AddFuncToPostConfigList

decompiled_code:
void __fastcall AddFuncToPostConfigList(__int64 a1, __int64 a2)
{
__int64 v2; // rbx

v2 = barnyard2_conf_for_parsing;
if ( !barnyard2_conf_for_parsing )
FatalError("%s(%d) Barnyard2 config for parsing is NULL.\n", "plugbase.c", 623LL);
AddFuncToSignalList(a1, a2, (__int64 *)(v2 + 71024));
}

canonical_decompiled_code:
void __fastcall func24(__int64 a1, __int64 a2)
{
__int64 v2; // rbx

v2 = barnyard2_conf_for_parsing;
if ( !barnyard2_conf_for_parsing )
FatalError("%s(%d) Barnyard2 config for parsing is NULL.\n", "plugbase.c", 623LL);
func20(a1, a2, (__int64 *)(v2 + 71024));
}

original_code:
void AddFuncToPostConfigList(PluginSignalFunc func, void *arg)
{
    Barnyard2Config *bc = barnyard2_conf_for_parsing;
    if (bc == ((void *)0))
    {
        FatalError("%s(%d) Barnyard2 config for parsing is NULL.\n",
                   "plugbase.c", 623);
    }
    AddFuncToSignalList(func, arg, &bc->plugin_post_config_funcs);
}

canonical_original_code:
void AddFuncToPostConfigList(void (*func)(int, void *), void *arg)
{
    struct _Barnyard2Config *bc = barnyard2_conf_for_parsing;
    if (bc == ((void *)0))
    {
        FatalError("%s(%d) Barnyard2 config for parsing is NULL.\n",
                   "plugbase.c", 623);
    }
    AddFuncToSignalList(func, arg, &bc->plugin_post_config_funcs);
}

variable_types: struct _Barnyard2Config { enum _RunMode { RUN_MODE__VERSION=1, RUN_MODE__CONTINUOUS=2, RUN_MODE__BATCH=3, RUN_MODE__TEST=4 } run_mode; int run_mode_flags; int run_flags; int output_flags; int logging_flags; struct _VarEntry { char *name; char *value; unsigned char flags; struct _VarEntry *prev; struct _VarEntry *next; } *var_table; int checksums_mode; char ignore_ports[65536]; char *config_file; char *config_dir; char *hostname; char *interface; char *class_file; char *sid_msg_file; char *gen_msg_file; char *reference_file; char *log_dir; char *orig_log_dir; char *chroot_dir; unsigned char verbose; unsigned char localtime; char *bpf_filter; int thiszone; int quiet_flag; int verbose_flag; int verbose_bytedump_flag; int show2hdr_flag; int char_data_flag; int data_flag; int obfuscation_flag; int alert_on_each_packet_in_stream_flag; int logtosyslog_flag; int test_mode_flag; int use_utc; int include_year; int line_buffer_flag; char nostamp; int user_id; int group_id; unsigned int file_mask; unsigned long homenet; unsigned long netmask; unsigned int obfuscation_net; unsigned int obfuscation_mask; int batch_mode_flag; int batch_total_files; char **batch_filelist; int process_new_records_only_flag; struct _Waldo { int fd; char filepath[1024]; unsigned char mode; unsigned char state; struct _WaldoData { char spool_dir[1024]; char spool_filebase[1024]; unsigned int timestamp; unsigned int record_idx; } data; } waldo; char *archive_dir; int daemon_flag; int daemon_restart_flag; char pid_filename[1024]; char pid_path[1024]; char pidfile_suffix[-1]; char create_pid_file; char nolock_pid_file; int done_processing; int restart_flag; int print_version; int usr_signal; int cant_hup_signal; struct _ClassType { char *type; unsigned int id; char *name; unsigned int priority; struct _ClassType *next; } *classifications; struct _ReferenceSystemNode { char *name; char *url; struct _ReferenceSystemNode *next; } *references; struct _InputConfig { char *keyword; char *opts; char *file_name; int file_line; struct _InputConfig *next; } *input_configs; struct _OutputConfig { char *keyword; char *opts; char *file_name; int file_line; struct _OutputConfig *next; } *output_configs; struct _PluginSignalFuncNode { void *arg; void (*func)(int, void *); struct _PluginSignalFuncNode *next; } *plugin_post_config_funcs; } *

user_defined_types: struct _Barnyard2Config { enum _RunMode run_mode; int run_mode_flags; int run_flags; int output_flags; int logging_flags; struct _VarEntry *var_table; int checksums_mode; char ignore_ports[65536]; char *config_file; char *config_dir; char *hostname; char *interface; char *class_file; char *sid_msg_file; char *gen_msg_file; char *reference_file; char *log_dir; char *orig_log_dir; char *chroot_dir; unsigned char verbose; unsigned char localtime; char *bpf_filter; int thiszone; int quiet_flag; int verbose_flag; int verbose_bytedump_flag; int show2hdr_flag; int char_data_flag; int data_flag; int obfuscation_flag; int alert_on_each_packet_in_stream_flag; int logtosyslog_flag; int test_mode_flag; int use_utc; int include_year; int line_buffer_flag; char nostamp; int user_id; int group_id; unsigned int file_mask; unsigned long homenet; unsigned long netmask; unsigned int obfuscation_net; unsigned int obfuscation_mask; int batch_mode_flag; int batch_total_files; char **batch_filelist; int process_new_records_only_flag; struct _Waldo waldo; char *archive_dir; int daemon_flag; int daemon_restart_flag; char pid_filename[1024]; char pid_path[1024]; char pidfile_suffix[-1]; char create_pid_file; char nolock_pid_file; int done_processing; int restart_flag; int print_version; int usr_signal; int cant_hup_signal; struct _ClassType *classifications; struct _ReferenceSystemNode *references; struct _InputConfig *input_configs; struct _OutputConfig *output_configs; struct _PluginSignalFuncNode *plugin_post_config_funcs; }

user_defined_types: struct _Waldo { int fd; char filepath[1024]; unsigned char mode; unsigned char state; struct _WaldoData data; }


FreePluginSigFuncs

decompiled_code:
void __fastcall FreePluginSigFuncs(void *ptr)
{
void *v1; // rbx
void *v2; // rdi

v1 = ptr;
while ( v1 )
{
v2 = v1;
v1 = (void *)*((_QWORD *)v1 + 2);
free(v2);
}
}

canonical_decompiled_code:
void __fastcall func25(void *ptr)
{
void *v1; // rbx
void *v2; // rdi

v1 = ptr;
while ( v1 )
{
v2 = v1;
v1 = (void *)*((_QWORD *)v1 + 2);
free(v2);
}
}

original_code:
void FreePluginSigFuncs(PluginSignalFuncNode *head)
{
    while (head != ((void *)0))
    {
        PluginSignalFuncNode *tmp = head;
        head = head->next;
        free(tmp);
    }
}

canonical_original_code:
void FreePluginSigFuncs(struct _PluginSignalFuncNode *head)
{
    while (head != ((void *)0))
    {
        struct _PluginSignalFuncNode *tmp = head;
        head = head->next;
        free(tmp);
    }
}

variable_types: struct _PluginSignalFuncNode { void *arg; void (*func)(int, void *); struct _PluginSignalFuncNode *next; } *

return_type: void


decompiled_code:
__int64 sfvt_alloc_table()
{
return SnortAlloc(8LL);
}

canonical_decompiled_code:
__int64 func0()
{
return SnortAlloc(8LL);
}

original_code:
vartable_t * sfvt_alloc_table(void)
{
    return (vartable_t *)SnortAlloc(sizeof(vartable_t));
}

canonical_original_code:
struct _vartable_t *sfvt_alloc_table()
{
    return (struct _vartable_t *)SnortAlloc(sizeof(vartable_t));
}

return_type: struct _vartable_t { struct _var_t { enum _modes { SFIP_LIST=0, SFIP_TABLE=1 } mode; struct _ip_node { struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } *ip; struct _ip_node *next; int flags; int addr_flags; } *head; struct _ip_node *neg_head; struct _var_t *next; char *name; } *head; } *

user_defined_types: struct _vartable_t { struct _var_t *head; }

user_defined_types: struct _var_t { enum _modes mode; struct _ip_node *head; struct _ip_node *neg_head; struct _var_t *next; char *name; }

user_defined_types: struct _ip_node { struct _ip *ip; struct _ip_node *next; int flags; int addr_flags; }


original_code:
SFIP_RET sfvt_add_str(vartable_t *table, char *str)
{
    sfip_var_t *var;
    sfip_var_t *swp;
    sfip_var_t *p;
    int ret;
    SFIP_RET status;
    if(!table || !str) return SFIP_FAILURE;
    if( (var = sfvar_alloc(table, str, &status)) == ((void *)0) )
    {
         return status;
    }
    if(!table->head)
    {
        table->head = var;
        return SFIP_SUCCESS;
    }
    if((ret = strcmp(var->name, table->head->name)) < 0)
    {
        var->next = table->head;
        table->head = var;
        return SFIP_SUCCESS;
    }
    else if(ret == 0)
    {
        var->next = table->head->next;
        sfvar_free(table->head);
        table->head = var;
        return SFIP_DUPLICATE;
    }
    if(!table->head->next)
    {
        table->head->next = var;
        return SFIP_SUCCESS;
    }
    else if(!strcmp(var->name, table->head->next->name))
    {
        var->next = table->head->next->next;
        sfvar_free(table->head->next);
        table->head->next = var;
        return SFIP_DUPLICATE;
    }
    for(p = table->head; p->next; p=p->next)
    {
        if((ret = strcmp(var->name, p->next->name)) < 0)
        {
            swp = p->next;
            p->next = var;
            var->next = swp;
            return SFIP_SUCCESS;
        }
        else if(ret == 0)
        {
            var->next = p->next->next;
            sfvar_free(p->next);
            p->next = var;
            return SFIP_DUPLICATE;
        }
    }
    p->next = var;
    return SFIP_SUCCESS;
}

canonical_original_code:
enum _return_values sfvt_add_str(struct _vartable_t *table, char *str)
{
    struct _var_t *var;
    struct _var_t *swp;
    struct _var_t *p;
    int ret;
    enum _return_values status;
    if(!table || !str) return SFIP_FAILURE;
    if( (var = sfvar_alloc(table, str, &status)) == ((void *)0) )
    {
         return status;
    }
    if(!table->head)
    {
        table->head = var;
        return SFIP_SUCCESS;
    }
    if((ret = strcmp(var->name, table->head->name)) < 0)
    {
        var->next = table->head;
        table->head = var;
        return SFIP_SUCCESS;
    }
    else if(ret == 0)
    {
        var->next = table->head->next;
        sfvar_free(table->head);
        table->head = var;
        return SFIP_DUPLICATE;
    }
    if(!table->head->next)
    {
        table->head->next = var;
        return SFIP_SUCCESS;
    }
    else if(!strcmp(var->name, table->head->next->name))
    {
        var->next = table->head->next->next;
        sfvar_free(table->head->next);
        table->head->next = var;
        return SFIP_DUPLICATE;
    }
    for(p = table->head; p->next; p=p->next)
    {
        if((ret = strcmp(var->name, p->next->name)) < 0)
        {
            swp = p->next;
            p->next = var;
            var->next = swp;
            return SFIP_SUCCESS;
        }
        else if(ret == 0)
        {
            var->next = p->next->next;
            sfvar_free(p->next);
            p->next = var;
            return SFIP_DUPLICATE;
        }
    }
    p->next = var;
    return SFIP_SUCCESS;
}

variable_types: struct _vartable_t { struct _var_t { enum _modes { SFIP_LIST=0, SFIP_TABLE=1 } mode; struct _ip_node { struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } *ip; struct _ip_node *next; int flags; int addr_flags; } *head; struct _ip_node *neg_head; struct _var_t *next; char *name; } *head; } *

variable_types:
str
char *

variable_types: ret int

variable_types: enum _return_values { SFIP_SUCCESS=0, SFIP_FAILURE=1, SFIP_LESSER=2, SFIP_GREATER=3, SFIP_EQUAL=4, SFIP_ARG_ERR=5, SFIP_CIDR_ERR=6, SFIP_INET_PARSE_ERR=7, SFIP_INVALID_MASK=8, SFIP_ALLOC_ERR=9, SFIP_CONTAINS=10, SFIP_NOT_CONTAINS=11, SFIP_DUPLICATE=12, SFIP_LOOKUP_FAILURE=13, SFIP_UNMATCHED_BRACKET=14, SFIP_NOT_ANY=15, SFIP_CONFLICT=16 }


decompiled_code:
__int64 __fastcall sfvt_define(__int64 *a1, const char *a2, const char *a3)
{
int v4; // er12
size_t v5; // r14
void *v6; // rax
void *v7; // r12
unsigned int v8; // ebx

if ( !a2 || !a3 )
return 5;
v4 = strlen(a2);
v5 = (int)(v4 + strlen(a3) + 2);
v6 = malloc(v5);
v7 = v6;
if ( !v6 )
return 1;
SnortSnprintf(v6, v5, "%s %s", a2, a3);
v8 = sfvt_add_str(a1, (__int64)v7);
free(v7);
return v8;
}

canonical_decompiled_code:
__int64 __fastcall func2(__int64 *a1, const char *a2, const char *a3)
{
int v4; // er12
size_t v5; // r14
void *v6; // rax
void *v7; // r12
unsigned int v8; // ebx

if ( !a2 || !a3 )
return 5;
v4 = strlen(a2);
v5 = (int)(v4 + strlen(a3) + 2);
v6 = malloc(v5);
v7 = v6;
if ( !v6 )
return 1;
SnortSnprintf(v6, v5, "%s %s", a2, a3);
v8 = func1(a1, (__int64)v7);
free(v7);
return v8;
}

original_code:
SFIP_RET sfvt_define(vartable_t *table, char *name, char *value)
{
    char *buf;
    int len;
    SFIP_RET ret;
    if(!name || !value) return SFIP_ARG_ERR;
    len = strlen(name) + strlen(value) + 2;
    if((buf = (char*)malloc(len)) == ((void *)0))
    {
        return SFIP_FAILURE;
    }
    SnortSnprintf(buf, len, "%s %s", name, value);
    ret = sfvt_add_str(table, buf);
    free(buf);
    return ret;
}

canonical_original_code:
enum _return_values sfvt_define(struct _vartable_t *table, char *name, char *value)
{
    char *buf;
    int len;
    enum _return_values ret;
    if(!name || !value) return SFIP_ARG_ERR;
    len = strlen(name) + strlen(value) + 2;
    if((buf = (char *)malloc(len)) == ((void *)0))
    {
        return SFIP_FAILURE;
    }
    SnortSnprintf(buf, len, "%s %s", name, value);
    ret = sfvt_add_str(table, buf);
    free(buf);
    return ret;
}

variable_types:
name
char *

variable_types:
value
char *

variable_types:
buf
char *

variable_types: len int

return_type: enum _return_values { SFIP_SUCCESS=0, SFIP_FAILURE=1, SFIP_LESSER=2, SFIP_GREATER=3, SFIP_EQUAL=4, SFIP_ARG_ERR=5, SFIP_CIDR_ERR=6, SFIP_INET_PARSE_ERR=7, SFIP_INVALID_MASK=8, SFIP_ALLOC_ERR=9, SFIP_CONTAINS=10, SFIP_NOT_CONTAINS=11, SFIP_DUPLICATE=12, SFIP_LOOKUP_FAILURE=13, SFIP_UNMATCHED_BRACKET=14, SFIP_NOT_ANY=15, SFIP_CONFLICT=16 }

user_defined_types: enum _modes { SFIP_LIST=0, SFIP_TABLE=1 }

user_defined_types: struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; }


decompiled_code:
__int64 __fastcall sfvt_add_to_var(__int64 a1, __int64 a2, __int64 a3)
{
__int64 result; // rax

if ( a3 == 0 || a2 == 0 )
return 5LL;
result = 5LL;
if ( a1 )
{
result = sfvar_parse_iplist(a1, a2, a3, 0LL);
if ( !(_DWORD)result )
result = sfvar_validate(a2);
}
return result;
}

canonical_decompiled_code:
__int64 __fastcall func3(__int64 a1, __int64 a2, __int64 a3)
{
__int64 result; // rax

if ( a3 == 0 || a2 == 0 )
return 5LL;
result = 5LL;
if ( a1 )
{
result = sfvar_parse_iplist(a1, a2, a3, 0LL);
if ( !(_DWORD)result )
result = sfvar_validate(a2);
}
return result;
}

original_code:
SFIP_RET sfvt_add_to_var(vartable_t *table, sfip_var_t *dst, char *src)
{
    int ret;
    if(!table || !dst || !src) return SFIP_ARG_ERR;
    if((ret = sfvar_parse_iplist(table, dst, src, 0)) == SFIP_SUCCESS)
        return sfvar_validate(dst);
    return ret;
}

canonical_original_code:
enum _return_values sfvt_add_to_var(struct _vartable_t *table, struct _var_t *dst, char *src)
{
    int ret;
    if(!table || !dst || !src) return SFIP_ARG_ERR;
    if((ret = sfvar_parse_iplist(table, dst, src, 0)) == SFIP_SUCCESS)
        return sfvar_validate(dst);
    return ret;
}

variable_types:
dst
struct _var_t *

variable_types:
src
char *

user_defined_types: enum _return_values { SFIP_SUCCESS=0, SFIP_FAILURE=1, SFIP_LESSER=2, SFIP_GREATER=3, SFIP_EQUAL=4, SFIP_ARG_ERR=5, SFIP_CIDR_ERR=6, SFIP_INET_PARSE_ERR=7, SFIP_INVALID_MASK=8, SFIP_ALLOC_ERR=9, SFIP_CONTAINS=10, SFIP_NOT_CONTAINS=11, SFIP_DUPLICATE=12, SFIP_LOOKUP_FAILURE=13, SFIP_UNMATCHED_BRACKET=14, SFIP_NOT_ANY=15, SFIP_CONFLICT=16 }


decompiled_code:
__int64 __fastcall sfvt_lookup_var(__int64 *a1, _BYTE *a2)
{
const char *v2; // r12
char v3; // bl
const unsigned __int16 *v4; // rcx
const char *v5; // rax
int v6; // eax
int v7; // er13
__int64 v8; // rbx
size_t v9; // r14
const char *v10; // rbp

if ( !a1 || !a2 )
return 0LL;
v2 = &a2[*a2 == 36];
v3 = *v2;
if ( !*v2 )
return 0LL;
v4 = *_ctype_b_loc();
v5 = v2;
do
{
if ( (v4[v3] & 0x2000) != 0 )
break;
if ( (unsigned __int8)(v3 - 92) <= 1u )
break;
v3 = *++v5;
}
while ( *v5 );
v6 = (_DWORD)v5 - (_DWORD)v2;
v7 = v6;
v8 = *a1;
if ( !v6 || !v8 )
return 0LL;
v9 = v6;
do
{
v10 = *(const char **)(v8 + 32);
if ( v7 == (unsigned int)strlen(v10) && !strncmp(v10, v2, v9) )
break;
v8 = *(_QWORD *)(v8 + 24);
}
while ( v8 );
return v8;
}

canonical_decompiled_code:
__int64 __fastcall func4(__int64 *a1, _BYTE *a2)
{
const char *v2; // r12
char v3; // bl
const unsigned __int16 *v4; // rcx
const char *v5; // rax
int v6; // eax
int v7; // er13
__int64 v8; // rbx
size_t v9; // r14
const char *v10; // rbp

if ( !a1 || !a2 )
return 0LL;
v2 = &a2[*a2 == 36];
v3 = *v2;
if ( !*v2 )
return 0LL;
v4 = *_ctype_b_loc();
v5 = v2;
do
{
if ( (v4[v3] & 0x2000) != 0 )
break;
if ( (unsigned __int8)(v3 - 92) <= 1u )
break;
v3 = *++v5;
}
while ( *v5 );
v6 = (_DWORD)v5 - (_DWORD)v2;
v7 = v6;
v8 = *a1;
if ( !v6 || !v8 )
return 0LL;
v9 = v6;
do
{
v10 = *(const char **)(v8 + 32);
if ( v7 == (unsigned int)strlen(v10) && !strncmp(v10, v2, v9) )
break;
v8 = *(_QWORD *)(v8 + 24);
}
while ( v8 );
return v8;
}

original_code:
sfip_var_t *sfvt_lookup_var(vartable_t *table, char *name)
{
    sfip_var_t *p;
    int len;
    char *end;
    if(!table || !name) return ((void *)0);
    if(*name == '$') name++;
    for(end=name;
        *end && !((*__ctype_b_loc ())[(int) (((int)*end))] & (unsigned short int) _ISspace) && *end != '\\' && *end != ']';
        end++) ;
    len = end - name;
    for(p=table->head; len && p; p=p->next)
    {
        int name_len = strlen(p->name);
        if((len == name_len) && !strncmp(p->name, name, len)) return p;
    }
    return ((void *)0);
}

canonical_original_code:
struct _var_t *sfvt_lookup_var(struct _vartable_t *table, char *name)
{
    struct _var_t *p;
    int len;
    char *end;
    if(!table || !name) return ((void *)0);
    if(*name == '$') name++;
    for(end=name;
        *end && !((*__ctype_b_loc ())[(int) (((int)*end))] & (unsigned short) _ISspace) && *end != '\\' && *end != ']';
        end++) ;
    len = end - name;
    for(p=table->head; len && p; p=p->next)
    {
        int name_len = strlen(p->name);
        if((len == name_len) && !strncmp(p->name, name, len)) return p;
    }
    return ((void *)0);
}

variable_types: struct _vartable_t { struct _var_t *head; } *

variable_types: struct _var_t { enum _modes { SFIP_LIST=0, SFIP_TABLE=1 } mode; struct _ip_node { struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } *ip; struct _ip_node *next; int flags; int addr_flags; } *head; struct _ip_node *neg_head; struct _var_t *next; char *name; } *

variable_types:
end
char *


decompiled_code:
void __fastcall sfvt_free_table(void *ptr)
{
__int64 v2; // rbx
__int64 v3; // rdi

if ( ptr )
{
v2 = *(_QWORD *)ptr;
while ( v2 )
{
v3 = v2;
v2 = *(_QWORD *)(v2 + 24);
sfvar_free(v3);
}
free(ptr);
}
}

canonical_decompiled_code:
void __fastcall func5(void *ptr)
{
__int64 v2; // rbx
__int64 v3; // rdi

if ( ptr )
{
v2 = *(_QWORD *)ptr;
while ( v2 )
{
v3 = v2;
v2 = *(_QWORD *)(v2 + 24);
sfvar_free(v3);
}
free(ptr);
}
}

original_code:
void sfvt_free_table(vartable_t *table)
{
    sfip_var_t *p, *tmp;
    if (!table) return;
    p = table->head;
    while (p)
    {
        tmp = p->next;
        sfvar_free(p);
        p = tmp;
    }
    free(table);
}

canonical_original_code:
void sfvt_free_table(struct _vartable_t *table)
{
    struct _var_t *p; struct _var_t *tmp;
    if (!table) return;
    p = table->head;
    while (p)
    {
        tmp = p->next;
        sfvar_free(p);
        p = tmp;
    }
    free(table);
}


AlertUnixSock

decompiled_code:
ssize_t __fastcall AlertUnixSock(__int64 a1, unsigned int *a2)
{
unsigned int v2; // edx
unsigned int v3; // er12
unsigned int v4; // eax
__int64 v5; // rax
const char *v6; // rbp
size_t v7; // rax
size_t v8; // rdx
__int64 v9; // rdx
__int64 v10; // rdx
__int64 v11; // rcx
char v12; // dl
__int64 v13; // rax
__int64 v14; // rdx
__int64 v16; // rax
__int64 v17; // rax
__int64 v18; // rax

DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 177;
DebugMessageFunc(32LL, "Logging Alert data!\n");
memset(&alertpkt_0, 0, 0x740uLL);
if ( a2 )
memmove(&unk_BF8, a2, 0x24uLL);
if ( a1 && *(_QWORD *)(a1 + 8) )
{
memmove(&unk_5E0, *(const void **)a1, 0x18uLL);
v2 = 1514;
if ( (unsigned int)n <= 0x5EA )
v2 = n;
memmove(&unk_60C, *(const void **)(a1 + 8), v2);
}
else
{
dword_608 = 1;
}
v3 = _bswap_32(a2[4]);
v4 = _bswap_32(a2[5]);
v5 = GetSigByGidSid(v4, v3);
if ( v5 )
{
v6 = *(const char **)(v5 + 32);
v7 = strlen(v6);
v8 = 255LL;
if ( v7 <= 0xFF )
v8 = v7;
memmove(&alertpkt_0, v6, v8);
}
if ( (dword_608 & 1) == 0 && a1 )
{
v9 = *(_QWORD *)(a1 + 24);
if ( v9 )
dword_5F8 = v9 - *(_DWORD *)(a1 + 8);
v10 = *(_QWORD *)(a1 + 72);
if ( v10 )
{
v11 = *(_QWORD *)(a1 + 8);
if ( !v11 )
return sendto(alertsd, &alertpkt_0, 0x740uLL, 0, &alertaddr, 0x6Eu);
dword_5FC = v10 - v11;
v12 = *(_BYTE *)(*(_QWORD *)(a1 + 72) + 9LL);
switch ( v12 )
{
case 6:
v16 = *(_QWORD *)(a1 + 104);
if ( v16 )
dword_600 = v16 - *(_DWORD *)(a1 + 8);
break;
case 17:
v17 = *(_QWORD *)(a1 + 120);
if ( v17 )
dword_600 = v17 - *(_DWORD *)(a1 + 8);
break;
case 1:
v18 = *(_QWORD *)(a1 + 136);
if ( v18 )
dword_600 = v18 - *(_DWORD *)(a1 + 8);
break;
default:
dword_608 |= 2u;
break;
}
}
v13 = *(_QWORD *)(a1 + 152);
if ( v13 )
{
v14 = *(_QWORD *)(a1 + 8);
if ( v14 )
dword_604 = v13 - v14;
}
}
return sendto(alertsd, &alertpkt_0, 0x740uLL, 0, &alertaddr, 0x6Eu);
}

canonical_decompiled_code:
ssize_t __fastcall func1(__int64 a1, unsigned int *a2)
{
unsigned int v2; // edx
unsigned int v3; // er12
unsigned int v4; // eax
__int64 v5; // rax
const char *v6; // rbp
size_t v7; // rax
size_t v8; // rdx
__int64 v9; // rdx
__int64 v10; // rdx
__int64 v11; // rcx
char v12; // dl
__int64 v13; // rax
__int64 v14; // rdx
__int64 v16; // rax
__int64 v17; // rax
__int64 v18; // rax

DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 177;
DebugMessageFunc(32LL, "Logging Alert data!\n");
memset(&alertpkt_0, 0, 0x740uLL);
if ( a2 )
memmove(&unk_BF8, a2, 0x24uLL);
if ( a1 && *(_QWORD *)(a1 + 8) )
{
memmove(&unk_5E0, *(const void **)a1, 0x18uLL);
v2 = 1514;
if ( (unsigned int)n <= 0x5EA )
v2 = n;
memmove(&unk_60C, *(const void **)(a1 + 8), v2);
}
else
{
dword_608 = 1;
}
v3 = func0(a2[4]);
v4 = func0(a2[5]);
v5 = GetSigByGidSid(v4, v3);
if ( v5 )
{
v6 = *(const char **)(v5 + 32);
v7 = strlen(v6);
v8 = 255LL;
if ( v7 <= 0xFF )
v8 = v7;
memmove(&alertpkt_0, v6, v8);
}
if ( (dword_608 & 1) == 0 && a1 )
{
v9 = *(_QWORD *)(a1 + 24);
if ( v9 )
dword_5F8 = v9 - *(_DWORD *)(a1 + 8);
v10 = *(_QWORD *)(a1 + 72);
if ( v10 )
{
v11 = *(_QWORD *)(a1 + 8);
if ( !v11 )
return sendto(alertsd, &alertpkt_0, 0x740uLL, 0, &alertaddr, 0x6Eu);
dword_5FC = v10 - v11;
v12 = *(_BYTE *)(*(_QWORD *)(a1 + 72) + 9LL);
switch ( v12 )
{
case 6:
v16 = *(_QWORD *)(a1 + 104);
if ( v16 )
dword_600 = v16 - *(_DWORD *)(a1 + 8);
break;
case 17:
v17 = *(_QWORD *)(a1 + 120);
if ( v17 )
dword_600 = v17 - *(_DWORD *)(a1 + 8);
break;
case 1:
v18 = *(_QWORD *)(a1 + 136);
if ( v18 )
dword_600 = v18 - *(_DWORD *)(a1 + 8);
break;
default:
dword_608 |= 2u;
break;
}
}
v13 = *(_QWORD *)(a1 + 152);
if ( v13 )
{
v14 = *(_QWORD *)(a1 + 8);
if ( v14 )
dword_604 = v13 - v14;
}
}
return sendto(alertsd, &alertpkt_0, 0x740uLL, 0, &alertaddr, 0x6Eu);
}

original_code:
void AlertUnixSock(Packet *p, void *event, uint32_t event_type, void *arg)
{
    static Alertpkt alertpkt;
 SigNode *sn;
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 177; DebugMessageFunc(0x00000020, "Logging Alert data!\n");;
    bzero((char *)&alertpkt,sizeof(alertpkt));
    if (event)
    {
        bcopy((const void *)event,(void *)&alertpkt.event,sizeof(Unified2EventCommon));
    }
    if(p && p->pkt)
    {
        bcopy((const void *)p->pkth,(void *)&alertpkt.pkth,sizeof(struct pcap_pkthdr));
        bcopy((const void *)p->pkt,alertpkt.pkt,
              alertpkt.pkth.caplen > 1514? 1514 : alertpkt.pkth.caplen);
    }
    else
        alertpkt.val|=0x1;
 sn = GetSigByGidSid(ntohl(((Unified2EventCommon *)event)->generator_id),
      ntohl(((Unified2EventCommon *)event)->signature_id));
    if (sn != ((void *)0))
    {
        bcopy((const void *)sn->msg,(void *)alertpkt.alertmsg,
               strlen(sn->msg)>256 -1 ? 256 - 1 : strlen(sn->msg));
    }
    if(!(alertpkt.val & 0x1))
    {
        if(p)
        {
            if (p->eh)
            {
                alertpkt.dlthdr=(char *)p->eh-(char *)p->pkt;
            }
            if (p->iph && p->pkt)
            {
                alertpkt.nethdr=(char *)p->iph-(char *)p->pkt;
                switch(p->iph->ip_proto)
                {
                    case IPPROTO_TCP:
                       if (p->tcph)
                       {
                           alertpkt.transhdr=(char *)p->tcph-(char *)p->pkt;
                       }
                       break;
                    case IPPROTO_UDP:
                        if (p->udph)
                        {
                            alertpkt.transhdr=(char *)p->udph-(char *)p->pkt;
                        }
                        break;
                    case IPPROTO_ICMP:
                       if (p->icmph)
                       {
                           alertpkt.transhdr=(char *)p->icmph-(char *)p->pkt;
                       }
                       break;
                    default:
                        alertpkt.val|=0x2;
                        break;
                }
            }
            if (p->data && p->pkt) alertpkt.data=p->data - p->pkt;
        }
    }
    if(sendto(alertsd,(const void *)&alertpkt,sizeof(Alertpkt),
              0,(struct sockaddr *)&alertaddr,sizeof(alertaddr))==-1)
    {
    }
}

canonical_original_code:
void AlertUnixSock(struct _Packet *p, void *event, unsigned int event_type, void *arg)
{
    static struct _Alertpkt alertpkt;
 struct _SigNode *sn;
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 177; DebugMessageFunc(0x00000020, "Logging Alert data!\n");;
    bzero((char *)&alertpkt,sizeof(alertpkt));
    if (event)
    {
        bcopy((void *)event,(void *)&alertpkt.event,sizeof(Unified2EventCommon));
    }
    if(p && p->pkt)
    {
        bcopy((void *)p->pkth,(void *)&alertpkt.pkth,sizeof(struct pcap_pkthdr));
        bcopy((void *)p->pkt,alertpkt.pkt,
              alertpkt.pkth.caplen > 1514? 1514 : alertpkt.pkth.caplen);
    }
    else
        alertpkt.val|=0x1;
 sn = GetSigByGidSid(ntohl(((struct _Unified2EventCommon *)event)->generator_id),
      ntohl(((struct _Unified2EventCommon *)event)->signature_id));
    if (sn != ((void *)0))
    {
        bcopy((void *)sn->msg,(void *)alertpkt.alertmsg,
               strlen(sn->msg)>256 -1 ? 256 - 1 : strlen(sn->msg));
    }
    if(!(alertpkt.val & 0x1))
    {
        if(p)
        {
            if (p->eh)
            {
                alertpkt.dlthdr=(char *)p->eh-(char *)p->pkt;
            }
            if (p->iph && p->pkt)
            {
                alertpkt.nethdr=(char *)p->iph-(char *)p->pkt;
                switch(p->iph->ip_proto)
                {
                    case IPPROTO_TCP:
                       if (p->tcph)
                       {
                           alertpkt.transhdr=(char *)p->tcph-(char *)p->pkt;
                       }
                       break;
                    case IPPROTO_UDP:
                        if (p->udph)
                        {
                            alertpkt.transhdr=(char *)p->udph-(char *)p->pkt;
                        }
                        break;
                    case IPPROTO_ICMP:
                       if (p->icmph)
                       {
                           alertpkt.transhdr=(char *)p->icmph-(char *)p->pkt;
                       }
                       break;
                    default:
                        alertpkt.val|=0x2;
                        break;
                }
            }
            if (p->data && p->pkt) alertpkt.data=p->data - p->pkt;
        }
    }
    if(sendto(alertsd,(void *)&alertpkt,sizeof(Alertpkt),
              0,(struct sockaddr *)&alertaddr,sizeof(alertaddr))==-1)
    {
    }
}

variable_types: struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *

variable_types:
event
void *

variable_types:
arg
void *

variable_types: struct _Alertpkt { unsigned char alertmsg[256]; struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } pkth; unsigned int dlthdr; unsigned int nethdr; unsigned int transhdr; unsigned int data; unsigned int val; unsigned char pkt[1514]; struct _Unified2EventCommon { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int event_microsecond; unsigned int signature_id; unsigned int generator_id; unsigned int signature_revision; unsigned int classification_id; unsigned int priority_id; } event; }

variable_types: struct _SigNode { unsigned int generator; unsigned int id; unsigned int rev; unsigned int class_id; struct _ClassType { char *type; unsigned int id; char *name; unsigned int priority; struct _ClassType *next; } *classType; unsigned int priority; char *msg; struct _ReferenceNode { char *id; struct _ReferenceSystemNode { char *name; char *url; struct _ReferenceSystemNode *next; } *system; struct _ReferenceNode *next; } *refs; struct _SigNode *next; } *

user_defined_types: struct _Alertpkt { unsigned char alertmsg[256]; struct pcap_pkthdr pkth; unsigned int dlthdr; unsigned int nethdr; unsigned int transhdr; unsigned int data; unsigned int val; unsigned char pkt[1514]; struct _Unified2EventCommon event; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct _SigNode { unsigned int generator; unsigned int id; unsigned int rev; unsigned int class_id; struct _ClassType *classType; unsigned int priority; char *msg; struct _ReferenceNode *refs; struct _SigNode *next; }

user_defined_types: struct sockaddr { unsigned short sa_family; char sa_data[14]; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }

user_defined_types: struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ReferenceNode { char *id; struct _ReferenceSystemNode *system; struct _ReferenceNode *next; }


AlertUnixSockSetup

decompiled_code:
__int64 AlertUnixSockSetup()
{
RegisterOutputPlugin("alert_unixsock", 1LL, AlertUnixSockInit);
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 111;
return DebugMessageFunc(1LL, "Output plugin: AlertUnixSock is setup...\n");
}

canonical_decompiled_code:
__int64 func2()
{
RegisterOutputPlugin("alert_unixsock", 1LL, AlertUnixSockInit);
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 111;
return DebugMessageFunc(1LL, "Output plugin: AlertUnixSock is setup...\n");
}

original_code:
void AlertUnixSockSetup(void)
{
    RegisterOutputPlugin("alert_unixsock", OUTPUT_TYPE_FLAG__ALERT, AlertUnixSockInit);
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 111; DebugMessageFunc(0x00000001, "Output plugin: AlertUnixSock is setup...\n");;
}

canonical_original_code:
void AlertUnixSockSetup()
{
    RegisterOutputPlugin("alert_unixsock", OUTPUT_TYPE_FLAG__ALERT, AlertUnixSockInit);
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 111; DebugMessageFunc(0x00000001, "Output plugin: AlertUnixSock is setup...\n");;
}


OpenAlertSock

decompiled_code:
int OpenAlertSock()
{
const char *v0; // rcx
int result; // eax
int *v2; // rax
char *v3; // rax
char v4[1032]; // [rsp+0h] [rbp-408h] BYREF

v0 = *(const char **)(barnyard2_conf + 65656LL);
if ( !v0 )
v0 = (const char *)&unk_C5D;
SnortSnprintf(v4, 1024LL, "%s%s/%s", v0, *(const char **)(barnyard2_conf + 65640LL), "barnyard2_alert");
if ( access(v4, 2) )
ErrorMessage("%s file doesn't exist or isn't writable!\n", v4);
strncpy((char *)(unsigned int)((_DWORD)&alertaddr + 2), v4, 0x6CuLL);
alertaddr.sa_family = 1;
result = socket(1, 2, 0);
alertsd = result;
if ( result < 0 )
{
v2 = _errno_location();
v3 = strerror(*v2);
result = FatalError("socket() call failed: %s", v3);
}
return result;
}

canonical_decompiled_code:
int func3()
{
const char *v0; // rcx
int result; // eax
int *v2; // rax
char *v3; // rax
char v4[1032]; // [rsp+0h] [rbp-408h] BYREF

v0 = *(const char **)(barnyard2_conf + 65656LL);
if ( !v0 )
v0 = (const char *)&unk_C5D;
SnortSnprintf(v4, 1024LL, "%s%s/%s", v0, *(const char **)(barnyard2_conf + 65640LL), "barnyard2_alert");
if ( access(v4, 2) )
ErrorMessage("%s file doesn't exist or isn't writable!\n", v4);
strncpy((char *)(unsigned int)((_DWORD)&alertaddr + 2), v4, 0x6CuLL);
alertaddr.sa_family = 1;
result = socket(1, 2, 0);
alertsd = result;
if ( result < 0 )
{
v2 = _errno_location();
v3 = strerror(*v2);
result = FatalError("socket() call failed: %s", v3);
}
return result;
}

original_code:
void OpenAlertSock(void)
{
    char srv[1024];
    SnortSnprintf(srv, 1024, "%s%s/%s",
                  barnyard2_conf->chroot_dir == ((void *)0) ? "" : barnyard2_conf->chroot_dir,
                  barnyard2_conf->log_dir, "barnyard2_alert");
    if(access(srv, 2))
    {
       ErrorMessage("%s file doesn't exist or isn't writable!\n",
            srv);
    }
    bzero((char *) &alertaddr, sizeof(alertaddr));
    strncpy(alertaddr.sun_path, srv, 108);
    alertaddr.sun_family = 1;
    if((alertsd = socket(1, SOCK_DGRAM, 0)) < 0)
    {
        FatalError("socket() call failed: %s", strerror((*__errno_location ())));
    }
}

canonical_original_code:
void OpenAlertSock()
{
    char srv[1024];
    SnortSnprintf(srv, 1024, "%s%s/%s",
                  barnyard2_conf->chroot_dir == ((void *)0) ? "" : barnyard2_conf->chroot_dir,
                  barnyard2_conf->log_dir, "barnyard2_alert");
    if(access(srv, 2))
    {
       ErrorMessage("%s file doesn't exist or isn't writable!\n",
            srv);
    }
    bzero((char *) &alertaddr, sizeof(alertaddr));
    strncpy(alertaddr.sun_path, srv, 108);
    alertaddr.sun_family = 1;
    if((alertsd = socket(1, SOCK_DGRAM, 0)) < 0)
    {
        FatalError("socket() call failed: %s", strerror((*__errno_location ())));
    }
}

variable_types:
srv
char [1024]


ParseAlertUnixSockArgs

decompiled_code:
int __fastcall ParseAlertUnixSockArgs(const char *a1)
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 157;
DebugMessageFunc(32LL, "ParseAlertUnixSockArgs: %s\n", a1);
return OpenAlertSock();
}

canonical_decompiled_code:
int __fastcall func4(const char *a1)
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 157;
DebugMessageFunc(32LL, "ParseAlertUnixSockArgs: %s\n", a1);
return func3();
}

original_code:
void ParseAlertUnixSockArgs(char *args)
{
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 157; DebugMessageFunc(0x00000020,"ParseAlertUnixSockArgs: %s\n", args);;
    OpenAlertSock();
}

variable_types:
args
char *


AlertUnixSockInit

decompiled_code:
__int64 __fastcall AlertUnixSockInit(const char *a1)
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 128;
DebugMessageFunc(1LL, "Output: AlertUnixSock Initialized\n");
ParseAlertUnixSockArgs(a1);
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 133;
DebugMessageFunc(1LL, "Linking UnixSockAlert functions to call lists...\n");
AddFuncToOutputList(AlertUnixSock, 1LL, 0LL);
AddFuncToCleanExitList(AlertUnixSockCleanExit, 0LL);
return AddFuncToRestartList(AlertUnixSockRestart, 0LL);
}

canonical_decompiled_code:
__int64 __fastcall func5(const char *a1)
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 128;
DebugMessageFunc(1LL, "Output: AlertUnixSock Initialized\n");
func4(a1);
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 133;
DebugMessageFunc(1LL, "Linking UnixSockAlert functions to call lists...\n");
AddFuncToOutputList(AlertUnixSock, 1LL, 0LL);
AddFuncToCleanExitList(AlertUnixSockCleanExit, 0LL);
return AddFuncToRestartList(AlertUnixSockRestart, 0LL);
}

original_code:
void AlertUnixSockInit(char *args)
{
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 128; DebugMessageFunc(0x00000001,"Output: AlertUnixSock Initialized\n");;
    ParseAlertUnixSockArgs(args);
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 133; DebugMessageFunc(0x00000001,"Linking UnixSockAlert functions to call lists...\n");;
    AddFuncToOutputList(AlertUnixSock, OUTPUT_TYPE__ALERT, ((void *)0));
    AddFuncToCleanExitList(AlertUnixSockCleanExit, ((void *)0));
    AddFuncToRestartList(AlertUnixSockRestart, ((void *)0));
}


CloseAlertSock

decompiled_code:
int CloseAlertSock()
{
int result; // eax

if ( alertsd >= 0 )
result = close(alertsd);
return result;
}

canonical_decompiled_code:
int func6()
{
int result; // eax

if ( alertsd >= 0 )
result = close(alertsd);
return result;
}

original_code:
void CloseAlertSock(void)
{
    if(alertsd >= 0) {
        close(alertsd);
    }
}

canonical_original_code:
void CloseAlertSock()
{
    if(alertsd >= 0) {
        close(alertsd);
    }
}


AlertUnixSockCleanExit

decompiled_code:
int AlertUnixSockCleanExit()
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 303;
DebugMessageFunc(32LL, "AlertUnixSockCleanExitFunc\n");
return CloseAlertSock();
}

canonical_decompiled_code:
int func7()
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 303;
DebugMessageFunc(32LL, "AlertUnixSockCleanExitFunc\n");
return func6();
}

original_code:
void AlertUnixSockCleanExit(int signal, void *arg)
{
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 303; DebugMessageFunc(0x00000020,"AlertUnixSockCleanExitFunc\n");;
    CloseAlertSock();
}

variable_types: signal int


AlertUnixSockRestart

decompiled_code:
int AlertUnixSockRestart()
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 309;
DebugMessageFunc(32LL, "AlertUnixSockRestartFunc\n");
return CloseAlertSock();
}

canonical_decompiled_code:
int func8()
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 309;
DebugMessageFunc(32LL, "AlertUnixSockRestartFunc\n");
return func6();
}

original_code:
void AlertUnixSockRestart(int signal, void *arg)
{
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 309; DebugMessageFunc(0x00000020,"AlertUnixSockRestartFunc\n");;
    CloseAlertSock();
}


AlertArubaActionCleanExitFunc

decompiled_code:
void __fastcall AlertArubaActionCleanExitFunc(__int64 a1, void **a2)
{
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 640;
DebugMessageFunc(32LL, "AlertArubaActionCleanExitFunc\n");
free(*a2);
free(a2[2]);
free(a2);
}

canonical_decompiled_code:
void __fastcall func1(__int64 a1, void **a2)
{
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 640;
DebugMessageFunc(32LL, "AlertArubaActionCleanExitFunc\n");
free(*a2);
free(a2[2]);
free(a2);
}

original_code:
void AlertArubaActionCleanExitFunc(int signal, void *arg)
{
 SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 640; DebugMessageFunc(0x00000020,"AlertArubaActionCleanExitFunc\n");;
 free(data->secret);
 free(data->role_name);
 free(data);
}

canonical_original_code:
void AlertArubaActionCleanExitFunc(int signal, void *arg)
{
 struct _SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 640; DebugMessageFunc(0x00000020,"AlertArubaActionCleanExitFunc\n");;
 free(data->secret);
 free(data->role_name);
 free(data);
}

variable_types: struct _SpoAlertArubaActionData { char *secret; unsigned char secret_type; unsigned char action_type; char *role_name; struct in_addr { unsigned int s_addr; } aswitch; int fd; } *

user_defined_types: struct _SpoAlertArubaActionData { char *secret; unsigned char secret_type; unsigned char action_type; char *role_name; struct in_addr aswitch; int fd; }


AlertArubaActionRestartFunc

decompiled_code:
void __fastcall AlertArubaActionRestartFunc(__int64 a1, void **a2)
{
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 650;
DebugMessageFunc(32LL, "AlertArubaActionRestartFunc\n");
free(*a2);
free(a2[2]);
free(a2);
}

canonical_decompiled_code:
void __fastcall func2(__int64 a1, void **a2)
{
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 650;
DebugMessageFunc(32LL, "AlertArubaActionRestartFunc\n");
free(*a2);
free(a2[2]);
free(a2);
}

original_code:
void AlertArubaActionRestartFunc(int signal, void *arg)
{
 SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 650; DebugMessageFunc(0x00000020,"AlertArubaActionRestartFunc\n");;
 free(data->secret);
 free(data->role_name);
 free(data);
}

canonical_original_code:
void AlertArubaActionRestartFunc(int signal, void *arg)
{
 struct _SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 650; DebugMessageFunc(0x00000020,"AlertArubaActionRestartFunc\n");;
 free(data->secret);
 free(data->role_name);
 free(data);
}


AlertArubaActionSetup

decompiled_code:
__int64 AlertArubaActionSetup()
{
RegisterOutputPlugin("alert_aruba_action", 1LL, AlertArubaActionInit);
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 184;
return DebugMessageFunc(1LL, "Output plugin: AlertArubaAction is setup...\n");
}

canonical_decompiled_code:
__int64 func3()
{
RegisterOutputPlugin("alert_aruba_action", 1LL, AlertArubaActionInit);
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 184;
return DebugMessageFunc(1LL, "Output plugin: AlertArubaAction is setup...\n");
}

original_code:
void AlertArubaActionSetup(void)
{
    RegisterOutputPlugin("alert_aruba_action", OUTPUT_TYPE_FLAG__ALERT,
                         AlertArubaActionInit);
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 184; DebugMessageFunc(0x00000001,"Output plugin: AlertArubaAction is " "setup...\n");;
}

canonical_original_code:
void AlertArubaActionSetup()
{
    RegisterOutputPlugin("alert_aruba_action", OUTPUT_TYPE_FLAG__ALERT,
                         AlertArubaActionInit);
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 184; DebugMessageFunc(0x00000001,"Output plugin: AlertArubaAction is " "setup...\n");;
}


ArubaSwitchSend

decompiled_code:
ssize_t __fastcall ArubaSwitchSend(__int64 a1, const void *a2, int a3)
{
return write(*(_DWORD *)(a1 + 28), a2, a3);
}

canonical_decompiled_code:
ssize_t __fastcall func4(__int64 a1, const void *a2, int a3)
{
return write(*(_DWORD *)(a1 + 28), a2, a3);
}

original_code:
int ArubaSwitchSend(SpoAlertArubaActionData *data, uint8_t *post, int len)
{
 return(write(data->fd, post, len));
}

canonical_original_code:
int ArubaSwitchSend(struct _SpoAlertArubaActionData *data, unsigned char *post, int len)
{
 return(write(data->fd, post, len));
}

variable_types:
post
unsigned char *

return_type: int


ArubaSwitchRecv

decompiled_code:
ssize_t __fastcall ArubaSwitchRecv(__int64 a1, void *a2, int a3)
{
return read(*(_DWORD *)(a1 + 28), a2, a3);
}

canonical_decompiled_code:
ssize_t __fastcall func5(__int64 a1, void *a2, int a3)
{
return read(*(_DWORD *)(a1 + 28), a2, a3);
}

original_code:
int ArubaSwitchRecv(SpoAlertArubaActionData *data, uint8_t *recv, int maxlen)
{
 return(read(data->fd, recv, maxlen));
}

canonical_original_code:
int ArubaSwitchRecv(struct _SpoAlertArubaActionData *data, unsigned char *recv, int maxlen)
{
 return(read(data->fd, recv, maxlen));
}

variable_types:
recv
unsigned char *

variable_types: maxlen int


ArubaSwitchConnect

decompiled_code:
__int64 __fastcall ArubaSwitchConnect(__int64 a1)
{
int v1; // eax
int v2; // ebp
__int16 v3; // r12
__int64 result; // rax
__int16 v5[4]; // [rsp+0h] [rbp-48h] BYREF
__m128i v6; // [rsp+8h] [rbp-40h]
struct sockaddr addr; // [rsp+20h] [rbp-28h] BYREF

v1 = socket(2, 1, 0);
*(_DWORD *)(a1 + 28) = v1;
if ( v1 < 0 )
{
ErrorMessage("aruba_action: socket error\n");
result = 0xFFFFFFFFLL;
}
else
{
v2 = v1;
*(_DWORD *)&addr.sa_data[2] = *(_DWORD *)(a1 + 24);
addr.sa_family = 2;
v3 = _bswap_16(80);
*(_WORD *)addr.sa_data = v3;
if ( connect(v2, &addr, 0x10u) < 0 )
{
perror("connect");
ErrorMessage("aruba_action: Unable to connect to switch\n");
close(*(_DWORD *)(a1 + 28));
result = 0xFFFFFFFFLL;
}
else
{
v6 = _mm_loadu_si128((const __m128i *)(a1 + 24));
v5[0] = 10;
v5[1] = v3;
if ( connect(*(_DWORD *)(a1 + 28), (const struct sockaddr *)v5, 0x1Cu) < 0 )
{
perror("connect");
ErrorMessage("aruba_action: Unable to connect to switch\n");
close(*(_DWORD *)(a1 + 28));
result = 0xFFFFFFFFLL;
}
else
{
result = *(unsigned int *)(a1 + 28);
}
}
}
return result;
}

canonical_decompiled_code:
__int64 __fastcall func6(__int64 a1)
{
int v1; // eax
int v2; // ebp
__int16 v3; // r12
__int64 result; // rax
__int16 v5[4]; // [rsp+0h] [rbp-48h] BYREF
__m128i v6; // [rsp+8h] [rbp-40h]
struct sockaddr addr; // [rsp+20h] [rbp-28h] BYREF

v1 = socket(2, 1, 0);
*(_DWORD *)(a1 + 28) = v1;
if ( v1 < 0 )
{
ErrorMessage("aruba_action: socket error\n");
result = 0xFFFFFFFFLL;
}
else
{
v2 = v1;
*(_DWORD *)&addr.sa_data[2] = *(_DWORD *)(a1 + 24);
addr.sa_family = 2;
v3 = func0(80);
*(_WORD *)addr.sa_data = v3;
if ( connect(v2, &addr, 0x10u) < 0 )
{
perror("connect");
ErrorMessage("aruba_action: Unable to connect to switch\n");
close(*(_DWORD *)(a1 + 28));
result = 0xFFFFFFFFLL;
}
else
{
v6 = _mm_loadu_si128((const __m128i *)(a1 + 24));
v5[0] = 10;
v5[1] = v3;
if ( connect(*(_DWORD *)(a1 + 28), (const struct sockaddr *)v5, 0x1Cu) < 0 )
{
perror("connect");
ErrorMessage("aruba_action: Unable to connect to switch\n");
close(*(_DWORD *)(a1 + 28));
result = 0xFFFFFFFFLL;
}
else
{
result = *(unsigned int *)(a1 + 28);
}
}
}
return result;
}

original_code:
int ArubaSwitchConnect(SpoAlertArubaActionData *data)
{
 struct sockaddr_in sa4;
 struct sockaddr_in6 sa6;
 data->fd = socket(2, SOCK_STREAM, 0);
 if (data->fd < 0) {
  ErrorMessage("aruba_action: socket error\n");
  return -1;
 }
     sa4.sin_addr.s_addr = (unsigned int)(data->aswitch.s_addr);
     sa4.sin_family = 2;
     sa4.sin_port = htons(80);
     if (connect(data->fd, (struct sockaddr *)&sa4, sizeof(sa4)) < 0) {
      perror("connect");
      ErrorMessage("aruba_action: Unable to connect to switch\n");
      close(data->fd);
      return -1;
     }
     memcpy(&sa6.sin6_addr, &data->aswitch, 16);
     sa6.sin6_family = 10;
     sa6.sin6_port = htons(80);
        if (connect(data->fd, (struct sockaddr *)&sa6, sizeof(sa6)) < 0) {
      perror("connect");
      ErrorMessage("aruba_action: Unable to connect to switch\n");
      close(data->fd);
      return -1;
     }
 return data->fd;
}

canonical_original_code:
int ArubaSwitchConnect(struct _SpoAlertArubaActionData *data)
{
 struct sockaddr_in sa4;
 struct sockaddr_in6 sa6;
 data->fd = socket(2, SOCK_STREAM, 0);
 if (data->fd < 0) {
  ErrorMessage("aruba_action: socket error\n");
  return -1;
 }
     sa4.sin_addr.s_addr = (unsigned int)(data->aswitch.s_addr);
     sa4.sin_family = 2;
     sa4.sin_port = htons(80);
     if (connect(data->fd, (struct sockaddr *)&sa4, sizeof(sa4)) < 0) {
      perror("connect");
      ErrorMessage("aruba_action: Unable to connect to switch\n");
      close(data->fd);
      return -1;
     }
     memcpy(&sa6.sin6_addr, &data->aswitch, 16);
     sa6.sin6_family = 10;
     sa6.sin6_port = htons(80);
        if (connect(data->fd, (struct sockaddr *)&sa6, sizeof(sa6)) < 0) {
      perror("connect");
      ErrorMessage("aruba_action: Unable to connect to switch\n");
      close(data->fd);
      return -1;
     }
 return data->fd;
}

variable_types: struct sockaddr_in { unsigned short sin_family; unsigned short sin_port; struct in_addr { unsigned int s_addr; } sin_addr; unsigned char sin_zero[-1]; }

variable_types: struct sockaddr_in6 { unsigned short sin6_family; unsigned short sin6_port; unsigned int sin6_flowinfo; struct in6_addr { union { unsigned char __u6_addr8[16]; unsigned short __u6_addr16[8]; unsigned int __u6_addr32[4]; } __in6_u; } sin6_addr; unsigned int sin6_scope_id; }

user_defined_types: struct sockaddr_in { unsigned short sin_family; unsigned short sin_port; struct in_addr sin_addr; unsigned char sin_zero[-1]; }

user_defined_types: struct sockaddr_in6 { unsigned short sin6_family; unsigned short sin6_port; unsigned int sin6_flowinfo; struct in6_addr sin6_addr; unsigned int sin6_scope_id; }


AlertArubaAction

decompiled_code:
void __fastcall AlertArubaAction(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
int v5; // eax
char v6; // al
char *v7; // rax
size_t v8; // rax
int v9; // ebp
char *v10; // r13
char *v11; // rax
size_t v12; // rax
int v13; // ebp
char *v14; // r13
char v15; // al
size_t v16; // rax
int v17; // ebp
char *v18; // r13
size_t v19; // rax
int v20; // ebp
char *v21; // r13
size_t v22; // rax
int v23; // ebp
size_t v24; // rbp
char *v25; // rax
int v26; // eax
char *v27; // rax
unsigned __int8 *v28; // rax
const char *v29; // rdx
unsigned int v30; // [rsp+0h] [rbp-A2Ch] BYREF
char haystack[1024]; // [rsp+4h] [rbp-A28h] BYREF
char v32[1024]; // [rsp+404h] [rbp-628h] BYREF
char s[552]; // [rsp+804h] [rbp-228h] BYREF

if ( a1 && a4 )
{
v5 = ArubaSwitchConnect(a4);
*(_DWORD *)(a4 + 28) = v5;
if ( v5 < 0 )
{
v7 = inet_ntoa(*(struct in_addr *)(a4 + 24));
ErrorMessage("Unable to connect to Aruba switch at %s\n", v7);
return;
}
v6 = *(_BYTE *)(a4 + 9);
if ( v6 == 1 )
{
strcpy(s, "xml=<aruba command=user_blacklist>");
}
else
{
if ( v6 != 2 )
{
ErrorMessage("aruba_action: invalid action type specified");
return;
}
snprintf(s, 0x200uLL, "xml=<aruba command=user_add><role>%s</role>", *(const char **)(a4 + 16));
}
v8 = strlen(s);
v9 = 512 - v8;
v10 = &s[v8];
v11 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
snprintf(v10, v9, "<ipaddr>%s</ipaddr>", v11);
v12 = strlen(v10);
v13 = v9 - v12;
if ( v13 <= 0 )
goto LABEL_25;
v14 = &v10[v12];
v15 = *(_BYTE *)(a4 + 8);
switch ( v15 )
{
case 2:
snprintf(v14, v13, "<authentication>md5</authentication>");
break;
case 4:
snprintf(v14, v13, "<authentication>cleartext</authentication>");
break;
case 1:
snprintf(v14, v13, "<authentication>sha-1</authentication>");
break;
default:
ErrorMessage("aruba_action: invalid secret type specified");
return;
}
v16 = strlen(v14);
v17 = v13 - v16;
if ( v17 <= 0 )
goto LABEL_25;
v18 = &v14[v16];
snprintf(v18, v17, "<key>%s</key>", *(const char **)a4);
v19 = strlen(v18);
v20 = v17 - v19;
if ( v20 <= 0
|| (v21 = &v18[v19], snprintf(v21, v20, "<version>1.0</version>"), v22 = strlen(v21), v23 = v20 - v22, v23 <= 0) )
{
LABEL_25:
ErrorMessage("aruba_action: configuration parameters too long\n");
FatalError("Unable to parse configuration parameters for ArubaAction output plugin.\n");
}
else
{
snprintf(&v21[v22], v23, "</aruba>");
v24 = strlen(s);
v25 = inet_ntoa(*(struct in_addr *)(a4 + 24));
v26 = snprintf(
v32,
0x3FFuLL,
"POST /auth/command.xml HTTP/1.0\r\n"
"User-Agent: snort\r\n"
"Host: %s\r\n"
"Pragma: no-cache\r\n"
"Content-Length: %lu\r\n"
"Content-Type: application/xml\r\n"
"\r\n"
"%s",
v25,
v24,
s);
if ( (unsigned int)ArubaSwitchSend(a4, v32, v26) == v26 )
{
if ( (int)ArubaSwitchRecv(a4, haystack, 1024) < 0 )
{
ErrorMessage("aruba_action: Error reading response from Aruba switch\n");
close(*(_DWORD *)(a4 + 28));
}
else
{
v27 = strstr(haystack, "<code>");
if ( v27 )
{
if ( (unsigned int)_isoc99_sscanf(v27 + 6, "%d", &v30) == 1 )
{
if ( v30 )
{
v28 = (unsigned __int8 *)&response_lookup;
v29 = "success";
while ( v30 != *v28 )
{
v28 += 16;
v29 = (const char *)*((_QWORD *)v28 + 1);
if ( !v29 )
goto LABEL_34;
}
if ( !v29 )
{
LABEL_34:
ErrorMessage("aruba_action: Switch returned error status of %d \"unknown\"\n", v30);
goto LABEL_40;
}
ErrorMessage("aruba_action: Switch returned error status of %d \"%s\"\n", v30, v29);
}
LABEL_40:
close(*(_DWORD *)(a4 + 28));
}
else
{
ErrorMessage("aruba_action: Invalid response code returned from the Aruba switch.\n");
}
}
else
{
ErrorMessage("aruba_action: Error extracting response code from Aruba switch\n");
close(*(_DWORD *)(a4 + 28));
}
}
}
else
{
ErrorMessage("aruba_action: Error sending data to Aruba switch.\n");
close(*(_DWORD *)(a4 + 28));
}
}
}
}

canonical_decompiled_code:
void __fastcall func7(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
int v5; // eax
char v6; // al
char *v7; // rax
size_t v8; // rax
int v9; // ebp
char *v10; // r13
char *v11; // rax
size_t v12; // rax
int v13; // ebp
char *v14; // r13
char v15; // al
size_t v16; // rax
int v17; // ebp
char *v18; // r13
size_t v19; // rax
int v20; // ebp
char *v21; // r13
size_t v22; // rax
int v23; // ebp
size_t v24; // rbp
char *v25; // rax
int v26; // eax
char *v27; // rax
unsigned __int8 *v28; // rax
const char *v29; // rdx
unsigned int v30; // [rsp+0h] [rbp-A2Ch] BYREF
char haystack[1024]; // [rsp+4h] [rbp-A28h] BYREF
char v32[1024]; // [rsp+404h] [rbp-628h] BYREF
char s[552]; // [rsp+804h] [rbp-228h] BYREF

if ( a1 && a4 )
{
v5 = func6(a4);
*(_DWORD *)(a4 + 28) = v5;
if ( v5 < 0 )
{
v7 = inet_ntoa(*(struct in_addr *)(a4 + 24));
ErrorMessage("Unable to connect to Aruba switch at %s\n", v7);
return;
}
v6 = *(_BYTE *)(a4 + 9);
if ( v6 == 1 )
{
strcpy(s, "xml=<aruba command=user_blacklist>");
}
else
{
if ( v6 != 2 )
{
ErrorMessage("aruba_action: invalid action type specified");
return;
}
snprintf(s, 0x200uLL, "xml=<aruba command=user_add><role>%s</role>", *(const char **)(a4 + 16));
}
v8 = strlen(s);
v9 = 512 - v8;
v10 = &s[v8];
v11 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
snprintf(v10, v9, "<ipaddr>%s</ipaddr>", v11);
v12 = strlen(v10);
v13 = v9 - v12;
if ( v13 <= 0 )
goto LABEL_25;
v14 = &v10[v12];
v15 = *(_BYTE *)(a4 + 8);
switch ( v15 )
{
case 2:
snprintf(v14, v13, "<authentication>md5</authentication>");
break;
case 4:
snprintf(v14, v13, "<authentication>cleartext</authentication>");
break;
case 1:
snprintf(v14, v13, "<authentication>sha-1</authentication>");
break;
default:
ErrorMessage("aruba_action: invalid secret type specified");
return;
}
v16 = strlen(v14);
v17 = v13 - v16;
if ( v17 <= 0 )
goto LABEL_25;
v18 = &v14[v16];
snprintf(v18, v17, "<key>%s</key>", *(const char **)a4);
v19 = strlen(v18);
v20 = v17 - v19;
if ( v20 <= 0
|| (v21 = &v18[v19], snprintf(v21, v20, "<version>1.0</version>"), v22 = strlen(v21), v23 = v20 - v22, v23 <= 0) )
{
LABEL_25:
ErrorMessage("aruba_action: configuration parameters too long\n");
FatalError("Unable to parse configuration parameters for ArubaAction output plugin.\n");
}
else
{
snprintf(&v21[v22], v23, "</aruba>");
v24 = strlen(s);
v25 = inet_ntoa(*(struct in_addr *)(a4 + 24));
v26 = snprintf(
v32,
0x3FFuLL,
"POST /auth/command.xml HTTP/1.0\r\n"
"User-Agent: snort\r\n"
"Host: %s\r\n"
"Pragma: no-cache\r\n"
"Content-Length: %lu\r\n"
"Content-Type: application/xml\r\n"
"\r\n"
"%s",
v25,
v24,
s);
if ( (unsigned int)func4(a4, v32, v26) == v26 )
{
if ( (int)func5(a4, haystack, 1024) < 0 )
{
ErrorMessage("aruba_action: Error reading response from Aruba switch\n");
close(*(_DWORD *)(a4 + 28));
}
else
{
v27 = strstr(haystack, "<code>");
if ( v27 )
{
if ( (unsigned int)_isoc99_sscanf(v27 + 6, "%d", &v30) == 1 )
{
if ( v30 )
{
v28 = (unsigned __int8 *)&response_lookup;
v29 = "success";
while ( v30 != *v28 )
{
v28 += 16;
v29 = (const char *)*((_QWORD *)v28 + 1);
if ( !v29 )
goto LABEL_34;
}
if ( !v29 )
{
LABEL_34:
ErrorMessage("aruba_action: Switch returned error status of %d \"unknown\"\n", v30);
goto LABEL_40;
}
ErrorMessage("aruba_action: Switch returned error status of %d \"%s\"\n", v30, v29);
}
LABEL_40:
close(*(_DWORD *)(a4 + 28));
}
else
{
ErrorMessage("aruba_action: Invalid response code returned from the Aruba switch.\n");
}
}
else
{
ErrorMessage("aruba_action: Error extracting response code from Aruba switch\n");
close(*(_DWORD *)(a4 + 28));
}
}
}
else
{
ErrorMessage("aruba_action: Error sending data to Aruba switch.\n");
close(*(_DWORD *)(a4 + 28));
}
}
}
}

original_code:
void AlertArubaAction(Packet *p, void *event, uint32_t event_type, void *arg)
{
 char cmdbuf[512], post[1024];
 char response[1024];
 char *cmdbufp, *responsecode, *responsemsg;
 int postlen, xmllenrem, i, responsecodei;
 if ( p == ((void *)0) || arg == ((void *)0) )
 {
  return;
 }
 SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 cmdbufp = cmdbuf;
 data->fd = ArubaSwitchConnect(data);
 if (data->fd < 0) {
  ErrorMessage("Unable to connect to Aruba switch at %s\n",
    inet_ntoa(data->aswitch));
  return;
 }
 xmllenrem = 512;
 switch(data->action_type) {
  case 1:
  snprintf(cmdbufp, xmllenrem, "xml=<aruba "
    "command=user_blacklist>");
  break;
  case 2:
  snprintf(cmdbufp, xmllenrem, "xml=<aruba command=user_add>"
    "<role>%s</role>", data->role_name);
  break;
  default:
  ErrorMessage("aruba_action: invalid action type specified");
  return;
  break;
 }
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<ipaddr>%s</ipaddr>",
   inet_ntoa(p->iph->ip_src)
        );
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 switch(data->secret_type) {
  case 1:
  snprintf(cmdbufp, xmllenrem, "<authentication>sha-1"
    "</authentication>");
  break;
  case 2:
  snprintf(cmdbufp, xmllenrem, "<authentication>md5"
    "</authentication>");
  break;
  case 4:
  snprintf(cmdbufp, xmllenrem, "<authentication>cleartext"
    "</authentication>");
  break;
  default:
  ErrorMessage("aruba_action: invalid secret type specified");
  return;
  break;
 }
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<key>%s</key>", data->secret);
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<version>1.0</version>");
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "</aruba>");
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 cmdbufp = ((void *)0);
 postlen = snprintf(post, 1024 -1,
   "POST /auth/command.xml HTTP/1.0\r\n"
   "User-Agent: snort\r\n"
   "Host: %s\r\n"
   "Pragma: no-cache\r\n"
   "Content-Length: %lu\r\n"
   "Content-Type: application/xml\r\n"
   "\r\n"
   "%s",
   inet_ntoa(data->aswitch),
   (unsigned long)strlen(cmdbuf), cmdbuf
        );
 if (ArubaSwitchSend(data, (uint8_t *)post, postlen) != postlen) {
  ErrorMessage("aruba_action: Error sending data to Aruba "
    "switch.\n");
  close(data->fd);
  return;
 }
 if (ArubaSwitchRecv(data, (uint8_t *)response, 1024) < 0) {
  ErrorMessage("aruba_action: Error reading response from Aruba"
    " switch\n");
  close(data->fd);
  return;
 }
 responsecode = strstr(response, "<code>");
 if (responsecode == ((void *)0)) {
  ErrorMessage("aruba_action: Error extracting response code "
    "from Aruba switch\n");
  close(data->fd);
  return;
 }
 responsecode += (strlen("<code>"));
 if (sscanf(responsecode, "%d", &responsecodei) != 1) {
  ErrorMessage("aruba_action: Invalid response code returned from"
    " the Aruba switch.\n");
  return;
 }
 if (responsecodei != 0) {
  responsemsg = ((void *)0);
  for (i=0; response_lookup[i].name != ((void *)0); i++) {
   if (response_lookup[i].type == responsecodei) {
    responsemsg = response_lookup[i].name;
    break;
   }
  }
  if (responsemsg == ((void *)0)) {
   ErrorMessage("aruba_action: Switch returned error "
     "status of %d \"unknown\"\n",
     responsecodei);
  } else {
   ErrorMessage("aruba_action: Switch returned error "
     "status of %d \"%s\"\n",
     responsecodei, responsemsg);
  }
  close(data->fd);
  return;
 }
 close(data->fd);
 return;
}

canonical_original_code:
void AlertArubaAction(struct _Packet *p, void *event, unsigned int event_type, void *arg)
{
 char cmdbuf[512]; char post[1024];
 char response[1024];
 char *cmdbufp; char *responsecode; char *responsemsg;
 int postlen; int xmllenrem; int i; int responsecodei;
 if ( p == ((void *)0) || arg == ((void *)0) )
 {
  return;
 }
 struct _SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 cmdbufp = cmdbuf;
 data->fd = ArubaSwitchConnect(data);
 if (data->fd < 0) {
  ErrorMessage("Unable to connect to Aruba switch at %s\n",
    inet_ntoa(data->aswitch));
  return;
 }
 xmllenrem = 512;
 switch(data->action_type) {
  case 1:
  snprintf(cmdbufp, xmllenrem, "xml=<aruba "
    "command=user_blacklist>");
  break;
  case 2:
  snprintf(cmdbufp, xmllenrem, "xml=<aruba command=user_add>"
    "<role>%s</role>", data->role_name);
  break;
  default:
  ErrorMessage("aruba_action: invalid action type specified");
  return;
  break;
 }
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<ipaddr>%s</ipaddr>",
   inet_ntoa(p->iph->ip_src)
        );
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 switch(data->secret_type) {
  case 1:
  snprintf(cmdbufp, xmllenrem, "<authentication>sha-1"
    "</authentication>");
  break;
  case 2:
  snprintf(cmdbufp, xmllenrem, "<authentication>md5"
    "</authentication>");
  break;
  case 4:
  snprintf(cmdbufp, xmllenrem, "<authentication>cleartext"
    "</authentication>");
  break;
  default:
  ErrorMessage("aruba_action: invalid secret type specified");
  return;
  break;
 }
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<key>%s</key>", data->secret);
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<version>1.0</version>");
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "</aruba>");
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 cmdbufp = ((void *)0);
 postlen = snprintf(post, 1024 -1,
   "POST /auth/command.xml HTTP/1.0\r\n"
   "User-Agent: snort\r\n"
   "Host: %s\r\n"
   "Pragma: no-cache\r\n"
   "Content-Length: %lu\r\n"
   "Content-Type: application/xml\r\n"
   "\r\n"
   "%s",
   inet_ntoa(data->aswitch),
   (unsigned long)strlen(cmdbuf), cmdbuf
        );
 if (ArubaSwitchSend(data, (unsigned char *)post, postlen) != postlen) {
  ErrorMessage("aruba_action: Error sending data to Aruba "
    "switch.\n");
  close(data->fd);
  return;
 }
 if (ArubaSwitchRecv(data, (unsigned char *)response, 1024) < 0) {
  ErrorMessage("aruba_action: Error reading response from Aruba"
    " switch\n");
  close(data->fd);
  return;
 }
 responsecode = strstr(response, "<code>");
 if (responsecode == ((void *)0)) {
  ErrorMessage("aruba_action: Error extracting response code "
    "from Aruba switch\n");
  close(data->fd);
  return;
 }
 responsecode += (strlen("<code>"));
 if (sscanf(responsecode, "%d", &responsecodei) != 1) {
  ErrorMessage("aruba_action: Invalid response code returned from"
    " the Aruba switch.\n");
  return;
 }
 if (responsecodei != 0) {
  responsemsg = ((void *)0);
  for (i=0; response_lookup[i].name != ((void *)0); i++) {
   if (response_lookup[i].type == responsecodei) {
    responsemsg = response_lookup[i].name;
    break;
   }
  }
  if (responsemsg == ((void *)0)) {
   ErrorMessage("aruba_action: Switch returned error "
     "status of %d \"unknown\"\n",
     responsecodei);
  } else {
   ErrorMessage("aruba_action: Switch returned error "
     "status of %d \"%s\"\n",
     responsecodei, responsemsg);
  }
  close(data->fd);
  return;
 }
 close(data->fd);
 return;
}

variable_types:
cmdbuf
char [512]

variable_types:
post
char [1024]

variable_types:
response
char [1024]

variable_types:
cmdbufp
char *

variable_types:
responsecode
char *

variable_types:
responsemsg
char *

variable_types: postlen int

variable_types: xmllenrem int

variable_types: i int

variable_types: responsecodei int

user_defined_types: struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; }

user_defined_types: struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; }

user_defined_types: struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; }

user_defined_types: struct _EthLlc { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; }

user_defined_types: struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; }

user_defined_types: struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; }

user_defined_types: struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; }

user_defined_types: struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; }

user_defined_types: struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; }

user_defined_types: struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; }

user_defined_types: struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Fddi_llc_other { unsigned char ctrl_fld[1]; }

user_defined_types: struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; }

user_defined_types: struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; }

user_defined_types: struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; }

user_defined_types: struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; }

user_defined_types: struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; }

user_defined_types: struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; }

user_defined_types: struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; }

user_defined_types: struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; }

user_defined_types: struct _Options { unsigned char code; unsigned char len; unsigned char *data; }

user_defined_types: struct _IP6Option { unsigned char type; unsigned char *data; }

user_defined_types: struct timeval { long tv_sec; long tv_usec; }

user_defined_types: struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; }

user_defined_types: struct idseq { unsigned short id; unsigned short seq; }

user_defined_types: struct pmtu { unsigned short ipm_void; unsigned short nextmtu; }

user_defined_types: struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; }

user_defined_types: struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; }

user_defined_types: struct ra_addr { unsigned int addr; unsigned int preference; }


ParseAlertArubaActionArgs

decompiled_code:
__int64 __fastcall ParseAlertArubaActionArgs(const char *a1)
{
__int64 v1; // rax
__int64 v2; // r12
const char **v3; // rax
__int64 v4; // r15
const char *v5; // r14
__int64 v6; // rbp
const char *v7; // rbx
size_t v8; // rax
size_t v9; // rax
char *v10; // rbx
const char *v11; // rbp
size_t v12; // rax
__int64 v13; // r15
const char *v14; // r14
__int64 v15; // rbp
const char *v16; // rbx
size_t v17; // rax
char v18; // al
__int64 v20; // rax
__int64 v21; // rbx
size_t v22; // rax
char *v23; // rbp
const char *v24; // rbx
size_t v25; // rax
int v26; // [rsp+0h] [rbp-48h] BYREF
unsigned int v27; // [rsp+4h] [rbp-44h] BYREF
const char **v28; // [rsp+8h] [rbp-40h] BYREF

v1 = SnortAlloc(32LL);
if ( a1 )
{
v2 = v1;
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 557;
DebugMessageFunc(32LL, "ParseAlertArubaActionArgs: %s\n", a1);
v3 = (const char **)mSplit(a1, " ", 4LL, &v27, 0LL);
v28 = v3;
if ( v27 == 4 )
{
if ( inet_aton(*v3, (struct in_addr *)(v2 + 24)) )
{
v4 = (__int64)v28;
v5 = v28[1];
v6 = 0LL;
v7 = "sha1";
while ( 1 )
{
v8 = strlen(v7);
if ( !strncmp(v5, v7, v8) )
break;
++v6;
v7 = (const char *)secret_lookup[2 * v6 + 1];
if ( !v7 )
goto LABEL_12;
}
*(_BYTE *)(v2 + 8) = secret_lookup[2 * (int)v6];
LABEL_12:
if ( *(_BYTE *)(v2 + 8) )
{
v9 = strlen(*(const char **)(v4 + 16));
v10 = (char *)SnortAlloc(v9 + 1);
*(_QWORD *)v2 = v10;
v11 = v28[2];
v12 = strlen(v11);
strncpy(v10, v11, v12);
v13 = (__int64)v28;
v14 = v28[3];
v15 = 0LL;
v16 = "blacklist";
while ( 1 )
{
v17 = strlen(v16);
if ( !strncmp(v16, v14, v17) )
break;
++v15;
v16 = (const char *)action_lookup[2 * v15 + 1];
if ( !v16 )
goto LABEL_19;
}
*(_BYTE *)(v2 + 9) = action_lookup[2 * (int)v15];
LABEL_19:
v18 = *(_BYTE *)(v2 + 9);
if ( v18 )
{
if ( v18 == 2 )
{
v20 = mSplit(*(_QWORD *)(v13 + 24), ":", 2LL, &v26, 0LL);
v21 = v20;
if ( v26 != 2 )
{
ErrorMessage("aruba_action: malformed setrole action specification \"%s\"\n", v28[3]);
FatalError("Improperly formatted action\n");
return 0LL;
}
v22 = strlen(*(const char **)(v20 + 8));
v23 = (char *)SnortAlloc(v22 + 1);
*(_QWORD *)(v2 + 16) = v23;
v24 = *(const char **)(v21 + 8);
v25 = strlen(v24);
strncpy(v23, v24, v25);
}
mSplitFree(&v28, v27);
}
else
{
ErrorMessage("aruba_action: unknown action type \"%s\"\n", *(const char **)(v13 + 24));
FatalError("Unsupported action type specified\n");
v2 = 0LL;
}
}
else
{
ErrorMessage("aruba_action: unknown secret type \"%s\"\n", *(const char **)(v4 + 8));
FatalError("Unsupported secret type specified\n");
v2 = 0LL;
}
}
else
{
ErrorMessage("aruba_action: invalid Aruba switch address specified (%s)\n", *v28);
FatalError("Invalid Aruba switch address.\n");
v2 = 0LL;
}
}
else
{
ErrorMessage("aruba_action: incorrect number of arguments specified (%d)\n", v27);
FatalError("Invalid argument count\n");
v2 = 0LL;
}
}
else
{
ErrorMessage("aruba_action: you must specify arguments for the Aruba Action plugin\n");
FatalError("No output plugin arguments specified\n");
v2 = 0LL;
}
return v2;
}

canonical_decompiled_code:
__int64 __fastcall func8(const char *a1)
{
__int64 v1; // rax
__int64 v2; // r12
const char **v3; // rax
__int64 v4; // r15
const char *v5; // r14
__int64 v6; // rbp
const char *v7; // rbx
size_t v8; // rax
size_t v9; // rax
char *v10; // rbx
const char *v11; // rbp
size_t v12; // rax
__int64 v13; // r15
const char *v14; // r14
__int64 v15; // rbp
const char *v16; // rbx
size_t v17; // rax
char v18; // al
__int64 v20; // rax
__int64 v21; // rbx
size_t v22; // rax
char *v23; // rbp
const char *v24; // rbx
size_t v25; // rax
int v26; // [rsp+0h] [rbp-48h] BYREF
unsigned int v27; // [rsp+4h] [rbp-44h] BYREF
const char **v28; // [rsp+8h] [rbp-40h] BYREF

v1 = SnortAlloc(32LL);
if ( a1 )
{
v2 = v1;
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 557;
DebugMessageFunc(32LL, "ParseAlertArubaActionArgs: %s\n", a1);
v3 = (const char **)mSplit(a1, " ", 4LL, &v27, 0LL);
v28 = v3;
if ( v27 == 4 )
{
if ( inet_aton(*v3, (struct in_addr *)(v2 + 24)) )
{
v4 = (__int64)v28;
v5 = v28[1];
v6 = 0LL;
v7 = "sha1";
while ( 1 )
{
v8 = strlen(v7);
if ( !strncmp(v5, v7, v8) )
break;
++v6;
v7 = (const char *)secret_lookup[2 * v6 + 1];
if ( !v7 )
goto LABEL_12;
}
*(_BYTE *)(v2 + 8) = secret_lookup[2 * (int)v6];
LABEL_12:
if ( *(_BYTE *)(v2 + 8) )
{
v9 = strlen(*(const char **)(v4 + 16));
v10 = (char *)SnortAlloc(v9 + 1);
*(_QWORD *)v2 = v10;
v11 = v28[2];
v12 = strlen(v11);
strncpy(v10, v11, v12);
v13 = (__int64)v28;
v14 = v28[3];
v15 = 0LL;
v16 = "blacklist";
while ( 1 )
{
v17 = strlen(v16);
if ( !strncmp(v16, v14, v17) )
break;
++v15;
v16 = (const char *)action_lookup[2 * v15 + 1];
if ( !v16 )
goto LABEL_19;
}
*(_BYTE *)(v2 + 9) = action_lookup[2 * (int)v15];
LABEL_19:
v18 = *(_BYTE *)(v2 + 9);
if ( v18 )
{
if ( v18 == 2 )
{
v20 = mSplit(*(_QWORD *)(v13 + 24), ":", 2LL, &v26, 0LL);
v21 = v20;
if ( v26 != 2 )
{
ErrorMessage("aruba_action: malformed setrole action specification \"%s\"\n", v28[3]);
FatalError("Improperly formatted action\n");
return 0LL;
}
v22 = strlen(*(const char **)(v20 + 8));
v23 = (char *)SnortAlloc(v22 + 1);
*(_QWORD *)(v2 + 16) = v23;
v24 = *(const char **)(v21 + 8);
v25 = strlen(v24);
strncpy(v23, v24, v25);
}
mSplitFree(&v28, v27);
}
else
{
ErrorMessage("aruba_action: unknown action type \"%s\"\n", *(const char **)(v13 + 24));
FatalError("Unsupported action type specified\n");
v2 = 0LL;
}
}
else
{
ErrorMessage("aruba_action: unknown secret type \"%s\"\n", *(const char **)(v4 + 8));
FatalError("Unsupported secret type specified\n");
v2 = 0LL;
}
}
else
{
ErrorMessage("aruba_action: invalid Aruba switch address specified (%s)\n", *v28);
FatalError("Invalid Aruba switch address.\n");
v2 = 0LL;
}
}
else
{
ErrorMessage("aruba_action: incorrect number of arguments specified (%d)\n", v27);
FatalError("Invalid argument count\n");
v2 = 0LL;
}
}
else
{
ErrorMessage("aruba_action: you must specify arguments for the Aruba Action plugin\n");
FatalError("No output plugin arguments specified\n");
v2 = 0LL;
}
return v2;
}

original_code:
SpoAlertArubaActionData *ParseAlertArubaActionArgs(char *args)
{
 char **toks, **action_toks;
 int num_toks, num_action_toks, i;
 SpoAlertArubaActionData *data;
 data = (SpoAlertArubaActionData *)SnortAlloc(sizeof(SpoAlertArubaActionData));
 if(args == ((void *)0)) {
  ErrorMessage("aruba_action: you must specify arguments for the "
    "Aruba Action plugin\n");
  FatalError("No output plugin arguments specified\n");
  return ((void *)0);
 }
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 557; DebugMessageFunc(0x00000020, "ParseAlertArubaActionArgs: %s\n", args);;
 toks = mSplit(args, " ", 4, &num_toks, 0);
 if (num_toks != 4) {
  ErrorMessage("aruba_action: incorrect number of arguments "
    "specified (%d)\n", num_toks);
  FatalError("Invalid argument count\n");
  return ((void *)0);
 }
 if (inet_aton(toks[0], &data->aswitch) == 0)
    {
  ErrorMessage("aruba_action: invalid Aruba switch address "
    "specified (%s)\n", toks[0]);
  FatalError("Invalid Aruba switch address.\n");
  return ((void *)0);
 }
 for (i=0; secret_lookup[i].name != ((void *)0); i++) {
  if (strncmp(toks[1], secret_lookup[i].name,
    strlen(secret_lookup[i].name)) == 0) {
   data->secret_type = secret_lookup[i].type;
   break;
  }
 }
 if (data->secret_type == 0) {
  ErrorMessage("aruba_action: unknown secret type \"%s\"\n",
    toks[1]);
  FatalError("Unsupported secret type specified\n");
  return ((void *)0);
 }
 data->secret = (char *)SnortAlloc(strlen(toks[2])+1);
 strncpy(data->secret, toks[2], strlen(toks[2]));
 for (i=0; action_lookup[i].name != ((void *)0); i++) {
  if (strncmp(action_lookup[i].name, toks[3],
    strlen(action_lookup[i].name)) == 0) {
   data->action_type = action_lookup[i].type;
   break;
  }
 }
 if (data->action_type == 0) {
  ErrorMessage("aruba_action: unknown action type \"%s\"\n",
    toks[3]);
  FatalError("Unsupported action type specified\n");
  return ((void *)0);
 }
 if (data->action_type == 2) {
  action_toks = mSplit(toks[3], ":", 2, &num_action_toks, 0);
  if (num_action_toks != 2) {
   ErrorMessage("aruba_action: malformed setrole action "
     "specification \"%s\"\n", toks[3]);
   FatalError("Improperly formatted action\n");
   return ((void *)0);
  }
  data->role_name = (char *)SnortAlloc(strlen(action_toks[1])+1);
  strncpy(data->role_name, action_toks[1],
    strlen(action_toks[1]));
 }
 mSplitFree(&toks, num_toks);
 return data;
}

canonical_original_code:
struct _SpoAlertArubaActionData *ParseAlertArubaActionArgs(char *args)
{
 char **toks; char **action_toks;
 int num_toks; int num_action_toks; int i;
 struct _SpoAlertArubaActionData *data;
 data = (struct _SpoAlertArubaActionData *)SnortAlloc(sizeof(SpoAlertArubaActionData));
 if(args == ((void *)0)) {
  ErrorMessage("aruba_action: you must specify arguments for the "
    "Aruba Action plugin\n");
  FatalError("No output plugin arguments specified\n");
  return ((void *)0);
 }
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 557; DebugMessageFunc(0x00000020, "ParseAlertArubaActionArgs: %s\n", args);;
 toks = mSplit(args, " ", 4, &num_toks, 0);
 if (num_toks != 4) {
  ErrorMessage("aruba_action: incorrect number of arguments "
    "specified (%d)\n", num_toks);
  FatalError("Invalid argument count\n");
  return ((void *)0);
 }
 if (inet_aton(toks[0], &data->aswitch) == 0)
    {
  ErrorMessage("aruba_action: invalid Aruba switch address "
    "specified (%s)\n", toks[0]);
  FatalError("Invalid Aruba switch address.\n");
  return ((void *)0);
 }
 for (i=0; secret_lookup[i].name != ((void *)0); i++) {
  if (strncmp(toks[1], secret_lookup[i].name,
    strlen(secret_lookup[i].name)) == 0) {
   data->secret_type = secret_lookup[i].type;
   break;
  }
 }
 if (data->secret_type == 0) {
  ErrorMessage("aruba_action: unknown secret type \"%s\"\n",
    toks[1]);
  FatalError("Unsupported secret type specified\n");
  return ((void *)0);
 }
 data->secret = (char *)SnortAlloc(strlen(toks[2])+1);
 strncpy(data->secret, toks[2], strlen(toks[2]));
 for (i=0; action_lookup[i].name != ((void *)0); i++) {
  if (strncmp(action_lookup[i].name, toks[3],
    strlen(action_lookup[i].name)) == 0) {
   data->action_type = action_lookup[i].type;
   break;
  }
 }
 if (data->action_type == 0) {
  ErrorMessage("aruba_action: unknown action type \"%s\"\n",
    toks[3]);
  FatalError("Unsupported action type specified\n");
  return ((void *)0);
 }
 if (data->action_type == 2) {
  action_toks = mSplit(toks[3], ":", 2, &num_action_toks, 0);
  if (num_action_toks != 2) {
   ErrorMessage("aruba_action: malformed setrole action "
     "specification \"%s\"\n", toks[3]);
   FatalError("Improperly formatted action\n");
   return ((void *)0);
  }
  data->role_name = (char *)SnortAlloc(strlen(action_toks[1])+1);
  strncpy(data->role_name, action_toks[1],
    strlen(action_toks[1]));
 }
 mSplitFree(&toks, num_toks);
 return data;
}

variable_types:
args
char *

variable_types:
toks
char **

return_type: struct _SpoAlertArubaActionData { char *secret; unsigned char secret_type; unsigned char action_type; char *role_name; struct in_addr { unsigned int s_addr; } aswitch; int fd; } *

user_defined_types: struct _SpoAlertArubaActionData { char *secret; unsigned char secret_type; unsigned char action_type; char *role_name; struct in_addr aswitch; int fd; }


AlertArubaActionInit

decompiled_code:
__int64 __fastcall AlertArubaActionInit(const char *a1)
{
__int64 v1; // rbx

DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 204;
DebugMessageFunc(1LL, "Output: AlertArubaAction Initialized\n");
v1 = ParseAlertArubaActionArgs(a1);
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 210;
DebugMessageFunc(1LL, "Linking AlertArubaAction functions to call lists...\n");
AddFuncToOutputList(AlertArubaAction, 1LL, v1);
AddFuncToCleanExitList(AlertArubaActionCleanExitFunc, v1);
return AddFuncToRestartList(AlertArubaActionRestartFunc, v1);
}

canonical_decompiled_code:
__int64 __fastcall func9(const char *a1)
{
__int64 v1; // rbx

DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 204;
DebugMessageFunc(1LL, "Output: AlertArubaAction Initialized\n");
v1 = func8(a1);
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 210;
DebugMessageFunc(1LL, "Linking AlertArubaAction functions to call lists...\n");
AddFuncToOutputList(AlertArubaAction, 1LL, v1);
AddFuncToCleanExitList(AlertArubaActionCleanExitFunc, v1);
return AddFuncToRestartList(AlertArubaActionRestartFunc, v1);
}

original_code:
void AlertArubaActionInit(char *args)
{
 SpoAlertArubaActionData *data;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 204; DebugMessageFunc(0x00000001,"Output: AlertArubaAction " "Initialized\n");;
 data = ParseAlertArubaActionArgs(args);
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 210; DebugMessageFunc(0x00000001,"Linking AlertArubaAction functions " "to call lists...\n");;
 AddFuncToOutputList(AlertArubaAction, OUTPUT_TYPE__ALERT, data);
 AddFuncToCleanExitList(AlertArubaActionCleanExitFunc, data);
 AddFuncToRestartList(AlertArubaActionRestartFunc, data);
}

canonical_original_code:
void AlertArubaActionInit(char *args)
{
 struct _SpoAlertArubaActionData *data;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 204; DebugMessageFunc(0x00000001,"Output: AlertArubaAction " "Initialized\n");;
 data = ParseAlertArubaActionArgs(args);
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 210; DebugMessageFunc(0x00000001,"Linking AlertArubaAction functions " "to call lists...\n");;
 AddFuncToOutputList(AlertArubaAction, OUTPUT_TYPE__ALERT, data);
 AddFuncToCleanExitList(AlertArubaActionCleanExitFunc, data);
 AddFuncToRestartList(AlertArubaActionRestartFunc, data);
}

variable_types: struct _SpoAlertArubaActionData { char *secret; unsigned char secret_type; unsigned char action_type; char *role_name; struct in_addr { unsigned int s_addr; } aswitch; int fd; } *


BcDaemonMode

decompiled_code:
__int64 BcDaemonMode()
{
return *(_DWORD *)(barnyard2_conf + 8LL) & 2;
}

canonical_decompiled_code:
__int64 func0()
{
return *(_DWORD *)(barnyard2_conf + 8LL) & 2;
}

original_code:
static inline int BcDaemonMode(void)
{
    return barnyard2_conf->run_flags & RUN_FLAG__DAEMON;
}

canonical_original_code:
static inline int BcDaemonMode()
{
    return barnyard2_conf->run_flags & RUN_FLAG__DAEMON;
}


BcAlertInterface

decompiled_code:
__int64 BcAlertInterface()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x200;
}

canonical_decompiled_code:
__int64 func1()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x200;
}

original_code:
static inline int BcAlertInterface(void)
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__ALERT_IFACE;
}

canonical_original_code:
static inline int BcAlertInterface()
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__ALERT_IFACE;
}