0

I'm checking tcpip.sys file in IDA and found that in the .data part there is an int called g_37HashSeed. This seed is an input for a hash function that I look into. Can someone tell me which program or function is responsible for initializing this seed?

.data:00000001C020512C g_37HashSeed    dd ?                    ; DATA XREF: IppSendError+33E↑r
.data:00000001C020512C                                         ; IppFindPath+31↑r ...
.data:00000001C0205130 IppNSWorkerQueue dq ?                   ; DATA XREF: IppResolveNeighbor+31C↑o
.data:00000001C0205130                                         ; IppNeighborSolicitationWorker+2E↑o ...
.data:00000001C0205138 qword_1C0205138 dq ?                    ; DATA XREF: IppResolveNeighbor+315↑r
.data:00000001C0205138                                         ; IppResolveNeighbor+339↑w ...
.data:00000001C0205140 ; KSPIN_LOCK IppNSWorkItemLock
.data:00000001C0205140 IppNSWorkItemLock dq ?                  ; DATA XREF: IppNeighborSetTimeout+253↑o

1 Answer 1

1

It looks like the g_37HashSeed variable is initialized in the function IppInitSharedHashContext, in the file tcpip.sys:

IppInitSharedHashContext proc near
sub     rsp, 28h
or      edx, 0FFFFFFFFh
mov     ecx, 1
call    RandomNumber
mov     cs:g_37HashSeed, eax
mov     al, 1
add     rsp, 28h
retn
IppInitSharedHashContext endp

The RandomNumber function seems to be a simple LCG (https://en.wikipedia.org/wiki/Linear_congruential_generator) with the parameters a=1664525, c=1013904223.

You can find this by yourself by right clicking on g_37HashSeed in IDA and select List cross references to....

1
  • Thank you so much. Commented Aug 17, 2022 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.