvNetStopClient
SrvNetTdiDisconnectHandler
SrvNetTdiReceiveCompletion
SrvNetTdiReceiveHandler
SrvNetTerminateIdleConnections
SrvNetTerminateScavenger
SrvNetTriggerScavenger
SrvNetUnpublishClientSlot
SrvNetUpdateStatisticsFromQueues
SrvNetWskDisconnectEvent
SrvNetWskReceiveComplete
SrvNetWskReceiveEvent
| |paramcount|0|0| |address|EXTERNAL:00000058|EXTERNAL:00000058| |sig|undefined KeReleaseSpinLock(void)|undefined KeReleaseSpinLock(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeReleaseSpinLock Calling Diff ```diff --- NTOSKRNL.EXE::KeReleaseSpinLock calling +++ NTOSKRNL.EXE::KeReleaseSpinLock calling @@ -1 +1 @@ -FUN_14002ccb1 +FUN_14002cfa5 @@ -10,0 +11 @@ +SrvNetCommonReceiveHandler @@ -31 +31,0 @@ -SrvNetHandleUnclaimedSmb1Connection @@ -52,0 +53 @@ +SrvNetUnpublishClientSlot ``` ## NTOSKRNL.EXE::ExWaitForRundownProtectionRelease ### Match Info |Key|srvnet-06.sys - srvnet-07.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|srvnet-06.sys|srvnet-07.sys| | :---: | :---: | :---: | |name|ExWaitForRundownProtectionRelease|ExWaitForRundownProtectionRelease| |fullname|NTOSKRNL.EXE::ExWaitForRundownProtectionRelease|NTOSKRNL.EXE::ExWaitForRundownProtectionRelease| |`refcount`|7|10| |length|0|0| |called||| |`calling`|PdcPortClose
SrvAdminNodeUninitialize
SrvNetCloseEndpoint
SrvNetDisableRdmaListenSocketsAndUnlinkSmbDirect
SrvNetRdmaCloseSocket|PdcPortClose
SrvAdminNodeUninitialize
SrvNetCloseEndpoint
SrvNetDeregisterClient
SrvNetDisableRdmaListenSocketsAndUnlinkSmbDirect
SrvNetNotifyClientsOfEndpoint
SrvNetRdmaCloseSocket
SrvNetTdiCloseConnection| |paramcount|0|0| |address|EXTERNAL:0000006a|EXTERNAL:0000006a| |sig|undefined ExWaitForRundownProtectionRelease(void)|undefined ExWaitForRundownProtectionRelease(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExWaitForRundownProtectionRelease Calling Diff ```diff --- NTOSKRNL.EXE::ExWaitForRundownProtectionRelease calling +++ NTOSKRNL.EXE::ExWaitForRundownProtectionRelease calling @@ -3,0 +4 @@ +SrvNetDeregisterClient @@ -4,0 +6 @@ +SrvNetNotifyClientsOfEndpoint @@ -5,0 +8 @@ +SrvNetTdiCloseConnection ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-25T23:53:48