# sstp_8737.dll-sstp_8875.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [ProcessReceivedNotification](#processreceivednotification) * [RemoveListenerComplete](#removelistenercomplete) * [SetupListenerComplete](#setuplistenercomplete) * [ConvertByteArrayToString](#convertbytearraytostring) * [Added](#added) * [Feature_1207409977__private_IsEnabledDeviceUsageNoInline](#feature_1207409977__private_isenableddeviceusagenoinline) * [wil_RtlStagingConfig_QueryFeatureState](#wil_rtlstagingconfig_queryfeaturestate) * [wil_RtlStagingConfig_RecordFeatureUsage](#wil_rtlstagingconfig_recordfeatureusage) * [wil_details_AreDependenciesEnabled](#wil_details_aredependenciesenabled) * [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache) * [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate) * [wil_details_GetNtDllProcedureAddress](#wil_details_getntdllprocedureaddress) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_MapReportingKind](#wil_details_mapreportingkind) * [ReleaseHostRouteInfoContext](#releasehostrouteinfocontext) * [Modified](#modified) * [CleanupCallCtx](#cleanupcallctx) * [InitiateCallContextCleanup](#initiatecallcontextcleanup) * [SstpThreadPoolRequestQueueCallback](#sstpthreadpoolrequestqueuecallback) * [AllocateAndInitializeCallContext](#allocateandinitializecallcontext) * [HfGetPointerFromHandle32](#hfgetpointerfromhandle32) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection](#api-ms-win-core-synch-l1-1-0dllentercriticalsection) * [API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW](#api-ms-win-core-libraryloader-l1-2-0dllgetmodulehandlew) * [API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl](#api-ms-win-core-io-l1-1-0dlldeviceiocontrol) * [StringCchPrintfW](#stringcchprintfw) * [McTemplateU0z_EventWriteTransfer](#mctemplateu0z_eventwritetransfer) * [API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError](#api-ms-win-core-errorhandling-l1-1-0dllgetlasterror) * [DereferenceRefCount](#dereferencerefcount) * [SyncDeviceControl](#syncdevicecontrol) * [__security_check_cookie](#__security_check_cookie) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection](#api-ms-win-core-synch-l1-1-0dllleavecriticalsection) * [__chkstk](#__chkstk) * [HfFreeHandle32](#hffreehandle32) * [McGenEventWrite_EventWriteTransfer](#mcgeneventwrite_eventwritetransfer) * [MSVCRT.DLL::exception::exception](#msvcrtdllexceptionexception) # Visual Chart Diff ```mermaid flowchart LR CleanupCallCtx-1-old<--Match 78%-->CleanupCallCtx-1-new InitiateCallContextCleanup-4-old<--Match 91%-->InitiateCallContextCleanup-4-new SstpThreadPoolRequestQueueCallback-4-old<--Match 3%-->SstpThreadPoolRequestQueueCallback-4-new AllocateAndInitializeCallContext-4-old<--Match 90%-->AllocateAndInitializeCallContext-4-new HfGetPointerFromHandle32-3-old<--Match 35%-->FormatRRASErrorString-3-new subgraph sstp_8875.dll CleanupCallCtx-1-new InitiateCallContextCleanup-4-new SstpThreadPoolRequestQueueCallback-4-new AllocateAndInitializeCallContext-4-new FormatRRASErrorString-3-new subgraph Added direction LR Feature_1207409977__private_IsEnabledDeviceUsageNoInline wil_RtlStagingConfig_QueryFeatureState wil_RtlStagingConfig_RecordFeatureUsage wil_details_AreDependenciesEnabled wil_details_FeatureReporting_IncrementOpportunityInCache wil_details_FeatureReporting_IncrementUsageInCache wil_details_FeatureReporting_RecordUsageInCache wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath wil_details_GetCurrentFeatureEnabledState wil_details_GetNtDllProcedureAddress wil_details_IsEnabledFallback wil_details_MapReportingKind ReleaseHostRouteInfoContext end end subgraph sstp_8737.dll CleanupCallCtx-1-old InitiateCallContextCleanup-4-old SstpThreadPoolRequestQueueCallback-4-old AllocateAndInitializeCallContext-4-old HfGetPointerFromHandle32-3-old subgraph Deleted direction LR ProcessReceivedNotification RemoveListenerComplete SetupListenerComplete ConvertByteArrayToString end end ``` ```mermaid pie showData title Function Matches - 98.1933% "unmatched_funcs_len" : 20 "matched_funcs_len" : 1087 ``` ```mermaid pie showData title Matched Function Similarity - 97.9761% "matched_funcs_with_code_changes_len" : 5 "matched_funcs_with_non_code_changes_len" : 17 "matched_funcs_no_changes_len" : 1065 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 sstp_8737.dll sstp_8875.dll ``` #### Verbose Args
``` --old ['sstp_8737.dll'] --new [['sstp_8875.dll']] --engine VersionTrackingDiff --output-path sstp_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/sstpsvc.dll/069427182E000/sstpsvc.dll -O sstpsvc.dll.x64.10.0.26100.8737 wget https://msdl.microsoft.com/download/symbols/sstpsvc.dll/8BDAB75F2F000/sstpsvc.dll -O sstpsvc.dll.x64.10.0.26100.8875 ``` ## Binary Metadata Diff ```diff --- sstp_8737.dll Meta +++ sstp_8875.dll Meta @@ -1,44 +1,44 @@ -Program Name: sstp_8737.dll +Program Name: sstp_8875.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 194640 +# of Bytes: 198736 # of Memory Blocks: 10 -# of Instructions: 20944 -# of Defined Data: 2088 -# of Functions: 548 -# of Symbols: 4395 -# of Data Types: 510 -# of Data Type Categories: 38 +# of Instructions: 21920 +# of Defined Data: 2121 +# of Functions: 559 +# of Symbols: 4498 +# of Data Types: 507 +# of Data Type Categories: 37 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Wed Aug 19 00:08:35 SGT 2026 +Date Created: Wed Aug 19 00:08:38 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/sstp/sstp_8737.dll -Executable MD5: b6b48ff0ed16e1101d35000d40b533e0 -Executable SHA256: 729367a7ab204b1025d418245219defb65e0f436b76685e1569c170f4b9a1f39 -FSRL: file:///tmp/sstp/sstp_8737.dll?MD5=b6b48ff0ed16e1101d35000d40b533e0 +Executable Location: /tmp/sstp/sstp_8875.dll +Executable MD5: 6e5e1f22f69a119fae24fc5bd9cd0348 +Executable SHA256: 416df55724c91f99087aa58f8dae317cc9851e8ebf7380ae0ccd9854567321d1 +FSRL: file:///tmp/sstp/sstp_8875.dll?MD5=6e5e1f22f69a119fae24fc5bd9cd0348 PDB Age: 1 PDB File: sstpsvc.pdb -PDB GUID: f01de328-6d09-9f19-35f7-d07813d25ee6 +PDB GUID: 13199cac-cf56-d8b2-6603-5dac56989b3c PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Provides the facility of using Secure Socket Tunneling Protocol (SSTP) to connect to remote computers (using VPN). -PE Property[FileVersion]: 10.0.26100.8737 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8875 (WinBuild.160101.0800) PE Property[InternalName]: sstpsvc.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: sstpsvc.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8737 +PE Property[ProductVersion]: 10.0.26100.8875 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra sstp_8737.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra sstp_8737.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra sstp_8737.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra sstp_8875.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra sstp_8875.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra sstp_8875.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|16| |deleted_funcs_len|4| |modified_funcs_len|22| |added_symbols_len|22| |deleted_symbols_len|0| |diff_time|5.56967568397522| |deleted_strings_len|0| |added_strings_len|3| |match_types|Counter({'SymbolsHash': 529, 'ExternalsName': 207, 'StructuralGraphHash': 4, 'ExactInstructionsFunctionHasher': 3, 'ExactBytesFunctionHasher': 2, 'Implied Match': 1})| |items_to_process|64| |diff_types|Counter({'address': 22, 'refcount': 19, 'calling': 15, 'code': 5, 'length': 5, 'called': 5, 'sig': 2, 'name': 1, 'fullname': 1})| |unmatched_funcs_len|20| |total_funcs_len|1107| |matched_funcs_len|1087| |matched_funcs_with_code_changes_len|5| |matched_funcs_with_non_code_changes_len|17| |matched_funcs_no_changes_len|1065| |match_func_similarity_percent|97.9761%| |func_match_overall_percent|98.1933%| |first_matches|Counter({'SymbolsHash': 529, 'StructuralGraphHash': 4, 'ExactInstructionsFunctionHasher': 3, 'ExactBytesFunctionHasher': 2, 'Implied Match': 1, 'ExternalsName': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 529 "ExternalsName" : 207 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 3 "StructuralGraphHash" : 4 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 529 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 3 "StructuralGraphHash" : 4 "Implied-Match" : 1 "ExternalsName" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 16 "deleted_funcs_len" : 4 "modified_funcs_len" : 22 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 22 "deleted_symbols_len" : 0 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 3 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,3 @@ +s_RtlNotifyFeatureUsage +s_RtlQueryFeatureConfiguration +u_ntdll.dll ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_ntdll.dll|1|wil_details_GetNtDllProcedureAddress| |s_RtlQueryFeatureConfiguration|1|wil_RtlStagingConfig_QueryFeatureState| |s_RtlNotifyFeatureUsage|1|wil_RtlStagingConfig_RecordFeatureUsage| # Deleted ## ProcessReceivedNotification ### Function Meta |Key|sstp_8737.dll| | :---: | :---: | |name|ProcessReceivedNotification| |fullname|ProcessReceivedNotification| |refcount|2| |length|391| |called|FormatRRASErrorString
InitializeSstpServer
McTemplateU0z_EventWriteTransfer
PostNotificationBufferToDevice
ProcessMakeCallRequest
RemoveListenerComplete
SetupListenerComplete
ShutdownSstpServer
__security_check_cookie
memset| |calling|SstpThreadPoolRequestQueueCallback| |paramcount|4| |address|18000a804| |sig|undefined __fastcall ProcessReceivedNotification(LPOVERLAPPED param_1, undefined8 param_2, undefined8 param_3, wchar_t * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- ProcessReceivedNotification +++ ProcessReceivedNotification @@ -1,79 +0,0 @@ - -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -void ProcessReceivedNotification - (LPOVERLAPPED param_1,undefined8 param_2,undefined8 param_3,wchar_t *param_4) - -{ - int iVar1; - size_t *psVar2; - wchar_t *pwVar3; - wchar_t *pwVar4; - undefined1 auStack_838 [32]; - uint local_818; - undefined1 local_814 [2044]; - ulonglong local_18; - - local_18 = __security_cookie ^ (ulonglong)auStack_838; - local_818 = 0; - pwVar3 = (wchar_t *)0x0; - pwVar4 = (wchar_t *)0x7fc; - memset(local_814,0,0x7fc); - if ((DAT_1800287c3 & 0x10) != 0) { - pwVar4 = L"ProcessReceivedNotification"; - local_818 = local_818 & 0xffff0000; - pwVar3 = L"Entering %ws"; - FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_818,0x18001bb00,(size_t *)L"ProcessReceivedNotification", - param_4); - if ((DAT_1800287c3 & 0x10) != 0) { - pwVar4 = (wchar_t *)&local_818; - pwVar3 = L"㚱က\x04"; - McTemplateU0z_EventWriteTransfer - (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo, - pwVar4); - if ((DAT_1800287c3 & 0x10) != 0) { - pwVar4 = (wchar_t *)(ulonglong)(uint)param_1[1].InternalHigh; - pwVar3 = L"Received NotificationBuffer with func-code %d"; - local_818 = local_818 & 0xffff0000; - FormatRRASErrorString((STRSAFE_LPWSTR)&local_818,0x18001cad0,(size_t *)pwVar4,param_4); - if ((DAT_1800287c3 & 0x10) != 0) { - pwVar4 = (wchar_t *)&local_818; - pwVar3 = L"㚱က\x04"; - McTemplateU0z_EventWriteTransfer - (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, - (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo,pwVar4); - } - } - } - } - iVar1 = (int)param_1[1].InternalHigh; - if (iVar1 == 0) { - PostNotificationBufferToDevice(param_1,pwVar3,pwVar4,param_4); - psVar2 = InitializeSstpServer(1,pwVar3,pwVar4,param_4); - SetupListenerComplete((uint)psVar2); - } - else if (iVar1 == 2) { - PostNotificationBufferToDevice(param_1,pwVar3,pwVar4,param_4); - ShutdownSstpServer(1,pwVar3,pwVar4,(ulonglong)param_4); - RemoveListenerComplete(); - } - else if (iVar1 == 4) { - ProcessMakeCallRequest - ((undefined4 *)((longlong)¶m_1[1].InternalHigh + 4),pwVar3,pwVar4,param_4); - PostNotificationBufferToDevice(param_1,pwVar3,pwVar4,param_4); - } - if ((DAT_1800287c3 & 0x10) != 0) { - local_818 = local_818 & 0xffff0000; - FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_818,0x18001bbb0,(size_t *)L"ProcessReceivedNotification", - param_4); - if ((DAT_1800287c3 & 0x10) != 0) { - McTemplateU0z_EventWriteTransfer - (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo, - (wchar_t *)&local_818); - } - } - return; -} - ``` ## RemoveListenerComplete ### Function Meta |Key|sstp_8737.dll| | :---: | :---: | |name|RemoveListenerComplete| |fullname|RemoveListenerComplete| |refcount|2| |length|210| |called|FormatRRASErrorString
McTemplateU0z_EventWriteTransfer
SyncDeviceControl
__security_check_cookie
memset| |calling|ProcessReceivedNotification| |paramcount|0| |address|18000a994| |sig|undefined __fastcall RemoveListenerComplete(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- RemoveListenerComplete +++ RemoveListenerComplete @@ -1,33 +0,0 @@ - -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Type propagation algorithm not settling */ - -void RemoveListenerComplete(void) - -{ - DWORD DVar1; - undefined1 auStackY_868 [32]; - DWORD local_828 [4]; - uint local_818; - undefined1 local_814 [2044]; - ulonglong local_18; - - local_18 = __security_cookie ^ (ulonglong)auStackY_868; - local_828[0] = 0; - local_818 = 0; - memset(local_814,0,0x7fc); - local_828[1] = 0; - DVar1 = SyncDeviceControl(*(HANDLE *)(SstpSvcGlobals + 0x118),0x12800c,local_828 + 1,4,(LPVOID)0x0 - ,0,local_828); - if ((DVar1 != 0) && ((DAT_1800287c3 & 8) != 0)) { - local_818 = local_818 & 0xffff0000; - FormatRRASErrorString((STRSAFE_LPWSTR)&local_818,0x18001c4d0,(size_t *)0x0,0); - if ((DAT_1800287c3 & 8) != 0) { - McTemplateU0z_EventWriteTransfer - (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError, - (wchar_t *)&local_818); - } - } - return; -} - ``` ## SetupListenerComplete ### Function Meta |Key|sstp_8737.dll| | :---: | :---: | |name|SetupListenerComplete| |fullname|SetupListenerComplete| |refcount|2| |length|224| |called|FormatRRASErrorString
McTemplateU0z_EventWriteTransfer
SyncDeviceControl
__security_check_cookie
memset| |calling|ProcessReceivedNotification| |paramcount|1| |address|18000aa70| |sig|undefined __fastcall SetupListenerComplete(uint param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- SetupListenerComplete +++ SetupListenerComplete @@ -1,35 +0,0 @@ - -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -void SetupListenerComplete(uint param_1) - -{ - DWORD DVar1; - undefined1 auStackY_868 [32]; - DWORD local_828; - uint local_824 [3]; - uint local_818; - undefined1 local_814 [2044]; - ulonglong local_18; - - local_18 = __security_cookie ^ (ulonglong)auStackY_868; - local_828 = 0; - local_818 = 0; - memset(local_814,0,0x7fc); - local_824[0] = param_1; - DVar1 = SyncDeviceControl(*(HANDLE *)(SstpSvcGlobals + 0x118),0x128004,local_824,4,(LPVOID)0x0,0, - &local_828); - if ((DVar1 != 0) && ((DAT_1800287c3 & 8) != 0)) { - local_818 = local_818 & 0xffff0000; - FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_818,0x18001c440,(size_t *)(ulonglong)param_1, - (ulonglong)param_1); - if ((DAT_1800287c3 & 8) != 0) { - McTemplateU0z_EventWriteTransfer - (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError, - (wchar_t *)&local_818); - } - } - return; -} - ``` ## ConvertByteArrayToString ### Function Meta |Key|sstp_8737.dll| | :---: | :---: | |name|ConvertByteArrayToString| |fullname|ConvertByteArrayToString| |refcount|3| |length|156| |called|StringCchPrintfW| |calling|SstpThreadPoolRequestQueueCallback| |paramcount|4| |address|18000f76c| |sig|undefined __fastcall ConvertByteArrayToString(byte * param_1, uint param_2, longlong param_3, uint param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- ConvertByteArrayToString +++ ConvertByteArrayToString @@ -1,25 +0,0 @@ - -void ConvertByteArrayToString(byte *param_1,uint param_2,longlong param_3,uint param_4) - -{ - uint uVar1; - uint uVar2; - - if (((param_1 != (byte *)0x0) && (param_3 != 0)) && (param_2 < param_4)) { - uVar2 = 0; - uVar1 = 0; - if (param_2 != 0) { - do { - if (param_4 - 2 <= uVar1) break; - StringCchPrintfW((STRSAFE_LPWSTR)(param_3 + (ulonglong)uVar1 * 2), - (ulonglong)(param_4 - uVar1),L"%.2X",(ulonglong)*param_1); - uVar1 = uVar1 + 2; - uVar2 = uVar2 + 1; - param_1 = param_1 + 1; - } while (uVar2 < param_2); - } - *(undefined2 *)(param_3 + (ulonglong)uVar1 * 2) = 0; - } - return; -} - ``` # Added ## Feature_1207409977__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|Feature_1207409977__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1207409977__private_IsEnabledDeviceUsageNoInline| |refcount|6| |length|44| |called|wil_details_IsEnabledFallback| |calling|AllocateAndInitializeCallContext
CleanupCallCtx
InitiateCallContextCleanup
SstpThreadPoolRequestQueueCallback| |paramcount|0| |address|18000ac8c| |sig|uint __fastcall Feature_1207409977__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1207409977__private_IsEnabledDeviceUsageNoInline +++ Feature_1207409977__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,15 @@ + +uint Feature_1207409977__private_IsEnabledDeviceUsageNoInline(void) + +{ + uint uVar1; + undefined8 local_res8; + + local_res8 = (undefined4 *)(ulonglong)Feature_1207409977__private_featureState; + if ((Feature_1207409977__private_featureState & 0x10) != 0) { + return Feature_1207409977__private_featureState & 1; + } + uVar1 = wil_details_IsEnabledFallback(local_res8,3); + return uVar1; +} + ``` ## wil_RtlStagingConfig_QueryFeatureState ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_RtlStagingConfig_QueryFeatureState| |fullname|wil_RtlStagingConfig_QueryFeatureState| |refcount|2| |length|240| |called|__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|3| |address|18000aff4| |sig|undefined8 __fastcall wil_RtlStagingConfig_QueryFeatureState(uint * param_1, undefined4 param_2, int param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_RtlStagingConfig_QueryFeatureState +++ wil_RtlStagingConfig_QueryFeatureState @@ -0,0 +1,45 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +undefined8 wil_RtlStagingConfig_QueryFeatureState(uint *param_1,undefined4 param_2,int param_3) + +{ + int iVar1; + undefined8 uVar2; + undefined1 auStack_68 [48]; + undefined8 local_38; + undefined8 local_30; + uint local_28; + ulonglong local_20; + + local_20 = __security_cookie ^ (ulonglong)auStack_68; + uVar2 = 0; + local_38 = 0; + local_30 = 0; + local_28 = 0; + if ((g_wil_details_pfnRtlQueryFeatureConfiguration == (code *)0x0) && + (g_wil_details_pfnRtlQueryFeatureConfiguration = + (code *)wil_details_GetNtDllProcedureAddress("RtlQueryFeatureConfiguration"), + g_wil_details_pfnRtlQueryFeatureConfiguration == (code *)0x0)) { + return 0; + } + iVar1 = (*g_wil_details_pfnRtlQueryFeatureConfiguration)(param_2,param_3 == 0,&local_38,&local_30) + ; + if (iVar1 == 0) { + uVar2 = 1; + *param_1 = local_30._4_4_ >> 4 & 3; + *(byte *)(param_1 + 1) = (byte)((ulonglong)local_30 >> 0x28) & 0x3f; + param_1[3] = local_28; + param_1[2] = local_30._4_4_ >> 0xe & 3; + param_1[5] = local_30._4_4_ >> 6 & 1; + param_1[4] = local_30._4_4_ >> 7 & 1; + } + else if (iVar1 == 0x117) { + uVar2 = 1; + param_1[4] = local_30._4_4_ >> 7 & 1; + } + return uVar2; +} + ``` ## wil_RtlStagingConfig_RecordFeatureUsage ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_RtlStagingConfig_RecordFeatureUsage| |fullname|wil_RtlStagingConfig_RecordFeatureUsage| |refcount|2| |length|87| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|3| |address|18000b0ec| |sig|undefined8 __fastcall wil_RtlStagingConfig_RecordFeatureUsage(undefined4 param_1, undefined2 param_2, int param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_RtlStagingConfig_RecordFeatureUsage +++ wil_RtlStagingConfig_RecordFeatureUsage @@ -0,0 +1,28 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +undefined8 +wil_RtlStagingConfig_RecordFeatureUsage(undefined4 param_1,undefined2 param_2,int param_3) + +{ + uint6 uVar1; + undefined8 uVar2; + undefined8 local_res20; + + local_res20._0_6_ = CONCAT24(param_2,param_1); + uVar1 = (uint6)local_res20; + local_res20 = (ulonglong)(uint6)local_res20; + if (param_3 != 0) { + local_res20 = CONCAT26(1,uVar1); + } + if ((g_wil_details_pfnRtlNotifyFeatureUsage == (code *)0x0) && + (g_wil_details_pfnRtlNotifyFeatureUsage = + (code *)wil_details_GetNtDllProcedureAddress("RtlNotifyFeatureUsage"), + g_wil_details_pfnRtlNotifyFeatureUsage == (code *)0x0)) { + return 0xc0000139; + } + uVar2 = (*g_wil_details_pfnRtlNotifyFeatureUsage)(&local_res20); + return uVar2; +} + ``` ## wil_details_AreDependenciesEnabled ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_AreDependenciesEnabled| |fullname|wil_details_AreDependenciesEnabled| |refcount|2| |length|150| |called|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|1| |address|18000b14c| |sig|int __fastcall wil_details_AreDependenciesEnabled(longlong param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_AreDependenciesEnabled +++ wil_details_AreDependenciesEnabled @@ -0,0 +1,48 @@ + +int wil_details_AreDependenciesEnabled(longlong param_1) + +{ + uint uVar1; + undefined8 *puVar2; + int iVar3; + int iVar4; + longlong *plVar5; + ulonglong local_res8; + + plVar5 = *(longlong **)(param_1 + 0x20); + iVar3 = 1; + iVar4 = iVar3; + if (plVar5 != (longlong *)0x0) { + do { + while( true ) { + puVar2 = (undefined8 *)*plVar5; + if (puVar2 == (undefined8 *)0x0) { + return iVar3; + } + if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && + (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; + if ((iVar3 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { + return 0; + } + iVar3 = 1; + plVar5 = plVar5 + 1; + } + uVar1 = *(uint *)*puVar2; + local_res8 = (ulonglong)uVar1; + if ((uVar1 & 2) == 0) { + local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*puVar2,local_res8,(longlong)puVar2); + } + if ((iVar3 == 0) || ((local_res8 & 1) == 0)) { + iVar3 = 0; + } + else { + iVar3 = 1; + } + plVar5 = plVar5 + 1; + iVar4 = 0; + } while (iVar3 != 0); + } + return iVar4; +} + ``` ## wil_details_FeatureReporting_IncrementOpportunityInCache ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementOpportunityInCache| |fullname|wil_details_FeatureReporting_IncrementOpportunityInCache| |refcount|2| |length|208| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|18000b1ec| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementOpportunityInCache +++ wil_details_FeatureReporting_IncrementOpportunityInCache @@ -0,0 +1,54 @@ + +void wil_details_FeatureReporting_IncrementOpportunityInCache + (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar2 = *param_1; + do { + uVar4 = uVar2; + param_4[1] = 0; + uVar1 = uVar4 | 1; + if ((uVar4 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) { + uVar2 = (uVar4 & 0x3f8000) >> 0xf; + if (uVar2 != 0) { + param_4[1] = uVar2; + uVar2 = 5; + if (param_2 != 1) { + uVar2 = 1; + } + uVar1 = uVar4 & 0xffc07fff | 1; + param_4[2] = uVar2; + } + uVar2 = 0; + if (param_2 == 5) { + uVar2 = 0x400000; + } + uVar1 = uVar2 | uVar1 & 0xffbfffff; + } + uVar2 = uVar1 >> 0xf & 0x7f; + uVar3 = uVar2 + 1; + if ((0x7f < uVar3) || (uVar3 < uVar2)) { + uVar3 = 1; + param_4[2] = param_2; + param_4[1] = uVar2; + } + LOCK(); + uVar2 = *param_1; + bVar5 = uVar4 == uVar2; + if (bVar5) { + *param_1 = (uVar3 << 0xf ^ uVar1) & 0x3f8000 ^ uVar1; + uVar2 = uVar4; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar4 & 1; + return; +} + ``` ## wil_details_FeatureReporting_IncrementUsageInCache ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementUsageInCache| |fullname|wil_details_FeatureReporting_IncrementUsageInCache| |refcount|2| |length|220| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|18000b2c4| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementUsageInCache +++ wil_details_FeatureReporting_IncrementUsageInCache @@ -0,0 +1,50 @@ + +void wil_details_FeatureReporting_IncrementUsageInCache + (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar4 = *param_1; + do { + uVar3 = uVar4; + param_4[1] = 0; + uVar1 = uVar3 | 1; + if ((uVar3 & 0x4000) >> 0xe != (uint)(param_2 == 4)) { + uVar4 = (uVar3 & 0x3fe0) >> 5; + if (uVar4 != 0) { + param_4[1] = uVar4; + param_4[2] = ~-(uint)(param_2 != 0) & 4; + uVar1 = uVar3 & 0xffffc01f | 1; + } + uVar4 = 0; + if (param_2 == 4) { + uVar4 = 0x4000; + } + uVar1 = uVar4 | uVar1 & 0xffffbfff; + } + uVar4 = uVar1 >> 5 & 0x1ff; + uVar2 = uVar4 + 1; + if ((0x1ff < uVar2) || (uVar2 < uVar4)) { + uVar2 = 1; + param_4[2] = param_2; + param_4[1] = uVar4; + } + LOCK(); + uVar4 = *param_1; + bVar5 = uVar3 == uVar4; + if (bVar5) { + *param_1 = (uVar2 << 5 ^ uVar1) & 0x3fe0 ^ uVar1; + uVar4 = uVar3; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar3 & 1; + return; +} + ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2| |length|374| |called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|4| |address|18000b3a8| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -0,0 +1,101 @@ + +uint * wil_details_FeatureReporting_RecordUsageInCache + (uint *param_1,uint *param_2,undefined8 param_3,uint param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint uVar5; + bool bVar6; + + uVar3 = (uint)param_3; + param_1[0] = 0; + param_1[1] = 0; + param_1[2] = 0; + param_1[3] = 0; + param_1[4] = 0; + param_1[5] = 0; + if (uVar3 == 0) { +LAB_18000b500: + wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar3,param_3,param_1); + } + else { + if (uVar3 == 1) { +LAB_18000b4f3: + wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar3,param_3,param_1); + return param_1; + } + if ((uVar3 != 2) && (uVar3 != 3)) { + if (uVar3 == 4) goto LAB_18000b500; + if (uVar3 == 5) goto LAB_18000b4f3; + if ((uVar3 != 6) && (uVar3 != 7)) { + uVar4 = uVar3 - 0x140; + if ((int)uVar4 < 0x40) { + uVar5 = param_2[1]; + do { + if (((uVar5 & 0x10) == 0) || (uVar2 = 1, (uVar5 >> 5 & 0x3f) != uVar4)) { + uVar2 = 0; + } + param_1[4] = uVar2; + LOCK(); + uVar2 = param_2[1]; + bVar6 = uVar5 == uVar2; + if (bVar6) { + param_2[1] = (uVar4 * 0x20 ^ uVar5) & 0x7e0 ^ uVar5 | 0x10; + uVar2 = uVar5; + } + uVar5 = uVar2; + UNLOCK(); + } while (!bVar6); + if (param_1[4] != 0) { + return param_1; + } + } + param_1[2] = uVar3; + param_1[1] = 1; + param_1[3] = param_4; + return param_1; + } + } + uVar4 = 0; + if (uVar3 == 2) { + uVar4 = 2; + } + else if (uVar3 == 3) { + uVar4 = 8; + } + else if (uVar3 == 6) { + uVar4 = 4; + } + else if (uVar3 == 7) { + uVar4 = 0x10; + } + uVar5 = 1; + uVar3 = *param_2; + do { + uVar1 = uVar3; + uVar3 = uVar4 | uVar1; + param_1[4] = (uint)(uVar3 == uVar1); + uVar2 = uVar3 | 1; + if (uVar3 == uVar1) { + uVar2 = uVar3; + } + LOCK(); + uVar3 = *param_2; + bVar6 = uVar1 == uVar3; + if (bVar6) { + *param_2 = uVar2; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar6); + if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) { + uVar5 = 0; + } + *param_1 = uVar5; + } + return param_1; +} + ``` ## wil_details_FeatureReporting_ReportUsageToService ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService| |refcount|2| |length|114| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil_details_IsEnabledFallback| |paramcount|3| |address|18000b528| |sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, uint param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -0,0 +1,28 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +void wil_details_FeatureReporting_ReportUsageToService + (undefined8 param_1,undefined8 param_2,uint param_3) + +{ + bool bVar1; + uint uVar2; + undefined7 extraout_var; + ulonglong uVar3; + uint uVar4; + uint local_res18 [4]; + + uVar4 = (uint)param_2 & 1; + uVar3 = (ulonglong)param_3; + local_res18[0] = param_3; + uVar2 = wil_details_MapReportingKind(param_3,uVar4); + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,(ulonglong)uVar2); + if (((int)CONCAT71(extraout_var,bVar1) != 0) && + (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { + (*g_wil_details_pfnFeatureLoggingHook) + (0x3bba30f,&Feature_1207409977_logged_traits,0,uVar4,local_res18,0,0,1); + } + return; +} + ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2| |length|137| |called|__security_check_cookie
wil_RtlStagingConfig_RecordFeatureUsage
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3| |address|18000b5a4| |sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, undefined8 param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -0,0 +1,24 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +bool wil_details_FeatureReporting_ReportUsageToServiceDirect + (undefined8 param_1,undefined8 param_2,undefined8 param_3) + +{ + uint *puVar1; + undefined1 auStack_78 [48]; + uint local_48 [10]; + undefined8 local_20; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_78; + puVar1 = wil_details_FeatureReporting_RecordUsageInCache + (local_48,(uint *)&Feature_1207409977__private_reporting,param_3, + (uint)((ulonglong)param_2 >> 0x20)); + local_20 = *(undefined8 *)(puVar1 + 4); + if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) { + wil_RtlStagingConfig_RecordFeatureUsage(0x3bba30f,(short)param_3,(uint)param_2 >> 0xb & 1); + } + return (int)local_20 == 0; +} + ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3| |length|263| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetCurrentFeatureEnabledState| |calling|wil_details_AreDependenciesEnabled
wil_details_IsEnabledFallback| |paramcount|3| |address|18000b634| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -0,0 +1,70 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (uint *param_1,ulonglong param_2,longlong param_3) + +{ + undefined4 uVar1; + int iVar2; + uint uVar3; + uint uVar4; + ulonglong uVar5; + uint uVar6; + ulonglong uVar7; + bool bVar8; + uint local_res8 [2]; + undefined8 local_res10; + + iVar2 = 0; + local_res8[0] = 0; + local_res10 = param_2; + if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) { + iVar2 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); + } + uVar3 = wil_details_GetCurrentFeatureEnabledState(param_3,local_res8); + if (*(char *)(param_3 + 0x1c) == '\0') { + local_res8[0] = local_res8[0] & -(uint)(iVar2 != 0); + } + uVar5 = param_2 & 0xffffffff; + do { + uVar7 = param_2; + uVar6 = (uint)uVar5; + uVar4 = uVar6 | 0x40000; + uVar1 = local_res10._4_4_; + local_res10 = CONCAT44(local_res10._4_4_,uVar6) | 0x40000; + if ((local_res8[0] != 0) && ((uVar5 & 2) == 0)) { + uVar6 = uVar6 & 0xfffff63e | 0x40000 | uVar3 & 0x9c1; + uVar4 = uVar6 | 2; + local_res10 = CONCAT44(uVar1,uVar6) | 2; + } + if ((uVar7 & 4) == 0) { + uVar6 = uVar3 & 0x400 | uVar4 & 0xfffffbff; + uVar4 = uVar6 | 4; + local_res10 = CONCAT44(local_res10._4_4_,uVar6) | 4; + } + uVar5 = uVar7 & 0xffffffff; + LOCK(); + uVar6 = *param_1; + bVar8 = (uint)uVar7 == uVar6; + if (bVar8) { + *param_1 = uVar4; + } + else { + uVar5 = (ulonglong)uVar6; + } + UNLOCK(); + param_2 = uVar5; + } while (!bVar8); + if (((uVar7 & 4) == 0) && + (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) { + (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) + (param_1,*(undefined1 *)(param_3 + 0x1c),iVar2); + } + if (local_res8[0] == 0) { + local_res10 = CONCAT44(local_res10._4_4_,uVar3 & 0x9c1 | uVar4 & 0xfffff63e); + } + return local_res10; +} + ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|1| |length|76| |called|| |calling|wil_details_IsEnabledFallback| |paramcount|2| |address|18000b744| |sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -0,0 +1,41 @@ + +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + bool bVar4; + + if (param_2 == 3) { + uVar3 = 0x10; + } + else { + if (param_2 != 4) { + return; + } + uVar3 = 0x20; + } + if ((Feature_1207409977__private_featureState & 2) != 0) { + uVar2 = Feature_1207409977__private_featureState; + while ((uVar2 & 1) == (param_1 & 1)) { + LOCK(); + bVar4 = uVar2 == Feature_1207409977__private_featureState; + uVar1 = uVar3 | uVar2; + if (!bVar4) { + uVar2 = Feature_1207409977__private_featureState; + uVar1 = Feature_1207409977__private_featureState; + } + Feature_1207409977__private_featureState = uVar1; + UNLOCK(); + if (bVar4) { + return; + } + if ((uVar2 & 2) == 0) { + return; + } + } + } + return; +} + ``` ## wil_details_GetCurrentFeatureEnabledState ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_GetCurrentFeatureEnabledState| |fullname|wil_details_GetCurrentFeatureEnabledState| |refcount|2| |length|266| |called|wil_RtlStagingConfig_QueryFeatureState
wil_details_AreDependenciesEnabled| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |paramcount|2| |address|18000b798| |sig|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_GetCurrentFeatureEnabledState +++ wil_details_GetCurrentFeatureEnabledState @@ -0,0 +1,56 @@ + +uint wil_details_GetCurrentFeatureEnabledState(longlong param_1,undefined4 *param_2) + +{ + char cVar1; + uint uVar2; + undefined8 uVar3; + uint uVar4; + uint uVar5; + uint uVar6; + uint uVar7; + uint uVar8; + uint uVar9; + uint local_38 [8]; + + cVar1 = *(char *)(param_1 + 0x1c); + local_38[0] = 0; + local_38[1] = 0; + local_38[2] = 0; + local_38[3] = 0; + uVar7 = 1; + *param_2 = 1; + local_38[4] = 0; + local_38[5] = 0; + uVar3 = wil_RtlStagingConfig_QueryFeatureState + (local_38,*(undefined4 *)(param_1 + 0x18),(uint)((byte)(cVar1 - 2U) < 2)); + uVar5 = -(uint)(local_38[5] != 0) & 0x800; + uVar8 = -(uint)(local_38[4] != 0) & 0x400 | uVar5; + uVar2 = -(uint)((int)uVar3 != 0) & local_38[0] & 3; + uVar4 = uVar2 << 7; + if (uVar2 == 0) { + uVar2 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40; + } + else { + uVar2 = 0; + if (local_38[0] == 2) { + uVar2 = 0x40; + } + } + uVar6 = uVar2 | uVar4 | uVar8; + uVar9 = uVar7; + if ((uVar8 == 0xc00) || (uVar9 = 0, uVar2 != 0)) { + uVar8 = uVar7; + if (*(longlong *)(param_1 + 0x20) != 0) { + uVar8 = wil_details_AreDependenciesEnabled(param_1); + } + if ((uVar9 != 0) && (uVar8 == 0)) { + uVar6 = uVar2 | uVar4 | uVar5; + } + if (((uVar6 & 0x40) != 0) && (uVar8 != 0)) goto LAB_18000b881; + } + uVar7 = 0; +LAB_18000b881: + return uVar6 | uVar7; +} + ``` ## wil_details_GetNtDllProcedureAddress ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_GetNtDllProcedureAddress| |fullname|wil_details_GetNtDllProcedureAddress| |refcount|3| |length|65| |called|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW| |calling|wil_RtlStagingConfig_QueryFeatureState
wil_RtlStagingConfig_RecordFeatureUsage| |paramcount|1| |address|18000b8ac| |sig|undefined __fastcall wil_details_GetNtDllProcedureAddress(undefined8 param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_GetNtDllProcedureAddress +++ wil_details_GetNtDllProcedureAddress @@ -0,0 +1,14 @@ + +void wil_details_GetNtDllProcedureAddress(undefined8 param_1) + +{ + if (`wil_details_GetNtDllModuleHandle'::__l2::wil_details_ntdllModuleHandle == (HMODULE)0x0) { + `wil_details_GetNtDllModuleHandle'::__l2::wil_details_ntdllModuleHandle = + GetModuleHandleW(L"ntdll.dll"); + } + /* WARNING: Could not recover jumptable at 0x00018000b8e6. Too many branches */ + /* WARNING: Treating indirect jump as call */ + GetProcAddress(`wil_details_GetNtDllModuleHandle'::__l2::wil_details_ntdllModuleHandle,param_1); + return; +} + ``` ## wil_details_IsEnabledFallback ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback| |refcount|2| |length|135| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |calling|Feature_1207409977__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|18000b8f8| |sig|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -0,0 +1,26 @@ + +uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) + +{ + uint uVar1; + undefined4 *puVar2; + ulonglong local_res18; + + uVar1 = (uint)param_1; + local_res18 = (ulonglong)param_1 & 0xffffffff; + if (((ulonglong)param_1 & 2) == 0) { + puVar2 = &Feature_1207409977__private_featureState; + local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (&Feature_1207409977__private_featureState,(ulonglong)param_1, + 0x180026d20); + param_1 = puVar2; + uVar1 = (uint)local_res18; + } + if ((param_2 != 0) && + (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), + param_2 - 3 < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); + } + return uVar1 & 1; +} + ``` ## wil_details_MapReportingKind ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|wil_details_MapReportingKind| |fullname|wil_details_MapReportingKind| |refcount|1| |length|144| |called|| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|2| |address|18000b988| |sig|uint __fastcall wil_details_MapReportingKind(int param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_MapReportingKind +++ wil_details_MapReportingKind @@ -0,0 +1,33 @@ + +uint wil_details_MapReportingKind(int param_1,int param_2) + +{ + byte bVar1; + + if (param_1 != 0) { + if (param_1 == 1) { + return ~-(uint)(param_2 != 0) & 4; + } + if (param_1 == 2) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 5; + } + if (param_1 == 3) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 6; + } + if (param_1 == 4) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 7; + } + if (param_1 == 5) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 10; + } + if (param_1 == 6) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 0xb; + } + bVar1 = (char)param_1 + 0x9c; + if (bVar1 < 0x32) { + return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1; + } + } + return 0xff; +} + ``` ## ReleaseHostRouteInfoContext ### Function Meta |Key|sstp_8875.dll| | :---: | :---: | |name|ReleaseHostRouteInfoContext| |fullname|ReleaseHostRouteInfoContext| |refcount|2| |length|111| |called|DereferenceRefCount
_guard_dispatch_icall$thunk$10345483385596137414| |calling|CleanupCallCtx| |paramcount|1| |address|1800178ec| |sig|undefined __fastcall ReleaseHostRouteInfoContext(int * param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- ReleaseHostRouteInfoContext +++ ReleaseHostRouteInfoContext @@ -0,0 +1,21 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +void ReleaseHostRouteInfoContext(int *param_1) + +{ + if (DAT_1800298e8 != 0) { + (*gHostRoutTemplateFunc) + (gHostRoutEtwContext,DAT_1800298e8,L"Entering ReleaseHostRouteInfoContext"); + } + if (param_1 != (int *)0x0) { + DereferenceRefCount(param_1); + } + if (DAT_1800298e8 != 0) { + (*gHostRoutTemplateFunc) + (gHostRoutEtwContext,DAT_1800298e8,L"Leaving ReleaseHostRouteInfoContext"); + } + return; +} + ``` # Modified *Modified functions contain code changes* ## CleanupCallCtx ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.69| |i_ratio|0.4| |m_ratio|0.92| |b_ratio|0.78| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|CleanupCallCtx|CleanupCallCtx| |fullname|CleanupCallCtx|CleanupCallCtx| |refcount|4|4| |`length`|638|547| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::DeleteCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
DereferenceRefCount
FormatRRASErrorString
FreeBufferToPool
HfFreeHandle32
McTemplateU0z_EventWriteTransfer
WEBIO.DLL::Ordinal_4
WEBIO.DLL::Ordinal_5
__security_check_cookie_guard_dispatch_icall$thunk$10345483385596137414
memset
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::DeleteCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
Feature_1207409977__private_IsEnabledDeviceUsageNoInline
FormatRRASErrorString
FreeBufferToPool
HfFreeHandle32
McTemplateU0z_EventWriteTransfer
ReleaseHostRouteInfoContext
WEBIO.DLL::Ordinal_4
WEBIO.DLL::Ordinal_5__security_check_cookie
memset
| |calling||| |paramcount|1|1| |`address`|18000a0e0|18000a8f0| |sig|undefined __fastcall CleanupCallCtx(longlong param_1)|undefined __fastcall CleanupCallCtx(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CleanupCallCtx Called Diff ```diff --- CleanupCallCtx called +++ CleanupCallCtx called @@ -4 +4 @@ -DereferenceRefCount +Feature_1207409977__private_IsEnabledDeviceUsageNoInline @@ -8,0 +9 @@ +ReleaseHostRouteInfoContext @@ -12 +12,0 @@ -_guard_dispatch_icall$thunk$10345483385596137414 ``` ### CleanupCallCtx Diff ```diff --- CleanupCallCtx +++ CleanupCallCtx @@ -1,80 +1,69 @@ -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void CleanupCallCtx(longlong param_1) { - int *piVar1; - uint uVar2; + uint uVar1; undefined1 auStack_838 [32]; uint local_818; undefined1 local_814 [2044]; ulonglong local_18; local_18 = __security_cookie ^ (ulonglong)auStack_838; local_818 = 0; memset(local_814,0,0x7fc); - EnterCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xb8)); - HfFreeHandle32(*(int **)(SstpSvcGlobals + 0xb0),(uint *)(param_1 + 0x24)); - LeaveCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xb8)); + uVar1 = Feature_1207409977__private_IsEnabledDeviceUsageNoInline(); + if (uVar1 == 0) { + EnterCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xb8)); + HfFreeHandle32(*(int **)(SstpSvcGlobals + 0xb0),(uint *)(param_1 + 0x24)); + LeaveCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xb8)); + } if (*(char *)(param_1 + 0x28) != '\0') { if (*(longlong *)(param_1 + 0xf0) != 0) { - uVar2 = Ordinal_4(*(longlong *)(param_1 + 0xf0),0); - if ((uVar2 != 0) && ((DAT_0 & 8) != 0)) { + uVar1 = Ordinal_4(*(longlong *)(param_1 + 0xf0),0); + if ((uVar1 != 0) && ((DAT_0 & 8) != 0)) { local_818 = local_818 & 0xffff0000; FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_818,0x18001c1b0,(size_t *)(param_1 + 0x158), - (ulonglong)uVar2); + ((STRSAFE_LPWSTR)&local_818,0x18001d1a0,(size_t *)(param_1 + 0x158), + (ulonglong)uVar1); if ((DAT_0 & 8) != 0) { McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,(wchar_t *)&local_818); } } *(undefined8 *)(param_1 + 0xf0) = 0; } if (*(longlong *)(param_1 + 0xe8) != 0) { - uVar2 = Ordinal_5(*(longlong *)(param_1 + 0xe8),0); - if ((uVar2 != 0) && ((DAT_0 & 8) != 0)) { + uVar1 = Ordinal_5(*(longlong *)(param_1 + 0xe8),0); + if ((uVar1 != 0) && ((DAT_0 & 8) != 0)) { local_818 = local_818 & 0xffff0000; FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_818,0x18001c220,(size_t *)(param_1 + 0x158), - (ulonglong)uVar2); + ((STRSAFE_LPWSTR)&local_818,0x18001d210,(size_t *)(param_1 + 0x158), + (ulonglong)uVar1); if ((DAT_0 & 8) != 0) { McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,(wchar_t *)&local_818); } } *(undefined8 *)(param_1 + 0xe8) = 0; } - piVar1 = *(int **)(param_1 + 0x150); - if (DAT_1 != 0) { - (*gHostRoutTemplateFunc) - (gHostRoutEtwContext,DAT_1,L"Entering ReleaseHostRouteInfoContext"); - } - if (piVar1 != (int *)0x0) { - DereferenceRefCount(piVar1); - } - if (DAT_1 != 0) { - (*gHostRoutTemplateFunc) - (gHostRoutEtwContext,DAT_1,L"Leaving ReleaseHostRouteInfoContext"); - } + ReleaseHostRouteInfoContext(*(int **)(param_1 + 0x150)); } DeleteCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x50)); if ((DAT_0 & 8) != 0) { local_818 = local_818 & 0xffff0000; FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_818,0x18001c290,(size_t *)(param_1 + 0x158),param_1 + -0xd0); + ((STRSAFE_LPWSTR)&local_818,0x18001d280,(size_t *)(param_1 + 0x158),param_1 + -0xd0); if ((DAT_0 & 8) != 0) { McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError, (wchar_t *)&local_818); } } FreeBufferToPool((uint *)(SstpSvcGlobals + 0x218),param_1 + -0xd0,'\x01'); return; } ``` ## InitiateCallContextCleanup ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.98| |i_ratio|0.61| |m_ratio|0.97| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|InitiateCallContextCleanup|InitiateCallContextCleanup| |fullname|InitiateCallContextCleanup|InitiateCallContextCleanup| |refcount|34|34| |`length`|1169|1256| |`called`|
Expand for full list:
API-MS-WIN-CORE-IO-L1-1-0.DLL::CancelIoEx
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolWork
DereferenceRefCount
DisconnectClientHttpCallContext
DisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
FormatRRASErrorString
FreeBufferToPool
InitiateCallContextCleanupMcTemplateU0z_EventWriteTransfer
NotifyMakeCallComplete
__security_check_cookie
memset
|
Expand for full list:
API-MS-WIN-CORE-IO-L1-1-0.DLL::CancelIoEx
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolWork
DereferenceRefCount
DisconnectClientHttpCallContext
DisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
Feature_1207409977__private_IsEnabledDeviceUsageNoInline
FormatRRASErrorString
FreeBufferToPoolHfFreeHandle32
InitiateCallContextCleanup
McTemplateU0z_EventWriteTransfer
NotifyMakeCallComplete
__security_check_cookie
memset
| |calling|
Expand for full list:
DeinitializeTransport
DisconnectClientHttpCallContext
DisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
ForwardMakeCallRequest
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitiateCallContextCleanup
InitiateSstpResponse
PostReceiveOnCall
ProcessMakeCallRequestProcessNewCall
ProcessReceivedBytesWorker
ProxySendToRelatedCtx
SendToNetworkWorker
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
SstpWebSendRequestEntityCompletion
|
Expand for full list:
DeinitializeTransport
DisconnectClientHttpCallContext
DisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
ForwardMakeCallRequest
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitiateCallContextCleanup
InitiateSstpResponse
PostReceiveOnCall
ProcessMakeCallRequestProcessNewCall
ProcessReceivedBytesWorker
ProxySendToRelatedCtx
SendToNetworkWorker
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
SstpWebSendRequestEntityCompletion
| |paramcount|4|4| |`address`|18000292c|1800020bc| |sig|undefined __fastcall InitiateCallContextCleanup(longlong param_1, uint param_2, undefined8 param_3, ulonglong param_4)|undefined __fastcall InitiateCallContextCleanup(longlong param_1, uint param_2, undefined8 param_3, ulonglong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### InitiateCallContextCleanup Called Diff ```diff --- InitiateCallContextCleanup called +++ InitiateCallContextCleanup called @@ -8,0 +9 @@ +Feature_1207409977__private_IsEnabledDeviceUsageNoInline @@ -10,0 +12 @@ +HfFreeHandle32 ``` ### InitiateCallContextCleanup Diff ```diff --- InitiateCallContextCleanup +++ InitiateCallContextCleanup @@ -1,175 +1,181 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void InitiateCallContextCleanup(longlong param_1,uint param_2,undefined8 param_3,ulonglong param_4) { LPCRITICAL_SECTION lpCriticalSection; longlong lVar1; longlong *plVar2; longlong *plVar3; uint uVar4; wchar_t *pwVar5; wchar_t *pwVar6; bool bVar7; undefined1 auStack_848 [32]; uint local_828; undefined1 local_824 [2044]; ulonglong local_28; local_28 = __security_cookie ^ (ulonglong)auStack_848; pwVar5 = (wchar_t *)0x0; local_828 = 0; pwVar6 = (wchar_t *)0x7fc; memset(local_824,0,0x7fc); if ((DAT_0 & 8) != 0) { param_4 = (ulonglong)*(uint *)(param_1 + 0xfc); pwVar6 = (wchar_t *)(param_1 + 0x228); pwVar5 = L"CoId=%hs:InitiateContextCleanup(0x%x)"; local_828 = local_828 & 0xffff0000; - FormatRRASErrorString((STRSAFE_LPWSTR)&local_828,0x18001c360,(size_t *)pwVar6,param_4); + FormatRRASErrorString((STRSAFE_LPWSTR)&local_828,0x18001d350,(size_t *)pwVar6,param_4); if ((DAT_0 & 8) != 0) { pwVar6 = (wchar_t *)&local_828; pwVar5 = L"㚰က\x02"; McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError, pwVar6); } } LOCK(); *(int *)(param_1 + 0xd0) = *(int *)(param_1 + 0xd0) + 1; UNLOCK(); lVar1 = *(longlong *)(param_1 + 0x270); if (lVar1 != 0) { *(undefined8 *)(param_1 + 0x270) = 0; LeaveCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x120)); EnterCriticalSection((LPCRITICAL_SECTION)(lVar1 + 0x120)); pwVar5 = (wchar_t *)(ulonglong)param_2; InitiateCallContextCleanup(lVar1,param_2,pwVar6,param_4); DereferenceRefCount((int *)(lVar1 + 0xd0)); EnterCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x120)); } if (*(int *)(param_1 + 0xfc) != 0) { if (*(char *)(param_1 + 0x1b3) == '\0') { LOCK(); *(int *)(param_1 + 0xd0) = *(int *)(param_1 + 0xd0) + 1; UNLOCK(); *(undefined1 *)(param_1 + 0x1b3) = 1; } uVar4 = *(uint *)(param_1 + 0xfc); if ((uVar4 & 0x20) != 0) { uVar4 = uVar4 & 0xffffffdf; *(uint *)(param_1 + 0xfc) = uVar4; if (param_2 == 1) { if ((*(byte *)(param_1 + 0x268) & 2) == 0) { uVar4 = uVar4 | 0x40; LAB_1: *(uint *)(param_1 + 0xfc) = uVar4; } } else if (param_2 == 0) { uVar4 = uVar4 | 0x200; goto LAB_1; } } if ((uVar4 >> 0x10 & 1) == 0) { if ((uVar4 & 8) != 0) { *(uint *)(param_1 + 0xfc) = uVar4 & 0xfffffff7 | 0x4000; LeaveCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x120)); pwVar5 = (wchar_t *)(ulonglong)*(uint *)(param_1 + 0x10c); pwVar6 = (wchar_t *)(param_1 + 0x250); NotifyMakeCallComplete(param_1,*(uint *)(param_1 + 0x10c),(ULONG_PTR *)pwVar6,param_4); EnterCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x120)); uVar4 = *(uint *)(param_1 + 0xfc) & 0xffffbfff; *(uint *)(param_1 + 0xfc) = uVar4; } if ((uVar4 & 0x4000) == 0) { if ((uVar4 & 0x40) != 0) { *(uint *)(param_1 + 0xfc) = uVar4 & 0xffffffbf | 0x800; bVar7 = (uVar4 & 0x1000) != 0; if (bVar7) { *(uint *)(param_1 + 0xfc) = uVar4 & 0xffffefbf | 0x800; } DisconnectSstpCallFromTpi(param_1,bVar7); goto LAB_2; } if ((uVar4 >> 0xb & 1) == 0) { if ((uVar4 & 0x200) != 0) goto LAB_3; if ((uVar4 >> 0xd & 1) == 0) { if ((uVar4 >> 10 & 1) != 0) { *(uint *)(param_1 + 0xfc) = uVar4 & 0xfffffbff | 4; LeaveCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x120)); CancelIoEx(*(HANDLE *)(SstpSvcGlobals + 0x118),(LPOVERLAPPED)(param_1 + 0x28)); goto LAB_2; } if ((uVar4 & 4) == 0) { if ((uVar4 >> 0xf & 1) != 0) { uVar4 = uVar4 & 0xffff7fff; *(uint *)(param_1 + 0xfc) = uVar4; } if ((((uVar4 >> 8 & 1) == 0) && (-1 < (char)uVar4)) && ((uVar4 & 0x10) != 0)) { *(uint *)(param_1 + 0xfc) = uVar4 & 0xffffffef; DereferenceRefCount((int *)(param_1 + 0xd0)); } } } } } } else if ((uVar4 & 0x200) != 0) { LAB_3: *(uint *)(param_1 + 0xfc) = uVar4 & 0xfffffdff | 0x2000; if (*(char *)(param_1 + 0xf8) == '\0') { DisconnectServerHttpCallContext(param_1,pwVar5,pwVar6,param_4); } else { DisconnectClientHttpCallContext(param_1); } goto LAB_2; } } LeaveCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x120)); LAB_2: lpCriticalSection = (LPCRITICAL_SECTION)(param_1 + 0x120); EnterCriticalSection(lpCriticalSection); if (*(int *)(param_1 + 0xfc) == 1) { *(undefined4 *)(param_1 + 0xfc) = 0; LeaveCriticalSection(lpCriticalSection); if (*(longlong *)(param_1 + 0x100) != 0) { FreeBufferToPool((uint *)(SstpSvcGlobals + 0x1a8),*(longlong *)(param_1 + 0x100),'\x01'); *(undefined8 *)(param_1 + 0x100) = 0; } if (*(PTP_WORK *)(param_1 + 0x148) != (PTP_WORK)0x0) { CloseThreadpoolWork(*(PTP_WORK *)(param_1 + 0x148)); *(undefined8 *)(param_1 + 0x148) = 0; } if (*(PTP_WORK *)(param_1 + 0x150) != (PTP_WORK)0x0) { CloseThreadpoolWork(*(PTP_WORK *)(param_1 + 0x150)); *(undefined8 *)(param_1 + 0x150) = 0; } EnterCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x120)); while (plVar3 = *(longlong **)(param_1 + 0x1a0), plVar3 != (longlong *)(param_1 + 0x1a0)) { lVar1 = *plVar3; plVar2 = (longlong *)plVar3[1]; *plVar2 = lVar1; *(longlong **)(lVar1 + 8) = plVar2; FreeBufferToPool((uint *)(SstpSvcGlobals + 0x1a8),(longlong)(plVar3 + -5),'\x01'); } LeaveCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x120)); EnterCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xe0)); EnterCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x120)); lVar1 = *(longlong *)(param_1 + 0xe0); plVar3 = *(longlong **)(param_1 + 0xe8); *plVar3 = lVar1; *(longlong **)(lVar1 + 8) = plVar3; LeaveCriticalSection((LPCRITICAL_SECTION)(param_1 + 0x120)); LeaveCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xe0)); + uVar4 = Feature_1207409977__private_IsEnabledDeviceUsageNoInline(); + if (uVar4 != 0) { + EnterCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xb8)); + HfFreeHandle32(*(int **)(SstpSvcGlobals + 0xb0),(uint *)(param_1 + 0xf4)); + LeaveCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xb8)); + } DereferenceRefCount((int *)(param_1 + 0xd0)); } else { LeaveCriticalSection(lpCriticalSection); } DereferenceRefCount((int *)(param_1 + 0xd0)); return; } ``` ## SstpThreadPoolRequestQueueCallback ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.13| |i_ratio|0.08| |m_ratio|0.67| |b_ratio|0.03| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|SstpThreadPoolRequestQueueCallback|SstpThreadPoolRequestQueueCallback| |fullname|SstpThreadPoolRequestQueueCallback|SstpThreadPoolRequestQueueCallback| |`refcount`|12|5| |`length`|2148|4047| |`called`|
Expand for full list:
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SubmitThreadpoolWork
AsyncSstpDeviceControl
ConvertByteArrayToString
ConvertCorrelationIdToWideChar
DereferenceRefCount
FormatRRASErrorString
FreeBufferToPoolHfGetPointerFromHandle32
InitiateCallContextCleanup
InitiateSstpResponse
LogEventWithErrorParameter
McTemplateU0z_EventWriteTransfer
ProcessReceivedNotification
RTUTILS.DLL::RouterLogEventW
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
memset
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SubmitThreadpoolWork
AsyncSstpDeviceControl
ConvertCorrelationIdToWideChar
DereferenceRefCount
Feature_1207409977__private_IsEnabledDeviceUsageNoInlineFormatRRASErrorString
FreeBufferToPool
InitializeSstpServer
InitiateCallContextCleanup
InitiateSstpResponse
LogEventWithErrorParameter
McGenEventWrite_EventWriteTransfer
PostNotificationBufferToDevice
ProcessMakeCallRequest
RTUTILS.DLL::RouterLogEventW
ShutdownSstpServer
StringCchPrintfW
__chkstk
__security_check_cookie
memset
| |calling||| |paramcount|4|4| |`address`|180001130|180007b30| |sig|undefined __fastcall SstpThreadPoolRequestQueueCallback(undefined8 param_1, undefined8 param_2, LPOVERLAPPED param_3, wchar_t * param_4)|undefined __fastcall SstpThreadPoolRequestQueueCallback(undefined8 param_1, undefined8 param_2, LPOVERLAPPED param_3, wchar_t * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SstpThreadPoolRequestQueueCallback Called Diff ```diff --- SstpThreadPoolRequestQueueCallback called +++ SstpThreadPoolRequestQueueCallback called @@ -0,0 +1 @@ +API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError @@ -2,0 +4 @@ +API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl @@ -7 +8,0 @@ -ConvertByteArrayToString @@ -9,0 +11 @@ +Feature_1207409977__private_IsEnabledDeviceUsageNoInline @@ -12 +14 @@ -HfGetPointerFromHandle32 +InitializeSstpServer @@ -16,2 +18,3 @@ -McTemplateU0z_EventWriteTransfer -ProcessReceivedNotification +McGenEventWrite_EventWriteTransfer +PostNotificationBufferToDevice +ProcessMakeCallRequest @@ -18,0 +22,3 @@ +ShutdownSstpServer +StringCchPrintfW +__chkstk @@ -20 +25,0 @@ -_guard_dispatch_icall$thunk$10345483385596137414 ``` ### SstpThreadPoolRequestQueueCallback Diff ```diff --- SstpThreadPoolRequestQueueCallback +++ SstpThreadPoolRequestQueueCallback @@ -1,357 +1,688 @@ +/* WARNING: Function: __chkstk replaced with injection: alloca_probe */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ +/* WARNING: Type propagation algorithm not settling */ void SstpThreadPoolRequestQueueCallback (undefined8 param_1,undefined8 param_2,LPOVERLAPPED param_3,wchar_t *param_4) { - DWORD *pDVar1; - uint *puVar2; - int iVar3; - uint uVar4; - int *piVar5; - ULONG_PTR UVar6; - byte bVar7; - size_t *psVar8; - undefined7 extraout_var; + uint *puVar1; + DWORD *pDVar2; + longlong lVar3; + int *piVar4; + BOOL BVar5; + DWORD DVar6; + uint uVar7; + longlong lVar8; HANDLE hHeap; - LPOVERLAPPED p_Var9; - wchar_t *pwVar10; + size_t *psVar9; + _union_540 *p_Var10; wchar_t *pwVar11; longlong lVar12; - longlong lVar13; - int iVar14; - ULONG_PTR *pUVar15; - HANDLE *ppvVar16; - undefined8 uVar17; - ulonglong uVar18; - undefined4 *puVar19; - LPCSTR pCVar20; - wchar_t *pwVar21; - uint uVar22; - undefined1 auStackY_9d8 [32]; - longlong local_9a8; - WCHAR *local_9a0; - undefined1 *local_998; - undefined1 *local_990; - undefined8 local_988; - undefined1 local_978 [96]; - WCHAR local_918 [40]; - undefined1 local_8c8 [144]; - undefined8 local_838; - ulonglong local_38; + ulonglong uVar13; + ulonglong uVar14; + ulonglong uVar15; + byte *pbVar16; + HANDLE *ppvVar17; + wchar_t *pwVar18; + undefined8 uVar19; + wchar_t *pwVar20; + undefined4 *puVar21; + LPCSTR pCVar22; + int iVar23; + uint uVar24; + undefined1 auStackY_1968 [32]; + DWORD local_1928 [2]; + undefined1 local_1920 [16]; + wchar_t *local_1910; + ulonglong local_1908; + wchar_t local_18f8 [48]; + WCHAR local_1898 [40]; + undefined4 local_1848; + undefined1 local_1844 [2044]; + undefined8 local_1048; + undefined8 uStack_1040; + undefined8 local_1038; + undefined8 uStack_1030; + undefined8 local_1028; + undefined8 uStack_1020; + undefined8 local_1018; + undefined8 uStack_1010; + undefined8 local_1008; + undefined8 uStack_1000; + undefined8 local_ff8; + undefined8 uStack_ff0; + undefined8 local_fe8; + undefined8 uStack_fe0; + undefined8 local_fd8; + undefined8 uStack_fd0; + undefined4 local_fc8; + undefined2 local_fc4; + undefined4 local_848; + undefined1 local_844 [2044]; + ulonglong local_48; - local_38 = __security_cookie ^ (ulonglong)auStackY_9d8; - lVar13 = 0; - ppvVar16 = (HANDLE *)0x7fc; - pwVar10 = (wchar_t *)0x0; - uVar22 = 0; - local_838._0_4_ = 0; + local_48 = __security_cookie ^ (ulonglong)auStackY_1968; + uVar14 = 0; + ppvVar17 = (HANDLE *)0x7fc; + uVar24 = 0; + local_1848 = 0; pwVar11 = (wchar_t *)((ulonglong)param_4 & 0xffffffff); - pwVar21 = param_4; - memset((void *)((longlong)&local_838 + 4),0,0x7fc); + pwVar20 = param_4; + memset(local_1844,0,0x7fc); if (param_3 == (LPOVERLAPPED)0x0) { if ((DAT_0 & 8) == 0) { return; } - McTemplateU0z_EventWriteTransfer + lVar12 = -1; + do { + lVar8 = lVar12 + 1; + lVar12 = lVar12 + 1; + } while (L"No Overlapped info found..."[lVar8] != L'\0'); + local_1910 = L"No Overlapped info found..."; + local_1908 = (ulonglong)((int)lVar12 * 2 + 2); + McGenEventWrite_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError, - L"No Overlapped info found..."); + ppvVar17,2,(PEVENT_DATA_DESCRIPTOR)local_1920); return; } - iVar14 = (int)param_4; + lVar12 = -1; + iVar23 = (int)param_4; if ((DAT_0 & 0x10) != 0) { - ppvVar16 = (HANDLE *)(ulonglong)(uint)param_3[1].Internal; - pwVar10 = L"OverlapInfo with id %x received [%d - %d"; - local_838._0_4_ = (uint)local_838 & 0xffff0000; - FormatRRASErrorString((STRSAFE_LPWSTR)&local_838,0x18001b220,(size_t *)ppvVar16,pwVar11); - pwVar21 = pwVar11; + ppvVar17 = (HANDLE *)(ulonglong)(uint)param_3[1].Internal; + local_1848 = local_1848 & 0xffff0000; + FormatRRASErrorString((STRSAFE_LPWSTR)&local_1848,0x18001db60,(size_t *)ppvVar17,pwVar11); + pwVar20 = pwVar11; if ((DAT_0 & 0x10) != 0) { - ppvVar16 = (HANDLE *)&local_838; - pwVar10 = L"㚱က\x04"; - McTemplateU0z_EventWriteTransfer + lVar8 = -1; + do { + lVar3 = lVar8 * 2; + lVar8 = lVar8 + 1; + } while (*(short *)(local_1844 + lVar3 + -2) != 0); + local_1910 = (wchar_t *)&local_1848; + local_1908 = (ulonglong)((int)lVar8 * 2 + 2); + pwVar20 = (wchar_t *)0x2; + McGenEventWrite_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo, - (wchar_t *)ppvVar16); - pwVar21 = pwVar11; + ppvVar17,2,(PEVENT_DATA_DESCRIPTOR)local_1920); } } - iVar3 = (int)param_3[1].Internal; - if (iVar3 == 0x456a) { + pwVar11 = L"婍\x90\x03"; + switch((int)param_3[1].Internal) { + case 0x4569: + if (iVar23 == 0) { + pwVar11 = (wchar_t *)0x0; + local_1048 = local_1048 & 0xffffffff00000000; + pwVar18 = (wchar_t *)0x7fc; + memset((void *)((longlong)&local_1048 + 4),0,0x7fc); + if ((DAT_0 & 0x10) != 0) { + pwVar18 = L"ProcessReceivedNotification"; + local_1048 = local_1048 & 0xffffffffffff0000; + pwVar11 = L"Entering %ws"; + FormatRRASErrorString + ((STRSAFE_LPWSTR)&local_1048,0x18001caa0,(size_t *)L"ProcessReceivedNotification", + pwVar20); + if ((DAT_0 & 0x10) != 0) { + lVar8 = -1; + do { + lVar3 = lVar8 * 2; + lVar8 = lVar8 + 1; + } while (*(short *)((longlong)&local_1048 + lVar3 + 2) != 0); + local_1910 = (wchar_t *)&local_1048; + local_1908 = (ulonglong)((int)lVar8 * 2 + 2); + pwVar20 = (wchar_t *)0x2; + pwVar11 = L"㚱က\x04"; + McGenEventWrite_EventWriteTransfer + (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, + (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo,pwVar18,2, + (PEVENT_DATA_DESCRIPTOR)local_1920); + if ((DAT_0 & 0x10) != 0) { + pwVar18 = (wchar_t *)(ulonglong)(uint)param_3[1].InternalHigh; + pwVar11 = L"Received NotificationBuffer with func-code %d"; + local_1048 = local_1048 & 0xffffffffffff0000; + FormatRRASErrorString((STRSAFE_LPWSTR)&local_1048,0x18001dac0,(size_t *)pwVar18,pwVar20) + ; + if ((DAT_0 & 0x10) != 0) { + lVar8 = -1; + do { + lVar3 = lVar8 * 2; + lVar8 = lVar8 + 1; + } while (*(short *)((longlong)&local_1048 + lVar3 + 2) != 0); + local_1910 = (wchar_t *)&local_1048; + local_1908 = (ulonglong)((int)lVar8 * 2 + 2); + pwVar20 = (wchar_t *)0x2; + pwVar11 = L"㚱က\x04"; + McGenEventWrite_EventWriteTransfer + (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, + (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo,pwVar18,2, + (PEVENT_DATA_DESCRIPTOR)local_1920); + } + } + } + } + iVar23 = (int)param_3[1].InternalHigh; + if (iVar23 == 0) { + PostNotificationBufferToDevice(param_3,pwVar11,pwVar18,pwVar20); + psVar9 = InitializeSstpServer(1,pwVar11,pwVar18,pwVar20); + local_1928[1] = 0; + local_848 = 0; + memset(local_844,0,0x7fc); + pwVar20 = (wchar_t *)0x4; + local_1928[0] = (DWORD)psVar9; + BVar5 = DeviceIoControl(*(HANDLE *)(SstpSvcGlobals + 0x118),0x128004,local_1928,4, + (LPVOID)0x0,0,local_1928 + 1,(LPOVERLAPPED)0x0); + if (((BVar5 == 0) && (DVar6 = GetLastError(), DVar6 != 0)) && ((DAT_0 & 8) != 0)) { + pwVar20 = (wchar_t *)((ulonglong)psVar9 & 0xffffffff); + local_848 = local_848 & 0xffff0000; + psVar9 = (size_t *)((ulonglong)psVar9 & 0xffffffff); + FormatRRASErrorString((STRSAFE_LPWSTR)&local_848,0x18001d430,psVar9,pwVar20); + if ((DAT_0 & 8) != 0) { + lVar8 = -1; + do { + lVar3 = lVar8 * 2; + lVar8 = lVar8 + 1; + } while (*(short *)(local_844 + lVar3 + -2) != 0); +LAB_1: + local_1910 = (wchar_t *)&local_848; + local_1908 = (ulonglong)((int)lVar8 * 2 + 2); + pwVar20 = (wchar_t *)0x2; + McGenEventWrite_EventWriteTransfer + (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, + (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,psVar9,2, + (PEVENT_DATA_DESCRIPTOR)local_1920); + } + } + } + else if (iVar23 == 2) { + PostNotificationBufferToDevice(param_3,pwVar11,pwVar18,pwVar20); + ShutdownSstpServer(1,pwVar11,pwVar18,(ulonglong)pwVar20); + local_1928[0] = 0; + local_848 = 0; + memset(local_844,0,0x7fc); + pwVar20 = (wchar_t *)0x4; + local_1928[1] = 0; + BVar5 = DeviceIoControl(*(HANDLE *)(SstpSvcGlobals + 0x118),0x12800c,local_1928 + 1,4, + (LPVOID)0x0,0,local_1928,(LPOVERLAPPED)0x0); + if (((BVar5 == 0) && (DVar6 = GetLastError(), DVar6 != 0)) && ((DAT_0 & 8) != 0)) { + pwVar20 = (wchar_t *)0x0; + local_848 = local_848 & 0xffff0000; + psVar9 = (size_t *)0x0; + FormatRRASErrorString((STRSAFE_LPWSTR)&local_848,0x18001d4c0,(size_t *)0x0,0); + if ((DAT_0 & 8) != 0) { + lVar8 = -1; + do { + lVar3 = lVar8 * 2; + lVar8 = lVar8 + 1; + } while (*(short *)(local_844 + lVar3 + -2) != 0); + goto LAB_1; + } + } + } + else if (iVar23 == 4) { + ProcessMakeCallRequest + ((undefined4 *)((longlong)¶m_3[1].InternalHigh + 4),pwVar11,pwVar18,pwVar20); + PostNotificationBufferToDevice(param_3,pwVar11,pwVar18,pwVar20); + } + if ((DAT_0 & 0x10) != 0) { + pwVar11 = L"ProcessReceivedNotification"; + local_1048 = local_1048 & 0xffffffffffff0000; + FormatRRASErrorString + ((STRSAFE_LPWSTR)&local_1048,0x18001cb50,(size_t *)L"ProcessReceivedNotification", + pwVar20); + if ((DAT_0 & 0x10) != 0) { + do { + lVar8 = lVar12 * 2; + lVar12 = lVar12 + 1; + } while (*(short *)((longlong)&local_1048 + lVar8 + 2) != 0); + local_1910 = (wchar_t *)&local_1048; + local_1908 = (ulonglong)((int)lVar12 * 2 + 2); + McGenEventWrite_EventWriteTransfer + (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, + (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo,pwVar11,2, + (PEVENT_DATA_DESCRIPTOR)local_1920); + } + } + } + else if (iVar23 == 0x3e3) { + FreeBufferToPool((uint *)(SstpSvcGlobals + 0x138),(longlong)param_3,'\x01'); + } + break; + case 0x456a: EnterCriticalSection((LPCRITICAL_SECTION)¶m_3[7].hEvent); - if ((iVar14 == 0) && (*(char *)((longlong)¶m_3[0xc].InternalHigh + 3) == '\0')) { - pDVar1 = ¶m_3[6].u.s.OffsetHigh; - *pDVar1 = *pDVar1 & 0xfffffbff; + if ((iVar23 == 0) && (*(char *)((longlong)¶m_3[0xc].InternalHigh + 3) == '\0')) { + pDVar2 = ¶m_3[6].u.s.OffsetHigh; + *pDVar2 = *pDVar2 & 0xfffffbff; + p_Var10 = (_union_540 *)¶m_3[5].InternalHigh; LOCK(); - *(int *)¶m_3[5].InternalHigh = (int)param_3[5].InternalHigh + 1; + *(int *)p_Var10 = (int)*(ULONG_PTR *)p_Var10 + 1; UNLOCK(); SubmitThreadpoolWork((PTP_WORK)param_3[9].Internal); LeaveCriticalSection((LPCRITICAL_SECTION)¶m_3[7].hEvent); } else { - pDVar1 = ¶m_3[6].u.s.OffsetHigh; - *pDVar1 = *pDVar1 & 0xfffffffb; - InitiateCallContextCleanup((longlong)¶m_3[-2].hEvent,2,ppvVar16,(ulonglong)pwVar21); - } - pUVar15 = ¶m_3[5].InternalHigh; - LOCK(); - UVar6 = *pUVar15; - *(int *)pUVar15 = (int)*pUVar15 + -1; - UNLOCK(); - if ((int)UVar6 != 1) { - return; - } - (*(code *)param_3[5].u)(pUVar15); - return; - } - if (iVar3 == 0x4569) { - if (iVar14 == 0) { - ProcessReceivedNotification(param_3,pwVar10,ppvVar16,pwVar21); - return; - } - if (iVar14 != 0x3e3) { - return; - } - FreeBufferToPool((uint *)(SstpSvcGlobals + 0x138),(longlong)param_3,'\x01'); - return; - } - if (iVar3 != 0x456c) { - if (iVar3 != 0x456e) { - if (iVar3 != 0x4571) { - if (iVar3 != 0x4573) { - return; - } - uVar4 = *(uint *)((longlong)¶m_3[1].InternalHigh + 4); - pwVar10 = (wchar_t *)(ulonglong)uVar4; - piVar5 = *(int **)(SstpSvcGlobals + 0xb0); - if (piVar5 == (int *)0x0) { - uVar22 = 0x57; + pDVar2 = ¶m_3[6].u.s.OffsetHigh; + *pDVar2 = *pDVar2 & 0xfffffffb; + InitiateCallContextCleanup((longlong)¶m_3[-2].hEvent,2,ppvVar17,(ulonglong)pwVar20); + p_Var10 = (_union_540 *)¶m_3[5].InternalHigh; + } + goto LAB_2; + case 0x456b: + case 0x456d: + case 0x456f: + case 0x4570: + case 0x4572: + break; + case 0x456c: + uVar7 = Feature_1207409977__private_IsEnabledDeviceUsageNoInline(); + if (uVar7 == 0) { + uVar24 = (uint)param_3[1].InternalHigh; + pwVar11 = (wchar_t *)(ulonglong)uVar24; + piVar4 = *(int **)(SstpSvcGlobals + 0xb0); + if (piVar4 != (int *)0x0) { + lVar8 = (longlong)(int)(*piVar4 - 1U & uVar24) * 0x20; + if ((*(uint *)(lVar8 + *(longlong *)(piVar4 + 2)) == uVar24) && + (uVar14 = *(ulonglong *)(lVar8 + 8 + *(longlong *)(piVar4 + 2)), uVar14 != 0)) + goto LAB_3; + } + } + else { + EnterCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xb8)); + uVar7 = (uint)param_3[1].InternalHigh; + pwVar11 = (wchar_t *)(ulonglong)uVar7; + piVar4 = *(int **)(SstpSvcGlobals + 0xb0); + if (piVar4 == (int *)0x0) { + uVar24 = 0x57; + } + else { + lVar8 = (longlong)(int)(*piVar4 - 1U & uVar7) * 0x20; + if ((*(uint *)(lVar8 + *(longlong *)(piVar4 + 2)) == uVar7) && + (uVar14 = *(ulonglong *)(lVar8 + 8 + *(longlong *)(piVar4 + 2)), uVar14 != 0)) { + LOCK(); + *(int *)(uVar14 + 0xd0) = *(int *)(uVar14 + 0xd0) + 1; + UNLOCK(); } else { - lVar12 = (longlong)(int)(*piVar5 - 1U & uVar4) * 0x20; - if ((*(uint *)(lVar12 + *(longlong *)(piVar5 + 2)) != uVar4) || - (lVar13 = *(longlong *)(lVar12 + 8 + *(longlong *)(piVar5 + 2)), lVar13 == 0)) { - uVar22 = 6; - } - } - if (iVar14 == 0) { - if ((int)param_3[2].Internal == 0) { - LOCK(); - *(int *)(lVar13 + 0xd0) = *(int *)(lVar13 + 0xd0) + 1; - UNLOCK(); - EnterCriticalSection((LPCRITICAL_SECTION)(lVar13 + 0x120)); - if (*(char *)(lVar13 + 0x1b3) == '\0') { - if ((DAT_0 & 0x10) != 0) { - local_838._0_4_ = (uint)local_838 & 0xffff0000; + uVar24 = 6; + } + } + LeaveCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xb8)); + if (uVar24 == 0) { +LAB_3: + EnterCriticalSection((LPCRITICAL_SECTION)(uVar14 + 0x120)); + if ((*(uint *)(uVar14 + 0xfc) & 0x10) == 0) { + LeaveCriticalSection((LPCRITICAL_SECTION)(uVar14 + 0x120)); + } + else { + *(uint *)(uVar14 + 0xfc) = *(uint *)(uVar14 + 0xfc) & 0xffffffef; + if (iVar23 == 0) { + uVar24 = (uint)param_3[2].InternalHigh; + pwVar20 = (wchar_t *)(ulonglong)uVar24; + if (uVar24 != 0) { + if ((DAT_0 & 8) != 0) { + ppvVar17 = (HANDLE *)(uVar14 + 0x228); + local_1848 = local_1848 & 0xffff0000; FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_838,0x18001cc80,(size_t *)(lVar13 + 0x228),pwVar21 - ); - if ((DAT_0 & 0x10) != 0) { - McTemplateU0z_EventWriteTransfer - (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, - (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo,(wchar_t *)&local_838); + ((STRSAFE_LPWSTR)&local_1848,0x18001dbc0,(size_t *)ppvVar17,pwVar20); + if ((DAT_0 & 8) != 0) { + do { + lVar8 = lVar12 * 2; + lVar12 = lVar12 + 1; + } while (*(short *)(local_1844 + lVar8 + -2) != 0); + goto LAB_4; } } - *(undefined4 *)(lVar13 + 0x70) = 0x4571; - ((LPOVERLAPPED)(lVar13 + 0x50))->Internal = 0; - *(undefined8 *)(lVar13 + 0x58) = 0; - puVar19 = (undefined4 *)(lVar13 + 0x78); - uVar17 = 8; - *(undefined8 *)(lVar13 + 0x60) = 0; - *(undefined8 *)(lVar13 + 0x68) = 0; - *puVar19 = *(undefined4 *)(lVar13 + 0xf0); - *(undefined1 *)(lVar13 + 0x7c) = 0; - psVar8 = AsyncSstpDeviceControl - (0x12801c,puVar19,8,puVar19,8,(LPOVERLAPPED)(lVar13 + 0x50)); - if ((int)psVar8 != 0) { - *(undefined1 *)(lVar13 + 0x1b1) = 0; - InitiateCallContextCleanup(lVar13,0,uVar17,(ulonglong)puVar19); - DereferenceRefCount((int *)(lVar13 + 0xd0)); - goto LAB_1; + goto LAB_5; + } + if ((DAT_0 & 0x10) != 0) { + ppvVar17 = (HANDLE *)(uVar14 + 0x228); + local_1848 = (uint)local_1848._2_2_ << 0x10; + pwVar11 = L"CoId=%hs:Incoming call accepted"; + FormatRRASErrorString((STRSAFE_LPWSTR)&local_1848,0x18001dc20,(size_t *)ppvVar17,0); + if ((DAT_0 & 0x10) != 0) { + do { + lVar8 = lVar12 * 2; + lVar12 = lVar12 + 1; + } while (*(short *)(local_1844 + lVar8 + -2) != 0); + local_1910 = (wchar_t *)&local_1848; + local_1908 = (ulonglong)((int)lVar12 * 2 + 2); + pwVar20 = (wchar_t *)0x2; + pwVar11 = L"㚱က\x04"; + McGenEventWrite_EventWriteTransfer + (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, + (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo,ppvVar17,2, + (PEVENT_DATA_DESCRIPTOR)local_1920); } - *(undefined1 *)(lVar13 + 0x1b1) = 1; } - LeaveCriticalSection((LPCRITICAL_SECTION)(lVar13 + 0x120)); + *(undefined4 *)(uVar14 + 0xf0) = *(undefined4 *)((longlong)¶m_3[2].InternalHigh + 4) + ; + *(uint *)(uVar14 + 0xfc) = *(uint *)(uVar14 + 0xfc) & 0xfffffdff | 0x20; + LeaveCriticalSection((LPCRITICAL_SECTION)(uVar14 + 0x120)); + InitiateSstpResponse(uVar14,pwVar11,ppvVar17,pwVar20); } else { if ((DAT_0 & 8) != 0) { - local_838._0_4_ = (uint)local_838 & 0xffff0000; - pwVar10 = L"CoId=%hs: CLIENT_FSM_FAILED, Status=%d"; + pwVar20 = (wchar_t *)(ulonglong)(uint)param_3[2].InternalHigh; + ppvVar17 = (HANDLE *)(uVar14 + 0x228); + local_1848 = (uint)local_1848._2_2_ << 0x10; FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_838,0x18001cce0,(size_t *)(lVar13 + 0x228), - (ulonglong)uVar22); + ((STRSAFE_LPWSTR)&local_1848,0x18001dbc0,(size_t *)ppvVar17,pwVar20); if ((DAT_0 & 8) != 0) { - pwVar10 = L"㚰က\x02"; - McTemplateU0z_EventWriteTransfer + do { + lVar8 = lVar12 * 2; + lVar12 = lVar12 + 1; + } while (*(short *)(local_1844 + lVar8 + -2) != 0); +LAB_4: + local_1910 = (wchar_t *)&local_1848; + local_1908 = (ulonglong)((int)lVar12 * 2 + 2); + pwVar20 = (wchar_t *)0x2; + McGenEventWrite_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, - (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,(wchar_t *)&local_838); + (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,ppvVar17,2, + (PEVENT_DATA_DESCRIPTOR)local_1920); } } - pCVar20 = (LPCSTR)(lVar13 + 0x228); - uVar18 = (ulonglong)uVar22; - LogEventWithErrorParameter(5,pwVar10,uVar22,pCVar20); - EnterCriticalSection((LPCRITICAL_SECTION)(lVar13 + 0x120)); - InitiateCallContextCleanup(lVar13,0,uVar18,(ulonglong)pCVar20); - } - } -LAB_1: - LOCK(); - piVar5 = (int *)(lVar13 + 0xd0); - iVar14 = *piVar5; - *piVar5 = *piVar5 + -1; - UNLOCK(); - if (iVar14 != 1) { - return; - } - (**(code **)(lVar13 + 0xd8))(lVar13 + 0xd0); - return; - } - if (iVar14 == 0) { - EnterCriticalSection((LPCRITICAL_SECTION)¶m_3[6].u.s); - if (*(char *)((longlong)¶m_3[1].InternalHigh + 4) != '\0') { - if ((DAT_0 & 8) != 0) { - ppvVar16 = ¶m_3[0xe].hEvent; - local_838._0_4_ = (uint)local_838 & 0xffff0000; - FormatRRASErrorString((STRSAFE_LPWSTR)&local_838,0x18001cc10,(size_t *)ppvVar16,pwVar21) - ; - if ((DAT_0 & 8) != 0) { - ppvVar16 = (HANDLE *)&local_838; - McTemplateU0z_EventWriteTransfer - (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, - (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,(wchar_t *)ppvVar16); - } - } - if (*(longlong *)(SstpSvcGlobals + 0x48) != 0) { - memset(local_978,0,0x56); - memset(local_8c8,0,0x86); - ConvertByteArrayToString - ((byte *)((longlong)¶m_3[0xc].hEvent + 1),0x14,(longlong)local_978,0x2b); - uVar17 = 0x20; - ConvertByteArrayToString - ((byte *)((longlong)¶m_3[0xd].InternalHigh + 5),0x20,(longlong)local_8c8, - 0x43); - ConvertCorrelationIdToWideChar(local_918,uVar17,(LPCSTR)¶m_3[0xe].hEvent); - local_9a0 = local_918; - local_998 = local_978; - local_988 = 0; - local_990 = local_8c8; - pwVar21 = (wchar_t *)0x3; - ppvVar16 = (HANDLE *)0x6; - RouterLogEventW(*(undefined8 *)(SstpSvcGlobals + 0x48)); - } - } - InitiateCallContextCleanup((longlong)¶m_3[-3].u,0,ppvVar16,(ulonglong)pwVar21); - } - p_Var9 = param_3 + 4; - goto LAB_2; - } - if (iVar14 == 0) { +LAB_5: + InitiateCallContextCleanup(uVar14,2,ppvVar17,(ulonglong)pwVar20); + } + DereferenceRefCount((int *)(uVar14 + 0xd0)); + } + uVar24 = Feature_1207409977__private_IsEnabledDeviceUsageNoInline(); + if (uVar24 != 0) { + DereferenceRefCount((int *)(uVar14 + 0xd0)); + } + } + } + hHeap = GetProcessHeap(); + HeapFree(hHeap,0,param_3); + break; + case 0x456e: + if (iVar23 == 0) { LOCK(); param_3[6].u.s.Offset = param_3[6].u.s.Offset + 1; UNLOCK(); EnterCriticalSection((LPCRITICAL_SECTION)(param_3 + 9)); - puVar2 = (uint *)((longlong)¶m_3[7].hEvent + 4); - *puVar2 = *puVar2 & 0xffff7fff; + puVar1 = (uint *)((longlong)¶m_3[7].hEvent + 4); + *puVar1 = *puVar1 & 0xffff7fff; if (*(char *)((longlong)¶m_3[0xd].u + 3) == '\0') { param_3[3].u.s.Offset = 0x4571; param_3[2].u.Pointer = (PVOID)0x0; param_3[2].hEvent = (HANDLE)0x0; - ppvVar16 = ¶m_3[3].hEvent; + ppvVar17 = ¶m_3[3].hEvent; param_3[3].Internal = 0; param_3[3].InternalHigh = 0; - uVar17 = 8; - *(DWORD *)ppvVar16 = param_3[7].u.s.Offset; + uVar19 = 8; + *(DWORD *)ppvVar17 = param_3[7].u.s.Offset; *(undefined1 *)((longlong)¶m_3[3].hEvent + 4) = 0; - psVar8 = AsyncSstpDeviceControl - (0x12801c,ppvVar16,8,ppvVar16,8,(LPOVERLAPPED)¶m_3[2].u.s); - if ((int)psVar8 != 0) { + psVar9 = AsyncSstpDeviceControl + (0x12801c,ppvVar17,8,ppvVar17,8,(LPOVERLAPPED)¶m_3[2].u.s); + if ((int)psVar9 != 0) { *(undefined1 *)((longlong)¶m_3[0xd].u + 1) = 0; - InitiateCallContextCleanup((longlong)param_3,0,uVar17,(ulonglong)ppvVar16); + InitiateCallContextCleanup((longlong)param_3,0,uVar19,(ulonglong)ppvVar17); DereferenceRefCount((int *)¶m_3[6].u); - goto LAB_3; + p_Var10 = ¶m_3[6].u; + goto LAB_2; } *(undefined1 *)((longlong)¶m_3[0xd].u + 1) = 1; } LeaveCriticalSection((LPCRITICAL_SECTION)(param_3 + 9)); + p_Var10 = ¶m_3[6].u; } else { EnterCriticalSection((LPCRITICAL_SECTION)(param_3 + 9)); - puVar2 = (uint *)((longlong)¶m_3[7].hEvent + 4); - *puVar2 = *puVar2 & 0xffff7fff; - InitiateCallContextCleanup((longlong)param_3,0,ppvVar16,(ulonglong)pwVar21); - } -LAB_3: - p_Var9 = (LPOVERLAPPED)¶m_3[6].u; + puVar1 = (uint *)((longlong)¶m_3[7].hEvent + 4); + *puVar1 = *puVar1 & 0xffff7fff; + InitiateCallContextCleanup((longlong)param_3,0,ppvVar17,(ulonglong)pwVar20); + p_Var10 = ¶m_3[6].u; + } + goto LAB_2; + case 0x4571: + if (iVar23 == 0) { + EnterCriticalSection((LPCRITICAL_SECTION)¶m_3[6].u.s); + if (*(char *)((longlong)¶m_3[1].InternalHigh + 4) != '\0') { + if ((DAT_0 & 8) != 0) { + ppvVar17 = ¶m_3[0xe].hEvent; + local_1848 = local_1848 & 0xffff0000; + pwVar11 = L"CoId=%hs: Crypto Binding failed notification received"; + FormatRRASErrorString((STRSAFE_LPWSTR)&local_1848,0x18001dc60,(size_t *)ppvVar17,pwVar20); + if ((DAT_0 & 8) != 0) { + do { + lVar8 = lVar12 * 2; + lVar12 = lVar12 + 1; + } while (*(short *)(local_1844 + lVar8 + -2) != 0); + local_1910 = (wchar_t *)&local_1848; + local_1908 = (ulonglong)((int)lVar12 * 2 + 2); + pwVar20 = (wchar_t *)0x2; + pwVar11 = L"㚰က\x02"; + McGenEventWrite_EventWriteTransfer + (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, + (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,ppvVar17,2, + (PEVENT_DATA_DESCRIPTOR)local_1920); + } + } + if (*(longlong *)(SstpSvcGlobals + 0x48) != 0) { + pbVar16 = (byte *)((longlong)¶m_3[0xc].hEvent + 1); + local_18f8[0x28] = L'\0'; + local_18f8[0x29] = L'\0'; + local_18f8[0x2a] = 0; + local_fc8 = 0; + local_fc4 = 0; + local_18f8[0] = L'\0'; + local_18f8[1] = L'\0'; + local_18f8[2] = L'\0'; + local_18f8[3] = L'\0'; + local_18f8[4] = L'\0'; + local_18f8[5] = L'\0'; + local_18f8[6] = L'\0'; + local_18f8[7] = L'\0'; + local_18f8[8] = L'\0'; + local_18f8[9] = L'\0'; + local_18f8[10] = L'\0'; + local_18f8[0xb] = L'\0'; + local_18f8[0xc] = L'\0'; + local_18f8[0xd] = L'\0'; + local_18f8[0xe] = L'\0'; + local_18f8[0xf] = L'\0'; + local_18f8[0x10] = L'\0'; + local_18f8[0x11] = L'\0'; + local_18f8[0x12] = L'\0'; + local_18f8[0x13] = L'\0'; + local_18f8[0x14] = L'\0'; + local_18f8[0x15] = L'\0'; + local_18f8[0x16] = L'\0'; + local_18f8[0x17] = L'\0'; + local_18f8[0x18] = L'\0'; + local_18f8[0x19] = L'\0'; + local_18f8[0x1a] = L'\0'; + local_18f8[0x1b] = L'\0'; + local_18f8[0x1c] = L'\0'; + local_18f8[0x1d] = L'\0'; + local_18f8[0x1e] = L'\0'; + local_18f8[0x1f] = L'\0'; + local_18f8[0x20] = L'\0'; + local_18f8[0x21] = L'\0'; + local_18f8[0x22] = L'\0'; + local_18f8[0x23] = L'\0'; + local_18f8[0x24] = L'\0'; + local_18f8[0x25] = L'\0'; + local_18f8[0x26] = L'\0'; + local_18f8[0x27] = L'\0'; + local_1048 = 0; + uStack_1040 = 0; + local_1038 = 0; + uStack_1030 = 0; + local_1028 = 0; + uStack_1020 = 0; + local_1018 = 0; + uStack_1010 = 0; + local_1008 = 0; + uStack_1000 = 0; + local_ff8 = 0; + uStack_ff0 = 0; + local_fe8 = 0; + uStack_fe0 = 0; + local_fd8 = 0; + uStack_fd0 = 0; + uVar13 = uVar14; + uVar15 = uVar14; + if (pbVar16 != (byte *)0x0) { + do { + uVar24 = (uint)uVar13; + if (0x28 < uVar24) break; + pwVar11 = (wchar_t *)(ulonglong)(0x2b - uVar24); + StringCchPrintfW(local_18f8 + uVar13,(size_t)pwVar11,L"%.2X",(ulonglong)*pbVar16); + uVar13 = (ulonglong)(uVar24 + 2); + uVar24 = (int)uVar15 + 1; + pbVar16 = pbVar16 + 1; + uVar15 = (ulonglong)uVar24; + } while (uVar24 < 0x14); + local_18f8[uVar13] = L'\0'; + } + pbVar16 = (byte *)((longlong)¶m_3[0xd].InternalHigh + 5); + uVar13 = uVar14; + if (pbVar16 != (byte *)0x0) { + do { + uVar24 = (uint)uVar14; + if (0x40 < uVar24) break; + pwVar11 = (wchar_t *)(ulonglong)(0x43 - uVar24); + StringCchPrintfW((STRSAFE_LPWSTR)((longlong)&local_1048 + uVar14 * 2),(size_t)pwVar11, + L"%.2X",(ulonglong)*pbVar16); + uVar14 = (ulonglong)(uVar24 + 2); + uVar24 = (int)uVar13 + 1; + pbVar16 = pbVar16 + 1; + uVar13 = (ulonglong)uVar24; + } while (uVar24 < 0x20); + *(undefined2 *)((longlong)&local_1048 + uVar14 * 2) = 0; + } + ConvertCorrelationIdToWideChar(local_1898,pwVar11,(LPCSTR)¶m_3[0xe].hEvent); + local_1920._0_8_ = local_1898; + local_1920._8_8_ = local_18f8; + local_1908 = 0; + local_1910 = (wchar_t *)&local_1048; + pwVar20 = (wchar_t *)0x3; + ppvVar17 = (HANDLE *)0x6; + RouterLogEventW(*(undefined8 *)(SstpSvcGlobals + 0x48)); + } + } + InitiateCallContextCleanup((longlong)¶m_3[-3].u,0,ppvVar17,(ulonglong)pwVar20); + } + DereferenceRefCount((int *)(param_3 + 4)); + break; + case 0x4573: + uVar7 = Feature_1207409977__private_IsEnabledDeviceUsageNoInline(); + if (uVar7 == 0) { + uVar7 = *(uint *)((longlong)¶m_3[1].InternalHigh + 4); + pwVar11 = (wchar_t *)(ulonglong)uVar7; + piVar4 = *(int **)(SstpSvcGlobals + 0xb0); + if (piVar4 == (int *)0x0) { + uVar24 = 0x57; + } + else { + lVar8 = (longlong)(int)(*piVar4 - 1U & uVar7) * 0x20; + if ((*(uint *)(lVar8 + *(longlong *)(piVar4 + 2)) != uVar7) || + (uVar14 = *(ulonglong *)(lVar8 + 8 + *(longlong *)(piVar4 + 2)), uVar14 == 0)) { + uVar24 = 6; + } + } + } + else { + EnterCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xb8)); + uVar7 = *(uint *)((longlong)¶m_3[1].InternalHigh + 4); + pwVar11 = (wchar_t *)(ulonglong)uVar7; + piVar4 = *(int **)(SstpSvcGlobals + 0xb0); + if (piVar4 == (int *)0x0) { + uVar24 = 0x57; + } + else { + lVar8 = (longlong)(int)(*piVar4 - 1U & uVar7) * 0x20; + if ((*(uint *)(lVar8 + *(longlong *)(piVar4 + 2)) != uVar7) || + (uVar14 = *(ulonglong *)(lVar8 + 8 + *(longlong *)(piVar4 + 2)), uVar14 == 0)) { + uVar24 = 6; + } + } + LeaveCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0xb8)); + } + if (iVar23 == 0) { + if ((int)param_3[2].Internal == 0) { + LOCK(); + *(int *)(uVar14 + 0xd0) = *(int *)(uVar14 + 0xd0) + 1; + UNLOCK(); + EnterCriticalSection((LPCRITICAL_SECTION)(uVar14 + 0x120)); + if (*(char *)(uVar14 + 0x1b3) == '\0') { + if ((DAT_0 & 0x10) != 0) { + psVar9 = (size_t *)(uVar14 + 0x228); + local_1848 = local_1848 & 0xffff0000; + FormatRRASErrorString((STRSAFE_LPWSTR)&local_1848,0x18001dcd0,psVar9,pwVar20); + if ((DAT_0 & 0x10) != 0) { + do { + lVar8 = lVar12 * 2; + lVar12 = lVar12 + 1; + } while (*(short *)(local_1844 + lVar8 + -2) != 0); + local_1910 = (wchar_t *)&local_1848; + local_1908 = (ulonglong)((int)lVar12 * 2 + 2); + McGenEventWrite_EventWriteTransfer + (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, + (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo,psVar9,2, + (PEVENT_DATA_DESCRIPTOR)local_1920); + } + } + *(undefined4 *)(uVar14 + 0x70) = 0x4571; + ((LPOVERLAPPED)(uVar14 + 0x50))->Internal = 0; + *(undefined8 *)(uVar14 + 0x58) = 0; + puVar21 = (undefined4 *)(uVar14 + 0x78); + uVar19 = 8; + *(undefined8 *)(uVar14 + 0x60) = 0; + *(undefined8 *)(uVar14 + 0x68) = 0; + *puVar21 = *(undefined4 *)(uVar14 + 0xf0); + *(undefined1 *)(uVar14 + 0x7c) = 0; + psVar9 = AsyncSstpDeviceControl + (0x12801c,puVar21,8,puVar21,8,(LPOVERLAPPED)(uVar14 + 0x50)); + if ((int)psVar9 != 0) { + *(undefined1 *)(uVar14 + 0x1b1) = 0; + InitiateCallContextCleanup(uVar14,0,uVar19,(ulonglong)puVar21); + DereferenceRefCount((int *)(uVar14 + 0xd0)); + goto LAB_6; + } + *(undefined1 *)(uVar14 + 0x1b1) = 1; + } + LeaveCriticalSection((LPCRITICAL_SECTION)(uVar14 + 0x120)); + } + else { + if ((DAT_0 & 8) != 0) { + psVar9 = (size_t *)(uVar14 + 0x228); + local_1848 = local_1848 & 0xffff0000; + pwVar11 = L"CoId=%hs: CLIENT_FSM_FAILED, Status=%d"; + FormatRRASErrorString((STRSAFE_LPWSTR)&local_1848,0x18001dd30,psVar9,(ulonglong)uVar24); + if ((DAT_0 & 8) != 0) { + do { + lVar8 = lVar12 * 2; + lVar12 = lVar12 + 1; + } while (*(short *)(local_1844 + lVar8 + -2) != 0); + local_1910 = (wchar_t *)&local_1848; + local_1908 = (ulonglong)((int)lVar12 * 2 + 2); + pwVar11 = L"㚰က\x02"; + McGenEventWrite_EventWriteTransfer + (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, + (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,psVar9,2, + (PEVENT_DATA_DESCRIPTOR)local_1920); + } + } + pCVar22 = (LPCSTR)(uVar14 + 0x228); + uVar13 = (ulonglong)uVar24; + LogEventWithErrorParameter(5,pwVar11,uVar24,pCVar22); + EnterCriticalSection((LPCRITICAL_SECTION)(uVar14 + 0x120)); + InitiateCallContextCleanup(uVar14,0,uVar13,(ulonglong)pCVar22); + } + } +LAB_6: + p_Var10 = (_union_540 *)(uVar14 + 0xd0); LAB_2: - DereferenceRefCount((int *)p_Var9); - return; + DereferenceRefCount((int *)p_Var10); + break; + default: + goto switchD_180007cac_default; } - pwVar10 = (wchar_t *)&local_9a8; - uVar22 = (uint)param_3[1].InternalHigh; - pwVar11 = (wchar_t *)(ulonglong)uVar22; - local_9a8 = 0; - bVar7 = HfGetPointerFromHandle32(*(int **)(SstpSvcGlobals + 0xb0),uVar22,(longlong *)pwVar10); - lVar13 = local_9a8; - if ((int)CONCAT71(extraout_var,bVar7) != 0) goto LAB_4; - EnterCriticalSection((LPCRITICAL_SECTION)(local_9a8 + 0x120)); - if ((*(uint *)(lVar13 + 0xfc) & 0x10) == 0) { - LeaveCriticalSection((LPCRITICAL_SECTION)(lVar13 + 0x120)); - goto LAB_4; - } - *(uint *)(lVar13 + 0xfc) = *(uint *)(lVar13 + 0xfc) & 0xffffffef; - if (iVar14 == 0) { - uVar22 = (uint)param_3[2].InternalHigh; - pwVar21 = (wchar_t *)(ulonglong)uVar22; - if (uVar22 != 0) { - if ((DAT_0 & 8) != 0) { - pwVar10 = (wchar_t *)(lVar13 + 0x228); - local_838._0_4_ = (uint)local_838 & 0xffff0000; - FormatRRASErrorString((STRSAFE_LPWSTR)&local_838,0x18001cb70,(size_t *)pwVar10,pwVar21); - goto joined_r0x0001800018ef; - } - goto LAB_5; - } - if ((DAT_0 & 0x10) != 0) { - pwVar10 = (wchar_t *)(lVar13 + 0x228); - local_838._0_4_ = (uint)local_838._2_2_ << 0x10; - pwVar11 = L"CoId=%hs:Incoming call accepted"; - FormatRRASErrorString((STRSAFE_LPWSTR)&local_838,0x18001cbd0,(size_t *)pwVar10,0); - if ((DAT_0 & 0x10) != 0) { - pwVar10 = (wchar_t *)&local_838; - pwVar11 = L"㚱က\x04"; - McTemplateU0z_EventWriteTransfer - (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo - ,pwVar10); - } - } - *(undefined4 *)(lVar13 + 0xf0) = *(undefined4 *)((longlong)¶m_3[2].InternalHigh + 4); - *(uint *)(lVar13 + 0xfc) = *(uint *)(lVar13 + 0xfc) & 0xfffffdff; - *(uint *)(lVar13 + 0xfc) = *(uint *)(lVar13 + 0xfc) | 0x20; - LeaveCriticalSection((LPCRITICAL_SECTION)(lVar13 + 0x120)); - InitiateSstpResponse(lVar13,pwVar11,pwVar10,pwVar21); - } - else { - if ((DAT_0 & 8) != 0) { - pwVar21 = (wchar_t *)(ulonglong)(uint)param_3[2].InternalHigh; - pwVar10 = (wchar_t *)(lVar13 + 0x228); - local_838._0_4_ = (uint)local_838._2_2_ << 0x10; - FormatRRASErrorString((STRSAFE_LPWSTR)&local_838,0x18001cb70,(size_t *)pwVar10,pwVar21); -joined_r0x0001800018ef: - if ((DAT_0 & 8) != 0) { - pwVar10 = (wchar_t *)&local_838; - McTemplateU0z_EventWriteTransfer - (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, - (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,pwVar10); - } - } -LAB_5: - InitiateCallContextCleanup(lVar13,2,pwVar10,(ulonglong)pwVar21); - } - DereferenceRefCount((int *)(lVar13 + 0xd0)); -LAB_4: - hHeap = GetProcessHeap(); - HeapFree(hHeap,0,param_3); +switchD_180007cac_default: return; } ``` ## AllocateAndInitializeCallContext ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.88| |i_ratio|0.45| |m_ratio|0.98| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|AllocateAndInitializeCallContext|AllocateAndInitializeCallContext| |fullname|AllocateAndInitializeCallContext|AllocateAndInitializeCallContext| |refcount|4|4| |`length`|1736|1838| |`called`|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::DeleteCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeCriticalSectionAndSpinCount
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolTimer
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolWork
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolWork
FormatRRASErrorString
FreeBufferToPoolGetBufferFromPool
HfFreeHandle32
McTemplateU0z_EventWriteTransfer
__security_check_cookie
assign_HF_handle
memset
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::DeleteCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeCriticalSectionAndSpinCount
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolTimer
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CloseThreadpoolWork
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolWork
Feature_1207409977__private_IsEnabledDeviceUsageNoInline
FormatRRASErrorStringFreeBufferToPool
GetBufferFromPool
HfFreeHandle32
McTemplateU0z_EventWriteTransfer
__security_check_cookie
assign_HF_handle
memset
| |calling|ForwardMakeCallRequest
PostNewHttpRequest
ProcessMakeCallRequest|ForwardMakeCallRequest
PostNewHttpRequest
ProcessMakeCallRequest| |paramcount|4|4| |`address`|180009a0c|18000a1ac| |sig|DWORD __fastcall AllocateAndInitializeCallContext(char param_1, undefined8 * param_2, undefined8 param_3, wchar_t * param_4)|DWORD __fastcall AllocateAndInitializeCallContext(char param_1, undefined8 * param_2, undefined8 param_3, wchar_t * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### AllocateAndInitializeCallContext Called Diff ```diff --- AllocateAndInitializeCallContext called +++ AllocateAndInitializeCallContext called @@ -9,0 +10 @@ +Feature_1207409977__private_IsEnabledDeviceUsageNoInline ``` ### AllocateAndInitializeCallContext Diff ```diff --- AllocateAndInitializeCallContext +++ AllocateAndInitializeCallContext @@ -1,251 +1,259 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ DWORD AllocateAndInitializeCallContext (char param_1,undefined8 *param_2,undefined8 param_3,wchar_t *param_4) { size_t *psVar1; size_t *psVar2; - LPCRITICAL_SECTION lpCriticalSection; PTP_CALLBACK_ENVIRON pcbe; longlong *plVar3; BOOL BVar4; DWORD DVar5; - int iVar6; + uint uVar6; size_t *_Dst; PTP_TIMER p_Var7; PTP_WORK p_Var8; uint *puVar9; - LPCRITICAL_SECTION lpCriticalSection_00; + LPCRITICAL_SECTION lpCriticalSection; int *piVar10; undefined1 auStack_868 [32]; char local_848; undefined8 *local_840; uint local_838; undefined1 local_834 [2044]; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStack_868; local_838 = 0; local_848 = param_1; local_840 = param_2; memset(local_834,0,0x7fc); puVar9 = (uint *)(SstpSvcGlobals + 0x86); *param_2 = 0; _Dst = (size_t *)GetBufferFromPool(puVar9); if (_Dst == (size_t *)0x0) { if ((DAT_0 & 8) == 0) { return 8; } McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError, L"TpCallCtxPool: Alloc failed for initrequest fails"); return 8; } if ((DAT_0 & 8) != 0) { local_838 = local_838 & 0xffff0000; - FormatRRASErrorString((STRSAFE_LPWSTR)&local_838,0x18001c5c8,_Dst,param_4); + FormatRRASErrorString((STRSAFE_LPWSTR)&local_838,0x18001d5b8,_Dst,param_4); if ((DAT_0 & 8) != 0) { McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context,(PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError, (wchar_t *)&local_838); } } memset(_Dst,0,0x278); *(undefined4 *)(_Dst + 4) = 0x4567; + *(undefined4 *)(_Dst + 0x1a) = 0; _Dst[0x1b] = (size_t)CleanupCallCtx; psVar1 = _Dst + 0x1c; - *(undefined4 *)(_Dst + 0x1a) = 0; psVar2 = _Dst + 0x34; - _Dst[0x1e] = 0; + *(undefined4 *)(_Dst + 0x1e) = 0; _Dst[0x22] = 0; + puVar9 = (uint *)((longlong)_Dst + 0xf4); + *puVar9 = 0; _Dst[0x23] = 0; *(undefined1 *)(_Dst + 0x36) = 0; _Dst[0x4e] = 0; - lpCriticalSection = (LPCRITICAL_SECTION)(_Dst + 0x24); + _Dst[0x35] = (size_t)psVar2; + *psVar2 = (size_t)psVar2; _Dst[0x1d] = (size_t)psVar1; *psVar1 = (size_t)psVar1; - _Dst[0x35] = (size_t)psVar2; - *psVar2 = (size_t)psVar2; *(char *)(_Dst + 0x1f) = param_1; *(undefined8 *)((longlong)_Dst + 0x264) = 1; - BVar4 = InitializeCriticalSectionAndSpinCount(lpCriticalSection,4000); + BVar4 = InitializeCriticalSectionAndSpinCount((LPCRITICAL_SECTION)(_Dst + 0x24),4000); piVar10 = SstpSvcGlobals; if (BVar4 == 0) { DVar5 = GetLastError(); if ((DAT_0 & 8) != 0) { local_838 = local_838 & 0xffff0000; FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_838,0x18001c610,(size_t *)(ulonglong)DVar5,param_4); + ((STRSAFE_LPWSTR)&local_838,0x18001d600,(size_t *)(ulonglong)DVar5,param_4); if ((DAT_0 & 8) != 0) { McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,(wchar_t *)&local_838); } } goto LAB_1; } pcbe = (PTP_CALLBACK_ENVIRON)(_Dst + 0x2b); + _Dst[0x2c] = 0; pcbe->Version = 3; - _Dst[0x2c] = 0; _Dst[0x2d] = 0; _Dst[0x2e] = 0; _Dst[0x2f] = 0; _Dst[0x30] = 0; _Dst[0x31] = 0; *(undefined4 *)(_Dst + 0x32) = 0; *(undefined4 *)((longlong)_Dst + 0x194) = 1; *(undefined4 *)(_Dst + 0x33) = 0x48; _Dst[0x2c] = *(size_t *)(piVar10 + 0x28); if (local_848 == '\0') { LAB_2: _Dst[5] = 0; _Dst[6] = 0; _Dst[7] = 0; _Dst[8] = 0; _Dst[9] = 0; *(undefined4 *)(_Dst + 9) = 0x456a; p_Var8 = CreateThreadpoolWork(SendToNetworkWorker,_Dst,pcbe); _Dst[0x29] = (size_t)p_Var8; if (p_Var8 == (PTP_WORK)0x0) { DVar5 = GetLastError(); if ((DAT_0 & 8) != 0) { local_838 = local_838 & 0xffff0000; FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_838,0x18001c6c0,(size_t *)(ulonglong)DVar5,param_4); + ((STRSAFE_LPWSTR)&local_838,0x18001d6b0,(size_t *)(ulonglong)DVar5,param_4); if ((DAT_0 & 8) != 0) { McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,(wchar_t *)&local_838); } } } else { p_Var8 = CreateThreadpoolWork(ProcessReceivedBytesWorker,_Dst,pcbe); _Dst[0x2a] = (size_t)p_Var8; if (p_Var8 == (PTP_WORK)0x0) { DVar5 = GetLastError(); if ((DAT_0 & 8) != 0) { local_838 = local_838 & 0xffff0000; FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_838,0x18001c710,(size_t *)(ulonglong)DVar5,param_4); + ((STRSAFE_LPWSTR)&local_838,0x18001d700,(size_t *)(ulonglong)DVar5,param_4); if ((DAT_0 & 8) != 0) { McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,(wchar_t *)&local_838); } } } else { *(undefined4 *)(_Dst + 0x14) = 0x456b; _Dst[0x10] = 0; _Dst[0x11] = 0; _Dst[0x12] = 0; _Dst[0x13] = 0; *(undefined4 *)(_Dst + 0xe) = 0x4571; _Dst[10] = 0; _Dst[0xb] = 0; _Dst[0xc] = 0; _Dst[0xd] = 0; *(undefined4 *)(_Dst + 9) = 0x456a; _Dst[5] = 0; _Dst[6] = 0; _Dst[7] = 0; _Dst[8] = 0; if ((DAT_0 & 0x10) != 0) { param_4 = L"FALSE"; local_838 = local_838 & 0xffff0000; - FormatRRASErrorString((STRSAFE_LPWSTR)&local_838,0x18001c790,_Dst,L"FALSE"); + FormatRRASErrorString((STRSAFE_LPWSTR)&local_838,0x18001d780,_Dst,L"FALSE"); if ((DAT_0 & 0x10) != 0) { McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceInfo,(wchar_t *)&local_838); } } - lpCriticalSection_00 = (LPCRITICAL_SECTION)(SstpSvcGlobals + 0x2e); + lpCriticalSection = (LPCRITICAL_SECTION)(SstpSvcGlobals + 0x2e); _Dst[0x20] = 0; *(undefined2 *)(_Dst + 0x21) = 0; *(undefined1 *)((longlong)_Dst + 0x1b2) = 0; - EnterCriticalSection(lpCriticalSection_00); + EnterCriticalSection(lpCriticalSection); if (*(uint **)(SstpSvcGlobals + 0x2c) == (uint *)0x0) { DVar5 = 0x57; piVar10 = SstpSvcGlobals; } else { - iVar6 = assign_HF_handle(*(uint **)(SstpSvcGlobals + 0x2c),_Dst); + uVar6 = assign_HF_handle(*(uint **)(SstpSvcGlobals + 0x2c),_Dst); piVar10 = SstpSvcGlobals; - *(int *)((longlong)_Dst + 0xf4) = iVar6; - DVar5 = ~-(uint)(iVar6 != 0) & 8; + *puVar9 = uVar6; + DVar5 = ~-(uint)(uVar6 != 0) & 8; } LeaveCriticalSection((LPCRITICAL_SECTION)(piVar10 + 0x2e)); if (DVar5 == 0) { EnterCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0x38)); if (*SstpSvcGlobals != 3) { _Dst[0x1d] = (size_t)psVar1; _Dst[0x1c] = (size_t)psVar1; - EnterCriticalSection(lpCriticalSection); + EnterCriticalSection((LPCRITICAL_SECTION)(_Dst + 0x24)); *(undefined4 *)((longlong)_Dst + 0xfc) = 1; if ((char)_Dst[0x1f] != '\0') { _Dst[0x37] = 0; _Dst[0x38] = 0; *(undefined4 *)((longlong)_Dst + 0xfc) = 0x10001; } piVar10 = SstpSvcGlobals; plVar3 = *(longlong **)(SstpSvcGlobals + 0x44); _Dst[0x1c] = (size_t)(SstpSvcGlobals + 0x42); _Dst[0x1d] = (size_t)plVar3; *plVar3 = (longlong)psVar1; *(size_t **)(piVar10 + 0x44) = psVar1; - LeaveCriticalSection(lpCriticalSection); + LeaveCriticalSection((LPCRITICAL_SECTION)(_Dst + 0x24)); LeaveCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0x38)); *local_840 = _Dst; return 0; } LeaveCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0x38)); DVar5 = 0x3e3; - HfFreeHandle32(*(int **)(SstpSvcGlobals + 0x2c),(uint *)((longlong)_Dst + 0xf4)); + uVar6 = Feature_1207409977__private_IsEnabledDeviceUsageNoInline(); + if (uVar6 == 0) { + HfFreeHandle32(*(int **)(SstpSvcGlobals + 0x2c),puVar9); + } + else { + EnterCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0x2e)); + HfFreeHandle32(*(int **)(SstpSvcGlobals + 0x2c),puVar9); + LeaveCriticalSection((LPCRITICAL_SECTION)(SstpSvcGlobals + 0x2e)); + } } else if ((DAT_0 & 8) != 0) { local_838 = local_838 & 0xffff0000; FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_838,0x18001c800,(size_t *)(ulonglong)DVar5,param_4); + ((STRSAFE_LPWSTR)&local_838,0x18001d7f0,(size_t *)(ulonglong)DVar5,param_4); if ((DAT_0 & 8) != 0) { McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,(wchar_t *)&local_838); } } CloseThreadpoolWork((PTP_WORK)_Dst[0x2a]); _Dst[0x2a] = 0; } CloseThreadpoolWork((PTP_WORK)_Dst[0x29]); _Dst[0x29] = 0; } if (local_848 != '\0') { CloseThreadpoolTimer((PTP_TIMER)_Dst[0x39]); _Dst[0x39] = 0; } } else { p_Var7 = CreateThreadpoolTimer(ResponseWaitTimeout,_Dst,pcbe); _Dst[0x39] = (size_t)p_Var7; if (p_Var7 != (PTP_TIMER)0x0) goto LAB_2; DVar5 = GetLastError(); if ((DAT_0 & 8) != 0) { local_838 = local_838 & 0xffff0000; FormatRRASErrorString - ((STRSAFE_LPWSTR)&local_838,0x18001c660,(size_t *)(ulonglong)DVar5,param_4); + ((STRSAFE_LPWSTR)&local_838,0x18001d650,(size_t *)(ulonglong)DVar5,param_4); if ((DAT_0 & 8) != 0) { McTemplateU0z_EventWriteTransfer (&MICROSOFT_WINDOWS_RRAS_PROVIDER_Context, (PCEVENT_DESCRIPTOR)&RasSSTPSvcTraceError,(wchar_t *)&local_838); } } } - DeleteCriticalSection(lpCriticalSection); + DeleteCriticalSection((LPCRITICAL_SECTION)(_Dst + 0x24)); LAB_1: FreeBufferToPool((uint *)(SstpSvcGlobals + 0x86),(longlong)_Dst,'\x01'); return DVar5; } ``` ## HfGetPointerFromHandle32 ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.27| |i_ratio|0.06| |m_ratio|0.65| |b_ratio|0.35| |match_types|Implied Match| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |`name`|HfGetPointerFromHandle32|FormatRRASErrorString| |`fullname`|HfGetPointerFromHandle32|FormatRRASErrorString| |`refcount`|1|246| |`length`|64|40| |`called`||StringVPrintfWorkerW| |`calling`|SstpThreadPoolRequestQueueCallback|
Expand for full list:
AcquireHostRouteInfoContext
AddExistingEntryToXmlWriter
AddNewEntryToXmlWriter
AddNewTenantEntry
AllocateAndInitializeCallContext
AsyncSstpDeviceControl
CheckClientAccessToXmlFile
CleanupCallCtx
CleanupHostRouteEntry
DeinitializeTransport
DisconnectClientHttpCallContextDisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
FileStream::OpenFile
FindSstpGatewayByGroup
FlushXmlWriter
ForwardMakeCallRequest
GetXmlFilePath
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitializeHostRouteInfo
InitializeService
InitializeSstpServer
InitializeTransport
InitiateCallContextCleanup
InitiateSstpResponse
LoadSstpProxyConfigFromXmlFile
LogEventWithErrorParameter
NotifyMakeCallComplete
OpenXmlWriter
PostNewHttpRequest
PostNotificationBufferToDevice
PostReceiveOnCall
PostSendNotificationRequest
ProcessMakeCallRequest
ProcessNewCall
ProcessReceivedBytes
ProcessReceivedBytesWorker
ProcessReceivedHttpRequest
ProxySendToRelatedCtx
ResponseWaitTimeout
SendToNetworkWorker
ServiceHandlerEx
ServiceMain
ShutdownSstpServer
SstpMakeCall
SstpSvcCreateUpdateTenantGatewayMapping
SstpSvcGetConfig
SstpSvcGetTenantGatewayMapping
SstpSvcRemoveTenantGatewayMapping
SstpSvcSetConfig
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
StartServiceCleanup
TenantGatewayMap::DeleteSstpProxyRules
TenantGatewayMap::GetFileStream
TenantGatewayMap::TenantGatewayMap
TerminatePartialConnection
| |paramcount|3|4| |`address`|180008c8c|180009320| |`sig`|byte __fastcall HfGetPointerFromHandle32(int * param_1, uint param_2, longlong * param_3)|undefined __fastcall FormatRRASErrorString(STRSAFE_LPWSTR param_1, size_t param_2, size_t * param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HfGetPointerFromHandle32 Called Diff ```diff --- HfGetPointerFromHandle32 called +++ FormatRRASErrorString called @@ -0,0 +1 @@ +StringVPrintfWorkerW ``` ### HfGetPointerFromHandle32 Calling Diff ```diff --- HfGetPointerFromHandle32 calling +++ FormatRRASErrorString calling @@ -0,0 +1,51 @@ +AcquireHostRouteInfoContext +AddExistingEntryToXmlWriter +AddNewEntryToXmlWriter +AddNewTenantEntry +AllocateAndInitializeCallContext +AsyncSstpDeviceControl +CheckClientAccessToXmlFile +CleanupCallCtx +CleanupHostRouteEntry +DeinitializeTransport +DisconnectClientHttpCallContext +DisconnectServerHttpCallContext +DisconnectSstpCallFromTpi +FileStream::OpenFile +FindSstpGatewayByGroup +FlushXmlWriter +ForwardMakeCallRequest +GetXmlFilePath +HttpThreadPoolRequestQueueCallback +IndicateCallConnectedToTPI +InitializeHostRouteInfo +InitializeService +InitializeSstpServer +InitializeTransport +InitiateCallContextCleanup +InitiateSstpResponse +LoadSstpProxyConfigFromXmlFile +LogEventWithErrorParameter +NotifyMakeCallComplete +OpenXmlWriter +PostNewHttpRequest +PostNotificationBufferToDevice +PostReceiveOnCall +PostSendNotificationRequest +ProcessMakeCallRequest +ProcessNewCall +ProcessReceivedBytes +ProcessReceivedBytesWorker +ProcessReceivedHttpRequest +ProxySendToRelatedCtx +ResponseWaitTimeout +SendToNetworkWorker +ServiceHandlerEx +ServiceMain +ShutdownSstpServer +SstpMakeCall +SstpSvcCreateUpdateTenantGatewayMapping +SstpSvcGetConfig +SstpSvcGetTenantGatewayMapping +SstpSvcRemoveTenantGatewayMapping +SstpSvcSetConfig @@ -1,0 +53,8 @@ +SstpWebReceiveResponseCompletion +SstpWebReceiveResponseEntityCompletion +SstpWebSendRequestCompletion +StartServiceCleanup +TenantGatewayMap::DeleteSstpProxyRules +TenantGatewayMap::GetFileStream +TenantGatewayMap::TenantGatewayMap +TerminatePartialConnection ``` ### HfGetPointerFromHandle32 Diff ```diff --- HfGetPointerFromHandle32 +++ FormatRRASErrorString @@ -1,23 +1,13 @@ -byte HfGetPointerFromHandle32(int *param_1,uint param_2,longlong *param_3) +void FormatRRASErrorString(STRSAFE_LPWSTR param_1,size_t param_2,size_t *param_3,undefined8 param_4) { - byte bVar1; - longlong lVar2; + size_t *local_res18; + undefined8 local_res20; - if (param_1 == (int *)0x0) { - bVar1 = 0x57; - } - else { - lVar2 = (longlong)(int)(*param_1 - 1U & param_2) * 0x20; - if (*(uint *)(lVar2 + *(longlong *)(param_1 + 2)) == param_2) { - lVar2 = *(longlong *)(lVar2 + 8 + *(longlong *)(param_1 + 2)); - *param_3 = lVar2; - return ~-(lVar2 != 0) & 6; - } - bVar1 = 6; - } - *param_3 = 0; - return bVar1; + local_res18 = param_3; + local_res20 = param_4; + StringVPrintfWorkerW(param_1,param_2,param_3,(STRSAFE_LPCWSTR)param_2,(va_list)&local_res18); + return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|68|67| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|180017828|1800186c8| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|EnterCriticalSection|EnterCriticalSection| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection| |`refcount`|90|94| |length|0|0| |called||| |calling|
Expand for full list:
AcquireHostRouteInfoContext
AddBufferBlockToPool
AllocateAndInitializeCallContext
CleanupCallCtx
CleanupHostRouteEntry
DeinitializeTransport
DisconnectClientHttpCallContext
DisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
ForwardMakeCallRequest
FreeBufferPoolFreeBufferToPool
GetBufferFromPool
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitiateCallContextCleanup
InitiateSstpResponse
PostReceiveOnCall
PostSendNotificationRequest
ProcessMakeCallRequest
ProcessNewCall
ProcessReceivedBytes
ProcessReceivedBytesWorker
ProxySendToRelatedCtx
ResponseWaitTimeout
SendToNetworkWorker
SstpMakeCall
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
SstpWebSendRequestEntityCompletion
|
Expand for full list:
AcquireHostRouteInfoContext
AddBufferBlockToPool
AllocateAndInitializeCallContext
CleanupCallCtx
CleanupHostRouteEntry
DeinitializeTransport
DisconnectClientHttpCallContext
DisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
ForwardMakeCallRequest
FreeBufferPoolFreeBufferToPool
GetBufferFromPool
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitiateCallContextCleanup
InitiateSstpResponse
PostReceiveOnCall
PostSendNotificationRequest
ProcessMakeCallRequest
ProcessNewCall
ProcessReceivedBytes
ProcessReceivedBytesWorker
ProxySendToRelatedCtx
ResponseWaitTimeout
SendToNetworkWorker
SstpMakeCall
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
SstpWebSendRequestEntityCompletion
| |paramcount|1|1| |`address`|EXTERNAL:00000030|EXTERNAL:00000026| |sig|void __stdcall EnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection)|void __stdcall EnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|GetModuleHandleW|GetModuleHandleW| |fullname|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW| |`refcount`|4|5| |length|0|0| |called||| |`calling`|ConvertCorrelationIdToWideChar
PrintGuid
ProcessNewCall|ConvertCorrelationIdToWideChar
PrintGuid
ProcessNewCall
wil_details_GetNtDllProcedureAddress| |paramcount|1|1| |`address`|EXTERNAL:00000069|EXTERNAL:0000003d| |sig|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW Calling Diff ```diff --- API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW calling +++ API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW calling @@ -3,0 +4 @@ +wil_details_GetNtDllProcedureAddress ``` ## API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|DeviceIoControl|DeviceIoControl| |fullname|API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl|API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl| |`refcount`|8|10| |length|0|0| |called||| |`calling`|AsyncDeviceControl
AsyncSstpDeviceControl
PostNotificationBufferToDevice
PostSendNotificationRequest
ProcessReceivedBytesWorker
SendToNetworkWorker
SyncDeviceControl|AsyncDeviceControl
AsyncSstpDeviceControl
PostNotificationBufferToDevice
PostSendNotificationRequest
ProcessReceivedBytesWorker
SendToNetworkWorker
SstpThreadPoolRequestQueueCallback
SyncDeviceControl| |paramcount|8|8| |`address`|EXTERNAL:0000003d|EXTERNAL:0000003f| |sig|BOOL __stdcall DeviceIoControl(HANDLE hDevice, DWORD dwIoControlCode, LPVOID lpInBuffer, DWORD nInBufferSize, LPVOID lpOutBuffer, DWORD nOutBufferSize, LPDWORD lpBytesReturned, LPOVERLAPPED lpOverlapped)|BOOL __stdcall DeviceIoControl(HANDLE hDevice, DWORD dwIoControlCode, LPVOID lpInBuffer, DWORD nInBufferSize, LPVOID lpOutBuffer, DWORD nOutBufferSize, LPDWORD lpBytesReturned, LPOVERLAPPED lpOverlapped)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl Calling Diff ```diff --- API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl calling +++ API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl calling @@ -6,0 +7 @@ +SstpThreadPoolRequestQueueCallback ``` ## StringCchPrintfW ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.79| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|StringCchPrintfW|StringCchPrintfW| |fullname|StringCchPrintfW|StringCchPrintfW| |`refcount`|2|3| |length|114|114| |called|MSVCRT.DLL::_vsnwprintf|MSVCRT.DLL::_vsnwprintf| |`calling`|ConvertByteArrayToString|SstpThreadPoolRequestQueueCallback| |paramcount|3|3| |`address`|18000faa0|1800108cc| |sig|HRESULT __stdcall StringCchPrintfW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszFormat, ...)|HRESULT __stdcall StringCchPrintfW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszFormat, ...)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### StringCchPrintfW Calling Diff ```diff --- StringCchPrintfW calling +++ StringCchPrintfW calling @@ -1 +1 @@ -ConvertByteArrayToString +SstpThreadPoolRequestQueueCallback ``` ## McTemplateU0z_EventWriteTransfer ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.76| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|McTemplateU0z_EventWriteTransfer|McTemplateU0z_EventWriteTransfer| |fullname|McTemplateU0z_EventWriteTransfer|McTemplateU0z_EventWriteTransfer| |`refcount`|251|239| |length|122|122| |called|McGenEventWrite_EventWriteTransfer
__security_check_cookie|McGenEventWrite_EventWriteTransfer
__security_check_cookie| |`calling`|
Expand for full list:
AddExistingEntryToXmlWriter
AddNewEntryToXmlWriter
AddNewTenantEntry
AllocateAndInitializeCallContext
AsyncSstpDeviceControl
CheckClientAccessToXmlFile
CleanupCallCtx
CreateTenantGatewayEntryStruct
DeinitializeTransport
DisconnectClientHttpCallContext
DisconnectServerHttpCallContextDisconnectSstpCallFromTpi
FileStream::OpenFile
FindSstpGatewayByGroup
FlushXmlWriter
ForwardMakeCallRequest
GetXmlFilePath
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitializeService
InitializeSstpServer
InitializeTransport
InitiateCallContextCleanup
InitiateSstpResponse
LoadSstpProxyConfigFromXmlFile
LogEventWithErrorParameter
NotifyMakeCallComplete
OpenXmlWriter
PostNewHttpRequest
PostNotificationBufferToDevice
PostReceiveOnCall
PostSendNotificationRequest
ProcessMakeCallRequest
ProcessNewCall
ProcessReceivedBytes
ProcessReceivedBytesWorker
ProcessReceivedHttpRequest
ProcessReceivedNotification
ProxySendToRelatedCtx
RemoveListenerComplete
ReplaceGatewayList
ResponseWaitTimeout
SendToNetworkWorker
ServiceHandlerEx
ServiceMain
SetHostRoutLibParams
SetupListenerComplete
ShutdownSstpServer
SstpMakeCall
SstpSvcCreateUpdateTenantGatewayMapping
SstpSvcGetConfig
SstpSvcGetTenantGatewayMapping
SstpSvcRemoveTenantGatewayMapping
SstpSvcSetConfig
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
StartServiceCleanup
TenantGatewayMap::DeleteSstpProxyRules
TenantGatewayMap::GetFileStream
TenantGatewayMap::TenantGatewayMap
TerminatePartialConnection
|
Expand for full list:
AddExistingEntryToXmlWriter
AddNewEntryToXmlWriter
AddNewTenantEntry
AllocateAndInitializeCallContext
AsyncSstpDeviceControl
CheckClientAccessToXmlFile
CleanupCallCtx
CreateTenantGatewayEntryStruct
DeinitializeTransport
DisconnectClientHttpCallContext
DisconnectServerHttpCallContextDisconnectSstpCallFromTpi
FileStream::OpenFile
FindSstpGatewayByGroup
FlushXmlWriter
ForwardMakeCallRequest
GetXmlFilePath
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitializeService
InitializeSstpServer
InitializeTransport
InitiateCallContextCleanup
InitiateSstpResponse
LoadSstpProxyConfigFromXmlFile
LogEventWithErrorParameter
NotifyMakeCallComplete
OpenXmlWriter
PostNewHttpRequest
PostNotificationBufferToDevice
PostReceiveOnCall
PostSendNotificationRequest
ProcessMakeCallRequest
ProcessNewCall
ProcessReceivedBytes
ProcessReceivedBytesWorker
ProcessReceivedHttpRequest
ProxySendToRelatedCtx
ReplaceGatewayList
ResponseWaitTimeout
SendToNetworkWorker
ServiceHandlerEx
ServiceMain
SetHostRoutLibParams
ShutdownSstpServer
SstpMakeCall
SstpSvcCreateUpdateTenantGatewayMapping
SstpSvcGetConfig
SstpSvcGetTenantGatewayMapping
SstpSvcRemoveTenantGatewayMapping
SstpSvcSetConfig
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
StartServiceCleanup
TenantGatewayMap::DeleteSstpProxyRules
TenantGatewayMap::GetFileStream
TenantGatewayMap::TenantGatewayMap
TerminatePartialConnection
| |paramcount|3|3| |`address`|180008930|180009110| |sig|undefined __fastcall McTemplateU0z_EventWriteTransfer(REGHANDLE * param_1, PCEVENT_DESCRIPTOR param_2, wchar_t * param_3)|undefined __fastcall McTemplateU0z_EventWriteTransfer(REGHANDLE * param_1, PCEVENT_DESCRIPTOR param_2, wchar_t * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### McTemplateU0z_EventWriteTransfer Calling Diff ```diff --- McTemplateU0z_EventWriteTransfer calling +++ McTemplateU0z_EventWriteTransfer calling @@ -38 +37,0 @@ -ProcessReceivedNotification @@ -40 +38,0 @@ -RemoveListenerComplete @@ -47 +44,0 @@ -SetupListenerComplete @@ -55 +51,0 @@ -SstpThreadPoolRequestQueueCallback ``` ## API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|GetLastError|GetLastError| |fullname|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError| |`refcount`|56|58| |length|0|0| |called||| |`calling`|
Expand for full list:
AcquireHostRouteInfoContext
AllocateAndInitializeCallContext
AsyncSstpDeviceControl
CheckClientAccessToXmlFile
ConfigureMiniports
CreateMiniportDevices
FileStream::DeleteExistingContent
FileStream::OpenFile
FileStream::Read
FileStream::Seek
FileStream::StatFileStream::Write
GetXmlFilePath
InitRrasRootEnum
InitializeHostRouteInfo
InitializeService
InitializeSstpServer
InitializeTransport
PostNotificationBufferToDevice
PostSendNotificationRequest
ProcessReceivedBytesWorker
SendToNetworkWorker
ServiceHandlerEx
ServiceMain
SstpMakeCall
StartServiceCleanup
SyncDeviceControl
TenantGatewayMap::DeleteSstpProxyRules
WaitForInterface
|
Expand for full list:
AcquireHostRouteInfoContext
AllocateAndInitializeCallContext
AsyncSstpDeviceControl
CheckClientAccessToXmlFile
ConfigureMiniports
CreateMiniportDevices
FileStream::DeleteExistingContent
FileStream::OpenFile
FileStream::Read
FileStream::Seek
FileStream::StatFileStream::Write
GetXmlFilePath
InitRrasRootEnum
InitializeHostRouteInfo
InitializeService
InitializeSstpServer
InitializeTransport
PostNotificationBufferToDevice
PostSendNotificationRequest
ProcessReceivedBytesWorker
SendToNetworkWorker
ServiceHandlerEx
ServiceMain
SstpMakeCall
SstpThreadPoolRequestQueueCallback
StartServiceCleanup
SyncDeviceControl
TenantGatewayMap::DeleteSstpProxyRules
WaitForInterface
| |paramcount|0|0| |`address`|EXTERNAL:00000034|EXTERNAL:00000035| |sig|DWORD __stdcall GetLastError(void)|DWORD __stdcall GetLastError(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError Calling Diff ```diff --- API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError calling +++ API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError calling @@ -25,0 +26 @@ +SstpThreadPoolRequestQueueCallback ``` ## DereferenceRefCount ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.7| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|DereferenceRefCount|DereferenceRefCount| |fullname|DereferenceRefCount|DereferenceRefCount| |`refcount`|26|28| |length|34|34| |called|_guard_dispatch_icall$thunk$10345483385596137414|_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|
Expand for full list:
CleanupCallCtx
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitiateCallContextCleanup
InitiateSstpResponse
NotifyMakeCallComplete
PostNewHttpRequest
PostReceiveOnCall
PostSendNotificationRequest
ProcessNewCall
ResponseWaitTimeoutSstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebSendRequestCompletion
|
Expand for full list:
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitiateCallContextCleanup
InitiateSstpResponse
NotifyMakeCallComplete
PostNewHttpRequest
PostReceiveOnCall
PostSendNotificationRequest
ProcessNewCall
ReleaseHostRouteInfoContext
ResponseWaitTimeoutSstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebSendRequestCompletion
| |paramcount|1|1| |`address`|180002dd0|180004ab0| |sig|undefined __fastcall DereferenceRefCount(int * param_1)|undefined __fastcall DereferenceRefCount(int * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DereferenceRefCount Calling Diff ```diff --- DereferenceRefCount calling +++ DereferenceRefCount calling @@ -1 +0,0 @@ -CleanupCallCtx @@ -10,0 +10 @@ +ReleaseHostRouteInfoContext ``` ## SyncDeviceControl ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.78| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|SyncDeviceControl|SyncDeviceControl| |fullname|SyncDeviceControl|SyncDeviceControl| |`refcount`|7|5| |length|81|81| |called|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-IO-L1-1-0.DLL::DeviceIoControl| |`calling`|DisconnectSstpCallFromTpi
HttpThreadPoolRequestQueueCallback
NotifyMakeCallComplete
ProcessMakeCallRequest
RemoveListenerComplete
SetupListenerComplete|DisconnectSstpCallFromTpi
HttpThreadPoolRequestQueueCallback
NotifyMakeCallComplete
ProcessMakeCallRequest| |paramcount|7|7| |`address`|1800052a0|180004a50| |sig|DWORD __fastcall SyncDeviceControl(HANDLE param_1, DWORD param_2, LPVOID param_3, DWORD param_4, LPVOID param_5, DWORD param_6, LPDWORD param_7)|DWORD __fastcall SyncDeviceControl(HANDLE param_1, DWORD param_2, LPVOID param_3, DWORD param_4, LPVOID param_5, DWORD param_6, LPDWORD param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SyncDeviceControl Calling Diff ```diff --- SyncDeviceControl calling +++ SyncDeviceControl calling @@ -5,2 +4,0 @@ -RemoveListenerComplete -SetupListenerComplete ``` ## __security_check_cookie ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|80|79| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
AcquireHostRouteInfoContext
AddExistingEntryToXmlWriter
AddNewEntryToXmlWriter
AddNewTenantEntry
AllocateAndInitializeCallContext
AsyncSstpDeviceControl
CheckClientAccessToXmlFile
CheckGatewayName
CleanupCallCtx
CleanupHostRouteEntry
ConvertCorrelationIdToWideCharCreateTenantGatewayEntryStruct
DeinitializeTransport
DisconnectClientHttpCallContext
DisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
FileStream::OpenFile
FindSstpGatewayByGroup
FlushXmlWriter
ForwardMakeCallRequest
GetXmlFilePath
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitRrasRootEnum
InitializeHostRouteInfo
InitializeService
InitializeSstpServer
InitializeTransport
InitiateCallContextCleanup
InitiateSstpResponse
LoadSstpProxyConfigFromXmlFile
LogEventWithErrorParameter
McTemplateU0z_EventWriteTransfer
McTemplateU0zjzz_EventWriteTransfer
NotifyMakeCallComplete
NsiCliAddHostRoute
NsiCliAddHostV6Route
NsiCliDeleteHostRoute
NsiCliDeleteHostV6Route
OpenXmlWriter
PostNewHttpRequest
PostNotificationBufferToDevice
PostReceiveOnCall
PostSendNotificationRequest
PrintGuid
ProcessMakeCallRequest
ProcessNewCall
ProcessReceivedBytes
ProcessReceivedBytesWorker
ProcessReceivedHttpRequest
ProcessReceivedNotification
ProxySendToRelatedCtx
RemoveListenerComplete
ResponseWaitTimeout
SendToNetworkWorker
ServiceHandlerEx
ServiceMain
SetCurrentServiceStatus
SetLibParams
SetupListenerComplete
ShutdownSstpServer
SstpMakeCall
SstpSvcCreateUpdateTenantGatewayMapping
SstpSvcGetConfig
SstpSvcGetTenantGatewayMapping
SstpSvcRemoveTenantGatewayMapping
SstpSvcSetConfig
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
StartServiceCleanup
TenantGatewayMap::DeleteSstpProxyRules
TenantGatewayMap::GetFileStream
TenantGatewayMap::TenantGatewayMap
TerminatePartialConnection
WaitForInterface
__GSHandlerCheckCommon
std::tr1::unordered_map,class_std::allocator_>,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>,struct_CaseInsensitiveStringHash,struct_CaseInsensitiveStringEquality,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>::operator[]
|
Expand for full list:
AcquireHostRouteInfoContext
AddExistingEntryToXmlWriter
AddNewEntryToXmlWriter
AddNewTenantEntry
AllocateAndInitializeCallContext
AsyncSstpDeviceControl
CheckClientAccessToXmlFile
CheckGatewayName
CleanupCallCtx
CleanupHostRouteEntry
ConvertCorrelationIdToWideCharCreateTenantGatewayEntryStruct
DeinitializeTransport
DisconnectClientHttpCallContext
DisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
FileStream::OpenFile
FindSstpGatewayByGroup
FlushXmlWriter
ForwardMakeCallRequest
GetXmlFilePath
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitRrasRootEnum
InitializeHostRouteInfo
InitializeService
InitializeSstpServer
InitializeTransport
InitiateCallContextCleanup
InitiateSstpResponse
LoadSstpProxyConfigFromXmlFile
LogEventWithErrorParameter
McTemplateU0z_EventWriteTransfer
McTemplateU0zjzz_EventWriteTransfer
NotifyMakeCallComplete
NsiCliAddHostRoute
NsiCliAddHostV6Route
NsiCliDeleteHostRoute
NsiCliDeleteHostV6Route
OpenXmlWriter
PostNewHttpRequest
PostNotificationBufferToDevice
PostReceiveOnCall
PostSendNotificationRequest
PrintGuid
ProcessMakeCallRequest
ProcessNewCall
ProcessReceivedBytes
ProcessReceivedBytesWorker
ProcessReceivedHttpRequest
ProxySendToRelatedCtx
ResponseWaitTimeout
SendToNetworkWorker
ServiceHandlerEx
ServiceMain
SetCurrentServiceStatus
SetLibParams
ShutdownSstpServer
SstpMakeCall
SstpSvcCreateUpdateTenantGatewayMapping
SstpSvcGetConfig
SstpSvcGetTenantGatewayMapping
SstpSvcRemoveTenantGatewayMapping
SstpSvcSetConfig
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
StartServiceCleanup
TenantGatewayMap::DeleteSstpProxyRules
TenantGatewayMap::GetFileStream
TenantGatewayMap::TenantGatewayMap
TerminatePartialConnection
WaitForInterface
__GSHandlerCheckCommon
std::tr1::unordered_map,class_std::allocator_>,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>,struct_CaseInsensitiveStringHash,struct_CaseInsensitiveStringEquality,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>::operator[]
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
| |paramcount|1|1| |`address`|180017980|180018820| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -51 +50,0 @@ -ProcessReceivedNotification @@ -53 +51,0 @@ -RemoveListenerComplete @@ -60 +57,0 @@ -SetupListenerComplete @@ -79,0 +77,2 @@ +wil_RtlStagingConfig_QueryFeatureState +wil_details_FeatureReporting_ReportUsageToServiceDirect ``` ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|LeaveCriticalSection|LeaveCriticalSection| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection| |`refcount`|83|87| |length|0|0| |called||| |calling|
Expand for full list:
AcquireHostRouteInfoContext
AddBufferBlockToPool
AllocateAndInitializeCallContext
CleanupCallCtx
CleanupHostRouteEntry
DeinitializeTransport
DisconnectClientHttpCallContext
DisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
ForwardMakeCallRequest
FreeBufferPoolGetBufferFromPool
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitiateCallContextCleanup
InitiateSstpResponse
PostReceiveOnCall
PostSendNotificationRequest
ProcessMakeCallRequest
ProcessNewCall
ProcessReceivedBytes
ProcessReceivedBytesWorker
ProxySendToRelatedCtx
ResponseWaitTimeout
SendToNetworkWorker
SstpMakeCall
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
SstpWebSendRequestEntityCompletion
|
Expand for full list:
AcquireHostRouteInfoContext
AddBufferBlockToPool
AllocateAndInitializeCallContext
CleanupCallCtx
CleanupHostRouteEntry
DeinitializeTransport
DisconnectClientHttpCallContext
DisconnectServerHttpCallContext
DisconnectSstpCallFromTpi
ForwardMakeCallRequest
FreeBufferPoolGetBufferFromPool
HttpThreadPoolRequestQueueCallback
IndicateCallConnectedToTPI
InitiateCallContextCleanup
InitiateSstpResponse
PostReceiveOnCall
PostSendNotificationRequest
ProcessMakeCallRequest
ProcessNewCall
ProcessReceivedBytes
ProcessReceivedBytesWorker
ProxySendToRelatedCtx
ResponseWaitTimeout
SendToNetworkWorker
SstpMakeCall
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseCompletion
SstpWebReceiveResponseEntityCompletion
SstpWebSendRequestCompletion
SstpWebSendRequestEntityCompletion
| |paramcount|1|1| |`address`|EXTERNAL:00000026|EXTERNAL:00000027| |sig|void __stdcall LeaveCriticalSection(LPCRITICAL_SECTION lpCriticalSection)|void __stdcall LeaveCriticalSection(LPCRITICAL_SECTION lpCriticalSection)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## __chkstk ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.89| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|__chkstk|__chkstk| |fullname|__chkstk|__chkstk| |`refcount`|6|7| |length|77|77| |called||| |`calling`|HttpThreadPoolRequestQueueCallback
PostNotificationBufferToDevice
PostReceiveOnCall
PostSendNotificationRequest
SstpWebReceiveResponseEntityCompletion|HttpThreadPoolRequestQueueCallback
PostNotificationBufferToDevice
PostReceiveOnCall
PostSendNotificationRequest
SstpThreadPoolRequestQueueCallback
SstpWebReceiveResponseEntityCompletion| |paramcount|0|0| |`address`|180017a40|1800188e0| |sig|undefined __fastcall __chkstk(void)|undefined __fastcall __chkstk(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __chkstk Calling Diff ```diff --- __chkstk calling +++ __chkstk calling @@ -4,0 +5 @@ +SstpThreadPoolRequestQueueCallback ``` ## HfFreeHandle32 ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.79| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|HfFreeHandle32|HfFreeHandle32| |fullname|HfFreeHandle32|HfFreeHandle32| |`refcount`|3|5| |length|37|37| |called|release_HF_handle|release_HF_handle| |`calling`|AllocateAndInitializeCallContext
CleanupCallCtx|AllocateAndInitializeCallContext
CleanupCallCtx
InitiateCallContextCleanup| |paramcount|2|2| |`address`|1800159f8|180016828| |sig|undefined4 __fastcall HfFreeHandle32(int * param_1, uint * param_2)|undefined4 __fastcall HfFreeHandle32(int * param_1, uint * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HfFreeHandle32 Calling Diff ```diff --- HfFreeHandle32 calling +++ HfFreeHandle32 calling @@ -2,0 +3 @@ +InitiateCallContextCleanup ``` ## McGenEventWrite_EventWriteTransfer ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|McGenEventWrite_EventWriteTransfer|McGenEventWrite_EventWriteTransfer| |fullname|McGenEventWrite_EventWriteTransfer|McGenEventWrite_EventWriteTransfer| |`refcount`|4|15| |length|87|87| |called|API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL::EventWriteTransfer|API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL::EventWriteTransfer| |`calling`|McTemplateU0z_EventWriteTransfer
McTemplateU0zjzz_EventWriteTransfer
PostSendNotificationRequest|McTemplateU0z_EventWriteTransfer
McTemplateU0zjzz_EventWriteTransfer
PostSendNotificationRequest
SstpThreadPoolRequestQueueCallback| |paramcount|5|5| |`address`|1800089b4|180009194| |sig|undefined __fastcall McGenEventWrite_EventWriteTransfer(REGHANDLE * param_1, PCEVENT_DESCRIPTOR param_2, undefined8 param_3, ULONG param_4, PEVENT_DATA_DESCRIPTOR param_5)|undefined __fastcall McGenEventWrite_EventWriteTransfer(REGHANDLE * param_1, PCEVENT_DESCRIPTOR param_2, undefined8 param_3, ULONG param_4, PEVENT_DATA_DESCRIPTOR param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### McGenEventWrite_EventWriteTransfer Calling Diff ```diff --- McGenEventWrite_EventWriteTransfer calling +++ McGenEventWrite_EventWriteTransfer calling @@ -3,0 +4 @@ +SstpThreadPoolRequestQueueCallback ``` ## MSVCRT.DLL::exception::exception ### Match Info |Key|sstp_8737.dll - sstp_8875.dll| | :---: | :---: | |diff_type|refcount,sig,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|ExternalsName| ### Function Meta Diff |Key|sstp_8737.dll|sstp_8875.dll| | :---: | :---: | :---: | |name|exception|exception| |fullname|MSVCRT.DLL::exception::exception|MSVCRT.DLL::exception::exception| |`refcount`|14|4| |length|0|0| |called||| |`calling`|
Expand for full list:
FUN_1800083cc
`std::basic_string,std::allocator_>::_Copy'::__l1::catch$3
std::_List_val,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>::_Buynode,class_std::allocator_>,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>
std::_Tree_val,class_std::allocator_>,struct__lessstr,class_std::allocator,class_std::allocator_>_>,0>_>::_Buynode
std::_Tree_val,class_std::allocator_>,struct__lessstr,class_std::allocator,class_std::allocator_>_>,0>_>::_Tree_val,class_std::allocator_>,struct__lessstr,class_std::allocator,class_std::allocator_>_>,0>_>
std::basic_string,class_std::allocator_>::_Copy
std::tr1::unordered_map,class_std::allocator_>,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>,struct_CaseInsensitiveStringHash,struct_CaseInsensitiveStringEquality,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>::unordered_map,class_std::allocator_>,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>,struct_CaseInsensitiveStringHash,struct_CaseInsensitiveStringEquality,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>
std::vector,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>_>,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>_>_>_>::reserve
std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>::_Buy
std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>::reserve
std::vector_>::reserve
|std::bad_alloc::bad_alloc| |paramcount|2|2| |`address`|EXTERNAL:00000011|EXTERNAL:0000001a| |`sig`|undefined __thiscall exception(exception * this, char * * param_1)|undefined __thiscall exception(exception * this, exception * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### MSVCRT.DLL::exception::exception Calling Diff ```diff --- MSVCRT.DLL::exception::exception calling +++ MSVCRT.DLL::exception::exception calling @@ -1,11 +1 @@ -FUN_1800083cc -`std::basic_string,std::allocator_>::_Copy'::__l1::catch$3 -std::_List_val,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>::_Buynode,class_std::allocator_>,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_> -std::_Tree_val,class_std::allocator_>,struct__lessstr,class_std::allocator,class_std::allocator_>_>,0>_>::_Buynode -std::_Tree_val,class_std::allocator_>,struct__lessstr,class_std::allocator,class_std::allocator_>_>,0>_>::_Tree_val,class_std::allocator_>,struct__lessstr,class_std::allocator,class_std::allocator_>_>,0>_> -std::basic_string,class_std::allocator_>::_Copy -std::tr1::unordered_map,class_std::allocator_>,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>,struct_CaseInsensitiveStringHash,struct_CaseInsensitiveStringEquality,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>::unordered_map,class_std::allocator_>,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>,struct_CaseInsensitiveStringHash,struct_CaseInsensitiveStringEquality,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_> -std::vector,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>_>,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>,class_std::allocator,class_std::allocator_>_const_,class_std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>_>_>_>_>_>_>::reserve -std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>::_Buy -std::vector,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>::reserve -std::vector_>::reserve +std::bad_alloc::bad_alloc ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-19T00:09:09