AlertUnixSock

decompiled_code:
ssize_t __fastcall AlertUnixSock(__int64 a1, unsigned int *a2)
{
unsigned int v3; // edx
__int64 v4; // rsi
unsigned int v5; // eax
__int64 v6; // rax
const char *v7; // rbp
size_t v8; // rax
size_t v9; // rdx
__int64 v10; // rdx
__int64 v11; // rdx
__int64 v12; // rcx
char v13; // dl
__int64 v14; // rax
__int64 v15; // rdx
__int64 v17; // rax

DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 177;
DebugMessageFunc(32LL, "Logging Alert data!\n");
memset(&alertpkt_0, 0, 0x740uLL);
if ( a2 )
memmove(&unk_C38, a2, 0x24uLL);
if ( a1 && *(_QWORD *)(a1 + 8) )
{
memmove(&unk_620, *(const void **)a1, 0x18uLL);
v3 = 1514;
if ( (unsigned int)n <= 0x5EA )
v3 = n;
memmove(&unk_64C, *(const void **)(a1 + 8), v3);
}
else
{
dword_648 = 1;
}
v4 = (unsigned int)_bswap_32(a2[4]);
v5 = _bswap_32(a2[5]);
v6 = GetSigByGidSid(v5, v4);
if ( v6 )
{
v7 = *(const char **)(v6 + 32);
v8 = strlen(v7);
v9 = 255LL;
if ( v8 <= 0xFF )
v9 = v8;
memmove(&alertpkt_0, v7, v9);
}
if ( (dword_648 & 1) == 0 && a1 )
{
v10 = *(_QWORD *)(a1 + 24);
if ( v10 )
dword_638 = v10 - *(_DWORD *)(a1 + 8);
v11 = *(_QWORD *)(a1 + 72);
if ( !v11 )
goto LABEL_23;
v12 = *(_QWORD *)(a1 + 8);
if ( !v12 )
return sendto(alertsd, &alertpkt_0, 0x740uLL, 0, &alertaddr, 0x6Eu);
dword_63C = v11 - v12;
v13 = *(_BYTE *)(*(_QWORD *)(a1 + 72) + 9LL);
switch ( v13 )
{
case 6:
v17 = *(_QWORD *)(a1 + 104);
if ( !v17 )
goto LABEL_23;
break;
case 17:
v17 = *(_QWORD *)(a1 + 120);
if ( !v17 )
goto LABEL_23;
break;
case 1:
v17 = *(_QWORD *)(a1 + 136);
if ( !v17 )
goto LABEL_23;
break;
default:
dword_648 |= 2u;
LABEL_23:
v14 = *(_QWORD *)(a1 + 152);
if ( v14 )
{
v15 = *(_QWORD *)(a1 + 8);
if ( v15 )
dword_644 = v14 - v15;
}
return sendto(alertsd, &alertpkt_0, 0x740uLL, 0, &alertaddr, 0x6Eu);
}
dword_640 = v17 - *(_DWORD *)(a1 + 8);
goto LABEL_23;
}
return sendto(alertsd, &alertpkt_0, 0x740uLL, 0, &alertaddr, 0x6Eu);
}

canonical_decompiled_code:
ssize_t __fastcall func1(__int64 a1, unsigned int *a2)
{
unsigned int v3; // edx
__int64 v4; // rsi
unsigned int v5; // eax
__int64 v6; // rax
const char *v7; // rbp
size_t v8; // rax
size_t v9; // rdx
__int64 v10; // rdx
__int64 v11; // rdx
__int64 v12; // rcx
char v13; // dl
__int64 v14; // rax
__int64 v15; // rdx
__int64 v17; // rax

DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 177;
DebugMessageFunc(32LL, "Logging Alert data!\n");
memset(&alertpkt_0, 0, 0x740uLL);
if ( a2 )
memmove(&unk_C38, a2, 0x24uLL);
if ( a1 && *(_QWORD *)(a1 + 8) )
{
memmove(&unk_620, *(const void **)a1, 0x18uLL);
v3 = 1514;
if ( (unsigned int)n <= 0x5EA )
v3 = n;
memmove(&unk_64C, *(const void **)(a1 + 8), v3);
}
else
{
dword_648 = 1;
}
v4 = (unsigned int)func0(a2[4]);
v5 = func0(a2[5]);
v6 = GetSigByGidSid(v5, v4);
if ( v6 )
{
v7 = *(const char **)(v6 + 32);
v8 = strlen(v7);
v9 = 255LL;
if ( v8 <= 0xFF )
v9 = v8;
memmove(&alertpkt_0, v7, v9);
}
if ( (dword_648 & 1) == 0 && a1 )
{
v10 = *(_QWORD *)(a1 + 24);
if ( v10 )
dword_638 = v10 - *(_DWORD *)(a1 + 8);
v11 = *(_QWORD *)(a1 + 72);
if ( !v11 )
goto LABEL_23;
v12 = *(_QWORD *)(a1 + 8);
if ( !v12 )
return sendto(alertsd, &alertpkt_0, 0x740uLL, 0, &alertaddr, 0x6Eu);
dword_63C = v11 - v12;
v13 = *(_BYTE *)(*(_QWORD *)(a1 + 72) + 9LL);
switch ( v13 )
{
case 6:
v17 = *(_QWORD *)(a1 + 104);
if ( !v17 )
goto LABEL_23;
break;
case 17:
v17 = *(_QWORD *)(a1 + 120);
if ( !v17 )
goto LABEL_23;
break;
case 1:
v17 = *(_QWORD *)(a1 + 136);
if ( !v17 )
goto LABEL_23;
break;
default:
dword_648 |= 2u;
LABEL_23:
v14 = *(_QWORD *)(a1 + 152);
if ( v14 )
{
v15 = *(_QWORD *)(a1 + 8);
if ( v15 )
dword_644 = v14 - v15;
}
return sendto(alertsd, &alertpkt_0, 0x740uLL, 0, &alertaddr, 0x6Eu);
}
dword_640 = v17 - *(_DWORD *)(a1 + 8);
goto LABEL_23;
}
return sendto(alertsd, &alertpkt_0, 0x740uLL, 0, &alertaddr, 0x6Eu);
}

original_code:
void AlertUnixSock(Packet *p, void *event, uint32_t event_type, void *arg)
{
    static Alertpkt alertpkt;
 SigNode *sn;
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 177; DebugMessageFunc(0x00000020, "Logging Alert data!\n");;
    bzero((char *)&alertpkt,sizeof(alertpkt));
    if (event)
    {
        bcopy((const void *)event,(void *)&alertpkt.event,sizeof(Unified2EventCommon));
    }
    if(p && p->pkt)
    {
        bcopy((const void *)p->pkth,(void *)&alertpkt.pkth,sizeof(struct pcap_pkthdr));
        bcopy((const void *)p->pkt,alertpkt.pkt,
              alertpkt.pkth.caplen > 1514? 1514 : alertpkt.pkth.caplen);
    }
    else
        alertpkt.val|=0x1;
 sn = GetSigByGidSid(ntohl(((Unified2EventCommon *)event)->generator_id),
      ntohl(((Unified2EventCommon *)event)->signature_id));
    if (sn != ((void *)0))
    {
        bcopy((const void *)sn->msg,(void *)alertpkt.alertmsg,
               strlen(sn->msg)>256 -1 ? 256 - 1 : strlen(sn->msg));
    }
    if(!(alertpkt.val & 0x1))
    {
        if(p)
        {
            if (p->eh)
            {
                alertpkt.dlthdr=(char *)p->eh-(char *)p->pkt;
            }
            if (p->iph && p->pkt)
            {
                alertpkt.nethdr=(char *)p->iph-(char *)p->pkt;
                switch(p->iph->ip_proto)
                {
                    case IPPROTO_TCP:
                       if (p->tcph)
                       {
                           alertpkt.transhdr=(char *)p->tcph-(char *)p->pkt;
                       }
                       break;
                    case IPPROTO_UDP:
                        if (p->udph)
                        {
                            alertpkt.transhdr=(char *)p->udph-(char *)p->pkt;
                        }
                        break;
                    case IPPROTO_ICMP:
                       if (p->icmph)
                       {
                           alertpkt.transhdr=(char *)p->icmph-(char *)p->pkt;
                       }
                       break;
                    default:
                        alertpkt.val|=0x2;
                        break;
                }
            }
            if (p->data && p->pkt) alertpkt.data=p->data - p->pkt;
        }
    }
    if(sendto(alertsd,(const void *)&alertpkt,sizeof(Alertpkt),
              0,(struct sockaddr *)&alertaddr,sizeof(alertaddr))==-1)
    {
    }
}

canonical_original_code:
void AlertUnixSock(struct _Packet *p, void *event, unsigned int event_type, void *arg)
{
    static struct _Alertpkt alertpkt;
 struct _SigNode *sn;
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 177; DebugMessageFunc(0x00000020, "Logging Alert data!\n");;
    bzero((char *)&alertpkt,sizeof(alertpkt));
    if (event)
    {
        bcopy((void *)event,(void *)&alertpkt.event,sizeof(Unified2EventCommon));
    }
    if(p && p->pkt)
    {
        bcopy((void *)p->pkth,(void *)&alertpkt.pkth,sizeof(struct pcap_pkthdr));
        bcopy((void *)p->pkt,alertpkt.pkt,
              alertpkt.pkth.caplen > 1514? 1514 : alertpkt.pkth.caplen);
    }
    else
        alertpkt.val|=0x1;
 sn = GetSigByGidSid(ntohl(((struct _Unified2EventCommon *)event)->generator_id),
      ntohl(((struct _Unified2EventCommon *)event)->signature_id));
    if (sn != ((void *)0))
    {
        bcopy((void *)sn->msg,(void *)alertpkt.alertmsg,
               strlen(sn->msg)>256 -1 ? 256 - 1 : strlen(sn->msg));
    }
    if(!(alertpkt.val & 0x1))
    {
        if(p)
        {
            if (p->eh)
            {
                alertpkt.dlthdr=(char *)p->eh-(char *)p->pkt;
            }
            if (p->iph && p->pkt)
            {
                alertpkt.nethdr=(char *)p->iph-(char *)p->pkt;
                switch(p->iph->ip_proto)
                {
                    case IPPROTO_TCP:
                       if (p->tcph)
                       {
                           alertpkt.transhdr=(char *)p->tcph-(char *)p->pkt;
                       }
                       break;
                    case IPPROTO_UDP:
                        if (p->udph)
                        {
                            alertpkt.transhdr=(char *)p->udph-(char *)p->pkt;
                        }
                        break;
                    case IPPROTO_ICMP:
                       if (p->icmph)
                       {
                           alertpkt.transhdr=(char *)p->icmph-(char *)p->pkt;
                       }
                       break;
                    default:
                        alertpkt.val|=0x2;
                        break;
                }
            }
            if (p->data && p->pkt) alertpkt.data=p->data - p->pkt;
        }
    }
    if(sendto(alertsd,(void *)&alertpkt,sizeof(Alertpkt),
              0,(struct sockaddr *)&alertaddr,sizeof(alertaddr))==-1)
    {
    }
}

variable_types: struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *

variable_types:
event
void *

variable_types:
arg
void *

variable_types: struct _Alertpkt { unsigned char alertmsg[256]; struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } pkth; unsigned int dlthdr; unsigned int nethdr; unsigned int transhdr; unsigned int data; unsigned int val; unsigned char pkt[1514]; struct _Unified2EventCommon { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int event_microsecond; unsigned int signature_id; unsigned int generator_id; unsigned int signature_revision; unsigned int classification_id; unsigned int priority_id; } event; }

variable_types: struct _SigNode { unsigned int generator; unsigned int id; unsigned int rev; unsigned int class_id; struct _ClassType { char *type; unsigned int id; char *name; unsigned int priority; struct _ClassType *next; } *classType; unsigned int priority; char *msg; struct _ReferenceNode { char *id; struct _ReferenceSystemNode { char *name; char *url; struct _ReferenceSystemNode *next; } *system; struct _ReferenceNode *next; } *refs; struct _SigNode *next; } *

user_defined_types: struct _Alertpkt { unsigned char alertmsg[256]; struct pcap_pkthdr pkth; unsigned int dlthdr; unsigned int nethdr; unsigned int transhdr; unsigned int data; unsigned int val; unsigned char pkt[1514]; struct _Unified2EventCommon event; }

user_defined_types: struct _SigNode { unsigned int generator; unsigned int id; unsigned int rev; unsigned int class_id; struct _ClassType *classType; unsigned int priority; char *msg; struct _ReferenceNode *refs; struct _SigNode *next; }

user_defined_types: struct sockaddr { unsigned short sa_family; char sa_data[14]; }

user_defined_types: struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ReferenceNode { char *id; struct _ReferenceSystemNode *system; struct _ReferenceNode *next; }


AlertUnixSockSetup

decompiled_code:
__int64 AlertUnixSockSetup()
{
RegisterOutputPlugin("alert_unixsock", 1LL, AlertUnixSockInit);
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 111;
return DebugMessageFunc(1LL, "Output plugin: AlertUnixSock is setup...\n");
}

canonical_decompiled_code:
__int64 func2()
{
RegisterOutputPlugin("alert_unixsock", 1LL, AlertUnixSockInit);
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 111;
return DebugMessageFunc(1LL, "Output plugin: AlertUnixSock is setup...\n");
}

original_code:
void AlertUnixSockSetup(void)
{
    RegisterOutputPlugin("alert_unixsock", OUTPUT_TYPE_FLAG__ALERT, AlertUnixSockInit);
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 111; DebugMessageFunc(0x00000001, "Output plugin: AlertUnixSock is setup...\n");;
}

canonical_original_code:
void AlertUnixSockSetup()
{
    RegisterOutputPlugin("alert_unixsock", OUTPUT_TYPE_FLAG__ALERT, AlertUnixSockInit);
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 111; DebugMessageFunc(0x00000001, "Output plugin: AlertUnixSock is setup...\n");;
}

return_type: void


OpenAlertSock

decompiled_code:
int OpenAlertSock()
{
const char *v0; // rcx
int result; // eax
int *v2; // rax
char *v3; // rax
char v4[1032]; // [rsp+0h] [rbp-408h] BYREF

v0 = *(const char **)(barnyard2_conf + 65656LL);
if ( !v0 )
v0 = (const char *)&unk_C9D;
SnortSnprintf(v4, 1024LL, "%s%s/%s", v0, *(const char **)(barnyard2_conf + 65640LL), "barnyard2_alert");
if ( access(v4, 2) )
ErrorMessage("%s file doesn't exist or isn't writable!\n", v4);
strncpy((char *)(unsigned int)((_DWORD)&alertaddr + 2), v4, 0x6CuLL);
alertaddr.sa_family = 1;
result = socket(1, 2, 0);
alertsd = result;
if ( result < 0 )
{
v2 = _errno_location();
v3 = strerror(*v2);
result = FatalError("socket() call failed: %s", v3);
}
return result;
}

canonical_decompiled_code:
int func3()
{
const char *v0; // rcx
int result; // eax
int *v2; // rax
char *v3; // rax
char v4[1032]; // [rsp+0h] [rbp-408h] BYREF

v0 = *(const char **)(barnyard2_conf + 65656LL);
if ( !v0 )
v0 = (const char *)&unk_C9D;
SnortSnprintf(v4, 1024LL, "%s%s/%s", v0, *(const char **)(barnyard2_conf + 65640LL), "barnyard2_alert");
if ( access(v4, 2) )
ErrorMessage("%s file doesn't exist or isn't writable!\n", v4);
strncpy((char *)(unsigned int)((_DWORD)&alertaddr + 2), v4, 0x6CuLL);
alertaddr.sa_family = 1;
result = socket(1, 2, 0);
alertsd = result;
if ( result < 0 )
{
v2 = _errno_location();
v3 = strerror(*v2);
result = FatalError("socket() call failed: %s", v3);
}
return result;
}

original_code:
void OpenAlertSock(void)
{
    char srv[1024];
    SnortSnprintf(srv, 1024, "%s%s/%s",
                  barnyard2_conf->chroot_dir == ((void *)0) ? "" : barnyard2_conf->chroot_dir,
                  barnyard2_conf->log_dir, "barnyard2_alert");
    if(access(srv, 2))
    {
       ErrorMessage("%s file doesn't exist or isn't writable!\n",
            srv);
    }
    bzero((char *) &alertaddr, sizeof(alertaddr));
    strncpy(alertaddr.sun_path, srv, 108);
    alertaddr.sun_family = 1;
    if((alertsd = socket(1, SOCK_DGRAM, 0)) < 0)
    {
        FatalError("socket() call failed: %s", strerror((*__errno_location ())));
    }
}

canonical_original_code:
void OpenAlertSock()
{
    char srv[1024];
    SnortSnprintf(srv, 1024, "%s%s/%s",
                  barnyard2_conf->chroot_dir == ((void *)0) ? "" : barnyard2_conf->chroot_dir,
                  barnyard2_conf->log_dir, "barnyard2_alert");
    if(access(srv, 2))
    {
       ErrorMessage("%s file doesn't exist or isn't writable!\n",
            srv);
    }
    bzero((char *) &alertaddr, sizeof(alertaddr));
    strncpy(alertaddr.sun_path, srv, 108);
    alertaddr.sun_family = 1;
    if((alertsd = socket(1, SOCK_DGRAM, 0)) < 0)
    {
        FatalError("socket() call failed: %s", strerror((*__errno_location ())));
    }
}

variable_types:
srv
char [1024]


ParseAlertUnixSockArgs

decompiled_code:
int __fastcall ParseAlertUnixSockArgs(const char *a1)
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 157;
DebugMessageFunc(32LL, "ParseAlertUnixSockArgs: %s\n", a1);
return OpenAlertSock();
}

canonical_decompiled_code:
int __fastcall func4(const char *a1)
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 157;
DebugMessageFunc(32LL, "ParseAlertUnixSockArgs: %s\n", a1);
return func3();
}

original_code:
void ParseAlertUnixSockArgs(char *args)
{
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 157; DebugMessageFunc(0x00000020,"ParseAlertUnixSockArgs: %s\n", args);;
    OpenAlertSock();
}

variable_types:
args
char *


AlertUnixSockInit

decompiled_code:
__int64 __fastcall AlertUnixSockInit(const char *a1)
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 128;
DebugMessageFunc(1LL, "Output: AlertUnixSock Initialized\n");
ParseAlertUnixSockArgs(a1);
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 133;
DebugMessageFunc(1LL, "Linking UnixSockAlert functions to call lists...\n");
AddFuncToOutputList(AlertUnixSock, 1LL, 0LL);
AddFuncToCleanExitList(AlertUnixSockCleanExit, 0LL);
return AddFuncToRestartList(AlertUnixSockRestart, 0LL);
}

canonical_decompiled_code:
__int64 __fastcall func5(const char *a1)
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 128;
DebugMessageFunc(1LL, "Output: AlertUnixSock Initialized\n");
func4(a1);
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 133;
DebugMessageFunc(1LL, "Linking UnixSockAlert functions to call lists...\n");
AddFuncToOutputList(AlertUnixSock, 1LL, 0LL);
AddFuncToCleanExitList(AlertUnixSockCleanExit, 0LL);
return AddFuncToRestartList(AlertUnixSockRestart, 0LL);
}

original_code:
void AlertUnixSockInit(char *args)
{
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 128; DebugMessageFunc(0x00000001,"Output: AlertUnixSock Initialized\n");;
    ParseAlertUnixSockArgs(args);
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 133; DebugMessageFunc(0x00000001,"Linking UnixSockAlert functions to call lists...\n");;
    AddFuncToOutputList(AlertUnixSock, OUTPUT_TYPE__ALERT, ((void *)0));
    AddFuncToCleanExitList(AlertUnixSockCleanExit, ((void *)0));
    AddFuncToRestartList(AlertUnixSockRestart, ((void *)0));
}


CloseAlertSock

decompiled_code:
int CloseAlertSock()
{
int result; // eax

if ( alertsd >= 0 )
result = close(alertsd);
return result;
}

canonical_decompiled_code:
int func6()
{
int result; // eax

if ( alertsd >= 0 )
result = close(alertsd);
return result;
}

original_code:
void CloseAlertSock(void)
{
    if(alertsd >= 0) {
        close(alertsd);
    }
}

canonical_original_code:
void CloseAlertSock()
{
    if(alertsd >= 0) {
        close(alertsd);
    }
}


AlertUnixSockCleanExit

decompiled_code:
int AlertUnixSockCleanExit()
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 303;
DebugMessageFunc(32LL, "AlertUnixSockCleanExitFunc\n");
return CloseAlertSock();
}

canonical_decompiled_code:
int func7()
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 303;
DebugMessageFunc(32LL, "AlertUnixSockCleanExitFunc\n");
return func6();
}

original_code:
void AlertUnixSockCleanExit(int signal, void *arg)
{
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 303; DebugMessageFunc(0x00000020,"AlertUnixSockCleanExitFunc\n");;
    CloseAlertSock();
}

variable_types: signal int


AlertUnixSockRestart

decompiled_code:
int AlertUnixSockRestart()
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 309;
DebugMessageFunc(32LL, "AlertUnixSockRestartFunc\n");
return CloseAlertSock();
}

canonical_decompiled_code:
int func8()
{
DebugMessageFile = "spo_alert_unixsock.c";
DebugMessageLine = 309;
DebugMessageFunc(32LL, "AlertUnixSockRestartFunc\n");
return func6();
}

original_code:
void AlertUnixSockRestart(int signal, void *arg)
{
    DebugMessageFile = "spo_alert_unixsock.c"; DebugMessageLine = 309; DebugMessageFunc(0x00000020,"AlertUnixSockRestartFunc\n");;
    CloseAlertSock();
}


AlertArubaActionCleanExitFunc

decompiled_code:
void __fastcall AlertArubaActionCleanExitFunc(__int64 a1, void **a2)
{
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 640;
DebugMessageFunc(32LL, "AlertArubaActionCleanExitFunc\n");
free(*a2);
free(a2[2]);
free(a2);
}

canonical_decompiled_code:
void __fastcall func0(__int64 a1, void **a2)
{
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 640;
DebugMessageFunc(32LL, "AlertArubaActionCleanExitFunc\n");
free(*a2);
free(a2[2]);
free(a2);
}

original_code:
void AlertArubaActionCleanExitFunc(int signal, void *arg)
{
 SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 640; DebugMessageFunc(0x00000020,"AlertArubaActionCleanExitFunc\n");;
 free(data->secret);
 free(data->role_name);
 free(data);
}

canonical_original_code:
void AlertArubaActionCleanExitFunc(int signal, void *arg)
{
 struct _SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 640; DebugMessageFunc(0x00000020,"AlertArubaActionCleanExitFunc\n");;
 free(data->secret);
 free(data->role_name);
 free(data);
}

variable_types: struct _SpoAlertArubaActionData { char *secret; unsigned char secret_type; unsigned char action_type; char *role_name; struct in_addr { unsigned int s_addr; } aswitch; int fd; } *

user_defined_types: struct _SpoAlertArubaActionData { char *secret; unsigned char secret_type; unsigned char action_type; char *role_name; struct in_addr aswitch; int fd; }


AlertArubaActionRestartFunc

decompiled_code:
void __fastcall AlertArubaActionRestartFunc(__int64 a1, void **a2)
{
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 650;
DebugMessageFunc(32LL, "AlertArubaActionRestartFunc\n");
free(*a2);
free(a2[2]);
free(a2);
}

canonical_decompiled_code:
void __fastcall func1(__int64 a1, void **a2)
{
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 650;
DebugMessageFunc(32LL, "AlertArubaActionRestartFunc\n");
free(*a2);
free(a2[2]);
free(a2);
}

original_code:
void AlertArubaActionRestartFunc(int signal, void *arg)
{
 SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 650; DebugMessageFunc(0x00000020,"AlertArubaActionRestartFunc\n");;
 free(data->secret);
 free(data->role_name);
 free(data);
}

canonical_original_code:
void AlertArubaActionRestartFunc(int signal, void *arg)
{
 struct _SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 650; DebugMessageFunc(0x00000020,"AlertArubaActionRestartFunc\n");;
 free(data->secret);
 free(data->role_name);
 free(data);
}


AlertArubaActionSetup

decompiled_code:
__int64 AlertArubaActionSetup()
{
RegisterOutputPlugin("alert_aruba_action", 1LL, AlertArubaActionInit);
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 184;
return DebugMessageFunc(1LL, "Output plugin: AlertArubaAction is setup...\n");
}

canonical_decompiled_code:
__int64 func3()
{
RegisterOutputPlugin("alert_aruba_action", 1LL, AlertArubaActionInit);
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 184;
return DebugMessageFunc(1LL, "Output plugin: AlertArubaAction is setup...\n");
}

original_code:
void AlertArubaActionSetup(void)
{
    RegisterOutputPlugin("alert_aruba_action", OUTPUT_TYPE_FLAG__ALERT,
                         AlertArubaActionInit);
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 184; DebugMessageFunc(0x00000001,"Output plugin: AlertArubaAction is " "setup...\n");;
}

canonical_original_code:
void AlertArubaActionSetup()
{
    RegisterOutputPlugin("alert_aruba_action", OUTPUT_TYPE_FLAG__ALERT,
                         AlertArubaActionInit);
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 184; DebugMessageFunc(0x00000001,"Output plugin: AlertArubaAction is " "setup...\n");;
}


ArubaSwitchSend

decompiled_code:
ssize_t __fastcall ArubaSwitchSend(__int64 a1, const void *a2, int a3)
{
return write(*(_DWORD *)(a1 + 28), a2, a3);
}

canonical_decompiled_code:
ssize_t __fastcall func4(__int64 a1, const void *a2, int a3)
{
return write(*(_DWORD *)(a1 + 28), a2, a3);
}

original_code:
int ArubaSwitchSend(SpoAlertArubaActionData *data, uint8_t *post, int len)
{
 return(write(data->fd, post, len));
}

canonical_original_code:
int ArubaSwitchSend(struct _SpoAlertArubaActionData *data, unsigned char *post, int len)
{
 return(write(data->fd, post, len));
}

variable_types:
post
unsigned char *

variable_types: len int

return_type: int


ArubaSwitchRecv

decompiled_code:
ssize_t __fastcall ArubaSwitchRecv(__int64 a1, void *a2, int a3)
{
return read(*(_DWORD *)(a1 + 28), a2, a3);
}

canonical_decompiled_code:
ssize_t __fastcall func5(__int64 a1, void *a2, int a3)
{
return read(*(_DWORD *)(a1 + 28), a2, a3);
}

original_code:
int ArubaSwitchRecv(SpoAlertArubaActionData *data, uint8_t *recv, int maxlen)
{
 return(read(data->fd, recv, maxlen));
}

canonical_original_code:
int ArubaSwitchRecv(struct _SpoAlertArubaActionData *data, unsigned char *recv, int maxlen)
{
 return(read(data->fd, recv, maxlen));
}

variable_types:
recv
unsigned char *

variable_types: maxlen int


ArubaSwitchConnect

decompiled_code:
__int64 __fastcall ArubaSwitchConnect(__int64 a1)
{
int v2; // eax
__int64 v3; // rdi
int v4; // eax
__int16 v5; // bp
socklen_t v6; // edx
__m128i v7; // xmm0
int v8; // edi
__int64 result; // rax
struct sockaddr v10; // [rsp+0h] [rbp-48h] BYREF
struct sockaddr addr[3]; // [rsp+10h] [rbp-38h] BYREF

v2 = socket(2, 1, 0);
*(_DWORD *)(a1 + 28) = v2;
if ( v2 < 0 )
{
ErrorMessage("aruba_action: socket error\n");
result = 0xFFFFFFFFLL;
}
else
{
v3 = (unsigned int)v2;
v4 = *(_DWORD *)(a1 + 24);
v10.sa_family = 2;
*(_DWORD *)&v10.sa_data[2] = v4;
*(_WORD *)v10.sa_data = _bswap_16_constprop_0(v3, &v10, 16LL);
v5 = *(_WORD *)v10.sa_data;
if ( connect(v3, &v10, v6) < 0
|| (v7 = _mm_loadu_si128((const __m128i *)(a1 + 24)),
v8 = *(_DWORD *)(a1 + 28),
addr[0].sa_family = 10,
*(_WORD *)addr[0].sa_data = v5,
*(struct sockaddr *)&addr[0].sa_data[6] = (struct sockaddr)v7,
connect(v8, addr, 0x1Cu) < 0) )
{
perror("connect");
ErrorMessage("aruba_action: Unable to connect to switch\n");
close(*(_DWORD *)(a1 + 28));
result = 0xFFFFFFFFLL;
}
else
{
result = *(unsigned int *)(a1 + 28);
}
}
return result;
}

canonical_decompiled_code:
__int64 __fastcall func6(__int64 a1)
{
int v2; // eax
__int64 v3; // rdi
int v4; // eax
__int16 v5; // bp
socklen_t v6; // edx
__m128i v7; // xmm0
int v8; // edi
__int64 result; // rax
struct sockaddr v10; // [rsp+0h] [rbp-48h] BYREF
struct sockaddr addr[3]; // [rsp+10h] [rbp-38h] BYREF

v2 = socket(2, 1, 0);
*(_DWORD *)(a1 + 28) = v2;
if ( v2 < 0 )
{
ErrorMessage("aruba_action: socket error\n");
result = 0xFFFFFFFFLL;
}
else
{
v3 = (unsigned int)v2;
v4 = *(_DWORD *)(a1 + 24);
v10.sa_family = 2;
*(_DWORD *)&v10.sa_data[2] = v4;
*(_WORD *)v10.sa_data = func2(v3, &v10, 16LL);
v5 = *(_WORD *)v10.sa_data;
if ( connect(v3, &v10, v6) < 0
|| (v7 = _mm_loadu_si128((const __m128i *)(a1 + 24)),
v8 = *(_DWORD *)(a1 + 28),
addr[0].sa_family = 10,
*(_WORD *)addr[0].sa_data = v5,
*(struct sockaddr *)&addr[0].sa_data[6] = (struct sockaddr)v7,
connect(v8, addr, 0x1Cu) < 0) )
{
perror("connect");
ErrorMessage("aruba_action: Unable to connect to switch\n");
close(*(_DWORD *)(a1 + 28));
result = 0xFFFFFFFFLL;
}
else
{
result = *(unsigned int *)(a1 + 28);
}
}
return result;
}

original_code:
int ArubaSwitchConnect(SpoAlertArubaActionData *data)
{
 struct sockaddr_in sa4;
 struct sockaddr_in6 sa6;
 data->fd = socket(2, SOCK_STREAM, 0);
 if (data->fd < 0) {
  ErrorMessage("aruba_action: socket error\n");
  return -1;
 }
     sa4.sin_addr.s_addr = (unsigned int)(data->aswitch.s_addr);
     sa4.sin_family = 2;
     sa4.sin_port = htons(80);
     if (connect(data->fd, (struct sockaddr *)&sa4, sizeof(sa4)) < 0) {
      perror("connect");
      ErrorMessage("aruba_action: Unable to connect to switch\n");
      close(data->fd);
      return -1;
     }
     memcpy(&sa6.sin6_addr, &data->aswitch, 16);
     sa6.sin6_family = 10;
     sa6.sin6_port = htons(80);
        if (connect(data->fd, (struct sockaddr *)&sa6, sizeof(sa6)) < 0) {
      perror("connect");
      ErrorMessage("aruba_action: Unable to connect to switch\n");
      close(data->fd);
      return -1;
     }
 return data->fd;
}

canonical_original_code:
int ArubaSwitchConnect(struct _SpoAlertArubaActionData *data)
{
 struct sockaddr_in sa4;
 struct sockaddr_in6 sa6;
 data->fd = socket(2, SOCK_STREAM, 0);
 if (data->fd < 0) {
  ErrorMessage("aruba_action: socket error\n");
  return -1;
 }
     sa4.sin_addr.s_addr = (unsigned int)(data->aswitch.s_addr);
     sa4.sin_family = 2;
     sa4.sin_port = htons(80);
     if (connect(data->fd, (struct sockaddr *)&sa4, sizeof(sa4)) < 0) {
      perror("connect");
      ErrorMessage("aruba_action: Unable to connect to switch\n");
      close(data->fd);
      return -1;
     }
     memcpy(&sa6.sin6_addr, &data->aswitch, 16);
     sa6.sin6_family = 10;
     sa6.sin6_port = htons(80);
        if (connect(data->fd, (struct sockaddr *)&sa6, sizeof(sa6)) < 0) {
      perror("connect");
      ErrorMessage("aruba_action: Unable to connect to switch\n");
      close(data->fd);
      return -1;
     }
 return data->fd;
}

variable_types: struct sockaddr_in { unsigned short sin_family; unsigned short sin_port; struct in_addr { unsigned int s_addr; } sin_addr; unsigned char sin_zero[-1]; }

variable_types: struct sockaddr_in6 { unsigned short sin6_family; unsigned short sin6_port; unsigned int sin6_flowinfo; struct in6_addr { union { unsigned char __u6_addr8[16]; unsigned short __u6_addr16[8]; unsigned int __u6_addr32[4]; } __in6_u; } sin6_addr; unsigned int sin6_scope_id; }

user_defined_types: struct sockaddr_in { unsigned short sin_family; unsigned short sin_port; struct in_addr sin_addr; unsigned char sin_zero[-1]; }

user_defined_types: struct sockaddr_in6 { unsigned short sin6_family; unsigned short sin6_port; unsigned int sin6_flowinfo; struct in6_addr sin6_addr; unsigned int sin6_scope_id; }


AlertArubaAction

decompiled_code:
void __fastcall AlertArubaAction(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
int v5; // eax
char v6; // al
size_t v7; // rax
unsigned int v8; // er13
char *v9; // r14
char *v10; // rax
size_t v11; // rax
int v12; // er13
char *v13; // r14
char v14; // al
char *v15; // rax
size_t v16; // rax
int v17; // ebp
char *v18; // r14
size_t v19; // rax
int v20; // ebp
const char *v21; // r13
size_t v22; // rax
int v23; // ebp
size_t v24; // rbp
char *v25; // rax
int v26; // eax
char *v27; // rax
unsigned __int64 v28; // rdx
int v29; // eax
const char *v30; // r8
unsigned int v31; // [rsp+0h] [rbp-A2Ch] BYREF
char s[16]; // [rsp+4h] [rbp-A28h] BYREF
__m128i v33; // [rsp+14h] [rbp-A18h]
char v34[8]; // [rsp+24h] [rbp-A08h] BYREF
char v35[1024]; // [rsp+204h] [rbp-828h] BYREF
char haystack[1064]; // [rsp+604h] [rbp-428h] BYREF

if ( a1 && a4 )
{
v5 = ArubaSwitchConnect(a4);
*(_DWORD *)(a4 + 28) = v5;
if ( v5 < 0 )
{
v15 = inet_ntoa(*(struct in_addr *)(a4 + 24));
ErrorMessage("Unable to connect to Aruba switch at %s\n", v15);
}
else
{
v6 = *(_BYTE *)(a4 + 9);
if ( v6 == 1 )
{
strcpy(v34, "t>");
*(__m128i *)s = _mm_load_si128((const __m128i *)&LC31);
v33 = _mm_load_si128((const __m128i *)&LC32);
}
else
{
if ( v6 != 2 )
{
ErrorMessage("aruba_action: invalid action type specified");
return;
}
snprintf(s, 0x200uLL, "xml=<aruba command=user_add><role>%s</role>", *(const char **)(a4 + 16));
}
v7 = strlen(s);
v8 = 512 - v7;
v9 = &s[v7];
v10 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
snprintf(v9, v8, "<ipaddr>%s</ipaddr>", v10);
v11 = strlen(v9);
v12 = v8 - v11;
v13 = &v9[v11];
if ( v12 <= 0 )
goto LABEL_7;
v14 = *(_BYTE *)(a4 + 8);
switch ( v14 )
{
case 2:
snprintf(v13, v12, "<authentication>md5</authentication>");
break;
case 4:
snprintf(v13, v12, "<authentication>cleartext</authentication>");
break;
case 1:
snprintf(v13, v12, "<authentication>sha-1</authentication>");
break;
default:
ErrorMessage("aruba_action: invalid secret type specified");
return;
}
v16 = strlen(v13);
v17 = v12 - v16;
if ( v12 - (int)v16 <= 0 )
goto LABEL_7;
v18 = &v13[v16];
snprintf(v18, v17, "<key>%s</key>", *(const char **)a4);
v19 = strlen(v18);
v20 = v17 - v19;
if ( v20 <= 0
|| (v21 = &v18[v19],
snprintf(&v18[v19], v20, "<version>1.0</version>"),
v22 = strlen(v21),
v23 = v20 - v22,
v23 <= 0) )
{
LABEL_7:
ErrorMessage("aruba_action: configuration parameters too long\n");
FatalError("Unable to parse configuration parameters for ArubaAction output plugin.\n");
}
else
{
snprintf((char *)&v21[v22], v23, "</aruba>");
v24 = strlen(s);
v25 = inet_ntoa(*(struct in_addr *)(a4 + 24));
v26 = snprintf(
v35,
0x3FFuLL,
"POST /auth/command.xml HTTP/1.0\r\n"
"User-Agent: snort\r\n"
"Host: %s\r\n"
"Pragma: no-cache\r\n"
"Content-Length: %lu\r\n"
"Content-Type: application/xml\r\n"
"\r\n"
"%s",
v25,
v24,
s);
if ( (unsigned int)ArubaSwitchSend(a4, v35, v26) == v26 )
{
if ( (int)ArubaSwitchRecv(a4, haystack, 1024) < 0 )
{
ErrorMessage("aruba_action: Error reading response from Aruba switch\n");
close(*(_DWORD *)(a4 + 28));
}
else
{
v27 = strstr(haystack, "<code>");
if ( v27 )
{
if ( (unsigned int)_isoc99_sscanf(v27 + 6, "%d", &v31) == 1 )
{
if ( v31 )
{
v28 = (unsigned int)((_DWORD)&response_lookup + 16);
v29 = 0;
v30 = "success";
while ( 1 )
{
if ( v31 == v29 )
{
ErrorMessage("aruba_action: Switch returned error status of %d \"%s\"\n", v31, v30);
goto LABEL_32;
}
v30 = *(const char **)(v28 + 8);
if ( !v30 )
break;
v29 = *(unsigned __int8 *)v28;
v28 += 16LL;
}
ErrorMessage("aruba_action: Switch returned error status of %d \"unknown\"\n", v31);
}
LABEL_32:
close(*(_DWORD *)(a4 + 28));
}
else
{
ErrorMessage("aruba_action: Invalid response code returned from the Aruba switch.\n");
}
}
else
{
ErrorMessage("aruba_action: Error extracting response code from Aruba switch\n");
close(*(_DWORD *)(a4 + 28));
}
}
}
else
{
ErrorMessage("aruba_action: Error sending data to Aruba switch.\n");
close(*(_DWORD *)(a4 + 28));
}
}
}
}
}

canonical_decompiled_code:
void __fastcall func7(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
int v5; // eax
char v6; // al
size_t v7; // rax
unsigned int v8; // er13
char *v9; // r14
char *v10; // rax
size_t v11; // rax
int v12; // er13
char *v13; // r14
char v14; // al
char *v15; // rax
size_t v16; // rax
int v17; // ebp
char *v18; // r14
size_t v19; // rax
int v20; // ebp
const char *v21; // r13
size_t v22; // rax
int v23; // ebp
size_t v24; // rbp
char *v25; // rax
int v26; // eax
char *v27; // rax
unsigned __int64 v28; // rdx
int v29; // eax
const char *v30; // r8
unsigned int v31; // [rsp+0h] [rbp-A2Ch] BYREF
char s[16]; // [rsp+4h] [rbp-A28h] BYREF
__m128i v33; // [rsp+14h] [rbp-A18h]
char v34[8]; // [rsp+24h] [rbp-A08h] BYREF
char v35[1024]; // [rsp+204h] [rbp-828h] BYREF
char haystack[1064]; // [rsp+604h] [rbp-428h] BYREF

if ( a1 && a4 )
{
v5 = func6(a4);
*(_DWORD *)(a4 + 28) = v5;
if ( v5 < 0 )
{
v15 = inet_ntoa(*(struct in_addr *)(a4 + 24));
ErrorMessage("Unable to connect to Aruba switch at %s\n", v15);
}
else
{
v6 = *(_BYTE *)(a4 + 9);
if ( v6 == 1 )
{
strcpy(v34, "t>");
*(__m128i *)s = _mm_load_si128((const __m128i *)&LC31);
v33 = _mm_load_si128((const __m128i *)&LC32);
}
else
{
if ( v6 != 2 )
{
ErrorMessage("aruba_action: invalid action type specified");
return;
}
snprintf(s, 0x200uLL, "xml=<aruba command=user_add><role>%s</role>", *(const char **)(a4 + 16));
}
v7 = strlen(s);
v8 = 512 - v7;
v9 = &s[v7];
v10 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
snprintf(v9, v8, "<ipaddr>%s</ipaddr>", v10);
v11 = strlen(v9);
v12 = v8 - v11;
v13 = &v9[v11];
if ( v12 <= 0 )
goto LABEL_7;
v14 = *(_BYTE *)(a4 + 8);
switch ( v14 )
{
case 2:
snprintf(v13, v12, "<authentication>md5</authentication>");
break;
case 4:
snprintf(v13, v12, "<authentication>cleartext</authentication>");
break;
case 1:
snprintf(v13, v12, "<authentication>sha-1</authentication>");
break;
default:
ErrorMessage("aruba_action: invalid secret type specified");
return;
}
v16 = strlen(v13);
v17 = v12 - v16;
if ( v12 - (int)v16 <= 0 )
goto LABEL_7;
v18 = &v13[v16];
snprintf(v18, v17, "<key>%s</key>", *(const char **)a4);
v19 = strlen(v18);
v20 = v17 - v19;
if ( v20 <= 0
|| (v21 = &v18[v19],
snprintf(&v18[v19], v20, "<version>1.0</version>"),
v22 = strlen(v21),
v23 = v20 - v22,
v23 <= 0) )
{
LABEL_7:
ErrorMessage("aruba_action: configuration parameters too long\n");
FatalError("Unable to parse configuration parameters for ArubaAction output plugin.\n");
}
else
{
snprintf((char *)&v21[v22], v23, "</aruba>");
v24 = strlen(s);
v25 = inet_ntoa(*(struct in_addr *)(a4 + 24));
v26 = snprintf(
v35,
0x3FFuLL,
"POST /auth/command.xml HTTP/1.0\r\n"
"User-Agent: snort\r\n"
"Host: %s\r\n"
"Pragma: no-cache\r\n"
"Content-Length: %lu\r\n"
"Content-Type: application/xml\r\n"
"\r\n"
"%s",
v25,
v24,
s);
if ( (unsigned int)func4(a4, v35, v26) == v26 )
{
if ( (int)func5(a4, haystack, 1024) < 0 )
{
ErrorMessage("aruba_action: Error reading response from Aruba switch\n");
close(*(_DWORD *)(a4 + 28));
}
else
{
v27 = strstr(haystack, "<code>");
if ( v27 )
{
if ( (unsigned int)_isoc99_sscanf(v27 + 6, "%d", &v31) == 1 )
{
if ( v31 )
{
v28 = (unsigned int)((_DWORD)&response_lookup + 16);
v29 = 0;
v30 = "success";
while ( 1 )
{
if ( v31 == v29 )
{
ErrorMessage("aruba_action: Switch returned error status of %d \"%s\"\n", v31, v30);
goto LABEL_32;
}
v30 = *(const char **)(v28 + 8);
if ( !v30 )
break;
v29 = *(unsigned __int8 *)v28;
v28 += 16LL;
}
ErrorMessage("aruba_action: Switch returned error status of %d \"unknown\"\n", v31);
}
LABEL_32:
close(*(_DWORD *)(a4 + 28));
}
else
{
ErrorMessage("aruba_action: Invalid response code returned from the Aruba switch.\n");
}
}
else
{
ErrorMessage("aruba_action: Error extracting response code from Aruba switch\n");
close(*(_DWORD *)(a4 + 28));
}
}
}
else
{
ErrorMessage("aruba_action: Error sending data to Aruba switch.\n");
close(*(_DWORD *)(a4 + 28));
}
}
}
}
}

original_code:
void AlertArubaAction(Packet *p, void *event, uint32_t event_type, void *arg)
{
 char cmdbuf[512], post[1024];
 char response[1024];
 char *cmdbufp, *responsecode, *responsemsg;
 int postlen, xmllenrem, i, responsecodei;
 if ( p == ((void *)0) || arg == ((void *)0) )
 {
  return;
 }
 SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 cmdbufp = cmdbuf;
 data->fd = ArubaSwitchConnect(data);
 if (data->fd < 0) {
  ErrorMessage("Unable to connect to Aruba switch at %s\n",
    inet_ntoa(data->aswitch));
  return;
 }
 xmllenrem = 512;
 switch(data->action_type) {
  case 1:
  snprintf(cmdbufp, xmllenrem, "xml=<aruba "
    "command=user_blacklist>");
  break;
  case 2:
  snprintf(cmdbufp, xmllenrem, "xml=<aruba command=user_add>"
    "<role>%s</role>", data->role_name);
  break;
  default:
  ErrorMessage("aruba_action: invalid action type specified");
  return;
  break;
 }
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<ipaddr>%s</ipaddr>",
   inet_ntoa(p->iph->ip_src)
        );
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 switch(data->secret_type) {
  case 1:
  snprintf(cmdbufp, xmllenrem, "<authentication>sha-1"
    "</authentication>");
  break;
  case 2:
  snprintf(cmdbufp, xmllenrem, "<authentication>md5"
    "</authentication>");
  break;
  case 4:
  snprintf(cmdbufp, xmllenrem, "<authentication>cleartext"
    "</authentication>");
  break;
  default:
  ErrorMessage("aruba_action: invalid secret type specified");
  return;
  break;
 }
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<key>%s</key>", data->secret);
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<version>1.0</version>");
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "</aruba>");
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 cmdbufp = ((void *)0);
 postlen = snprintf(post, 1024 -1,
   "POST /auth/command.xml HTTP/1.0\r\n"
   "User-Agent: snort\r\n"
   "Host: %s\r\n"
   "Pragma: no-cache\r\n"
   "Content-Length: %lu\r\n"
   "Content-Type: application/xml\r\n"
   "\r\n"
   "%s",
   inet_ntoa(data->aswitch),
   (unsigned long)strlen(cmdbuf), cmdbuf
        );
 if (ArubaSwitchSend(data, (uint8_t *)post, postlen) != postlen) {
  ErrorMessage("aruba_action: Error sending data to Aruba "
    "switch.\n");
  close(data->fd);
  return;
 }
 if (ArubaSwitchRecv(data, (uint8_t *)response, 1024) < 0) {
  ErrorMessage("aruba_action: Error reading response from Aruba"
    " switch\n");
  close(data->fd);
  return;
 }
 responsecode = strstr(response, "<code>");
 if (responsecode == ((void *)0)) {
  ErrorMessage("aruba_action: Error extracting response code "
    "from Aruba switch\n");
  close(data->fd);
  return;
 }
 responsecode += (strlen("<code>"));
 if (sscanf(responsecode, "%d", &responsecodei) != 1) {
  ErrorMessage("aruba_action: Invalid response code returned from"
    " the Aruba switch.\n");
  return;
 }
 if (responsecodei != 0) {
  responsemsg = ((void *)0);
  for (i=0; response_lookup[i].name != ((void *)0); i++) {
   if (response_lookup[i].type == responsecodei) {
    responsemsg = response_lookup[i].name;
    break;
   }
  }
  if (responsemsg == ((void *)0)) {
   ErrorMessage("aruba_action: Switch returned error "
     "status of %d \"unknown\"\n",
     responsecodei);
  } else {
   ErrorMessage("aruba_action: Switch returned error "
     "status of %d \"%s\"\n",
     responsecodei, responsemsg);
  }
  close(data->fd);
  return;
 }
 close(data->fd);
 return;
}

canonical_original_code:
void AlertArubaAction(struct _Packet *p, void *event, unsigned int event_type, void *arg)
{
 char cmdbuf[512]; char post[1024];
 char response[1024];
 char *cmdbufp; char *responsecode; char *responsemsg;
 int postlen; int xmllenrem; int i; int responsecodei;
 if ( p == ((void *)0) || arg == ((void *)0) )
 {
  return;
 }
 struct _SpoAlertArubaActionData *data = (SpoAlertArubaActionData *)arg;
 cmdbufp = cmdbuf;
 data->fd = ArubaSwitchConnect(data);
 if (data->fd < 0) {
  ErrorMessage("Unable to connect to Aruba switch at %s\n",
    inet_ntoa(data->aswitch));
  return;
 }
 xmllenrem = 512;
 switch(data->action_type) {
  case 1:
  snprintf(cmdbufp, xmllenrem, "xml=<aruba "
    "command=user_blacklist>");
  break;
  case 2:
  snprintf(cmdbufp, xmllenrem, "xml=<aruba command=user_add>"
    "<role>%s</role>", data->role_name);
  break;
  default:
  ErrorMessage("aruba_action: invalid action type specified");
  return;
  break;
 }
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<ipaddr>%s</ipaddr>",
   inet_ntoa(p->iph->ip_src)
        );
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 switch(data->secret_type) {
  case 1:
  snprintf(cmdbufp, xmllenrem, "<authentication>sha-1"
    "</authentication>");
  break;
  case 2:
  snprintf(cmdbufp, xmllenrem, "<authentication>md5"
    "</authentication>");
  break;
  case 4:
  snprintf(cmdbufp, xmllenrem, "<authentication>cleartext"
    "</authentication>");
  break;
  default:
  ErrorMessage("aruba_action: invalid secret type specified");
  return;
  break;
 }
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<key>%s</key>", data->secret);
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "<version>1.0</version>");
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 if (xmllenrem < 1) {
  ErrorMessage("aruba_action: configuration parameters too "
    "long\n");
  FatalError("Unable to parse configuration parameters for Aruba"
    "Action output plugin.\n");
  return;
 }
 snprintf(cmdbufp, xmllenrem, "</aruba>");
 xmllenrem -= strlen(cmdbufp);
 cmdbufp += strlen(cmdbufp);
 cmdbufp = ((void *)0);
 postlen = snprintf(post, 1024 -1,
   "POST /auth/command.xml HTTP/1.0\r\n"
   "User-Agent: snort\r\n"
   "Host: %s\r\n"
   "Pragma: no-cache\r\n"
   "Content-Length: %lu\r\n"
   "Content-Type: application/xml\r\n"
   "\r\n"
   "%s",
   inet_ntoa(data->aswitch),
   (unsigned long)strlen(cmdbuf), cmdbuf
        );
 if (ArubaSwitchSend(data, (unsigned char *)post, postlen) != postlen) {
  ErrorMessage("aruba_action: Error sending data to Aruba "
    "switch.\n");
  close(data->fd);
  return;
 }
 if (ArubaSwitchRecv(data, (unsigned char *)response, 1024) < 0) {
  ErrorMessage("aruba_action: Error reading response from Aruba"
    " switch\n");
  close(data->fd);
  return;
 }
 responsecode = strstr(response, "<code>");
 if (responsecode == ((void *)0)) {
  ErrorMessage("aruba_action: Error extracting response code "
    "from Aruba switch\n");
  close(data->fd);
  return;
 }
 responsecode += (strlen("<code>"));
 if (sscanf(responsecode, "%d", &responsecodei) != 1) {
  ErrorMessage("aruba_action: Invalid response code returned from"
    " the Aruba switch.\n");
  return;
 }
 if (responsecodei != 0) {
  responsemsg = ((void *)0);
  for (i=0; response_lookup[i].name != ((void *)0); i++) {
   if (response_lookup[i].type == responsecodei) {
    responsemsg = response_lookup[i].name;
    break;
   }
  }
  if (responsemsg == ((void *)0)) {
   ErrorMessage("aruba_action: Switch returned error "
     "status of %d \"unknown\"\n",
     responsecodei);
  } else {
   ErrorMessage("aruba_action: Switch returned error "
     "status of %d \"%s\"\n",
     responsecodei, responsemsg);
  }
  close(data->fd);
  return;
 }
 close(data->fd);
 return;
}

variable_types:
cmdbuf
char [512]

variable_types:
post
char [1024]

variable_types:
response
char [1024]

variable_types:
cmdbufp
char *

variable_types:
responsecode
char *

variable_types:
responsemsg
char *

variable_types: postlen int

variable_types: xmllenrem int

variable_types: i int

variable_types: responsecodei int

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; }

user_defined_types: struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; }

user_defined_types: struct _EthLlc { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; }

user_defined_types: struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; }

user_defined_types: struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }

user_defined_types: struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; }

user_defined_types: struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; }

user_defined_types: struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; }

user_defined_types: struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Fddi_llc_other { unsigned char ctrl_fld[1]; }

user_defined_types: struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; }

user_defined_types: struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; }

user_defined_types: struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; }

user_defined_types: struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; }

user_defined_types: struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; }

user_defined_types: struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; }

user_defined_types: struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; }

user_defined_types: struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; }

user_defined_types: struct _Options { unsigned char code; unsigned char len; unsigned char *data; }

user_defined_types: struct _IP6Option { unsigned char type; unsigned char *data; }

user_defined_types: struct timeval { long tv_sec; long tv_usec; }

user_defined_types: struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; }

user_defined_types: struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; }

user_defined_types: struct idseq { unsigned short id; unsigned short seq; }

user_defined_types: struct pmtu { unsigned short ipm_void; unsigned short nextmtu; }

user_defined_types: struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; }

user_defined_types: struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; }

user_defined_types: struct ra_addr { unsigned int addr; unsigned int preference; }


ParseAlertArubaActionArgs

decompiled_code:
__int64 __fastcall ParseAlertArubaActionArgs(const char *a1)
{
__int64 v1; // rax
__int64 v2; // r12
const char **v3; // rax
__int64 v4; // r15
__int64 v5; // rbx
size_t v6; // rdx
const char *v7; // rbp
const char *v8; // r14
char v9; // al
__int64 v10; // rbx
size_t v11; // rax
__int64 v12; // rax
char *v13; // rbp
const char *v14; // r13
size_t v15; // rax
char *v16; // rdi
const char *v17; // rbp
__int64 v18; // r15
size_t v19; // rdx
const char *v20; // r14
char v21; // al
__int64 v23; // rax
__int64 v24; // rbx
size_t v25; // rax
__int64 v26; // rax
const char *v27; // r13
char *v28; // rbp
size_t v29; // rax
unsigned int v30; // [rsp+0h] [rbp-48h] BYREF
int v31; // [rsp+4h] [rbp-44h] BYREF
const char **v32; // [rsp+8h] [rbp-40h] BYREF

v1 = SnortAlloc(32LL);
if ( a1 )
{
v2 = v1;
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 557;
DebugMessageFunc(32LL, "ParseAlertArubaActionArgs: %s\n", a1);
v3 = (const char **)mSplit(a1, " ", 4LL, &v30, 0LL);
v32 = v3;
if ( v30 == 4 )
{
if ( inet_aton(*v3, (struct in_addr *)(v2 + 24)) )
{
v4 = (__int64)v32;
v5 = 0LL;
v6 = 4LL;
v7 = "sha1";
v8 = v32[1];
while ( 1 )
{
if ( !strncmp(v8, v7, v6) )
{
v9 = secret_lookup[2 * (int)v5];
*(_BYTE *)(v2 + 8) = v9;
if ( !v9 )
goto LABEL_19;
goto LABEL_9;
}
++v5;
v7 = (const char *)secret_lookup[2 * v5 + 1];
if ( !v7 )
break;
v6 = strlen((const char *)secret_lookup[2 * v5 + 1]);
}
if ( !*(_BYTE *)(v2 + 8) )
{
LABEL_19:
v2 = 0LL;
ErrorMessage("aruba_action: unknown secret type \"%s\"\n", *(const char **)(v4 + 8));
FatalError("Unsupported secret type specified\n");
return v2;
}
LABEL_9:
v10 = 0LL;
v11 = strlen(*(const char **)(v4 + 16));
v12 = SnortAlloc(v11 + 1);
*(_QWORD *)v2 = v12;
v13 = (char *)v12;
v14 = v32[2];
v15 = strlen(v14);
v16 = v13;
v17 = "blacklist";
strncpy(v16, v14, v15);
v18 = (__int64)v32;
v19 = 9LL;
v20 = v32[3];
while ( 1 )
{
if ( !strncmp(v17, v20, v19) )
{
v21 = action_lookup[2 * (int)v10];
*(_BYTE *)(v2 + 9) = v21;
goto LABEL_14;
}
++v10;
v17 = (const char *)action_lookup[2 * v10 + 1];
if ( !v17 )
break;
v19 = strlen((const char *)action_lookup[2 * v10 + 1]);
}
v21 = *(_BYTE *)(v2 + 9);
LABEL_14:
if ( v21 )
{
if ( v21 == 2 )
{
v23 = mSplit(*(_QWORD *)(v18 + 24), ":", 2LL, &v31, 0LL);
v24 = v23;
if ( v31 != 2 )
{
v2 = 0LL;
ErrorMessage("aruba_action: malformed setrole action specification \"%s\"\n", v32[3]);
FatalError("Improperly formatted action\n");
return v2;
}
v25 = strlen(*(const char **)(v23 + 8));
v26 = SnortAlloc(v25 + 1);
*(_QWORD *)(v2 + 16) = v26;
v27 = *(const char **)(v24 + 8);
v28 = (char *)v26;
v29 = strlen(v27);
strncpy(v28, v27, v29);
}
mSplitFree(&v32, v30);
return v2;
}
v2 = 0LL;
ErrorMessage("aruba_action: unknown action type \"%s\"\n", *(const char **)(v18 + 24));
FatalError("Unsupported action type specified\n");
}
else
{
v2 = 0LL;
ErrorMessage("aruba_action: invalid Aruba switch address specified (%s)\n", *v32);
FatalError("Invalid Aruba switch address.\n");
}
}
else
{
v2 = 0LL;
ErrorMessage("aruba_action: incorrect number of arguments specified (%d)\n", v30);
FatalError("Invalid argument count\n");
}
}
else
{
v2 = 0LL;
ErrorMessage("aruba_action: you must specify arguments for the Aruba Action plugin\n");
FatalError("No output plugin arguments specified\n");
}
return v2;
}

canonical_decompiled_code:
__int64 __fastcall func8(const char *a1)
{
__int64 v1; // rax
__int64 v2; // r12
const char **v3; // rax
__int64 v4; // r15
__int64 v5; // rbx
size_t v6; // rdx
const char *v7; // rbp
const char *v8; // r14
char v9; // al
__int64 v10; // rbx
size_t v11; // rax
__int64 v12; // rax
char *v13; // rbp
const char *v14; // r13
size_t v15; // rax
char *v16; // rdi
const char *v17; // rbp
__int64 v18; // r15
size_t v19; // rdx
const char *v20; // r14
char v21; // al
__int64 v23; // rax
__int64 v24; // rbx
size_t v25; // rax
__int64 v26; // rax
const char *v27; // r13
char *v28; // rbp
size_t v29; // rax
unsigned int v30; // [rsp+0h] [rbp-48h] BYREF
int v31; // [rsp+4h] [rbp-44h] BYREF
const char **v32; // [rsp+8h] [rbp-40h] BYREF

v1 = SnortAlloc(32LL);
if ( a1 )
{
v2 = v1;
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 557;
DebugMessageFunc(32LL, "ParseAlertArubaActionArgs: %s\n", a1);
v3 = (const char **)mSplit(a1, " ", 4LL, &v30, 0LL);
v32 = v3;
if ( v30 == 4 )
{
if ( inet_aton(*v3, (struct in_addr *)(v2 + 24)) )
{
v4 = (__int64)v32;
v5 = 0LL;
v6 = 4LL;
v7 = "sha1";
v8 = v32[1];
while ( 1 )
{
if ( !strncmp(v8, v7, v6) )
{
v9 = secret_lookup[2 * (int)v5];
*(_BYTE *)(v2 + 8) = v9;
if ( !v9 )
goto LABEL_19;
goto LABEL_9;
}
++v5;
v7 = (const char *)secret_lookup[2 * v5 + 1];
if ( !v7 )
break;
v6 = strlen((const char *)secret_lookup[2 * v5 + 1]);
}
if ( !*(_BYTE *)(v2 + 8) )
{
LABEL_19:
v2 = 0LL;
ErrorMessage("aruba_action: unknown secret type \"%s\"\n", *(const char **)(v4 + 8));
FatalError("Unsupported secret type specified\n");
return v2;
}
LABEL_9:
v10 = 0LL;
v11 = strlen(*(const char **)(v4 + 16));
v12 = SnortAlloc(v11 + 1);
*(_QWORD *)v2 = v12;
v13 = (char *)v12;
v14 = v32[2];
v15 = strlen(v14);
v16 = v13;
v17 = "blacklist";
strncpy(v16, v14, v15);
v18 = (__int64)v32;
v19 = 9LL;
v20 = v32[3];
while ( 1 )
{
if ( !strncmp(v17, v20, v19) )
{
v21 = action_lookup[2 * (int)v10];
*(_BYTE *)(v2 + 9) = v21;
goto LABEL_14;
}
++v10;
v17 = (const char *)action_lookup[2 * v10 + 1];
if ( !v17 )
break;
v19 = strlen((const char *)action_lookup[2 * v10 + 1]);
}
v21 = *(_BYTE *)(v2 + 9);
LABEL_14:
if ( v21 )
{
if ( v21 == 2 )
{
v23 = mSplit(*(_QWORD *)(v18 + 24), ":", 2LL, &v31, 0LL);
v24 = v23;
if ( v31 != 2 )
{
v2 = 0LL;
ErrorMessage("aruba_action: malformed setrole action specification \"%s\"\n", v32[3]);
FatalError("Improperly formatted action\n");
return v2;
}
v25 = strlen(*(const char **)(v23 + 8));
v26 = SnortAlloc(v25 + 1);
*(_QWORD *)(v2 + 16) = v26;
v27 = *(const char **)(v24 + 8);
v28 = (char *)v26;
v29 = strlen(v27);
strncpy(v28, v27, v29);
}
mSplitFree(&v32, v30);
return v2;
}
v2 = 0LL;
ErrorMessage("aruba_action: unknown action type \"%s\"\n", *(const char **)(v18 + 24));
FatalError("Unsupported action type specified\n");
}
else
{
v2 = 0LL;
ErrorMessage("aruba_action: invalid Aruba switch address specified (%s)\n", *v32);
FatalError("Invalid Aruba switch address.\n");
}
}
else
{
v2 = 0LL;
ErrorMessage("aruba_action: incorrect number of arguments specified (%d)\n", v30);
FatalError("Invalid argument count\n");
}
}
else
{
v2 = 0LL;
ErrorMessage("aruba_action: you must specify arguments for the Aruba Action plugin\n");
FatalError("No output plugin arguments specified\n");
}
return v2;
}

original_code:
SpoAlertArubaActionData *ParseAlertArubaActionArgs(char *args)
{
 char **toks, **action_toks;
 int num_toks, num_action_toks, i;
 SpoAlertArubaActionData *data;
 data = (SpoAlertArubaActionData *)SnortAlloc(sizeof(SpoAlertArubaActionData));
 if(args == ((void *)0)) {
  ErrorMessage("aruba_action: you must specify arguments for the "
    "Aruba Action plugin\n");
  FatalError("No output plugin arguments specified\n");
  return ((void *)0);
 }
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 557; DebugMessageFunc(0x00000020, "ParseAlertArubaActionArgs: %s\n", args);;
 toks = mSplit(args, " ", 4, &num_toks, 0);
 if (num_toks != 4) {
  ErrorMessage("aruba_action: incorrect number of arguments "
    "specified (%d)\n", num_toks);
  FatalError("Invalid argument count\n");
  return ((void *)0);
 }
 if (inet_aton(toks[0], &data->aswitch) == 0)
    {
  ErrorMessage("aruba_action: invalid Aruba switch address "
    "specified (%s)\n", toks[0]);
  FatalError("Invalid Aruba switch address.\n");
  return ((void *)0);
 }
 for (i=0; secret_lookup[i].name != ((void *)0); i++) {
  if (strncmp(toks[1], secret_lookup[i].name,
    strlen(secret_lookup[i].name)) == 0) {
   data->secret_type = secret_lookup[i].type;
   break;
  }
 }
 if (data->secret_type == 0) {
  ErrorMessage("aruba_action: unknown secret type \"%s\"\n",
    toks[1]);
  FatalError("Unsupported secret type specified\n");
  return ((void *)0);
 }
 data->secret = (char *)SnortAlloc(strlen(toks[2])+1);
 strncpy(data->secret, toks[2], strlen(toks[2]));
 for (i=0; action_lookup[i].name != ((void *)0); i++) {
  if (strncmp(action_lookup[i].name, toks[3],
    strlen(action_lookup[i].name)) == 0) {
   data->action_type = action_lookup[i].type;
   break;
  }
 }
 if (data->action_type == 0) {
  ErrorMessage("aruba_action: unknown action type \"%s\"\n",
    toks[3]);
  FatalError("Unsupported action type specified\n");
  return ((void *)0);
 }
 if (data->action_type == 2) {
  action_toks = mSplit(toks[3], ":", 2, &num_action_toks, 0);
  if (num_action_toks != 2) {
   ErrorMessage("aruba_action: malformed setrole action "
     "specification \"%s\"\n", toks[3]);
   FatalError("Improperly formatted action\n");
   return ((void *)0);
  }
  data->role_name = (char *)SnortAlloc(strlen(action_toks[1])+1);
  strncpy(data->role_name, action_toks[1],
    strlen(action_toks[1]));
 }
 mSplitFree(&toks, num_toks);
 return data;
}

canonical_original_code:
struct _SpoAlertArubaActionData *ParseAlertArubaActionArgs(char *args)
{
 char **toks; char **action_toks;
 int num_toks; int num_action_toks; int i;
 struct _SpoAlertArubaActionData *data;
 data = (struct _SpoAlertArubaActionData *)SnortAlloc(sizeof(SpoAlertArubaActionData));
 if(args == ((void *)0)) {
  ErrorMessage("aruba_action: you must specify arguments for the "
    "Aruba Action plugin\n");
  FatalError("No output plugin arguments specified\n");
  return ((void *)0);
 }
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 557; DebugMessageFunc(0x00000020, "ParseAlertArubaActionArgs: %s\n", args);;
 toks = mSplit(args, " ", 4, &num_toks, 0);
 if (num_toks != 4) {
  ErrorMessage("aruba_action: incorrect number of arguments "
    "specified (%d)\n", num_toks);
  FatalError("Invalid argument count\n");
  return ((void *)0);
 }
 if (inet_aton(toks[0], &data->aswitch) == 0)
    {
  ErrorMessage("aruba_action: invalid Aruba switch address "
    "specified (%s)\n", toks[0]);
  FatalError("Invalid Aruba switch address.\n");
  return ((void *)0);
 }
 for (i=0; secret_lookup[i].name != ((void *)0); i++) {
  if (strncmp(toks[1], secret_lookup[i].name,
    strlen(secret_lookup[i].name)) == 0) {
   data->secret_type = secret_lookup[i].type;
   break;
  }
 }
 if (data->secret_type == 0) {
  ErrorMessage("aruba_action: unknown secret type \"%s\"\n",
    toks[1]);
  FatalError("Unsupported secret type specified\n");
  return ((void *)0);
 }
 data->secret = (char *)SnortAlloc(strlen(toks[2])+1);
 strncpy(data->secret, toks[2], strlen(toks[2]));
 for (i=0; action_lookup[i].name != ((void *)0); i++) {
  if (strncmp(action_lookup[i].name, toks[3],
    strlen(action_lookup[i].name)) == 0) {
   data->action_type = action_lookup[i].type;
   break;
  }
 }
 if (data->action_type == 0) {
  ErrorMessage("aruba_action: unknown action type \"%s\"\n",
    toks[3]);
  FatalError("Unsupported action type specified\n");
  return ((void *)0);
 }
 if (data->action_type == 2) {
  action_toks = mSplit(toks[3], ":", 2, &num_action_toks, 0);
  if (num_action_toks != 2) {
   ErrorMessage("aruba_action: malformed setrole action "
     "specification \"%s\"\n", toks[3]);
   FatalError("Improperly formatted action\n");
   return ((void *)0);
  }
  data->role_name = (char *)SnortAlloc(strlen(action_toks[1])+1);
  strncpy(data->role_name, action_toks[1],
    strlen(action_toks[1]));
 }
 mSplitFree(&toks, num_toks);
 return data;
}

variable_types:
args
char *

variable_types:
toks
char **

variable_types: struct _SpoAlertArubaActionData { char *secret; unsigned char secret_type; unsigned char action_type; char *role_name; struct in_addr { unsigned int s_addr; } aswitch; int fd; } *

user_defined_types: struct _SpoAlertArubaActionData { char *secret; unsigned char secret_type; unsigned char action_type; char *role_name; struct in_addr aswitch; int fd; }


AlertArubaActionInit

decompiled_code:
__int64 __fastcall AlertArubaActionInit(const char *a1)
{
__int64 v1; // rax
__int64 v2; // rbp

DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 204;
DebugMessageFunc(1LL, "Output: AlertArubaAction Initialized\n");
v1 = ParseAlertArubaActionArgs(a1);
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 210;
v2 = v1;
DebugMessageFunc(1LL, "Linking AlertArubaAction functions to call lists...\n");
AddFuncToOutputList(AlertArubaAction, 1LL, v2);
AddFuncToCleanExitList(AlertArubaActionCleanExitFunc, v2);
return AddFuncToRestartList(AlertArubaActionRestartFunc, v2);
}

canonical_decompiled_code:
__int64 __fastcall func9(const char *a1)
{
__int64 v1; // rax
__int64 v2; // rbp

DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 204;
DebugMessageFunc(1LL, "Output: AlertArubaAction Initialized\n");
v1 = func8(a1);
DebugMessageFile = "spo_alert_arubaaction.c";
DebugMessageLine = 210;
v2 = v1;
DebugMessageFunc(1LL, "Linking AlertArubaAction functions to call lists...\n");
AddFuncToOutputList(AlertArubaAction, 1LL, v2);
AddFuncToCleanExitList(AlertArubaActionCleanExitFunc, v2);
return AddFuncToRestartList(AlertArubaActionRestartFunc, v2);
}

original_code:
void AlertArubaActionInit(char *args)
{
 SpoAlertArubaActionData *data;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 204; DebugMessageFunc(0x00000001,"Output: AlertArubaAction " "Initialized\n");;
 data = ParseAlertArubaActionArgs(args);
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 210; DebugMessageFunc(0x00000001,"Linking AlertArubaAction functions " "to call lists...\n");;
 AddFuncToOutputList(AlertArubaAction, OUTPUT_TYPE__ALERT, data);
 AddFuncToCleanExitList(AlertArubaActionCleanExitFunc, data);
 AddFuncToRestartList(AlertArubaActionRestartFunc, data);
}

canonical_original_code:
void AlertArubaActionInit(char *args)
{
 struct _SpoAlertArubaActionData *data;
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 204; DebugMessageFunc(0x00000001,"Output: AlertArubaAction " "Initialized\n");;
 data = ParseAlertArubaActionArgs(args);
 DebugMessageFile = "spo_alert_arubaaction.c"; DebugMessageLine = 210; DebugMessageFunc(0x00000001,"Linking AlertArubaAction functions " "to call lists...\n");;
 AddFuncToOutputList(AlertArubaAction, OUTPUT_TYPE__ALERT, data);
 AddFuncToCleanExitList(AlertArubaActionCleanExitFunc, data);
 AddFuncToRestartList(AlertArubaActionRestartFunc, data);
}


BcDaemonMode

decompiled_code:
__int64 BcDaemonMode()
{
return *(_DWORD *)(barnyard2_conf + 8LL) & 2;
}

canonical_decompiled_code:
__int64 func0()
{
return *(_DWORD *)(barnyard2_conf + 8LL) & 2;
}

original_code:
static inline int BcDaemonMode(void)
{
    return barnyard2_conf->run_flags & RUN_FLAG__DAEMON;
}

canonical_original_code:
static inline int BcDaemonMode()
{
    return barnyard2_conf->run_flags & RUN_FLAG__DAEMON;
}


BcAlertInterface

decompiled_code:
__int64 BcAlertInterface()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x200;
}

canonical_decompiled_code:
__int64 func1()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x200;
}

original_code:
static inline int BcAlertInterface(void)
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__ALERT_IFACE;
}

canonical_original_code:
static inline int BcAlertInterface()
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__ALERT_IFACE;
}