AlertSyslog

decompiled_code:
void __fastcall AlertSyslog(__int64 a1, unsigned int *a2, __int64 a3, __int64 a4)
{
unsigned int v5; // er13
unsigned int v6; // eax
__int64 v7; // r13
unsigned int v8; // eax
__int64 v9; // r14
struct in_addr *v10; // rax
char *v11; // rax
char *v12; // rax
unsigned int v13; // er15
unsigned int v14; // eax
const char *v15; // r13
unsigned int v16; // eax
unsigned __int8 v17; // bl
const char *v18; // rcx
unsigned int v19; // eax
const char *v20; // r8
const char *v21; // r8
const char *v22; // rcx
const char *v23; // rdx
unsigned int v24; // [rsp+0h] [rbp-105Ch]
char v25[1024]; // [rsp+4h] [rbp-1058h] BYREF
char v26[1024]; // [rsp+404h] [rbp-C58h] BYREF
char v27[1024]; // [rsp+804h] [rbp-858h] BYREF
char v28[1024]; // [rsp+C04h] [rbp-458h] BYREF
char v29[16]; // [rsp+1004h] [rbp-58h] BYREF
char v30[72]; // [rsp+1014h] [rbp-48h] BYREF

if ( a4 == 0 || a2 == 0LL || !a1 )
return;
v5 = _bswap_32(a2[4]);
v6 = _bswap_32(a2[5]);
v7 = GetSigByGidSid(v6, v5);
v8 = _bswap_32(a2[7]);
v9 = ClassTypeLookupById(barnyard2_conf, v8);
v25[0] = 0;
v10 = *(struct in_addr **)(a1 + 72);
if ( v10 )
{
v11 = inet_ntoa(v10[3]);
if ( (unsigned __int64)strlcpy(v30, v11, 16LL) > 0xF )
return;
v12 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 16LL));
if ( (unsigned __int64)strlcpy(v29, v12, 16LL) > 0xF )
return;
v13 = _bswap_32(a2[6]);
v24 = _bswap_32(a2[4]);
v14 = _bswap_32(a2[5]);
if ( (unsigned int)SnortSnprintf(v26, 1024LL, "[%lu:%lu:%lu] ", v14, v24, v13)
|| (unsigned __int64)strlcat(v25, v26, 1024LL) > 0x3FF )
{
return;
}
if ( v7 )
{
if ( (unsigned __int64)strlcat(v25, *(_QWORD *)(v7 + 32), 1024LL) > 0x3FF )
return;
}
else if ( (unsigned __int64)strlcat(v25, "ALERT", 1024LL) > 0x3FF )
{
return;
}
if ( v9 )
{
v15 = *(const char **)(v9 + 16);
if ( v15 )
{
v16 = _bswap_32(a2[8]);
if ( (unsigned int)SnortSnprintf(v28, 1023LL, " [Classification: %s] [Priority: %d]:", v15, v16) )
return;
}
if ( (unsigned __int64)strlcat(v25, v28, 1024LL) > 0x3FF )
return;
}
else
{
v19 = _bswap_32(a2[8]);
if ( v19
&& ((unsigned int)SnortSnprintf(v28, 1024LL, "[Priority: %d]:", v19)
|| (unsigned __int64)strlcat(v25, v28, 1024LL) > 0x3FF) )
{
return;
}
}
v17 = *(_BYTE *)(*(_QWORD *)(a1 + 72) + 9LL);
if ( v17 != 6 && v17 != 17 || *(_BYTE *)(a1 + 852) )
{
if ( (unsigned int)BcAlertInterface() )
{
v21 = *(const char **)(protocol_names + 8LL * v17);
if ( v21
&& (unsigned int)SnortSnprintf(
v27,
1024LL,
" <%s> {%s} %s -> %s",
*(const char **)(barnyard2_conf + 65600LL),
v21,
v30,
v29) )
{
return;
}
}
else
{
v18 = *(const char **)(protocol_names + 8LL * v17);
if ( v18 && (unsigned int)SnortSnprintf(v27, 1024LL, " {%s} %s -> %s", v18, v30, v29) )
return;
}
goto LABEL_19;
}
if ( (unsigned int)BcAlertInterface() )
{
v20 = *(const char **)(protocol_names + 8LL * v17);
if ( v20
&& (unsigned int)SnortSnprintf(
v27,
1024LL,
" <%s> {%s} %s:%i -> %s:%i",
*(const char **)(barnyard2_conf + 65600LL),
v20,
v30,
*(unsigned __int16 *)(a1 + 842),
v29,
*(unsigned __int16 *)(a1 + 844)) )
{
return;
}
LABEL_19:
if ( (unsigned __int64)strlcat(v25, v27, 1024LL) <= 0x3FF )
syslog(*(_DWORD *)(a4 + 4), "%s", v25);
return;
}
v22 = *(const char **)(protocol_names + 8LL * v17);
if ( !v22
|| !(unsigned int)SnortSnprintf(
v27,
1024LL,
" {%s} %s:%i -> %s:%i",
v22,
v30,
*(unsigned __int16 *)(a1 + 842),
v29,
*(unsigned __int16 *)(a1 + 844)) )
{
goto LABEL_19;
}
}
else if ( v7 )
{
v23 = *(const char **)(v7 + 32);
if ( !v23 )
v23 = "ALERT!";
syslog(*(_DWORD *)(a4 + 4), "%s", v23);
}
}

canonical_decompiled_code:
void __fastcall func3(__int64 a1, unsigned int *a2, __int64 a3, __int64 a4)
{
unsigned int v5; // er13
unsigned int v6; // eax
__int64 v7; // r13
unsigned int v8; // eax
__int64 v9; // r14
struct in_addr *v10; // rax
char *v11; // rax
char *v12; // rax
unsigned int v13; // er15
unsigned int v14; // eax
const char *v15; // r13
unsigned int v16; // eax
unsigned __int8 v17; // bl
const char *v18; // rcx
unsigned int v19; // eax
const char *v20; // r8
const char *v21; // r8
const char *v22; // rcx
const char *v23; // rdx
unsigned int v24; // [rsp+0h] [rbp-105Ch]
char v25[1024]; // [rsp+4h] [rbp-1058h] BYREF
char v26[1024]; // [rsp+404h] [rbp-C58h] BYREF
char v27[1024]; // [rsp+804h] [rbp-858h] BYREF
char v28[1024]; // [rsp+C04h] [rbp-458h] BYREF
char v29[16]; // [rsp+1004h] [rbp-58h] BYREF
char v30[72]; // [rsp+1014h] [rbp-48h] BYREF

if ( a4 == 0 || a2 == 0LL || !a1 )
return;
v5 = func2(a2[4]);
v6 = func2(a2[5]);
v7 = GetSigByGidSid(v6, v5);
v8 = func2(a2[7]);
v9 = ClassTypeLookupById(barnyard2_conf, v8);
v25[0] = 0;
v10 = *(struct in_addr **)(a1 + 72);
if ( v10 )
{
v11 = inet_ntoa(v10[3]);
if ( (unsigned __int64)strlcpy(v30, v11, 16LL) > 0xF )
return;
v12 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 16LL));
if ( (unsigned __int64)strlcpy(v29, v12, 16LL) > 0xF )
return;
v13 = func2(a2[6]);
v24 = func2(a2[4]);
v14 = func2(a2[5]);
if ( (unsigned int)SnortSnprintf(v26, 1024LL, "[%lu:%lu:%lu] ", v14, v24, v13)
|| (unsigned __int64)strlcat(v25, v26, 1024LL) > 0x3FF )
{
return;
}
if ( v7 )
{
if ( (unsigned __int64)strlcat(v25, *(_QWORD *)(v7 + 32), 1024LL) > 0x3FF )
return;
}
else if ( (unsigned __int64)strlcat(v25, "ALERT", 1024LL) > 0x3FF )
{
return;
}
if ( v9 )
{
v15 = *(const char **)(v9 + 16);
if ( v15 )
{
v16 = func2(a2[8]);
if ( (unsigned int)SnortSnprintf(v28, 1023LL, " [Classification: %s] [Priority: %d]:", v15, v16) )
return;
}
if ( (unsigned __int64)strlcat(v25, v28, 1024LL) > 0x3FF )
return;
}
else
{
v19 = func2(a2[8]);
if ( v19
&& ((unsigned int)SnortSnprintf(v28, 1024LL, "[Priority: %d]:", v19)
|| (unsigned __int64)strlcat(v25, v28, 1024LL) > 0x3FF) )
{
return;
}
}
v17 = *(_BYTE *)(*(_QWORD *)(a1 + 72) + 9LL);
if ( v17 != 6 && v17 != 17 || *(_BYTE *)(a1 + 852) )
{
if ( (unsigned int)func1() )
{
v21 = *(const char **)(protocol_names + 8LL * v17);
if ( v21
&& (unsigned int)SnortSnprintf(
v27,
1024LL,
" <%s> {%s} %s -> %s",
*(const char **)(barnyard2_conf + 65600LL),
v21,
v30,
v29) )
{
return;
}
}
else
{
v18 = *(const char **)(protocol_names + 8LL * v17);
if ( v18 && (unsigned int)SnortSnprintf(v27, 1024LL, " {%s} %s -> %s", v18, v30, v29) )
return;
}
goto LABEL_19;
}
if ( (unsigned int)func1() )
{
v20 = *(const char **)(protocol_names + 8LL * v17);
if ( v20
&& (unsigned int)SnortSnprintf(
v27,
1024LL,
" <%s> {%s} %s:%i -> %s:%i",
*(const char **)(barnyard2_conf + 65600LL),
v20,
v30,
*(unsigned __int16 *)(a1 + 842),
v29,
*(unsigned __int16 *)(a1 + 844)) )
{
return;
}
LABEL_19:
if ( (unsigned __int64)strlcat(v25, v27, 1024LL) <= 0x3FF )
syslog(*(_DWORD *)(a4 + 4), "%s", v25);
return;
}
v22 = *(const char **)(protocol_names + 8LL * v17);
if ( !v22
|| !(unsigned int)SnortSnprintf(
v27,
1024LL,
" {%s} %s:%i -> %s:%i",
v22,
v30,
*(unsigned __int16 *)(a1 + 842),
v29,
*(unsigned __int16 *)(a1 + 844)) )
{
goto LABEL_19;
}
}
else if ( v7 )
{
v23 = *(const char **)(v7 + 32);
if ( !v23 )
v23 = "ALERT!";
syslog(*(_DWORD *)(a4 + 4), "%s", v23);
}
}

original_code:
void AlertSyslog(Packet *p, void *event, uint32_t event_type, void *arg)
{
    char sip[16];
    char dip[16];
    char pri_data[1024];
    char ip_data[1024];
    char event_data[1024];
    char event_string[1024];
    SyslogData *data;
 SigNode *sn;
 ClassType *cn;
 if ( p == ((void *)0) || event == ((void *)0) || arg == ((void *)0) )
 {
  return;
 }
 data = (SyslogData *)arg;
 sn = GetSigByGidSid(ntohl(((Unified2EventCommon *)event)->generator_id),
      ntohl(((Unified2EventCommon *)event)->signature_id));
 cn = ClassTypeLookupById(barnyard2_conf, ntohl(((Unified2EventCommon *)event)->classification_id));
    event_string[0] = '\0';
    if (!1)
    {
        return;
    }
    if(p && p->iph)
    {
        if (strlcpy(sip, inet_ntoa(p->iph->ip_src), sizeof(sip)) >= sizeof(sip))
            return;
        if (strlcpy(dip, inet_ntoa(p->iph->ip_dst), sizeof(dip)) >= sizeof(dip))
            return;
            if( SnortSnprintf(event_data, 1024, "[%lu:%lu:%lu] ",
                              (unsigned long) ntohl(((Unified2EventCommon *)event)->generator_id),
                              (unsigned long) ntohl(((Unified2EventCommon *)event)->signature_id),
                              (unsigned long) ntohl(((Unified2EventCommon *)event)->signature_revision)) != 0 )
                return ;
            if( strlcat(event_string, event_data, 1024) >= 1024 )
                return ;
        if(sn != ((void *)0))
        {
           if( strlcat(event_string, sn->msg, 1024) >= 1024 )
                return ;
        }
        else
        {
           if(strlcat(event_string, "ALERT", 1024) >= 1024)
                return ;
        }
            if(cn != ((void *)0))
            {
                if( cn->name )
                {
                    if( SnortSnprintf(pri_data, 1024 -1, " [Classification: %s] "
                                      "[Priority: %d]:",
                                      cn->name,
                                      ntohl(((Unified2EventCommon *)event)->priority_id)) != 0 )
                        return ;
                }
                if( strlcat(event_string, pri_data, 1024) >= 1024)
                    return ;
            }
            else if( ntohl(((Unified2EventCommon *)event)->priority_id) != 0 )
            {
                if( SnortSnprintf(pri_data, 1024, "[Priority: %d]:",
                                  ntohl(((Unified2EventCommon *)event)->priority_id)) != 0 )
                   return ;
                if( strlcat(event_string, pri_data, 1024) >= 1024)
                    return;
            }
        if((p->iph->ip_proto != IPPROTO_TCP &&
                    p->iph->ip_proto != IPPROTO_UDP) ||
                p->frag_flag)
        {
            if(!BcAlertInterface())
            {
                if( protocol_names[p->iph->ip_proto] )
                {
                    if( SnortSnprintf(ip_data, 1024, " {%s} %s -> %s",
                                      protocol_names[p->iph->ip_proto],
                                      sip, dip) != 0 )
                        return;
                }
            }
            else
            {
                if( protocol_names[p->iph->ip_proto] )
                {
                    if( SnortSnprintf(ip_data, 1024, " <%s> {%s} %s -> %s",
                                      barnyard2_conf->interface,
                                      protocol_names[p->iph->ip_proto],
                                      sip, dip) != 0 )
                        return ;
                }
            }
        }
        else
        {
            if(BcAlertInterface())
            {
               if( protocol_names[p->iph->ip_proto] )
               {
                   if( SnortSnprintf(ip_data, 1024, " <%s> {%s} %s:%i -> %s:%i",
                                     barnyard2_conf->interface,
                                     protocol_names[p->iph->ip_proto], sip,
                                     p->sp, dip, p->dp) != 0 )
                       return ;
               }
            }
            else
            {
               if( protocol_names[p->iph->ip_proto] )
               {
                   if( SnortSnprintf(ip_data, 1024, " {%s} %s:%i -> %s:%i",
                                     protocol_names[p->iph->ip_proto], sip, p->sp,
                                     dip, p->dp) != 0 )
                       return ;
               }
            }
        }
        if( strlcat(event_string, ip_data, 1024) >= 1024)
            return;
        syslog(data->priority, "%s", event_string);
    }
    else if (sn != ((void *)0))
    {
        syslog(data->priority, "%s", sn->msg == ((void *)0) ? "ALERT!" : sn->msg);
    }
    return;
}

canonical_original_code:
void AlertSyslog(struct _Packet *p, void *event, unsigned int event_type, void *arg)
{
    char sip[16];
    char dip[16];
    char pri_data[1024];
    char ip_data[1024];
    char event_data[1024];
    char event_string[1024];
    struct _SyslogData *data;
 struct _SigNode *sn;
 struct _ClassType *cn;
 if ( p == ((void *)0) || event == ((void *)0) || arg == ((void *)0) )
 {
  return;
 }
 data = (struct _SyslogData *)arg;
 sn = GetSigByGidSid(ntohl(((struct _Unified2EventCommon *)event)->generator_id),
      ntohl(((struct _Unified2EventCommon *)event)->signature_id));
 cn = ClassTypeLookupById(barnyard2_conf, ntohl(((struct _Unified2EventCommon *)event)->classification_id));
    event_string[0] = '\0';
    if (!1)
    {
        return;
    }
    if(p && p->iph)
    {
        if (strlcpy(sip, inet_ntoa(p->iph->ip_src), sizeof(sip)) >= sizeof(sip))
            return;
        if (strlcpy(dip, inet_ntoa(p->iph->ip_dst), sizeof(dip)) >= sizeof(dip))
            return;
            if( SnortSnprintf(event_data, 1024, "[%lu:%lu:%lu] ",
                              (unsigned long) ntohl(((struct _Unified2EventCommon *)event)->generator_id),
                              (unsigned long) ntohl(((struct _Unified2EventCommon *)event)->signature_id),
                              (unsigned long) ntohl(((struct _Unified2EventCommon *)event)->signature_revision)) != 0 )
                return ;
            if( strlcat(event_string, event_data, 1024) >= 1024 )
                return ;
        if(sn != ((void *)0))
        {
           if( strlcat(event_string, sn->msg, 1024) >= 1024 )
                return ;
        }
        else
        {
           if(strlcat(event_string, "ALERT", 1024) >= 1024)
                return ;
        }
            if(cn != ((void *)0))
            {
                if( cn->name )
                {
                    if( SnortSnprintf(pri_data, 1024 -1, " [Classification: %s] "
                                      "[Priority: %d]:",
                                      cn->name,
                                      ntohl(((struct _Unified2EventCommon *)event)->priority_id)) != 0 )
                        return ;
                }
                if( strlcat(event_string, pri_data, 1024) >= 1024)
                    return ;
            }
            else if( ntohl(((struct _Unified2EventCommon *)event)->priority_id) != 0 )
            {
                if( SnortSnprintf(pri_data, 1024, "[Priority: %d]:",
                                  ntohl(((struct _Unified2EventCommon *)event)->priority_id)) != 0 )
                   return ;
                if( strlcat(event_string, pri_data, 1024) >= 1024)
                    return;
            }
        if((p->iph->ip_proto != IPPROTO_TCP &&
                    p->iph->ip_proto != IPPROTO_UDP) ||
                p->frag_flag)
        {
            if(!BcAlertInterface())
            {
                if( protocol_names[p->iph->ip_proto] )
                {
                    if( SnortSnprintf(ip_data, 1024, " {%s} %s -> %s",
                                      protocol_names[p->iph->ip_proto],
                                      sip, dip) != 0 )
                        return;
                }
            }
            else
            {
                if( protocol_names[p->iph->ip_proto] )
                {
                    if( SnortSnprintf(ip_data, 1024, " <%s> {%s} %s -> %s",
                                      barnyard2_conf->interface,
                                      protocol_names[p->iph->ip_proto],
                                      sip, dip) != 0 )
                        return ;
                }
            }
        }
        else
        {
            if(BcAlertInterface())
            {
               if( protocol_names[p->iph->ip_proto] )
               {
                   if( SnortSnprintf(ip_data, 1024, " <%s> {%s} %s:%i -> %s:%i",
                                     barnyard2_conf->interface,
                                     protocol_names[p->iph->ip_proto], sip,
                                     p->sp, dip, p->dp) != 0 )
                       return ;
               }
            }
            else
            {
               if( protocol_names[p->iph->ip_proto] )
               {
                   if( SnortSnprintf(ip_data, 1024, " {%s} %s:%i -> %s:%i",
                                     protocol_names[p->iph->ip_proto], sip, p->sp,
                                     dip, p->dp) != 0 )
                       return ;
               }
            }
        }
        if( strlcat(event_string, ip_data, 1024) >= 1024)
            return;
        syslog(data->priority, "%s", event_string);
    }
    else if (sn != ((void *)0))
    {
        syslog(data->priority, "%s", sn->msg == ((void *)0) ? "ALERT!" : sn->msg);
    }
    return;
}

variable_types: struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *

variable_types:
event
void *

variable_types:
arg
void *

variable_types:
sip
char [16]

variable_types:
dip
char [16]

variable_types: struct _SyslogData { int facility; int priority; int options; } *

variable_types: struct _SigNode { unsigned int generator; unsigned int id; unsigned int rev; unsigned int class_id; struct _ClassType { char *type; unsigned int id; char *name; unsigned int priority; struct _ClassType *next; } *classType; unsigned int priority; char *msg; struct _ReferenceNode { char *id; struct _ReferenceSystemNode { char *name; char *url; struct _ReferenceSystemNode *next; } *system; struct _ReferenceNode *next; } *refs; struct _SigNode *next; } *

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct _SigNode { unsigned int generator; unsigned int id; unsigned int rev; unsigned int class_id; struct _ClassType *classType; unsigned int priority; char *msg; struct _ReferenceNode *refs; struct _SigNode *next; }

user_defined_types: struct _Unified2EventCommon { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int event_microsecond; unsigned int signature_id; unsigned int generator_id; unsigned int signature_revision; unsigned int classification_id; unsigned int priority_id; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }

user_defined_types: struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ReferenceNode { char *id; struct _ReferenceSystemNode *system; struct _ReferenceNode *next; }


AlertSyslogCleanExit

decompiled_code:
void __fastcall AlertSyslogCleanExit(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_syslog.c";
DebugMessageLine = 656;
DebugMessageFunc(32LL, "AlertSyslogCleanExit\n");
if ( a2 )
free(a2);
}

canonical_decompiled_code:
void __fastcall func4(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_syslog.c";
DebugMessageLine = 656;
DebugMessageFunc(32LL, "AlertSyslogCleanExit\n");
if ( a2 )
free(a2);
}

original_code:
void AlertSyslogCleanExit(int signal, void *arg)
{
    SyslogData *data = (SyslogData *)arg;
    DebugMessageFile = "spo_alert_syslog.c"; DebugMessageLine = 656; DebugMessageFunc(0x00000020, "AlertSyslogCleanExit\n");;
    if(data)
        free(data);
}

canonical_original_code:
void AlertSyslogCleanExit(int signal, void *arg)
{
    struct _SyslogData *data = (SyslogData *)arg;
    DebugMessageFile = "spo_alert_syslog.c"; DebugMessageLine = 656; DebugMessageFunc(0x00000020, "AlertSyslogCleanExit\n");;
    if(data)
        free(data);
}

variable_types: signal int

return_type: void

user_defined_types: struct _SyslogData { int facility; int priority; int options; }


AlertSyslogRestart

decompiled_code:
void __fastcall AlertSyslogRestart(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_syslog.c";
DebugMessageLine = 665;
DebugMessageFunc(32LL, "AlertSyslogRestartFunc\n");
if ( a2 )
free(a2);
}

canonical_decompiled_code:
void __fastcall func5(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_syslog.c";
DebugMessageLine = 665;
DebugMessageFunc(32LL, "AlertSyslogRestartFunc\n");
if ( a2 )
free(a2);
}

original_code:
void AlertSyslogRestart(int signal, void *arg)
{
    SyslogData *data = (SyslogData *)arg;
    DebugMessageFile = "spo_alert_syslog.c"; DebugMessageLine = 665; DebugMessageFunc(0x00000020, "AlertSyslogRestartFunc\n");;
    if(data)
        free(data);
}

canonical_original_code:
void AlertSyslogRestart(int signal, void *arg)
{
    struct _SyslogData *data = (SyslogData *)arg;
    DebugMessageFile = "spo_alert_syslog.c"; DebugMessageLine = 665; DebugMessageFunc(0x00000020, "AlertSyslogRestartFunc\n");;
    if(data)
        free(data);
}


AlertSyslogSetup

decompiled_code:
__int64 AlertSyslogSetup()
{
RegisterOutputPlugin("alert_syslog", 1LL, AlertSyslogInit);
DebugMessageFile = "spo_alert_syslog.c";
DebugMessageLine = 104;
return DebugMessageFunc(1LL, "Output plugin: Alert-Syslog is setup...\n");
}

canonical_decompiled_code:
__int64 func6()
{
RegisterOutputPlugin("alert_syslog", 1LL, AlertSyslogInit);
DebugMessageFile = "spo_alert_syslog.c";
DebugMessageLine = 104;
return DebugMessageFunc(1LL, "Output plugin: Alert-Syslog is setup...\n");
}

original_code:
void AlertSyslogSetup(void)
{
    RegisterOutputPlugin("alert_syslog", OUTPUT_TYPE_FLAG__ALERT, AlertSyslogInit);
    DebugMessageFile = "spo_alert_syslog.c"; DebugMessageLine = 104; DebugMessageFunc(0x00000001,"Output plugin: Alert-Syslog is setup...\n");;
}

canonical_original_code:
void AlertSyslogSetup()
{
    RegisterOutputPlugin("alert_syslog", OUTPUT_TYPE_FLAG__ALERT, AlertSyslogInit);
    DebugMessageFile = "spo_alert_syslog.c"; DebugMessageLine = 104; DebugMessageFunc(0x00000001,"Output plugin: Alert-Syslog is setup...\n");;
}


AlertSyslogInit

decompiled_code:
__int64 __fastcall AlertSyslogInit(__int64 a1)
{
int *v1; // rbx

DebugMessageFile = "spo_alert_syslog.c";
DebugMessageLine = 122;
DebugMessageFunc(1LL, "Output: Alert-Syslog Initialized\n");
v1 = ParseSyslogArgs(a1);
if ( (unsigned int)BcDaemonMode() )
v1[2] |= 1u;
openlog("snort", v1[2], *v1);
DebugMessageFile = "spo_alert_syslog.c";
DebugMessageLine = 132;
DebugMessageFunc(1LL, "Linking syslog alert function to call list...\n");
AddFuncToOutputList(AlertSyslog, 1LL, v1);
AddFuncToCleanExitList(AlertSyslogCleanExit, v1);
return AddFuncToRestartList(AlertSyslogRestart, v1);
}

canonical_decompiled_code:
__int64 __fastcall func7(__int64 a1)
{
int *v1; // rbx

DebugMessageFile = "spo_alert_syslog.c";
DebugMessageLine = 122;
DebugMessageFunc(1LL, "Output: Alert-Syslog Initialized\n");
v1 = ParseSyslogArgs(a1);
if ( (unsigned int)func0() )
v1[2] |= 1u;
openlog("snort", v1[2], *v1);
DebugMessageFile = "spo_alert_syslog.c";
DebugMessageLine = 132;
DebugMessageFunc(1LL, "Linking syslog alert function to call list...\n");
AddFuncToOutputList(AlertSyslog, 1LL, v1);
AddFuncToCleanExitList(AlertSyslogCleanExit, v1);
return AddFuncToRestartList(AlertSyslogRestart, v1);
}

original_code:
void AlertSyslogInit(char *args)
{
    SyslogData *data;
    DebugMessageFile = "spo_alert_syslog.c"; DebugMessageLine = 122; DebugMessageFunc(0x00000001, "Output: Alert-Syslog Initialized\n");;
    data = ParseSyslogArgs(args);
    if (BcDaemonMode())
        data->options |= 0x01;
    openlog("snort", data->options, data->facility);
    DebugMessageFile = "spo_alert_syslog.c"; DebugMessageLine = 132; DebugMessageFunc(0x00000001,"Linking syslog alert function to call list...\n");;
    AddFuncToOutputList(AlertSyslog, OUTPUT_TYPE__ALERT, data);
    AddFuncToCleanExitList(AlertSyslogCleanExit, data);
    AddFuncToRestartList(AlertSyslogRestart, data);
}

canonical_original_code:
void AlertSyslogInit(char *args)
{
    struct _SyslogData *data;
    DebugMessageFile = "spo_alert_syslog.c"; DebugMessageLine = 122; DebugMessageFunc(0x00000001, "Output: Alert-Syslog Initialized\n");;
    data = ParseSyslogArgs(args);
    if (BcDaemonMode())
        data->options |= 0x01;
    openlog("snort", data->options, data->facility);
    DebugMessageFile = "spo_alert_syslog.c"; DebugMessageLine = 132; DebugMessageFunc(0x00000001,"Linking syslog alert function to call list...\n");;
    AddFuncToOutputList(AlertSyslog, OUTPUT_TYPE__ALERT, data);
    AddFuncToCleanExitList(AlertSyslogCleanExit, data);
    AddFuncToRestartList(AlertSyslogRestart, data);
}

variable_types:
args
char *


AlertCuSetup

decompiled_code:
__int64 AlertCuSetup()
{
RegisterOutputPlugin("alert_cu", 1LL, AlertCuInit);
DebugMessageFile = "spo_alert_cu.c";
DebugMessageLine = 72;
return DebugMessageFunc(1LL, "**** Output plugin: AlertCu is setup...\n");
}

canonical_decompiled_code:
__int64 func4()
{
RegisterOutputPlugin("alert_cu", 1LL, AlertCuInit);
DebugMessageFile = "spo_alert_cu.c";
DebugMessageLine = 72;
return DebugMessageFunc(1LL, "**** Output plugin: AlertCu is setup...\n");
}

original_code:
void AlertCuSetup(void)
{
    RegisterOutputPlugin("alert_cu", OUTPUT_TYPE_FLAG__ALERT, AlertCuInit);
    DebugMessageFile = "spo_alert_cu.c"; DebugMessageLine = 72; DebugMessageFunc(0x00000001,"**** Output plugin: AlertCu is setup...\n");;
}

canonical_original_code:
void AlertCuSetup()
{
    RegisterOutputPlugin("alert_cu", OUTPUT_TYPE_FLAG__ALERT, AlertCuInit);
    DebugMessageFile = "spo_alert_cu.c"; DebugMessageLine = 72; DebugMessageFunc(0x00000001,"**** Output plugin: AlertCu is setup...\n");;
}


decompiled_code:
__int64 Unified2CleanExitFunc()
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 238;
return DebugMessageFunc(32LL, "Unified2CleanExitFunc\n");
}

canonical_decompiled_code:
__int64 func0()
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 238;
return DebugMessageFunc(32LL, "Unified2CleanExitFunc\n");
}

original_code:
void Unified2CleanExitFunc(int signal, void *arg)
{
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 238; DebugMessageFunc(0x00000020,"Unified2CleanExitFunc\n");;
}


decompiled_code:
__int64 Unified2RestartFunc()
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 243;
return DebugMessageFunc(32LL, "Unified2RestartFunc\n");
}

canonical_decompiled_code:
__int64 func1()
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 243;
return DebugMessageFunc(32LL, "Unified2RestartFunc\n");
}

original_code:
void Unified2RestartFunc(int signal, void *arg)
{
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 243; DebugMessageFunc(0x00000020,"Unified2RestartFunc\n");;
}


decompiled_code:
__int64 Unified2Init()
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 105;
DebugMessageFunc(1LL, "Linking UnifiedLog functions to call lists...\n");
AddReadRecordHeaderFuncToInputList("unified2", Unified2ReadRecordHeader);
AddReadRecordFuncToInputList("unified2", Unified2ReadRecord);
AddFuncToCleanExitList(Unified2CleanExitFunc, 0LL);
return AddFuncToRestartList(Unified2RestartFunc, 0LL);
}

canonical_decompiled_code:
__int64 func2()
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 105;
DebugMessageFunc(1LL, "Linking UnifiedLog functions to call lists...\n");
AddReadRecordHeaderFuncToInputList("unified2", Unified2ReadRecordHeader);
AddReadRecordFuncToInputList("unified2", Unified2ReadRecord);
AddFuncToCleanExitList(Unified2CleanExitFunc, 0LL);
return AddFuncToRestartList(Unified2RestartFunc, 0LL);
}

original_code:
void Unified2Init(char *args)
{
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 105; DebugMessageFunc(0x00000001,"Linking UnifiedLog functions to call lists...\n");;
    AddReadRecordHeaderFuncToInputList("unified2", Unified2ReadRecordHeader);
    AddReadRecordFuncToInputList("unified2", Unified2ReadRecord);
    AddFuncToCleanExitList(Unified2CleanExitFunc, ((void *)0));
    AddFuncToRestartList(Unified2RestartFunc, ((void *)0));
}


decompiled_code:
__int64 __fastcall Unified2ReadRecordHeader(__int64 a1)
{
__off_t v1; // rax
ssize_t v2; // rax
ssize_t v3; // rdx
unsigned int v4; // esi
int *v6; // rax
char *v7; // rax
unsigned int *v8; // r12
unsigned int v9; // ebp
unsigned int v10; // eax

if ( !*(_QWORD *)(a1 + 1072) )
*(_QWORD *)(a1 + 1072) = SnortAlloc(8LL);
v1 = lseek(*(_DWORD *)(a1 + 8), 0LL, 1);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 133;
DebugMessageFunc(32LL, "Header: Reading at byte position %u\n", v1);
v2 = read(
*(_DWORD *)(a1 + 8),
(void *)(*(_QWORD *)(a1 + 1072) + *(unsigned int *)(a1 + 1052)),
8LL - *(unsigned int *)(a1 + 1052));
if ( v2 == -1 )
{
v6 = _errno_location();
v7 = strerror(*v6);
LogMessage("ERROR: Read error: %s\n", v7);
v4 = 34;
}
else
{
v3 = v2 + *(unsigned int *)(a1 + 1052);
if ( v3 == 8 )
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 155;
v8 = *(unsigned int **)(a1 + 1072);
v9 = _bswap_32(v8[1]);
v10 = _bswap_32(*v8);
DebugMessageFunc(32LL, "Header: Type=%u (%u bytes)\n", v10, v9);
*(_DWORD *)(a1 + 1052) = 0;
v4 = 0;
}
else
{
v4 = 32;
if ( v3 )
{
*(_DWORD *)(a1 + 1052) += v2;
v4 = 33;
}
}
}
return v4;
}

canonical_decompiled_code:
__int64 __fastcall func4(__int64 a1)
{
__off_t v1; // rax
ssize_t v2; // rax
ssize_t v3; // rdx
unsigned int v4; // esi
int *v6; // rax
char *v7; // rax
unsigned int *v8; // r12
unsigned int v9; // ebp
unsigned int v10; // eax

if ( !*(_QWORD *)(a1 + 1072) )
*(_QWORD *)(a1 + 1072) = SnortAlloc(8LL);
v1 = lseek(*(_DWORD *)(a1 + 8), 0LL, 1);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 133;
DebugMessageFunc(32LL, "Header: Reading at byte position %u\n", v1);
v2 = read(
*(_DWORD *)(a1 + 8),
(void *)(*(_QWORD *)(a1 + 1072) + *(unsigned int *)(a1 + 1052)),
8LL - *(unsigned int *)(a1 + 1052));
if ( v2 == -1 )
{
v6 = _errno_location();
v7 = strerror(*v6);
LogMessage("ERROR: Read error: %s\n", v7);
v4 = 34;
}
else
{
v3 = v2 + *(unsigned int *)(a1 + 1052);
if ( v3 == 8 )
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 155;
v8 = *(unsigned int **)(a1 + 1072);
v9 = func3(v8[1]);
v10 = func3(*v8);
DebugMessageFunc(32LL, "Header: Type=%u (%u bytes)\n", v10, v9);
*(_DWORD *)(a1 + 1052) = 0;
v4 = 0;
}
else
{
v4 = 32;
if ( v3 )
{
*(_DWORD *)(a1 + 1052) += v2;
v4 = 33;
}
}
}
return v4;
}

original_code:
int Unified2ReadRecordHeader(void *sph)
{
    ssize_t bytes_read;
    Spooler *spooler = (Spooler *)sph;
    if( ((void *)0) == spooler->record.header )
    {
        spooler->record.header = SnortAlloc(sizeof(Unified2RecordHeader));
    }
    int position = lseek(spooler->fd, 0, 1);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 133; DebugMessageFunc(0x00000020,"Header: Reading at byte position %u\n", position);;
    bytes_read = read( spooler->fd, spooler->record.header + spooler->offset, sizeof(Unified2RecordHeader) - spooler->offset);
    if (bytes_read == -1)
    {
        LogMessage("ERROR: Read error: %s\n", strerror((*__errno_location ())));
        return 34;
    }
    if (bytes_read + spooler->offset != sizeof(Unified2RecordHeader))
    {
        if(bytes_read + spooler->offset == 0)
        {
            return 32;
        }
        spooler->offset += bytes_read;
        return 33;
    }
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 155; DebugMessageFunc(0x00000020,"Header: Type=%u (%u bytes)\n", ntohl(((Unified2RecordHeader *)spooler->record.header)->type), ntohl(((Unified2RecordHeader *)spooler->record.header)->length));;
    spooler->offset = 0;
    return 0;
}

canonical_original_code:
int Unified2ReadRecordHeader(void *sph)
{
    long bytes_read;
    struct _Spooler *spooler = (Spooler *)sph;
    if( ((void *)0) == spooler->record.header )
    {
        spooler->record.header = SnortAlloc(sizeof(Unified2RecordHeader));
    }
    int position = lseek(spooler->fd, 0, 1);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 133; DebugMessageFunc(0x00000020,"Header: Reading at byte position %u\n", position);;
    bytes_read = read( spooler->fd, spooler->record.header + spooler->offset, sizeof(Unified2RecordHeader) - spooler->offset);
    if (bytes_read == -1)
    {
        LogMessage("ERROR: Read error: %s\n", strerror((*__errno_location ())));
        return 34;
    }
    if (bytes_read + spooler->offset != sizeof(Unified2RecordHeader))
    {
        if(bytes_read + spooler->offset == 0)
        {
            return 32;
        }
        spooler->offset += bytes_read;
        return 33;
    }
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 155; DebugMessageFunc(0x00000020,"Header: Type=%u (%u bytes)\n", ntohl(((struct _Unified2RecordHeader *)spooler->record.header)->type), ntohl(((struct _Unified2RecordHeader *)spooler->record.header)->length));;
    spooler->offset = 0;
    return 0;
}

variable_types:
sph
void *

variable_types: struct _Spooler { struct _InputFuncNode { char *keyword; int configured_flag; void *arg; int (*readRecordHeader)(void *); int (*readRecord)(void *); struct _InputFuncNode *next; } *ifn; int fd; char filepath[1024]; long timestamp; unsigned int state; unsigned int offset; unsigned int record_idx; unsigned int magic; void *header; struct _Record { void *header; void *data; struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *pkt; } record; struct _EventRecordNode { unsigned int type; void *data; unsigned char used; struct _EventRecordNode *next; } *event_cache; unsigned int events_cached; struct _PacketRecordNode { struct _Packet *data; struct _PacketRecordNode *next; } *packet_cache; unsigned int packets_cached; } *

variable_types: position int

return_type: int

user_defined_types: struct _Spooler { struct _InputFuncNode *ifn; int fd; char filepath[1024]; long timestamp; unsigned int state; unsigned int offset; unsigned int record_idx; unsigned int magic; void *header; struct _Record record; struct _EventRecordNode *event_cache; unsigned int events_cached; struct _PacketRecordNode *packet_cache; unsigned int packets_cached; }

user_defined_types: struct _Unified2RecordHeader { unsigned int type; unsigned int length; }

user_defined_types: struct _Record { void *header; void *data; struct _Packet *pkt; }


decompiled_code:
__int64 Unified2Setup()
{
RegisterInputPlugin("unified2", Unified2Init);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 97;
return DebugMessageFunc(1LL, "Input plugin: Unified2 is setup...\n");
}

canonical_decompiled_code:
__int64 func6()
{
RegisterInputPlugin("unified2", Unified2Init);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 97;
return DebugMessageFunc(1LL, "Input plugin: Unified2 is setup...\n");
}

original_code:
void Unified2Setup(void)
{
    RegisterInputPlugin("unified2", Unified2Init);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 97; DebugMessageFunc(0x00000001,"Input plugin: Unified2 is setup...\n");;
}

canonical_original_code:
void Unified2Setup()
{
    RegisterInputPlugin("unified2", Unified2Init);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 97; DebugMessageFunc(0x00000001,"Input plugin: Unified2 is setup...\n");;
}


decompiled_code:
void __fastcall Unified2PrintEventCommonRecord(unsigned int *a1)
{
unsigned int v1; // eax
unsigned int v2; // eax
unsigned int v3; // eax
unsigned int v4; // eax
unsigned int v5; // eax
unsigned int v6; // eax
unsigned int v7; // eax
unsigned int v8; // eax
unsigned int v9; // eax

if ( a1 )
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 252;
DebugMessageFunc(32LL, "Type: Event -------------------------------------------\n");
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 254;
v1 = _bswap_32(*a1);
DebugMessageFunc(32LL, " sensor_id = %d\n", v1);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 256;
v2 = _bswap_32(a1[1]);
DebugMessageFunc(32LL, " event_id = %d\n", v2);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 258;
v3 = _bswap_32(a1[2]);
DebugMessageFunc(32LL, " event_second = %lu\n", v3);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 260;
v4 = _bswap_32(a1[3]);
DebugMessageFunc(32LL, " event_microsecond = %lu\n", v4);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 262;
v5 = _bswap_32(a1[5]);
DebugMessageFunc(32LL, " generator_id = %d\n", v5);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 264;
v6 = _bswap_32(a1[4]);
DebugMessageFunc(32LL, " signature_id = %d\n", v6);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 266;
v7 = _bswap_32(a1[6]);
DebugMessageFunc(32LL, " signature_revision = %d\n", v7);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 268;
v8 = _bswap_32(a1[7]);
DebugMessageFunc(32LL, " classification_id = %d\n", v8);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 270;
v9 = _bswap_32(a1[8]);
DebugMessageFunc(32LL, " priority_id = %d\n", v9);
}
}

canonical_decompiled_code:
void __fastcall func7(unsigned int *a1)
{
unsigned int v1; // eax
unsigned int v2; // eax
unsigned int v3; // eax
unsigned int v4; // eax
unsigned int v5; // eax
unsigned int v6; // eax
unsigned int v7; // eax
unsigned int v8; // eax
unsigned int v9; // eax

if ( a1 )
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 252;
DebugMessageFunc(32LL, "Type: Event -------------------------------------------\n");
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 254;
v1 = func3(*a1);
DebugMessageFunc(32LL, " sensor_id = %d\n", v1);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 256;
v2 = func3(a1[1]);
DebugMessageFunc(32LL, " event_id = %d\n", v2);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 258;
v3 = func3(a1[2]);
DebugMessageFunc(32LL, " event_second = %lu\n", v3);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 260;
v4 = func3(a1[3]);
DebugMessageFunc(32LL, " event_microsecond = %lu\n", v4);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 262;
v5 = func3(a1[5]);
DebugMessageFunc(32LL, " generator_id = %d\n", v5);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 264;
v6 = func3(a1[4]);
DebugMessageFunc(32LL, " signature_id = %d\n", v6);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 266;
v7 = func3(a1[6]);
DebugMessageFunc(32LL, " signature_revision = %d\n", v7);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 268;
v8 = func3(a1[7]);
DebugMessageFunc(32LL, " classification_id = %d\n", v8);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 270;
v9 = func3(a1[8]);
DebugMessageFunc(32LL, " priority_id = %d\n", v9);
}
}

original_code:
void Unified2PrintEventCommonRecord(Unified2EventCommon *evt)
{
    if(evt == ((void *)0))
        return;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 252; DebugMessageFunc(0x00000020, "Type: Event -------------------------------------------\n");;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 254; DebugMessageFunc(0x00000020, "  sensor_id          = %d\n", ntohl(evt->sensor_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 256; DebugMessageFunc(0x00000020, "  event_id           = %d\n", ntohl(evt->event_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 258; DebugMessageFunc(0x00000020, "  event_second       = %lu\n", ntohl(evt->event_second));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 260; DebugMessageFunc(0x00000020, "  event_microsecond  = %lu\n", ntohl(evt->event_microsecond));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 262; DebugMessageFunc(0x00000020, "  generator_id       = %d\n", ntohl(evt->generator_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 264; DebugMessageFunc(0x00000020, "  signature_id       = %d\n", ntohl(evt->signature_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 266; DebugMessageFunc(0x00000020, "  signature_revision = %d\n", ntohl(evt->signature_revision));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 268; DebugMessageFunc(0x00000020, "  classification_id  = %d\n", ntohl(evt->classification_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 270; DebugMessageFunc(0x00000020, "  priority_id        = %d\n", ntohl(evt->priority_id));;
}

canonical_original_code:
void Unified2PrintEventCommonRecord(struct _Unified2EventCommon *evt)
{
    if(evt == ((void *)0))
        return;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 252; DebugMessageFunc(0x00000020, "Type: Event -------------------------------------------\n");;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 254; DebugMessageFunc(0x00000020, "  sensor_id          = %d\n", ntohl(evt->sensor_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 256; DebugMessageFunc(0x00000020, "  event_id           = %d\n", ntohl(evt->event_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 258; DebugMessageFunc(0x00000020, "  event_second       = %lu\n", ntohl(evt->event_second));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 260; DebugMessageFunc(0x00000020, "  event_microsecond  = %lu\n", ntohl(evt->event_microsecond));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 262; DebugMessageFunc(0x00000020, "  generator_id       = %d\n", ntohl(evt->generator_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 264; DebugMessageFunc(0x00000020, "  signature_id       = %d\n", ntohl(evt->signature_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 266; DebugMessageFunc(0x00000020, "  signature_revision = %d\n", ntohl(evt->signature_revision));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 268; DebugMessageFunc(0x00000020, "  classification_id  = %d\n", ntohl(evt->classification_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 270; DebugMessageFunc(0x00000020, "  priority_id        = %d\n", ntohl(evt->priority_id));;
}

variable_types: struct _Unified2EventCommon { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int event_microsecond; unsigned int signature_id; unsigned int generator_id; unsigned int signature_revision; unsigned int classification_id; unsigned int priority_id; } *


decompiled_code:
void __fastcall Unified2PrintEventRecord(__int64 a1)
{
unsigned __int16 v1; // ax
unsigned __int16 v2; // ax
char v3[16]; // [rsp-10h] [rbp-28h] BYREF
char buf[24]; // [rsp+0h] [rbp-18h] BYREF

if ( a1 )
{
Unified2PrintEventCommonRecord((unsigned int *)a1);
inet_ntop(2, (const void *)(a1 + 36), buf, 0x10u);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 285;
DebugMessageFunc(32LL, " ip_source = %s\n", buf);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 288;
v1 = _bswap_16(*(_WORD *)(a1 + 44));
DebugMessageFunc(32LL, " sport_itype = %d\n", v1);
inet_ntop(2, (const void *)(a1 + 40), v3, 0x10u);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 291;
DebugMessageFunc(32LL, " ip_destination = %s\n", v3);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 293;
v2 = _bswap_16(*(_WORD *)(a1 + 46));
DebugMessageFunc(32LL, " dport_icode = %d\n", v2);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 296;
DebugMessageFunc(32LL, " ip_protocol = %d\n", *(unsigned __int8 *)(a1 + 48));
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 298;
DebugMessageFunc(32LL, " impact = %d\n", *(unsigned __int8 *)(a1 + 49));
}
}

canonical_decompiled_code:
void __fastcall func8(__int64 a1)
{
unsigned __int16 v1; // ax
unsigned __int16 v2; // ax
char v3[16]; // [rsp-10h] [rbp-28h] BYREF
char buf[24]; // [rsp+0h] [rbp-18h] BYREF

if ( a1 )
{
func7((unsigned int *)a1);
inet_ntop(2, (const void *)(a1 + 36), buf, 0x10u);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 285;
DebugMessageFunc(32LL, " ip_source = %s\n", buf);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 288;
v1 = func5(*(_WORD *)(a1 + 44));
DebugMessageFunc(32LL, " sport_itype = %d\n", v1);
inet_ntop(2, (const void *)(a1 + 40), v3, 0x10u);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 291;
DebugMessageFunc(32LL, " ip_destination = %s\n", v3);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 293;
v2 = func5(*(_WORD *)(a1 + 46));
DebugMessageFunc(32LL, " dport_icode = %d\n", v2);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 296;
DebugMessageFunc(32LL, " ip_protocol = %d\n", *(unsigned __int8 *)(a1 + 48));
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 298;
DebugMessageFunc(32LL, " impact = %d\n", *(unsigned __int8 *)(a1 + 49));
}
}

original_code:
void Unified2PrintEventRecord(Unified2IDSEvent_legacy *evt)
{
    char sip4[16];
    char dip4[16];
    if(evt == ((void *)0))
        return;
    Unified2PrintEventCommonRecord((Unified2EventCommon *)evt);
    inet_ntop(2, &(evt->ip_source), sip4, 16);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 285; DebugMessageFunc(0x00000020, "  ip_source          = %s\n", sip4);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 288; DebugMessageFunc(0x00000020, "  sport_itype        = %d\n", ntohs(evt->sport_itype));;
    inet_ntop(2, &(evt->ip_destination), dip4, 16);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 291; DebugMessageFunc(0x00000020, "  ip_destination     = %s\n", dip4);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 293; DebugMessageFunc(0x00000020, "  dport_icode        = %d\n", ntohs(evt->dport_icode));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 296; DebugMessageFunc(0x00000020, "  ip_protocol        = %d\n", evt->protocol);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 298; DebugMessageFunc(0x00000020, "  impact             = %d\n", evt->impact_flag);;
}

canonical_original_code:
void Unified2PrintEventRecord(struct Unified2IDSEvent_legacy *evt)
{
    char sip4[16];
    char dip4[16];
    if(evt == ((void *)0))
        return;
    Unified2PrintEventCommonRecord((struct _Unified2EventCommon *)evt);
    inet_ntop(2, &(evt->ip_source), sip4, 16);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 285; DebugMessageFunc(0x00000020, "  ip_source          = %s\n", sip4);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 288; DebugMessageFunc(0x00000020, "  sport_itype        = %d\n", ntohs(evt->sport_itype));;
    inet_ntop(2, &(evt->ip_destination), dip4, 16);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 291; DebugMessageFunc(0x00000020, "  ip_destination     = %s\n", dip4);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 293; DebugMessageFunc(0x00000020, "  dport_icode        = %d\n", ntohs(evt->dport_icode));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 296; DebugMessageFunc(0x00000020, "  ip_protocol        = %d\n", evt->protocol);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 298; DebugMessageFunc(0x00000020, "  impact             = %d\n", evt->impact_flag);;
}

variable_types: struct Unified2IDSEvent_legacy { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int event_microsecond; unsigned int signature_id; unsigned int generator_id; unsigned int signature_revision; unsigned int classification_id; unsigned int priority_id; unsigned int ip_source; unsigned int ip_destination; unsigned short sport_itype; unsigned short dport_icode; unsigned char protocol; unsigned char impact_flag; unsigned char impact; unsigned char blocked; } *


decompiled_code:
void __fastcall Unified2PrintEvent6Record(__int64 a1)
{
unsigned __int16 v1; // ax
unsigned __int16 v2; // ax
char v3[48]; // [rsp-30h] [rbp-68h] BYREF
char buf[56]; // [rsp+0h] [rbp-38h] BYREF

if ( a1 )
{
Unified2PrintEventCommonRecord((unsigned int *)a1);
inet_ntop(10, (const void *)(a1 + 36), buf, 0x2Eu);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 313;
DebugMessageFunc(32LL, " ip_source = %s\n", buf);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 316;
v1 = _bswap_16(*(_WORD *)(a1 + 68));
DebugMessageFunc(32LL, " sport_itype = %d\n", v1);
inet_ntop(10, (const void *)(a1 + 52), v3, 0x2Eu);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 319;
DebugMessageFunc(32LL, " ip_destination = %s\n", v3);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 321;
v2 = _bswap_16(*(_WORD *)(a1 + 70));
DebugMessageFunc(32LL, " dport_icode = %d\n", v2);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 324;
DebugMessageFunc(32LL, " ip_protocol = %d\n", *(unsigned __int8 *)(a1 + 72));
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 326;
DebugMessageFunc(32LL, " impact = %d\n", *(unsigned __int8 *)(a1 + 73));
}
}

canonical_decompiled_code:
void __fastcall func9(__int64 a1)
{
unsigned __int16 v1; // ax
unsigned __int16 v2; // ax
char v3[48]; // [rsp-30h] [rbp-68h] BYREF
char buf[56]; // [rsp+0h] [rbp-38h] BYREF

if ( a1 )
{
func7((unsigned int *)a1);
inet_ntop(10, (const void *)(a1 + 36), buf, 0x2Eu);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 313;
DebugMessageFunc(32LL, " ip_source = %s\n", buf);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 316;
v1 = func5(*(_WORD *)(a1 + 68));
DebugMessageFunc(32LL, " sport_itype = %d\n", v1);
inet_ntop(10, (const void *)(a1 + 52), v3, 0x2Eu);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 319;
DebugMessageFunc(32LL, " ip_destination = %s\n", v3);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 321;
v2 = func5(*(_WORD *)(a1 + 70));
DebugMessageFunc(32LL, " dport_icode = %d\n", v2);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 324;
DebugMessageFunc(32LL, " ip_protocol = %d\n", *(unsigned __int8 *)(a1 + 72));
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 326;
DebugMessageFunc(32LL, " impact = %d\n", *(unsigned __int8 *)(a1 + 73));
}
}

original_code:
void Unified2PrintEvent6Record(Unified2IDSEventIPv6_legacy *evt)
{
    char sip6[46];
    char dip6[46];
    if(evt == ((void *)0))
        return;
    Unified2PrintEventCommonRecord((Unified2EventCommon *)evt);
    inet_ntop(10, &(evt->ip_source), sip6, 46);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 313; DebugMessageFunc(0x00000020, "  ip_source          = %s\n", sip6);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 316; DebugMessageFunc(0x00000020, "  sport_itype        = %d\n", ntohs(evt->sport_itype));;
    inet_ntop(10, &(evt->ip_destination), dip6, 46);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 319; DebugMessageFunc(0x00000020, "  ip_destination     = %s\n", dip6);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 321; DebugMessageFunc(0x00000020, "  dport_icode        = %d\n", ntohs(evt->dport_icode));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 324; DebugMessageFunc(0x00000020, "  ip_protocol        = %d\n", evt->protocol);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 326; DebugMessageFunc(0x00000020, "  impact             = %d\n", evt->impact_flag);;
}

canonical_original_code:
void Unified2PrintEvent6Record(struct Unified2IDSEventIPv6_legacy *evt)
{
    char sip6[46];
    char dip6[46];
    if(evt == ((void *)0))
        return;
    Unified2PrintEventCommonRecord((struct _Unified2EventCommon *)evt);
    inet_ntop(10, &(evt->ip_source), sip6, 46);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 313; DebugMessageFunc(0x00000020, "  ip_source          = %s\n", sip6);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 316; DebugMessageFunc(0x00000020, "  sport_itype        = %d\n", ntohs(evt->sport_itype));;
    inet_ntop(10, &(evt->ip_destination), dip6, 46);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 319; DebugMessageFunc(0x00000020, "  ip_destination     = %s\n", dip6);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 321; DebugMessageFunc(0x00000020, "  dport_icode        = %d\n", ntohs(evt->dport_icode));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 324; DebugMessageFunc(0x00000020, "  ip_protocol        = %d\n", evt->protocol);;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 326; DebugMessageFunc(0x00000020, "  impact             = %d\n", evt->impact_flag);;
}

variable_types: struct Unified2IDSEventIPv6_legacy { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int event_microsecond; unsigned int signature_id; unsigned int generator_id; unsigned int signature_revision; unsigned int classification_id; unsigned int priority_id; struct in6_addr { union { unsigned char __u6_addr8[16]; unsigned short __u6_addr16[8]; unsigned int __u6_addr32[4]; } __in6_u; } ip_source; struct in6_addr ip_destination; unsigned short sport_itype; unsigned short dport_icode; unsigned char protocol; unsigned char impact_flag; unsigned char impact; unsigned char blocked; } *

user_defined_types: struct Unified2IDSEventIPv6_legacy { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int event_microsecond; unsigned int signature_id; unsigned int generator_id; unsigned int signature_revision; unsigned int classification_id; unsigned int priority_id; struct in6_addr ip_source; struct in6_addr ip_destination; unsigned short sport_itype; unsigned short dport_icode; unsigned char protocol; unsigned char impact_flag; unsigned char impact; unsigned char blocked; }


decompiled_code:
void __fastcall Unified2PrintPacketRecord(__int64 a1)
{
unsigned int v1; // eax
unsigned int v2; // eax
unsigned int v3; // eax
unsigned int v4; // eax
unsigned int v5; // eax
unsigned int v6; // eax
unsigned int v7; // eax

if ( a1 )
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 335;
DebugMessageFunc(32LL, "Type: Packet ------------------------------------------\n");
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 337;
v1 = _bswap_32(*(_DWORD *)a1);
DebugMessageFunc(32LL, " sensor_id = %d\n", v1);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 339;
v2 = _bswap_32(*(_DWORD *)(a1 + 4));
DebugMessageFunc(32LL, " event_id = %d\n", v2);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 341;
v3 = _bswap_32(*(_DWORD *)(a1 + 8));
DebugMessageFunc(32LL, " event_second = %lu\n", v3);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 343;
v4 = _bswap_32(*(_DWORD *)(a1 + 20));
DebugMessageFunc(32LL, " linktype = %d\n", v4);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 345;
v5 = _bswap_32(*(_DWORD *)(a1 + 12));
DebugMessageFunc(32LL, " packet_second = %lu\n", v5);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 347;
v6 = _bswap_32(*(_DWORD *)(a1 + 16));
DebugMessageFunc(32LL, " packet_microsecond = %lu\n", v6);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 349;
v7 = _bswap_32(*(_DWORD *)(a1 + 24));
DebugMessageFunc(32LL, " packet_length = %d\n", v7);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 351;
DebugMessageFunc(
32LL,
" packet = %02x %02x %02x %02x\n",
*(unsigned __int8 *)(a1 + 29),
*(unsigned __int8 *)(a1 + 30),
*(unsigned __int8 *)(a1 + 31),
*(unsigned __int8 *)(a1 + 32));
}
}

canonical_decompiled_code:
void __fastcall func10(__int64 a1)
{
unsigned int v1; // eax
unsigned int v2; // eax
unsigned int v3; // eax
unsigned int v4; // eax
unsigned int v5; // eax
unsigned int v6; // eax
unsigned int v7; // eax

if ( a1 )
{
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 335;
DebugMessageFunc(32LL, "Type: Packet ------------------------------------------\n");
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 337;
v1 = func3(*(_DWORD *)a1);
DebugMessageFunc(32LL, " sensor_id = %d\n", v1);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 339;
v2 = func3(*(_DWORD *)(a1 + 4));
DebugMessageFunc(32LL, " event_id = %d\n", v2);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 341;
v3 = func3(*(_DWORD *)(a1 + 8));
DebugMessageFunc(32LL, " event_second = %lu\n", v3);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 343;
v4 = func3(*(_DWORD *)(a1 + 20));
DebugMessageFunc(32LL, " linktype = %d\n", v4);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 345;
v5 = func3(*(_DWORD *)(a1 + 12));
DebugMessageFunc(32LL, " packet_second = %lu\n", v5);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 347;
v6 = func3(*(_DWORD *)(a1 + 16));
DebugMessageFunc(32LL, " packet_microsecond = %lu\n", v6);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 349;
v7 = func3(*(_DWORD *)(a1 + 24));
DebugMessageFunc(32LL, " packet_length = %d\n", v7);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 351;
DebugMessageFunc(
32LL,
" packet = %02x %02x %02x %02x\n",
*(unsigned __int8 *)(a1 + 29),
*(unsigned __int8 *)(a1 + 30),
*(unsigned __int8 *)(a1 + 31),
*(unsigned __int8 *)(a1 + 32));
}
}

original_code:
void Unified2PrintPacketRecord(Unified2Packet *pkt)
{
    if(pkt == ((void *)0))
        return;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 335; DebugMessageFunc(0x00000020, "Type: Packet ------------------------------------------\n");;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 337; DebugMessageFunc(0x00000020, "  sensor_id          = %d\n", ntohl(pkt->sensor_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 339; DebugMessageFunc(0x00000020, "  event_id           = %d\n", ntohl(pkt->event_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 341; DebugMessageFunc(0x00000020, "  event_second       = %lu\n", ntohl(pkt->event_second));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 343; DebugMessageFunc(0x00000020, "  linktype           = %d\n", ntohl(pkt->linktype));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 345; DebugMessageFunc(0x00000020, "  packet_second      = %lu\n", ntohl(pkt->packet_second));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 347; DebugMessageFunc(0x00000020, "  packet_microsecond = %lu\n", ntohl(pkt->packet_microsecond));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 349; DebugMessageFunc(0x00000020, "  packet_length      = %d\n", ntohl(pkt->packet_length));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 351; DebugMessageFunc(0x00000020, "  packet             = %02x %02x %02x %02x\n",pkt->packet_data[1], pkt->packet_data[2], pkt->packet_data[3], pkt->packet_data[4]);;
}

canonical_original_code:
void Unified2PrintPacketRecord(struct _Unified2Packet *pkt)
{
    if(pkt == ((void *)0))
        return;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 335; DebugMessageFunc(0x00000020, "Type: Packet ------------------------------------------\n");;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 337; DebugMessageFunc(0x00000020, "  sensor_id          = %d\n", ntohl(pkt->sensor_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 339; DebugMessageFunc(0x00000020, "  event_id           = %d\n", ntohl(pkt->event_id));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 341; DebugMessageFunc(0x00000020, "  event_second       = %lu\n", ntohl(pkt->event_second));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 343; DebugMessageFunc(0x00000020, "  linktype           = %d\n", ntohl(pkt->linktype));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 345; DebugMessageFunc(0x00000020, "  packet_second      = %lu\n", ntohl(pkt->packet_second));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 347; DebugMessageFunc(0x00000020, "  packet_microsecond = %lu\n", ntohl(pkt->packet_microsecond));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 349; DebugMessageFunc(0x00000020, "  packet_length      = %d\n", ntohl(pkt->packet_length));;
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 351; DebugMessageFunc(0x00000020, "  packet             = %02x %02x %02x %02x\n",pkt->packet_data[1], pkt->packet_data[2], pkt->packet_data[3], pkt->packet_data[4]);;
}

variable_types: struct _Unified2Packet { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int packet_second; unsigned int packet_microsecond; unsigned int linktype; unsigned int packet_length; unsigned char packet_data[4]; } *


decompiled_code:
__int64 __fastcall Unified2ReadRecord(__int64 a1)
{
unsigned int *v1; // rbp
unsigned int v2; // er12
__int64 v3; // rbp
__off_t v4; // rax
ssize_t v5; // rax
__int64 result; // rax
int *v7; // rax
char *v8; // rax

v1 = *(unsigned int **)(a1 + 1072);
v2 = _bswap_32(*v1);
v3 = (unsigned int)_bswap_32(v1[1]);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 174;
DebugMessageFunc(32LL, "Reading record type=%u (%u bytes)\n", v2, v3);
if ( !*(_QWORD *)(a1 + 1080) )
*(_QWORD *)(a1 + 1080) = SnortAlloc((unsigned int)v3);
if ( *(_DWORD *)(a1 + 1052) >= (unsigned int)v3 )
return 0xFFFFFFFFLL;
v4 = lseek(*(_DWORD *)(a1 + 8), 0LL, 1);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 187;
DebugMessageFunc(32LL, "Record: Reading at byte position %u\n", v4);
v5 = read(
*(_DWORD *)(a1 + 8),
(void *)(*(_QWORD *)(a1 + 1080) + *(unsigned int *)(a1 + 1052)),
(unsigned int)(v3 - *(_DWORD *)(a1 + 1052)));
if ( v5 == -1 )
{
v7 = _errno_location();
v8 = strerror(*v7);
LogMessage("ERROR: read error: %s\n", v8);
result = 34LL;
}
else if ( v5 + *(unsigned int *)(a1 + 1052) == (unsigned int)v3 )
{
switch ( v2 )
{
case 7u:
Unified2PrintEventRecord(*(_QWORD *)(a1 + 1080));
break;
case 0x48u:
Unified2PrintEvent6Record(*(_QWORD *)(a1 + 1080));
break;
case 2u:
Unified2PrintPacketRecord(*(_QWORD *)(a1 + 1080));
break;
default:
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 223;
DebugMessageFunc(32LL, "No debug available for record type: %u\n", v2);
break;
}
*(_DWORD *)(a1 + 1052) = 0;
result = 0LL;
}
else
{
*(_DWORD *)(a1 + 1052) += v5;
result = 33LL;
}
return result;
}

canonical_decompiled_code:
__int64 __fastcall func11(__int64 a1)
{
unsigned int *v1; // rbp
unsigned int v2; // er12
__int64 v3; // rbp
__off_t v4; // rax
ssize_t v5; // rax
__int64 result; // rax
int *v7; // rax
char *v8; // rax

v1 = *(unsigned int **)(a1 + 1072);
v2 = func3(*v1);
v3 = (unsigned int)func3(v1[1]);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 174;
DebugMessageFunc(32LL, "Reading record type=%u (%u bytes)\n", v2, v3);
if ( !*(_QWORD *)(a1 + 1080) )
*(_QWORD *)(a1 + 1080) = SnortAlloc((unsigned int)v3);
if ( *(_DWORD *)(a1 + 1052) >= (unsigned int)v3 )
return 0xFFFFFFFFLL;
v4 = lseek(*(_DWORD *)(a1 + 8), 0LL, 1);
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 187;
DebugMessageFunc(32LL, "Record: Reading at byte position %u\n", v4);
v5 = read(
*(_DWORD *)(a1 + 8),
(void *)(*(_QWORD *)(a1 + 1080) + *(unsigned int *)(a1 + 1052)),
(unsigned int)(v3 - *(_DWORD *)(a1 + 1052)));
if ( v5 == -1 )
{
v7 = _errno_location();
v8 = strerror(*v7);
LogMessage("ERROR: read error: %s\n", v8);
result = 34LL;
}
else if ( v5 + *(unsigned int *)(a1 + 1052) == (unsigned int)v3 )
{
switch ( v2 )
{
case 7u:
func8(*(_QWORD *)(a1 + 1080));
break;
case 0x48u:
func9(*(_QWORD *)(a1 + 1080));
break;
case 2u:
func10(*(_QWORD *)(a1 + 1080));
break;
default:
DebugMessageFile = "spi_unified2.c";
DebugMessageLine = 223;
DebugMessageFunc(32LL, "No debug available for record type: %u\n", v2);
break;
}
*(_DWORD *)(a1 + 1052) = 0;
result = 0LL;
}
else
{
*(_DWORD *)(a1 + 1052) += v5;
result = 33LL;
}
return result;
}

original_code:
int Unified2ReadRecord(void *sph)
{
    ssize_t bytes_read;
    uint32_t record_type;
    uint32_t record_length;
    Spooler *spooler = (Spooler *)sph;
    record_type = ntohl(((Unified2RecordHeader *)spooler->record.header)->type);
    record_length = ntohl(((Unified2RecordHeader *)spooler->record.header)->length);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 174; DebugMessageFunc(0x00000020,"Reading record type=%u (%u bytes)\n", record_type, record_length);;
    if(!spooler->record.data)
    {
        spooler->record.data = SnortAlloc(record_length);
    }
    if (spooler->offset < record_length)
    {
        int position = lseek(spooler->fd, 0, 1);
        DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 187; DebugMessageFunc(0x00000020,"Record: Reading at byte position %u\n", position);;
        bytes_read = read(spooler->fd, spooler->record.data + spooler->offset,
                    record_length - spooler->offset);
        if (bytes_read == -1)
        {
            LogMessage("ERROR: read error: %s\n", strerror((*__errno_location ())));
            return 34;
        }
        if (bytes_read + spooler->offset != record_length)
        {
            spooler->offset += bytes_read;
            return 33;
        }
        switch (record_type)
        {
            case 7:
                Unified2PrintEventRecord((Unified2IDSEvent_legacy *)spooler->record.data);
                break;
            case 72:
                Unified2PrintEvent6Record((Unified2IDSEventIPv6_legacy *)spooler->record.data);
                break;
            case 2:
                Unified2PrintPacketRecord((Unified2Packet *)spooler->record.data);
                break;
            case 99:
            case 100:
            case 104:
            case 105:
            default:
                DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 223; DebugMessageFunc(0x00000020,"No debug available for record type: %u\n", record_type);;
                break;
        }
        spooler->offset = 0;
        return 0;
    }
    return -1;
}

canonical_original_code:
int Unified2ReadRecord(void *sph)
{
    long bytes_read;
    unsigned int record_type;
    unsigned int record_length;
    struct _Spooler *spooler = (Spooler *)sph;
    record_type = ntohl(((struct _Unified2RecordHeader *)spooler->record.header)->type);
    record_length = ntohl(((struct _Unified2RecordHeader *)spooler->record.header)->length);
    DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 174; DebugMessageFunc(0x00000020,"Reading record type=%u (%u bytes)\n", record_type, record_length);;
    if(!spooler->record.data)
    {
        spooler->record.data = SnortAlloc(record_length);
    }
    if (spooler->offset < record_length)
    {
        int position = lseek(spooler->fd, 0, 1);
        DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 187; DebugMessageFunc(0x00000020,"Record: Reading at byte position %u\n", position);;
        bytes_read = read(spooler->fd, spooler->record.data + spooler->offset,
                    record_length - spooler->offset);
        if (bytes_read == -1)
        {
            LogMessage("ERROR: read error: %s\n", strerror((*__errno_location ())));
            return 34;
        }
        if (bytes_read + spooler->offset != record_length)
        {
            spooler->offset += bytes_read;
            return 33;
        }
        switch (record_type)
        {
            case 7:
                Unified2PrintEventRecord((struct Unified2IDSEvent_legacy *)spooler->record.data);
                break;
            case 72:
                Unified2PrintEvent6Record((struct Unified2IDSEventIPv6_legacy *)spooler->record.data);
                break;
            case 2:
                Unified2PrintPacketRecord((struct _Unified2Packet *)spooler->record.data);
                break;
            case 99:
            case 100:
            case 104:
            case 105:
            default:
                DebugMessageFile = "spi_unified2.c"; DebugMessageLine = 223; DebugMessageFunc(0x00000020,"No debug available for record type: %u\n", record_type);;
                break;
        }
        spooler->offset = 0;
        return 0;
    }
    return -1;
}

user_defined_types: struct Unified2IDSEvent_legacy { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int event_microsecond; unsigned int signature_id; unsigned int generator_id; unsigned int signature_revision; unsigned int classification_id; unsigned int priority_id; unsigned int ip_source; unsigned int ip_destination; unsigned short sport_itype; unsigned short dport_icode; unsigned char protocol; unsigned char impact_flag; unsigned char impact; unsigned char blocked; }

user_defined_types: struct _Unified2Packet { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int packet_second; unsigned int packet_microsecond; unsigned int linktype; unsigned int packet_length; unsigned char packet_data[4]; }

user_defined_types: struct in6_addr { union { unsigned char __u6_addr8[16]; unsigned short __u6_addr16[8]; unsigned int __u6_addr32[4]; } __in6_u; }

user_defined_types: struct _InputFuncNode { char *keyword; int configured_flag; void *arg; int (*readRecordHeader)(void *); int (*readRecord)(void *); struct _InputFuncNode *next; }

user_defined_types: struct _EventRecordNode { unsigned int type; void *data; unsigned char used; struct _EventRecordNode *next; }

user_defined_types: struct _PacketRecordNode { struct _Packet *data; struct _PacketRecordNode *next; }

user_defined_types: struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; }

user_defined_types: struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; }

user_defined_types: struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; }

user_defined_types: struct _EthLlc { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; }

user_defined_types: struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; }

user_defined_types: struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; }

user_defined_types: struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; }

user_defined_types: struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; }

user_defined_types: struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; }

user_defined_types: struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; }

user_defined_types: struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Fddi_llc_other { unsigned char ctrl_fld[1]; }

user_defined_types: struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; }

user_defined_types: struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; }

user_defined_types: struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; }

user_defined_types: struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; }

user_defined_types: struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; }

user_defined_types: struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; }

user_defined_types: struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; }

user_defined_types: struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; }

user_defined_types: struct _Options { unsigned char code; unsigned char len; unsigned char *data; }

user_defined_types: struct _IP6Option { unsigned char type; unsigned char *data; }

user_defined_types: struct timeval { long tv_sec; long tv_usec; }

user_defined_types: struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; }

user_defined_types: struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; }

user_defined_types: struct idseq { unsigned short id; unsigned short seq; }

user_defined_types: struct pmtu { unsigned short ipm_void; unsigned short nextmtu; }

user_defined_types: struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; }

user_defined_types: struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; }

user_defined_types: struct ra_addr { unsigned int addr; unsigned int preference; }


BcAlertInterface

decompiled_code:
__int64 BcAlertInterface()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x200;
}

canonical_decompiled_code:
__int64 func0()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x200;
}

original_code:
static inline int BcAlertInterface(void)
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__ALERT_IFACE;
}

canonical_original_code:
static inline int BcAlertInterface()
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__ALERT_IFACE;
}


BcOutputDataLink

decompiled_code:
__int64 BcOutputDataLink()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x10;
}

canonical_decompiled_code:
__int64 func1()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x10;
}

original_code:
static inline int BcOutputDataLink(void)
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__SHOW_DATA_LINK;
}

canonical_original_code:
static inline int BcOutputDataLink()
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__SHOW_DATA_LINK;
}


AlertFullRestart

decompiled_code:
void __fastcall AlertFullRestart(__int64 a1, _QWORD *a2)
{
AlertFullCleanup(a1, a2, "AlertFullRestart");
}

canonical_decompiled_code:
void __fastcall func3(__int64 a1, _QWORD *a2)
{
func2(a1, a2, "AlertFullRestart");
}

original_code:
static void AlertFullRestart(int signal, void *arg)
{
    AlertFullCleanup(signal, arg, "AlertFullRestart");
}


AlertFullCleanExit

decompiled_code:
void __fastcall AlertFullCleanExit(__int64 a1, _QWORD *a2)
{
AlertFullCleanup(a1, a2, "AlertFullCleanExit");
}

canonical_decompiled_code:
void __fastcall func4(__int64 a1, _QWORD *a2)
{
func2(a1, a2, "AlertFullCleanExit");
}

original_code:
static void AlertFullCleanExit(int signal, void *arg)
{
    AlertFullCleanup(signal, arg, "AlertFullCleanExit");
}


AlertFullSetup

decompiled_code:
__int64 AlertFullSetup()
{
RegisterOutputPlugin("alert_full", 1LL, AlertFullInit);
DebugMessageFile = "spo_alert_full.c";
DebugMessageLine = 110;
return DebugMessageFunc(1LL, "Output plugin: AlertFull is setup...\n");
}

canonical_decompiled_code:
__int64 func9()
{
RegisterOutputPlugin("alert_full", 1LL, AlertFullInit);
DebugMessageFile = "spo_alert_full.c";
DebugMessageLine = 110;
return DebugMessageFunc(1LL, "Output plugin: AlertFull is setup...\n");
}

original_code:
void AlertFullSetup(void)
{
    RegisterOutputPlugin("alert_full", OUTPUT_TYPE_FLAG__ALERT, AlertFullInit);
    DebugMessageFile = "spo_alert_full.c"; DebugMessageLine = 110; DebugMessageFunc(0x00000001,"Output plugin: AlertFull is setup...\n");;
}

canonical_original_code:
void AlertFullSetup()
{
    RegisterOutputPlugin("alert_full", OUTPUT_TYPE_FLAG__ALERT, AlertFullInit);
    DebugMessageFile = "spo_alert_full.c"; DebugMessageLine = 110; DebugMessageFunc(0x00000001,"Output plugin: AlertFull is setup...\n");;
}


LogAsciiCleanExit

decompiled_code:
void LogAsciiCleanExit()
{
;
}

canonical_decompiled_code:
void func0()
{
;
}

original_code:
void LogAsciiCleanExit(int signal, void *arg)
{
    return;
}


LogAsciiRestart

decompiled_code:
void LogAsciiRestart()
{
;
}

canonical_decompiled_code:
void func1()
{
;
}

original_code:
void LogAsciiRestart(int signal, void *arg)
{
    return;
}


LogAsciiInit

decompiled_code:
__int64 LogAsciiInit()
{
DebugMessageFile = "spo_log_ascii.c";
DebugMessageLine = 98;
DebugMessageFunc(4LL, "Output: Ascii logging initialized\n");
AddFuncToOutputList(LogAscii, 2LL, 0LL);
AddFuncToCleanExitList(LogAsciiCleanExit, 0LL);
return AddFuncToRestartList(LogAsciiRestart, 0LL);
}

canonical_decompiled_code:
__int64 func2()
{
DebugMessageFile = "spo_log_ascii.c";
DebugMessageLine = 98;
DebugMessageFunc(4LL, "Output: Ascii logging initialized\n");
AddFuncToOutputList(LogAscii, 2LL, 0LL);
AddFuncToCleanExitList(LogAsciiCleanExit, 0LL);
return AddFuncToRestartList(LogAsciiRestart, 0LL);
}

original_code:
void LogAsciiInit(char *args)
{
    DebugMessageFile = "spo_log_ascii.c"; DebugMessageLine = 98; DebugMessageFunc(0x00000004, "Output: Ascii logging initialized\n");;
    AddFuncToOutputList(LogAscii, OUTPUT_TYPE__LOG, ((void *)0));
    AddFuncToCleanExitList(LogAsciiCleanExit, ((void *)0));
    AddFuncToRestartList(LogAsciiRestart, ((void *)0));
}


LogAsciiSetup

decompiled_code:
__int64 LogAsciiSetup()
{
RegisterOutputPlugin("log_ascii", 2LL, LogAsciiInit);
DebugMessageFile = "spo_log_ascii.c";
DebugMessageLine = 93;
return DebugMessageFunc(4LL, "Output: LogAscii is setup\n");
}

canonical_decompiled_code:
__int64 func4()
{
RegisterOutputPlugin("log_ascii", 2LL, LogAsciiInit);
DebugMessageFile = "spo_log_ascii.c";
DebugMessageLine = 93;
return DebugMessageFunc(4LL, "Output: LogAscii is setup\n");
}

original_code:
void LogAsciiSetup(void)
{
    RegisterOutputPlugin("log_ascii", OUTPUT_TYPE_FLAG__LOG, LogAsciiInit);
    DebugMessageFile = "spo_log_ascii.c"; DebugMessageLine = 93; DebugMessageFunc(0x00000004, "Output: LogAscii is setup\n");;
}

canonical_original_code:
void LogAsciiSetup()
{
    RegisterOutputPlugin("log_ascii", OUTPUT_TYPE_FLAG__LOG, LogAsciiInit);
    DebugMessageFile = "spo_log_ascii.c"; DebugMessageLine = 93; DebugMessageFunc(0x00000004, "Output: LogAscii is setup\n");;
}