un wrapper entre services.exe et termsrv.dll
https://github.com/stascorp/rdpwrap
-------------------------------------- Questions sur le debugage
windbg -y srv*http://msdl.microsoft.com/download/symbols
Comment voir les info de debugage avec windbg ??? visibles dans ETW (eventvwr log windows terminalService...)
	call    ?_DbgPrintMessage@@YAXHPEBDZZ ; _DbgPrintMessage(int,char const *,...)
		avec ETW après avoir configuré qq   ch ??
			?g_DebugSpewTraceLevel@@3KA dd 0BAh  --> ff pour tout logger test
			voir peut être :    
				?g_DebugTraceComponent@@3KA dd 0FFFFFFFEh
				cmp     cs:?g_bEnabled@CTraceBase@@0HA, 0 ; int CTraceBase::g_bEnabled
				cmp     cs:g_DbgTraceFunction, 0
		voir aussi :
			call    ?IsTraceEnabled@CTraceBase@@KAJPEAH@Z ; CTraceBase::IsTraceEnabled(int *)
				"System\CurrentControlSet\Control\Terminal Server"
"				"EnableTraceCorrelation"
					mov     ecx, cs:?g_bEnabled@CTraceBase@@0HA ; int CTraceBase::g_bEnabled
					cmp     [rsp+38h+Type], 4
					cmovz   ecx, dword ptr [rsp+38h+Data]
					mov     cs:?g_bEnabled@CTraceBase@@0HA, ecx ; int CTraceBase::g_bEnabled
	call    cs:__imp_DbgPrint	
---------------------------------------- Le principe du wrapper, 3 parties : 
	installation/hook/injection des modifications ---------> c'est du code
	mise à disposition des modifications selon la version --> un fichier txt
	analyse du code pour découvrir les points à modifier  --> un minimum de doc ( txt, forum, youtube )
---------------------------------------- ne pas oublier la mise en oeuvre de termservice
ouvrir le port dans le firewall
et d'autres choses que je ne connais pas !!!
---------------------------------------- le principe du hook utilisé avec CSLQuery::Initialize
Le wrapper remplace les premiers octets de cette fonction par du code simple pour appeler "la sienne".
J'avais oublié la méthode :
	mov rax, ptr_fct
	push rax
	ret
et le pointeur de pile est correct pour le prochain "ret"
---------------------------------------- les 4 patchs du wrapper pour version 1709 : 
; Patch CEnforcementCore::GetInstanceOfTSLicense
; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
; Patch CDefPolicy::Query
; Hook CSLQuery::Initialize
les trois premiers assurent le test des conditions relatives à la version qui autorise l'emploi de termservice
le dernier modifie les variables des divers paramètres limitant l'emploi de termservice et lues dans la clé "policy"

Question : Comment peut on trouver ce qu'il convient de patcher ?

---------------------------------------- CSLQuery::Initialize(void)
CSLQuery::Initialize(void)
 

-------------------------------------------- les modif pour [10.0.16299.15]
[10.0.16299.15]
; Patch CEnforcementCore::GetInstanceOfTSLicense
LocalOnlyPatch.x86=1
LocalOnlyOffset.x86=A8E08
LocalOnlyCode.x86=jmpshort
LocalOnlyPatch.x64=1
LocalOnlyOffset.x64=8FD01
LocalOnlyCode.x64=jmpshort
; Patch CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
SingleUserPatch.x86=1
SingleUserOffset.x86=39215
SingleUserCode.x86=nop
SingleUserPatch.x64=1
SingleUserOffset.x64=1C774
SingleUserCode.x64=Zero
; Patch CDefPolicy::Query
DefPolicyPatch.x86=1
DefPolicyOffset.x86=3DC89
DefPolicyCode.x86=CDefPolicy_Query_eax_ecx
DefPolicyPatch.x64=1
DefPolicyOffset.x64=12D85  ------------------------> correspond à ce que je lis avec ida pour cette version
DefPolicyCode.x64=CDefPolicy_Query_eax_rcx
; Hook CSLQuery::Initialize
SLInitHook.x86=1
SLInitOffset.x86=461BD
SLInitFunc.x86=New_CSLQuery_Initialize
SLInitHook.x64=1
SLInitOffset.x64=22D5C
SLInitFunc.x64=New_CSLQuery_Initialize
---------------------------------------- CDefPolicy::Query : 
CDefPolicy::Query(CDefPolicy *__hidden this, int *)
	il injecte le code suivant pour la version [10.0.14393.0] : Mais pourquoi mettre 100h dans ce ptr ? le test aurait il lieu dans d'autres fct appelantes ?
		CDefPolicy_Query_eax_rcx=B80001000089813806000090 
		mov     eax, 100h
		mov     [rcx+638h], eax
		nop
---------------------------------------------------------------------------termsrv!CDefPolicy::Query
.text:0000000180012D70 ; =============== S U B R O U T I N E =======================================
.text:0000000180012D70
.text:0000000180012D70
.text:0000000180012D70 ; __int64 __fastcall CDefPolicy::Query(CDefPolicy *__hidden this, int *)
.text:0000000180012D70 ?Query@CDefPolicy@@UEAAJPEAH@Z proc near
.text:0000000180012D70                                         ; CODE XREF: CEnfPolicyManager::QueryPolicy(_GUID,int *,int *)+88?p
.text:0000000180012D70                                         ; DATA XREF: CEnfPolicyManager::QueryPolicy(_GUID,int *,int *)+72?o ...
.text:0000000180012D70
.text:0000000180012D70 ; FUNCTION CHUNK AT .text:000000018003AB42 SIZE 0000001C BYTES
.text:0000000180012D70
.text:0000000180012D70                 sub     rsp, 28h
.text:0000000180012D74                 mov     eax, [rcx+644h] -->>  = 1 si >2 licenses 
.text:0000000180012D7A                 xor     r8d, r8d
.text:0000000180012D7D                 mov     [rdx], eax ------------->> le second param de l'appelant est renseigné
.text:0000000180012D7F                 mov     eax, [rcx+638h]  --> le nombre de licenses
.text:0000000180012D85                 cmp     [rcx+63Ch], eax  --> cmp like a sub! 
.text:0000000180012D8B                 jz      loc_18003AB42   ---> so if [rcx+638h]=[rcx+63Ch] then jump to error msg
	cmp     [rcx+63Ch], eax = 39 81 3C 06 00 00 = <bh:39><bh:81><bh:3c><bh:06><bh:06><bh:00>  
	jz      loc_18003AB42   = 0F 84 B1 7D 02 00 = <bh:0f><bh:84><bh:b1><bh:7d><bh:02><bh:00> dans l'éditeur binaire frHed.exe à offet 1218B : bizarre la différence d'offset de C00h qui provient des en-têtes du format PE
.text:0000000180012D91
.text:0000000180012D91 loc_180012D91:                          ; CODE XREF: CDefPolicy::Query(int *)+27DE9?j
.text:0000000180012D91                 mov     eax, r8d -----> 0 = license OK
.text:0000000180012D94                 add     rsp, 28h
.text:0000000180012D98                 retn
.text:0000000180012D98 ?Query@CDefPolicy@@UEAAJPEAH@Z endp
.text:000000018003AB42 ; START OF FUNCTION CHUNK FOR ?Query@CDefPolicy@@UEAAJPEAH@Z
.text:000000018003AB42
.text:000000018003AB42 loc_18003AB42:                          ; CODE XREF: CDefPolicy::Query(int *)+1B?j
.text:000000018003AB42                                         ; DATA XREF: .pdata:00000001800F182C?o ...
.text:000000018003AB42                 lea     rdx, aCdefpolicyQuer ; "CDefPolicy::Query FAILED - License not available"...
.text:000000018003AB49                 mov     ecx, 8          ; int
.text:000000018003AB4E                 call    ?_DbgPrintMessage@@YAXHPEBDZZ ; _DbgPrintMessage(int,char const *,...)
.text:000000018003AB53                 mov     r8d, 0D00A0013h --------------> - License not available
.text:000000018003AB59                 jmp     loc_180012D91

-----------------------------------------CEnforcementCore::GetInstanceOfTSLicense
.text:000000018008FCEB loc_18008FCEB:                          ; CODE XREF: CEnforcementCore::GetInstanceOfTSLicense(_GUID &,ITSLicense * *)+30?j
.text:000000018008FCEB                 lea     rdx, [rsp+48h+arg_18] ; int *
.text:000000018008FCF0                 mov     rcx, rsi        ; struct _GUID *
.text:000000018008FCF3                 call    ?IsLicenseTypeLocalOnly@CSLQuery@@SAJAEAU_GUID@@PEAH@Z ; CSLQuery::IsLicenseTypeLocalOnly(_GUID &,int *)
.text:000000018008FCF8                 test    eax, eax
.text:000000018008FCFA                 js      short loc_18008FD1B
.text:000000018008FCFC                 cmp     [rsp+48h+arg_18], 0
.text:000000018008FD01                 jz      short loc_18008FD1B  -> devient jmp ( EB )
.text:000000018008FD03                 lea     rdx, aCenforcementco_0 ; "CEnforcementCore::GetInstanceOfTSLicens"...erreur car local only !
.text:000000018008FD0A                 mov     ecx, 8          ; int
.text:000000018008FD0F                 mov     ebx, 80070005h
.text:000000018008FD14                 call    ?_DbgPrintMessage@@YAXHPEBDZZ ; _DbgPrintMessage(int,char const *,...)
.text:000000018008FD19                 jmp     short loc_18008FD63
IsLicenseTypeLocalOnly teste la "policy"
	TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly
---------------------------------------CSessionArbitrationHelper::IsSingleSessionPerUserEnabled
.text:000000018001C730                 mov     [rsp-8+arg_0], rbx
.text:000000018001C735                 mov     [rsp-8+arg_10], rsi
.text:000000018001C73A                 push    rbp
.text:000000018001C73B                 push    rdi
.text:000000018001C73C                 push    r14
.text:000000018001C73E                 lea     rbp, [rsp-90h]
.text:000000018001C746                 sub     rsp, 190h
.text:000000018001C74D                 mov     rax, cs:__security_cookie
.text:000000018001C754                 xor     rax, rsp
.text:000000018001C757                 mov     [rbp+0A0h+var_20], rax
.text:000000018001C761                 lea     rcx, [rsp+1A0h+VersionInformation.dwMajorVersion] ; Dst
.text:000000018001C766                 xor     edx, edx        ; Val
.text:000000018001C768                 mov     r8d, 118h       ; Size
.text:000000018001C76E                 call    memset_0
.text:000000018001C773                 mov     ebx, 1          ; mis à zero par le wrapper
.text:000000018001C778                 mov     [rsp+1A0h+VersionInformation.dwOSVersionInfoSize], 11Ch
.text:000000018001C780                 lea     rcx, [rsp+1A0h+VersionInformation] ; lpVersionInformation
.text:000000018001C785                 mov     [rsi], ebx
.text:000000018001C787                 call    cs:__imp_GetVersionExW
.text:000000018001C78D                 xor     edi, edi
.text:000000018001C78F                 test    eax, eax
.text:000000018001C791                 jz      short loc_18001C79C
.text:000000018001C793                 cmp     [rbp+0A0h+var_26], bl ; ??? wSuiteMask ou wProductType
.text:000000018001C796                 jnz     loc_18003E55E --------> saut si ok
.text:000000018001C79C
.text:000000018001C79C loc_18001C79C:                          ; CODE XREF: CSessionArbitrationHelper::IsSingleSessionPerUserEnabled(int *)+61?j
.text:000000018001C79C                 mov     [rsi], ebx
.text:000000018001C79E                 mov     ebx, edi
.text:000000018001C7A0
.text:000000018001C7A0 loc_18001C7A0:                          ; CODE XREF: CSessionArbitrationHelper::IsSingleSessionPerUserEnabled(int *)+21F21?j
.text:000000018001C7A0                 cmp     ebx, 80070002h

"Software\Policies\Microsoft\Windows NT\Terminal Server\fSingleSessionPerUser"
"System\CurrentControlSet\Control\Terminal Server\fSingleSessionPerUser"

------------------------------------ tentative de suivi du démarrage
public ?ServiceMain@@YAXKPEAPEAG@Z
?ServiceMain@@YAXKPEAPEAG@Z proc near
jmp     ?Start@CService@@QEAAJXZ ; CService::Start(void)
?ServiceMain@@YAXKPEAPEAG@Z endp
----------------------------------------
; __int64 __fastcall CService::Start(CService *__hidden this)
?Start@CService@@QEAAJXZ proc near
	initialisation des structures relatives WPP_MAIN_CB 
	Enregistrement des providers ETW (pour les fichiers .etl) avec EtwRegisterTraceGuidsW
	call    ?UpdateServiceStatus@CService@@IEAAHKKKK@Z ; CService::UpdateServiceStatus(ulong,ulong,ulong,ulong)
		call    cs:__imp_SetServiceStatus ( retour EAX = 0 si error )
	call    ?Initialize@CUtils@@SAJXZ ; CUtils::Initialize(void)
		call    ?CreateSystemSid@CUtils@@SAJPEAPEAX@Z ; CUtils::CreateSystemSid(void * *)
		call    ?CreateAdminSid@CUtils@@SAJPEAPEAX@Z ; CUtils::CreateAdminSid(void * *)
		call    NtCreateAnonymousSid
		call    ?CreateNetworkServiceSid@CUtils@@SAJPEAPEAX@Z ; CUtils::CreateNetworkServiceSid(void * *)
		call    ?CreateNetworkServiceSid@CUtils@@SAJPEAPEAX@Z ; CUtils::CreateNetworkServiceSid(void * *)
		call    NtCreateRdsMsSid
		call    ?CreateAppContainerSid@CUtils@@SAJPEAPEAX@Z ; CUtils::CreateAppContainerSid(void * *)
		call    ?CreateLPACCapabilitySid@CUtils@@SAJPEAPEAX@Z ; CUtils::CreateLPACCapabilitySid(void * *)
		call    RtlVerifyVersionInfo
		mov     cs:?bIsClientSKU@CUtils@@0HA, edx ; int CUtils::bIsClientSKU
		mov     cs:?g_pObjectTracker@@3PEAVCObjectTracker@@EA, rdi ; CObjectTracker * g_pObjectTracker
		lea     rcx, [rdi+18h]  ; this
		call    ?Initialize@CResource@@QEAAJXZ ; CResource::Initialize(void)
		call    cs:__imp_CreateTimerQueue
		mov     cs:?g_OpsMonitorTimeQueue@COpsMonitorBase@@0PEAXEA, rax ; void * COpsMonitorBase::g_OpsMonitorTimeQueue
		ret
	call    cs:__imp_CreateEventW -> mov     cs:qword_1800ED3B8, rax
	call    cs:__imp_CreateEventW -> mov     cs:qword_1800ED3C8, rax
	call    cs:__imp_CreateEventW -> mov     cs:qword_1800ED3B0, rax
	lea     rdx, ?staticHandler@CService@@KAXK@Z ; lpHandlerProc
	lea     rcx, ?SERVICE_NAME@CService@@1QBGB ; "TermService"
	call    cs:__imp_RegisterServiceCtrlHandlerW
	mov     cs:qword_1800ED378, rax
	lea     rax, [rsp+238h+ThreadId]
	mov     r9, r15         ; lpParameter
	mov     [rsp+238h+lpThreadId], rax ; lpThreadId
	lea     r8, ?staticMiscThread@CService@@KAKPEAX@Z ; lpStartAddress ---> thread de gestion COM/DCOM
	xor     edx, edx        ; dwStackSize
	mov     [rsp+238h+dwCreationFlags], esi ; dwCreationFlags
	xor     ecx, ecx        ; lpThreadAttributes
	call    cs:__imp_CreateThread
	mov     cs:hThread, rax
	call    ?WaitForReadyMiscThread@CService@@IEAAJXZ ; CService::WaitForReadyMiscThread(void)
	call    ?InitServer@CRCMModule@@QEAAJAEAU_GUID@@@Z ; CRCMModule::InitServer(_GUID &)
	call    cs:__guard_dispatch_icall_fptr -> register StopCallBack
	call    ?UpdateServiceStatus@CService@@IEAAHKKKK@Z ; CService::UpdateServiceStatus(ulong,ulong,ulong,ulong)
	mov     rcx, r15        ; this
	call    ?Advertise@CService@@IEAAJH@Z ; CService::Advertise(int)
	mov     ecx, 202h       ; wVersionRequested
	lea     rdx, [rsp+238h+WSAData] ; lpWSAData
	call    cs:__imp_WSAStartup
	test    ebx, ebx
	call    ?Shutdown@CService@@IEAAXXZ ; CService::Shutdown(void)
	ret
---------------
; DWORD __stdcall CService::staticMiscThread(LPVOID lpThreadParameter)
?staticMiscThread@CService@@KAKPEAX@Z proc near
	call    cs:__imp_CoInitializeEx
	call    cs:__imp_SetEvent 
	call    cs:__imp_WaitForSingleObject
	call    ??4?$SmartPtr@VCRemoteConnectionManagerSink@CRemoteConnectionManager
***création de l'objet principal COM/DCOM !!!
	lea     r9, [rbp+pUnk]  ; void **
	lea     rdx, CLSID_RemoteConnectionManager ; struct _GUID *  {0F9A874B6-F8A8-4D73-B5A8610816828B} ??? clsid non trouvée ???
	call    ?AtlComModuleGetClassObject@ATL@@YAJPEAU_ATL_COM_MODULE70@1@AEBU_GUID@@1PEAPEAX@Z ; ATL::AtlComModuleGetClassObject(ATL::_ATL_COM_MODULE70 *,_GUID const &,_GUID const &,void * *)
		lea     rdx, _GUID_00000000_0000_0000_c000_000000000046
		call    ?CreateInstance@?$CComCreator@V?$CComObjectNoLock@V?$CComClassFactorySingleton@VCRemoteConnectionManager
			bouble de recherche de ....
			lea     rdx, IID_IClassFactory
			call    ?QueryInterface@?$CComObjectNoLock@V?$CComClassFactorySingleton@VCRemoteConnectionManager
				*
				* createInstance ...
				*
			ret
	mov     rcx, [rbp+pUnk]  -->>> interface Iunknow qui permet de trouver IID_IConnectionManager
	lea     r9, [rbp+arg_0]
	and     [rbp+arg_0], 0
	lea     r8, IID_IConnectionManager
	xor     edx, edx
	mov     rax, [rcx]
	mov     rax, [rax+18h]
	call    cs:__guard_dispatch_icall_fptr
	test    eax, eax
BIZARRE !!!
	call    ?ServiceStopCleanupObjects@CService@@IEAAJXZ ; CService::ServiceStopCleanupObjects(void)
	call    cs:__imp_CoUninitialize
	call    cs:__imp_ExitThread

----------------- ****************   autre objet ....
; __int64 __fastcall CDefPolicy::CDefPolicy(CDefPolicy *__hidden this, struct _GUID *__struct_ptr)
??0CDefPolicy@@QEAA@U_GUID@@@Z proc near
	call    ?GetMaxSessions@CSLQuery@@SAJU_GUID@@PEAJ@Z ; CSLQuery::GetMaxSessions(_GUID,long *)
		rcx = Uuid
		call    cs:__imp_UuidToStringW
		'TerminalServices-RemoteConnectionManager-'

---------------------- Mise en oeuvre du debuger possible avec :
La création de l'objet initial peut être ...
; __int64 __fastcall CRemoteConnectionManager::Initialize(CRemoteConnectionManager *this, struct ISessionManager *, struct ITSEventDispatcher *)
?Initialize@CRemoteConnectionManager@@UEAAJPEAUISessionManager@@PEAUITSEventDispatcher@@@Z proc near
call CUtils::DebugBreakIfAskedEx
...
; void __fastcall CUtils::DebugBreakIfAskedEx(unsigned __int16 *, unsigned __int16 *)
?DebugBreakIfAskedEx@CUtils@@SAXPEAG0@Z proc near
	"System\CurrentControlSet\Control\Terminal Server"
		Case "DebugTS" de type 4
			break
		Case "BreakOnRCMStart" de type 4
			break
	Si = 1 ou 3 ou (2 si type == 1)
		call    cs:__imp_IsDebuggerPresent   (If the current process is not running in the context of a debugger, the return value is zero.)
			si oui alors call    cs:__imp_DebugBreak
		call    ?IsKernelDebuggerAttached@CUtils@@SAHXZ ; CUtils::IsKernelDebuggerAttached(void)
			si oui alors call    cs:__imp_DebugBreak	
	Si = 2 
		call    cs:__imp_IsDebuggerPresent
		test "Debugger" 
			type != 1 
				call    cs:__imp_GetCurrentProcessId
				lea     r8, aNtsdDGXPD  ; "ntsd -d -G -x -p %d" <---- pid du host de termsrv.dll
				mov     edx, 100h       ; unsigned __int64
				mov     r9d, eax
				lea     rcx, [rbp+400h+CommandLine] ; Dest
				call    ?StringCchPrintfW@@YAJPEAG_KPEBGZZ
				call    cs:__imp_CreateProcessW (puis close handle du process et du thread de ntsd)
				boucle attente avec sleep call    cs:__imp_IsDebuggerPresent
	Si = >3 alors rien ( bizarre ! )

 __int64 CUtils::IsKernelDebuggerAttached(void)
.text:00000001800948E0 ?IsKernelDebuggerAttached@CUtils@@SAHXZ proc near
.text:00000001800948E0                                         ; CODE XREF: CUtils::DebugBreakIfAskedEx(ushort *,ushort *)+25458?p
.text:00000001800948E0                                         ; CService::ServiceStopCleanupObjects(void)+14D?p
.text:00000001800948E0                                         ; DATA XREF: ...
.text:00000001800948E0
.text:00000001800948E0 arg_0           = byte ptr  8
.text:00000001800948E0
.text:00000001800948E0                 sub     rsp, 28h
.text:00000001800948E4                 xor     r9d, r9d ----------------- 0
.text:00000001800948E7                 lea     rdx, [rsp+28h+arg_0]
.text:00000001800948EC                 lea     r8d, [r9+2] -------------- 2
.text:00000001800948F0                 lea     ecx, [r9+23h] ------------ 23h
.text:00000001800948F4                 call    cs:__imp_NtQuerySystemInformation
.text:00000001800948FA                 xor     ecx, ecx
.text:00000001800948FC                 test    eax, eax
.text:00000001800948FE                 js      short loc_18009490B
.text:0000000180094900                 cmp     [rsp+28h+arg_0], cl
.text:0000000180094904                 jz      short loc_18009490B
.text:0000000180094906                 mov     ecx, 1
.text:000000018009490B
.text:000000018009490B loc_18009490B:                          ; CODE XREF: CUtils::IsKernelDebuggerAttached(void)+1E?j
.text:000000018009490B                                         ; CUtils::IsKernelDebuggerAttached(void)+24?j
.text:000000018009490B                 mov     eax, ecx
.text:000000018009490D                 add     rsp, 28h
.text:0000000180094911                 retn
.text:0000000180094911 ?IsKernelDebuggerAttached@CUtils@@SAHXZ endp

----------------
Séquence potentielle au démarrage du service :
...
ServiceMain
création d'un objet CRemoteConnectionManager
...
reste du chemin à faire !
...
CSLQuery::IsServerSku(int *)
CSLQuery::Initialize(void)

--------------
il y a un test de license avec DoesVMNeedLicensing(void) et IsLicensingRegistrySet(ushort *,ushort *)
	'System\CurrentControlSet\Services\termservice' 
		"fForceRDVHLicensing"  type 4 data 1
qui affiche "CDefPolicy - Licensing is not required"
tester sans résultat sur ma machine "windows home"

----------------- recherche autour des variables utilisée dans CDefPolicy::Query : Rien de plus
; __int64 __fastcall CWinlogonRequest::GetFlags(CWinlogonRequest *__hidden this, unsigned int *)
?GetFlags@CWinlogonRequest@@UEAAJPEAK@Z proc near
mov     eax, [rcx+63Ch]
mov     [rdx], eax
xor     eax, eax
retn
?GetFlags@CWinlogonRequest@@UEAAJPEAK@Z endp

Les 3 variables servent pour comparer 2 objets COM avec 
; public: int CWinlogonRequest::operator==(class CWinlogonRequest &)
??8CWinlogonRequest@@QEAAHAEAV0@@Z proc near

---------- pour  NtSetSystemInformation (ntdll)
http://www.pinvoke.net/default.aspx/ntdll/NtSetSystemInformation.html
http://www.exploit-monday.com/2013/06/undocumented-ntquerysysteminformation.html

---------------GGGRRRRRRRRRRRRRRRRR
call    cs:__guard_dispatch_icall_fptr = jmp rax
------------------------------
; __int64 __fastcall CDefPolicy::CDefPolicy(CDefPolicy *__hidden this, struct _GUID *__struct_ptr)
??0CDefPolicy@@QEAA@U_GUID@@@Z proc near
.text:0000000180012C7C loc_180012C7C:                          ; CODE XREF: CDefPolicy::CDefPolicy(_GUID)+27E79?j
.text:0000000180012C7C                 lea     rax, ??_7CDefPolicy@@6B@ ; const CDefPolicy::`vftable'
.text:0000000180012C83                 xor     ebp, ebp
.text:0000000180012C85                 and     [rsp+68h+var_48], ebp --------> 0
.text:0000000180012C89                 lea     rsi, [rbx+648h]
.text:0000000180012C90                 mov     [rbx], rax
.text:0000000180012C93                 lea     r14, [rbx+650h]
.text:0000000180012C9A                 and     qword ptr [rsi], 0
.text:0000000180012C9E                 lea     rdx, [rsp+68h+var_48] ; int * -------> 0, recevra le nombre de licenses maxi du pc!
.text:0000000180012CA3                 and     qword ptr [r14], 0
.text:0000000180012CA7                 lea     rcx, [rsp+68h+var_38] ; struct _GUID
.text:0000000180012CAC                 movaps  xmm0, xmmword ptr [rdi] ---------> le UID passé en paramètre donc inconnu ici
.text:0000000180012CAF                 movdqa  xmmword ptr [rsp+68h+var_38.Data1], xmm0
.text:0000000180012CB5                 call    ?GetMaxSessions@CSLQuery@@SAJU_GUID@@PEAJ@Z ; CSLQuery::GetMaxSessions(_GUID,long *)
.text:0000000180012CBA                 test    eax, eax
.text:0000000180012CBC                 js      loc_18003AA7A ---> error dans la fct, ce qui ne renseigne pas sur la license
.text:0000000180012CC2                 mov     rax, qword ptr cs:LICENSE_TYPE_BUILTIN
.text:0000000180012CC9                 sub     rax, [rdi]
.text:0000000180012CCC                 jnz     short loc_180012CD9
.text:0000000180012CCE                 mov     rax, qword ptr cs:LICENSE_TYPE_BUILTIN+8
.text:0000000180012CD5                 sub     rax, [rdi+8]

--------------------------- dans GetMaxSessions
text:000000018001187F                 call    cs:__imp_GetModuleHandleExW
.text:0000000180011885                 test    eax, eax
.text:0000000180011887                 jz      loc_180037F4B
.text:000000018001188D                 mov     rcx, [rbp+350h+phModule] ; hModule
.text:0000000180011894                 lea     rdx, ProcName   ; "NtQuerySystemInformation"
.text:000000018001189B                 call    cs:__imp_GetProcAddress
.text:00000001800118A1                 test    rax, rax
.text:00000001800118A4                 jz      loc_180037F71
.text:00000001800118AA                 xor     r9d, r9d
.text:00000001800118AD                 lea     rdx, [rbp+350h+var_70] >>>>>> ptr buffer
.text:00000001800118B4                 lea     r8d, [r9+20h]          >>>>>> longueur
.text:00000001800118B8                 lea     ecx, [r8+66h]          >>>>>> type d'info 
.text:00000001800118BC                 call    cs:__guard_dispatch_icall_fptr ; = jmp rax
.text:00000001800118C2                 mov     ebx, eax  <<<<<<<<<<<<<<<<<<< retour de "NtQuerySystemInformation"
.text:00000001800118C4                 or      ebx, 10000000h
.text:00000001800118CA                 jl      loc_180037F7F
.text:00000001800118D0                 mov     edx, [rbp+350h+var_5C]  -------------->>>> l'info lue et momorisée
.text:00000001800118D6                 mov     dword ptr [rbp+350h+var_364+4], edx
.text:00000001800118D9
.text:00000001800118D9 loc_1800118D9:                          ; CODE XREF: .text:0000000180037F82?j
.text:00000001800118D9                 cmp     ebx, 0D0000023h --------------->>>>>>>>>>>>>< code license non valide ????
.text:00000001800118DF                 jz      loc_180037F87   --->>> error 0x8007007A
.text:00000001800118E5 loc_1800118E5:                          ; CODE XREF: .text:0000000180037F6C?j
.text:00000001800118E5                 test    ebx, ebx
.text:00000001800118E7                 js      loc_1800382EE     >>>>> bizarre
.text:00000001800118ED                 mov     [rbp+350h+Dst], rsi
.text:00000001800118F1                 cmp     edx, 4             -------------->>>> l'info lue
.text:00000001800118F4                 jb      loc_180037F91
.text:00000001800118FA                 mov     r14d, [r13+0]
.text:00000001800118FE                 lea     r12, [r13+4]
.text:0000000180011902                 cmp     r12, r13
.text:0000000180011905                 jb      loc_18003813B
.text:000000018001190B                 lea     eax, [rdx-4]
.text:000000018001190E                 cmp     eax, r14d
.text:0000000180011911                 jb      loc_180037F9B
.text:0000000180011917                 lea     r8, [r14+r12]
.text:000000018001191B                 cmp     r8, r12
.text:000000018001191E                 jb      loc_18003813B
.text:0000000180011924                 lea     ecx, [r14+4]
.text:0000000180011928                 cmp     ecx, 4
.text:000000018001192B                 jb      loc_18003813B
		ensuite très complexe !!!

----------------------------
; __int64 __fastcall CDefPolicy::CDefPolicy(CDefPolicy *__hidden this, struct _GUID *__struct_ptr)
??0CDefPolicy@@QEAA@U_GUID@@@Z proc near
.text:0000000180012D09 loc_180012D09:                          ; CODE XREF: CDefPolicy::CDefPolicy(_GUID)+E5?j
.text:0000000180012D09                                         ; CDefPolicy::CDefPolicy(_GUID):loc_18003AAEB?j ...
.text:0000000180012D09                 and     [rbx+63Ch], ebp  --------> =0
.text:0000000180012D0F                 xor     eax, eax
.text:0000000180012D11                 mov     ecx, [rsp+68h+var_48] ; le nombre de licenses
.text:0000000180012D15                 cmp     ecx, edi   -------------------> edi = 2
.text:0000000180012D17                 mov     [rbx+638h], ecx -----------> ; le nombre de licenses
.text:0000000180012D1D                 setnle  al
.text:0000000180012D20                 mov     [rbx+640h], r12d ---------> 1
.text:0000000180012D27                 xor     edi, edi
.text:0000000180012D29                 mov     [rbx+644h], eax   -------->>> eax = 1 si >2 licenses 
.text:0000000180012D2F                 cmp     cs:?bInitialized@CSLQuery@@0HA, edi ; int CSLQuery::bInitialized
.text:0000000180012D35                 jz      loc_18003AB12
.text:0000000180012D3B
.text:0000000180012D3B loc_180012D3B:                          ; CODE XREF: CDefPolicy::CDefPolicy(_GUID)+27F1F?j
.text:0000000180012D3B                 mov     ebp, cs:?bFUSEnabled@CSLQuery@@0HA ; int CSLQuery::bFUSEnabled
.text:0000000180012D41
.text:0000000180012D41 loc_180012D41:                          ; CODE XREF: CDefPolicy::CDefPolicy(_GUID)+27F41?j
.text:0000000180012D41                 test    edi, edi
.text:0000000180012D43                 js      loc_18003AA86
.text:0000000180012D49                 test    ebp, ebp
.text:0000000180012D4B                 jz      short loc_180012D64

si nb de licenses <= 2 alors 
	[rbx+644h] = 0
	si bFSUenabled = true alors [rbx+644h] = 1
si nb de licenses > 2 alors 
	[rbx+644h] = 1
---------------------------------------------------
.text:0000000180012DA0 ; __int64 __fastcall CDefPolicy::Logon(CDefPolicy *__hidden this, struct CLicenseData *)
.text:0000000180012DA0 ?Logon@CDefPolicy@@UEAAJAEAVCLicenseData@@@Z proc near
...
.text:0000000180012DF0                 lea     eax, [rdi+1]
.text:0000000180012DF3                 lock xadd [rbx+63Ch], eax
.text:0000000180012DFB                 inc     eax
.text:0000000180012DFD                 cmp     eax, [rbx+638h]
.text:0000000180012E03                 jg      loc_18003ABA4   -->> 'CDefPolicy::Logon FAILED - License not available'
					
63Ch est inc et dec avec logon/logoff* puis comparé à 638h
63Ch se comporte comme une valeur "actuelle"
638h se comporte donc bien comme une valeur maxi ---> d'où le choix du wrapper de l'initiliser à 100 lors de chaque test

------------------------ l'activation des traces utilise de nombreuses variables =====================

; __int64 __fastcall CService::Start(CService *__hidden this)
?Start@CService@@QEAAJXZ proc near

.data:00000001800EA000                 assume cs:_data
.data:00000001800EA000                 ;org 1800EA000h
.data:00000001800EA000 WPP_GLOBAL_Control dq offset WPP_GLOBAL_Control  --->>> initialisation : test-AAA

* cs:WPP_GLOBAL_Control+1C -> 0xFFFFF pour tout autoriser : où trouver la doc pour cette structure ?

.text:00000001800066C0 DoWppTrace      proc near               ; CODE XREF: _DbgPrintMessage(int,char const *,...)+155?p
.text:00000001800066C0
.text:00000001800066C0 ; FUNCTION CHUNK AT .text:0000000180042D70 SIZE 0000023D BYTES
.text:00000001800066C0
.text:00000001800066C0                 mov     r9, rdx
.text:00000001800066C3                 mov     edx, 80h
.text:00000001800066C8                 cmp     ecx, edx    ------------>>>>> ecx = chaque bit à 1 identifie un type de trace qui sera ou non autorisé à écrire la trace
.text:00000001800066CA                 jg      loc_180042E70 ----->>>> traite d'autres valeurs pour ecx
.text:00000001800066D0                 jz      loc_180042E46
.text:00000001800066D6                 sub     ecx, 1
.text:00000001800066D9                 jz      loc_180042E1B
.text:00000001800066DF                 sub     ecx, 1
.text:00000001800066E2                 jnz     short loc_180006702
.text:00000001800066E4                 mov     rcx, cs:WPP_GLOBAL_Control ---->>> une structure dont la data [+1C] définit les traces qui sont autorisées
.text:00000001800066EB                 lea     rax, WPP_GLOBAL_Control    --->>>  voir test-AAA ci-dessus
.text:00000001800066F2                 cmp     rcx, rax ----------------- >>>> ?
.text:00000001800066F5                 jz      short locret_180006701
.text:00000001800066F7                 test    byte ptr [rcx+1Ch], 2    -->>> * cs:WPP_GLOBAL_Control+1C -> 0xFFFFF pour tout autoriser 
.text:00000001800066FB                 jnz     loc_180042E11
.text:0000000180006701
.text:0000000180006701 locret_180006701:                       ; CODE XREF: DoWppTrace+35?j
.text:0000000180006701                                         ; DoWppTrace+61?j ...
.text:0000000180006701                 retn
... loc_180042E11 ...
.text:0000000180042F7F loc_180042F7F:                          ; CODE XREF: DoWppTrace+3C7B7?j
.text:0000000180042F7F                 mov     rcx, cs:WPP_GLOBAL_Control  --------->>>>>
.text:0000000180042F86                 lea     rax, WPP_GLOBAL_Control
.text:0000000180042F8D                 cmp     rcx, rax
.text:0000000180042F90                 jz      locret_180006701
.text:0000000180042F96                 test    [rcx+1Ch], edx ------------>>>> ???
.text:0000000180042F99                 jz      locret_180006701
.text:0000000180042F9F                 mov     edx, 12h
.text:0000000180042FA4
.text:0000000180042FA4 loc_180042FA4:                          ; CODE XREF: DoWppTrace+3C6DF?j
.text:0000000180042FA4                                         ; DoWppTrace+3C6E9?j ...
.text:0000000180042FA4                 mov     rcx, [rcx+10h]
.text:0000000180042FA8                 jmp     WPP_SF_s
.text:0000000180042FA8 ; END OF FUNCTION CHUNK FOR DoWppTrace

--------------------- WPP_SF_s
.text:00000001800592F8 ; =============== S U B R O U T I N E =======================================
.text:00000001800592F8
.text:00000001800592F8
.text:00000001800592F8 WPP_SF_s        proc near               ; CODE XREF: DoWppTrace+3C8E8?j
.text:00000001800592F8                                         ; DATA XREF: .pdata:00000001800F2A68?o
.text:00000001800592F8
.text:00000001800592F8 var_28          = qword ptr -28h
.text:00000001800592F8 var_20          = qword ptr -20h
.text:00000001800592F8 var_18          = qword ptr -18h
.text:00000001800592F8
.text:00000001800592F8                 sub     rsp, 48h
.text:00000001800592FC                 test    r9, r9
.text:00000001800592FF                 jz      short loc_180059314
.text:0000000180059301                 or      rax, 0FFFFFFFFFFFFFFFFh
.text:0000000180059305
.text:0000000180059305 loc_180059305:                          ; CODE XREF: WPP_SF_s+15?j
.text:0000000180059305                 inc     rax
.text:0000000180059308                 cmp     byte ptr [r9+rax], 0
.text:000000018005930D                 jnz     short loc_180059305
.text:000000018005930F                 inc     rax
.text:0000000180059312                 jmp     short loc_180059319
.text:0000000180059314 ; ---------------------------------------------------------------------------
.text:0000000180059314
.text:0000000180059314 loc_180059314:                          ; CODE XREF: WPP_SF_s+7?j
.text:0000000180059314                 mov     eax, 5
.text:0000000180059319
.text:0000000180059319 loc_180059319:                          ; CODE XREF: WPP_SF_s+1A?j
.text:0000000180059319                 test    r9, r9
.text:000000018005931C                 lea     r8, aNull       ; "NULL"
.text:0000000180059323                 cmovz   r9, r8
.text:0000000180059327                 and     [rsp+48h+var_18], 0
.text:000000018005932D                 mov     [rsp+48h+var_20], rax
.text:0000000180059332                 lea     r8, WPP_3d25fe78fcdb3cc1a7133b74a5897778_Traceguids ---->>> ????
.text:0000000180059339                 mov     [rsp+48h+var_28], r9
.text:000000018005933E                 movzx   r9d, dx
.text:0000000180059342                 mov     edx, 2Bh
.text:0000000180059347                 call    cs:__imp_EtwTraceMessage
.text:000000018005934D                 add     rsp, 48h
.text:0000000180059351                 retn
.text:0000000180059351 WPP_SF_s        endp
------------------------------------------------
.text:00000001800593B0 ; =============== S U B R O U T I N E =======================================
.text:00000001800593B0
.text:00000001800593B0
.text:00000001800593B0 WppControlCallback proc near            ; DATA XREF: CService::Start(void)+87?o
.text:00000001800593B0                                         ; .rdata:00000001800B892B?o ...
.text:00000001800593B0
.text:00000001800593B0 arg_0           = qword ptr  8
.text:00000001800593B0 arg_8           = qword ptr  10h
.text:00000001800593B0 arg_10          = qword ptr  18h
.text:00000001800593B0
.text:00000001800593B0                 mov     [rsp+arg_0], rbx ------------------- 
.text:00000001800593B5                 mov     [rsp+arg_8], rbp
.text:00000001800593BA                 mov     [rsp+arg_10], rsi
.text:00000001800593BF                 push    rdi
.text:00000001800593C0                 sub     rsp, 20h
.text:00000001800593C4                 and     dword ptr [r8], 0
.text:00000001800593C8                 mov     rbx, rdx ------------->>>>>>>>  ptr WPP_MAIN_CB  voir RegisterTraceGuids  
.text:00000001800593CB                 mov     edx, ecx ------------->>>>>>>> Request code from "controler"
.text:00000001800593CD                 mov     esi, ecx -------->>>  de  1 à 5 
.text:00000001800593CF                 sub     edx, 4
.text:00000001800593D2                 jz      short loc_1800593E9 -->>> 4 
.text:00000001800593D4                 cmp     edx, 1
.text:00000001800593D7                 jz      short loc_1800593E0 -->>> 5 
.text:00000001800593D9                 mov     eax, 57h
.text:00000001800593DE                 jmp     short loc_18005943C -->>> toutes les autres valeurs sont ignorées !!!
.text:00000001800593E0 ; ---------------------------------------------------------------------------
.text:00000001800593E0
.text:00000001800593E0 loc_1800593E0:                          ; CODE XREF: WppControlCallback+27?j
.text:00000001800593E0                 xor     edi, edi
.text:00000001800593E2                 xor     edx, edx             --- cas 5 VERBOSE ?
.text:00000001800593E4                 xor     bpl, bpl
.text:00000001800593E7                 jmp     short loc_18005940C
.text:00000001800593E9 ; ---------------------------------------------------------------------------
.text:00000001800593E9
.text:00000001800593E9 loc_1800593E9:                          ; CODE XREF: WppControlCallback+22?j
.text:00000001800593E9                 mov     rcx, r9              --- cas 4 WARNING ?
.text:00000001800593EC                 call    cs:__imp_EtwGetTraceLoggerHandle
.text:00000001800593F2                 mov     rcx, rax
.text:00000001800593F5                 mov     rdi, rax
.text:00000001800593F8                 call    cs:__imp_EtwGetTraceEnableLevel
.text:00000001800593FE                 mov     rcx, rdi
.text:0000000180059401                 mov     bpl, al
.text:0000000180059404                 call    cs:__imp_EtwGetTraceEnableFlags
.text:000000018005940A                 mov     edx, eax
.text:000000018005940C
.text:000000018005940C loc_18005940C:                          ; CODE XREF: WppControlCallback+37?j
.text:000000018005940C                 test    byte ptr [rbx+1Ah], 2
.text:0000000180059410                 jz      short loc_18005941D
.text:0000000180059412                 mov     rcx, [rbx+10h]
.text:0000000180059416                 test    rcx, rcx
.text:0000000180059419                 cmovnz  rbx, rcx
.text:000000018005941D
.text:000000018005941D loc_18005941D:                          ; CODE XREF: WppControlCallback+60?j
.text:000000018005941D                 mov     eax, cs:?g_DebugSpewTraceLevel@@3KA ; ulong g_DebugSpewTraceLevel
.text:0000000180059423                 cmp     esi, 5
.text:0000000180059426                 mov     [rbx+10h], rdi
.text:000000018005942A                 cmovnz  eax, edx
.text:000000018005942D                 mov     [rbx+19h], bpl
.text:0000000180059431                 mov     cs:?g_DebugSpewTraceLevel@@3KA, eax ; ulong g_DebugSpewTraceLevel
.text:0000000180059437                 xor     eax, eax
.text:0000000180059439                 mov     [rbx+1Ch], edx
.text:000000018005943C
.text:000000018005943C loc_18005943C:                          ; CODE XREF: WppControlCallback+2E?j
.text:000000018005943C                 mov     rbx, [rsp+28h+arg_0]
.text:0000000180059441                 mov     rbp, [rsp+28h+arg_8]
.text:0000000180059446                 mov     rsi, [rsp+28h+arg_10]
.text:000000018005944B                 add     rsp, 20h
.text:000000018005944F                 pop     rdi
.text:0000000180059450                 retn
.text:0000000180059450 WppControlCallback endp

