-- -------------------------------------------------------------------------------------------------------------------- -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > WS2InterceptDLL.dll!CDnsStateThread::ReCreateZoneTransferMessage(void * hFileHandle, _FLOW_DATA * pFlowData, CDnsMessageWB * pZoneTransferMessage, unsigned long * pErrorCode) Line 7358 C++ WS2InterceptDLL.dll!CDnsStateThread::OnIdle(long lCount) Line 3799 C++ WS2InterceptDLL.dll!CWinThread::Run() Line 621 C++ WS2InterceptDLL.dll!_AfxThreadEntry(void * pParam) Line 122 C++ [External Code] -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ bool CDnsStateThread::ReCreateZoneTransferMessage( HANDLE hFileHandle, PFLOW_DATA pFlowData, CDnsMessageWB* pZoneTransferMessage, DWORD* pErrorCode ) { CDnsResorceRecord* pCurrentRR = pZoneTransferMessage->m_pFirstDnsRRecord; CDnsResorceRecord* pNextRR; UINT32 nBufferLength; int nA4Count = 0; int nA4PrivateCount = 0; int nA6Count = 0; int nA6PrivateCount = 0; TCP_INJECT_OUTPUT stTcpInjectOutput; OVERLAPPED stInjectResponceDoneOverlapped; CEvent oOverlappedEvent(FALSE, TRUE); TCHAR szIpAddress[128]; LPTSTR pAddressEnd; IN_ADDR stIpAddress; IN6_ADDR stIp6Address; BOOL bRet; DWORD dwResult, dwOverlappedResult; *pErrorCode = 0; if (NULL == pCurrentRR) { TraceEvents( TRACE_LEVEL_ERROR, ... *pErrorCode = dwResult; return false; } } bRet = GetOverlappedResult( hFileHandle, &stInjectResponceDoneOverlapped, &dwOverlappedResult, TRUE ); if (!bRet) { dwResult = ::GetLastError(); -- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - oNewDnsMessage {m_stDnsHeader={Xid=0x0003 RecursionDesired=0x01 '\x1' Truncation=0x00 '\0' ...} m_pFirstDnsRRecord=...} CDnsMessageWB + __vfptr 0x00007ffffe808f20 {WS2InterceptDLL.dll!const CDnsMessageWB::`vftable'} {0x00007ffffe232560 {WS2InterceptDLL.dll!CDnsMessageWB::`scalar deleting destructor'(unsigned int)}} void * * - m_stDnsHeader {Xid=0x0003 RecursionDesired=0x01 '\x1' Truncation=0x00 '\0' ...} _DNS_HEADER Xid 0x0003 unsigned short RecursionDesired 0x01 '\x1' unsigned char Truncation 0x00 '\0' unsigned char Authoritative 0x00 '\0' unsigned char Opcode 0x00 '\0' unsigned char IsResponse 0x01 '\x1' unsigned char ResponseCode 0x00 '\0' unsigned char CheckingDisabled 0x00 '\0' unsigned char AuthenticatedData 0x00 '\0' unsigned char Reserved 0x00 '\0' unsigned char RecursionAvailable 0x01 '\x1' unsigned char QuestionCount 0x0001 unsigned short AnswerCount 0x00a4 unsigned short NameServerCount 0x0000 unsigned short AdditionalCount 0x0000 unsigned short + m_pFirstDnsRRecord 0x000000acc4f53740 {m_pNext=0x0000000000000000 m_nStartPositionIndex=0x0000001a m_sName={...} ...} CDnsResorceRecord * + m_pLastDnsRRecord 0x000000acc4f53740 {m_pNext=0x0000000000000000 m_nStartPositionIndex=0x0000001a m_sName={...} ...} CDnsResorceRecord * m_nAnswerCount 0x0001 unsigned short m_nNameServerCount 0x0000 unsigned short m_nAdditionalCount 0x0000 unsigned short + m_stDnsQuestionRecord {sQNAME={...} stDnsWireQuestion={QuestionType=0x00fc QuestionClass=0x0001 } } dns_question_record + m_pParsedMessage 0x0000000000000000 char * m_nParsedMessageLength 0x00000000 int m_nQuestionCount 0x0000 unsigned short + m_pSavedQueryMessage 0x0000000000000000 _DNS_MESSAGE_BUFFER * + m_sDnsQuestionTypeName {...} ATL::CStringT > > m_nCookiesValue 0x2b049979 int + this 0x000000acc3d39ad0 {m_pDnsServerAppID=0x000000acc3d41730 {size=0x00000062 data=0x000000acc3d41740 "\\" } ...} CDnsStateThread * hFileHandle 0x0000000000000238 void * - pFlowData 0x000000acc3d39f70 {pThis=0xffffe00078c60050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} ...} _FLOW_DATA * + pThis 0xffffe00078c60050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} _FLOW_DATA * nFileIndex 0x00000002 int + listEntry {Flink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } } _LIST_ENTRY + threadListEntry {Flink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } } _LIST_ENTRY + wdfFlowFileObject 0x00001fff863d6fd8 {unused=??? } WDFFILEOBJECT__ * + wdfFlowQueue 0x00001fff84b003d8 {unused=??? } WDFQUEUE__ * + wdfWaitFlowDoneQueue 0x00001fff87807fd8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpQuery2Queue 0x00001fff857c03d8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpSetFirewallFilterQueue 0x00001fff86447e48 {unused=??? } WDFQUEUE__ * + wdfWaitDnsQueryQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQuery2PermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpNewMessageQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpResponceQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryInjectQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponcePermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponceInjectQueue 0x0000000000000000 WDFQUEUE__ * enIpProto IPPROTO_TCP (0x00000006) IPPROTO nRemoteAddressV4 0x5f38e252 unsigned int nRemoteAddressV4N 0x52e2385f unsigned int usRemotePort 0x57ab unsigned short flowHandle 0x0000000000002eae unsigned __int64 enContextState csTcpWaitReadResponce (0x0000002c) _context_state - arContextStateStack 0x000000acc3d3a02c {csTcpWaitReadResponce (0x0000002c), csTcpPermitQueryDone (0x00000027), csTcpPermitQueryDone (0x00000027), ...} _context_state[0x00000010] [0x00000000] csTcpWaitReadResponce (0x0000002c) _context_state [0x00000001] csTcpPermitQueryDone (0x00000027) _context_state [0x00000002] csTcpPermitQueryDone (0x00000027) _context_state [0x00000003] csTcpWaitPermitQuery (0x00000026) _context_state [0x00000004] csTcpPermitQueryPended (0x00000025) _context_state [0x00000005] csTcpWaitResponceStarted (0x00000022) _context_state [0x00000006] csTcpWaitApprovalQuery (0x00000021) _context_state [0x00000007] csTcpWaitReadQuery (0x00000020) _context_state [0x00000008] csTcpQueryMoreData01 (0x0000001e) _context_state [0x00000009] csTcpFlowEstablished (0x0000001d) _context_state [0x0000000a] csWaitQueryStarted (0x00000004) _context_state [0x0000000b] csUdpWaitSetFilterStarted (0x00000003) _context_state [0x0000000c] csUdpWaitQuery2Started (0x00000002) _context_state [0x0000000d] csWaitFlowDoneStarted (0x00000001) _context_state [0x0000000e] csNotRun (0x00000000) _context_state [0x0000000f] csNotRun (0x00000000) _context_state + stRemoteAddressV6 {byteArray16=0x000000acc3d3a06c "" } FWP_BYTE_ARRAY16_ enPacketDirection FWP_DIRECTION_OUTBOUND (0x00000000) FWP_DIRECTION_ pUdpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQueryCloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2BufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2CloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpResponceBufferList 0xffffe00078ccb400 {...} _NET_BUFFER_LIST * pTcpResponceInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryMdl 0x0000000000000000 _MDL * pTcpResponceMdl 0x0000000000000000 _MDL * ulUdpQueryIpHeaderSize 0x00000000 unsigned int ulUdpQuery2IpHeaderSize 0x00000000 unsigned int ulUdpQueryTransportHeaderSize 0x00000000 unsigned int ulUdpQuery2TransportHeaderSize 0x00000000 unsigned int ulUdpQueryBufferSize 0x00000000 unsigned int ulUdpQueryDataOffset 0x00000000 unsigned int ulUdpQueryPacketOffset 0x00000000 unsigned int ulUdpQueryDataLength 0x00000000 unsigned int ulUdpQuery2BufferSize 0x00000000 unsigned int ulUdpQuery2DataOffset 0x00000000 unsigned int ulUdpQuery2PacketOffset 0x00000000 unsigned int ulUdpQuery2DataLength 0x00000000 unsigned int enUdpQueryCompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID enUdpQuery2CompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID interfaceIndex 0x00000000 unsigned long subInterfaceIndex 0x00000000 unsigned long hTcpQueryFlowID 0x0000000000000000 unsigned __int64 hTcpResponceFlowID 0x0000000000002eae unsigned __int64 nTcpQueryLength 0x000000000000001e unsigned __int64 nTcpQueryInjectDataSize 0x0000000000000000 unsigned __int64 nTcpResponceLength 0x0000000000001635 unsigned __int64 nTcpResponceInjectDataSize 0x0000000000000000 unsigned __int64 bIPv6 0x00 '\0' unsigned char bQuery2Pended 0x00 '\0' unsigned char bFilterGhangePended 0x00 '\0' unsigned char bUdpFlow1Done 0x00 '\0' unsigned char - pZoneTransferMessage 0x000000acc3d4d250 {m_stDnsHeader={Xid=0x0003 RecursionDesired=0x01 '\x1' Truncation=0x00 '\0' ...} ...} CDnsMessageWB * + __vfptr 0x00007ffffe808f20 {WS2InterceptDLL.dll!const CDnsMessageWB::`vftable'} {0x00007ffffe232560 {WS2InterceptDLL.dll!CDnsMessageWB::`scalar deleting destructor'(unsigned int)}} void * * - m_stDnsHeader {Xid=0x0003 RecursionDesired=0x01 '\x1' Truncation=0x00 '\0' ...} _DNS_HEADER Xid 0x0003 unsigned short RecursionDesired 0x01 '\x1' unsigned char Truncation 0x00 '\0' unsigned char Authoritative 0x00 '\0' unsigned char Opcode 0x00 '\0' unsigned char IsResponse 0x01 '\x1' unsigned char ResponseCode 0x00 '\0' unsigned char CheckingDisabled 0x00 '\0' unsigned char AuthenticatedData 0x00 '\0' unsigned char Reserved 0x00 '\0' unsigned char RecursionAvailable 0x01 '\x1' unsigned char QuestionCount 0x0001 unsigned short AnswerCount 0x00a4 unsigned short NameServerCount 0x0000 unsigned short AdditionalCount 0x0000 unsigned short + m_pFirstDnsRRecord 0x000000acc4f53340 {m_pNext=0x000000acc4f52a40 {m_pNext=0x000000acc4f532c0 {m_pNext=0x000000acc4f52cc0 {...} ...} ...} ...} CDnsResorceRecord * + m_pLastDnsRRecord 0x000000acc660fe00 {m_pNext=0x0000000000000000 m_nStartPositionIndex=0x00000000 m_sName={...} ...} CDnsResorceRecord * m_nAnswerCount 0x0066 unsigned short m_nNameServerCount 0x0000 unsigned short m_nAdditionalCount 0x0000 unsigned short + m_stDnsQuestionRecord {sQNAME={...} stDnsWireQuestion={QuestionType=0x00fc QuestionClass=0x0001 } } dns_question_record + m_pParsedMessage 0x000000acc446ea62 "" char * m_nParsedMessageLength 0x00001633 int m_nQuestionCount 0x0001 unsigned short + m_pSavedQueryMessage 0x0000000000000000 _DNS_MESSAGE_BUFFER * + m_sDnsQuestionTypeName {...} ATL::CStringT > > m_nCookiesValue 0x2b049979 int + pErrorCode 0x000000acc445d874 {0x00000000} unsigned long * + pNextRR 0x0000000000000000 CDnsResorceRecord * nA4PrivateCount 0x00000003 int - stInjectResponceDoneOverlapped {Internal=0x00000000c0000011 InternalHigh=0x0000000000000000 Offset=0x00000000 ...} _OVERLAPPED Internal 0x00000000c0000011 unsigned __int64 InternalHigh 0x0000000000000000 unsigned __int64 Offset 0x00000000 unsigned long OffsetHigh 0x00000000 unsigned long Pointer 0x0000000000000000 void * hEvent 0x000000000000a451 void * nA6PrivateCount 0x00000001 int dwOverlappedResult 0x00000000 unsigned long nA4Count 0x00000004 int dwResult 0x00000026 unsigned long + szIpAddress 0x000000acc445d3d0 L"쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌쳌... wchar_t[0x00000080] bRet 0x00000000 int + pCurrentRR 0x000000acc4f53740 {m_pNext=0x0000000000000000 m_nStartPositionIndex=0x0000001a m_sName={...} ...} CDnsResorceRecord * + stIpAddress {S_un={S_un_b={s_b1=0xcc 'М' s_b2=0xcc 'М' s_b3=0xcc 'М' ...} S_un_w={s_w1=0xcccc s_w2=0xcccc } S_addr=...} } in_addr nBufferLength 0x0000002c unsigned int - stTcpInjectOutput {m_stInjectConfig={m_nDataSize=0x0000002c } m_wMessageLength=0x2a00 m_pData=0x000000acc444d336 "" } _TCP_INJECT_OUTPUT + m_stInjectConfig {m_nDataSize=0x0000002c } _DNS_INJECT_CONFIG m_wMessageLength 0x2a00 unsigned short - m_pData 0x000000acc444d336 "" unsigned char[0x0000fffe] [0x00000000] 0x00 '\0' unsigned char [0x00000001] 0x03 '\x3' unsigned char [0x00000002] 0x81 'Ѓ' unsigned char [0x00000003] 0x80 'Ђ' unsigned char [0x00000004] 0x00 '\0' unsigned char [0x00000005] 0x01 '\x1' unsigned char [0x00000006] 0x00 '\0' unsigned char [0x00000007] 0x01 '\x1' unsigned char [0x00000008] 0x00 '\0' unsigned char [0x00000009] 0x00 '\0' unsigned char [0x0000000a] 0x00 '\0' unsigned char [0x0000000b] 0x00 '\0' unsigned char [0x0000000c] 0x05 '\x5' unsigned char [0x0000000d] 0x72 'r' unsigned char [0x0000000e] 0x74 't' unsigned char [0x0000000f] 0x73 's' unsigned char [0x00000010] 0x64 'd' unsigned char [0x00000011] 0x64 'd' unsigned char [0x00000012] 0x02 '\x2' unsigned char [0x00000013] 0x72 'r' unsigned char [0x00000014] 0x75 'u' unsigned char [0x00000015] 0x00 '\0' unsigned char [0x00000016] 0x00 '\0' unsigned char [0x00000017] 0xfc 'ь' unsigned char [0x00000018] 0x00 '\0' unsigned char [0x00000019] 0x01 '\x1' unsigned char [0x0000001a] 0xc0 'А' unsigned char [0x0000001b] 0x0c '\f' unsigned char [0x0000001c] 0x00 '\0' unsigned char [0x0000001d] 0x01 '\x1' unsigned char [0x0000001e] 0x00 '\0' unsigned char [0x0000001f] 0x01 '\x1' unsigned char [0x00000020] 0x00 '\0' unsigned char [0x00000021] 0x00 '\0' unsigned char [0x00000022] 0x02 '\x2' unsigned char [0x00000023] 0x58 'X' unsigned char [0x00000024] 0x00 '\0' unsigned char [0x00000025] 0x04 '\x4' unsigned char [0x00000026] 0x4e 'N' unsigned char [0x00000027] 0x6b 'k' unsigned char [0x00000028] 0xbf 'ї' unsigned char [0x00000029] 0x50 'P' unsigned char [0x0000002a] 0x32 '2' unsigned char [0x0000002b] 0x6b 'k' unsigned char [0x0000002c] 0x31 '1' unsigned char [0x0000002d] 0x32 '2' unsigned char [0x0000002e] 0x76 'v' unsigned char [0x0000002f] 0x6d 'm' unsigned char [0x00000030] 0xc0 'А' unsigned char [0x00000031] 0x0c '\f' unsigned char [0x00000032] 0x05 '\x5' unsigned char [0x00000033] 0x64 'd' unsigned char [0x00000034] 0x75 'u' unsigned char [0x00000035] 0x6b 'k' unsigned char [0x00000036] 0x6f 'o' unsigned char [0x00000037] 0x76 'v' unsigned char [0x00000038] 0xc0 'А' unsigned char [0x00000039] 0x0c '\f' unsigned char [0x0000003a] 0x00 '\0' unsigned char [0x0000003b] 0x01 '\x1' unsigned char [0x0000003c] 0x4a 'J' unsigned char [0x0000003d] 0xc9 'Й' unsigned char [0x0000003e] 0x00 '\0' unsigned char [0x0000003f] 0x00 '\0' unsigned char [0x00000040] 0x03 '\x3' unsigned char [0x00000041] 0x84 '„' unsigned char [0x00000042] 0x00 '\0' unsigned char [0x00000043] 0x00 '\0' unsigned char [0x00000044] 0x02 '\x2' unsigned char [0x00000045] 0x58 'X' unsigned char [0x00000046] 0x00 '\0' unsigned char [0x00000047] 0x01 '\x1' unsigned char [0x00000048] 0x51 'Q' unsigned char [0x00000049] 0x80 'Ђ' unsigned char [0x0000004a] 0x00 '\0' unsigned char [0x0000004b] 0x00 '\0' unsigned char [0x0000004c] 0x0e '\xe' unsigned char [0x0000004d] 0x10 '\x10' unsigned char ... + pAddressEnd 0xcccccccccccccccc wchar_t * + oOverlappedEvent {...} CEvent nA6Count 0x00000003 int + stIp6Address {u={Byte=0x000000acc445d508 "ММММММММММММММММ... Word=0x000000acc445d508 {0xcccc, 0xcccc, 0xcccc, 0xcccc, ...} } } in6_addr -- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- ==================================================================================================================== bRet 0x00000000 int dwResult 0x00000026 unsigned long - this 0x000000acc3d39ad0 {m_pDnsServerAppID=0x000000acc3d41730 {size=0x00000062 data=0x000000acc3d41740 "\\" } ...} CDnsStateThread * + CWinThread {m_pMainWnd=0x0000000000000000 m_pActiveWnd=0x0000000000000000 m_bAutoDelete=0x00000000 ...} CWinThread + m_pDnsServerAppID 0x000000acc3d41730 {size=0x00000062 data=0x000000acc3d41740 "\\" } FWP_BYTE_BLOB_ * m_nRetCode 0x00000000 int m_hWfpEngineHandle 0x000000acc3d48f60 void * m_nAleFlowEstablishedCalloutId 0x00000129 unsigned int m_nAleFlowEstablishedV6CalloutId 0x0000012a unsigned int m_nStreamCalloutId 0x0000012b unsigned int m_nStreamV6CalloutId 0x0000012c unsigned int m_nDatagramsCalloutId 0x0000012d unsigned int m_nDatagramsV6CalloutId 0x0000012e unsigned int m_nAleFlowEstablishedFilterID 0x0000000000012487 unsigned __int64 m_nAleFlowEstablishedV6FilterID 0x0000000000012488 unsigned __int64 m_nStreamFilterID 0x0000000000012489 unsigned __int64 m_nStreamV6FilterID 0x000000000001248a unsigned __int64 m_nDatagramDataFilterID 0x000000000001248b unsigned __int64 m_nDatagramV6DataFilterID 0x000000000001248c unsigned __int64 m_hDnsFirewallDevice 0x000000000000022c void * - m_aFowContextArray 0x000000acc3d39bc0 {{pThis=0xffffe00079185050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} ...}, ...} _FLOW_DATA[0x00000020] - [0x00000000] {pThis=0xffffe00079185050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} nFileIndex=...} _FLOW_DATA + pThis 0xffffe00079185050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} _FLOW_DATA * nFileIndex 0x00000000 int + listEntry {Flink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } } _LIST_ENTRY + threadListEntry {Flink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } } _LIST_ENTRY + wdfFlowFileObject 0x00001fff87f68f28 {unused=??? } WDFFILEOBJECT__ * + wdfFlowQueue 0x00001fff85d393d8 {unused=??? } WDFQUEUE__ * + wdfWaitFlowDoneQueue 0x00001fff8785cd18 {unused=??? } WDFQUEUE__ * + wdfWaitUdpQuery2Queue 0x00001fff8531f3d8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpSetFirewallFilterQueue 0x00001fff8513f3d8 {unused=??? } WDFQUEUE__ * + wdfWaitDnsQueryQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQuery2PermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpNewMessageQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpResponceQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryInjectQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponcePermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponceInjectQueue 0x0000000000000000 WDFQUEUE__ * enIpProto IPPROTO_TCP (0x00000006) IPPROTO nRemoteAddressV4 0x5bd91501 unsigned int nRemoteAddressV4N 0x0115d95b unsigned int usRemotePort 0xd784 unsigned short flowHandle 0x0000000000002ea6 unsigned __int64 enContextState csTcpWaitReadResponce (0x0000002c) _context_state - arContextStateStack 0x000000acc3d39c7c {csTcpWaitReadResponce (0x0000002c), csTcpReplaceQueryDone (0x0000002b), csTcpWaitReplaceQueryDone (0x0000002a), ...} _context_state[0x00000010] [0x00000000] csTcpWaitReadResponce (0x0000002c) _context_state [0x00000001] csTcpReplaceQueryDone (0x0000002b) _context_state [0x00000002] csTcpWaitReplaceQueryDone (0x0000002a) _context_state [0x00000003] csTcpReplaceQueryPended (0x00000029) _context_state [0x00000004] csTcpWaitReplaceQuery (0x00000023) _context_state [0x00000005] csTcpWaitResponceStarted (0x00000022) _context_state [0x00000006] csTcpWaitApprovalQuery (0x00000021) _context_state [0x00000007] csTcpWaitReadQuery (0x00000020) _context_state [0x00000008] csTcpQueryMoreData01 (0x0000001e) _context_state [0x00000009] csTcpFlowEstablished (0x0000001d) _context_state [0x0000000a] csWaitQueryStarted (0x00000004) _context_state [0x0000000b] csUdpWaitSetFilterStarted (0x00000003) _context_state [0x0000000c] csUdpWaitQuery2Started (0x00000002) _context_state [0x0000000d] csWaitFlowDoneStarted (0x00000001) _context_state [0x0000000e] csNotRun (0x00000000) _context_state [0x0000000f] csNotRun (0x00000000) _context_state + stRemoteAddressV6 {byteArray16=0x000000acc3d39cbc "" } FWP_BYTE_ARRAY16_ enPacketDirection FWP_DIRECTION_OUTBOUND (0x00000000) FWP_DIRECTION_ pUdpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQueryCloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2BufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2CloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpResponceBufferList 0xffffe00077f7c030 {...} _NET_BUFFER_LIST * pTcpResponceInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryMdl 0x0000000000000000 _MDL * pTcpResponceMdl 0x0000000000000000 _MDL * ulUdpQueryIpHeaderSize 0x00000000 unsigned int ulUdpQuery2IpHeaderSize 0x00000000 unsigned int ulUdpQueryTransportHeaderSize 0x00000000 unsigned int ulUdpQuery2TransportHeaderSize 0x00000000 unsigned int ulUdpQueryBufferSize 0x00000000 unsigned int ulUdpQueryDataOffset 0x00000000 unsigned int ulUdpQueryPacketOffset 0x00000000 unsigned int ulUdpQueryDataLength 0x00000000 unsigned int ulUdpQuery2BufferSize 0x00000000 unsigned int ulUdpQuery2DataOffset 0x00000000 unsigned int ulUdpQuery2PacketOffset 0x00000000 unsigned int ulUdpQuery2DataLength 0x00000000 unsigned int enUdpQueryCompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID enUdpQuery2CompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID interfaceIndex 0x00000000 unsigned long subInterfaceIndex 0x00000000 unsigned long hTcpQueryFlowID 0x0000000000002ea6 unsigned __int64 hTcpResponceFlowID 0x0000000000002ea6 unsigned __int64 nTcpQueryLength 0x0000000000000050 unsigned __int64 nTcpQueryInjectDataSize 0x0000000000000000 unsigned __int64 nTcpResponceLength 0x00000000000000e4 unsigned __int64 nTcpResponceInjectDataSize 0x0000000000000000 unsigned __int64 bIPv6 0x00 '\0' unsigned char bQuery2Pended 0x00 '\0' unsigned char bFilterGhangePended 0x00 '\0' unsigned char bUdpFlow1Done 0x00 '\0' unsigned char - [0x00000001] {pThis=0xffffe00078e6d050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} nFileIndex=...} _FLOW_DATA + pThis 0xffffe00078e6d050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} _FLOW_DATA * nFileIndex 0x00000001 int + listEntry {Flink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } } _LIST_ENTRY + threadListEntry {Flink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } } _LIST_ENTRY + wdfFlowFileObject 0x00001fff875d7fd8 {unused=??? } WDFFILEOBJECT__ * + wdfFlowQueue 0x00001fff884f85b8 {unused=??? } WDFQUEUE__ * + wdfWaitFlowDoneQueue 0x00001fff87b663d8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpQuery2Queue 0x00001fff878c23d8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpSetFirewallFilterQueue 0x00001fff867d3648 {unused=??? } WDFQUEUE__ * + wdfWaitDnsQueryQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQuery2PermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpNewMessageQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpResponceQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryInjectQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponcePermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponceInjectQueue 0x0000000000000000 WDFQUEUE__ * enIpProto IPPROTO_TCP (0x00000006) IPPROTO nRemoteAddressV4 0x5bd91501 unsigned int nRemoteAddressV4N 0x0115d95b unsigned int usRemotePort 0xd882 unsigned short flowHandle 0x0000000000002ea7 unsigned __int64 enContextState csTcpWaitReadResponce (0x0000002c) _context_state - arContextStateStack 0x000000acc3d39e54 {csTcpWaitReadResponce (0x0000002c), csTcpPermitQueryDone (0x00000027), csTcpPermitQueryDone (0x00000027), ...} _context_state[0x00000010] [0x00000000] csTcpWaitReadResponce (0x0000002c) _context_state [0x00000001] csTcpPermitQueryDone (0x00000027) _context_state [0x00000002] csTcpPermitQueryDone (0x00000027) _context_state [0x00000003] csTcpWaitPermitQuery (0x00000026) _context_state [0x00000004] csTcpPermitQueryPended (0x00000025) _context_state [0x00000005] csTcpWaitResponceStarted (0x00000022) _context_state [0x00000006] csTcpWaitApprovalQuery (0x00000021) _context_state [0x00000007] csTcpWaitReadQuery (0x00000020) _context_state [0x00000008] csTcpQueryMoreData01 (0x0000001e) _context_state [0x00000009] csTcpFlowEstablished (0x0000001d) _context_state [0x0000000a] csWaitQueryStarted (0x00000004) _context_state [0x0000000b] csUdpWaitSetFilterStarted (0x00000003) _context_state [0x0000000c] csUdpWaitQuery2Started (0x00000002) _context_state [0x0000000d] csWaitFlowDoneStarted (0x00000001) _context_state [0x0000000e] csNotRun (0x00000000) _context_state [0x0000000f] csNotRun (0x00000000) _context_state + stRemoteAddressV6 {byteArray16=0x000000acc3d39e94 "" } FWP_BYTE_ARRAY16_ enPacketDirection FWP_DIRECTION_OUTBOUND (0x00000000) FWP_DIRECTION_ pUdpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQueryCloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2BufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2CloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpResponceBufferList 0xffffe000784aadf0 {...} _NET_BUFFER_LIST * pTcpResponceInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryMdl 0x0000000000000000 _MDL * pTcpResponceMdl 0x0000000000000000 _MDL * ulUdpQueryIpHeaderSize 0x00000000 unsigned int ulUdpQuery2IpHeaderSize 0x00000000 unsigned int ulUdpQueryTransportHeaderSize 0x00000000 unsigned int ulUdpQuery2TransportHeaderSize 0x00000000 unsigned int ulUdpQueryBufferSize 0x00000000 unsigned int ulUdpQueryDataOffset 0x00000000 unsigned int ulUdpQueryPacketOffset 0x00000000 unsigned int ulUdpQueryDataLength 0x00000000 unsigned int ulUdpQuery2BufferSize 0x00000000 unsigned int ulUdpQuery2DataOffset 0x00000000 unsigned int ulUdpQuery2PacketOffset 0x00000000 unsigned int ulUdpQuery2DataLength 0x00000000 unsigned int enUdpQueryCompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID enUdpQuery2CompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID interfaceIndex 0x00000000 unsigned long subInterfaceIndex 0x00000000 unsigned long hTcpQueryFlowID 0x0000000000000000 unsigned __int64 hTcpResponceFlowID 0x0000000000002ea7 unsigned __int64 nTcpQueryLength 0x000000000000001c unsigned __int64 nTcpQueryInjectDataSize 0x0000000000000000 unsigned __int64 nTcpResponceLength 0x00000000000000e4 unsigned __int64 nTcpResponceInjectDataSize 0x0000000000000000 unsigned __int64 bIPv6 0x00 '\0' unsigned char bQuery2Pended 0x00 '\0' unsigned char bFilterGhangePended 0x00 '\0' unsigned char bUdpFlow1Done 0x00 '\0' unsigned char - [0x00000002] {pThis=0xffffe00078c60050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} nFileIndex=...} _FLOW_DATA + pThis 0xffffe00078c60050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} _FLOW_DATA * nFileIndex 0x00000002 int + listEntry {Flink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } } _LIST_ENTRY + threadListEntry {Flink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } } _LIST_ENTRY + wdfFlowFileObject 0x00001fff863d6fd8 {unused=??? } WDFFILEOBJECT__ * + wdfFlowQueue 0x00001fff84b003d8 {unused=??? } WDFQUEUE__ * + wdfWaitFlowDoneQueue 0x00001fff87807fd8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpQuery2Queue 0x00001fff857c03d8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpSetFirewallFilterQueue 0x00001fff86447e48 {unused=??? } WDFQUEUE__ * + wdfWaitDnsQueryQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQuery2PermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpNewMessageQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpResponceQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryInjectQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponcePermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponceInjectQueue 0x0000000000000000 WDFQUEUE__ * enIpProto IPPROTO_TCP (0x00000006) IPPROTO nRemoteAddressV4 0x5f38e252 unsigned int nRemoteAddressV4N 0x52e2385f unsigned int usRemotePort 0x57ab unsigned short flowHandle 0x0000000000002eae unsigned __int64 enContextState csTcpWaitReadResponce (0x0000002c) _context_state - arContextStateStack 0x000000acc3d3a02c {csTcpWaitReadResponce (0x0000002c), csTcpPermitQueryDone (0x00000027), csTcpPermitQueryDone (0x00000027), ...} _context_state[0x00000010] [0x00000000] csTcpWaitReadResponce (0x0000002c) _context_state [0x00000001] csTcpPermitQueryDone (0x00000027) _context_state [0x00000002] csTcpPermitQueryDone (0x00000027) _context_state [0x00000003] csTcpWaitPermitQuery (0x00000026) _context_state [0x00000004] csTcpPermitQueryPended (0x00000025) _context_state [0x00000005] csTcpWaitResponceStarted (0x00000022) _context_state [0x00000006] csTcpWaitApprovalQuery (0x00000021) _context_state [0x00000007] csTcpWaitReadQuery (0x00000020) _context_state [0x00000008] csTcpQueryMoreData01 (0x0000001e) _context_state [0x00000009] csTcpFlowEstablished (0x0000001d) _context_state [0x0000000a] csWaitQueryStarted (0x00000004) _context_state [0x0000000b] csUdpWaitSetFilterStarted (0x00000003) _context_state [0x0000000c] csUdpWaitQuery2Started (0x00000002) _context_state [0x0000000d] csWaitFlowDoneStarted (0x00000001) _context_state [0x0000000e] csNotRun (0x00000000) _context_state [0x0000000f] csNotRun (0x00000000) _context_state + stRemoteAddressV6 {byteArray16=0x000000acc3d3a06c "" } FWP_BYTE_ARRAY16_ enPacketDirection FWP_DIRECTION_OUTBOUND (0x00000000) FWP_DIRECTION_ pUdpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQueryCloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2BufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2CloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpResponceBufferList 0xffffe00078ccb400 {...} _NET_BUFFER_LIST * pTcpResponceInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryMdl 0x0000000000000000 _MDL * pTcpResponceMdl 0x0000000000000000 _MDL * ulUdpQueryIpHeaderSize 0x00000000 unsigned int ulUdpQuery2IpHeaderSize 0x00000000 unsigned int ulUdpQueryTransportHeaderSize 0x00000000 unsigned int ulUdpQuery2TransportHeaderSize 0x00000000 unsigned int ulUdpQueryBufferSize 0x00000000 unsigned int ulUdpQueryDataOffset 0x00000000 unsigned int ulUdpQueryPacketOffset 0x00000000 unsigned int ulUdpQueryDataLength 0x00000000 unsigned int ulUdpQuery2BufferSize 0x00000000 unsigned int ulUdpQuery2DataOffset 0x00000000 unsigned int ulUdpQuery2PacketOffset 0x00000000 unsigned int ulUdpQuery2DataLength 0x00000000 unsigned int enUdpQueryCompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID enUdpQuery2CompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID interfaceIndex 0x00000000 unsigned long subInterfaceIndex 0x00000000 unsigned long hTcpQueryFlowID 0x0000000000000000 unsigned __int64 hTcpResponceFlowID 0x0000000000002eae unsigned __int64 nTcpQueryLength 0x000000000000001e unsigned __int64 nTcpQueryInjectDataSize 0x0000000000000000 unsigned __int64 nTcpResponceLength 0x0000000000001635 unsigned __int64 nTcpResponceInjectDataSize 0x0000000000000000 unsigned __int64 bIPv6 0x00 '\0' unsigned char bQuery2Pended 0x00 '\0' unsigned char bFilterGhangePended 0x00 '\0' unsigned char bUdpFlow1Done 0x00 '\0' unsigned char + [0x00000003] {pThis=0x0000000000000000 nFileIndex=0x00000003 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000004] {pThis=0x0000000000000000 nFileIndex=0x00000004 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000005] {pThis=0x0000000000000000 nFileIndex=0x00000005 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000006] {pThis=0x0000000000000000 nFileIndex=0x00000006 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000007] {pThis=0x0000000000000000 nFileIndex=0x00000007 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000008] {pThis=0x0000000000000000 nFileIndex=0x00000008 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000009] {pThis=0x0000000000000000 nFileIndex=0x00000009 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000a] {pThis=0x0000000000000000 nFileIndex=0x0000000a listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000b] {pThis=0x0000000000000000 nFileIndex=0x0000000b listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000c] {pThis=0x0000000000000000 nFileIndex=0x0000000c listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000d] {pThis=0x0000000000000000 nFileIndex=0x0000000d listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000e] {pThis=0x0000000000000000 nFileIndex=0x0000000e listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000f] {pThis=0x0000000000000000 nFileIndex=0x0000000f listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000010] {pThis=0x0000000000000000 nFileIndex=0x00000010 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000011] {pThis=0x0000000000000000 nFileIndex=0x00000011 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000012] {pThis=0x0000000000000000 nFileIndex=0x00000012 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000013] {pThis=0x0000000000000000 nFileIndex=0x00000013 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000014] {pThis=0x0000000000000000 nFileIndex=0x00000014 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000015] {pThis=0x0000000000000000 nFileIndex=0x00000015 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000016] {pThis=0x0000000000000000 nFileIndex=0x00000016 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000017] {pThis=0x0000000000000000 nFileIndex=0x00000017 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000018] {pThis=0x0000000000000000 nFileIndex=0x00000018 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000019] {pThis=0x0000000000000000 nFileIndex=0x00000019 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001a] {pThis=0x0000000000000000 nFileIndex=0x0000001a listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001b] {pThis=0x0000000000000000 nFileIndex=0x0000001b listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001c] {pThis=0x0000000000000000 nFileIndex=0x0000001c listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001d] {pThis=0x0000000000000000 nFileIndex=0x0000001d listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001e] {pThis=0x0000000000000000 nFileIndex=0x0000001e listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001f] {pThis=0x0000000000000000 nFileIndex=0x0000001f listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + m_aFileHandleArray 0x000000acc3d3d6c0 {0x0000000000000230, 0x0000000000000234, 0x0000000000000238, 0x000000000000023c, ...} void *[0x00000020] m_hIoCompletionPort 0x00000000000002b0 void * + m_aWaitFlowDoneOverlapedArray 0x000000acc3d3d7c8 {{Internal=0x0000000000000103 InternalHigh=0x0000000000000000 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_aWaitDnsQueryOverlapedArray 0x000000acc3d3dbc8 {{Internal=0x0000000000000103 InternalHigh=0x0000000000000000 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_aWaitUdpQuery2OverlappedArray 0x000000acc3d3dfc8 {{Internal=0x0000000000000103 InternalHigh=0x0000000000000000 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_aWaitUdpSetFilterOverlappedArray 0x000000acc3d3e3c8 {{Internal=0x0000000000000103 InternalHigh=0x0000000000000000 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_oTimerArray {...} std::unordered_map,std::equal_to,std::allocator > > + m_aDnsQueryMessage 0x000000acc3d3e818 {0x0000000000000000 , 0x0000000000000000 , 0x0000000000000000 , ...} CDnsMessageWB *[0x00000020] + m_aAbortedQuery 0x000000acc3d3e918 {false, false, false, false, false, false, false, false, false, false, false, false, ...} bool[0x00000020] + m_aWaitTcpResponceOverlapped 0x000000acc3d3e938 {{Internal=0x0000000000000000 InternalHigh=0x00000000000001d8 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_aWaitTcpNewMessageOverlapped 0x000000acc3d3ed38 {{Internal=0x00000000c0000011 InternalHigh=0x0000000000000000 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_aZoneTransferMessage 0x000000acc3d3f138 {0x0000000000000000 , 0x0000000000000000 , 0x000000acc3d4d250 {m_stDnsHeader=...}, ...} CDnsMessageWB *[0x00000020] m_bFireWallInitialized true bool + m_aCompletionPortEntries 0x000000acc3d3f240 {{lpCompletionKey=0x0000000100000002 lpOverlapped=0x000000acc3d3e978 {Internal=0x0000000000000000 ...} ...}, ...} _OVERLAPPED_ENTRY[0x00000100] -- ==================================================================================================================== if (ERROR_HANDLE_EOF != dwResult) { TraceEvents( TRACE_LEVEL_ERROR, TRACE_DNS_STATE_THREAD, "%!FUNC! line:%!LINE! %!LEVEL! Call \"GetOverlappedResult\" failed. Error: %!WINERROR!", dwResult ); } *pErrorCode = dwResult; return false; } if (STATUS_CANCELLED == stInjectResponceDoneOverlapped.Internal) { dwResult = ERROR_CANCELLED; TraceEvents( TRACE_LEVEL_WARNING, TRACE_DNS_STATE_THREAD, "%!FUNC! line:%!LINE! %!LEVEL! Insert operation DNS response was cancelled. ; IP address = \"%ws\"; nFileIndex = %d;", szIpAddress, pFlowData->nFileIndex ); *pErrorCode = dwResult; return false; } } return true; } -- -------------------------------------------------------------------------------------------------------------------- -- -------------------------------------------------------------------------------------------------------------------- -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ WS2InterceptDLL.dll!CDnsStateThread::ReCreateZoneTransferMessage(void * hFileHandle, _FLOW_DATA * pFlowData, CDnsMessageWB * pZoneTransferMessage, unsigned long * pErrorCode) Line 7358 C++ > WS2InterceptDLL.dll!CDnsStateThread::OnIdle(long lCount) Line 3799 C++ WS2InterceptDLL.dll!CWinThread::Run() Line 621 C++ WS2InterceptDLL.dll!_AfxThreadEntry(void * pParam) Line 122 C++ [External Code] -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... continue; } // NULL == m_pZoneTransferMessage assert(DNS_TYPE_SOA == pDnsMessage->m_pFirstDnsRRecord->m_wType); m_aZoneTransferMessage[nFileIndex] = pDnsMessage; if (1 == pDnsMessage->m_nAnswerCount) { continue; } if (DNS_TYPE_SOA != pDnsMessage->m_pLastDnsRRecord->m_wType) { continue; } bSuccessfull = ReCreateZoneTransferMessage( hFileHandle, pFlowContext, m_aZoneTransferMessage[nFileIndex], &dwResult ); -- ==================================================================================================================== + &dwResult 0x000000acc445d874 {0x00000000} unsigned long * + m_aZoneTransferMessage 0x000000acc3d3f138 {0x0000000000000000 , 0x0000000000000000 , 0x000000acc3d4d250 {m_stDnsHeader=...}, ...} CDnsMessageWB *[0x00000020] + m_aZoneTransferMessage[nFileIndex] 0x000000acc3d4d250 {m_stDnsHeader={Xid=0x0003 RecursionDesired=0x01 '\x1' Truncation=0x00 '\0' ...} ...} CDnsMessageWB * nFileIndex 0x00000002 int + pFlowContext 0x000000acc3d39f70 {pThis=0xffffe00078c60050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} ...} _FLOW_DATA * - this 0x000000acc3d39ad0 {m_pDnsServerAppID=0x000000acc3d41730 {size=0x00000062 data=0x000000acc3d41740 "\\" } ...} CDnsStateThread * + CWinThread {m_pMainWnd=0x0000000000000000 m_pActiveWnd=0x0000000000000000 m_bAutoDelete=0x00000000 ...} CWinThread + m_pDnsServerAppID 0x000000acc3d41730 {size=0x00000062 data=0x000000acc3d41740 "\\" } FWP_BYTE_BLOB_ * m_nRetCode 0x00000000 int m_hWfpEngineHandle 0x000000acc3d48f60 void * m_nAleFlowEstablishedCalloutId 0x00000129 unsigned int m_nAleFlowEstablishedV6CalloutId 0x0000012a unsigned int m_nStreamCalloutId 0x0000012b unsigned int m_nStreamV6CalloutId 0x0000012c unsigned int m_nDatagramsCalloutId 0x0000012d unsigned int m_nDatagramsV6CalloutId 0x0000012e unsigned int m_nAleFlowEstablishedFilterID 0x0000000000012487 unsigned __int64 m_nAleFlowEstablishedV6FilterID 0x0000000000012488 unsigned __int64 m_nStreamFilterID 0x0000000000012489 unsigned __int64 m_nStreamV6FilterID 0x000000000001248a unsigned __int64 m_nDatagramDataFilterID 0x000000000001248b unsigned __int64 m_nDatagramV6DataFilterID 0x000000000001248c unsigned __int64 m_hDnsFirewallDevice 0x000000000000022c void * - m_aFowContextArray 0x000000acc3d39bc0 {{pThis=0xffffe00079185050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} ...}, ...} _FLOW_DATA[0x00000020] - [0x00000000] {pThis=0xffffe00079185050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} nFileIndex=...} _FLOW_DATA + pThis 0xffffe00079185050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} _FLOW_DATA * nFileIndex 0x00000000 int + listEntry {Flink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } } _LIST_ENTRY + threadListEntry {Flink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } } _LIST_ENTRY + wdfFlowFileObject 0x00001fff87f68f28 {unused=??? } WDFFILEOBJECT__ * + wdfFlowQueue 0x00001fff85d393d8 {unused=??? } WDFQUEUE__ * + wdfWaitFlowDoneQueue 0x00001fff8785cd18 {unused=??? } WDFQUEUE__ * + wdfWaitUdpQuery2Queue 0x00001fff8531f3d8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpSetFirewallFilterQueue 0x00001fff8513f3d8 {unused=??? } WDFQUEUE__ * + wdfWaitDnsQueryQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQuery2PermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpNewMessageQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpResponceQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryInjectQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponcePermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponceInjectQueue 0x0000000000000000 WDFQUEUE__ * enIpProto IPPROTO_TCP (0x00000006) IPPROTO nRemoteAddressV4 0x5bd91501 unsigned int nRemoteAddressV4N 0x0115d95b unsigned int usRemotePort 0xd784 unsigned short flowHandle 0x0000000000002ea6 unsigned __int64 enContextState csTcpWaitReadResponce (0x0000002c) _context_state - arContextStateStack 0x000000acc3d39c7c {csTcpWaitReadResponce (0x0000002c), csTcpReplaceQueryDone (0x0000002b), csTcpWaitReplaceQueryDone (0x0000002a), ...} _context_state[0x00000010] [0x00000000] csTcpWaitReadResponce (0x0000002c) _context_state [0x00000001] csTcpReplaceQueryDone (0x0000002b) _context_state [0x00000002] csTcpWaitReplaceQueryDone (0x0000002a) _context_state [0x00000003] csTcpReplaceQueryPended (0x00000029) _context_state [0x00000004] csTcpWaitReplaceQuery (0x00000023) _context_state [0x00000005] csTcpWaitResponceStarted (0x00000022) _context_state [0x00000006] csTcpWaitApprovalQuery (0x00000021) _context_state [0x00000007] csTcpWaitReadQuery (0x00000020) _context_state [0x00000008] csTcpQueryMoreData01 (0x0000001e) _context_state [0x00000009] csTcpFlowEstablished (0x0000001d) _context_state [0x0000000a] csWaitQueryStarted (0x00000004) _context_state [0x0000000b] csUdpWaitSetFilterStarted (0x00000003) _context_state [0x0000000c] csUdpWaitQuery2Started (0x00000002) _context_state [0x0000000d] csWaitFlowDoneStarted (0x00000001) _context_state [0x0000000e] csNotRun (0x00000000) _context_state [0x0000000f] csNotRun (0x00000000) _context_state + stRemoteAddressV6 {byteArray16=0x000000acc3d39cbc "" } FWP_BYTE_ARRAY16_ enPacketDirection FWP_DIRECTION_OUTBOUND (0x00000000) FWP_DIRECTION_ pUdpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQueryCloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2BufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2CloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpResponceBufferList 0xffffe00077f7c030 {...} _NET_BUFFER_LIST * pTcpResponceInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryMdl 0x0000000000000000 _MDL * pTcpResponceMdl 0x0000000000000000 _MDL * ulUdpQueryIpHeaderSize 0x00000000 unsigned int ulUdpQuery2IpHeaderSize 0x00000000 unsigned int ulUdpQueryTransportHeaderSize 0x00000000 unsigned int ulUdpQuery2TransportHeaderSize 0x00000000 unsigned int ulUdpQueryBufferSize 0x00000000 unsigned int ulUdpQueryDataOffset 0x00000000 unsigned int ulUdpQueryPacketOffset 0x00000000 unsigned int ulUdpQueryDataLength 0x00000000 unsigned int ulUdpQuery2BufferSize 0x00000000 unsigned int ulUdpQuery2DataOffset 0x00000000 unsigned int ulUdpQuery2PacketOffset 0x00000000 unsigned int ulUdpQuery2DataLength 0x00000000 unsigned int enUdpQueryCompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID enUdpQuery2CompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID interfaceIndex 0x00000000 unsigned long subInterfaceIndex 0x00000000 unsigned long hTcpQueryFlowID 0x0000000000002ea6 unsigned __int64 hTcpResponceFlowID 0x0000000000002ea6 unsigned __int64 nTcpQueryLength 0x0000000000000050 unsigned __int64 nTcpQueryInjectDataSize 0x0000000000000000 unsigned __int64 nTcpResponceLength 0x00000000000000e4 unsigned __int64 nTcpResponceInjectDataSize 0x0000000000000000 unsigned __int64 bIPv6 0x00 '\0' unsigned char bQuery2Pended 0x00 '\0' unsigned char bFilterGhangePended 0x00 '\0' unsigned char bUdpFlow1Done 0x00 '\0' unsigned char - [0x00000001] {pThis=0xffffe00078e6d050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} nFileIndex=...} _FLOW_DATA + pThis 0xffffe00078e6d050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} _FLOW_DATA * nFileIndex 0x00000001 int + listEntry {Flink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } } _LIST_ENTRY + threadListEntry {Flink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } } _LIST_ENTRY + wdfFlowFileObject 0x00001fff875d7fd8 {unused=??? } WDFFILEOBJECT__ * + wdfFlowQueue 0x00001fff884f85b8 {unused=??? } WDFQUEUE__ * + wdfWaitFlowDoneQueue 0x00001fff87b663d8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpQuery2Queue 0x00001fff878c23d8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpSetFirewallFilterQueue 0x00001fff867d3648 {unused=??? } WDFQUEUE__ * + wdfWaitDnsQueryQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQuery2PermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpNewMessageQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpResponceQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryInjectQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponcePermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponceInjectQueue 0x0000000000000000 WDFQUEUE__ * enIpProto IPPROTO_TCP (0x00000006) IPPROTO nRemoteAddressV4 0x5bd91501 unsigned int nRemoteAddressV4N 0x0115d95b unsigned int usRemotePort 0xd882 unsigned short flowHandle 0x0000000000002ea7 unsigned __int64 enContextState csTcpWaitReadResponce (0x0000002c) _context_state - arContextStateStack 0x000000acc3d39e54 {csTcpWaitReadResponce (0x0000002c), csTcpPermitQueryDone (0x00000027), csTcpPermitQueryDone (0x00000027), ...} _context_state[0x00000010] [0x00000000] csTcpWaitReadResponce (0x0000002c) _context_state [0x00000001] csTcpPermitQueryDone (0x00000027) _context_state [0x00000002] csTcpPermitQueryDone (0x00000027) _context_state [0x00000003] csTcpWaitPermitQuery (0x00000026) _context_state [0x00000004] csTcpPermitQueryPended (0x00000025) _context_state [0x00000005] csTcpWaitResponceStarted (0x00000022) _context_state [0x00000006] csTcpWaitApprovalQuery (0x00000021) _context_state [0x00000007] csTcpWaitReadQuery (0x00000020) _context_state [0x00000008] csTcpQueryMoreData01 (0x0000001e) _context_state [0x00000009] csTcpFlowEstablished (0x0000001d) _context_state [0x0000000a] csWaitQueryStarted (0x00000004) _context_state [0x0000000b] csUdpWaitSetFilterStarted (0x00000003) _context_state [0x0000000c] csUdpWaitQuery2Started (0x00000002) _context_state [0x0000000d] csWaitFlowDoneStarted (0x00000001) _context_state [0x0000000e] csNotRun (0x00000000) _context_state [0x0000000f] csNotRun (0x00000000) _context_state + stRemoteAddressV6 {byteArray16=0x000000acc3d39e94 "" } FWP_BYTE_ARRAY16_ enPacketDirection FWP_DIRECTION_OUTBOUND (0x00000000) FWP_DIRECTION_ pUdpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQueryCloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2BufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2CloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpResponceBufferList 0xffffe000784aadf0 {...} _NET_BUFFER_LIST * pTcpResponceInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryMdl 0x0000000000000000 _MDL * pTcpResponceMdl 0x0000000000000000 _MDL * ulUdpQueryIpHeaderSize 0x00000000 unsigned int ulUdpQuery2IpHeaderSize 0x00000000 unsigned int ulUdpQueryTransportHeaderSize 0x00000000 unsigned int ulUdpQuery2TransportHeaderSize 0x00000000 unsigned int ulUdpQueryBufferSize 0x00000000 unsigned int ulUdpQueryDataOffset 0x00000000 unsigned int ulUdpQueryPacketOffset 0x00000000 unsigned int ulUdpQueryDataLength 0x00000000 unsigned int ulUdpQuery2BufferSize 0x00000000 unsigned int ulUdpQuery2DataOffset 0x00000000 unsigned int ulUdpQuery2PacketOffset 0x00000000 unsigned int ulUdpQuery2DataLength 0x00000000 unsigned int enUdpQueryCompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID enUdpQuery2CompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID interfaceIndex 0x00000000 unsigned long subInterfaceIndex 0x00000000 unsigned long hTcpQueryFlowID 0x0000000000000000 unsigned __int64 hTcpResponceFlowID 0x0000000000002ea7 unsigned __int64 nTcpQueryLength 0x000000000000001c unsigned __int64 nTcpQueryInjectDataSize 0x0000000000000000 unsigned __int64 nTcpResponceLength 0x00000000000000e4 unsigned __int64 nTcpResponceInjectDataSize 0x0000000000000000 unsigned __int64 bIPv6 0x00 '\0' unsigned char bQuery2Pended 0x00 '\0' unsigned char bFilterGhangePended 0x00 '\0' unsigned char bUdpFlow1Done 0x00 '\0' unsigned char - [0x00000002] {pThis=0xffffe00078c60050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} nFileIndex=...} _FLOW_DATA + pThis 0xffffe00078c60050 {pThis=??? nFileIndex=??? listEntry={Flink=??? Blink=??? } ...} _FLOW_DATA * nFileIndex 0x00000002 int + listEntry {Flink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5f0 {Flink=??? Blink=??? } } _LIST_ENTRY + threadListEntry {Flink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } Blink=0xfffff801cd3ef5e0 {Flink=??? Blink=??? } } _LIST_ENTRY + wdfFlowFileObject 0x00001fff863d6fd8 {unused=??? } WDFFILEOBJECT__ * + wdfFlowQueue 0x00001fff84b003d8 {unused=??? } WDFQUEUE__ * + wdfWaitFlowDoneQueue 0x00001fff87807fd8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpQuery2Queue 0x00001fff857c03d8 {unused=??? } WDFQUEUE__ * + wdfWaitUdpSetFirewallFilterQueue 0x00001fff86447e48 {unused=??? } WDFQUEUE__ * + wdfWaitDnsQueryQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfUdpQuery2PermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpNewMessageQueue 0x0000000000000000 WDFQUEUE__ * + wdfWaitTcpResponceQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryPermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpQueryInjectQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponcePermitQueue 0x0000000000000000 WDFQUEUE__ * + wdfTcpResponceInjectQueue 0x0000000000000000 WDFQUEUE__ * enIpProto IPPROTO_TCP (0x00000006) IPPROTO nRemoteAddressV4 0x5f38e252 unsigned int nRemoteAddressV4N 0x52e2385f unsigned int usRemotePort 0x57ab unsigned short flowHandle 0x0000000000002eae unsigned __int64 enContextState csTcpWaitReadResponce (0x0000002c) _context_state - arContextStateStack 0x000000acc3d3a02c {csTcpWaitReadResponce (0x0000002c), csTcpPermitQueryDone (0x00000027), csTcpPermitQueryDone (0x00000027), ...} _context_state[0x00000010] [0x00000000] csTcpWaitReadResponce (0x0000002c) _context_state [0x00000001] csTcpPermitQueryDone (0x00000027) _context_state [0x00000002] csTcpPermitQueryDone (0x00000027) _context_state [0x00000003] csTcpWaitPermitQuery (0x00000026) _context_state [0x00000004] csTcpPermitQueryPended (0x00000025) _context_state [0x00000005] csTcpWaitResponceStarted (0x00000022) _context_state [0x00000006] csTcpWaitApprovalQuery (0x00000021) _context_state [0x00000007] csTcpWaitReadQuery (0x00000020) _context_state [0x00000008] csTcpQueryMoreData01 (0x0000001e) _context_state [0x00000009] csTcpFlowEstablished (0x0000001d) _context_state [0x0000000a] csWaitQueryStarted (0x00000004) _context_state [0x0000000b] csUdpWaitSetFilterStarted (0x00000003) _context_state [0x0000000c] csUdpWaitQuery2Started (0x00000002) _context_state [0x0000000d] csWaitFlowDoneStarted (0x00000001) _context_state [0x0000000e] csNotRun (0x00000000) _context_state [0x0000000f] csNotRun (0x00000000) _context_state + stRemoteAddressV6 {byteArray16=0x000000acc3d3a06c "" } FWP_BYTE_ARRAY16_ enPacketDirection FWP_DIRECTION_OUTBOUND (0x00000000) FWP_DIRECTION_ pUdpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQueryCloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2BufferList 0x0000000000000000 _NET_BUFFER_LIST * pUdpQuery2CloneBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpResponceBufferList 0xffffe00078ccb400 {...} _NET_BUFFER_LIST * pTcpResponceInjectBufferList 0x0000000000000000 _NET_BUFFER_LIST * pTcpQueryMdl 0x0000000000000000 _MDL * pTcpResponceMdl 0x0000000000000000 _MDL * ulUdpQueryIpHeaderSize 0x00000000 unsigned int ulUdpQuery2IpHeaderSize 0x00000000 unsigned int ulUdpQueryTransportHeaderSize 0x00000000 unsigned int ulUdpQuery2TransportHeaderSize 0x00000000 unsigned int ulUdpQueryBufferSize 0x00000000 unsigned int ulUdpQueryDataOffset 0x00000000 unsigned int ulUdpQueryPacketOffset 0x00000000 unsigned int ulUdpQueryDataLength 0x00000000 unsigned int ulUdpQuery2BufferSize 0x00000000 unsigned int ulUdpQuery2DataOffset 0x00000000 unsigned int ulUdpQuery2PacketOffset 0x00000000 unsigned int ulUdpQuery2DataLength 0x00000000 unsigned int enUdpQueryCompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID enUdpQuery2CompartmentID UNSPECIFIED_COMPARTMENT_ID (0x00000000) COMPARTMENT_ID interfaceIndex 0x00000000 unsigned long subInterfaceIndex 0x00000000 unsigned long hTcpQueryFlowID 0x0000000000000000 unsigned __int64 hTcpResponceFlowID 0x0000000000002eae unsigned __int64 nTcpQueryLength 0x000000000000001e unsigned __int64 nTcpQueryInjectDataSize 0x0000000000000000 unsigned __int64 nTcpResponceLength 0x0000000000001635 unsigned __int64 nTcpResponceInjectDataSize 0x0000000000000000 unsigned __int64 bIPv6 0x00 '\0' unsigned char bQuery2Pended 0x00 '\0' unsigned char bFilterGhangePended 0x00 '\0' unsigned char bUdpFlow1Done 0x00 '\0' unsigned char + [0x00000003] {pThis=0x0000000000000000 nFileIndex=0x00000003 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000004] {pThis=0x0000000000000000 nFileIndex=0x00000004 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000005] {pThis=0x0000000000000000 nFileIndex=0x00000005 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000006] {pThis=0x0000000000000000 nFileIndex=0x00000006 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000007] {pThis=0x0000000000000000 nFileIndex=0x00000007 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000008] {pThis=0x0000000000000000 nFileIndex=0x00000008 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000009] {pThis=0x0000000000000000 nFileIndex=0x00000009 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000a] {pThis=0x0000000000000000 nFileIndex=0x0000000a listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000b] {pThis=0x0000000000000000 nFileIndex=0x0000000b listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000c] {pThis=0x0000000000000000 nFileIndex=0x0000000c listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000d] {pThis=0x0000000000000000 nFileIndex=0x0000000d listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000e] {pThis=0x0000000000000000 nFileIndex=0x0000000e listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000000f] {pThis=0x0000000000000000 nFileIndex=0x0000000f listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000010] {pThis=0x0000000000000000 nFileIndex=0x00000010 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000011] {pThis=0x0000000000000000 nFileIndex=0x00000011 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000012] {pThis=0x0000000000000000 nFileIndex=0x00000012 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000013] {pThis=0x0000000000000000 nFileIndex=0x00000013 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000014] {pThis=0x0000000000000000 nFileIndex=0x00000014 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000015] {pThis=0x0000000000000000 nFileIndex=0x00000015 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000016] {pThis=0x0000000000000000 nFileIndex=0x00000016 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000017] {pThis=0x0000000000000000 nFileIndex=0x00000017 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000018] {pThis=0x0000000000000000 nFileIndex=0x00000018 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x00000019] {pThis=0x0000000000000000 nFileIndex=0x00000019 listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001a] {pThis=0x0000000000000000 nFileIndex=0x0000001a listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001b] {pThis=0x0000000000000000 nFileIndex=0x0000001b listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001c] {pThis=0x0000000000000000 nFileIndex=0x0000001c listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001d] {pThis=0x0000000000000000 nFileIndex=0x0000001d listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001e] {pThis=0x0000000000000000 nFileIndex=0x0000001e listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + [0x0000001f] {pThis=0x0000000000000000 nFileIndex=0x0000001f listEntry={Flink=0x0000000000000000 Blink=...} ...} _FLOW_DATA + m_aFileHandleArray 0x000000acc3d3d6c0 {0x0000000000000230, 0x0000000000000234, 0x0000000000000238, 0x000000000000023c, ...} void *[0x00000020] m_hIoCompletionPort 0x00000000000002b0 void * + m_aWaitFlowDoneOverlapedArray 0x000000acc3d3d7c8 {{Internal=0x0000000000000103 InternalHigh=0x0000000000000000 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_aWaitDnsQueryOverlapedArray 0x000000acc3d3dbc8 {{Internal=0x0000000000000103 InternalHigh=0x0000000000000000 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_aWaitUdpQuery2OverlappedArray 0x000000acc3d3dfc8 {{Internal=0x0000000000000103 InternalHigh=0x0000000000000000 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_aWaitUdpSetFilterOverlappedArray 0x000000acc3d3e3c8 {{Internal=0x0000000000000103 InternalHigh=0x0000000000000000 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_oTimerArray {...} std::unordered_map,std::equal_to,std::allocator > > + m_aDnsQueryMessage 0x000000acc3d3e818 {0x0000000000000000 , 0x0000000000000000 , 0x0000000000000000 , ...} CDnsMessageWB *[0x00000020] + m_aAbortedQuery 0x000000acc3d3e918 {false, false, false, false, false, false, false, false, false, false, false, false, ...} bool[0x00000020] + m_aWaitTcpResponceOverlapped 0x000000acc3d3e938 {{Internal=0x0000000000000000 InternalHigh=0x00000000000001d8 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] + m_aWaitTcpNewMessageOverlapped 0x000000acc3d3ed38 {{Internal=0x00000000c0000011 InternalHigh=0x0000000000000000 Offset=0x00000000 ...}, ...} _OVERLAPPED[0x00000020] -- ==================================================================================================================== delete pDnsMessage; m_aZoneTransferMessage[nFileIndex] = NULL; if (!bSuccessfull) { if (ERROR_HANDLE_EOF == dwResult) { TraceEvents( TRACE_LEVEL_WARNING, TRACE_DNS_STATE_THREAD, "%!FUNC! line:%!LINE! %!LEVEL! Response message transfer DNS zone unexpectedly Terminated. IP address = \"%ws\"; nFileIndex = %d; nFileQEntryIndex = %d;", szIpAddress, nFileIndex, nFileQEntryIndex ); continue; } if (ERROR_CANCELLED == dwResult) { TraceEvents( TRACE_LEVEL_WARNING, ... -- --------------------------------------------------------------------------------------------------------------------