timestamp

repo: ob/cache

decompiled_code:
double timestamp()
{
struct timeval v1; // [rsp+0h] [rbp-18h] BYREF

gettimeofday(&v1, 0LL);
return (double)SLODWORD(v1.tv_usec) / 1000000.0 + (double)SLODWORD(v1.tv_sec);
}

canonical_decompiled_code:
double func7()
{
struct timeval v1; // [rsp+0h] [rbp-18h] BYREF

gettimeofday(&v1, 0LL);
return (double)SLODWORD(v1.tv_usec) / 1000000.0 + (double)SLODWORD(v1.tv_sec);
}

original_code:
double
timestamp(void)
{
    struct timeval tv;
    gettimeofday(&tv, 0);
    return (tv.tv_sec + (tv.tv_usec/1000000.0));
}

canonical_original_code:
double timestamp()
{
    struct timeval tv;
    gettimeofday(&tv, 0);
    return (tv.tv_sec + (tv.tv_usec/1000000.0));
}

variable_types: struct timeval { long tv_sec; long tv_usec; }

return_type: double


shuffle

decompiled_code:
__int64 __fastcall shuffle(__int64 a1, int a2, unsigned int a3)
{
_DWORD *v4; // rbp
unsigned int v5; // eax
unsigned int v6; // edx
unsigned int v7; // er12
__int64 v8; // rbx
int *v9; // rdx
int v10; // ecx
int *v11; // rax
int *v12; // rdx
__int64 v13; // rax
int *v14; // rax

if ( indices_0 )
{
memset(indices_0, 0, (size_t)&unk_8000000);
}
else
{
indices_0 = calloc((size_t)&unk_8000000, 4uLL);
if ( !indices_0 )
{
puts(s);
exit(1);
}
}
if ( a3 )
{
v4 = indices_0;
v5 = 0;
v6 = 1;
do
{
v4[v5] = v6;
v6 += a2;
v7 = v5++;
}
while ( a3 >= v6 );
if ( v5 <= 1 )
{
if ( !v7 )
goto LABEL_13;
}
else
{
v8 = v7;
do
{
v9 = &v4[(unsigned int)(random() % v8)];
v10 = *v9;
v11 = &v4[v8];
*v9 = *v11;
*v11 = v10;
--v8;
}
while ( v8 != v7 - 1LL - (v7 - 1) );
}
}
else
{
v7 = -1;
}
v12 = (int *)indices_0;
v13 = 0LL;
do
{
*(_QWORD *)(a1 + 8LL * v12[v13]) = a1 + 8LL * v12[v13 + 1];
++v13;
}
while ( v7 > (unsigned int)v13 );
if ( !v7 )
v7 = 1;
LABEL_13:
v14 = (int *)indices_0;
*(_QWORD *)(a1 + 8LL * *((int *)indices_0 + v7)) = 0LL;
return a1 + 8LL * *v14;
}

canonical_decompiled_code:
__int64 __fastcall func8(__int64 a1, int a2, unsigned int a3)
{
_DWORD *v4; // rbp
unsigned int v5; // eax
unsigned int v6; // edx
unsigned int v7; // er12
__int64 v8; // rbx
int *v9; // rdx
int v10; // ecx
int *v11; // rax
int *v12; // rdx
__int64 v13; // rax
int *v14; // rax

if ( indices_0 )
{
memset(indices_0, 0, (size_t)&unk_8000000);
}
else
{
indices_0 = calloc((size_t)&unk_8000000, 4uLL);
if ( !indices_0 )
{
puts(s);
exit(1);
}
}
if ( a3 )
{
v4 = indices_0;
v5 = 0;
v6 = 1;
do
{
v4[v5] = v6;
v6 += a2;
v7 = v5++;
}
while ( a3 >= v6 );
if ( v5 <= 1 )
{
if ( !v7 )
goto LABEL_13;
}
else
{
v8 = v7;
do
{
v9 = &v4[(unsigned int)(random() % v8)];
v10 = *v9;
v11 = &v4[v8];
*v9 = *v11;
*v11 = v10;
--v8;
}
while ( v8 != v7 - 1LL - (v7 - 1) );
}
}
else
{
v7 = -1;
}
v12 = (int *)indices_0;
v13 = 0LL;
do
{
*(_QWORD *)(a1 + 8LL * v12[v13]) = a1 + 8LL * v12[v13 + 1];
++v13;
}
while ( v7 > (unsigned int)v13 );
if ( !v7 )
v7 = 1;
LABEL_13:
v14 = (int *)indices_0;
*(_QWORD *)(a1 + 8LL * *((int *)indices_0 + v7)) = 0LL;
return a1 + 8LL * *v14;
}

original_code:
u32 **
shuffle(u32 **buffer, u32 stride, u32 max)
{
    u32 i, j, r, n, tmp;
    static int *indices = ((void *)0);
    if (indices == ((void *)0)) {
 indices = calloc(((1024 * 1024 * 1024) / sizeof(u32*)), sizeof(int));
 if (indices == ((void *)0)) {
     printf("not enough memory\n");
     exit(1);
 }
    } else {
 bzero(indices, ((1024 * 1024 * 1024) / sizeof(u32*)));
    }
    for (i = 1, j = 0; i <= max; i+=stride, j++) indices[j] = i;
     n = j;
     while (n > 1) {
  n--;
  r = random() % n;
  tmp = indices[r];
  indices[r] = indices[n];
  indices[n] = tmp;
     }
     for (i = 0; i < j-1; i++) {
  buffer[indices[i]] = (u32 *)&buffer[indices[i+1]];
     }
     buffer[indices[i]] = ((void *)0);
     return (&buffer[indices[0]]);
}

canonical_original_code:
unsigned int **shuffle(unsigned int **buffer, unsigned int stride, unsigned int max)
{
    unsigned int i; unsigned int j; unsigned int r; unsigned int n; unsigned int tmp;
    static int *indices = ((void *)0);
    if (indices == ((void *)0)) {
 indices = calloc(((1024 * 1024 * 1024) / sizeof(unsigned int *)), sizeof(int));
 if (indices == ((void *)0)) {
     printf("not enough memory\n");
     exit(1);
 }
    } else {
 bzero(indices, ((1024 * 1024 * 1024) / sizeof(unsigned int *)));
    }
    for (i = 1, j = 0; i <= max; i+=stride, j++) indices[j] = i;
     n = j;
     while (n > 1) {
  n--;
  r = random() % n;
  tmp = indices[r];
  indices[r] = indices[n];
  indices[n] = tmp;
     }
     for (i = 0; i < j-1; i++) {
  buffer[indices[i]] = (unsigned int *)&buffer[indices[i+1]];
     }
     buffer[indices[i]] = ((void *)0);
     return (&buffer[indices[0]]);
}

variable_types:
buffer
unsigned int **

variable_types:
stride
unsigned int

variable_types:
max
unsigned int

variable_types:
i
unsigned int

variable_types:
j
unsigned int

variable_types:
r
unsigned int

variable_types:
n
unsigned int

variable_types:
tmp
unsigned int

variable_types:
indices
int *

return_type: unsigned int **


linear

decompiled_code:
__int64 __fastcall linear(__int64 a1, int a2, unsigned int a3)
{
unsigned int v4; // eax
unsigned int v5; // edx

v4 = a2 + 1;
if ( a2 + 1 <= a3 )
{
v5 = 1;
do
{
*(_QWORD *)(a1 + 8LL * v5) = a1 + 8LL * v4;
v4 += a2;
v5 += a2;
}
while ( a3 >= v4 );
}
*(_QWORD *)(a1 + 8LL * a3) = 0LL;
return a1 + 8;
}

canonical_decompiled_code:
__int64 __fastcall func9(__int64 a1, int a2, unsigned int a3)
{
unsigned int v4; // eax
unsigned int v5; // edx

v4 = a2 + 1;
if ( a2 + 1 <= a3 )
{
v5 = 1;
do
{
*(_QWORD *)(a1 + 8LL * v5) = a1 + 8LL * v4;
v4 += a2;
v5 += a2;
}
while ( a3 >= v4 );
}
*(_QWORD *)(a1 + 8LL * a3) = 0LL;
return a1 + 8;
}

original_code:
u32 **
linear(u32 **buffer, u32 stride, u32 max)
{
    u32 i, last;
    last = 1;
    for (i = stride + 1; i <= max; i += stride) {
 buffer[last] = (u32 *)&buffer[i];
 last = i;
    }
    buffer[max] = 0;
    return (&buffer[1]);
}

canonical_original_code:
unsigned int **linear(unsigned int **buffer, unsigned int stride, unsigned int max)
{
    unsigned int i; unsigned int last;
    last = 1;
    for (i = stride + 1; i <= max; i += stride) {
 buffer[last] = (unsigned int *)&buffer[i];
 last = i;
    }
    buffer[max] = 0;
    return (&buffer[1]);
}

variable_types:
last
unsigned int


decompiled_code:
void __fastcall random_access(unsigned int a1)
{
unsigned int v1; // er15
_QWORD *v2; // rax
int v3; // edx
int v4; // er12
double v5; // xmm0_8
unsigned int v6; // er14
__int64 v7; // rbx
int v8; // ebp
double v9; // [rsp+0h] [rbp-58h]
double v10; // [rsp+8h] [rbp-50h]

v1 = 128;
if ( a1 > 0x7F )
{
do
{
v6 = 1;
if ( v1 > 1 )
{
do
{
v7 = shuffle((__int64)&buffer, v6, v1 - v6 + 1);
v8 = 10 * v6;
v9 = 0.0;
v4 = 0;
do
{
v10 = timestamp();
v3 = 10 * v6;
if ( v8 )
{
do
{
v2 = (_QWORD *)v7;
if ( v7 )
{
do
v2 = (_QWORD *)*v2;
while ( v2 );
}
--v3;
}
while ( v3 );
}
++v4;
v5 = timestamp() - v10 + v9;
v9 = v5;
}
while ( v5 < 1.0 );
printf(format, 8LL * v6, 8LL * v1, v5 * 1000000000.0 / (double)(int)(v4 * v8 * ((v1 - v6) / v6 + 1)));
fflush(_bss_start);
v6 *= 2;
}
while ( v6 <= v1 >> 1 );
}
puts("\n");
fflush(_bss_start);
v1 *= 2;
}
while ( a1 >= v1 );
}
}

original_code:
void
random_access(u32 cache_max)
{
    u32 register i, stride;
    u32 steps, csize, limit;
    double sec0, sec;
    u32 register **start, **p;
    for (csize=(1024 / sizeof(u32*)); csize <= cache_max; csize*=2) {
 for (stride=1; stride <= csize/2; stride=stride*2) {
     sec = 0.0;
     limit = csize - stride + 1;
     steps = 0;
     start = shuffle(buffer, stride, limit);
     do {
  sec0 = timestamp();
  for (i=10*stride; i > 0; i--)
      for (p = start; p; p = (u32 **)*p) ;
  steps++;
  sec += timestamp() - sec0;
     } while (sec < 1.0);
     printf("%lu\t%lu\t%.1lf\n",
     stride * sizeof(u32*),
     csize * sizeof(u32*),
     sec*1e9/(steps*10*stride*((limit-1)/stride+1)));
     fflush(stdout);
 }
 printf("\n\n");
 fflush(stdout);
    }
}

canonical_original_code:
void random_access(unsigned int cache_max)
{
    register unsigned int i; register unsigned int stride;
    unsigned int steps; unsigned int csize; unsigned int limit;
    double sec0; double sec;
    register unsigned int **start; register unsigned int **p;
    for (csize=(1024 / sizeof(unsigned int *)); csize <= cache_max; csize*=2) {
 for (stride=1; stride <= csize/2; stride=stride*2) {
     sec = 0.0;
     limit = csize - stride + 1;
     steps = 0;
     start = shuffle(buffer, stride, limit);
     do {
  sec0 = timestamp();
  for (i=10*stride; i > 0; i--)
      for (p = start; p; p = (unsigned int **)*p) ;
  steps++;
  sec += timestamp() - sec0;
     } while (sec < 1.0);
     printf("%lu\t%lu\t%.1lf\n",
     stride * sizeof(unsigned int *),
     csize * sizeof(unsigned int *),
     sec*1e9/(steps*10*stride*((limit-1)/stride+1)));
     fflush(stdout);
 }
 printf("\n\n");
 fflush(stdout);
    }
}

variable_types:
steps
unsigned int

variable_types:
csize
unsigned int

variable_types:
limit
unsigned int

variable_types: sec double

variable_types:
start
unsigned int **

variable_types:
p
unsigned int **

return_type: void


decompiled_code:
void __fastcall sequential_access(unsigned int a1)
{
unsigned int v1; // er15
_QWORD *v2; // rax
int v3; // edx
int v4; // er12
double v5; // xmm0_8
unsigned int v6; // er14
__int64 v7; // rbx
int v8; // ebp
double v9; // [rsp+0h] [rbp-58h]
double v10; // [rsp+8h] [rbp-50h]

v1 = 128;
if ( a1 > 0x7F )
{
do
{
v6 = 1;
if ( v1 > 1 )
{
do
{
v7 = linear((__int64)&buffer, v6, v1 - v6 + 1);
v8 = 10 * v6;
v9 = 0.0;
v4 = 0;
do
{
v10 = timestamp();
v3 = 10 * v6;
if ( v8 )
{
do
{
v2 = (_QWORD *)v7;
if ( v7 )
{
do
v2 = (_QWORD *)*v2;
while ( v2 );
}
--v3;
}
while ( v3 );
}
++v4;
v5 = timestamp() - v10 + v9;
v9 = v5;
}
while ( v5 < 1.0 );
printf(format, 8LL * v6, 8LL * v1, v5 * 1000000000.0 / (double)(int)(v4 * v8 * ((v1 - v6) / v6 + 1)));
fflush(_bss_start);
v6 *= 2;
}
while ( v6 <= v1 >> 1 );
}
puts("\n");
fflush(_bss_start);
v1 *= 2;
}
while ( a1 >= v1 );
}
}

original_code:
void
sequential_access(u32 cache_max)
{
    u32 i, stride;
    u32 steps, csize, limit;
    double sec0, sec;
    u32 **start;
    register u32 **p;
    for (csize=(1024 / sizeof(u32*)); csize <= cache_max; csize*=2) {
 for (stride=1; stride <= csize/2; stride=stride*2) {
     sec = 0.0;
     limit = csize - stride + 1;
     steps = 0;
     start = linear(buffer, stride, limit);
     do {
  sec0 = timestamp();
  for (i=10*stride; i > 0; i--)
      for (p = start; p; p = (u32 **)*p) ;
  steps++;
  sec += timestamp() - sec0;
     } while (sec < 1.0);
     printf("%lu\t%lu\t%.1lf\n",
     stride * sizeof(u32*),
     csize * sizeof(u32*),
     sec*1e9/(steps*10*stride*((limit-1)/stride+1)));
     fflush(stdout);
 }
 printf("\n\n");
 fflush(stdout);
    }
}

canonical_original_code:
void sequential_access(unsigned int cache_max)
{
    unsigned int i; unsigned int stride;
    unsigned int steps; unsigned int csize; unsigned int limit;
    double sec0; double sec;
    unsigned int **start;
    register unsigned int **p;
    for (csize=(1024 / sizeof(unsigned int *)); csize <= cache_max; csize*=2) {
 for (stride=1; stride <= csize/2; stride=stride*2) {
     sec = 0.0;
     limit = csize - stride + 1;
     steps = 0;
     start = linear(buffer, stride, limit);
     do {
  sec0 = timestamp();
  for (i=10*stride; i > 0; i--)
      for (p = start; p; p = (unsigned int **)*p) ;
  steps++;
  sec += timestamp() - sec0;
     } while (sec < 1.0);
     printf("%lu\t%lu\t%.1lf\n",
     stride * sizeof(unsigned int *),
     csize * sizeof(unsigned int *),
     sec*1e9/(steps*10*stride*((limit-1)/stride+1)));
     fflush(stdout);
 }
 printf("\n\n");
 fflush(stdout);
    }
}


main

canonical_name: main

decompiled_code:
int __cdecl main(int argc, const char **argv, const char **envp)
{
int v3; // er13
void *v4; // r12
int v5; // eax
int result; // eax

v4 = &unk_8000000;
while ( 1 )
{
v5 = getopt_long(argc, (char *const *)argv, shortopts, &longopts, 0LL);
if ( v5 == -1 )
break;
switch ( v5 )
{
case 'r':
v3 = 0;
break;
case 's':
v3 = 1;
break;
case 'b':
v4 = (void *)((unsigned __int64)strtol(optarg, 0LL, 10) >> 3);
break;
default:
goto LABEL_9;
}
}
if ( (unsigned int)v4 <= 0x7F )
{
fprintf(stderr, off_402080, *argv, 1024LL);
result = 1;
}
else if ( (unsigned int)v4 > (unsigned int)&unk_8000000 )
{
fprintf(stderr, off_4020A8, *argv, &unk_40000000);
result = 1;
}
else if ( v3 )
{
if ( v3 != 1 )
{
LABEL_9:
fprintf(stderr, "usage: %s (--random|--sequential) [--buffer <size>]\n", *argv);
return 1;
}
printf("# doing sequential access with a max buffer of %ld\n", 8LL * (unsigned int)v4);
sequential_access((unsigned int)v4);
result = 0;
}
else
{
printf("# doing random access with a max buffer of %ld\n", 8LL * (unsigned int)v4);
random_access((unsigned int)v4);
result = 0;
}
return result;
}

canonical_decompiled_code:
int __cdecl main(int argc, const char **argv, const char **envp)
{
int v3; // er13
void *v4; // r12
int v5; // eax
int result; // eax

v4 = &unk_8000000;
while ( 1 )
{
v5 = getopt_long(argc, (char *const *)argv, shortopts, &longopts, 0LL);
if ( v5 == -1 )
break;
switch ( v5 )
{
case 'r':
v3 = 0;
break;
case 's':
v3 = 1;
break;
case 'b':
v4 = (void *)((unsigned __int64)strtol(optarg, 0LL, 10) >> 3);
break;
default:
goto LABEL_9;
}
}
if ( (unsigned int)v4 <= 0x7F )
{
fprintf(stderr, off_402080, *argv, 1024LL);
result = 1;
}
else if ( (unsigned int)v4 > (unsigned int)&unk_8000000 )
{
fprintf(stderr, off_4020A8, *argv, &unk_40000000);
result = 1;
}
else if ( v3 )
{
if ( v3 != 1 )
{
LABEL_9:
fprintf(stderr, "usage: %s (--random|--sequential) [--buffer <size>]\n", *argv);
return 1;
}
printf("# doing sequential access with a max buffer of %ld\n", 8LL * (unsigned int)v4);
func11((unsigned int)v4);
result = 0;
}
else
{
printf("# doing random access with a max buffer of %ld\n", 8LL * (unsigned int)v4);
func10((unsigned int)v4);
result = 0;
}
return result;
}

original_code:
int
main(int ac, char **av)
{
    int c;
    u32 cache_size;
    access_kind kind;
    cache_size = ((1024 * 1024 * 1024) / sizeof(u32*));
    while ((c = getopt_long(ac, av, "rsc:", longopts, ((void *)0))) != -1) {
 switch (c) {
 case 'r':
     kind = rand_access;
     break;
 case 's':
     kind = seq_access;
     break;
 case 'b':
     cache_size = strtol(optarg, 0, 10) / sizeof(u32*);
     break;
 default:
usage: fprintf(stderr, "usage: %s (--random|--sequential) "
      "[--buffer <size>]\n", av[0]);
     return (1);
     break;
 }
    }
    if (cache_size < (1024 / sizeof(u32*))) {
 fprintf(stderr, "%s: buffer needs to be at least %ld\n",
  av[0], (1024 / sizeof(u32*)) * sizeof(u32*));
 return (1);
    }
    if (cache_size > ((1024 * 1024 * 1024) / sizeof(u32*))) {
 fprintf(stderr, "%s: buffer needs to be less than %ld\n",
  av[0], ((1024 * 1024 * 1024) / sizeof(u32*)) * sizeof(u32*));
 return (1);
    }
    switch (kind) {
    case rand_access:
 printf("# doing random access with a max buffer of %ld\n",
        cache_size * sizeof(u32*));
 random_access(cache_size);
 break;
    case seq_access:
 printf("# doing sequential access with a max buffer of %ld\n",
        cache_size * sizeof(u32*));
 sequential_access(cache_size);
 break;
    default:
 goto usage;
 break;
    }
    return (0);
}

canonical_original_code:
int main(int ac, char **av)
{
    int c;
    unsigned int cache_size;
    enum access_kind kind;
    cache_size = ((1024 * 1024 * 1024) / sizeof(unsigned int *));
    while ((c = getopt_long(ac, av, "rsc:", longopts, ((void *)0))) != -1) {
 switch (c) {
 case 'r':
     kind = rand_access;
     break;
 case 's':
     kind = seq_access;
     break;
 case 'b':
     cache_size = strtol(optarg, 0, 10) / sizeof(unsigned int *);
     break;
 default:
usage: fprintf(stderr, "usage: %s (--random|--sequential) "
      "[--buffer <size>]\n", av[0]);
     return (1);
     break;
 }
    }
    if (cache_size < (1024 / sizeof(unsigned int *))) {
 fprintf(stderr, "%s: buffer needs to be at least %ld\n",
  av[0], (1024 / sizeof(unsigned int *)) * sizeof(unsigned int *));
 return (1);
    }
    if (cache_size > ((1024 * 1024 * 1024) / sizeof(unsigned int *))) {
 fprintf(stderr, "%s: buffer needs to be less than %ld\n",
  av[0], ((1024 * 1024 * 1024) / sizeof(unsigned int *)) * sizeof(unsigned int *));
 return (1);
    }
    switch (kind) {
    case rand_access:
 printf("# doing random access with a max buffer of %ld\n",
        cache_size * sizeof(unsigned int *));
 random_access(cache_size);
 break;
    case seq_access:
 printf("# doing sequential access with a max buffer of %ld\n",
        cache_size * sizeof(unsigned int *));
 sequential_access(cache_size);
 break;
    default:
 goto usage;
 break;
    }
    return (0);
}

variable_types: ac int

variable_types:
av
char **

variable_types: c int

variable_types: enum access_kind { rand_access=0, seq_access=1 }

return_type: int


BcTestMode

decompiled_code:
_BOOL8 BcTestMode()
{
return *barnyard2_conf == 4;
}

canonical_decompiled_code:
_BOOL8 func0()
{
return *barnyard2_conf == 4;
}

original_code:
static inline int BcTestMode(void)
{
    return barnyard2_conf->run_mode == RUN_MODE__TEST;
}

canonical_original_code:
static inline int BcTestMode()
{
    return barnyard2_conf->run_mode == RUN_MODE__TEST;
}


BcLogVerbose

decompiled_code:
__int64 BcLogVerbose()
{
return *(_DWORD *)(barnyard2_conf + 16LL) & 1;
}

canonical_decompiled_code:
__int64 func1()
{
return *(_DWORD *)(barnyard2_conf + 16LL) & 1;
}

original_code:
static inline int BcLogVerbose(void)
{
    return barnyard2_conf->logging_flags & LOGGING_FLAG__VERBOSE;
}

canonical_original_code:
static inline int BcLogVerbose()
{
    return barnyard2_conf->logging_flags & LOGGING_FLAG__VERBOSE;
}


BcLogQuiet

decompiled_code:
__int64 BcLogQuiet()
{
return *(_DWORD *)(barnyard2_conf + 16LL) & 2;
}

canonical_decompiled_code:
__int64 func2()
{
return *(_DWORD *)(barnyard2_conf + 16LL) & 2;
}

original_code:
static inline int BcLogQuiet(void)
{
    return barnyard2_conf->logging_flags & LOGGING_FLAG__QUIET;
}

canonical_original_code:
static inline int BcLogQuiet()
{
    return barnyard2_conf->logging_flags & LOGGING_FLAG__QUIET;
}


BcOutputUseUtc

decompiled_code:
__int64 BcOutputUseUtc()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x40;
}

canonical_decompiled_code:
__int64 func3()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x40;
}

original_code:
static inline int BcOutputUseUtc(void)
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__USE_UTC;
}

canonical_original_code:
static inline int BcOutputUseUtc()
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__USE_UTC;
}


Sguil

decompiled_code:
void Sguil()
{
;
}

canonical_decompiled_code:
void func4()
{
;
}

original_code:
void Sguil(Packet *p, void *event, uint32_t event_type, void *arg)
{
}

canonical_original_code:
void Sguil(struct _Packet *p, void *event, unsigned int event_type, void *arg)
{
}

variable_types: struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *

variable_types:
event
void *

variable_types:
arg
void *

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }

user_defined_types: struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip ip_src; struct _ip ip_dst; }


SguilCleanExitFunc

decompiled_code:
void __fastcall SguilCleanExitFunc(__int64 a1, __int64 a2)
{
void *v2; // rdi
void *v3; // rdi
void *v4; // rdi

DebugMessageFile = "spo_sguil.c";
DebugMessageLine = 1085;
DebugMessageFunc(32LL, "SguilCleanExitFunc\n");
if ( a2 )
{
if ( *(_QWORD *)a2 )
free(*(void **)a2);
v2 = *(void **)(a2 + 8);
if ( v2 )
free(v2);
v3 = *(void **)(a2 + 16);
if ( v3 )
free(v3);
v4 = *(void **)(a2 + 40);
if ( v4 )
free(v4);
free((void *)a2);
}
}

canonical_decompiled_code:
void __fastcall func6(__int64 a1, __int64 a2)
{
void *v2; // rdi
void *v3; // rdi
void *v4; // rdi

DebugMessageFile = "spo_sguil.c";
DebugMessageLine = 1085;
DebugMessageFunc(32LL, "SguilCleanExitFunc\n");
if ( a2 )
{
if ( *(_QWORD *)a2 )
free(*(void **)a2);
v2 = *(void **)(a2 + 8);
if ( v2 )
free(v2);
v3 = *(void **)(a2 + 16);
if ( v3 )
free(v3);
v4 = *(void **)(a2 + 40);
if ( v4 )
free(v4);
free((void *)a2);
}
}

original_code:
void SguilCleanExitFunc(int signal, void *arg)
{
    SpoSguilData *ssd_data = (SpoSguilData *)arg;
    DebugMessageFile = "spo_sguil.c"; DebugMessageLine = 1085; DebugMessageFunc(0x00000020,"SguilCleanExitFunc\n");;
 if (ssd_data)
 {
  if (ssd_data->sensor_name)
   free(ssd_data->sensor_name);
  if (ssd_data->tag_path)
   free(ssd_data->tag_path);
  if (ssd_data->passwd)
   free(ssd_data->passwd);
  if (ssd_data->args)
   free(ssd_data->args);
  free(ssd_data);
 }
}

canonical_original_code:
void SguilCleanExitFunc(int signal, void *arg)
{
    struct _SpoSguilData *ssd_data = (SpoSguilData *)arg;
    DebugMessageFile = "spo_sguil.c"; DebugMessageLine = 1085; DebugMessageFunc(0x00000020,"SguilCleanExitFunc\n");;
 if (ssd_data)
 {
  if (ssd_data->sensor_name)
   free(ssd_data->sensor_name);
  if (ssd_data->tag_path)
   free(ssd_data->tag_path);
  if (ssd_data->passwd)
   free(ssd_data->passwd);
  if (ssd_data->args)
   free(ssd_data->args);
  free(ssd_data);
 }
}

variable_types: signal int

variable_types: struct _SpoSguilData { char *sensor_name; char *tag_path; char *passwd; unsigned int sensor_id; unsigned int event_id; unsigned int agent_port; int agent_sock; char *args; } *


SguilRestartFunc

decompiled_code:
void __fastcall SguilRestartFunc(__int64 a1, __int64 a2)
{
void *v2; // rdi
void *v3; // rdi
void *v4; // rdi

DebugMessageFile = "spo_sguil.c";
DebugMessageLine = 1110;
DebugMessageFunc(32LL, "SguilCleanExitFunc\n");
if ( a2 )
{
if ( *(_QWORD *)a2 )
free(*(void **)a2);
v2 = *(void **)(a2 + 8);
if ( v2 )
free(v2);
v3 = *(void **)(a2 + 16);
if ( v3 )
free(v3);
v4 = *(void **)(a2 + 40);
if ( v4 )
free(v4);
free((void *)a2);
}
}

canonical_decompiled_code:
void __fastcall func7(__int64 a1, __int64 a2)
{
void *v2; // rdi
void *v3; // rdi
void *v4; // rdi

DebugMessageFile = "spo_sguil.c";
DebugMessageLine = 1110;
DebugMessageFunc(32LL, "SguilCleanExitFunc\n");
if ( a2 )
{
if ( *(_QWORD *)a2 )
free(*(void **)a2);
v2 = *(void **)(a2 + 8);
if ( v2 )
free(v2);
v3 = *(void **)(a2 + 16);
if ( v3 )
free(v3);
v4 = *(void **)(a2 + 40);
if ( v4 )
free(v4);
free((void *)a2);
}
}

original_code:
void SguilRestartFunc(int signal, void *arg)
{
    SpoSguilData *ssd_data = (SpoSguilData *)arg;
    DebugMessageFile = "spo_sguil.c"; DebugMessageLine = 1110; DebugMessageFunc(0x00000020,"SguilCleanExitFunc\n");;
 if (ssd_data)
 {
  if (ssd_data->sensor_name)
   free(ssd_data->sensor_name);
  if (ssd_data->tag_path)
   free(ssd_data->tag_path);
  if (ssd_data->passwd)
   free(ssd_data->passwd);
  if (ssd_data->args)
   free(ssd_data->args);
  free(ssd_data);
 }
}

canonical_original_code:
void SguilRestartFunc(int signal, void *arg)
{
    struct _SpoSguilData *ssd_data = (SpoSguilData *)arg;
    DebugMessageFile = "spo_sguil.c"; DebugMessageLine = 1110; DebugMessageFunc(0x00000020,"SguilCleanExitFunc\n");;
 if (ssd_data)
 {
  if (ssd_data->sensor_name)
   free(ssd_data->sensor_name);
  if (ssd_data->tag_path)
   free(ssd_data->tag_path);
  if (ssd_data->passwd)
   free(ssd_data->passwd);
  if (ssd_data->args)
   free(ssd_data->args);
  free(ssd_data);
 }
}

user_defined_types: struct _SpoSguilData { char *sensor_name; char *tag_path; char *passwd; unsigned int sensor_id; unsigned int event_id; unsigned int agent_port; int agent_sock; char *args; }


SguilSetup

decompiled_code:
__int64 SguilSetup()
{
RegisterOutputPlugin("sguil", 1LL, SguilInit);
DebugMessageFile = "spo_sguil.c";
DebugMessageLine = 129;
return DebugMessageFunc(4LL, "Output: Sguil is setup\n");
}

canonical_decompiled_code:
__int64 func8()
{
RegisterOutputPlugin("sguil", 1LL, SguilInit);
DebugMessageFile = "spo_sguil.c";
DebugMessageLine = 129;
return DebugMessageFunc(4LL, "Output: Sguil is setup\n");
}

original_code:
void SguilSetup()
{
    RegisterOutputPlugin("sguil", OUTPUT_TYPE_FLAG__ALERT, SguilInit);
    DebugMessageFile = "spo_sguil.c"; DebugMessageLine = 129; DebugMessageFunc(0x00000004, "Output: Sguil is setup\n");;
}


InitSguilData

decompiled_code:
__int64 __fastcall InitSguilData(__int64 a1)
{
__int64 v1; // rbx

v1 = SnortAlloc(48LL);
if ( !a1 )
{
ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
FatalError(&unk_1522);
}
*(_QWORD *)(v1 + 40) = SnortStrdup(a1);
return v1;
}

canonical_decompiled_code:
__int64 __fastcall func9(__int64 a1)
{
__int64 v1; // rbx

v1 = SnortAlloc(48LL);
if ( !a1 )
{
ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
FatalError(&unk_1522);
}
*(_QWORD *)(v1 + 40) = SnortStrdup(a1);
return v1;
}

original_code:
SpoSguilData *InitSguilData(char *args)
{
 SpoSguilData *data;
    data = (SpoSguilData *)SnortAlloc(sizeof(SpoSguilData));
 if (args == ((void *)0))
 {
  ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
  FatalError("");
 }
 data->args = SnortStrdup(args);
 return data;
}

canonical_original_code:
struct _SpoSguilData *InitSguilData(char *args)
{
 struct _SpoSguilData *data;
    data = (struct _SpoSguilData *)SnortAlloc(sizeof(SpoSguilData));
 if (args == ((void *)0))
 {
  ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
  FatalError("");
 }
 data->args = SnortStrdup(args);
 return data;
}

variable_types:
args
char *

return_type: struct _SpoSguilData { char *sensor_name; char *tag_path; char *passwd; unsigned int sensor_id; unsigned int event_id; unsigned int agent_port; int agent_sock; char *args; } *


SguilInit

decompiled_code:
__int64 __fastcall SguilInit(__int64 a1)
{
__int64 v1; // rax

DebugMessageFile = "spo_sguil.c";
DebugMessageLine = 136;
DebugMessageFunc(4LL, "Output: Sguil initialized\n");
ErrorMessage("sguil: Tcl support is not compiled into this build of barnyard2\n\n");
FatalError(
"If this build of barnyard was obtained as a binary distribution (e.g., rpm,\n"
"or Windows), then check for alternate builds that contains the necessary Tcl\n"
"support.\n"
"\n"
"If this build of barnyard was compiled by you, then re-run the ./configure\n"
"script using the '--with-tcl' switch to specify the location of the\n"
"tclConfig.sh for your system.\n"
"\n");
v1 = InitSguilData(a1);
return AddFuncToPostConfigList(SguilInitFinalize, v1);
}

canonical_decompiled_code:
__int64 __fastcall func10(__int64 a1)
{
__int64 v1; // rax

DebugMessageFile = "spo_sguil.c";
DebugMessageLine = 136;
DebugMessageFunc(4LL, "Output: Sguil initialized\n");
ErrorMessage("sguil: Tcl support is not compiled into this build of barnyard2\n\n");
FatalError(
"If this build of barnyard was obtained as a binary distribution (e.g., rpm,\n"
"or Windows), then check for alternate builds that contains the necessary Tcl\n"
"support.\n"
"\n"
"If this build of barnyard was compiled by you, then re-run the ./configure\n"
"script using the '--with-tcl' switch to specify the location of the\n"
"tclConfig.sh for your system.\n"
"\n");
v1 = func9(a1);
return AddFuncToPostConfigList(SguilInitFinalize, v1);
}

original_code:
void SguilInit(char *args)
{
 SpoSguilData *ssd_data;
    DebugMessageFile = "spo_sguil.c"; DebugMessageLine = 136; DebugMessageFunc(0x00000004, "Output: Sguil initialized\n");;
    ErrorMessage("sguil: Tcl support is not compiled into this build of barnyard2\n\n");
    FatalError("If this build of barnyard was obtained as a binary distribution (e.g., rpm,\n"
               "or Windows), then check for alternate builds that contains the necessary Tcl\n"
               "support.\n\n"
               "If this build of barnyard was compiled by you, then re-run the ./configure\n"
               "script using the '--with-tcl' switch to specify the location of the\n"
      "tclConfig.sh for your system.\n\n");
 ssd_data = InitSguilData(args);
 AddFuncToPostConfigList(SguilInitFinalize, ssd_data);
}

canonical_original_code:
void SguilInit(char *args)
{
 struct _SpoSguilData *ssd_data;
    DebugMessageFile = "spo_sguil.c"; DebugMessageLine = 136; DebugMessageFunc(0x00000004, "Output: Sguil initialized\n");;
    ErrorMessage("sguil: Tcl support is not compiled into this build of barnyard2\n\n");
    FatalError("If this build of barnyard was obtained as a binary distribution (e.g., rpm,\n"
               "or Windows), then check for alternate builds that contains the necessary Tcl\n"
               "support.\n\n"
               "If this build of barnyard was compiled by you, then re-run the ./configure\n"
               "script using the '--with-tcl' switch to specify the location of the\n"
      "tclConfig.sh for your system.\n\n");
 ssd_data = InitSguilData(args);
 AddFuncToPostConfigList(SguilInitFinalize, ssd_data);
}


ParseSguilArgs

decompiled_code:
__int64 __fastcall ParseSguilArgs(__int64 a1)
{
__int64 v1; // rsi
const unsigned __int16 **v2; // r13
__int64 v3; // rbp
const char *i; // rbx
const char **v5; // r14
const char *v6; // r15
__int64 result; // rax
int v8; // [rsp+4h] [rbp-54h] BYREF
const char **v9; // [rsp+8h] [rbp-50h] BYREF
int v10; // [rsp+14h] [rbp-44h] BYREF
__int64 v11[8]; // [rsp+18h] [rbp-40h] BYREF

if ( !*(_QWORD *)(a1 + 40) )
{
ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
FatalError(&unk_1522);
}
*(_WORD *)(a1 + 32) = 0;
v11[0] = mSplit(*(_QWORD *)(a1 + 40), ", ", 31LL, &v10, 92LL);
v1 = (unsigned int)v10;
if ( v10 > 0 )
{
v2 = _ctype_b_loc();
v3 = 0LL;
do
{
for ( i = *(const char **)(v11[0] + 8 * v3); ((*v2)[*i] & 0x2000) != 0; ++i )
;
v5 = (const char **)mSplit(i, "=", 2LL, &v8, 0LL);
v9 = v5;
v6 = *v5;
if ( !strncasecmp(*v5, "agent_port", 0xAuLL) )
{
if ( v8 <= 1 )
LogMessage("sguil: agent_port error\n");
else
*(_WORD *)(a1 + 32) = atoi(v5[1]);
}
else if ( !strncasecmp(v6, "tag_path", 8uLL) )
{
if ( v8 <= 1 || *(_QWORD *)(a1 + 8) )
LogMessage("sguil: tag_path error\n");
else
*(_QWORD *)(a1 + 8) = SnortStrdup(v5[1]);
}
else if ( !strncasecmp(v6, "sensor_name", 0xBuLL) )
{
if ( v8 <= 1 || *(_QWORD *)a1 )
LogMessage("sguil: sensor_name error\n");
else
*(_QWORD *)a1 = SnortStrdup(v5[1]);
}
else if ( !strncasecmp(v6, "passwd", 6uLL) )
{
if ( v8 <= 1 || *(_QWORD *)(a1 + 16) )
LogMessage("sguil: passwd error\n");
else
*(_QWORD *)(a1 + 16) = SnortStrdup(v5[1]);
}
else
{
LogMessage("sguil: unrecognised argument = %s\n", i);
}
mSplitFree(&v9, (unsigned int)v8);
v1 = (unsigned int)v10;
++v3;
}
while ( v10 > (int)v3 );
}
result = mSplitFree(v11, v1);
if ( !*(_WORD *)(a1 + 32) )
*(_WORD *)(a1 + 32) = 7735;
return result;
}

canonical_decompiled_code:
__int64 __fastcall func11(__int64 a1)
{
__int64 v1; // rsi
const unsigned __int16 **v2; // r13
__int64 v3; // rbp
const char *i; // rbx
const char **v5; // r14
const char *v6; // r15
__int64 result; // rax
int v8; // [rsp+4h] [rbp-54h] BYREF
const char **v9; // [rsp+8h] [rbp-50h] BYREF
int v10; // [rsp+14h] [rbp-44h] BYREF
__int64 v11[8]; // [rsp+18h] [rbp-40h] BYREF

if ( !*(_QWORD *)(a1 + 40) )
{
ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
FatalError(&unk_1522);
}
*(_WORD *)(a1 + 32) = 0;
v11[0] = mSplit(*(_QWORD *)(a1 + 40), ", ", 31LL, &v10, 92LL);
v1 = (unsigned int)v10;
if ( v10 > 0 )
{
v2 = _ctype_b_loc();
v3 = 0LL;
do
{
for ( i = *(const char **)(v11[0] + 8 * v3); ((*v2)[*i] & 0x2000) != 0; ++i )
;
v5 = (const char **)mSplit(i, "=", 2LL, &v8, 0LL);
v9 = v5;
v6 = *v5;
if ( !strncasecmp(*v5, "agent_port", 0xAuLL) )
{
if ( v8 <= 1 )
LogMessage("sguil: agent_port error\n");
else
*(_WORD *)(a1 + 32) = atoi(v5[1]);
}
else if ( !strncasecmp(v6, "tag_path", 8uLL) )
{
if ( v8 <= 1 || *(_QWORD *)(a1 + 8) )
LogMessage("sguil: tag_path error\n");
else
*(_QWORD *)(a1 + 8) = SnortStrdup(v5[1]);
}
else if ( !strncasecmp(v6, "sensor_name", 0xBuLL) )
{
if ( v8 <= 1 || *(_QWORD *)a1 )
LogMessage("sguil: sensor_name error\n");
else
*(_QWORD *)a1 = SnortStrdup(v5[1]);
}
else if ( !strncasecmp(v6, "passwd", 6uLL) )
{
if ( v8 <= 1 || *(_QWORD *)(a1 + 16) )
LogMessage("sguil: passwd error\n");
else
*(_QWORD *)(a1 + 16) = SnortStrdup(v5[1]);
}
else
{
LogMessage("sguil: unrecognised argument = %s\n", i);
}
mSplitFree(&v9, (unsigned int)v8);
v1 = (unsigned int)v10;
++v3;
}
while ( v10 > (int)v3 );
}
result = mSplitFree(v11, v1);
if ( !*(_WORD *)(a1 + 32) )
*(_WORD *)(a1 + 32) = 7735;
return result;
}

original_code:
void ParseSguilArgs(SpoSguilData *ssd_data)
{
    char **toks;
    int num_toks;
    int i;
    if(ssd_data->args == ((void *)0))
    {
  ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
  FatalError("");
 }
 ssd_data->agent_port = 0;
    toks = mSplit(ssd_data->args, ", ", 31, &num_toks, '\\');
    for(i = 0; i < num_toks; ++i)
    {
        char **stoks;
        int num_stoks;
        char *index = toks[i];
        while(((*__ctype_b_loc ())[(int) (((int)*index))] & (unsigned short int) _ISspace))
            ++index;
        stoks = mSplit(index, "=", 2, &num_stoks, 0);
        if ( !strncasecmp(stoks[0], "agent_port", strlen("agent_port")) )
        {
            if(num_stoks > 1)
                ssd_data->agent_port = atoi(stoks[1]);
            else
                LogMessage("sguil: agent_port error\n");
        }
        else if ( !strncasecmp(stoks[0], "tag_path", strlen("tag_path")) )
        {
            if(num_stoks > 1 && ssd_data->tag_path == ((void *)0))
                ssd_data->tag_path = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: tag_path error\n");
        }
        else if ( !strncasecmp(stoks[0], "sensor_name", strlen("sensor_name")) )
        {
            if(num_stoks > 1 && ssd_data->sensor_name == ((void *)0))
                ssd_data->sensor_name = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: sensor_name error\n");
  }
        else if ( !strncasecmp(stoks[0], "passwd", strlen("passwd")) )
        {
            if(num_stoks > 1 && ssd_data->passwd == ((void *)0))
                ssd_data->passwd = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: passwd error\n");
        }
        else
        {
   LogMessage("sguil: unrecognised argument = %s\n", index);
  }
        mSplitFree(&stoks, num_stoks);
    }
    mSplitFree(&toks, num_toks);
 if (ssd_data->agent_port == 0)
  ssd_data->agent_port = 7735;
}

canonical_original_code:
void ParseSguilArgs(struct _SpoSguilData *ssd_data)
{
    char **toks;
    int num_toks;
    int i;
    if(ssd_data->args == ((void *)0))
    {
  ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
  FatalError("");
 }
 ssd_data->agent_port = 0;
    toks = mSplit(ssd_data->args, ", ", 31, &num_toks, '\\');
    for(i = 0; i < num_toks; ++i)
    {
        char **stoks;
        int num_stoks;
        char *index = toks[i];
        while(((*__ctype_b_loc ())[(int) (((int)*index))] & (unsigned short) _ISspace))
            ++index;
        stoks = mSplit(index, "=", 2, &num_stoks, 0);
        if ( !strncasecmp(stoks[0], "agent_port", strlen("agent_port")) )
        {
            if(num_stoks > 1)
                ssd_data->agent_port = atoi(stoks[1]);
            else
                LogMessage("sguil: agent_port error\n");
        }
        else if ( !strncasecmp(stoks[0], "tag_path", strlen("tag_path")) )
        {
            if(num_stoks > 1 && ssd_data->tag_path == ((void *)0))
                ssd_data->tag_path = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: tag_path error\n");
        }
        else if ( !strncasecmp(stoks[0], "sensor_name", strlen("sensor_name")) )
        {
            if(num_stoks > 1 && ssd_data->sensor_name == ((void *)0))
                ssd_data->sensor_name = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: sensor_name error\n");
  }
        else if ( !strncasecmp(stoks[0], "passwd", strlen("passwd")) )
        {
            if(num_stoks > 1 && ssd_data->passwd == ((void *)0))
                ssd_data->passwd = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: passwd error\n");
        }
        else
        {
   LogMessage("sguil: unrecognised argument = %s\n", index);
  }
        mSplitFree(&stoks, num_stoks);
    }
    mSplitFree(&toks, num_toks);
 if (ssd_data->agent_port == 0)
  ssd_data->agent_port = 7735;
}

variable_types:
toks
char **

variable_types: i int

variable_types:
stoks
char **

variable_types:
index
char *


SguilSensorAgentConnect

decompiled_code:
__int64 __fastcall SguilSensorAgentConnect(__int64 a1)
{
unsigned int v1; // er13
char v2; // r12
int v4; // ebx
struct sockaddr v5; // [rsp+0h] [rbp-38h] BYREF

v1 = exit_signal;
if ( exit_signal )
return 1;
v2 = 4;
while ( 1 )
{
v4 = socket(2, 1, 0);
if ( v4 < 0 )
{
FatalError("sguil: Can't open a local socket.\n");
return 1;
}
v5.sa_family = 2;
*(_WORD *)v5.sa_data = _bswap_16(*(_WORD *)(a1 + 32));
*(_DWORD *)&v5.sa_data[2] = inet_addr("127.0.0.1");
*(_QWORD *)&v5.sa_data[6] = 0LL;
if ( connect(v4, &v5, 0x10u) >= 0 )
break;
LogMessage("sguil: Can't connect to localhost on TCP port %u.\n", *(unsigned __int16 *)(a1 + 32));
close(v4);
if ( BcTestMode() )
{
if ( v2 )
{
--v2;
}
else
{
FatalError("sguil: Unable to connect after 4 attempts\n");
v2 = -1;
}
}
LogMessage("sguil: Waiting 15 secs to try again.\n");
sleep(0xFu);
if ( exit_signal )
return 1;
}
*(_DWORD *)(a1 + 36) = v4;
LogMessage("sguil: Connected to localhost on %u.\n", *(unsigned __int16 *)(a1 + 32));
return v1;
}

canonical_decompiled_code:
__int64 __fastcall func12(__int64 a1)
{
unsigned int v1; // er13
char v2; // r12
int v4; // ebx
struct sockaddr v5; // [rsp+0h] [rbp-38h] BYREF

v1 = exit_signal;
if ( exit_signal )
return 1;
v2 = 4;
while ( 1 )
{
v4 = socket(2, 1, 0);
if ( v4 < 0 )
{
FatalError("sguil: Can't open a local socket.\n");
return 1;
}
v5.sa_family = 2;
*(_WORD *)v5.sa_data = func5(*(_WORD *)(a1 + 32));
*(_DWORD *)&v5.sa_data[2] = inet_addr("127.0.0.1");
*(_QWORD *)&v5.sa_data[6] = 0LL;
if ( connect(v4, &v5, 0x10u) >= 0 )
break;
LogMessage("sguil: Can't connect to localhost on TCP port %u.\n", *(unsigned __int16 *)(a1 + 32));
close(v4);
if ( func0() )
{
if ( v2 )
{
--v2;
}
else
{
FatalError("sguil: Unable to connect after 4 attempts\n");
v2 = -1;
}
}
LogMessage("sguil: Waiting 15 secs to try again.\n");
sleep(0xFu);
if ( exit_signal )
return 1;
}
*(_DWORD *)(a1 + 36) = v4;
LogMessage("sguil: Connected to localhost on %u.\n", *(unsigned __int16 *)(a1 + 32));
return v1;
}

original_code:
int SguilSensorAgentConnect(SpoSguilData *ssd_data)
{
    int sockfd;
    struct sockaddr_in my_addr;
 u_int8_t tries = 4;
 while (exit_signal == 0)
    {
        if ( (sockfd = socket(2, SOCK_STREAM, 0)) < 0 )
        {
            FatalError("sguil:  Can't open a local socket.\n");
            return 1;
        }
        my_addr.sin_family = 2;
        my_addr.sin_port = htons(ssd_data->agent_port);
        my_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
        memset(&(my_addr.sin_zero), '\0', 8);
        if (connect(sockfd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) < 0)
        {
            LogMessage("sguil:  Can't connect to localhost on TCP port %u.\n",
                        ssd_data->agent_port);
            close(sockfd);
   if ((BcTestMode()) && (tries-- == 0))
   {
    FatalError("sguil:  Unable to connect after 4 attempts\n");
         }
   LogMessage("sguil:  Waiting 15 secs to try again.\n");
      if (sleep(15))
   {
         }
        }
        else
        {
            ssd_data->agent_sock = sockfd;
            LogMessage("sguil:  Connected to localhost on %u.\n",
                        ssd_data->agent_port);
            return 0;
        }
    }
 return 1;
}

canonical_original_code:
int SguilSensorAgentConnect(struct _SpoSguilData *ssd_data)
{
    int sockfd;
    struct sockaddr_in my_addr;
 unsigned int tries = 4;
 while (exit_signal == 0)
    {
        if ( (sockfd = socket(2, SOCK_STREAM, 0)) < 0 )
        {
            FatalError("sguil:  Can't open a local socket.\n");
            return 1;
        }
        my_addr.sin_family = 2;
        my_addr.sin_port = htons(ssd_data->agent_port);
        my_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
        memset(&(my_addr.sin_zero), '\0', 8);
        if (connect(sockfd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) < 0)
        {
            LogMessage("sguil:  Can't connect to localhost on TCP port %u.\n",
                        ssd_data->agent_port);
            close(sockfd);
   if ((BcTestMode()) && (tries-- == 0))
   {
    FatalError("sguil:  Unable to connect after 4 attempts\n");
         }
   LogMessage("sguil:  Waiting 15 secs to try again.\n");
      if (sleep(15))
   {
         }
        }
        else
        {
            ssd_data->agent_sock = sockfd;
            LogMessage("sguil:  Connected to localhost on %u.\n",
                        ssd_data->agent_port);
            return 0;
        }
    }
 return 1;
}

variable_types: sockfd int

variable_types: struct sockaddr_in { unsigned short sin_family; unsigned short sin_port; struct in_addr { unsigned int s_addr; } sin_addr; unsigned char sin_zero[-1]; }

variable_types:
tries
unsigned int

user_defined_types: struct sockaddr_in { unsigned short sin_family; unsigned short sin_port; struct in_addr sin_addr; unsigned char sin_zero[-1]; }

user_defined_types: struct sockaddr { unsigned short sa_family; char sa_data[14]; }


SguilSendAgentMsg

decompiled_code:
__int64 __fastcall SguilSendAgentMsg(__int64 a1, const char *a2)
{
size_t v2; // r12
char *v3; // rbx
size_t v4; // rax

v2 = strlen(a2) + 2;
v3 = (char *)SnortAlloc(v2);
snprintf(v3, v2, "%s\n", a2);
v4 = strlen(v3);
if ( (int)send(*(_DWORD *)(a1 + 36), v3, v4, 0) < 0 )
{
if ( (unsigned int)BcLogVerbose() )
LogMessage("sguil: Lost connection to sensor_agent.\n");
SguilSendAgentMsg(a1, a2);
}
if ( (unsigned int)BcLogVerbose() )
LogMessage("sguil: sending \"%s\"", v3);
free(v3);
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func13(__int64 a1, const char *a2)
{
size_t v2; // r12
char *v3; // rbx
size_t v4; // rax

v2 = strlen(a2) + 2;
v3 = (char *)SnortAlloc(v2);
snprintf(v3, v2, "%s\n", a2);
v4 = strlen(v3);
if ( (int)send(*(_DWORD *)(a1 + 36), v3, v4, 0) < 0 )
{
if ( (unsigned int)func1() )
LogMessage("sguil: Lost connection to sensor_agent.\n");
func13(a1, a2);
}
if ( (unsigned int)func1() )
LogMessage("sguil: sending \"%s\"", v3);
free(v3);
return 0LL;
}

original_code:
int SguilSendAgentMsg(SpoSguilData *data, char *msg)
{
    int schars;
    size_t len;
    char *tmpMsg;
    len = strlen(msg)+2;
    tmpMsg = SnortAlloc(len);
    snprintf(tmpMsg, len, "%s\n", msg);
    if ( (schars = send(data->agent_sock, tmpMsg, sizeof(char)*strlen(tmpMsg), 0)) < 0 )
    {
        if(BcLogVerbose())
      LogMessage("sguil: Lost connection to sensor_agent.\n");
        SguilSendAgentMsg(data, msg);
    }
    if (BcLogVerbose())
     LogMessage("sguil: sending \"%s\"", tmpMsg);
    free(tmpMsg);
    return 0;
}

canonical_original_code:
int SguilSendAgentMsg(struct _SpoSguilData *data, char *msg)
{
    int schars;
    unsigned long len;
    char *tmpMsg;
    len = strlen(msg)+2;
    tmpMsg = SnortAlloc(len);
    snprintf(tmpMsg, len, "%s\n", msg);
    if ( (schars = send(data->agent_sock, tmpMsg, sizeof(char)*strlen(tmpMsg), 0)) < 0 )
    {
        if(BcLogVerbose())
      LogMessage("sguil: Lost connection to sensor_agent.\n");
        SguilSendAgentMsg(data, msg);
    }
    if (BcLogVerbose())
     LogMessage("sguil: sending \"%s\"", tmpMsg);
    free(tmpMsg);
    return 0;
}

variable_types:
msg
char *

variable_types: schars int

variable_types:
len
unsigned long

variable_types:
tmpMsg
char *


SguilRecvAgentMsg

decompiled_code:
__int64 __fastcall SguilRecvAgentMsg(__int64 a1, __int64 a2)
{
unsigned int v4; // er14
int v5; // ebx
int v6; // eax
int v7; // edi
char v8; // dl
int v9; // er9
__int64 v10; // rax
int v11; // ecx
char v12; // r8
__int64 v13; // rbx
int v14; // esi
fd_set v16; // [rsp+0h] [rbp-B8h] BYREF
struct timeval timeout; // [rsp+80h] [rbp-38h] BYREF

timeout.tv_sec = 15LL;
timeout.tv_usec = 0LL;
memset(&v16, 0, sizeof(v16));
v16.fds_bits[*(_DWORD *)(a1 + 36) / 64] |= 1LL << (*(_DWORD *)(a1 + 36) % 64);
v4 = exit_signal;
if ( exit_signal )
return 0;
v5 = exit_signal;
while ( 1 )
{
select(*(_DWORD *)(a1 + 36) + 1, &v16, 0LL, 0LL, &timeout);
if ( (v16.fds_bits[*(_DWORD *)(a1 + 36) / 64] & (1LL << (*(_DWORD *)(a1 + 36) % 64))) == 0 )
break;
if ( !rcv_ptr_2 )
{
memset(rcv_msg_1, 0, sizeof(rcv_msg_1));
v6 = recv(*(_DWORD *)(a1 + 36), rcv_msg_1, 0x800uLL, 0);
n_0 = v6;
if ( v6 < 0 )
{
LogMessage("ERROR: Unable to read data.\n");
SguilSensorAgentConnect(a1);
}
else if ( !v6 )
{
LogMessage("ERROR: Connecton closed by client\n");
close(*(_DWORD *)(a1 + 36));
SguilSensorAgentConnect(a1);
}
}
v7 = rcv_ptr_2;
v8 = rcv_msg_1[rcv_ptr_2];
if ( v8 == 10 )
{
v14 = rcv_ptr_2;
}
else
{
v9 = n_0;
v10 = rcv_ptr_2;
v11 = v5;
v12 = 0;
v13 = a2 + v5 - (__int64)rcv_ptr_2;
while ( 1 )
{
v14 = v10;
if ( v9 <= (int)v10 )
break;
*(_BYTE *)(v13 + v10) = v8;
++v11;
v7 = ++v10;
v8 = rcv_msg_1[v10];
v12 = 1;
if ( v8 == 10 )
{
rcv_ptr_2 = v7;
v5 = v11;
v14 = v7;
goto LABEL_12;
}
}
if ( v12 )
rcv_ptr_2 = v7;
v5 = v11;
}
LABEL_12:
if ( n_0 - 1 == v14 )
{
*(_BYTE *)(a2 + v5) = 10;
rcv_ptr_2 = 0;
return (unsigned int)(v5 + 1);
}
if ( n_0 - 1 > v14 )
{
*(_BYTE *)(a2 + v5) = 10;
rcv_ptr_2 = v14 + 1;
return (unsigned int)(v5 + 1);
}
if ( n_0 == v14 )
rcv_ptr_2 = 0;
if ( exit_signal )
return v4;
}
v4 = 1;
if ( (unsigned int)BcLogVerbose() )
LogMessage("sguil: Timed out waiting for response.\n");
return v4;
}

canonical_decompiled_code:
__int64 __fastcall func14(__int64 a1, __int64 a2)
{
unsigned int v4; // er14
int v5; // ebx
int v6; // eax
int v7; // edi
char v8; // dl
int v9; // er9
__int64 v10; // rax
int v11; // ecx
char v12; // r8
__int64 v13; // rbx
int v14; // esi
fd_set v16; // [rsp+0h] [rbp-B8h] BYREF
struct timeval timeout; // [rsp+80h] [rbp-38h] BYREF

timeout.tv_sec = 15LL;
timeout.tv_usec = 0LL;
memset(&v16, 0, sizeof(v16));
v16.fds_bits[*(_DWORD *)(a1 + 36) / 64] |= 1LL << (*(_DWORD *)(a1 + 36) % 64);
v4 = exit_signal;
if ( exit_signal )
return 0;
v5 = exit_signal;
while ( 1 )
{
select(*(_DWORD *)(a1 + 36) + 1, &v16, 0LL, 0LL, &timeout);
if ( (v16.fds_bits[*(_DWORD *)(a1 + 36) / 64] & (1LL << (*(_DWORD *)(a1 + 36) % 64))) == 0 )
break;
if ( !rcv_ptr_2 )
{
memset(rcv_msg_1, 0, sizeof(rcv_msg_1));
v6 = recv(*(_DWORD *)(a1 + 36), rcv_msg_1, 0x800uLL, 0);
n_0 = v6;
if ( v6 < 0 )
{
LogMessage("ERROR: Unable to read data.\n");
func12(a1);
}
else if ( !v6 )
{
LogMessage("ERROR: Connecton closed by client\n");
close(*(_DWORD *)(a1 + 36));
func12(a1);
}
}
v7 = rcv_ptr_2;
v8 = rcv_msg_1[rcv_ptr_2];
if ( v8 == 10 )
{
v14 = rcv_ptr_2;
}
else
{
v9 = n_0;
v10 = rcv_ptr_2;
v11 = v5;
v12 = 0;
v13 = a2 + v5 - (__int64)rcv_ptr_2;
while ( 1 )
{
v14 = v10;
if ( v9 <= (int)v10 )
break;
*(_BYTE *)(v13 + v10) = v8;
++v11;
v7 = ++v10;
v8 = rcv_msg_1[v10];
v12 = 1;
if ( v8 == 10 )
{
rcv_ptr_2 = v7;
v5 = v11;
v14 = v7;
goto LABEL_12;
}
}
if ( v12 )
rcv_ptr_2 = v7;
v5 = v11;
}
LABEL_12:
if ( n_0 - 1 == v14 )
{
*(_BYTE *)(a2 + v5) = 10;
rcv_ptr_2 = 0;
return (unsigned int)(v5 + 1);
}
if ( n_0 - 1 > v14 )
{
*(_BYTE *)(a2 + v5) = 10;
rcv_ptr_2 = v14 + 1;
return (unsigned int)(v5 + 1);
}
if ( n_0 == v14 )
rcv_ptr_2 = 0;
if ( exit_signal )
return v4;
}
v4 = 1;
if ( (unsigned int)func1() )
LogMessage("sguil: Timed out waiting for response.\n");
return v4;
}

original_code:
int SguilRecvAgentMsg(SpoSguilData *ssd_data, char *line_to_return)
{
 static int rcv_ptr=0;
 static char rcv_msg[2048];
 static int n;
 struct timeval tv;
 fd_set read_fds;
 int offset;
 offset=0;
 tv.tv_sec = 15;
 tv.tv_usec = 0;
 do { int __d0, __d1; __asm__ __volatile__ ("cld; rep; " "stosq" : "=c" (__d0), "=D" (__d1) : "a" (0), "0" (sizeof (fd_set) / sizeof (__fd_mask)), "1" (&((&read_fds)->__fds_bits)[0]) : "memory"); } while (0);
 ((void) (((&read_fds)->__fds_bits)[((ssd_data->agent_sock) / (8 * (int) sizeof (__fd_mask)))] |= ((__fd_mask) (1UL << ((ssd_data->agent_sock) % (8 * (int) sizeof (__fd_mask)))))));
 while (exit_signal == 0)
 {
  select(ssd_data->agent_sock+1, &read_fds, ((void *)0), ((void *)0), &tv);
  if ( !(((((&read_fds)->__fds_bits)[((ssd_data->agent_sock) / (8 * (int) sizeof (__fd_mask)))] & ((__fd_mask) (1UL << ((ssd_data->agent_sock) % (8 * (int) sizeof (__fd_mask)))))) != 0)) )
  {
   if(BcLogVerbose())
    LogMessage("sguil: Timed out waiting for response.\n");
   return 1;
  }
  else
  {
   if (rcv_ptr==0)
   {
    memset(rcv_msg,0x0,2048);
    n = recv(ssd_data->agent_sock, rcv_msg, 2048, 0);
    if (n<0)
    {
     LogMessage("ERROR: Unable to read data.\n");
     SguilSensorAgentConnect(ssd_data);
    }
    else if (n==0)
    {
     LogMessage("ERROR: Connecton closed by client\n");
     close(ssd_data->agent_sock);
     SguilSensorAgentConnect(ssd_data);
    }
   }
   while( *(rcv_msg+rcv_ptr)!=0x0A && rcv_ptr<n )
   {
    memcpy(line_to_return+offset,rcv_msg+rcv_ptr,1);
    offset++;
    rcv_ptr++;
   }
   if (rcv_ptr==n-1)
   {
    *(line_to_return+offset)=0x0A;
    rcv_ptr=0;
    return ++offset;
   }
   if (rcv_ptr <n-1)
   {
          *(line_to_return+offset)=0x0A;
       rcv_ptr++;
    return ++offset;
   }
   if (rcv_ptr == n)
   {
    rcv_ptr = 0;
   }
  }
 }
 return 0;
}

canonical_original_code:
int SguilRecvAgentMsg(struct _SpoSguilData *ssd_data, char *line_to_return)
{
 static int rcv_ptr = 0;
 static char rcv_msg[2048];
 static int n;
 struct timeval tv;
 struct fd_set read_fds;
 int offset;
 offset=0;
 tv.tv_sec = 15;
 tv.tv_usec = 0;
 do { int __d0; int __d1; __asm__ __volatile__ ("cld; rep; " "stosq" : "=c" (__d0), "=D" (__d1) : "a" (0), "0" (sizeof (fd_set) / sizeof (__fd_mask)), "1" (&((&read_fds)->__fds_bits)[0]) : "memory"); } while (0);
 ((void) (((&read_fds)->__fds_bits)[((ssd_data->agent_sock) / (8 * (int) sizeof (__fd_mask)))] |= ((__fd_mask) (1UL << ((ssd_data->agent_sock) % (8 * (int) sizeof (__fd_mask)))))));
 while (exit_signal == 0)
 {
  select(ssd_data->agent_sock+1, &read_fds, ((void *)0), ((void *)0), &tv);
  if ( !(((((&read_fds)->__fds_bits)[((ssd_data->agent_sock) / (8 * (int) sizeof (__fd_mask)))] & ((__fd_mask) (1UL << ((ssd_data->agent_sock) % (8 * (int) sizeof (__fd_mask)))))) != 0)) )
  {
   if(BcLogVerbose())
    LogMessage("sguil: Timed out waiting for response.\n");
   return 1;
  }
  else
  {
   if (rcv_ptr==0)
   {
    memset(rcv_msg,0x0,2048);
    n = recv(ssd_data->agent_sock, rcv_msg, 2048, 0);
    if (n<0)
    {
     LogMessage("ERROR: Unable to read data.\n");
     SguilSensorAgentConnect(ssd_data);
    }
    else if (n==0)
    {
     LogMessage("ERROR: Connecton closed by client\n");
     close(ssd_data->agent_sock);
     SguilSensorAgentConnect(ssd_data);
    }
   }
   while( *(rcv_msg+rcv_ptr)!=0x0A && rcv_ptr<n )
   {
    memcpy(line_to_return+offset,rcv_msg+rcv_ptr,1);
    offset++;
    rcv_ptr++;
   }
   if (rcv_ptr==n-1)
   {
    *(line_to_return+offset)=0x0A;
    rcv_ptr=0;
    return ++offset;
   }
   if (rcv_ptr <n-1)
   {
          *(line_to_return+offset)=0x0A;
       rcv_ptr++;
    return ++offset;
   }
   if (rcv_ptr == n)
   {
    rcv_ptr = 0;
   }
  }
 }
 return 0;
}

variable_types: n int

variable_types: struct timeval { long tv_sec; long tv_usec; }

variable_types: offset int


SguilRTEventMsg

decompiled_code:
__int64 __fastcall SguilRTEventMsg(__int64 a1, const char *a2)
{
const char **v2; // rbp
unsigned int v4; // [rsp+4h] [rbp-824h] BYREF
const char **v5; // [rsp+8h] [rbp-820h] BYREF
char v6[2072]; // [rsp+10h] [rbp-818h] BYREF

SguilSendAgentMsg(a1, a2);
memset(v6, 0, 0x800uLL);
if ( (unsigned int)SguilRecvAgentMsg(a1, (__int64)v6) == 1 )
{
if ( (unsigned int)BcLogVerbose() )
LogMessage("sguil: Retrying\n");
SguilRTEventMsg(a1, a2);
}
else
{
if ( (unsigned int)BcLogVerbose() )
LogMessage("sguil: Received: %s", v6);
v2 = (const char **)mSplit(v6, " ", 2LL, &v4, 0LL);
v5 = v2;
if ( strcasecmp("Confirm", *v2) || atoi(v2[1]) != *(_DWORD *)(a1 + 28) )
FatalError("sguil: Expected Confirm %u and got: %s\n", *(unsigned int *)(a1 + 28), v6);
mSplitFree(&v5, v4);
}
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func15(__int64 a1, const char *a2)
{
const char **v2; // rbp
unsigned int v4; // [rsp+4h] [rbp-824h] BYREF
const char **v5; // [rsp+8h] [rbp-820h] BYREF
char v6[2072]; // [rsp+10h] [rbp-818h] BYREF

func13(a1, a2);
memset(v6, 0, 0x800uLL);
if ( (unsigned int)func14(a1, (__int64)v6) == 1 )
{
if ( (unsigned int)func1() )
LogMessage("sguil: Retrying\n");
func15(a1, a2);
}
else
{
if ( (unsigned int)func1() )
LogMessage("sguil: Received: %s", v6);
v2 = (const char **)mSplit(v6, " ", 2LL, &v4, 0LL);
v5 = v2;
if ( strcasecmp("Confirm", *v2) || atoi(v2[1]) != *(_DWORD *)(a1 + 28) )
FatalError("sguil: Expected Confirm %u and got: %s\n", *(unsigned int *)(a1 + 28), v6);
mSplitFree(&v5, v4);
}
return 0LL;
}

original_code:
int SguilRTEventMsg(SpoSguilData *data, char *msg)
{
    char tmpRecvMsg[2048];
    SguilSendAgentMsg(data, msg);
    memset(tmpRecvMsg, 0x0, 2048);
    if(SguilRecvAgentMsg(data, tmpRecvMsg) == 1)
    {
        if(BcLogVerbose())
         LogMessage("sguil: Retrying\n");
        SguilRTEventMsg(data, msg);
    }
    else
    {
        char **toks;
        int num_toks;
        if(BcLogVerbose())
            LogMessage("sguil: Received: %s", tmpRecvMsg);
        toks = mSplit(tmpRecvMsg, " ", 2, &num_toks, 0);
        if(strcasecmp("Confirm", toks[0]) != 0 || atoi(toks[1]) != data->event_id )
        {
            FatalError("sguil: Expected Confirm %u and got: %s\n", data->event_id, tmpRecvMsg);
        }
        mSplitFree(&toks, num_toks);
    }
    return 0;
}

canonical_original_code:
int SguilRTEventMsg(struct _SpoSguilData *data, char *msg)
{
    char tmpRecvMsg[2048];
    SguilSendAgentMsg(data, msg);
    memset(tmpRecvMsg, 0x0, 2048);
    if(SguilRecvAgentMsg(data, tmpRecvMsg) == 1)
    {
        if(BcLogVerbose())
         LogMessage("sguil: Retrying\n");
        SguilRTEventMsg(data, msg);
    }
    else
    {
        char **toks;
        int num_toks;
        if(BcLogVerbose())
            LogMessage("sguil: Received: %s", tmpRecvMsg);
        toks = mSplit(tmpRecvMsg, " ", 2, &num_toks, 0);
        if(strcasecmp("Confirm", toks[0]) != 0 || atoi(toks[1]) != data->event_id )
        {
            FatalError("sguil: Expected Confirm %u and got: %s\n", data->event_id, tmpRecvMsg);
        }
        mSplitFree(&toks, num_toks);
    }
    return 0;
}

variable_types:
tmpRecvMsg
char [2048]


SguilSensorAgentInit

decompiled_code:
__int64 __fastcall SguilSensorAgentInit(__int64 a1)
{
const char **v1; // rbp
unsigned int v3; // [rsp+4h] [rbp-1024h] BYREF
const char **v4; // [rsp+8h] [rbp-1020h] BYREF
char v5[2048]; // [rsp+10h] [rbp-1018h] BYREF
char s[2072]; // [rsp+810h] [rbp-818h] BYREF

snprintf(s, 0x800uLL, "SidCidRequest %s", *(const char **)a1);
SguilSendAgentMsg(a1, s);
memset(v5, 0, sizeof(v5));
if ( (unsigned int)SguilRecvAgentMsg(a1, (__int64)v5) == 1 )
{
SguilSensorAgentInit(a1);
}
else
{
if ( (unsigned int)BcLogVerbose() )
LogMessage("sguil: received \"%s\"", v5);
v1 = (const char **)mSplit(v5, " ", 3LL, &v3, 0LL);
v4 = v1;
if ( !strcasecmp("SidCidResponse", *v1) )
{
*(_WORD *)(a1 + 24) = atoi(v1[1]);
*(_DWORD *)(a1 + 28) = atoi(v1[2]);
}
else
{
FatalError("sguil: Expected SidCidResponse and got '%s'\n", v5);
}
mSplitFree(&v4, v3);
if ( (unsigned int)BcLogVerbose() )
LogMessage(
"sguil: sensor ID = %u\nsguil: last cid = %u\n",
*(unsigned __int16 *)(a1 + 24),
*(unsigned int *)(a1 + 28));
++*(_DWORD *)(a1 + 28);
}
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func16(__int64 a1)
{
const char **v1; // rbp
unsigned int v3; // [rsp+4h] [rbp-1024h] BYREF
const char **v4; // [rsp+8h] [rbp-1020h] BYREF
char v5[2048]; // [rsp+10h] [rbp-1018h] BYREF
char s[2072]; // [rsp+810h] [rbp-818h] BYREF

snprintf(s, 0x800uLL, "SidCidRequest %s", *(const char **)a1);
func13(a1, s);
memset(v5, 0, sizeof(v5));
if ( (unsigned int)func14(a1, (__int64)v5) == 1 )
{
func16(a1);
}
else
{
if ( (unsigned int)func1() )
LogMessage("sguil: received \"%s\"", v5);
v1 = (const char **)mSplit(v5, " ", 3LL, &v3, 0LL);
v4 = v1;
if ( !strcasecmp("SidCidResponse", *v1) )
{
*(_WORD *)(a1 + 24) = atoi(v1[1]);
*(_DWORD *)(a1 + 28) = atoi(v1[2]);
}
else
{
FatalError("sguil: Expected SidCidResponse and got '%s'\n", v5);
}
mSplitFree(&v4, v3);
if ( (unsigned int)func1() )
LogMessage(
"sguil: sensor ID = %u\nsguil: last cid = %u\n",
*(unsigned __int16 *)(a1 + 24),
*(unsigned int *)(a1 + 28));
++*(_DWORD *)(a1 + 28);
}
return 0LL;
}

original_code:
int SguilSensorAgentInit(SpoSguilData *ssd_data)
{
    char tmpSendMsg[2048];
    char tmpRecvMsg[2048];
    snprintf(tmpSendMsg, 2048, "SidCidRequest %s", ssd_data->sensor_name);
    SguilSendAgentMsg(ssd_data, tmpSendMsg);
    memset(tmpRecvMsg,0x0,2048);
    if ( SguilRecvAgentMsg(ssd_data, tmpRecvMsg) == 1 )
    {
        SguilSensorAgentInit(ssd_data);
    }
    else
    {
        char **toks;
        int num_toks;
        if (BcLogVerbose())
            LogMessage("sguil: received \"%s\"", tmpRecvMsg);
        toks = mSplit(tmpRecvMsg, " ", 3, &num_toks, 0);
        if ( strcasecmp("SidCidResponse", toks[0]) == 0 )
        {
            ssd_data->sensor_id = atoi(toks[1]);
            ssd_data->event_id = atoi(toks[2]);
        }
        else
        {
            FatalError("sguil: Expected SidCidResponse and got '%s'\n", tmpRecvMsg);
        }
        mSplitFree(&toks, num_toks);
        if (BcLogVerbose())
         LogMessage("sguil: sensor ID = %u\nsguil: last cid = %u\n",
     ssd_data->sensor_id, ssd_data->event_id);
        ssd_data->event_id++;
    }
    return 0;
}

canonical_original_code:
int SguilSensorAgentInit(struct _SpoSguilData *ssd_data)
{
    char tmpSendMsg[2048];
    char tmpRecvMsg[2048];
    snprintf(tmpSendMsg, 2048, "SidCidRequest %s", ssd_data->sensor_name);
    SguilSendAgentMsg(ssd_data, tmpSendMsg);
    memset(tmpRecvMsg,0x0,2048);
    if ( SguilRecvAgentMsg(ssd_data, tmpRecvMsg) == 1 )
    {
        SguilSensorAgentInit(ssd_data);
    }
    else
    {
        char **toks;
        int num_toks;
        if (BcLogVerbose())
            LogMessage("sguil: received \"%s\"", tmpRecvMsg);
        toks = mSplit(tmpRecvMsg, " ", 3, &num_toks, 0);
        if ( strcasecmp("SidCidResponse", toks[0]) == 0 )
        {
            ssd_data->sensor_id = atoi(toks[1]);
            ssd_data->event_id = atoi(toks[2]);
        }
        else
        {
            FatalError("sguil: Expected SidCidResponse and got '%s'\n", tmpRecvMsg);
        }
        mSplitFree(&toks, num_toks);
        if (BcLogVerbose())
         LogMessage("sguil: sensor ID = %u\nsguil: last cid = %u\n",
     ssd_data->sensor_id, ssd_data->event_id);
        ssd_data->event_id++;
    }
    return 0;
}

variable_types: struct _SpoSguilData { char *sensor_name; char *tag_path; char *passwd; unsigned int sensor_id; unsigned int event_id; unsigned int agent_port; int agent_sock; char *args; } *

variable_types:
tmpSendMsg
char [2048]


SguilInitFinalize

decompiled_code:
__int64 __fastcall SguilInitFinalize(__int64 a1, __int64 a2)
{
const char *v3; // rdi
__int64 v4; // rdi
const char *v5; // rax
const char *v6; // rax

if ( !a2 )
FatalError("sguil: data uninitialized\n");
ParseSguilArgs(a2);
if ( !*(_QWORD *)a2 )
{
v3 = *(const char **)(barnyard2_conf + 65600LL);
if ( !v3 )
v3 = "NULL";
v4 = GetUniqueName(v3);
v5 = (const char *)SnortStrdup(v4);
*(_QWORD *)a2 = v5;
if ( v5 )
{
v6 = &v5[strlen(v5) - 1];
if ( *v6 == 10 )
*v6 = 0;
}
}
if ( !(unsigned int)BcLogQuiet() )
{
LogMessage("sguil: sensor name = %s\n", *(const char **)a2);
LogMessage("sguil: agent port = %u\n", *(unsigned __int16 *)(a2 + 32));
}
SguilSensorAgentConnect(a2);
if ( (unsigned int)BcLogVerbose() )
LogMessage("sguil: Waiting for sid and cid from sensor_agent.\n");
SguilSensorAgentInit(a2);
AddFuncToOutputList(Sguil, 1LL, a2);
AddFuncToCleanExitList(SguilCleanExitFunc, a2);
return AddFuncToRestartList(SguilRestartFunc, a2);
}

canonical_decompiled_code:
__int64 __fastcall func17(__int64 a1, __int64 a2)
{
const char *v3; // rdi
__int64 v4; // rdi
const char *v5; // rax
const char *v6; // rax

if ( !a2 )
FatalError("sguil: data uninitialized\n");
func11(a2);
if ( !*(_QWORD *)a2 )
{
v3 = *(const char **)(barnyard2_conf + 65600LL);
if ( !v3 )
v3 = "NULL";
v4 = GetUniqueName(v3);
v5 = (const char *)SnortStrdup(v4);
*(_QWORD *)a2 = v5;
if ( v5 )
{
v6 = &v5[strlen(v5) - 1];
if ( *v6 == 10 )
*v6 = 0;
}
}
if ( !(unsigned int)func2() )
{
LogMessage("sguil: sensor name = %s\n", *(const char **)a2);
LogMessage("sguil: agent port = %u\n", *(unsigned __int16 *)(a2 + 32));
}
func12(a2);
if ( (unsigned int)func1() )
LogMessage("sguil: Waiting for sid and cid from sensor_agent.\n");
func16(a2);
AddFuncToOutputList(Sguil, 1LL, a2);
AddFuncToCleanExitList(SguilCleanExitFunc, a2);
return AddFuncToRestartList(SguilRestartFunc, a2);
}

original_code:
void SguilInitFinalize(int unused, void *arg)
{
 SpoSguilData *ssd_data = (SpoSguilData *)arg;
 if (!ssd_data)
 {
  FatalError("sguil:  data uninitialized\n");
 }
 ParseSguilArgs(ssd_data);
    if(ssd_data->sensor_name == ((void *)0))
    {
  ssd_data->sensor_name = SnortStrdup(GetUniqueName((barnyard2_conf->interface ? barnyard2_conf->interface : "NULL")));
         if(ssd_data->sensor_name)
         {
            if( ssd_data->sensor_name[strlen(ssd_data->sensor_name)-1] == '\n' )
            {
                ssd_data->sensor_name[strlen(ssd_data->sensor_name)-1] = '\0';
            }
   }
    }
 if (!BcLogQuiet())
    {
        LogMessage("sguil:  sensor name = %s\n", ssd_data->sensor_name);
        LogMessage("sguil:  agent port =  %u\n", ssd_data->agent_port);
    }
    SguilSensorAgentConnect(ssd_data);
    if(BcLogVerbose())
        LogMessage("sguil: Waiting for sid and cid from sensor_agent.\n");
    SguilSensorAgentInit(ssd_data);
    AddFuncToOutputList(Sguil, OUTPUT_TYPE__ALERT, ssd_data);
    AddFuncToCleanExitList(SguilCleanExitFunc, ssd_data);
    AddFuncToRestartList(SguilRestartFunc, ssd_data);
}

canonical_original_code:
void SguilInitFinalize(int unused, void *arg)
{
 struct _SpoSguilData *ssd_data = (SpoSguilData *)arg;
 if (!ssd_data)
 {
  FatalError("sguil:  data uninitialized\n");
 }
 ParseSguilArgs(ssd_data);
    if(ssd_data->sensor_name == ((void *)0))
    {
  ssd_data->sensor_name = SnortStrdup(GetUniqueName((barnyard2_conf->interface ? barnyard2_conf->interface : "NULL")));
         if(ssd_data->sensor_name)
         {
            if( ssd_data->sensor_name[strlen(ssd_data->sensor_name)-1] == '\n' )
            {
                ssd_data->sensor_name[strlen(ssd_data->sensor_name)-1] = '\0';
            }
   }
    }
 if (!BcLogQuiet())
    {
        LogMessage("sguil:  sensor name = %s\n", ssd_data->sensor_name);
        LogMessage("sguil:  agent port =  %u\n", ssd_data->agent_port);
    }
    SguilSensorAgentConnect(ssd_data);
    if(BcLogVerbose())
        LogMessage("sguil: Waiting for sid and cid from sensor_agent.\n");
    SguilSensorAgentInit(ssd_data);
    AddFuncToOutputList(Sguil, OUTPUT_TYPE__ALERT, ssd_data);
    AddFuncToCleanExitList(SguilCleanExitFunc, ssd_data);
    AddFuncToRestartList(SguilRestartFunc, ssd_data);
}

variable_types: unused int

variable_types:
arg
void *


SguilTimestamp

decompiled_code:
__int64 __fastcall SguilTimestamp(unsigned int a1)
{
__int64 v1; // rbx
struct tm *v2; // rax
time_t timer; // [rsp+8h] [rbp-10h] BYREF

timer = a1;
v1 = SnortAlloc(128LL);
if ( (unsigned int)BcOutputUseUtc() )
v2 = gmtime(&timer);
else
v2 = localtime(&timer);
SnortSnprintf(
v1,
128LL,
"%04i-%02i-%02i %02i:%02i:%02i",
(unsigned int)(v2->tm_year + 1900),
(unsigned int)(v2->tm_mon + 1),
(unsigned int)v2->tm_mday,
(unsigned int)v2->tm_hour,
(unsigned int)v2->tm_min,
(unsigned int)v2->tm_sec);
return v1;
}

canonical_decompiled_code:
__int64 __fastcall func18(unsigned int a1)
{
__int64 v1; // rbx
struct tm *v2; // rax
time_t timer; // [rsp+8h] [rbp-10h] BYREF

timer = a1;
v1 = SnortAlloc(128LL);
if ( (unsigned int)func3() )
v2 = gmtime(&timer);
else
v2 = localtime(&timer);
SnortSnprintf(
v1,
128LL,
"%04i-%02i-%02i %02i:%02i:%02i",
(unsigned int)(v2->tm_year + 1900),
(unsigned int)(v2->tm_mon + 1),
(unsigned int)v2->tm_mday,
(unsigned int)v2->tm_hour,
(unsigned int)v2->tm_min,
(unsigned int)v2->tm_sec);
return v1;
}

original_code:
char *SguilTimestamp(u_int32_t sec)
{
    struct tm *lt;
    char *buf;
    time_t Time = sec;
    buf = (char *)SnortAlloc(128 * sizeof(char));
 if (BcOutputUseUtc())
  lt = gmtime(&Time);
 else
  lt = localtime(&Time);
    SnortSnprintf(buf, 128, "%04i-%02i-%02i %02i:%02i:%02i",
     1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday,
     lt->tm_hour, lt->tm_min, lt->tm_sec);
  return buf;
}

canonical_original_code:
char *SguilTimestamp(unsigned int sec)
{
    struct tm *lt;
    char *buf;
    long Time = sec;
    buf = (char *)SnortAlloc(128 * sizeof(char));
 if (BcOutputUseUtc())
  lt = gmtime(&Time);
 else
  lt = localtime(&Time);
    SnortSnprintf(buf, 128, "%04i-%02i-%02i %02i:%02i:%02i",
     1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday,
     lt->tm_hour, lt->tm_min, lt->tm_sec);
  return buf;
}

variable_types:
sec
unsigned int

variable_types: struct tm { int tm_sec; int tm_min; int tm_hour; int tm_mday; int tm_mon; int tm_year; int tm_wday; int tm_yday; int tm_isdst; long tm_gmtoff; char *tm_zone; } *

variable_types:
buf
char *

variable_types: Time long

return_type: char *


BcTestMode

decompiled_code:
_BOOL8 BcTestMode()
{
return *barnyard2_conf == 4;
}

canonical_decompiled_code:
_BOOL8 func0()
{
return *barnyard2_conf == 4;
}

original_code:
static inline int BcTestMode(void)
{
    return barnyard2_conf->run_mode == RUN_MODE__TEST;
}

canonical_original_code:
static inline int BcTestMode()
{
    return barnyard2_conf->run_mode == RUN_MODE__TEST;
}


BcNoOutputTimestamp

decompiled_code:
__int64 BcNoOutputTimestamp()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x400;
}

canonical_decompiled_code:
__int64 func1()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x400;
}

original_code:
static inline int BcNoOutputTimestamp(void)
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__NO_TIMESTAMP;
}

canonical_original_code:
static inline int BcNoOutputTimestamp()
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__NO_TIMESTAMP;
}


BcLineBufferedLogging

decompiled_code:
__int64 BcLineBufferedLogging()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 1;
}

canonical_decompiled_code:
__int64 func2()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 1;
}

original_code:
static inline int BcLineBufferedLogging(void)
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__LINE_BUFFER;
}

canonical_original_code:
static inline int BcLineBufferedLogging()
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__LINE_BUFFER;
}


SpoLogTcpdumpRestartFunc

decompiled_code:
void __fastcall SpoLogTcpdumpRestartFunc(__int64 a1, __int64 a2)
{
SpoLogTcpdumpCleanup(a1, a2, "SpoLogTcpdumpRestartFunc");
}

canonical_decompiled_code:
void __fastcall func5(__int64 a1, __int64 a2)
{
func4(a1, a2, "SpoLogTcpdumpRestartFunc");
}

original_code:
static void SpoLogTcpdumpRestartFunc(int signal, void *arg)
{
    SpoLogTcpdumpCleanup(signal, arg, "SpoLogTcpdumpRestartFunc");
}

variable_types: signal int


SpoLogTcpdumpCleanExitFunc

decompiled_code:
void __fastcall SpoLogTcpdumpCleanExitFunc(__int64 a1, __int64 a2)
{
SpoLogTcpdumpCleanup(a1, a2, "SpoLogTcpdumpCleanExitFunc");
}

canonical_decompiled_code:
void __fastcall func6(__int64 a1, __int64 a2)
{
func4(a1, a2, "SpoLogTcpdumpCleanExitFunc");
}

original_code:
static void SpoLogTcpdumpCleanExitFunc(int signal, void *arg)
{
    SpoLogTcpdumpCleanup(signal, arg, "SpoLogTcpdumpCleanExitFunc");
}


LogTcpdump

decompiled_code:
int __fastcall LogTcpdump(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
int result; // eax

if ( a1 )
{
if ( (*(_BYTE *)(a1 + 816) & 2) != 0 )
result = LogTcpdumpStream(a1, a2, a3, a4);
else
result = LogTcpdumpSingle((__int64 *)a1, a2, a3, a4);
}
return result;
}

canonical_decompiled_code:
int __fastcall func12(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
int result; // eax

if ( a1 )
{
if ( (*(_BYTE *)(a1 + 816) & 2) != 0 )
result = func9(a1, a2, a3, a4);
else
result = func11((__int64 *)a1, a2, a3, a4);
}
return result;
}

original_code:
static void LogTcpdump(Packet *p, void *event, uint32_t event_type, void *arg)
{
    if(p)
    {
        if(p->packet_flags & 0x00000002)
        {
            LogTcpdumpStream(p, event, event_type, arg);
        }
        else
        {
            LogTcpdumpSingle(p, event, event_type, arg);
        }
    }
}

canonical_original_code:
static void LogTcpdump(struct _Packet *p, void *event, unsigned int event_type, void *arg)
{
    if(p)
    {
        if(p->packet_flags & 0x00000002)
        {
            LogTcpdumpStream(p, event, event_type, arg);
        }
        else
        {
            LogTcpdumpSingle(p, event, event_type, arg);
        }
    }
}

variable_types: struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *

variable_types:
event
void *


LogTcpdumpSetup

decompiled_code:
__int64 LogTcpdumpSetup()
{
RegisterOutputPlugin("log_tcpdump", 2LL, LogTcpdumpInit);
DebugMessageFile = "spo_log_tcpdump.c";
DebugMessageLine = 137;
return DebugMessageFunc(1LL, "Output plugin: Log-Tcpdump is setup...\n");
}

canonical_decompiled_code:
__int64 func15()
{
RegisterOutputPlugin("log_tcpdump", 2LL, LogTcpdumpInit);
DebugMessageFile = "spo_log_tcpdump.c";
DebugMessageLine = 137;
return DebugMessageFunc(1LL, "Output plugin: Log-Tcpdump is setup...\n");
}

original_code:
void LogTcpdumpSetup(void)
{
    RegisterOutputPlugin("log_tcpdump", OUTPUT_TYPE_FLAG__LOG, LogTcpdumpInit);
    DebugMessageFile = "spo_log_tcpdump.c"; DebugMessageLine = 137; DebugMessageFunc(0x00000001,"Output plugin: Log-Tcpdump is setup...\n");;
}

canonical_original_code:
void LogTcpdumpSetup()
{
    RegisterOutputPlugin("log_tcpdump", OUTPUT_TYPE_FLAG__LOG, LogTcpdumpInit);
    DebugMessageFile = "spo_log_tcpdump.c"; DebugMessageLine = 137; DebugMessageFunc(0x00000001,"Output plugin: Log-Tcpdump is setup...\n");;
}


LogTcpdumpReset

decompiled_code:
time_t LogTcpdumpReset()
{
return TcpdumpRollLogFile(log_tcpdump_ptr);
}

canonical_decompiled_code:
time_t func16()
{
return func8(log_tcpdump_ptr);
}

original_code:
void LogTcpdumpReset(void)
{
    TcpdumpRollLogFile(log_tcpdump_ptr);
}

canonical_original_code:
void LogTcpdumpReset()
{
    TcpdumpRollLogFile(log_tcpdump_ptr);
}


DirectLogTcpdump

decompiled_code:
__int64 __fastcall DirectLogTcpdump(__int64 a1, __int64 a2)
{
__int64 v2; // rbx
__int64 result; // rax

v2 = SizeOf(a1);
if ( (unsigned __int64)(*(_QWORD *)(log_tcpdump_ptr + 32) + v2) > *(_QWORD *)(log_tcpdump_ptr + 40) )
TcpdumpRollLogFile(log_tcpdump_ptr);
++pc[37];
pcap_dump(*(_QWORD *)(log_tcpdump_ptr + 16), a1, a2);
result = log_tcpdump_ptr;
*(_QWORD *)(log_tcpdump_ptr + 32) += v2;
return result;
}

canonical_decompiled_code:
__int64 __fastcall func17(__int64 a1, __int64 a2)
{
__int64 v2; // rbx
__int64 result; // rax

v2 = func3(a1);
if ( (unsigned __int64)(*(_QWORD *)(log_tcpdump_ptr + 32) + v2) > *(_QWORD *)(log_tcpdump_ptr + 40) )
func8(log_tcpdump_ptr);
++pc[37];
pcap_dump(*(_QWORD *)(log_tcpdump_ptr + 16), a1, a2);
result = log_tcpdump_ptr;
*(_QWORD *)(log_tcpdump_ptr + 32) += v2;
return result;
}

original_code:
void DirectLogTcpdump(struct pcap_pkthdr *ph, uint8_t *pkt)
{
    size_t dumpSize = SizeOf(ph);
    if ( log_tcpdump_ptr->size + dumpSize > log_tcpdump_ptr->limit )
        TcpdumpRollLogFile(log_tcpdump_ptr);
    pc.log_pkts++;
    pcap_dump((u_char *)log_tcpdump_ptr->dumpd, ph, pkt);
    log_tcpdump_ptr->size += dumpSize;
}

canonical_original_code:
void DirectLogTcpdump(struct pcap_pkthdr *ph, unsigned char *pkt)
{
    unsigned long dumpSize = SizeOf(ph);
    if ( log_tcpdump_ptr->size + dumpSize > log_tcpdump_ptr->limit )
        TcpdumpRollLogFile(log_tcpdump_ptr);
    pc.log_pkts++;
    pcap_dump((unsigned char *)log_tcpdump_ptr->dumpd, ph, pkt);
    log_tcpdump_ptr->size += dumpSize;
}

variable_types: struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *

variable_types:
pkt
unsigned char *

variable_types:
dumpSize
unsigned long


BcDaemonMode

decompiled_code:
__int64 BcDaemonMode()
{
return *(_DWORD *)(barnyard2_conf + 8LL) & 2;
}

canonical_decompiled_code:
__int64 func0()
{
return *(_DWORD *)(barnyard2_conf + 8LL) & 2;
}

original_code:
static inline int BcDaemonMode(void)
{
    return barnyard2_conf->run_flags & RUN_FLAG__DAEMON;
}

canonical_original_code:
static inline int BcDaemonMode()
{
    return barnyard2_conf->run_flags & RUN_FLAG__DAEMON;
}