# pre.dll-post.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [wil_details_NtQueryWnfStateData](#wil_details_ntquerywnfstatedata) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [wil_details_StagingConfig_Load](#wil_details_stagingconfig_load) * [wil_details_StagingConfig_QueryFeatureState](#wil_details_stagingconfig_queryfeaturestate) * [Feature_1481456953__private_IsEnabledDeviceUsage](#feature_1481456953__private_isenableddeviceusage) * [Modified](#modified) * [GrowBuf](#growbuf) * [DoFunc](#dofunc) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [KERNEL32.DLL::HeapAlloc](#kernel32dllheapalloc) * [TRACELogPrint](#tracelogprint) * [KERNEL32.DLL::GetProcessHeap](#kernel32dllgetprocessheap) * [KERNEL32.DLL::GetModuleHandleW](#kernel32dllgetmodulehandlew) * [KERNEL32.DLL::HeapFree](#kernel32dllheapfree) * [__security_check_cookie](#__security_check_cookie) * [KERNEL32.DLL::GetProcAddress](#kernel32dllgetprocaddress) # Visual Chart Diff ```mermaid flowchart LR GrowBuf-4-old<--Match 74%-->GrowBuf-4-new DoFunc-4-old<--Match 55%-->DoFunc-4-new subgraph post.dll GrowBuf-4-new DoFunc-4-new subgraph Added direction LR wil_details_NtQueryWnfStateData wil_details_FeatureReporting_RecordUsageInCache wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_FeatureReporting_ReportUsageToService wil_details_GetCurrentFeatureEnabledState wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_IsEnabledFallback wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath wil_details_StagingConfig_Load wil_details_StagingConfig_QueryFeatureState Feature_1481456953__private_IsEnabledDeviceUsage end end subgraph pre.dll GrowBuf-4-old DoFunc-4-old end ``` ```mermaid pie showData title Function Matches - 99.4092% "unmatched_funcs_len" : 11 "matched_funcs_len" : 1851 ``` ```mermaid pie showData title Matched Function Similarity - 99.2977% "matched_funcs_with_code_changes_len" : 2 "matched_funcs_with_non_code_changes_len" : 11 "matched_funcs_no_changes_len" : 1838 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ./proj --project-name tapi32-43518 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 pre.dll post.dll ``` #### Verbose Args
``` --old ['pre.dll'] --new [['post.dll']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name tapi32-43518 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/TAPI32.DLL/D0439E7F42000/TAPI32.DLL -O tapi32.dll.x64.10.0.19041.4950 wget https://msdl.microsoft.com/download/symbols/TAPI32.DLL/95CC476243000/TAPI32.DLL -O tapi32.dll.x64.10.0.19041.5072 ``` ## Binary Metadata Diff ```diff --- pre.dll Meta +++ post.dll Meta @@ -1,44 +1,44 @@ -Program Name: pre.dll +Program Name: post.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 257632 +# of Bytes: 262824 # of Memory Blocks: 9 -# of Instructions: 43763 -# of Defined Data: 3337 -# of Functions: 925 -# of Symbols: 10484 -# of Data Types: 959 +# of Instructions: 45026 +# of Defined Data: 3371 +# of Functions: 937 +# of Symbols: 10619 +# of Data Types: 960 # of Data Type Categories: 42 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 19:26:35 SGT 2026 +Date Created: Sun Aug 16 19:26:39 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/tapi32-43518/pre.dll -Executable MD5: b7b62d8189cf42f17468dc6c40447909 -Executable SHA256: 7c06f155e46564cee84339e4ffcf75f97e21c14a2fb3508c3bfb41e5d6709a75 -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/tapi32-43518/pre.dll?MD5=b7b62d8189cf42f17468dc6c40447909 +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/tapi32-43518/post.dll +Executable MD5: 53b24508ec42da63f63cd12007922ac0 +Executable SHA256: e582250c325c67c9e811c869a69c255505066655a952bc09f80d04e2b4b9c71f +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/tapi32-43518/post.dll?MD5=53b24508ec42da63f63cd12007922ac0 PDB Age: 1 PDB File: tapi32.pdb -PDB GUID: 8a52aa98-b8f6-5508-7735-254e7e91f546 +PDB GUID: 3e6df2dd-664f-acb2-efb8-0e2769ea0995 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Microsoft® Windows(TM) Telephony API Client DLL -PE Property[FileVersion]: 10.0.19041.4950 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.19041.5072 (WinBuild.160101.0800) PE Property[InternalName]: tapi32 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: TAPI32.DLL PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.19041.4950 +PE Property[ProductVersion]: 10.0.19041.5072 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra pre.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra pre.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra pre.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra post.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra post.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra post.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|11| |deleted_funcs_len|0| |modified_funcs_len|13| |added_symbols_len|14| |deleted_symbols_len|0| |diff_time|4.053212642669678| |deleted_strings_len|0| |added_strings_len|4| |match_types|Counter({'SymbolsHash': 924, 'ExternalsName': 217, 'ExactBytesFunctionHasher': 1})| |items_to_process|38| |diff_types|Counter({'address': 13, 'refcount': 11, 'calling': 8, 'length': 3, 'code': 2, 'called': 2, 'sig': 1})| |unmatched_funcs_len|11| |total_funcs_len|1862| |matched_funcs_len|1851| |matched_funcs_with_code_changes_len|2| |matched_funcs_with_non_code_changes_len|11| |matched_funcs_no_changes_len|1838| |match_func_similarity_percent|99.2977%| |func_match_overall_percent|99.4092%| |first_matches|Counter({'SymbolsHash': 924, 'ExactBytesFunctionHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 924 "ExternalsName" : 217 "ExactBytesFunctionHasher" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 924 "ExactBytesFunctionHasher" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 11 "deleted_funcs_len" : 0 "modified_funcs_len" : 13 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 14 "deleted_symbols_len" : 0 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 4 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,4 @@ +s_NtQueryWnfStateData +s_RtlNotifyFeatureUsage +s_RtlQueryFeatureConfiguration +u_ntdll.dll ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_ntdll.dll|3|wil_details_GetCurrentFeatureEnabledState,wil_details_NtQueryWnfStateData,wil_details_FeatureReporting_ReportUsageToServiceDirect| |s_RtlNotifyFeatureUsage|1|wil_details_FeatureReporting_ReportUsageToServiceDirect| |s_RtlQueryFeatureConfiguration|1|wil_details_GetCurrentFeatureEnabledState| |s_NtQueryWnfStateData|1|wil_details_NtQueryWnfStateData| # Deleted # Added ## wil_details_NtQueryWnfStateData ### Function Meta |Key|post.dll| | :---: | :---: | |name|wil_details_NtQueryWnfStateData| |fullname|wil_details_NtQueryWnfStateData| |refcount|4| |length|161| |called|KERNEL32.DLL::GetModuleHandleW
KERNEL32.DLL::GetProcAddress
_guard_dispatch_icall| |calling|wil_details_StagingConfig_Load| |paramcount|6| |address|180001094| |sig|undefined8 __fastcall wil_details_NtQueryWnfStateData(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, undefined8 param_6)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_NtQueryWnfStateData +++ wil_details_NtQueryWnfStateData @@ -0,0 +1,26 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Exceeded maximum restarts with more pending */ + +undefined8 +wil_details_NtQueryWnfStateData + (undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4, + undefined8 param_5,undefined8 param_6) + +{ + undefined8 uVar1; + + if (g_wil_details_pfnNtQueryWnfStateData == (FARPROC)0x0) { + if (g_wil_details_ntdllModuleHandle == (HMODULE)0x0) { + g_wil_details_ntdllModuleHandle = GetModuleHandleW(L"ntdll.dll"); + } + g_wil_details_pfnNtQueryWnfStateData = + GetProcAddress(g_wil_details_ntdllModuleHandle,"NtQueryWnfStateData"); + if (g_wil_details_pfnNtQueryWnfStateData == (FARPROC)0x0) { + return 0xc0000139; + } + } + uVar1 = (*g_wil_details_pfnNtQueryWnfStateData)(param_1,0,0,param_4,param_5,param_6); + return uVar1; +} + ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Function Meta |Key|post.dll| | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2| |length|709| |called|| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|4| |address|18000113c| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, uint param_3, uint param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -0,0 +1,173 @@ + +uint * wil_details_FeatureReporting_RecordUsageInCache + (uint *param_1,uint *param_2,uint param_3,uint param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint uVar5; + bool bVar6; + + param_1[0] = 0; + param_1[1] = 0; + param_1[2] = 0; + param_1[3] = 0; + param_1[4] = 0; + param_1[5] = 0; + uVar3 = 1; + if (param_3 == 0) { +LAB_180001327: + uVar4 = *param_2; + do { + uVar2 = uVar4; + param_1[1] = 0; + uVar1 = uVar2 | 1; + if ((uVar2 >> 0xe & 1) != (uint)(param_3 == 4)) { + uVar4 = uVar2 >> 5 & 0x1ff; + if (uVar4 != 0) { + param_1[1] = uVar4; + param_1[2] = ~-(uint)(param_3 != 0) & 4; + uVar1 = uVar2 & 0xffffc01f | 1; + } + uVar4 = 0; + if (param_3 == 4) { + uVar4 = 0x4000; + } + uVar1 = uVar4 | uVar1 & 0xffffbfff; + } + uVar4 = uVar1 >> 5 & 0x1ff; + uVar5 = uVar4 + 1; + if ((0x1ff < uVar5) || (uVar5 < (uVar1 >> 5 & 0x1ff))) { + param_1[2] = param_3; + param_1[1] = uVar4; + uVar5 = uVar3; + } + LOCK(); + uVar4 = *param_2; + bVar6 = uVar2 == uVar4; + if (bVar6) { + *param_2 = uVar1 ^ (uVar5 << 5 ^ uVar1) & 0x3fe0; + uVar4 = uVar2; + } + UNLOCK(); + } while (!bVar6); + } + else { + if (param_3 != 1) { + if ((int)param_3 < 2) { +LAB_180001218: + uVar4 = param_3 - 0x140; + if (uVar4 < 0x40) { + uVar1 = param_2[1]; + do { + if (((uVar1 & 0x10) == 0) || (uVar2 = uVar3, (uVar1 >> 5 & 0x3f) != uVar4)) { + uVar2 = 0; + } + param_1[4] = uVar2; + LOCK(); + uVar2 = param_2[1]; + bVar6 = uVar1 == uVar2; + if (bVar6) { + param_2[1] = uVar1 & 0xfffff81f | (uVar4 & 0x3f) << 5 | 0x10; + uVar2 = uVar1; + } + uVar1 = uVar2; + UNLOCK(); + } while (!bVar6); + } + param_1[2] = param_3; + param_1[1] = 1; + param_1[3] = param_4; + return param_1; + } + if ((int)param_3 < 4) { +LAB_1800011a7: + uVar4 = 0; + if (param_3 == 2) { + uVar4 = 2; + } + else if (param_3 == 3) { + uVar4 = 8; + } + else if (param_3 == 6) { + uVar4 = 4; + } + else if (param_3 == 7) { + uVar4 = 0x10; + } + uVar1 = *param_2; + do { + uVar5 = uVar1; + uVar1 = uVar4 | uVar5; + param_1[4] = (uint)(uVar1 == uVar5); + uVar2 = uVar1 | 1; + if (uVar1 == uVar5) { + uVar2 = uVar1; + } + LOCK(); + uVar1 = *param_2; + bVar6 = uVar5 == uVar1; + if (bVar6) { + *param_2 = uVar2; + uVar1 = uVar5; + } + UNLOCK(); + } while (!bVar6); + if (((uVar2 & 1) == 0) || ((uVar5 & 1) != 0)) { + uVar3 = 0; + } + *param_1 = uVar3; + return param_1; + } + if (param_3 == 4) goto LAB_180001327; + if (param_3 != 5) { + if (1 < param_3 - 6) goto LAB_180001218; + goto LAB_1800011a7; + } + } + uVar4 = *param_2; + do { + uVar2 = uVar4; + param_1[1] = 0; + uVar1 = uVar2 | 1; + if ((uVar2 >> 0x16 & 1) != (uint)(param_3 == 5)) { + uVar4 = uVar2 >> 0xf & 0x7f; + if (uVar4 != 0) { + param_1[1] = uVar4; + uVar4 = uVar3; + if (param_3 == 1) { + uVar4 = 5; + } + uVar1 = uVar2 & 0xffc07fff | 1; + param_1[2] = uVar4; + } + uVar4 = 0; + if (param_3 == 5) { + uVar4 = 0x400000; + } + uVar1 = uVar4 | uVar1 & 0xffbfffff; + } + uVar4 = uVar1 >> 0xf & 0x7f; + uVar5 = uVar4 + 1; + if ((0x7f < uVar5) || (uVar5 < (uVar1 >> 0xf & 0x7f))) { + param_1[2] = param_3; + param_1[1] = uVar4; + uVar5 = uVar3; + } + LOCK(); + uVar4 = *param_2; + bVar6 = uVar2 == uVar4; + if (bVar6) { + *param_2 = uVar1 ^ (uVar5 << 0xf ^ uVar1) & 0x3f8000; + uVar4 = uVar2; + } + UNLOCK(); + } while (!bVar6); + } + param_1[4] = 0; + *param_1 = ~uVar2 & 1; + return param_1; +} + ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Function Meta |Key|post.dll| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2| |length|313| |called|KERNEL32.DLL::GetModuleHandleW
KERNEL32.DLL::GetProcAddress
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3| |address|180001408| |sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, uint param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -0,0 +1,57 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* WARNING: Exceeded maximum restarts with more pending */ + +bool wil_details_FeatureReporting_ReportUsageToServiceDirect + (undefined8 param_1,undefined8 param_2,uint param_3) + +{ + uint6 uVar1; + uint *puVar2; + undefined1 auStack_88 [32]; + uint *local_68; + undefined8 local_58; + uint local_50 [6]; + uint local_38; + uint uStack_34; + uint uStack_30; + uint uStack_2c; + undefined8 local_28; + ulonglong local_20; + + local_20 = __security_cookie ^ (ulonglong)auStack_88; + puVar2 = wil_details_FeatureReporting_RecordUsageInCache + (local_50,(uint *)&Feature_1481456953__private_reporting,param_3, + (uint)((ulonglong)param_2 >> 0x20)); + local_38 = *puVar2; + uStack_34 = puVar2[1]; + uStack_30 = puVar2[2]; + uStack_2c = puVar2[3]; + local_28 = *(undefined8 *)(puVar2 + 4); + if (g_wil_details_recordFeatureUsage != 0) { + local_68 = &local_38; + (*(code *)g_wil_details_recordFeatureUsage) + (0x3134d08,param_3,1,&Feature_1481456953__private_reporting); + } + if ((((uint)param_2 >> 10 & 1) != 0) && (param_3 != 0xfe)) { + local_58._0_6_ = CONCAT24((short)param_3,0x3134d08); + uVar1 = (uint6)local_58; + local_58 = (ulonglong)(uint6)local_58; + if (((uint)param_2 >> 0xb & 1) != 0) { + local_58 = CONCAT26(1,uVar1); + } + if (g_wil_details_pfnRtlNotifyFeatureUsage == (FARPROC)0x0) { + if (g_wil_details_ntdllModuleHandle == (HMODULE)0x0) { + g_wil_details_ntdllModuleHandle = GetModuleHandleW(L"ntdll.dll"); + } + g_wil_details_pfnRtlNotifyFeatureUsage = + GetProcAddress(g_wil_details_ntdllModuleHandle,"RtlNotifyFeatureUsage"); + if (g_wil_details_pfnRtlNotifyFeatureUsage == (FARPROC)0x0) goto LAB_180001517; + } + (*g_wil_details_pfnRtlNotifyFeatureUsage)(&local_58); + } +LAB_180001517: + return (int)local_28 == 0; +} + ``` ## wil_details_FeatureReporting_ReportUsageToService ### Function Meta |Key|post.dll| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService| |refcount|2| |length|276| |called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect| |calling|wil_details_IsEnabledFallback| |paramcount|3| |address|180001548| |sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, ulonglong param_2, uint param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -0,0 +1,65 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +void wil_details_FeatureReporting_ReportUsageToService + (undefined8 param_1,ulonglong param_2,uint param_3) + +{ + bool bVar1; + undefined7 extraout_var; + uint uVar2; + uint uVar4; + byte bVar5; + uint local_res18 [4]; + ulonglong uVar3; + + uVar4 = (uint)param_2 & 1; + uVar3 = (ulonglong)param_3; + if (param_3 != 0) { + if (param_3 == 1) { + uVar2 = (uVar4 ^ 1) << 2; + uVar3 = 0; + goto LAB_18000160b; + } + if (param_3 == 2) { + uVar2 = (uVar4 ^ 1) * 4 + 1; + uVar3 = 0; + goto LAB_18000160b; + } + if (param_3 == 3) { + uVar2 = (uVar4 ^ 1) * 4 + 2; + uVar3 = 0; + goto LAB_18000160b; + } + if (param_3 == 4) { + uVar2 = (uVar4 ^ 1) * 4 + 3; + uVar3 = 0; + goto LAB_18000160b; + } + uVar2 = param_3 - 5; + uVar3 = (ulonglong)uVar2; + if (uVar2 == 0) { + uVar2 = (uVar4 ^ 1) * 2 + 8; + goto LAB_18000160b; + } + if (uVar2 == 1) { + uVar2 = (uVar4 ^ 1) * 2 + 9; + goto LAB_18000160b; + } + bVar5 = (char)param_3 + 0x9c; + if (bVar5 < 0x32) { + uVar2 = (-(uint)((param_2 & 1) != 0) & 0xffffffce) + 0x96 + (uint)bVar5; + goto LAB_18000160b; + } + } + uVar2 = 0xff; +LAB_18000160b: + local_res18[0] = param_3; + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,uVar2); + if (((int)CONCAT71(extraout_var,bVar1) != 0) && (g_wil_details_pfnFeatureLoggingHook != 0)) { + (*(code *)g_wil_details_pfnFeatureLoggingHook) + (0x3134d08,&Feature_1481456953_logged_traits,0,uVar4,local_res18,0,0,1); + } + return; +} + ``` ## wil_details_GetCurrentFeatureEnabledState ### Function Meta |Key|post.dll| | :---: | :---: | |name|wil_details_GetCurrentFeatureEnabledState| |fullname|wil_details_GetCurrentFeatureEnabledState| |refcount|2| |length|642| |called|KERNEL32.DLL::GetModuleHandleW
KERNEL32.DLL::GetProcAddress
KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapFree
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_StagingConfig_Load
wil_details_StagingConfig_QueryFeatureState| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |paramcount|3| |address|180001664| |sig|ulonglong __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2, undefined1 * param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_GetCurrentFeatureEnabledState +++ wil_details_GetCurrentFeatureEnabledState @@ -0,0 +1,130 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Exceeded maximum restarts with more pending */ + +ulonglong wil_details_GetCurrentFeatureEnabledState + (longlong param_1,undefined4 *param_2,undefined1 *param_3) + +{ + char cVar1; + int iVar2; + undefined8 *puVar3; + int iVar4; + undefined8 uVar5; + HANDLE hHeap; + ulonglong uVar6; + uint uVar7; + uint uVar8; + uint uVar9; + char *pcVar10; + uint uVar11; + undefined8 *puVar12; + undefined1 auStack_1d8 [48]; + ulonglong local_1a8; + uint local_1a0; + undefined4 uStack_19c; + undefined8 local_198; + undefined8 uStack_190; + undefined8 local_188; + undefined1 local_180 [8]; + undefined8 local_178 [7]; + LPVOID local_140; + int local_128; + undefined8 local_118; + undefined4 local_110; + char local_108 [208]; + ulonglong local_38; + + local_38 = __security_cookie ^ (ulonglong)auStack_1d8; + cVar1 = *(char *)(param_1 + 0x1c); + iVar2 = *(int *)(param_1 + 0x18); + local_198 = 0; + uStack_190 = 0; + *param_2 = 1; + local_188 = 0; + local_118 = 0; + uVar11 = (uint)((byte)(cVar1 - 2U) < 2); + local_110 = 0; + if (g_wil_details_pfnRtlQueryFeatureConfiguration == (FARPROC)0x0) { + if (g_wil_details_ntdllModuleHandle == (HMODULE)0x0) { + g_wil_details_ntdllModuleHandle = GetModuleHandleW(L"ntdll.dll"); + } + pcVar10 = "RtlQueryFeatureConfiguration"; + g_wil_details_pfnRtlQueryFeatureConfiguration = + GetProcAddress(g_wil_details_ntdllModuleHandle,"RtlQueryFeatureConfiguration"); + if (g_wil_details_pfnRtlQueryFeatureConfiguration == (FARPROC)0x0) { + iVar4 = -0x3ffffec7; + goto LAB_180001736; + } + } + pcVar10 = (char *)(ulonglong)(uVar11 ^ 1); + param_3 = local_180; + iVar4 = (*g_wil_details_pfnRtlQueryFeatureConfiguration)(iVar2,pcVar10,param_3,&local_118); +LAB_180001736: + if (iVar4 == 0) { + local_188 = CONCAT44(local_188._4_4_,local_118._4_4_ >> 7) & 0xffffffff00000001; + uVar9 = 1; + uVar11 = local_118._4_4_ >> 4 & 3; + uVar7 = local_118._4_4_ >> 6 & 1; + } + else { + if (iVar4 == 0x117) { + local_188 = CONCAT44(local_188._4_4_,local_118._4_4_ >> 7) & 0xffffffff00000001; + } + uVar9 = 0; + iVar4 = wil_details_StagingConfig_Load(local_178,pcVar10,param_3,local_108); + if (iVar4 == 0) { + uVar5 = wil_details_StagingConfig_QueryFeatureState + ((longlong)local_178,(uint *)&local_198,iVar2,uVar11); + uVar9 = (uint)uVar5; + if (local_128 != 0) { + hHeap = GetProcessHeap(); + HeapFree(hHeap,0,local_140); + } + } + uVar11 = (uint)local_198; + uVar7 = local_188._4_4_; + } + uVar9 = -(uint)(uVar9 != 0) & uVar11 & 3; + if (uVar9 == 0) { + uVar8 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40; + } + else { + uVar8 = 0; + if (uVar11 == 2) { + uVar8 = 0x40; + } + } + uVar11 = uVar8 >> 6; + uVar9 = uVar11 | (uVar9 | -(uint)(uVar7 != 0) & 0x10 | -(uint)((int)local_188 != 0) & 8) << 7 | + uVar8; + local_1a8 = (ulonglong)uVar9; + if ((uVar11 != 0) && (puVar12 = *(undefined8 **)(param_1 + 0x20), puVar12 != (undefined8 *)0x0)) { + for (; (uVar11 != 0 && (puVar3 = (undefined8 *)*puVar12, puVar3 != (undefined8 *)0x0)); + puVar12 = puVar12 + 1) { + if ((*(char *)((longlong)puVar3 + 0x1e) == '\0') && + (*(char *)((longlong)puVar3 + 0x1d) == '\0')) { + local_1a0 = *(uint *)*puVar3; + if ((local_1a0 & 2) == 0) { + uVar6 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*puVar3,CONCAT44(uStack_19c,local_1a0),(undefined1 *)puVar3); + local_1a0 = (uint)uVar6; + } + uVar11 = uVar9 & 0xfffffffe; + uVar9 = (uint)(((byte)local_1a0 & (byte)uVar9 & 1) != 0); + } + else { + if ((uVar11 == 0) || (uVar11 = 1, *(char *)((longlong)puVar3 + 0x1f) == '\0')) { + uVar11 = 0; + } + uVar9 = uVar9 & 0xfffffffe; + } + uVar9 = uVar9 | uVar11; + local_1a8 = CONCAT44(local_1a8._4_4_,uVar9); + uVar11 = uVar9 & 1; + } + } + return local_1a8; +} + ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|post.dll| | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3| |length|236| |called|_guard_dispatch_icall
wil_details_GetCurrentFeatureEnabledState| |calling|wil_details_GetCurrentFeatureEnabledState
wil_details_IsEnabledFallback| |paramcount|3| |address|1800018f0| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, undefined1 * param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -0,0 +1,65 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (uint *param_1,ulonglong param_2,undefined1 *param_3) + +{ + int iVar1; + ulonglong uVar2; + uint uVar3; + uint uVar4; + uint uVar5; + uint uVar6; + undefined1 *puVar7; + bool bVar8; + uint local_res8 [2]; + undefined8 local_res10; + + iVar1 = 0; + puVar7 = param_3; + local_res10 = param_2; + if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != 0) { + iVar1 = (*(code *)g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); + } + uVar2 = wil_details_GetCurrentFeatureEnabledState((longlong)param_3,local_res8,puVar7); + if (param_3[0x1c] == '\0') { + local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0); + } + while( true ) { + uVar6 = (uint)param_2; + local_res10 = CONCAT44(local_res10._4_4_,uVar6); + uVar3 = (uint)uVar2; + uVar5 = uVar6; + if ((local_res8[0] != 0) && ((param_2 & 2) == 0)) { + uVar4 = (uVar6 ^ uVar3) & 0x9c1 ^ uVar6; + uVar5 = uVar4 | 2; + local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 2; + } + if ((param_2 & 4) == 0) { + uVar4 = uVar5 ^ (uVar3 ^ uVar5) & 0x400; + uVar5 = uVar4 | 4; + local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 4; + } + LOCK(); + uVar4 = *param_1; + bVar8 = uVar6 == uVar4; + if (bVar8) { + *param_1 = uVar5; + uVar4 = uVar6; + } + UNLOCK(); + if (bVar8) break; + param_2 = (ulonglong)uVar4; + } + if (((param_2 & 4) == 0) && (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != 0)) + { + (*(code *)g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) + (param_1,param_3[0x1c],iVar1); + } + if (local_res8[0] == 0) { + local_res10 = CONCAT44(local_res10._4_4_,uVar5 ^ (uVar3 ^ uVar5) & 0x9c1); + } + return local_res10; +} + ``` ## wil_details_IsEnabledFallback ### Function Meta |Key|post.dll| | :---: | :---: | |name|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback| |refcount|3| |length|128| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |calling|Feature_1481456953__private_IsEnabledFallback| |paramcount|3| |address|1800019e4| |sig|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2, undefined8 param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -0,0 +1,26 @@ + +uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2,undefined8 param_3) + +{ + uint uVar1; + undefined4 *puVar2; + undefined8 local_res18; + + uVar1 = (uint)param_1; + local_res18 = CONCAT44((int)((ulonglong)param_3 >> 0x20),uVar1); + if (((ulonglong)param_1 & 2) == 0) { + puVar2 = &Feature_1481456953__private_featureState; + local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (&Feature_1481456953__private_featureState,(ulonglong)param_1, + (undefined1 *)&Feature_1481456953__private_descriptor); + param_1 = puVar2; + uVar1 = (uint)local_res18; + } + if ((param_2 != 0) && + (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), + param_2 - 3 < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); + } + return uVar1 & 1; +} + ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Function Meta |Key|post.dll| | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|1| |length|58| |called|| |calling|wil_details_IsEnabledFallback| |paramcount|2| |address|180001a6c| |sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -0,0 +1,40 @@ + +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + bool bVar4; + + uVar2 = Feature_1481456953__private_featureState; + if (param_2 == 3) { + uVar3 = 0x10; + } + else { + if (param_2 != 4) { + return; + } + uVar3 = 0x20; + } + while( true ) { + if ((uVar2 & 2) == 0) { + return; + } + if (((uVar2 ^ param_1) & 1) != 0) break; + LOCK(); + bVar4 = uVar2 != Feature_1481456953__private_featureState; + uVar1 = uVar2 | uVar3; + if (bVar4) { + uVar2 = Feature_1481456953__private_featureState; + uVar1 = Feature_1481456953__private_featureState; + } + Feature_1481456953__private_featureState = uVar1; + UNLOCK(); + if (!bVar4) { + return; + } + } + return; +} + ``` ## wil_details_StagingConfig_Load ### Function Meta |Key|post.dll| | :---: | :---: | |name|wil_details_StagingConfig_Load| |fullname|wil_details_StagingConfig_Load| |refcount|2| |length|747| |called|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapAlloc
KERNEL32.DLL::HeapFree
__security_check_cookie
memset
wil_details_NtQueryWnfStateData| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|4| |address|180001ab0| |sig|int __fastcall wil_details_StagingConfig_Load(undefined8 * param_1, undefined8 param_2, undefined8 param_3, char * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_StagingConfig_Load +++ wil_details_StagingConfig_Load @@ -0,0 +1,150 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +int wil_details_StagingConfig_Load + (undefined8 *param_1,undefined8 param_2,undefined8 param_3,char *param_4) + +{ + ushort uVar1; + int iVar2; + undefined8 uVar3; + HANDLE pvVar4; + char *pcVar5; + ulonglong uVar6; + char *lpMem; + undefined8 uVar7; + SIZE_T SVar8; + ulonglong uVar9; + ulonglong dwBytes; + char *lpMem_00; + undefined1 auStackY_98 [32]; + uint local_68; + int local_64; + char *local_60; + undefined8 local_58; + undefined8 local_50; + ulonglong local_48; + + local_48 = __security_cookie ^ (ulonglong)auStackY_98; + uVar3 = 0; + uVar7 = 0x50; + local_60 = param_4; + memset(param_1 + 1,0,0x50); + lpMem = (char *)0x0; + *param_1 = 0; + local_58 = 0x418a073aa3bc7c75; + dwBytes = -(ulonglong)(param_4 != (char *)0x0) & 200; + local_68 = -(uint)(param_4 != (char *)0x0) & 200; + uVar3 = wil_details_NtQueryWnfStateData(&local_58,uVar3,uVar7,param_1 + 1,param_4,&local_68); + iVar2 = (int)uVar3; + pcVar5 = lpMem; + lpMem_00 = lpMem; + if (iVar2 != 0) goto LAB_180001bee; + pcVar5 = local_60; + lpMem_00 = (char *)0x0; + if (local_60 != (char *)0x0) goto LAB_180001bee; + do { + if (dwBytes < 200) { + dwBytes = 200; + } + if (dwBytes < local_68) { + dwBytes = (ulonglong)local_68; + } + if (dwBytes < 0x10) { + dwBytes = 0x10; + } + if (lpMem != (char *)0x0) { + pvVar4 = GetProcessHeap(); + HeapFree(pvVar4,0,lpMem); + } + pvVar4 = GetProcessHeap(); + uVar3 = 0; + SVar8 = dwBytes; + pcVar5 = HeapAlloc(pvVar4,0,dwBytes); + if (pcVar5 == (char *)0x0) { + return -0x3fffff66; + } + local_68 = (uint)dwBytes; + uVar3 = wil_details_NtQueryWnfStateData(&local_58,uVar3,SVar8,param_1 + 1,pcVar5,&local_68); + iVar2 = (int)uVar3; + lpMem_00 = pcVar5; +LAB_180001bee: + lpMem = lpMem_00; + } while (iVar2 == -0x3fffffdd); + if ((iVar2 != 0) || (pcVar5 == (char *)0x0)) { + if (lpMem_00 == (char *)0x0) { + return iVar2; + } + pvVar4 = GetProcessHeap(); + HeapFree(pvVar4,0,lpMem_00); + return iVar2; + } + uVar9 = (ulonglong)local_68; + if (4 < local_68) { + *(char *)((longlong)param_1 + 0xc) = *pcVar5; + } + if (((0xf < local_68) && (*(char *)((longlong)param_1 + 0xc) == '\x02')) && + (0xf < *(ushort *)(pcVar5 + 2))) { + uVar6 = (ulonglong)*(ushort *)(pcVar5 + 6) * 0x10 + (ulonglong)*(ushort *)(pcVar5 + 4) * 0xc + + (ulonglong)*(ushort *)(pcVar5 + 2); + if (uVar6 <= uVar9) { + local_64 = 0; + iVar2 = 0; + if (*(ushort *)(pcVar5 + 4) != 0) { + local_50 = 0x418a073aa3bc8075; + local_60 = (char *)((ulonglong)local_60 & 0xffffffff00000000); + wil_details_NtQueryWnfStateData(&local_50,uVar6,uVar9,&local_64,0,&local_60); + uVar9 = (ulonglong)local_68; + iVar2 = local_64; + } + param_1[3] = pcVar5; + param_1[4] = pcVar5 + 0x10; + param_1[5] = pcVar5 + 0x10 + (ulonglong)*(ushort *)(pcVar5 + 4) * 0xc; + *(uint *)(param_1 + 6) = (uint)(iVar2 != 0); + if ((*pcVar5 == '\x02') && ((byte)pcVar5[1] < 2)) { + uVar9 = (ulonglong) + ((uint)*(ushort *)(pcVar5 + 6) * 0x10 + + ((uint)*(ushort *)(pcVar5 + 4) + (uint)*(ushort *)(pcVar5 + 4) * 2) * 4 + + (uint)*(ushort *)(pcVar5 + 2)); + *(undefined4 *)(param_1 + 2) = 1; + } + goto LAB_180001d2b; + } + } + pcVar5[0] = '\0'; + pcVar5[1] = '\0'; + pcVar5[2] = '\0'; + pcVar5[3] = '\0'; + pcVar5[4] = '\0'; + pcVar5[5] = '\0'; + pcVar5[6] = '\0'; + pcVar5[7] = '\0'; + pcVar5[8] = '\0'; + pcVar5[9] = '\0'; + pcVar5[10] = '\0'; + pcVar5[0xb] = '\0'; + pcVar5[0xc] = '\0'; + pcVar5[0xd] = '\0'; + pcVar5[0xe] = '\0'; + pcVar5[0xf] = '\0'; + pcVar5[0] = '\x02'; + pcVar5[1] = '\x02'; + pcVar5[2] = '\x10'; + pcVar5[3] = '\0'; + uVar9 = 0x10; + param_1[3] = pcVar5; + uVar1 = *(ushort *)(pcVar5 + 2); + param_1[4] = pcVar5 + uVar1; + param_1[5] = pcVar5 + uVar1 + (ulonglong)*(ushort *)(pcVar5 + 4) * 0xc; +LAB_180001d2b: + param_1[8] = uVar9; + uVar9 = 200; + if (lpMem_00 != (char *)0x0) { + uVar9 = dwBytes; + } + param_1[7] = pcVar5; + param_1[9] = uVar9; + *(uint *)(param_1 + 10) = (uint)(pcVar5 == lpMem_00); + return 0; +} + ``` ## wil_details_StagingConfig_QueryFeatureState ### Function Meta |Key|post.dll| | :---: | :---: | |name|wil_details_StagingConfig_QueryFeatureState| |fullname|wil_details_StagingConfig_QueryFeatureState| |refcount|2| |length|437| |called|| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|4| |address|180001da4| |sig|undefined8 __fastcall wil_details_StagingConfig_QueryFeatureState(longlong param_1, uint * param_2, int param_3, int param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_StagingConfig_QueryFeatureState +++ wil_details_StagingConfig_QueryFeatureState @@ -0,0 +1,109 @@ + +undefined8 +wil_details_StagingConfig_QueryFeatureState(longlong param_1,uint *param_2,int param_3,int param_4) + +{ + uint uVar1; + longlong lVar2; + longlong lVar3; + undefined8 uVar4; + uint uVar5; + int *piVar6; + ulonglong uVar7; + uint uVar8; + undefined8 uVar9; + undefined8 local_38; + uint local_30; + + lVar2 = *(longlong *)(param_1 + 0x18); + lVar3 = *(longlong *)(param_1 + 0x20); + uVar8 = 0; + uVar1 = 1; + uVar9 = 1; + uVar7 = 0; + if (*(ushort *)(lVar2 + 4) != 0) { + do { + if (*(int *)(lVar3 + uVar7 * 0xc) == param_3) { + if ((param_4 == 0) || (*(int *)(param_1 + 0x30) == 0)) { + local_38 = *(undefined8 *)(lVar3 + uVar7 * 0xc); + local_30 = *(uint *)(lVar3 + 8 + uVar7 * 0xc); + uVar8 = uVar1; + if ((*(byte *)(lVar3 + 4 + uVar7 * 0xc) & 1) != 0) break; + } + else if ((*(byte *)(lVar3 + 4 + uVar7 * 0xc) & 1) == 0) { + local_38 = *(undefined8 *)(lVar3 + uVar7 * 0xc); + local_30 = *(uint *)(lVar3 + 8 + uVar7 * 0xc); + goto LAB_180001e4a; + } + } + uVar5 = (int)uVar7 + 1; + uVar7 = (ulonglong)uVar5; + } while (uVar5 < *(ushort *)(lVar2 + 4)); + } + uVar4 = 0; + if (uVar8 != 0) { +LAB_180001e4a: + if ((param_4 == 0) || (lVar3 = 0xc, *(int *)(param_1 + 0x30) == 0)) { + lVar3 = 8; + } + uVar8 = *(uint *)(lVar3 + lVar2); + uVar5 = local_38._4_4_; + if ((uVar8 & 4) != 0) { + uVar5 = local_38._4_4_ & 0xffffcfff; + } + if ((uVar8 & 2) != 0) { + uVar5 = uVar5 & 0xfffff3ff; + } + if ((uVar8 & 1) != 0) { + uVar5 = uVar5 & 0xfffffcff; + } + if ((uVar8 & 8) != 0) { + uVar5 = uVar5 & 0xc0ffffff; + local_30 = 0; + } + if ((int)local_38 != 0) { + if (((((uVar5 >> 0xc | uVar5 >> 10 | uVar5 >> 8) & 3) != 0) || ((uVar5 & 0x3f000000) != 0)) || + ((uVar5 & 2) != 0)) { + param_2[3] = local_30; + param_2[2] = uVar5 >> 0x1e; + *(byte *)(param_2 + 1) = (byte)(uVar5 >> 0x18) & 0x3f; + param_2[5] = uVar5 >> 1 & 1; + uVar8 = uVar5 >> 0xc & 3; + uVar4 = uVar9; + if (uVar8 == 0) { + uVar8 = uVar5 >> 10 & 3; + if (uVar8 == 0) { + uVar8 = uVar5 >> 8 & 3; + if (uVar8 != 0) { + *param_2 = uVar8; + } + } + else { + *param_2 = uVar8; + } + } + else { + *param_2 = uVar8; + } + goto LAB_180001f11; + } + } + uVar4 = 0; + } +LAB_180001f11: + uVar5 = 0; + piVar6 = *(int **)(param_1 + 0x28); + uVar8 = 0; + if (*(ushort *)(lVar2 + 6) != 0) { + do { + uVar8 = uVar1; + if (*piVar6 == param_3) break; + uVar5 = uVar5 + 1; + piVar6 = piVar6 + 4; + uVar8 = 0; + } while (uVar5 < *(ushort *)(lVar2 + 6)); + } + param_2[4] = uVar8; + return uVar4; +} + ``` ## Feature_1481456953__private_IsEnabledDeviceUsage ### Function Meta |Key|post.dll| | :---: | :---: | |name|Feature_1481456953__private_IsEnabledDeviceUsage| |fullname|Feature_1481456953__private_IsEnabledDeviceUsage| |refcount|8| |length|33| |called|Feature_1481456953__private_IsEnabledFallback| |calling|DoFunc
GrowBuf| |paramcount|3| |address|180001f6c| |sig|uint __fastcall Feature_1481456953__private_IsEnabledDeviceUsage(undefined8 param_1, undefined8 param_2, undefined8 param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1481456953__private_IsEnabledDeviceUsage +++ Feature_1481456953__private_IsEnabledDeviceUsage @@ -0,0 +1,17 @@ + +uint Feature_1481456953__private_IsEnabledDeviceUsage + (undefined8 param_1,undefined8 param_2,undefined8 param_3) + +{ + uint uVar1; + undefined4 uStackX_c; + + if ((Feature_1481456953__private_featureState & 0x10) != 0) { + return Feature_1481456953__private_featureState & 1; + } + uVar1 = Feature_1481456953__private_IsEnabledFallback + ((undefined4 *)CONCAT44(uStackX_c,Feature_1481456953__private_featureState),3, + param_3); + return uVar1; +} + ``` # Modified *Modified functions contain code changes* ## GrowBuf ### Match Info |Key|pre.dll - post.dll| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.3| |i_ratio|0.6| |m_ratio|0.79| |b_ratio|0.74| |match_types|SymbolsHash| ### Function Meta Diff |Key|pre.dll|post.dll| | :---: | :---: | :---: | |name|GrowBuf|GrowBuf| |fullname|GrowBuf|GrowBuf| |`refcount`|4|5| |`length`|142|196| |`called`|ClientAllocReal
KERNEL32.DLL::LocalFree
memcpy|ClientAllocReal
Feature_1481456953__private_IsEnabledDeviceUsage
KERNEL32.DLL::LocalFree
memcpy| |calling|DoFunc|DoFunc| |paramcount|4|4| |`address`|1800027d8|1800036d8| |sig|undefined8 __fastcall GrowBuf(longlong * param_1, uint * param_2, ulonglong param_3, int param_4)|undefined8 __fastcall GrowBuf(longlong * param_1, uint * param_2, ulonglong param_3, int param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### GrowBuf Called Diff ```diff --- GrowBuf called +++ GrowBuf called @@ -1,0 +2 @@ +Feature_1481456953__private_IsEnabledDeviceUsage ``` ### GrowBuf Diff ```diff --- GrowBuf +++ GrowBuf @@ -1,28 +1,38 @@ undefined8 GrowBuf(longlong *param_1,uint *param_2,ulonglong param_3,int param_4) { uint uVar1; uint uVar2; void *_Dst; - undefined8 uVar3; + uint uVar3; + bool bVar4; - uVar2 = *param_2; - uVar1 = uVar2 + param_4; - do { - uVar2 = uVar2 * 2; - } while (uVar2 < uVar1); - _Dst = (void *)ClientAllocReal(uVar2); - uVar3 = 0; - if (_Dst != (void *)0x0) { - memcpy(_Dst,(void *)*param_1,param_3 & 0xffffffff); - if (*param_1 != 0) { - LocalFree(*(HLOCAL *)(*param_1 + -8)); + uVar2 = Feature_1481456953__private_IsEnabledDeviceUsage(param_1,param_2,param_3); + uVar1 = *param_2; + uVar3 = uVar1 * 2; + if (uVar2 == 0) { + for (; uVar3 < uVar1 + param_4; uVar3 = uVar3 * 2) { } - *param_1 = (longlong)_Dst; - uVar3 = 1; - *param_2 = uVar2; +LAB_0: + _Dst = (void *)ClientAllocReal(uVar3); + if (_Dst != (void *)0x0) { + memcpy(_Dst,(void *)*param_1,param_3 & 0xffffffff); + if (*param_1 != 0) { + LocalFree(*(HLOCAL *)(*param_1 + -8)); + } + *param_1 = (longlong)_Dst; + *param_2 = uVar3; + return 1; + } } - return uVar3; + else if ((uVar1 <= uVar3) && (uVar1 <= uVar1 + param_4)) { + do { + if (uVar1 + param_4 <= uVar3) goto LAB_0; + bVar4 = uVar3 <= uVar3 * 2; + uVar3 = uVar3 * 2; + } while (bVar4); + } + return 0; } ``` ## DoFunc ### Match Info |Key|pre.dll - post.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.15| |i_ratio|0.22| |m_ratio|0.87| |b_ratio|0.55| |match_types|SymbolsHash| ### Function Meta Diff |Key|pre.dll|post.dll| | :---: | :---: | :---: | |name|DoFunc|DoFunc| |fullname|DoFunc|DoFunc| |refcount|179|179| |`length`|2278|2960| |`called`|
Expand for full list:
AllocClientResources
DereferenceObject
FreeClientResources
GetTls
GrowBuf
IsBadDwordPtr
KERNEL32.DLL::ReleaseMutex
KERNEL32.DLL::TlsGetValue
KERNEL32.DLL::WaitForSingleObject
KERNEL32.DLL::lstrlenW
RPCRT4.DLL::NdrClientCall3ReferenceObject
TRACELogPrint
Tapi_IsBadReadPtrNoSeh
Tapi_IsBadWritePtrNoSeh
USER32.DLL::IsWindow
memcpy
|
Expand for full list:
AllocClientResources
DereferenceObject
Feature_1481456953__private_IsEnabledDeviceUsage
FreeClientResources
GetTls
GrowBuf
IsBadDwordPtr
KERNEL32.DLL::ReleaseMutex
KERNEL32.DLL::TlsGetValue
KERNEL32.DLL::WaitForSingleObject
KERNEL32.DLL::lstrlenWRPCRT4.DLL::NdrClientCall3
ReferenceObject
TRACELogPrint
Tapi_IsBadReadPtrNoSeh
Tapi_IsBadWritePtrNoSeh
USER32.DLL::IsWindow
memcpy
| |calling|
Expand for full list:
AsyncEventsThread
CLocation::NewID
LoadUIDll
MMCGetAvailableProviders
MMCGetDeviceFlags
MMCGetLineInfo
MMCGetPhoneInfo
MMCGetServerConfig
MMCSetLineInfo
MMCSetPhoneInfo
MMCSetServerConfigReadCountriesAndGroups
ReadLocations
TUISPIDLLCallback
UIThread
WriteLocations
internalPerformance
lineAccept
lineAddToConference
lineAgentSpecific
lineAnswer
lineBlindTransferW
lineClose
lineCompleteCall
lineCompleteTransfer
lineCreateAgentSessionW
lineCreateAgentW
lineDeallocateCall
lineDevSpecific
lineDevSpecificFeature
lineDialW
lineDrop
lineForwardA
lineForwardW
lineGatherDigitsA
lineGatherDigitsW
lineGenerateDigitsA
lineGenerateDigitsW
lineGenerateTone
lineGetAddressCapsW
lineGetAddressIDW
lineGetAddressStatusW
lineGetAgentActivityListA
lineGetAgentActivityListW
lineGetAgentCapsA
lineGetAgentCapsW
lineGetAgentGroupListA
lineGetAgentGroupListW
lineGetAgentInfo
lineGetAgentSessionInfo
lineGetAgentSessionList
lineGetAgentStatusA
lineGetAgentStatusW
lineGetAppPriorityA
lineGetAppPriorityW
lineGetCallInfoW
lineGetCallStatus
lineGetConfRelatedCalls
lineGetCountryW
lineGetDevCapsW
lineGetDevConfigA
lineGetDevConfigW
lineGetGroupListA
lineGetGroupListW
lineGetIDW
lineGetIconW
lineGetLineDevStatusA
lineGetLineDevStatusW
lineGetNewCalls
lineGetNumRings
lineGetProviderListW
lineGetProxyStatus
lineGetQueueInfo
lineGetQueueListA
lineGetQueueListW
lineGetRequestA
lineGetRequestW
lineGetStatusMessages
lineHandoffW
lineHold
lineMakeCallA
lineMakeCallW
lineMonitorDigits
lineMonitorMedia
lineMonitorTones
lineNegotiateAPIVersion
lineNegotiateExtVersion
lineOpenA
lineOpenW
lineParkA
lineParkW
linePickupW
linePrepareAddToConferenceA
linePrepareAddToConferenceW
lineProxyMessage
lineProxyResponse
lineRedirectW
lineRegisterRequestRecipient
lineReleaseUserUserInfo
lineRemoveFromConference
lineSecureCall
lineSendUserUserInfo
lineSetAgentActivity
lineSetAgentGroup
lineSetAgentMeasurementPeriod
lineSetAgentSessionState
lineSetAgentState
lineSetAgentStateEx
lineSetAppPriorityW
lineSetAppSpecific
lineSetCallData
lineSetCallParams
lineSetCallPrivilege
lineSetCallQualityOfService
lineSetCallTreatment
lineSetDevConfigW
lineSetLineDevStatus
lineSetMediaControl
lineSetMediaMode
lineSetNumRings
lineSetQueueMeasurementPeriod
lineSetStatusMessages
lineSetTerminal
lineSetupConferenceA
lineSetupConferenceW
lineSetupTransferA
lineSetupTransferW
lineSwapHold
lineUncompleteCall
lineUnhold
lineUnparkW
lineXxxProvider
phoneClose
phoneDevSpecific
phoneGetButtonInfoW
phoneGetData
phoneGetDevCapsW
phoneGetDisplay
phoneGetGain
phoneGetHookSwitch
phoneGetIDW
phoneGetIconW
phoneGetLamp
phoneGetRing
phoneGetStatusMessages
phoneGetStatusW
phoneGetVolume
phoneNegotiateAPIVersion
phoneNegotiateExtVersion
phoneOpen
phoneSetButtonInfoW
phoneSetData
phoneSetDisplay
phoneSetGain
phoneSetHookSwitch
phoneSetLamp
phoneSetRing
phoneSetStatusMessages
phoneSetVolume
tapiRequestDrop
tapiRequestMakeCallW
tapiRequestMediaCallW
xxxInitialize
xxxShutdown
|
Expand for full list:
AsyncEventsThread
CLocation::NewID
LoadUIDll
MMCGetAvailableProviders
MMCGetDeviceFlags
MMCGetLineInfo
MMCGetPhoneInfo
MMCGetServerConfig
MMCSetLineInfo
MMCSetPhoneInfo
MMCSetServerConfigReadCountriesAndGroups
ReadLocations
TUISPIDLLCallback
UIThread
WriteLocations
internalPerformance
lineAccept
lineAddToConference
lineAgentSpecific
lineAnswer
lineBlindTransferW
lineClose
lineCompleteCall
lineCompleteTransfer
lineCreateAgentSessionW
lineCreateAgentW
lineDeallocateCall
lineDevSpecific
lineDevSpecificFeature
lineDialW
lineDrop
lineForwardA
lineForwardW
lineGatherDigitsA
lineGatherDigitsW
lineGenerateDigitsA
lineGenerateDigitsW
lineGenerateTone
lineGetAddressCapsW
lineGetAddressIDW
lineGetAddressStatusW
lineGetAgentActivityListA
lineGetAgentActivityListW
lineGetAgentCapsA
lineGetAgentCapsW
lineGetAgentGroupListA
lineGetAgentGroupListW
lineGetAgentInfo
lineGetAgentSessionInfo
lineGetAgentSessionList
lineGetAgentStatusA
lineGetAgentStatusW
lineGetAppPriorityA
lineGetAppPriorityW
lineGetCallInfoW
lineGetCallStatus
lineGetConfRelatedCalls
lineGetCountryW
lineGetDevCapsW
lineGetDevConfigA
lineGetDevConfigW
lineGetGroupListA
lineGetGroupListW
lineGetIDW
lineGetIconW
lineGetLineDevStatusA
lineGetLineDevStatusW
lineGetNewCalls
lineGetNumRings
lineGetProviderListW
lineGetProxyStatus
lineGetQueueInfo
lineGetQueueListA
lineGetQueueListW
lineGetRequestA
lineGetRequestW
lineGetStatusMessages
lineHandoffW
lineHold
lineMakeCallA
lineMakeCallW
lineMonitorDigits
lineMonitorMedia
lineMonitorTones
lineNegotiateAPIVersion
lineNegotiateExtVersion
lineOpenA
lineOpenW
lineParkA
lineParkW
linePickupW
linePrepareAddToConferenceA
linePrepareAddToConferenceW
lineProxyMessage
lineProxyResponse
lineRedirectW
lineRegisterRequestRecipient
lineReleaseUserUserInfo
lineRemoveFromConference
lineSecureCall
lineSendUserUserInfo
lineSetAgentActivity
lineSetAgentGroup
lineSetAgentMeasurementPeriod
lineSetAgentSessionState
lineSetAgentState
lineSetAgentStateEx
lineSetAppPriorityW
lineSetAppSpecific
lineSetCallData
lineSetCallParams
lineSetCallPrivilege
lineSetCallQualityOfService
lineSetCallTreatment
lineSetDevConfigW
lineSetLineDevStatus
lineSetMediaControl
lineSetMediaMode
lineSetNumRings
lineSetQueueMeasurementPeriod
lineSetStatusMessages
lineSetTerminal
lineSetupConferenceA
lineSetupConferenceW
lineSetupTransferA
lineSetupTransferW
lineSwapHold
lineUncompleteCall
lineUnhold
lineUnparkW
lineXxxProvider
phoneClose
phoneDevSpecific
phoneGetButtonInfoW
phoneGetData
phoneGetDevCapsW
phoneGetDisplay
phoneGetGain
phoneGetHookSwitch
phoneGetIDW
phoneGetIconW
phoneGetLamp
phoneGetRing
phoneGetStatusMessages
phoneGetStatusW
phoneGetVolume
phoneNegotiateAPIVersion
phoneNegotiateExtVersion
phoneOpen
phoneSetButtonInfoW
phoneSetData
phoneSetDisplay
phoneSetGain
phoneSetHookSwitch
phoneSetLamp
phoneSetRing
phoneSetStatusMessages
phoneSetVolume
tapiRequestDrop
tapiRequestMakeCallW
tapiRequestMediaCallW
xxxInitialize
xxxShutdown
| |paramcount|4|4| |`address`|180002990|1800038c4| |`sig`|ulonglong __fastcall DoFunc(uint * param_1, undefined8 param_2, HWND param_3, wchar_t * param_4)|ulonglong __fastcall DoFunc(wchar_t * param_1, undefined8 param_2, HWND param_3, wchar_t * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DoFunc Called Diff ```diff --- DoFunc called +++ DoFunc called @@ -2,0 +3 @@ +Feature_1481456953__private_IsEnabledDeviceUsage ``` ### DoFunc Diff ```diff --- DoFunc +++ DoFunc @@ -1,385 +1,515 @@ /* WARNING: Restarted to delay deadcode elimination for space: register */ -ulonglong DoFunc(uint *param_1,undefined8 param_2,HWND param_3,wchar_t *param_4) +ulonglong DoFunc(wchar_t *param_1,undefined8 param_2,HWND param_3,wchar_t *param_4) { - uint *puVar1; - byte bVar2; - char cVar3; + byte bVar1; + char cVar2; + uint uVar3; longlong lVar4; bool bVar5; bool bVar6; - bool bVar7; - uint uVar8; - uint uVar9; - int iVar10; - BOOL BVar11; - longlong *plVar12; - undefined8 uVar13; - int *piVar14; - wchar_t *pwVar15; - int iVar16; - HWND pHVar17; - char *pcVar18; - undefined8 uVar19; + uint uVar7; + int iVar8; + BOOL BVar9; + uint uVar10; + uint uVar11; + uint uVar12; + uint uVar13; + uint uVar14; + longlong *plVar15; + undefined8 uVar16; + int *piVar17; + wchar_t *pwVar18; + ulonglong uVar19; + ulonglong uVar20; + HWND pHVar21; + uint *puVar22; + char *pcVar23; + undefined8 uVar24; + void *pvVar25; void *_Src; - ulonglong uVar20; - ulonglong uVar21; - ulonglong uVar22; - size_t _Size; - wchar_t *pwVar23; - ulonglong uVar24; - uint uVar25; - uint uVar26; + wchar_t *pwVar26; + ulonglong uVar27; + HWND pHVar28; + ulonglong uVar29; + ulonglong uVar30; + uint uVar31; + bool bVar32; uint local_res10; - uint local_res18; - uint local_90; - uint local_8c; - uint local_70; - HWND local_60; + uint local_ac; + uint local_84; + uint local_80; + HWND local_78; - uVar26 = *param_1 >> 4 & 3; - uVar21 = (ulonglong)uVar26; - uVar22 = 0x80000032; + uVar3 = *(uint *)param_1; + uVar31 = uVar3 >> 4 & 3; + uVar30 = (ulonglong)uVar31; + uVar27 = 0x80000032; + bVar5 = false; bVar6 = false; - bVar7 = false; - pwVar23 = param_4; - if (2 < uVar26) goto LAB_0; - pcVar18 = "DoFunc -- enter"; + pwVar26 = param_4; + if (2 < uVar31) goto LAB_0; + pcVar23 = "DoFunc -- enter"; TRACELogPrint(0x80002,"DoFunc -- enter",param_3,param_4); - uVar8 = AllocClientResources(uVar26,pcVar18,param_3,param_4); - uVar22 = (ulonglong)uVar8; - pwVar23 = param_4; - if (uVar8 != 0) goto LAB_0; - bVar7 = true; - plVar12 = GetTls(); - if (plVar12 == (longlong *)0x0) { + pHVar21 = (HWND)(ulonglong)uVar31; + uVar7 = AllocClientResources(uVar31,pcVar23,param_3,param_4); + uVar27 = (ulonglong)uVar7; + pwVar26 = param_4; + if (uVar7 != 0) goto LAB_0; + bVar6 = true; + plVar15 = GetTls(); + if (plVar15 == (longlong *)0x0) { LAB_1: - uVar22 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar21 * 4); - pwVar23 = param_4; + uVar27 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar30 * 4); + pwVar26 = param_4; } else { - uVar8 = *param_1; - uVar22 = 0x40; + uVar7 = *(uint *)param_1; + uVar13 = 0x40; + uVar11 = 0x40; + if ((uVar7 & 0x40) != 0) { + *(undefined4 *)(plVar15[2] + 8) = 0; + uVar7 = *(uint *)param_1; + } local_res10 = 0x40; - if ((uVar8 & 0x40) != 0) { - *(undefined4 *)(plVar12[2] + 8) = 0; - uVar8 = *param_1; - } - local_res18 = 0x40; - if (0xd < ((byte)uVar8 & 0xf)) { - pcVar18 = "More func args than MAX_TAPI_FUNC_ARGS in dofunc"; + if (0xd < ((byte)uVar7 & 0xf)) { + pcVar23 = "More func args than MAX_TAPI_FUNC_ARGS in dofunc"; LAB_2: - TRACELogPrint(0x10002,pcVar18,param_3,param_4); - uVar22 = (ulonglong)*(uint *)(&gaOpFailedErrors + uVar21 * 4); - pwVar23 = param_4; + TRACELogPrint(0x10002,pcVar23,param_3,param_1); + uVar27 = (ulonglong)*(uint *)(&gaOpFailedErrors + uVar30 * 4); + pwVar26 = param_1; goto LAB_0; } - param_4 = (wchar_t *)0x0; - uVar8 = uVar8 >> 6 & 1; - local_8c = local_70; + uVar27 = 0; + uVar29 = (ulonglong)(uVar7 >> 6) & 0xffffffff00000001; + local_ac = local_84; while( true ) { - uVar20 = (ulonglong)uVar8; - uVar25 = (uint)param_4; - uVar9 = *param_1 & 0xf; - if (uVar9 <= uVar25) break; - param_3 = *(HWND *)(param_1 + (longlong)param_4 * 2 + 2); - bVar2 = *(byte *)((longlong)(param_4 + 0x38) + (longlong)param_1); - pwVar23 = param_4; - if (bVar2 < 6) { - if (bVar2 == 5) { - if ((uVar25 == uVar9 - 1) || - (pwVar15 = (wchar_t *)(ulonglong)(uVar25 + 1), - *(char *)((longlong)(pwVar15 + 0x38) + (longlong)param_1) != '\t')) { - pcVar18 = "DoFunc: error, lpGet_SizeToFollow !followed by Size"; + uVar10 = (uint)uVar27; + uVar7 = *(uint *)param_1 & 0xf; + if (uVar7 <= uVar10) break; + param_3 = *(HWND *)(param_1 + uVar27 * 4 + 4); + bVar1 = *(byte *)(uVar27 + 0x70 + (longlong)param_1); + param_4 = param_1; + if (bVar1 < 6) { + if (bVar1 == 5) { + if ((uVar10 == uVar7 - 1) || + (uVar19 = (ulonglong)(uVar10 + 1), *(char *)(uVar19 + 0x70 + (longlong)param_1) != '\t' + )) { + pcVar23 = "DoFunc: error, lpGet_SizeToFollow !followed by Size"; goto LAB_2; } - uVar9 = param_1[(longlong)pwVar15 * 2 + 2]; + uVar7 = *(uint *)(param_1 + uVar19 * 4 + 4); LAB_3: - uVar13 = Tapi_IsBadWritePtrNoSeh((undefined1 *)param_3,(ulonglong)uVar9); - if ((int)uVar13 != 0) { - pcVar18 = "Bad get size/struct2 in dofunc"; + uVar20 = (ulonglong)uVar7; + uVar16 = Tapi_IsBadWritePtrNoSeh((undefined1 *)param_3,uVar20); + if ((int)uVar16 != 0) { + pcVar23 = "Bad get size/struct2 in dofunc"; LAB_4: - TRACELogPrint(0x10002,pcVar18,param_3,pwVar23); - uVar22 = (ulonglong)*(uint *)(&gaInvalPtrErrors + uVar21 * 4); - goto LAB_0; - } - if (bVar2 == 5) { - *(undefined4 *)(plVar12[2] + 8 + uVar20 * 4) = 0xffffffff; - uVar8 = uVar8 + 1; - *(uint *)(plVar12[2] + 8 + (ulonglong)uVar8 * 4) = param_1[(longlong)pwVar15 * 2 + 2]; - param_4 = pwVar15; + TRACELogPrint(0x10002,pcVar23,param_3,param_4); + uVar27 = (ulonglong)*(uint *)(&gaInvalPtrErrors + uVar30 * 4); + pwVar26 = param_4; + goto LAB_0; + } + pHVar21 = (HWND)plVar15[2]; + if (bVar1 == 5) { + pHVar21[uVar29 + 2].unused = -1; + uVar29 = (ulonglong)((int)uVar29 + 1); + pHVar21 = (HWND)plVar15[2]; + pHVar21[uVar29 + 2].unused = *(int *)(param_1 + uVar19 * 4 + 4); + uVar27 = uVar19; + param_4 = param_1; } else { - *(uint *)(plVar12[2] + 8 + uVar20 * 4) = uVar9; - } - local_res10 = local_res10 + (uVar9 + 7 & 0xfffffff8); - uVar22 = (ulonglong)local_res10; - bVar6 = true; - } - else if (bVar2 == 0) { - *(int *)(plVar12[2] + 8 + uVar20 * 4) = (int)param_3; -LAB_5: - uVar22 = (ulonglong)local_res10; - } - else if (bVar2 == 1) { - uVar13 = IsBadDwordPtr(¶m_3->unused); - bVar6 = true; - if ((int)uVar13 != 0) { - pcVar18 = "Bad lpdword in dofunc"; + pHVar21[uVar29 + 2].unused = uVar7; + } + bVar5 = true; + uVar10 = Feature_1481456953__private_IsEnabledDeviceUsage(pHVar21,uVar20,param_3); + uVar11 = uVar7 + 7; + if (uVar10 == 0) { + uVar11 = uVar13 + (uVar11 & 0xfffffff8); + uVar13 = uVar11; + } + else { + if (uVar11 < uVar7) { + uVar11 = 0xffffffff; + iVar8 = -0x7ff8fdea; + } + else { + iVar8 = 0; + uVar11 = uVar11 & 0xfffffff8; + } + if (iVar8 < 0) goto LAB_1; + uVar11 = uVar11 + uVar13; + pHVar21 = (HWND)(ulonglong)uVar11; + bVar32 = uVar11 < uVar13; + uVar13 = uVar11; + if (bVar32) goto LAB_1; + } + } + else if (bVar1 == 0) { + pHVar21 = (HWND)plVar15[2]; + pHVar21[uVar29 + 2].unused = (int)param_3; + } + else if (bVar1 == 1) { + pHVar21 = param_3; + uVar16 = IsBadDwordPtr(¶m_3->unused); + if ((int)uVar16 != 0) { + pcVar23 = "Bad lpdword in dofunc"; + param_3 = pHVar21; goto LAB_4; } -LAB_6: - uVar22 = (ulonglong)local_res10; - } - else if (bVar2 != 0) { - if (bVar2 < 4) { - if ((param_3 == (HWND)0x0) && (bVar2 == 3)) { - *(undefined4 *)(plVar12[2] + 8 + uVar20 * 4) = 0; - goto LAB_5; - } - piVar14 = ReferenceObject(uVar22,param_1[(longlong)param_4 * 2 + 2],0x494e4954); - if (piVar14 == (int *)0x0) { - *(undefined4 *)(plVar12[2] + 8 + uVar20 * 4) = 0xffffffff; + bVar5 = true; + pHVar21 = param_3; + } + else if (bVar1 != 0) { + if (bVar1 < 4) { + if ((param_3 == (HWND)0x0) && (bVar1 == 3)) { + *(undefined4 *)(plVar15[2] + 8 + uVar29 * 4) = 0; } else { - *(int *)(plVar12[2] + 8 + uVar20 * 4) = piVar14[6]; - DereferenceObject(uVar22,param_1[(longlong)param_4 * 2 + 2],1); - } - goto LAB_6; - } - if (bVar2 == 4) { - uVar9 = lstrlenW((LPCWSTR)param_3); - local_90 = uVar9 + 1; - if (local_90 < uVar9) { - local_90 = 0xffffffff; - uVar9 = 0x80070216; - } - else { - uVar9 = 0; - } - if ((int)uVar9 < 0) { - _Size = (size_t)local_8c; - } - else { - uVar22 = (ulonglong)local_90 * 2; - _Size = 0xffffffff; - if (uVar22 < 0x100000000) { - _Size = uVar22 & 0xffffffff; - } - local_8c = (uint)_Size; - uVar9 = -(uint)(0xffffffff < uVar22) & 0x80070216; - } - if (-1 < (int)uVar9) { - uVar9 = (uint)_Size + 7; - if (uVar9 < (uint)_Size) { - pwVar15 = (wchar_t *)0xffffffff; - iVar10 = -0x7ff8fdea; + piVar17 = ReferenceObject(pHVar21,*(uint *)(param_1 + uVar27 * 4 + 4),0x494e4954); + if (piVar17 == (int *)0x0) { + *(undefined4 *)(plVar15[2] + 8 + uVar29 * 4) = 0xffffffff; } else { - iVar10 = 0; - pwVar15 = (wchar_t *)(ulonglong)(uVar9 & 0xfffffff8); + *(int *)(plVar15[2] + 8 + uVar29 * 4) = piVar17[6]; + DereferenceObject(pHVar21,*(uint *)(param_1 + uVar27 * 4 + 4),1); } - if (-1 < iVar10) { - uVar9 = (uint)pwVar15; - if (uVar9 <= uVar9 + local_res18) { - if ((uVar9 + local_res18 <= *(uint *)(plVar12 + 3)) || - (uVar13 = GrowBuf(plVar12 + 2,(uint *)(plVar12 + 3),(ulonglong)local_res18, - uVar9), (int)uVar13 != 0)) { - memcpy((void *)((ulonglong)local_res18 + plVar12[2]),param_3,_Size); - *(uint *)(plVar12[2] + 8 + uVar20 * 4) = local_res18 - 0x3c; - local_res18 = local_res18 + uVar9; - local_res10 = local_res10 + uVar9; - uVar22 = (ulonglong)local_res10; - goto LAB_7; + } + } + else if (bVar1 == 4) { + pwVar18 = param_1; + uVar7 = lstrlenW((LPCWSTR)param_3); + uVar19 = (ulonglong)(uVar7 + 1); + if (uVar7 + 1 < uVar7) { + uVar19 = 0xffffffff; + uVar7 = 0x80070216; + } + else { + uVar7 = 0; + } + if ((int)uVar7 < 0) { + uVar20 = (ulonglong)local_ac; + } + else { + uVar19 = uVar19 * 2; + uVar20 = 0xffffffff; + if (uVar19 < 0x100000000) { + uVar20 = uVar19 & 0xffffffff; + } + local_ac = (uint)uVar20; + uVar7 = -(uint)(0xffffffff < uVar19) & 0x80070216; + } + if (-1 < (int)uVar7) { + uVar7 = (uint)uVar20 + 7; + if (uVar7 < (uint)uVar20) { + pwVar26 = (wchar_t *)0xffffffff; + iVar8 = -0x7ff8fdea; + } + else { + iVar8 = 0; + pwVar26 = (wchar_t *)(ulonglong)(uVar7 & 0xfffffff8); + } + uVar11 = (uint)pwVar26; + if (-1 < iVar8) { + if (uVar11 <= uVar11 + local_res10) { + if (*(uint *)(plVar15 + 3) < uVar11 + local_res10) { + uVar16 = GrowBuf(plVar15 + 2,(uint *)(plVar15 + 3),(ulonglong)local_res10,uVar11 + ); + if ((int)uVar16 == 0) { + uVar27 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar30 * 4); + goto LAB_0; + } + uVar20 = (ulonglong)local_ac; + pwVar18 = pwVar26; } - uVar22 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar21 * 4); - pwVar23 = pwVar15; + pHVar21 = (HWND)((ulonglong)local_res10 + plVar15[2]); + memcpy(pHVar21,param_3,uVar20); + uVar7 = local_res10 - 0x3c; + *(uint *)(plVar15[2] + 8 + uVar29 * 4) = uVar7; + local_res10 = local_res10 + uVar11; + uVar7 = Feature_1481456953__private_IsEnabledDeviceUsage + (pHVar21,(ulonglong)uVar7,uVar20); + if ((uVar7 == 0) || (uVar13 <= uVar11 + uVar13)) { + uVar11 = uVar11 + uVar13; + uVar13 = uVar11; + goto LAB_5; + } + uVar27 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar30 * 4); + pwVar26 = pwVar18; goto LAB_0; } } } - uVar22 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar21 * 4); - goto LAB_0; - } - } - } - else if (bVar2 < 8) { - if (bVar2 == 6) { - if ((uVar25 == uVar9 - 1) || - (uVar22 = (ulonglong)(uVar25 + 1), *(char *)(uVar22 + 0x70 + (longlong)param_1) != '\t' + uVar27 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar30 * 4); + pwVar26 = pwVar18; + goto LAB_0; + } + } + } + else if (bVar1 < 8) { + if (bVar1 == 6) { + if ((uVar10 == uVar7 - 1) || + (uVar19 = (ulonglong)(uVar10 + 1), *(char *)(uVar19 + 0x70 + (longlong)param_1) != '\t' )) { - pcVar18 = "DoFunc: error, lpSet_SizeToFollow !followed by Size"; + pcVar23 = "DoFunc: error, lpSet_SizeToFollow !followed by Size"; goto LAB_2; } } else { - uVar22 = (ulonglong)(uVar25 + 1); - } - pHVar17 = param_3; - if (bVar2 == 6) { - pHVar17 = (HWND)(param_1 + (uVar22 + 1) * 2); - } - uVar9 = pHVar17->unused; - uVar22 = (ulonglong)uVar9; - pHVar17 = param_3; - uVar13 = Tapi_IsBadReadPtrNoSeh((ulonglong)param_3,uVar22); - if ((int)uVar13 != 0) { - TRACELogPrint(0x10002,"Bad set size/struct in dofunc",pHVar17,pwVar23); - uVar22 = (ulonglong)*(uint *)(&gaInvalPtrErrors + uVar21 * 4); + uVar19 = (ulonglong)(uVar10 + 1); + } + pHVar21 = param_3; + if (bVar1 == 6) { + pHVar21 = (HWND)(param_1 + (uVar19 + 1) * 4); + } + local_80 = pHVar21->unused; + uVar19 = (ulonglong)local_80; + pHVar21 = param_3; + pHVar28 = param_3; + uVar16 = Tapi_IsBadReadPtrNoSeh((ulonglong)param_3,uVar19); + if ((int)uVar16 != 0) { + TRACELogPrint(0x10002,"Bad set size/struct in dofunc",pHVar28,param_4); + uVar27 = (ulonglong)*(uint *)(&gaInvalPtrErrors + uVar30 * 4); + pwVar26 = param_4; goto LAB_0; } - pwVar23 = (wchar_t *)((ulonglong)(uVar9 + 7) & 0xfffffffffffffff8); - local_60 = param_3; - if ((bVar2 != 6) && (uVar9 < 4)) { - pwVar23 = (wchar_t *)0x4; - uVar22 = 4; - local_60 = (HWND)&DAT_8; - } - uVar24 = (ulonglong)local_res18; - iVar10 = (int)pwVar23; - if ((*(uint *)(plVar12 + 3) < iVar10 + local_res18) && - (uVar13 = GrowBuf(plVar12 + 2,(uint *)(plVar12 + 3),uVar24,iVar10), (int)uVar13 == 0)) { - TRACELogPrint(0x10002,"Nomem set size/struct in dofunc",uVar24,pwVar23); - uVar22 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar21 * 4); - goto LAB_0; - } - memcpy((void *)((ulonglong)local_res18 + plVar12[2]),local_60,uVar22); - if ((int)uVar22 == 0) { - iVar16 = -1; + uVar7 = Feature_1481456953__private_IsEnabledDeviceUsage(pHVar21,uVar19,pHVar28); + if (uVar7 != 0) { + if (local_80 + 7 < local_80) { + pwVar26 = (wchar_t *)0xffffffff; + iVar8 = -0x7ff8fdea; + } + else { + iVar8 = 0; + pwVar26 = (wchar_t *)((ulonglong)(local_80 + 7) & 0xfffffffffffffff8); + } + if (iVar8 < 0) { + uVar27 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar30 * 4); + pwVar26 = param_4; + goto LAB_0; + } } else { - iVar16 = local_res18 - 0x3c; - } - *(int *)(plVar12[2] + 8 + uVar20 * 4) = iVar16; - local_res18 = local_res18 + iVar10; - local_res10 = local_res10 + iVar10; - uVar22 = (ulonglong)local_res10; - if (bVar2 == 6) { - param_4 = (wchar_t *)(ulonglong)(uVar25 + 1); - uVar8 = uVar8 + 1; - *(uint *)(plVar12[2] + 8 + (ulonglong)uVar8 * 4) = param_1[(longlong)param_4 * 2 + 2]; - goto LAB_5; + pwVar26 = (wchar_t *)((ulonglong)(local_80 + 7) & 0xfffffff8); + } + local_78 = param_3; + if ((bVar1 != 6) && (local_80 < 4)) { + pwVar26 = (wchar_t *)0x4; + local_80 = 4; + local_78 = (HWND)&DAT_6; + } + uVar7 = Feature_1481456953__private_IsEnabledDeviceUsage + ((ulonglong)(uVar7 != 0),uVar19,pHVar28); + uVar19 = (ulonglong)local_res10; + uVar11 = (uint)pwVar26; + uVar12 = uVar11 + local_res10; + if (uVar7 == 0) { + if ((*(uint *)(plVar15 + 3) < uVar12) && + (uVar16 = GrowBuf(plVar15 + 2,(uint *)(plVar15 + 3),uVar19,uVar11), param_4 = pwVar26, + (int)uVar16 == 0)) { + TRACELogPrint(0x10002,"Nomem set size/struct in dofunc",uVar19,pwVar26); + uVar27 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar30 * 4); + goto LAB_0; + } + } + else { + if (uVar12 < uVar11) { + uVar27 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar30 * 4); + pwVar26 = param_4; + goto LAB_0; + } + if ((*(uint *)(plVar15 + 3) < uVar12) && + (uVar16 = GrowBuf(plVar15 + 2,(uint *)(plVar15 + 3),uVar19,uVar11), param_4 = pwVar26, + (int)uVar16 == 0)) { + TRACELogPrint(0x10002,"Nomem set size/struct in dofunc",uVar19,pwVar26); + uVar27 = (ulonglong)*(uint *)(&gaNoMemErrors + uVar30 * 4); + goto LAB_0; + } + } + uVar19 = (ulonglong)local_80; + pHVar21 = (HWND)((ulonglong)local_res10 + plVar15[2]); + memcpy(pHVar21,local_78,uVar19); + if (local_80 == 0) { + *(undefined4 *)(plVar15[2] + 8 + uVar29 * 4) = 0xffffffff; + } + else { + pHVar21 = (HWND)(ulonglong)(local_res10 - 0x3c); + *(uint *)(plVar15[2] + 8 + uVar29 * 4) = local_res10 - 0x3c; + } + local_res10 = local_res10 + uVar11; + uVar7 = Feature_1481456953__private_IsEnabledDeviceUsage(pHVar21,local_78,uVar19); + if ((uVar7 != 0) && (uVar11 + uVar13 < uVar13)) goto LAB_1; + uVar11 = uVar11 + uVar13; + uVar13 = uVar11; + if (bVar1 == 6) { + uVar27 = (ulonglong)(uVar10 + 1); + uVar29 = (ulonglong)((int)uVar29 + 1); + pHVar21 = (HWND)plVar15[2]; + pHVar21[uVar29 + 2].unused = *(int *)(param_1 + uVar27 * 4 + 4); } } else { - if (bVar2 == 8) { - uVar9 = param_3->unused; - pwVar15 = (wchar_t *)(ulonglong)(uVar25 + 1); + if (bVar1 == 8) { + uVar7 = param_3->unused; + uVar19 = (ulonglong)(uVar10 + 1); goto LAB_3; } - if (bVar2 == 10) { - BVar11 = IsWindow(param_3); - if (BVar11 != 0) { - *(undefined4 *)(plVar12[2] + 8 + uVar20 * 4) = 0; - goto LAB_6; - } - TRACELogPrint(0x10002,"Bad hWnd in dofunc",param_3,pwVar23); - uVar22 = (ulonglong)*(uint *)(&gaInvalHwndErrors + uVar21 * 4); - goto LAB_0; - } - } + if (bVar1 == 10) { + pHVar21 = param_3; + pwVar26 = param_1; + BVar9 = IsWindow(param_3); + if (BVar9 == 0) { + TRACELogPrint(0x10002,"Bad hWnd in dofunc",pHVar21,pwVar26); + uVar27 = (ulonglong)*(uint *)(&gaInvalHwndErrors + uVar30 * 4); + goto LAB_0; + } + *(undefined4 *)(plVar15[2] + 8 + uVar29 * 4) = 0; + pHVar21 = param_3; + } + } +LAB_5: + uVar27 = (ulonglong)((int)uVar27 + 1); + uVar29 = (ulonglong)((int)uVar29 + 1); + } + puVar22 = (uint *)(plVar15 + 3); + if (*puVar22 < uVar13) { + param_4 = (wchar_t *)(ulonglong)(uVar13 - *puVar22); + uVar16 = GrowBuf(plVar15 + 2,puVar22,(ulonglong)local_res10,uVar13 - *puVar22); + if ((int)uVar16 == 0) goto LAB_1; + } + *(uint *)plVar15[2] = (uint)(ushort)param_1[1]; + uVar30 = 0; + pwVar18 = TlsGetValue(gdwTlsIndexRpcCtx); + do { + pwVar26 = gphCx; + if (pwVar18 != (wchar_t *)0x0) { + pwVar26 = pwVar18; + } + uVar16 = 0; + NdrClientCall3((MIDL_STUBLESS_PROXY_INFO *)&PTR_PTR_18002f210,1,(void *)0x0); + uVar7 = *(uint *)plVar15[2]; + uVar27 = (ulonglong)uVar7; + if (uVar7 == 0xf101) { + uVar7 = (uint)uVar30; + uVar30 = (ulonglong)(uVar7 + 1); + if (gdwMaxNumRequestRetries <= uVar7) { + uVar27 = (ulonglong)*(uint *)(&gaOpFailedErrors + (ulonglong)uVar31 * 4); + goto LAB_7; + } + *(uint *)plVar15[2] = (uint)(ushort)param_1[1]; + bVar32 = true; + } + else { LAB_7: - param_4 = (wchar_t *)(ulonglong)((int)param_4 + 1); - uVar8 = uVar8 + 1; - } - puVar1 = (uint *)(plVar12 + 3); - if (*puVar1 < (uint)uVar22) { - uVar8 = (uint)uVar22 - *puVar1; - param_4 = (wchar_t *)(ulonglong)uVar8; - uVar13 = GrowBuf(plVar12 + 2,puVar1,(ulonglong)local_res18,uVar8); - if ((int)uVar13 == 0) goto LAB_1; - } - *(uint *)plVar12[2] = (uint)*(ushort *)((longlong)param_1 + 2); - uVar21 = 0; - pwVar15 = TlsGetValue(gdwTlsIndexRpcCtx); - do { - pwVar23 = gphCx; - if (pwVar15 != (wchar_t *)0x0) { - pwVar23 = pwVar15; - } - uVar13 = 0; - NdrClientCall3((MIDL_STUBLESS_PROXY_INFO *)&PTR_PTR_18002e210,1,(void *)0x0); - uVar8 = *(uint *)plVar12[2]; - uVar22 = (ulonglong)uVar8; - if (uVar8 == 0xf101) { - uVar8 = (uint)uVar21; - uVar21 = (ulonglong)(uVar8 + 1); - if (gdwMaxNumRequestRetries <= uVar8) { - uVar22 = (ulonglong)*(uint *)(&gaOpFailedErrors + (ulonglong)uVar26 * 4); - goto LAB_9; - } - *(uint *)plVar12[2] = (uint)*(ushort *)((longlong)param_1 + 2); - bVar5 = true; - } - else { -LAB_9: - bVar5 = false; - uVar21 = 0; - } - if (bVar5) { - TRACELogPrint(0x80002,"AllocClientResources: enter",uVar13,pwVar23); - uVar19 = 0xffffffff; + bVar32 = false; + uVar30 = 0; + } + if (bVar32) { + TRACELogPrint(0x80002,"AllocClientResources: enter",uVar16,pwVar26); + uVar24 = 0xffffffff; WaitForSingleObject(ghInitMutex,0xffffffff); - iVar10 = gdwRpcRefCount; + iVar8 = gdwRpcRefCount; if (gdwRpcRefCount == 0) { ReleaseMutex(ghInitMutex); } else { gdwRpcRefCount = 1; FreeClientResources(); - uVar8 = AllocClientResources(uVar26,uVar19,uVar13,pwVar23); + uVar7 = AllocClientResources(uVar31,uVar24,uVar16,pwVar26); gdwRpcRefCount = 0; - if (uVar8 == 0) { - gdwRpcRefCount = iVar10; + if (uVar7 == 0) { + gdwRpcRefCount = iVar8; } ReleaseMutex(ghInitMutex); - if (uVar8 == 0) goto LAB_10; - } - TRACELogPrint(0x10002,"DoFunc: ReAllocClientResources failed",uVar13,pwVar23); - uVar22 = (ulonglong)*(uint *)(&gaOpFailedErrors + (ulonglong)uVar26 * 4); - uVar21 = 0; - bVar7 = false; - } -LAB_10: - } while ((int)uVar21 != 0); - TRACELogPrint(0x80002,"DoFunc: back from srv- return code=0x%08lx",uVar22,pwVar23); - if (((int)uVar22 == 0) && (bVar6)) { - uVar20 = 0; - for (; uVar26 = (uint)uVar21, uVar26 < (*param_1 & 0xf); uVar21 = (ulonglong)((int)uVar21 + 1) - ) { - lVar4 = plVar12[2]; - cVar3 = *(char *)(uVar21 + 0x70 + (longlong)param_1); - if (cVar3 == '\x01') { - **(undefined4 **)(param_1 + uVar21 * 2 + 2) = *(undefined4 *)(lVar4 + 8 + uVar20 * 4); - } - else if (cVar3 == '\x05') { - uVar8 = (int)uVar20 + 1; - memcpy(*(void **)(param_1 + uVar21 * 2 + 2), - (void *)(lVar4 + 0x3c + (ulonglong)*(uint *)(lVar4 + 8 + uVar20 * 4)), - (ulonglong)*(uint *)(lVar4 + 8 + (ulonglong)uVar8 * 4)); - uVar21 = (ulonglong)(uVar26 + 1); - uVar20 = (ulonglong)uVar8; - } - else if (cVar3 == '\x06') { - uVar21 = (ulonglong)(uVar26 + 1); - uVar20 = (ulonglong)((int)uVar20 + 1); - } - else if ((cVar3 == '\b') && (*(int *)(lVar4 + 8 + uVar20 * 4) != -1)) { - _Src = (void *)(lVar4 + 0x3c + (ulonglong)*(uint *)(lVar4 + 8 + uVar20 * 4)); - memcpy(*(void **)(param_1 + uVar21 * 2 + 2),_Src,(ulonglong)*(uint *)((longlong)_Src + 8)) - ; - } - uVar20 = (ulonglong)((int)uVar20 + 1); + if (uVar7 == 0) goto LAB_8; + } + TRACELogPrint(0x10002,"DoFunc: ReAllocClientResources failed",uVar16,pwVar26); + uVar27 = (ulonglong)*(uint *)(&gaOpFailedErrors + (ulonglong)uVar31 * 4); + uVar30 = 0; + bVar6 = false; + } +LAB_8: + } while ((int)uVar30 != 0); + uVar29 = uVar27; + TRACELogPrint(0x80002,"DoFunc: back from srv- return code=0x%08lx",uVar27,pwVar26); + if (((int)uVar27 == 0) && (bVar5)) { + uVar19 = 0; + for (; uVar7 = (uint)uVar30, uVar7 < (*(uint *)param_1 & 0xf); + uVar30 = (ulonglong)((int)uVar30 + 1)) { + lVar4 = plVar15[2]; + cVar2 = *(char *)((longlong)param_1 + uVar30 + 0x70); + if (cVar2 == '\x01') { + **(undefined4 **)(param_1 + uVar30 * 4 + 4) = *(undefined4 *)(lVar4 + 8 + uVar19 * 4); + } + else if (cVar2 == '\x05') { + uVar12 = Feature_1481456953__private_IsEnabledDeviceUsage(0,param_1,uVar29); + uVar14 = (int)uVar19 + 1; + uVar13 = *(uint *)(lVar4 + 8 + (ulonglong)uVar14 * 4); + uVar29 = (ulonglong)uVar13; + uVar10 = *(uint *)(lVar4 + 8 + uVar19 * 4); + if (uVar12 == 0) { + _Src = (void *)(plVar15[2] + 0x3c + (ulonglong)uVar10); + pvVar25 = *(void **)(param_1 + uVar30 * 4 + 4); + } + else { + uVar10 = uVar10 + 0x3c; + if ((((uVar10 < 0x3c) || (uVar13 + uVar10 < uVar10)) || (uVar11 < uVar13 + uVar10)) || + (pwVar26 = param_1, *(uint *)(param_1 + (ulonglong)(uVar7 + 1) * 4 + 4) < uVar13)) { + uVar27 = (ulonglong) + *(uint *)(&gaInvalPtrErrors + + ((ulonglong)(uVar3 >> 4) & 0xffffffff00000003) * 4); + break; + } + _Src = (void *)((ulonglong)uVar10 + plVar15[2]); + pvVar25 = *(void **)(param_1 + uVar30 * 4 + 4); + } + memcpy(pvVar25,_Src,uVar29); + uVar30 = (ulonglong)(uVar7 + 1); + uVar19 = (ulonglong)uVar14; + } + else if (cVar2 == '\x06') { + uVar30 = (ulonglong)(uVar7 + 1); + uVar19 = (ulonglong)((int)uVar19 + 1); + } + else if ((cVar2 == '\b') && (*(int *)(lVar4 + 8 + uVar19 * 4) != -1)) { + uVar13 = Feature_1481456953__private_IsEnabledDeviceUsage(0xffffffff,param_1,uVar29); + uVar7 = *(uint *)(lVar4 + 8 + uVar19 * 4); + if (uVar13 == 0) { + pvVar25 = (void *)((ulonglong)uVar7 + plVar15[2] + 0x3c); + uVar7 = *(uint *)((longlong)pvVar25 + 8); + puVar22 = *(uint **)(param_1 + uVar30 * 4 + 4); + } + else { + uVar13 = uVar7 + 0x3c; + if (((uVar13 < 0x3c) || (uVar7 + 0x48 < uVar13)) || (uVar11 < uVar7 + 0x48)) { + uVar27 = (ulonglong)*(uint *)(&gaInvalPtrErrors + (ulonglong)uVar31 * 4); + break; + } + pvVar25 = (void *)((ulonglong)uVar13 + plVar15[2]); + uVar7 = *(uint *)((longlong)pvVar25 + 8); + uVar10 = uVar7 + uVar13; + pwVar26 = (wchar_t *)(ulonglong)uVar10; + if (((uVar10 < uVar13) || (uVar11 < uVar10)) || + (puVar22 = *(uint **)(param_1 + uVar30 * 4 + 4), *puVar22 < uVar7)) { + uVar27 = (ulonglong)*(uint *)(&gaInvalPtrErrors + (ulonglong)uVar31 * 4); + break; + } + } + uVar29 = (ulonglong)uVar7; + memcpy(puVar22,pvVar25,uVar29); + } + uVar19 = (ulonglong)((int)uVar19 + 1); } } } LAB_0: - if (bVar7) { + if (bVar6) { FreeClientResources(); } - TRACELogPrint(0x80002,"DoFunc: result = x%x",uVar22,pwVar23); - return uVar22; + TRACELogPrint(0x80002,"DoFunc: result = x%x",uVar27,pwVar26); + return uVar27; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|pre.dll - post.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pre.dll|post.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|98|101| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|18002d488|18002e678| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## KERNEL32.DLL::HeapAlloc ### Match Info |Key|pre.dll - post.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|pre.dll|post.dll| | :---: | :---: | :---: | |name|HeapAlloc|HeapAlloc| |fullname|KERNEL32.DLL::HeapAlloc|KERNEL32.DLL::HeapAlloc| |`refcount`|3|4| |length|0|0| |called||| |`calling`|CreateHandleTable
GrowTable|CreateHandleTable
GrowTable
wil_details_StagingConfig_Load| |paramcount|3|3| |`address`|EXTERNAL:0000004c|EXTERNAL:00000080| |sig|LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes)|LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::HeapAlloc Calling Diff ```diff --- KERNEL32.DLL::HeapAlloc calling +++ KERNEL32.DLL::HeapAlloc calling @@ -2,0 +3 @@ +wil_details_StagingConfig_Load ``` ## TRACELogPrint ### Match Info |Key|pre.dll - post.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.73| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pre.dll|post.dll| | :---: | :---: | :---: | |name|TRACELogPrint|TRACELogPrint| |fullname|TRACELogPrint|TRACELogPrint| |`refcount`|297|298| |length|416|416| |called|KERNEL32.DLL::GetCurrentThreadId
KERNEL32.DLL::GetLocalTime
KERNEL32.DLL::OutputDebugStringA
KERNEL32.DLL::lstrlenA
RTUTILS.DLL::TraceVprintfExA
StringCbCatA
StringCbPrintfA
StringCbVPrintfA
TraceLevel
__security_check_cookie|KERNEL32.DLL::GetCurrentThreadId
KERNEL32.DLL::GetLocalTime
KERNEL32.DLL::OutputDebugStringA
KERNEL32.DLL::lstrlenA
RTUTILS.DLL::TraceVprintfExA
StringCbCatA
StringCbPrintfA
StringCbVPrintfA
TraceLevel
__security_check_cookie| |calling|
Expand for full list:
AddProvider
AllocClientResources
AsyncEventsThread
BreakupCanonicalW
ClientAllocStringReal
CreateCountryObject
CreateCurrentLocationObject
CreateDialingRule
CreateHiddenWindow
DoFunc
EnsureTapiServiceFillAddDriverList
FillDriverList
GetDescriptionForRule
GetFunctionIndex
GetProviderFileDesc
GetTapi16CallbackMsg
GetTranslateCapsCommon
IsLeastCostRoutingEnabled
IsUserAdmin
LoadUIDll
LocWizardDlgProc
MIDL_user_allocate
MIDL_user_free
MMCInitialize
PopulateStepList
ReadCountriesAndGroups
ReadLocations
RemoveSelectedDriver
SetupDriver
TAPIWndProc
UIThread
UpdateDriverDlgButtons
UpdateSampleString
ValidateXxxInitializeParams
VerifyProcExists
WideStringToNotSoWideString
internalNewLocationW
internalRemoveLocation
internalRenameLocationW
lineAddProviderA
lineAddProviderW
lineBlindTransferA
lineBlindTransferW
lineCompleteCallPostProcess
lineConfigDialogEditW
lineConfigDialogW
lineDeallocateCall
lineDevSpecificPostProcess
lineDialA
lineDialW
lineGatherDigitsPostProcess
lineGatherDigitsWPostProcess
lineGetAddressIDA
lineGetAddressStatusA
lineGetAgentActivityListAPostProcess
lineGetAgentCapsAPostProcess
lineGetAgentGroupListAPostProcess
lineGetAgentStatusAPostProcess
lineGetAppPriorityA
lineGetAppPriorityW
lineGetCountry
lineGetCountryW
lineGetIDA
lineGetIDW
lineGetIconW
lineGetQueueListAPostProcess
lineGetTranslateCapsA
lineGetTranslateCapsW
lineInitializeExW
lineMakeCallA
lineMakeCallPostProcess
lineParkAPostProcess
lineSetCurrentLocation
lineSetTollListA
lineSetTollListW
lineSetupConferencePostProcess
lineTranslateAddressA
lineTranslateAddressW
lineTranslateDialogA
lineTranslateDialogW
lineXxxProvider
phoneConfigDialogW
phoneDevSpecificPostProcess
phoneGetIDA
phoneGetIDW
phoneGetIconW
phoneInitializeExW
phoneSetButtonInfoA
tapiGetLocationInfoA
tapiGetLocationInfoW
tapiRequestMakeCallW
xxxGetMessage
xxxInitialize
xxxShutdown
|
Expand for full list:
AddProvider
AllocClientResources
AsyncEventsThread
BreakupCanonicalW
ClientAllocStringReal
CreateCountryObject
CreateCurrentLocationObject
CreateDialingRule
CreateHiddenWindow
DoFunc
EnsureTapiServiceFillAddDriverList
FillDriverList
GetDescriptionForRule
GetFunctionIndex
GetProviderFileDesc
GetTapi16CallbackMsg
GetTranslateCapsCommon
IsLeastCostRoutingEnabled
IsUserAdmin
LoadUIDll
LocWizardDlgProc
MIDL_user_allocate
MIDL_user_free
MMCInitialize
PopulateStepList
ReadCountriesAndGroups
ReadLocations
RemoveSelectedDriver
SetupDriver
TAPIWndProc
UIThread
UpdateDriverDlgButtons
UpdateSampleString
ValidateXxxInitializeParams
VerifyProcExists
WideStringToNotSoWideString
internalNewLocationW
internalRemoveLocation
internalRenameLocationW
lineAddProviderA
lineAddProviderW
lineBlindTransferA
lineBlindTransferW
lineCompleteCallPostProcess
lineConfigDialogEditW
lineConfigDialogW
lineDeallocateCall
lineDevSpecificPostProcess
lineDialA
lineDialW
lineGatherDigitsPostProcess
lineGatherDigitsWPostProcess
lineGetAddressIDA
lineGetAddressStatusA
lineGetAgentActivityListAPostProcess
lineGetAgentCapsAPostProcess
lineGetAgentGroupListAPostProcess
lineGetAgentStatusAPostProcess
lineGetAppPriorityA
lineGetAppPriorityW
lineGetCountry
lineGetCountryW
lineGetIDA
lineGetIDW
lineGetIconW
lineGetQueueListAPostProcess
lineGetTranslateCapsA
lineGetTranslateCapsW
lineInitializeExW
lineMakeCallA
lineMakeCallPostProcess
lineParkAPostProcess
lineSetCurrentLocation
lineSetTollListA
lineSetTollListW
lineSetupConferencePostProcess
lineTranslateAddressA
lineTranslateAddressW
lineTranslateDialogA
lineTranslateDialogW
lineXxxProvider
phoneConfigDialogW
phoneDevSpecificPostProcess
phoneGetIDA
phoneGetIDW
phoneGetIconW
phoneInitializeExW
phoneSetButtonInfoA
tapiGetLocationInfoA
tapiGetLocationInfoW
tapiRequestMakeCallW
xxxGetMessage
xxxInitialize
xxxShutdown
| |paramcount|4|4| |`address`|1800290b8|18002a2a8| |sig|undefined __fastcall TRACELogPrint(uint param_1, STRSAFE_LPCSTR param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall TRACELogPrint(uint param_1, STRSAFE_LPCSTR param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## KERNEL32.DLL::GetProcessHeap ### Match Info |Key|pre.dll - post.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|pre.dll|post.dll| | :---: | :---: | :---: | |name|GetProcessHeap|GetProcessHeap| |fullname|KERNEL32.DLL::GetProcessHeap|KERNEL32.DLL::GetProcessHeap| |`refcount`|2|6| |length|0|0| |called||| |`calling`|DllMain|DllMain
wil_details_GetCurrentFeatureEnabledState
wil_details_StagingConfig_Load| |paramcount|0|0| |`address`|EXTERNAL:0000007c|EXTERNAL:0000007a| |sig|HANDLE __stdcall GetProcessHeap(void)|HANDLE __stdcall GetProcessHeap(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::GetProcessHeap Calling Diff ```diff --- KERNEL32.DLL::GetProcessHeap calling +++ KERNEL32.DLL::GetProcessHeap calling @@ -1,0 +2,2 @@ +wil_details_GetCurrentFeatureEnabledState +wil_details_StagingConfig_Load ``` ## KERNEL32.DLL::GetModuleHandleW ### Match Info |Key|pre.dll - post.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|pre.dll|post.dll| | :---: | :---: | :---: | |name|GetModuleHandleW|GetModuleHandleW| |fullname|KERNEL32.DLL::GetModuleHandleW|KERNEL32.DLL::GetModuleHandleW| |`refcount`|3|6| |length|0|0| |called||| |`calling`|SHFusionInitializeFromModuleID
ValidateXxxInitializeParams|SHFusionInitializeFromModuleID
ValidateXxxInitializeParams
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_GetCurrentFeatureEnabledState
wil_details_NtQueryWnfStateData| |paramcount|1|1| |`address`|EXTERNAL:0000007b|EXTERNAL:00000079| |sig|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::GetModuleHandleW Calling Diff ```diff --- KERNEL32.DLL::GetModuleHandleW calling +++ KERNEL32.DLL::GetModuleHandleW calling @@ -2,0 +3,3 @@ +wil_details_FeatureReporting_ReportUsageToServiceDirect +wil_details_GetCurrentFeatureEnabledState +wil_details_NtQueryWnfStateData ``` ## KERNEL32.DLL::HeapFree ### Match Info |Key|pre.dll - post.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|pre.dll|post.dll| | :---: | :---: | :---: | |name|HeapFree|HeapFree| |fullname|KERNEL32.DLL::HeapFree|KERNEL32.DLL::HeapFree| |`refcount`|5|8| |length|0|0| |called||| |`calling`|CreateHandleTable
DllMain
GrowTable|CreateHandleTable
DllMain
GrowTable
wil_details_GetCurrentFeatureEnabledState
wil_details_StagingConfig_Load| |paramcount|3|3| |`address`|EXTERNAL:0000004e|EXTERNAL:00000095| |sig|BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem)|BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::HeapFree Calling Diff ```diff --- KERNEL32.DLL::HeapFree calling +++ KERNEL32.DLL::HeapFree calling @@ -3,0 +4,2 @@ +wil_details_GetCurrentFeatureEnabledState +wil_details_StagingConfig_Load ``` ## __security_check_cookie ### Match Info |Key|pre.dll - post.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|pre.dll|post.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|252|255| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
AddProvider
AllocClientResources
BuildInstalledProviderList
BuildRuleDescription
CAreaCodeRule::TRACELogPrint
CAreaCodeRuleDialog::ApplyChanges
CAreaCodeRuleDialog::OnInitDialog
CAreaCodeRuleDialog::TRACELogPrint
CCallingCard::TRACELogPrint
CCallingCard::Validate
CCallingCardPropSheet::DoPropSheetCCallingCardPropSheet::General_OnInitDialog
CCallingCardPropSheet::Gerneral_OnApply
CCallingCardPropSheet::OnCommand
CCallingCardPropSheet::OnInitDialog
CCallingCardPropSheet::SetTextForRules
CCallingCardPropSheet::TRACELogPrint
CCallingCardPropSheet::UpdateRule
CCallingCards::CreateFreshCards
CCallingCards::Initialize
CCallingCards::TRACELogPrint
CCountries::TRACELogPrint
CCountry::TRACELogPrint
CDialingRulesPropSheet::AddLocationToList
CDialingRulesPropSheet::Advanced_OnCommand
CDialingRulesPropSheet::Dailing_OnInitDialog
CDialingRulesPropSheet::Dailing_OnNotify
CDialingRulesPropSheet::DeleteSelectedLocation
CDialingRulesPropSheet::DoPropSheet
CDialingRulesPropSheet::LaunchLocationPropSheet
CDialingRulesPropSheet::TRACELogPrint
CDialingRulesPropSheet::UpdateLocationInList
CEditDialog::OnInitDialog
CInputLimiter::CreateToolTipWindow
CInputLimiter::ShowToolTip
CLocation::NewID
CLocation::TRACELogPrint
CLocationPropSheet::AddCardToList
CLocationPropSheet::AddRuleToList
CLocationPropSheet::AreaCode_OnInitDialog
CLocationPropSheet::CallingCard_OnApply
CLocationPropSheet::CallingCard_OnInitDialog
CLocationPropSheet::DeleteSelectedCard
CLocationPropSheet::DeleteSelectedRule
CLocationPropSheet::DoPropSheet
CLocationPropSheet::General_OnCommand
CLocationPropSheet::General_OnInitDialog
CLocationPropSheet::LaunchCallingCardPropSheet
CLocationPropSheet::PopulateDisableCallWaitingCodes
CLocationPropSheet::SetDataForSelectedCard
CLocationPropSheet::SetDataForSelectedRule
CLocationPropSheet::TRACELogPrint
CLocationPropSheet::UpdateCardInList
CLocations::TRACELogPrint
CRuleSet::TRACELogPrint
CoCreateInstanceAsAdmin
ConvertCallingCards
ConvertOneCard
CreateSessionKey
EnablePrivilege
EnsureTapiService
FillAddDriverList
FillDriverList
GetDescriptionForRule
GetProviderFileDesc
IsLeastCostRoutingEnabled
IsUserAdmin
LOpenDialAsst
LayDownString
LoadUIDll
LocWizardDlgProc
MMCGetAvailableProviders
MMCGetDeviceFlags
MMCGetLineInfo
MMCGetPhoneInfo
MMCGetServerConfig
MMCInitialize
MMCSetLineInfo
MMCSetPhoneInfo
MMCSetServerConfig
PopulateCountryList
PopulateStepList
ReadCountriesAndGroups
ReadLocations
RemoveSelectedDriver
SHFusionInitializeFromModuleID
SetToForegroundEnumProc
SetupDriver
ShowErrorMessage
SplitCallingCardRule
TRACELogPrint
TRACELogRegister
TUISPIDLLCallback
TapiEncrypt
TapiIsSafeToDisplaySensitiveData
UpdateSampleString
WideStringToNotSoWideString
WriteLocations
__GSHandlerCheckCommon
internalPerformance
lineAccept
lineAddToConference
lineAgentSpecific
lineAnswer
lineBlindTransferW
lineClose
lineCompleteCall
lineCompleteTransfer
lineCreateAgentSessionW
lineCreateAgentW
lineDeallocateCall
lineDevSpecific
lineDevSpecificFeature
lineDialW
lineDrop
lineForwardA
lineForwardW
lineGatherDigitsA
lineGatherDigitsW
lineGenerateDigitsA
lineGenerateDigitsW
lineGenerateTone
lineGetAddressCapsW
lineGetAddressIDW
lineGetAddressStatusW
lineGetAgentActivityListA
lineGetAgentActivityListW
lineGetAgentCapsA
lineGetAgentCapsW
lineGetAgentGroupListA
lineGetAgentGroupListW
lineGetAgentInfo
lineGetAgentSessionInfo
lineGetAgentSessionList
lineGetAgentStatusA
lineGetAgentStatusW
lineGetAppPriorityA
lineGetAppPriorityW
lineGetCallInfoW
lineGetCallStatus
lineGetConfRelatedCalls
lineGetCountryW
lineGetDevCapsW
lineGetDevConfigA
lineGetDevConfigW
lineGetGroupListA
lineGetGroupListW
lineGetIDW
lineGetIconW
lineGetLineDevStatusA
lineGetLineDevStatusW
lineGetNewCalls
lineGetNumRings
lineGetProviderListW
lineGetProxyStatus
lineGetQueueInfo
lineGetQueueListA
lineGetQueueListW
lineGetRequestA
lineGetRequestW
lineGetStatusMessages
lineHandoffW
lineHold
lineMakeCallA
lineMakeCallW
lineMonitorDigits
lineMonitorMedia
lineMonitorTones
lineNegotiateAPIVersion
lineNegotiateExtVersion
lineOpenA
lineOpenW
lineParkA
lineParkW
linePickupW
linePrepareAddToConferenceA
linePrepareAddToConferenceW
lineProxyMessage
lineProxyResponse
lineRedirectW
lineRegisterRequestRecipient
lineReleaseUserUserInfo
lineRemoveFromConference
lineSecureCall
lineSendUserUserInfo
lineSetAgentActivity
lineSetAgentGroup
lineSetAgentMeasurementPeriod
lineSetAgentSessionState
lineSetAgentState
lineSetAgentStateEx
lineSetAppPriorityW
lineSetAppSpecific
lineSetCallData
lineSetCallParams
lineSetCallPrivilege
lineSetCallQualityOfService
lineSetCallTreatment
lineSetDevConfigW
lineSetLineDevStatus
lineSetMediaControl
lineSetMediaMode
lineSetNumRings
lineSetQueueMeasurementPeriod
lineSetStatusMessages
lineSetTerminal
lineSetTollListA
lineSetupConferenceA
lineSetupConferenceW
lineSetupTransferA
lineSetupTransferW
lineSwapHold
lineTranslateAddressA
lineUncompleteCall
lineUnhold
lineUnparkW
lineXxxProvider
phoneClose
phoneDevSpecific
phoneGetButtonInfoW
phoneGetData
phoneGetDevCapsW
phoneGetDisplay
phoneGetGain
phoneGetHookSwitch
phoneGetIDW
phoneGetIconW
phoneGetLamp
phoneGetRing
phoneGetStatusMessages
phoneGetStatusW
phoneGetVolume
phoneNegotiateAPIVersion
phoneNegotiateExtVersion
phoneOpen
phoneSetButtonInfoW
phoneSetData
phoneSetDisplay
phoneSetGain
phoneSetHookSwitch
phoneSetLamp
phoneSetRing
phoneSetStatusMessages
phoneSetVolume
tapiGetLocationInfoA
tapiGetLocationInfoW
tapiRequestDrop
tapiRequestMakeCallW
tapiRequestMediaCallW
xxxInitialize
xxxShutdown
|
Expand for full list:
AddProvider
AllocClientResources
BuildInstalledProviderList
BuildRuleDescription
CAreaCodeRule::TRACELogPrint
CAreaCodeRuleDialog::ApplyChanges
CAreaCodeRuleDialog::OnInitDialog
CAreaCodeRuleDialog::TRACELogPrint
CCallingCard::TRACELogPrint
CCallingCard::Validate
CCallingCardPropSheet::DoPropSheetCCallingCardPropSheet::General_OnInitDialog
CCallingCardPropSheet::Gerneral_OnApply
CCallingCardPropSheet::OnCommand
CCallingCardPropSheet::OnInitDialog
CCallingCardPropSheet::SetTextForRules
CCallingCardPropSheet::TRACELogPrint
CCallingCardPropSheet::UpdateRule
CCallingCards::CreateFreshCards
CCallingCards::Initialize
CCallingCards::TRACELogPrint
CCountries::TRACELogPrint
CCountry::TRACELogPrint
CDialingRulesPropSheet::AddLocationToList
CDialingRulesPropSheet::Advanced_OnCommand
CDialingRulesPropSheet::Dailing_OnInitDialog
CDialingRulesPropSheet::Dailing_OnNotify
CDialingRulesPropSheet::DeleteSelectedLocation
CDialingRulesPropSheet::DoPropSheet
CDialingRulesPropSheet::LaunchLocationPropSheet
CDialingRulesPropSheet::TRACELogPrint
CDialingRulesPropSheet::UpdateLocationInList
CEditDialog::OnInitDialog
CInputLimiter::CreateToolTipWindow
CInputLimiter::ShowToolTip
CLocation::NewID
CLocation::TRACELogPrint
CLocationPropSheet::AddCardToList
CLocationPropSheet::AddRuleToList
CLocationPropSheet::AreaCode_OnInitDialog
CLocationPropSheet::CallingCard_OnApply
CLocationPropSheet::CallingCard_OnInitDialog
CLocationPropSheet::DeleteSelectedCard
CLocationPropSheet::DeleteSelectedRule
CLocationPropSheet::DoPropSheet
CLocationPropSheet::General_OnCommand
CLocationPropSheet::General_OnInitDialog
CLocationPropSheet::LaunchCallingCardPropSheet
CLocationPropSheet::PopulateDisableCallWaitingCodes
CLocationPropSheet::SetDataForSelectedCard
CLocationPropSheet::SetDataForSelectedRule
CLocationPropSheet::TRACELogPrint
CLocationPropSheet::UpdateCardInList
CLocations::TRACELogPrint
CRuleSet::TRACELogPrint
CoCreateInstanceAsAdmin
ConvertCallingCards
ConvertOneCard
CreateSessionKey
EnablePrivilege
EnsureTapiService
FillAddDriverList
FillDriverList
GetDescriptionForRule
GetProviderFileDesc
IsLeastCostRoutingEnabled
IsUserAdmin
LOpenDialAsst
LayDownString
LoadUIDll
LocWizardDlgProc
MMCGetAvailableProviders
MMCGetDeviceFlags
MMCGetLineInfo
MMCGetPhoneInfo
MMCGetServerConfig
MMCInitialize
MMCSetLineInfo
MMCSetPhoneInfo
MMCSetServerConfig
PopulateCountryList
PopulateStepList
ReadCountriesAndGroups
ReadLocations
RemoveSelectedDriver
SHFusionInitializeFromModuleID
SetToForegroundEnumProc
SetupDriver
ShowErrorMessage
SplitCallingCardRule
TRACELogPrint
TRACELogRegister
TUISPIDLLCallback
TapiEncrypt
TapiIsSafeToDisplaySensitiveData
UpdateSampleString
WideStringToNotSoWideString
WriteLocations
__GSHandlerCheckCommon
internalPerformance
lineAccept
lineAddToConference
lineAgentSpecific
lineAnswer
lineBlindTransferW
lineClose
lineCompleteCall
lineCompleteTransfer
lineCreateAgentSessionW
lineCreateAgentW
lineDeallocateCall
lineDevSpecific
lineDevSpecificFeature
lineDialW
lineDrop
lineForwardA
lineForwardW
lineGatherDigitsA
lineGatherDigitsW
lineGenerateDigitsA
lineGenerateDigitsW
lineGenerateTone
lineGetAddressCapsW
lineGetAddressIDW
lineGetAddressStatusW
lineGetAgentActivityListA
lineGetAgentActivityListW
lineGetAgentCapsA
lineGetAgentCapsW
lineGetAgentGroupListA
lineGetAgentGroupListW
lineGetAgentInfo
lineGetAgentSessionInfo
lineGetAgentSessionList
lineGetAgentStatusA
lineGetAgentStatusW
lineGetAppPriorityA
lineGetAppPriorityW
lineGetCallInfoW
lineGetCallStatus
lineGetConfRelatedCalls
lineGetCountryW
lineGetDevCapsW
lineGetDevConfigA
lineGetDevConfigW
lineGetGroupListA
lineGetGroupListW
lineGetIDW
lineGetIconW
lineGetLineDevStatusA
lineGetLineDevStatusW
lineGetNewCalls
lineGetNumRings
lineGetProviderListW
lineGetProxyStatus
lineGetQueueInfo
lineGetQueueListA
lineGetQueueListW
lineGetRequestA
lineGetRequestW
lineGetStatusMessages
lineHandoffW
lineHold
lineMakeCallA
lineMakeCallW
lineMonitorDigits
lineMonitorMedia
lineMonitorTones
lineNegotiateAPIVersion
lineNegotiateExtVersion
lineOpenA
lineOpenW
lineParkA
lineParkW
linePickupW
linePrepareAddToConferenceA
linePrepareAddToConferenceW
lineProxyMessage
lineProxyResponse
lineRedirectW
lineRegisterRequestRecipient
lineReleaseUserUserInfo
lineRemoveFromConference
lineSecureCall
lineSendUserUserInfo
lineSetAgentActivity
lineSetAgentGroup
lineSetAgentMeasurementPeriod
lineSetAgentSessionState
lineSetAgentState
lineSetAgentStateEx
lineSetAppPriorityW
lineSetAppSpecific
lineSetCallData
lineSetCallParams
lineSetCallPrivilege
lineSetCallQualityOfService
lineSetCallTreatment
lineSetDevConfigW
lineSetLineDevStatus
lineSetMediaControl
lineSetMediaMode
lineSetNumRings
lineSetQueueMeasurementPeriod
lineSetStatusMessages
lineSetTerminal
lineSetTollListA
lineSetupConferenceA
lineSetupConferenceW
lineSetupTransferA
lineSetupTransferW
lineSwapHold
lineTranslateAddressA
lineUncompleteCall
lineUnhold
lineUnparkW
lineXxxProvider
phoneClose
phoneDevSpecific
phoneGetButtonInfoW
phoneGetData
phoneGetDevCapsW
phoneGetDisplay
phoneGetGain
phoneGetHookSwitch
phoneGetIDW
phoneGetIconW
phoneGetLamp
phoneGetRing
phoneGetStatusMessages
phoneGetStatusW
phoneGetVolume
phoneNegotiateAPIVersion
phoneNegotiateExtVersion
phoneOpen
phoneSetButtonInfoW
phoneSetData
phoneSetDisplay
phoneSetGain
phoneSetHookSwitch
phoneSetLamp
phoneSetRing
phoneSetStatusMessages
phoneSetVolume
tapiGetLocationInfoA
tapiGetLocationInfoW
tapiRequestDrop
tapiRequestMakeCallW
tapiRequestMediaCallW
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_GetCurrentFeatureEnabledState
wil_details_StagingConfig_Load
xxxInitialize
xxxShutdown
| |paramcount|1|1| |`address`|18002c660|18002d850| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -249,0 +250,3 @@ +wil_details_FeatureReporting_ReportUsageToServiceDirect +wil_details_GetCurrentFeatureEnabledState +wil_details_StagingConfig_Load ``` ## KERNEL32.DLL::GetProcAddress ### Match Info |Key|pre.dll - post.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|pre.dll|post.dll| | :---: | :---: | :---: | |name|GetProcAddress|GetProcAddress| |fullname|KERNEL32.DLL::GetProcAddress|KERNEL32.DLL::GetProcAddress| |`refcount`|16|19| |length|0|0| |called||| |`calling`|AsyncEventsThread
CDialingRulesPropSheet::DoPropSheet
GetProviderFileDesc
IsLeastCostRoutingEnabled
LoadUIDll
ValidateXxxInitializeParams
VerifyProcExists
_GetProcFromComCtl32
lineXxxProvider
tapiRequestMakeCallW|
Expand for full list:
AsyncEventsThread
CDialingRulesPropSheet::DoPropSheet
GetProviderFileDesc
IsLeastCostRoutingEnabled
LoadUIDll
ValidateXxxInitializeParams
VerifyProcExists
_GetProcFromComCtl32
lineXxxProvider
tapiRequestMakeCallW
wil_details_FeatureReporting_ReportUsageToServiceDirectwil_details_GetCurrentFeatureEnabledState
wil_details_NtQueryWnfStateData
| |paramcount|2|2| |`address`|EXTERNAL:00000081|EXTERNAL:0000007f| |sig|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::GetProcAddress Calling Diff ```diff --- KERNEL32.DLL::GetProcAddress calling +++ KERNEL32.DLL::GetProcAddress calling @@ -10,0 +11,3 @@ +wil_details_FeatureReporting_ReportUsageToServiceDirect +wil_details_GetCurrentFeatureEnabledState +wil_details_NtQueryWnfStateData ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-16T19:27:15