AlertCEF

decompiled_code:
void __fastcall AlertCEF(__int64 a1, unsigned int *a2, __int64 a3, __int64 a4)
{
unsigned int v5; // er13
unsigned int v6; // eax
__int64 v7; // r14
unsigned int v8; // eax
__int64 v9; // r13
const char *v10; // r15
unsigned int v11; // er14
unsigned int v12; // eax
__int64 v13; // rdx
unsigned __int8 v14; // al
const char *v15; // r13
char *v16; // rbx
char *v17; // rax
const char *v18; // r14
__int64 v19; // r13
unsigned int v20; // ebx
char *v21; // r15
char *v22; // rax
unsigned int v23; // [rsp+0h] [rbp-43Ch]
char v24[1080]; // [rsp+4h] [rbp-438h] BYREF

if ( a4 != 0 && a2 != 0LL )
{
if ( a1 )
{
v5 = _bswap_32(a2[4]);
v6 = _bswap_32(a2[5]);
v7 = GetSigByGidSid(v6, v5);
v8 = _bswap_32(a2[7]);
ClassTypeLookupById(barnyard2_conf, v8);
SnortSnprintf(v24, 1024LL, "CEF:0|snort|barnyard2|%s", "1.9");
if ( *(_QWORD *)(a1 + 72) )
{
v9 = 11 - (unsigned int)_bswap_32(a2[8]);
if ( (int)v9 > 10 )
v9 = 10LL;
if ( (int)v9 < 0 )
v9 = 0LL;
v10 = "ALERT";
if ( v7 )
v10 = *(const char **)(v7 + 32);
v11 = _bswap_32(a2[6]);
v23 = _bswap_32(a2[4]);
v12 = _bswap_32(a2[5]);
if ( !(unsigned int)SnortSnprintfAppend(v24, 1024LL, "%lu:%lu:%lu|%s|%d|", v12, v23, v11, v10, v9) )
{
v13 = *(_QWORD *)(a1 + 72);
v14 = *(_BYTE *)(v13 + 9);
if ( (v14 == 6 || v14 == 17) && !*(_BYTE *)(a1 + 852) )
{
v18 = *(const char **)(protocol_names + 8LL * v14);
v19 = *(unsigned __int16 *)(a1 + 844);
v20 = *(unsigned __int16 *)(a1 + 842);
v21 = inet_ntoa(*(struct in_addr *)(v13 + 16));
v22 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
if ( (unsigned int)SnortSnprintfAppend(
v24,
1024LL,
"src=%s dst=%s spt=%i dpt=%i proto=%s",
v22,
v21,
v20,
v19,
v18) )
return;
}
else
{
v15 = *(const char **)(protocol_names + 8LL * v14);
v16 = inet_ntoa(*(struct in_addr *)(v13 + 16));
v17 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
if ( (unsigned int)SnortSnprintfAppend(v24, 1024LL, "src=%s dst=%s proto=%s", v17, v16, v15) )
return;
}
syslog(*(_DWORD *)(a4 + 4), "%s", v24);
}
}
}
}
}

canonical_decompiled_code:
void __fastcall func2(__int64 a1, unsigned int *a2, __int64 a3, __int64 a4)
{
unsigned int v5; // er13
unsigned int v6; // eax
__int64 v7; // r14
unsigned int v8; // eax
__int64 v9; // r13
const char *v10; // r15
unsigned int v11; // er14
unsigned int v12; // eax
__int64 v13; // rdx
unsigned __int8 v14; // al
const char *v15; // r13
char *v16; // rbx
char *v17; // rax
const char *v18; // r14
__int64 v19; // r13
unsigned int v20; // ebx
char *v21; // r15
char *v22; // rax
unsigned int v23; // [rsp+0h] [rbp-43Ch]
char v24[1080]; // [rsp+4h] [rbp-438h] BYREF

if ( a4 != 0 && a2 != 0LL )
{
if ( a1 )
{
v5 = func1(a2[4]);
v6 = func1(a2[5]);
v7 = GetSigByGidSid(v6, v5);
v8 = func1(a2[7]);
ClassTypeLookupById(barnyard2_conf, v8);
SnortSnprintf(v24, 1024LL, "CEF:0|snort|barnyard2|%s", "1.9");
if ( *(_QWORD *)(a1 + 72) )
{
v9 = 11 - (unsigned int)func1(a2[8]);
if ( (int)v9 > 10 )
v9 = 10LL;
if ( (int)v9 < 0 )
v9 = 0LL;
v10 = "ALERT";
if ( v7 )
v10 = *(const char **)(v7 + 32);
v11 = func1(a2[6]);
v23 = func1(a2[4]);
v12 = func1(a2[5]);
if ( !(unsigned int)SnortSnprintfAppend(v24, 1024LL, "%lu:%lu:%lu|%s|%d|", v12, v23, v11, v10, v9) )
{
v13 = *(_QWORD *)(a1 + 72);
v14 = *(_BYTE *)(v13 + 9);
if ( (v14 == 6 || v14 == 17) && !*(_BYTE *)(a1 + 852) )
{
v18 = *(const char **)(protocol_names + 8LL * v14);
v19 = *(unsigned __int16 *)(a1 + 844);
v20 = *(unsigned __int16 *)(a1 + 842);
v21 = inet_ntoa(*(struct in_addr *)(v13 + 16));
v22 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
if ( (unsigned int)SnortSnprintfAppend(
v24,
1024LL,
"src=%s dst=%s spt=%i dpt=%i proto=%s",
v22,
v21,
v20,
v19,
v18) )
return;
}
else
{
v15 = *(const char **)(protocol_names + 8LL * v14);
v16 = inet_ntoa(*(struct in_addr *)(v13 + 16));
v17 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
if ( (unsigned int)SnortSnprintfAppend(v24, 1024LL, "src=%s dst=%s proto=%s", v17, v16, v15) )
return;
}
syslog(*(_DWORD *)(a4 + 4), "%s", v24);
}
}
}
}
}

original_code:
void AlertCEF(Packet *p, void *event, u_int32_t event_type, void *arg)
{
    char cef_message[1024];
    CEFData *data;
 SigNode *sn;
 ClassType *cn;
    int cef_severity;
 if ( p == ((void *)0) || event == ((void *)0) || arg == ((void *)0) )
 {
  return;
 }
 data = (CEFData *)arg;
 sn = GetSigByGidSid(ntohl(((Unified2EventCommon *)event)->generator_id),
      ntohl(((Unified2EventCommon *)event)->signature_id));
 cn = ClassTypeLookupById(barnyard2_conf, ntohl(((Unified2EventCommon *)event)->classification_id));
    if (!1)
    {
        return;
    }
    SnortSnprintf(cef_message, 1024, "CEF:0|snort|barnyard2|%s", "1.9");
    if(p && p->iph)
    {
        cef_severity = (11 - ntohl(((Unified2EventCommon *)event)->priority_id));
        if ( cef_severity < 0 )
            cef_severity = 0;
        else if ( cef_severity > 10 )
            cef_severity = 10;
        if( SnortSnprintfAppend(cef_message, 1024, "%lu:%lu:%lu|%s|%d|",
                          (unsigned long) ntohl(((Unified2EventCommon *)event)->generator_id),
                          (unsigned long) ntohl(((Unified2EventCommon *)event)->signature_id),
                          (unsigned long) ntohl(((Unified2EventCommon *)event)->signature_revision),
                          sn == ((void *)0) ? "ALERT" : sn->msg, cef_severity) != 0 )
                return ;
        if( (p->iph->ip_proto != IPPROTO_TCP && p->iph->ip_proto != IPPROTO_UDP) || p->frag_flag )
        {
            if( SnortSnprintfAppend(cef_message, 1024, "src=%s dst=%s proto=%s",
                                    inet_ntoa(p->iph->ip_src), inet_ntoa(p->iph->ip_dst),
                                    protocol_names[p->iph->ip_proto]) != 0 )
                return;
        }
        else
        {
            if( SnortSnprintfAppend(cef_message, 1024, "src=%s dst=%s spt=%i dpt=%i proto=%s",
                                 inet_ntoa(p->iph->ip_src), inet_ntoa(p->iph->ip_dst), p->sp, p->dp,
                                 protocol_names[p->iph->ip_proto]) != 0 )
                return ;
        }
        syslog(data->priority, "%s", cef_message);
    }
    return;
}

canonical_original_code:
void AlertCEF(struct _Packet *p, void *event, unsigned int event_type, void *arg)
{
    char cef_message[1024];
    struct _CEFData *data;
 struct _SigNode *sn;
 struct _ClassType *cn;
    int cef_severity;
 if ( p == ((void *)0) || event == ((void *)0) || arg == ((void *)0) )
 {
  return;
 }
 data = (struct _CEFData *)arg;
 sn = GetSigByGidSid(ntohl(((struct _Unified2EventCommon *)event)->generator_id),
      ntohl(((struct _Unified2EventCommon *)event)->signature_id));
 cn = ClassTypeLookupById(barnyard2_conf, ntohl(((struct _Unified2EventCommon *)event)->classification_id));
    if (!1)
    {
        return;
    }
    SnortSnprintf(cef_message, 1024, "CEF:0|snort|barnyard2|%s", "1.9");
    if(p && p->iph)
    {
        cef_severity = (11 - ntohl(((struct _Unified2EventCommon *)event)->priority_id));
        if ( cef_severity < 0 )
            cef_severity = 0;
        else if ( cef_severity > 10 )
            cef_severity = 10;
        if( SnortSnprintfAppend(cef_message, 1024, "%lu:%lu:%lu|%s|%d|",
                          (unsigned long) ntohl(((struct _Unified2EventCommon *)event)->generator_id),
                          (unsigned long) ntohl(((struct _Unified2EventCommon *)event)->signature_id),
                          (unsigned long) ntohl(((struct _Unified2EventCommon *)event)->signature_revision),
                          sn == ((void *)0) ? "ALERT" : sn->msg, cef_severity) != 0 )
                return ;
        if( (p->iph->ip_proto != IPPROTO_TCP && p->iph->ip_proto != IPPROTO_UDP) || p->frag_flag )
        {
            if( SnortSnprintfAppend(cef_message, 1024, "src=%s dst=%s proto=%s",
                                    inet_ntoa(p->iph->ip_src), inet_ntoa(p->iph->ip_dst),
                                    protocol_names[p->iph->ip_proto]) != 0 )
                return;
        }
        else
        {
            if( SnortSnprintfAppend(cef_message, 1024, "src=%s dst=%s spt=%i dpt=%i proto=%s",
                                 inet_ntoa(p->iph->ip_src), inet_ntoa(p->iph->ip_dst), p->sp, p->dp,
                                 protocol_names[p->iph->ip_proto]) != 0 )
                return ;
        }
        syslog(data->priority, "%s", cef_message);
    }
    return;
}

variable_types: struct _CEFData { int facility; int priority; int options; } *

variable_types: struct _SigNode { unsigned int generator; unsigned int id; unsigned int rev; unsigned int class_id; struct _ClassType { char *type; unsigned int id; char *name; unsigned int priority; struct _ClassType *next; } *classType; unsigned int priority; char *msg; struct _ReferenceNode { char *id; struct _ReferenceSystemNode { char *name; char *url; struct _ReferenceSystemNode *next; } *system; struct _ReferenceNode *next; } *refs; struct _SigNode *next; } *

user_defined_types: struct _SigNode { unsigned int generator; unsigned int id; unsigned int rev; unsigned int class_id; struct _ClassType *classType; unsigned int priority; char *msg; struct _ReferenceNode *refs; struct _SigNode *next; }

user_defined_types: struct _Unified2EventCommon { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int event_microsecond; unsigned int signature_id; unsigned int generator_id; unsigned int signature_revision; unsigned int classification_id; unsigned int priority_id; }

user_defined_types: struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; }

user_defined_types: struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; }

user_defined_types: struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; }

user_defined_types: struct _EthLlc { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; }

user_defined_types: struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; }

user_defined_types: struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; }

user_defined_types: struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; }

user_defined_types: struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; }

user_defined_types: struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; }

user_defined_types: struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; }

user_defined_types: struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Fddi_llc_other { unsigned char ctrl_fld[1]; }

user_defined_types: struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; }

user_defined_types: struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; }

user_defined_types: struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; }

user_defined_types: struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; }

user_defined_types: struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; }

user_defined_types: struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; }

user_defined_types: struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; }

user_defined_types: struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; }

user_defined_types: struct _Options { unsigned char code; unsigned char len; unsigned char *data; }

user_defined_types: struct _IP6Option { unsigned char type; unsigned char *data; }

user_defined_types: struct _ReferenceNode { char *id; struct _ReferenceSystemNode *system; struct _ReferenceNode *next; }

user_defined_types: struct timeval { long tv_sec; long tv_usec; }

user_defined_types: struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; }

user_defined_types: struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; }

user_defined_types: struct idseq { unsigned short id; unsigned short seq; }

user_defined_types: struct pmtu { unsigned short ipm_void; unsigned short nextmtu; }

user_defined_types: struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; }

user_defined_types: struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; }

user_defined_types: struct ra_addr { unsigned int addr; unsigned int preference; }


AlertCEFCleanExit

decompiled_code:
void __fastcall AlertCEFCleanExit(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 560;
DebugMessageFunc(32LL, "AlertCEFCleanExit\n");
if ( a2 )
free(a2);
}

canonical_decompiled_code:
void __fastcall func3(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 560;
DebugMessageFunc(32LL, "AlertCEFCleanExit\n");
if ( a2 )
free(a2);
}

original_code:
void AlertCEFCleanExit(int signal, void *arg)
{
    CEFData *data = (CEFData *)arg;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 560; DebugMessageFunc(0x00000020, "AlertCEFCleanExit\n");;
    if(data)
        free(data);
}

canonical_original_code:
void AlertCEFCleanExit(int signal, void *arg)
{
    struct _CEFData *data = (CEFData *)arg;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 560; DebugMessageFunc(0x00000020, "AlertCEFCleanExit\n");;
    if(data)
        free(data);
}

variable_types: signal int

variable_types:
arg
void *

return_type: void

user_defined_types: struct _CEFData { int facility; int priority; int options; }


AlertCEFRestart

decompiled_code:
void __fastcall AlertCEFRestart(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 569;
DebugMessageFunc(32LL, "AlertCEFRestartFunc\n");
if ( a2 )
free(a2);
}

canonical_decompiled_code:
void __fastcall func4(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 569;
DebugMessageFunc(32LL, "AlertCEFRestartFunc\n");
if ( a2 )
free(a2);
}

original_code:
void AlertCEFRestart(int signal, void *arg)
{
    CEFData *data = (CEFData *)arg;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 569; DebugMessageFunc(0x00000020, "AlertCEFRestartFunc\n");;
    if(data)
        free(data);
}

canonical_original_code:
void AlertCEFRestart(int signal, void *arg)
{
    struct _CEFData *data = (CEFData *)arg;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 569; DebugMessageFunc(0x00000020, "AlertCEFRestartFunc\n");;
    if(data)
        free(data);
}


AlertCEFSetup

decompiled_code:
__int64 AlertCEFSetup()
{
RegisterOutputPlugin("alert_cef", 1LL, AlertCEFInit);
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 104;
return DebugMessageFunc(1LL, "Output plugin: Alert-CEF is setup...\n");
}

canonical_decompiled_code:
__int64 func5()
{
RegisterOutputPlugin("alert_cef", 1LL, AlertCEFInit);
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 104;
return DebugMessageFunc(1LL, "Output plugin: Alert-CEF is setup...\n");
}

original_code:
void AlertCEFSetup(void)
{
    RegisterOutputPlugin("alert_cef", OUTPUT_TYPE_FLAG__ALERT, AlertCEFInit);
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 104; DebugMessageFunc(0x00000001,"Output plugin: Alert-CEF is setup...\n");;
}

canonical_original_code:
void AlertCEFSetup()
{
    RegisterOutputPlugin("alert_cef", OUTPUT_TYPE_FLAG__ALERT, AlertCEFInit);
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 104; DebugMessageFunc(0x00000001,"Output plugin: Alert-CEF is setup...\n");;
}


AlertCEFInit

decompiled_code:
__int64 __fastcall AlertCEFInit(__int64 a1)
{
int *v1; // rbx

DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 122;
DebugMessageFunc(1LL, "Output: Alert-CEF Initialized\n");
v1 = ParseCEFArgs(a1);
if ( (unsigned int)BcDaemonMode() )
v1[2] |= 1u;
openlog("barnyard2", v1[2], *v1);
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 132;
DebugMessageFunc(1LL, "Linking CEF alert function to call list...\n");
AddFuncToOutputList(AlertCEF, 1LL, v1);
AddFuncToCleanExitList(AlertCEFCleanExit, v1);
return AddFuncToRestartList(AlertCEFRestart, v1);
}

canonical_decompiled_code:
__int64 __fastcall func6(__int64 a1)
{
int *v1; // rbx

DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 122;
DebugMessageFunc(1LL, "Output: Alert-CEF Initialized\n");
v1 = ParseCEFArgs(a1);
if ( (unsigned int)func0() )
v1[2] |= 1u;
openlog("barnyard2", v1[2], *v1);
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 132;
DebugMessageFunc(1LL, "Linking CEF alert function to call list...\n");
AddFuncToOutputList(AlertCEF, 1LL, v1);
AddFuncToCleanExitList(AlertCEFCleanExit, v1);
return AddFuncToRestartList(AlertCEFRestart, v1);
}

original_code:
void AlertCEFInit(char *args)
{
    CEFData *data;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 122; DebugMessageFunc(0x00000001, "Output: Alert-CEF Initialized\n");;
    data = ParseCEFArgs(args);
    if (BcDaemonMode())
        data->options |= 0x01;
    openlog("barnyard2", data->options, data->facility);
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 132; DebugMessageFunc(0x00000001,"Linking CEF alert function to call list...\n");;
    AddFuncToOutputList(AlertCEF, OUTPUT_TYPE__ALERT, data);
    AddFuncToCleanExitList(AlertCEFCleanExit, data);
    AddFuncToRestartList(AlertCEFRestart, data);
}

canonical_original_code:
void AlertCEFInit(char *args)
{
    struct _CEFData *data;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 122; DebugMessageFunc(0x00000001, "Output: Alert-CEF Initialized\n");;
    data = ParseCEFArgs(args);
    if (BcDaemonMode())
        data->options |= 0x01;
    openlog("barnyard2", data->options, data->facility);
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 132; DebugMessageFunc(0x00000001,"Linking CEF alert function to call list...\n");;
    AddFuncToOutputList(AlertCEF, OUTPUT_TYPE__ALERT, data);
    AddFuncToCleanExitList(AlertCEFCleanExit, data);
    AddFuncToRestartList(AlertCEFRestart, data);
}

variable_types:
args
char *


AppendOutputFuncList

original_code:
void AppendOutputFuncList(OutputFunc func, void *arg, OutputFuncNode **list)
{
    OutputFuncNode *node;
    if (list == ((void *)0))
        return;
    node = (OutputFuncNode *)SnortAlloc(sizeof(OutputFuncNode));
    if (*list == ((void *)0))
    {
        *list = node;
    }
    else
    {
        OutputFuncNode *tmp = *list;
        while (tmp->next != ((void *)0))
            tmp = tmp->next;
        tmp->next = node;
    }
    node->func = func;
    node->arg = arg;
}

canonical_original_code:
void AppendOutputFuncList(void (*func)(struct _Packet *, void *, unsigned int, void *), void *arg, struct _OutputFuncNode **list)
{
    struct _OutputFuncNode *node;
    if (list == ((void *)0))
        return;
    node = (struct _OutputFuncNode *)SnortAlloc(sizeof(OutputFuncNode));
    if (*list == ((void *)0))
    {
        *list = node;
    }
    else
    {
        struct _OutputFuncNode *tmp = *list;
        while (tmp->next != ((void *)0))
            tmp = tmp->next;
        tmp->next = node;
    }
    node->func = func;
    node->arg = arg;
}

variable_types: void (*)(struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *, void *, unsigned int, void *)

variable_types: struct _OutputFuncNode { void *arg; void (*func)(struct _Packet *, void *, unsigned int, void *); struct _OutputFuncNode *next; } **

variable_types: struct _OutputFuncNode { void *arg; void (*func)(struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *, void *, unsigned int, void *); struct _OutputFuncNode *next; } *

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }

user_defined_types: struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip ip_src; struct _ip ip_dst; }


RegisterInputPlugins

decompiled_code:
__int64 RegisterInputPlugins()
{
LogMessage("Initializing Input Plugins!\n");
return Unified2Setup();
}

canonical_decompiled_code:
__int64 func1()
{
LogMessage("Initializing Input Plugins!\n");
return Unified2Setup();
}

original_code:
void RegisterInputPlugins()
{
    LogMessage("Initializing Input Plugins!\n");
 Unified2Setup();
}


GetInputPlugin

decompiled_code:
__int64 __fastcall GetInputPlugin(char *s1)
{
__int64 v1; // rbx

v1 = InputList;
if ( !s1 )
return 0LL;
if ( InputList )
{
while ( strcasecmp(s1, *(const char **)v1) )
{
v1 = *(_QWORD *)(v1 + 40);
if ( !v1 )
goto LABEL_5;
}
}
else
{
LABEL_5:
FatalError("unknown input plugin: '%s'\n", s1);
v1 = 0LL;
}
return v1;
}

canonical_decompiled_code:
__int64 __fastcall func2(char *s1)
{
__int64 v1; // rbx

v1 = InputList;
if ( !s1 )
return 0LL;
if ( InputList )
{
while ( strcasecmp(s1, *(const char **)v1) )
{
v1 = *(_QWORD *)(v1 + 40);
if ( !v1 )
goto LABEL_5;
}
}
else
{
LABEL_5:
FatalError("unknown input plugin: '%s'\n", s1);
v1 = 0LL;
}
return v1;
}

original_code:
InputFuncNode *GetInputPlugin(char *keyword)
{
    InputFuncNode *node = InputList;
    if (keyword == ((void *)0))
        return ((void *)0);
    while ((node != ((void *)0)) && (strcasecmp(keyword, node->keyword) != 0))
    {
        node = node->next;
    }
    if (node == ((void *)0))
    {
        FatalError("unknown input plugin: '%s'\n", keyword);
    }
    return node;
}

canonical_original_code:
struct _InputFuncNode *GetInputPlugin(char *keyword)
{
    struct _InputFuncNode *node = InputList;
    if (keyword == ((void *)0))
        return ((void *)0);
    while ((node != ((void *)0)) && (strcasecmp(keyword, node->keyword) != 0))
    {
        node = node->next;
    }
    if (node == ((void *)0))
    {
        FatalError("unknown input plugin: '%s'\n", keyword);
    }
    return node;
}

variable_types:
keyword
char *

variable_types: struct _InputFuncNode { char *keyword; int configured_flag; void *arg; int (*readRecordHeader)(void *); int (*readRecord)(void *); struct _InputFuncNode *next; } *


RegisterInputPlugin

decompiled_code:
__int64 __fastcall RegisterInputPlugin(char *s2, const void *a2)
{
_QWORD *v2; // r13
_QWORD *v3; // r12
__int64 v4; // rbp
__int64 v5; // rbp
__int64 result; // rax

v2 = (_QWORD *)SnortAlloc(24LL);
v3 = (_QWORD *)SnortAlloc(48LL);
DebugMessageFile = "plugbase.c";
DebugMessageLine = 142;
DebugMessageFunc(4LL, "Registering keyword:input => %s:%p\n", s2, a2);
v4 = input_config_funcs;
if ( input_config_funcs )
{
while ( 1 )
{
if ( !strcasecmp(*(const char **)v4, s2) )
{
free(v2);
FatalError("Duplicate input keyword: %s\n", s2);
}
if ( !*(_QWORD *)(v4 + 16) )
break;
v4 = *(_QWORD *)(v4 + 16);
}
*(_QWORD *)(v4 + 16) = v2;
}
else
{
input_config_funcs = v2;
}
*v2 = SnortStrdup(s2);
v2[1] = a2;
v5 = InputList;
if ( InputList )
{
while ( 1 )
{
if ( !strcasecmp(*(const char **)v5, s2) )
{
free(v3);
FatalError("Duplicate input keyword: %s\n", s2);
}
if ( !*(_QWORD *)(v5 + 40) )
break;
v5 = *(_QWORD *)(v5 + 40);
}
*(_QWORD *)(v5 + 40) = v3;
}
else
{
InputList = v3;
}
result = SnortStrdup(s2);
*v3 = result;
return result;
}

canonical_decompiled_code:
__int64 __fastcall func3(char *s2, const void *a2)
{
_QWORD *v2; // r13
_QWORD *v3; // r12
__int64 v4; // rbp
__int64 v5; // rbp
__int64 result; // rax

v2 = (_QWORD *)SnortAlloc(24LL);
v3 = (_QWORD *)SnortAlloc(48LL);
DebugMessageFile = "plugbase.c";
DebugMessageLine = 142;
DebugMessageFunc(4LL, "Registering keyword:input => %s:%p\n", s2, a2);
v4 = input_config_funcs;
if ( input_config_funcs )
{
while ( 1 )
{
if ( !strcasecmp(*(const char **)v4, s2) )
{
free(v2);
FatalError("Duplicate input keyword: %s\n", s2);
}
if ( !*(_QWORD *)(v4 + 16) )
break;
v4 = *(_QWORD *)(v4 + 16);
}
*(_QWORD *)(v4 + 16) = v2;
}
else
{
input_config_funcs = v2;
}
*v2 = SnortStrdup(s2);
v2[1] = a2;
v5 = InputList;
if ( InputList )
{
while ( 1 )
{
if ( !strcasecmp(*(const char **)v5, s2) )
{
free(v3);
FatalError("Duplicate input keyword: %s\n", s2);
}
if ( !*(_QWORD *)(v5 + 40) )
break;
v5 = *(_QWORD *)(v5 + 40);
}
*(_QWORD *)(v5 + 40) = v3;
}
else
{
InputList = v3;
}
result = SnortStrdup(s2);
*v3 = result;
return result;
}

original_code:
void RegisterInputPlugin(char *keyword, InputConfigFunc func)
{
    InputConfigFuncNode *node = (InputConfigFuncNode *)SnortAlloc(sizeof(InputConfigFuncNode));
    InputFuncNode *node2 = (InputFuncNode *)SnortAlloc(sizeof(InputFuncNode));
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 142; DebugMessageFunc(0x00000004,"Registering keyword:input => %s:%p\n", keyword, func);;
    if (input_config_funcs == ((void *)0))
    {
        input_config_funcs = node;
    }
    else
    {
        InputConfigFuncNode *tmp = input_config_funcs;
        InputConfigFuncNode *last;
        do
        {
            if (strcasecmp(tmp->keyword, keyword) == 0)
            {
                free(node);
                FatalError("Duplicate input keyword: %s\n", keyword);
            }
            last = tmp;
            tmp = tmp->next;
        } while (tmp != ((void *)0));
        last->next = node;
    }
    node->keyword = SnortStrdup(keyword);
    node->func = func;
    if (InputList == ((void *)0))
    {
        InputList = node2;
    }
    else
    {
        InputFuncNode *tmp2 = InputList;
        InputFuncNode *last2;
        do
        {
            if (strcasecmp(tmp2->keyword, keyword) == 0)
            {
                free(node2);
                FatalError("Duplicate input keyword: %s\n", keyword);
            }
            last2 = tmp2;
            tmp2 = tmp2->next;
        } while (tmp2 != ((void *)0));
        last2->next = node2;
    }
    node2->keyword = SnortStrdup(keyword);
}

canonical_original_code:
void RegisterInputPlugin(char *keyword, void (*func)(char *))
{
    struct _InputConfigFuncNode *node = (InputConfigFuncNode *)SnortAlloc(sizeof(InputConfigFuncNode));
    struct _InputFuncNode *node2 = (InputFuncNode *)SnortAlloc(sizeof(InputFuncNode));
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 142; DebugMessageFunc(0x00000004,"Registering keyword:input => %s:%p\n", keyword, func);;
    if (input_config_funcs == ((void *)0))
    {
        input_config_funcs = node;
    }
    else
    {
        struct _InputConfigFuncNode *tmp = input_config_funcs;
        struct _InputConfigFuncNode *last;
        do
        {
            if (strcasecmp(tmp->keyword, keyword) == 0)
            {
                free(node);
                FatalError("Duplicate input keyword: %s\n", keyword);
            }
            last = tmp;
            tmp = tmp->next;
        } while (tmp != ((void *)0));
        last->next = node;
    }
    node->keyword = SnortStrdup(keyword);
    node->func = func;
    if (InputList == ((void *)0))
    {
        InputList = node2;
    }
    else
    {
        struct _InputFuncNode *tmp2 = InputList;
        struct _InputFuncNode *last2;
        do
        {
            if (strcasecmp(tmp2->keyword, keyword) == 0)
            {
                free(node2);
                FatalError("Duplicate input keyword: %s\n", keyword);
            }
            last2 = tmp2;
            tmp2 = tmp2->next;
        } while (tmp2 != ((void *)0));
        last2->next = node2;
    }
    node2->keyword = SnortStrdup(keyword);
}

variable_types:
func
void (*)(char *)

variable_types: struct _InputConfigFuncNode { char *keyword; void (*func)(char *); struct _InputConfigFuncNode *next; } *

user_defined_types: struct _InputFuncNode { char *keyword; int configured_flag; void *arg; int (*readRecordHeader)(void *); int (*readRecord)(void *); struct _InputFuncNode *next; }


GetInputConfigFunc

decompiled_code:
__int64 __fastcall GetInputConfigFunc(char *s2)
{
__int64 v1; // rbx

v1 = input_config_funcs;
if ( !s2 )
return 0LL;
if ( !input_config_funcs )
return 0LL;
while ( strcasecmp(*(const char **)v1, s2) )
{
v1 = *(_QWORD *)(v1 + 16);
if ( !v1 )
return 0LL;
}
return *(_QWORD *)(v1 + 8);
}

canonical_decompiled_code:
__int64 __fastcall func4(char *s2)
{
__int64 v1; // rbx

v1 = input_config_funcs;
if ( !s2 )
return 0LL;
if ( !input_config_funcs )
return 0LL;
while ( strcasecmp(*(const char **)v1, s2) )
{
v1 = *(_QWORD *)(v1 + 16);
if ( !v1 )
return 0LL;
}
return *(_QWORD *)(v1 + 8);
}

original_code:
InputConfigFunc GetInputConfigFunc(char *keyword)
{
    InputConfigFuncNode *head = input_config_funcs;
    if (keyword == ((void *)0))
        return ((void *)0);
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->func;
        head = head->next;
    }
    return ((void *)0);
}

canonical_original_code:
void (*GetInputConfigFunc(char *keyword))(char *)
{
    struct _InputConfigFuncNode *head = input_config_funcs;
    if (keyword == ((void *)0))
        return ((void *)0);
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->func;
        head = head->next;
    }
    return ((void *)0);
}

return_type: void (*)(char *)

user_defined_types: struct _InputConfigFuncNode { char *keyword; void (*func)(char *); struct _InputConfigFuncNode *next; }


DumpInputPlugins

original_code:
void DumpInputPlugins()
{
    InputConfigFuncNode *idx = input_config_funcs;
    InputFuncNode *ifn = ((void *)0);
    LogMessage("-------------------------------------------------\n");
    LogMessage(" Keyword     |          Input @ \n");
    LogMessage("-------------------------------------------------\n");
    while(idx != ((void *)0))
    {
        LogMessage("%-13s: init() = %p\n", idx->keyword, idx->func);
        ifn = GetInputPlugin(idx->keyword);
  if ((ifn != ((void *)0)) && ifn->configured_flag)
  {
   LogMessage("%-13s:   - readRecordHeader() = %p\n",
       ifn->keyword, ifn->readRecordHeader);
   LogMessage("%-13s:   - readRecord()       = %p\n",
       ifn->keyword, ifn->readRecord);
  }
        idx = idx->next;
    }
    LogMessage("-------------------------------------------------\n\n");
}

canonical_original_code:
void DumpInputPlugins()
{
    struct _InputConfigFuncNode *idx = input_config_funcs;
    struct _InputFuncNode *ifn = ((void *)0);
    LogMessage("-------------------------------------------------\n");
    LogMessage(" Keyword     |          Input @ \n");
    LogMessage("-------------------------------------------------\n");
    while(idx != ((void *)0))
    {
        LogMessage("%-13s: init() = %p\n", idx->keyword, idx->func);
        ifn = GetInputPlugin(idx->keyword);
  if ((ifn != ((void *)0)) && ifn->configured_flag)
  {
   LogMessage("%-13s:   - readRecordHeader() = %p\n",
       ifn->keyword, ifn->readRecordHeader);
   LogMessage("%-13s:   - readRecord()       = %p\n",
       ifn->keyword, ifn->readRecord);
  }
        idx = idx->next;
    }
    LogMessage("-------------------------------------------------\n\n");
}


AddArgToInputList

decompiled_code:
__int64 __fastcall AddArgToInputList(char *a1, __int64 a2)
{
if ( !a1 )
return 0xFFFFFFFFLL;
*(_QWORD *)(GetInputPlugin(a1) + 16) = a2;
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func6(char *a1, __int64 a2)
{
if ( !a1 )
return 0xFFFFFFFFLL;
*(_QWORD *)(func2(a1) + 16) = a2;
return 0LL;
}

original_code:
int AddArgToInputList(char *keyword, void *arg)
{
    InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    node = GetInputPlugin(keyword);
    node->arg = arg;
 return 0;
}

canonical_original_code:
int AddArgToInputList(char *keyword, void *arg)
{
    struct _InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    node = GetInputPlugin(keyword);
    node->arg = arg;
 return 0;
}

return_type: int


InputFuncNodeConfigured

decompiled_code:
_BOOL8 __fastcall InputFuncNodeConfigured(__int64 a1)
{
_BOOL8 result; // rax

if ( *(_QWORD *)(a1 + 24) )
result = *(_QWORD *)(a1 + 32) != 0LL;
else
result = 0LL;
return result;
}

canonical_decompiled_code:
_BOOL8 __fastcall func7(__int64 a1)
{
_BOOL8 result; // rax

if ( *(_QWORD *)(a1 + 24) )
result = *(_QWORD *)(a1 + 32) != 0LL;
else
result = 0LL;
return result;
}

original_code:
int InputFuncNodeConfigured(InputFuncNode *ifn)
{
 if (!ifn->readRecordHeader || !ifn->readRecord)
  return 0;
 return 1;
}

canonical_original_code:
int InputFuncNodeConfigured(struct _InputFuncNode *ifn)
{
 if (!ifn->readRecordHeader || !ifn->readRecord)
  return 0;
 return 1;
}


AddReadRecordHeaderFuncToInputList

decompiled_code:
__int64 __fastcall AddReadRecordHeaderFuncToInputList(char *s1, const void *a2)
{
__int64 v2; // rbx

if ( !s1 )
return 0xFFFFFFFFLL;
DebugMessageFile = "plugbase.c";
DebugMessageLine = 277;
DebugMessageFunc(4LL, "Registering keyword:readRecordHeader => %s:%p\n", s1, a2);
v2 = GetInputPlugin(s1);
*(_QWORD *)(v2 + 24) = a2;
*(_DWORD *)(v2 + 8) = InputFuncNodeConfigured(v2);
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func8(char *s1, const void *a2)
{
__int64 v2; // rbx

if ( !s1 )
return 0xFFFFFFFFLL;
DebugMessageFile = "plugbase.c";
DebugMessageLine = 277;
DebugMessageFunc(4LL, "Registering keyword:readRecordHeader => %s:%p\n", s1, a2);
v2 = func2(s1);
*(_QWORD *)(v2 + 24) = a2;
*(_DWORD *)(v2 + 8) = func7(v2);
return 0LL;
}

original_code:
int AddReadRecordHeaderFuncToInputList(char *keyword, int (*readRecordHeader)(void *))
{
    InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 277; DebugMessageFunc(0x00000004,"Registering keyword:readRecordHeader => %s:%p\n", keyword, readRecordHeader);;
    node = GetInputPlugin(keyword);
    node->readRecordHeader = readRecordHeader;
 node->configured_flag = InputFuncNodeConfigured(node);
 return 0;
}

canonical_original_code:
int AddReadRecordHeaderFuncToInputList(char *keyword, int (*readRecordHeader)(void *))
{
    struct _InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 277; DebugMessageFunc(0x00000004,"Registering keyword:readRecordHeader => %s:%p\n", keyword, readRecordHeader);;
    node = GetInputPlugin(keyword);
    node->readRecordHeader = readRecordHeader;
 node->configured_flag = InputFuncNodeConfigured(node);
 return 0;
}

variable_types:
readRecordHeader
int (*)(void *)


AddReadRecordFuncToInputList

decompiled_code:
__int64 __fastcall AddReadRecordFuncToInputList(char *s1, const void *a2)
{
__int64 v2; // rbx

if ( !s1 )
return 0xFFFFFFFFLL;
DebugMessageFile = "plugbase.c";
DebugMessageLine = 295;
DebugMessageFunc(4LL, "Registering keyword:readRecord => %s:%p\n", s1, a2);
v2 = GetInputPlugin(s1);
*(_QWORD *)(v2 + 32) = a2;
*(_DWORD *)(v2 + 8) = InputFuncNodeConfigured(v2);
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func9(char *s1, const void *a2)
{
__int64 v2; // rbx

if ( !s1 )
return 0xFFFFFFFFLL;
DebugMessageFile = "plugbase.c";
DebugMessageLine = 295;
DebugMessageFunc(4LL, "Registering keyword:readRecord => %s:%p\n", s1, a2);
v2 = func2(s1);
*(_QWORD *)(v2 + 32) = a2;
*(_DWORD *)(v2 + 8) = func7(v2);
return 0LL;
}

original_code:
int AddReadRecordFuncToInputList(char *keyword, int (*readRecord)(void *))
{
    InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 295; DebugMessageFunc(0x00000004,"Registering keyword:readRecord => %s:%p\n", keyword, readRecord);;
    node = GetInputPlugin(keyword);
    node->readRecord = readRecord;
 node->configured_flag = InputFuncNodeConfigured(node);
    return 0;
}

canonical_original_code:
int AddReadRecordFuncToInputList(char *keyword, int (*readRecord)(void *))
{
    struct _InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 295; DebugMessageFunc(0x00000004,"Registering keyword:readRecord => %s:%p\n", keyword, readRecord);;
    node = GetInputPlugin(keyword);
    node->readRecord = readRecord;
 node->configured_flag = InputFuncNodeConfigured(node);
    return 0;
}

variable_types:
readRecord
int (*)(void *)


RegisterOutputPlugins

decompiled_code:
__int64 RegisterOutputPlugins()
{
LogMessage("Initializing Output Plugins!\n");
AlertCuSetup();
PlatypusSetup();
return SguilSetup();
}

canonical_decompiled_code:
__int64 func10()
{
LogMessage("Initializing Output Plugins!\n");
AlertCuSetup();
PlatypusSetup();
return SguilSetup();
}

original_code:
void RegisterOutputPlugins(void)
{
    LogMessage("Initializing Output Plugins!\n");
    AlertCuSetup();
 PlatypusSetup();
 SguilSetup();
}

canonical_original_code:
void RegisterOutputPlugins()
{
    LogMessage("Initializing Output Plugins!\n");
    AlertCuSetup();
 PlatypusSetup();
 SguilSetup();
}


GetOutputConfigFunc

decompiled_code:
const char *__fastcall GetOutputConfigFunc(char *s2)
{
const char **v1; // rbx

v1 = (const char **)output_config_funcs;
if ( !s2 )
return 0LL;
if ( !output_config_funcs )
return 0LL;
while ( strcasecmp(*v1, s2) )
{
v1 = (const char **)v1[3];
if ( !v1 )
return 0LL;
}
return v1[2];
}

canonical_decompiled_code:
const char *__fastcall func12(char *s2)
{
const char **v1; // rbx

v1 = (const char **)output_config_funcs;
if ( !s2 )
return 0LL;
if ( !output_config_funcs )
return 0LL;
while ( strcasecmp(*v1, s2) )
{
v1 = (const char **)v1[3];
if ( !v1 )
return 0LL;
}
return v1[2];
}

original_code:
OutputConfigFunc GetOutputConfigFunc(char *keyword)
{
    OutputConfigFuncNode *head = output_config_funcs;
    if (keyword == ((void *)0))
        return ((void *)0);
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->func;
        head = head->next;
    }
    return ((void *)0);
}

canonical_original_code:
void (*GetOutputConfigFunc(char *keyword))(char *)
{
    struct _OutputConfigFuncNode *head = output_config_funcs;
    if (keyword == ((void *)0))
        return ((void *)0);
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->func;
        head = head->next;
    }
    return ((void *)0);
}

variable_types: struct _OutputConfigFuncNode { char *keyword; int output_type_flags; void (*func)(char *); struct _OutputConfigFuncNode *next; } *


GetOutputTypeFlags

decompiled_code:
__int64 __fastcall GetOutputTypeFlags(char *s2)
{
const char **v1; // rbx

if ( !s2 )
return 0LL;
v1 = (const char **)output_config_funcs;
if ( !output_config_funcs )
return 0LL;
while ( strcasecmp(*v1, s2) )
{
v1 = (const char **)v1[3];
if ( !v1 )
return 0LL;
}
return *((unsigned int *)v1 + 2);
}

canonical_decompiled_code:
__int64 __fastcall func13(char *s2)
{
const char **v1; // rbx

if ( !s2 )
return 0LL;
v1 = (const char **)output_config_funcs;
if ( !output_config_funcs )
return 0LL;
while ( strcasecmp(*v1, s2) )
{
v1 = (const char **)v1[3];
if ( !v1 )
return 0LL;
}
return *((unsigned int *)v1 + 2);
}

original_code:
int GetOutputTypeFlags(char *keyword)
{
    OutputConfigFuncNode *head = output_config_funcs;
    if (keyword == ((void *)0))
        return 0;
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->output_type_flags;
        head = head->next;
    }
    return 0;
}

canonical_original_code:
int GetOutputTypeFlags(char *keyword)
{
    struct _OutputConfigFuncNode *head = output_config_funcs;
    if (keyword == ((void *)0))
        return 0;
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->output_type_flags;
        head = head->next;
    }
    return 0;
}

user_defined_types: struct _OutputConfigFuncNode { char *keyword; int output_type_flags; void (*func)(char *); struct _OutputConfigFuncNode *next; }


FreeOutputConfigFuncs

decompiled_code:
void FreeOutputConfigFuncs()
{
void **v0; // rbx
void **v1; // rbp

v0 = (void **)output_config_funcs;
if ( output_config_funcs )
{
do
{
v1 = v0;
v0 = (void **)v0[3];
if ( *v1 )
free(*v1);
free(v1);
}
while ( v0 );
}
}

canonical_decompiled_code:
void func14()
{
void **v0; // rbx
void **v1; // rbp

v0 = (void **)output_config_funcs;
if ( output_config_funcs )
{
do
{
v1 = v0;
v0 = (void **)v0[3];
if ( *v1 )
free(*v1);
free(v1);
}
while ( v0 );
}
}

original_code:
void FreeOutputConfigFuncs(void)
{
    OutputConfigFuncNode *head = output_config_funcs;
    OutputConfigFuncNode *tmp;
    while (head != ((void *)0))
    {
        tmp = head->next;
        if (head->keyword != ((void *)0))
            free(head->keyword);
        free(head);
        head = tmp;
    }
}

canonical_original_code:
void FreeOutputConfigFuncs()
{
    struct _OutputConfigFuncNode *head = output_config_funcs;
    struct _OutputConfigFuncNode *tmp;
    while (head != ((void *)0))
    {
        tmp = head->next;
        if (head->keyword != ((void *)0))
            free(head->keyword);
        free(head);
        head = tmp;
    }
}


FreeOutputList

decompiled_code:
void __fastcall FreeOutputList(void *ptr)
{
void *v1; // rbx
void *v2; // rdi

v1 = ptr;
while ( v1 )
{
v2 = v1;
v1 = (void *)*((_QWORD *)v1 + 2);
free(v2);
}
}

canonical_decompiled_code:
void __fastcall func15(void *ptr)
{
void *v1; // rbx
void *v2; // rdi

v1 = ptr;
while ( v1 )
{
v2 = v1;
v1 = (void *)*((_QWORD *)v1 + 2);
free(v2);
}
}

original_code:
void FreeOutputList(OutputFuncNode *list)
{
    while (list != ((void *)0))
    {
        OutputFuncNode *tmp = list;
        list = list->next;
        free(tmp);
    }
}

canonical_original_code:
void FreeOutputList(struct _OutputFuncNode *list)
{
    while (list != ((void *)0))
    {
        struct _OutputFuncNode *tmp = list;
        list = list->next;
        free(tmp);
    }
}

user_defined_types: struct _OutputFuncNode { void *arg; void (*func)(struct _Packet *, void *, unsigned int, void *); struct _OutputFuncNode *next; }

user_defined_types: struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; }

user_defined_types: struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; }

user_defined_types: struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; }

user_defined_types: struct _EthLlc { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; }

user_defined_types: struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; }

user_defined_types: struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; }

user_defined_types: struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; }

user_defined_types: struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; }

user_defined_types: struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; }

user_defined_types: struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; }

user_defined_types: struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Fddi_llc_other { unsigned char ctrl_fld[1]; }

user_defined_types: struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; }

user_defined_types: struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; }

user_defined_types: struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; }

user_defined_types: struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; }

user_defined_types: struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; }

user_defined_types: struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; }

user_defined_types: struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; }

user_defined_types: struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; }

user_defined_types: struct _Options { unsigned char code; unsigned char len; unsigned char *data; }

user_defined_types: struct _IP6Option { unsigned char type; unsigned char *data; }

user_defined_types: struct timeval { long tv_sec; long tv_usec; }

user_defined_types: struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; }


DumpOutputPlugins

user_defined_types: struct _OutputConfigFuncNode { char *keyword; int output_type_flags; void (*func)(char *); struct _OutputConfigFuncNode *next; }


AddFuncToOutputList

decompiled_code:
void __fastcall AddFuncToOutputList(__int64 a1, __int64 a2, __int64 a3)
{
if ( (_DWORD)a2 == 1 )
{
AppendOutputFuncList(a1, a3, (__int64 *)&AlertList);
}
else if ( (_DWORD)a2 == 2 )
{
AppendOutputFuncList(a1, a3, (__int64 *)&LogList);
}
else
{
FatalError("Unknown output type: %i. Possible bug, please report.\n", a2);
}
}

canonical_decompiled_code:
void __fastcall func17(__int64 a1, __int64 a2, __int64 a3)
{
if ( (_DWORD)a2 == 1 )
{
func0(a1, a3, (__int64 *)&AlertList);
}
else if ( (_DWORD)a2 == 2 )
{
func0(a1, a3, (__int64 *)&LogList);
}
else
{
FatalError("Unknown output type: %i. Possible bug, please report.\n", a2);
}
}

original_code:
void AddFuncToOutputList(OutputFunc func, OutputType type, void *arg)
{
    switch (type)
    {
        case OUTPUT_TYPE__ALERT:
            AppendOutputFuncList(func, arg, &AlertList);
            break;
        case OUTPUT_TYPE__LOG:
            AppendOutputFuncList(func, arg, &LogList);
            break;
        default:
            FatalError("Unknown output type: %i. Possible bug, please "
                       "report.\n", type);
    }
}

canonical_original_code:
void AddFuncToOutputList(void (*func)(struct _Packet *, void *, unsigned int, void *), enum _OutputType type, void *arg)
{
    switch (type)
    {
        case OUTPUT_TYPE__ALERT:
            AppendOutputFuncList(func, arg, &AlertList);
            break;
        case OUTPUT_TYPE__LOG:
            AppendOutputFuncList(func, arg, &LogList);
            break;
        default:
            FatalError("Unknown output type: %i. Possible bug, please "
                       "report.\n", type);
    }
}

variable_types: enum _OutputType { OUTPUT_TYPE__ALERT=1, OUTPUT_TYPE__LOG=2, OUTPUT_TYPE__SPECIAL=3, OUTPUT_TYPE__MAX=4 }

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; }

user_defined_types: struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; }

user_defined_types: struct _EthLlc { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; }

user_defined_types: struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; }

user_defined_types: struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }

user_defined_types: struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; }

user_defined_types: struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; }

user_defined_types: struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; }

user_defined_types: struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Fddi_llc_other { unsigned char ctrl_fld[1]; }

user_defined_types: struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; }

user_defined_types: struct idseq { unsigned short id; unsigned short seq; }

user_defined_types: struct pmtu { unsigned short ipm_void; unsigned short nextmtu; }

user_defined_types: struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; }

user_defined_types: struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; }

user_defined_types: struct ra_addr { unsigned int addr; unsigned int preference; }


CallOutputPlugins

decompiled_code:
__int64 __fastcall CallOutputPlugins(int a1, __int64 a2, __int64 a3, unsigned int a4)
{
__int64 v6; // rbx
__int64 i; // rbx
__int64 result; // rax
__int64 j; // rbx

if ( a1 == 3 )
{
for ( i = AlertList; i; i = *(_QWORD *)(i + 16) )
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(i + 8))(a2, a3, a4, *(_QWORD *)i);
for ( j = LogList; j; j = *(_QWORD *)(j + 16) )
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(j + 8))(a2, a3, a4, *(_QWORD *)j);
}
else
{
if ( a1 == 1 )
{
v6 = AlertList;
}
else
{
if ( a1 != 2 )
return result;
v6 = LogList;
}
for ( ; v6; v6 = *(_QWORD *)(v6 + 16) )
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(v6 + 8))(a2, a3, a4, *(_QWORD *)v6);
}
return result;
}

canonical_decompiled_code:
__int64 __fastcall func18(int a1, __int64 a2, __int64 a3, unsigned int a4)
{
__int64 v6; // rbx
__int64 i; // rbx
__int64 result; // rax
__int64 j; // rbx

if ( a1 == 3 )
{
for ( i = AlertList; i; i = *(_QWORD *)(i + 16) )
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(i + 8))(a2, a3, a4, *(_QWORD *)i);
for ( j = LogList; j; j = *(_QWORD *)(j + 16) )
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(j + 8))(a2, a3, a4, *(_QWORD *)j);
}
else
{
if ( a1 == 1 )
{
v6 = AlertList;
}
else
{
if ( a1 != 2 )
return result;
v6 = LogList;
}
for ( ; v6; v6 = *(_QWORD *)(v6 + 16) )
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(v6 + 8))(a2, a3, a4, *(_QWORD *)v6);
}
return result;
}

original_code:
void CallOutputPlugins(OutputType out_type, Packet *packet, void *event, uint32_t event_type)
{
 OutputFuncNode *idx = ((void *)0);
    if (out_type == OUTPUT_TYPE__SPECIAL)
    {
        idx = AlertList;
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
        idx = LogList;
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
    }
    else
    {
     switch(out_type)
     {
      case OUTPUT_TYPE__ALERT:
       idx = AlertList;
       break;
      case OUTPUT_TYPE__LOG:
       idx = LogList;
       break;
            default:
                break;
     }
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
    }
}

canonical_original_code:
void CallOutputPlugins(enum _OutputType out_type, struct _Packet *packet, void *event, unsigned int event_type)
{
 struct _OutputFuncNode *idx = ((void *)0);
    if (out_type == OUTPUT_TYPE__SPECIAL)
    {
        idx = AlertList;
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
        idx = LogList;
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
    }
    else
    {
     switch(out_type)
     {
      case OUTPUT_TYPE__ALERT:
       idx = AlertList;
       break;
      case OUTPUT_TYPE__LOG:
       idx = LogList;
       break;
            default:
                break;
     }
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
    }
}

variable_types: struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *

variable_types:
event
void *

user_defined_types: enum _OutputType { OUTPUT_TYPE__ALERT=1, OUTPUT_TYPE__LOG=2, OUTPUT_TYPE__SPECIAL=3, OUTPUT_TYPE__MAX=4 }

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct _OutputFuncNode { void *arg; void (*func)(struct _Packet *, void *, unsigned int, void *); struct _OutputFuncNode *next; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }


PostConfigInitPlugins

decompiled_code:
__int64 __fastcall PostConfigInitPlugins(__int64 a1)
{
__int64 i; // rbx
__int64 result; // rax

for ( i = a1; i; i = *(_QWORD *)(i + 16) )
result = (*(__int64 (__fastcall **)(_QWORD, _QWORD))(i + 8))(0LL, *(_QWORD *)i);
return result;
}

canonical_decompiled_code:
__int64 __fastcall func19(__int64 a1)
{
__int64 i; // rbx
__int64 result; // rax

for ( i = a1; i; i = *(_QWORD *)(i + 16) )
result = (*(__int64 (__fastcall **)(_QWORD, _QWORD))(i + 8))(0LL, *(_QWORD *)i);
return result;
}

original_code:
void PostConfigInitPlugins(PluginSignalFuncNode *post_config_funcs)
{
    while (post_config_funcs != ((void *)0))
    {
        post_config_funcs->func(0, post_config_funcs->arg);
        post_config_funcs = post_config_funcs->next;
    }
}

canonical_original_code:
void PostConfigInitPlugins(struct _PluginSignalFuncNode *post_config_funcs)
{
    while (post_config_funcs != ((void *)0))
    {
        post_config_funcs->func(0, post_config_funcs->arg);
        post_config_funcs = post_config_funcs->next;
    }
}

variable_types: struct _PluginSignalFuncNode { void *arg; void (*func)(int, void *); struct _PluginSignalFuncNode *next; } *


AddFuncToSignalList

original_code:
void AddFuncToSignalList(PluginSignalFunc func, void *arg, PluginSignalFuncNode **list)
{
    PluginSignalFuncNode *node;
    if (list == ((void *)0))
        return;
    node = (PluginSignalFuncNode *)SnortAlloc(sizeof(PluginSignalFuncNode));
    if (*list == ((void *)0))
    {
        *list = node;
    }
    else
    {
        PluginSignalFuncNode *tmp = *list;
        while (tmp->next != ((void *)0))
            tmp = tmp->next;
        tmp->next = node;
    }
    node->func = func;
    node->arg = arg;
}

canonical_original_code:
void AddFuncToSignalList(void (*func)(int, void *), void *arg, struct _PluginSignalFuncNode **list)
{
    struct _PluginSignalFuncNode *node;
    if (list == ((void *)0))
        return;
    node = (struct _PluginSignalFuncNode *)SnortAlloc(sizeof(PluginSignalFuncNode));
    if (*list == ((void *)0))
    {
        *list = node;
    }
    else
    {
        struct _PluginSignalFuncNode *tmp = *list;
        while (tmp->next != ((void *)0))
            tmp = tmp->next;
        tmp->next = node;
    }
    node->func = func;
    node->arg = arg;
}

variable_types:
func
void (*)(int, void *)

variable_types: struct _PluginSignalFuncNode { void *arg; void (*func)(int, void *); struct _PluginSignalFuncNode *next; } **


AddFuncToRestartList

decompiled_code:
void __fastcall AddFuncToRestartList(__int64 a1, __int64 a2)
{
AddFuncToSignalList(a1, a2, &plugin_restart_funcs);
}

canonical_decompiled_code:
void __fastcall func21(__int64 a1, __int64 a2)
{
func20(a1, a2, &plugin_restart_funcs);
}

original_code:
void AddFuncToRestartList(PluginSignalFunc func, void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_restart_funcs);
}

canonical_original_code:
void AddFuncToRestartList(void (*func)(int, void *), void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_restart_funcs);
}

variable_types:
arg
void *


AddFuncToCleanExitList

decompiled_code:
void __fastcall AddFuncToCleanExitList(__int64 a1, __int64 a2)
{
AddFuncToSignalList(a1, a2, &plugin_clean_exit_funcs);
}

canonical_decompiled_code:
void __fastcall func22(__int64 a1, __int64 a2)
{
func20(a1, a2, &plugin_clean_exit_funcs);
}

original_code:
void AddFuncToCleanExitList(PluginSignalFunc func, void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_clean_exit_funcs);
}

canonical_original_code:
void AddFuncToCleanExitList(void (*func)(int, void *), void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_clean_exit_funcs);
}


AddFuncToShutdownList

decompiled_code:
void __fastcall AddFuncToShutdownList(__int64 a1, __int64 a2)
{
AddFuncToSignalList(a1, a2, &plugin_shutdown_funcs);
}

canonical_decompiled_code:
void __fastcall func23(__int64 a1, __int64 a2)
{
func20(a1, a2, &plugin_shutdown_funcs);
}

original_code:
void AddFuncToShutdownList(PluginSignalFunc func, void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_shutdown_funcs);
}

canonical_original_code:
void AddFuncToShutdownList(void (*func)(int, void *), void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_shutdown_funcs);
}