# ai_8246.sys-ai_8457.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_3858697530__private_IsEnabledDeviceUsageNoInline](#feature_3858697530__private_isenableddeviceusagenoinline) * [Feature_3858697530__private_IsEnabledFallback](#feature_3858697530__private_isenabledfallback) * [Modified](#modified) * [wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_getcachedfeatureenabledstate) * [wil_InitializeFeatureStaging](#wil_initializefeaturestaging) * [wil_details_EvaluateFeatureDependencies](#wil_details_evaluatefeaturedependencies) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [AiConvertFullImagePathToMacroFormat](#aiconvertfullimagepathtomacroformat) * [wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_getcachedfeatureenabledstate) * [Modified (No Code Changes)](#modified-no-code-changes) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) # Visual Chart Diff ```mermaid flowchart LR wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-old<--Match 30%-->wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-new wil_InitializeFeatureStaging-0-old<--Match 87%-->wil_InitializeFeatureStaging-0-new wil_details_EvaluateFeatureDependencies-0-old<--Match 88%-->wil_details_EvaluateFeatureDependencies-0-new wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState-3-old<--Match 61%-->wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState-3-new AiConvertFullImagePathToMacroFormat-7-old<--Match 77%-->AiConvertFullImagePathToMacroFormat-7-new wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-old<--Match 71%-->wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState-2-new subgraph ai_8457.sys wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-new wil_InitializeFeatureStaging-0-new wil_details_EvaluateFeatureDependencies-0-new wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState-3-new AiConvertFullImagePathToMacroFormat-7-new wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState-2-new subgraph Added direction LR Feature_3858697530__private_IsEnabledDeviceUsageNoInline Feature_3858697530__private_IsEnabledFallback end end subgraph ai_8246.sys wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-old wil_InitializeFeatureStaging-0-old wil_details_EvaluateFeatureDependencies-0-old wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState-3-old AiConvertFullImagePathToMacroFormat-7-old wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState-2-old end ``` ```mermaid pie showData title Function Matches - 99.8391% "unmatched_funcs_len" : 2 "matched_funcs_len" : 1241 ``` ```mermaid pie showData title Matched Function Similarity - 99.4359% "matched_funcs_with_code_changes_len" : 6 "matched_funcs_with_non_code_changes_len" : 1 "matched_funcs_no_changes_len" : 1234 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 ai_8246.sys ai_8457.sys ``` #### Verbose Args

``` --old ['ai_8246.sys'] --new [['ai_8457.sys']] --engine VersionTrackingDiff --output-path ai_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/appid.sys/480D107E3D000/appid.sys -O appid.sys.x64.10.0.26100.8246 wget https://msdl.microsoft.com/download/symbols/appid.sys/A78FF48B3E000/appid.sys -O appid.sys.x64.10.0.26100.8457 ``` ## Binary Metadata Diff ```diff --- ai_8246.sys Meta +++ ai_8457.sys Meta @@ -1,44 +1,44 @@ -Program Name: ai_8246.sys +Program Name: ai_8457.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 256080 +# of Bytes: 260176 # of Memory Blocks: 13 -# of Instructions: 31904 -# of Defined Data: 2161 -# of Functions: 620 -# of Symbols: 5418 +# of Instructions: 32033 +# of Defined Data: 2169 +# of Functions: 623 +# of Symbols: 5441 # of Data Types: 385 # of Data Type Categories: 26 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Tue Aug 18 23:58:03 SGT 2026 +Date Created: Tue Aug 18 23:58:07 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/ai/ai_8246.sys -Executable MD5: de46550d521ced51e572274fafc59384 -Executable SHA256: 3fa168fc585376dfd4223579c6cd9c4b6e107be0bc645e78297296ddbac7b06f -FSRL: file:///tmp/ai/ai_8246.sys?MD5=de46550d521ced51e572274fafc59384 +Executable Location: /tmp/ai/ai_8457.sys +Executable MD5: e345019d71859199e494738cfd89e18c +Executable SHA256: e0d3b96d2be59e5fe931d543a5e2457b82a50756e7a9224868c7372ad5aaa540 +FSRL: file:///tmp/ai/ai_8457.sys?MD5=e345019d71859199e494738cfd89e18c PDB Age: 1 PDB File: appid.pdb -PDB GUID: 37b069bc-9889-11cb-6132-cb10c62760be +PDB GUID: fbb4111b-64e9-fa6d-9213-147de05cda59 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: AppID Driver -PE Property[FileVersion]: 10.0.26100.8246 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8457 (WinBuild.160101.0800) PE Property[InternalName]: appid.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: appid.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8246 +PE Property[ProductVersion]: 10.0.26100.8457 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra ai_8246.sys Decompiler Options

Ghidra ai_8246.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra ai_8246.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra ai_8457.sys Decompiler Options

Ghidra ai_8457.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra ai_8457.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|0| |modified_funcs_len|7| |added_symbols_len|5| |deleted_symbols_len|2| |diff_time|3.015772581100464| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 619, 'ExternalsName': 219, 'Implied Match': 1})| |items_to_process|16| |diff_types|Counter({'address': 6, 'code': 6, 'length': 6, 'called': 3, 'refcount': 2, 'calling': 2, 'sig': 2, 'name': 1, 'fullname': 1})| |unmatched_funcs_len|2| |total_funcs_len|1243| |matched_funcs_len|1241| |matched_funcs_with_code_changes_len|6| |matched_funcs_with_non_code_changes_len|1| |matched_funcs_no_changes_len|1234| |match_func_similarity_percent|99.4359%| |func_match_overall_percent|99.8391%| |first_matches|Counter({'SymbolsHash': 619, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 619 "ExternalsName" : 219 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 619 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 0 "modified_funcs_len" : 7 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 5 "deleted_symbols_len" : 2 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_3858697530__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|ai_8457.sys| | :---: | :---: | |name|Feature_3858697530__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3858697530__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|49| |called|Feature_3858697530__private_IsEnabledFallback| |calling|AiConvertFullImagePathToMacroFormat| |paramcount|0| |address|140002bec| |sig|ulonglong __fastcall Feature_3858697530__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3858697530__private_IsEnabledDeviceUsageNoInline +++ Feature_3858697530__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3858697530__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3858697530__private_featureState; + if ((Feature_3858697530__private_featureState & 0x10) == 0) { + uVar1 = Feature_3858697530__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3858697530__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3858697530__private_IsEnabledFallback ### Function Meta |Key|ai_8457.sys| | :---: | :---: | |name|Feature_3858697530__private_IsEnabledFallback| |fullname|Feature_3858697530__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3858697530__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140002c24| |sig|undefined __fastcall Feature_3858697530__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3858697530__private_IsEnabledFallback +++ Feature_3858697530__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3858697530__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3858697530__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState ### Match Info |Key|ai_8246.sys - ai_8457.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling,called| |ratio|0.16| |i_ratio|0.02| |m_ratio|0.3| |b_ratio|0.3| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8246.sys|ai_8457.sys| | :---: | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |fullname|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |`refcount`|3|2| |`length`|215|47| |`called`|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |`calling`|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |paramcount|2|2| |`address`|14002141c|140022444| |`sig`|uint __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)|ulonglong __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, undefined8 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState Called Diff ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState called +++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState called @@ -1 +1 @@ -wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState ``` ### wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState Calling Diff ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState calling +++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState calling @@ -1,2 +1 @@ -wil_details_EvaluateFeatureDependencies -wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState ``` ### wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState Diff ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState @@ -1,63 +1,19 @@ -uint wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState - (uint *param_1,longlong param_2) +ulonglong wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + (uint *param_1,longlong param_2) { uint uVar1; - undefined8 *puVar2; - uint uVar3; - uint uVar4; - longlong *plVar5; - uint uVar6; - bool bVar7; + undefined4 extraout_var; + undefined8 local_res8; - uVar6 = *param_1; - uVar3 = uVar6; - if ((uVar6 >> 9 & 1) != 0) { - uVar4 = uVar6 >> 6 & 1; - if ((uVar4 != 0) && (plVar5 = *(longlong **)(param_2 + 0x20), plVar5 != (longlong *)0x0)) { - do { - while( true ) { - puVar2 = (undefined8 *)*plVar5; - if (puVar2 == (undefined8 *)0x0) goto LAB_0; - if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && - (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; - if ((uVar4 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { - uVar4 = 0; - goto LAB_0; - } - uVar4 = 1; - plVar5 = plVar5 + 1; - } - uVar3 = wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState - ((uint *)*puVar2,(longlong)puVar2); - if ((uVar4 == 0) || ((uVar3 & 1) == 0)) { - uVar4 = 0; - } - else { - uVar4 = 1; - } - plVar5 = plVar5 + 1; - } while (uVar4 != 0); - } -LAB_0: - do { - uVar3 = uVar6 & 0xffffffce; - if ((uVar6 & 1) == uVar4) { - uVar3 = uVar6 & 0xfffffffe; - } - uVar3 = uVar3 & 0xfffffdff | uVar4; - LOCK(); - uVar1 = *param_1; - bVar7 = uVar6 == uVar1; - if (bVar7) { - *param_1 = uVar3; - uVar1 = uVar6; - } - uVar6 = uVar1; - UNLOCK(); - } while (!bVar7); + uVar1 = *param_1; + local_res8 = (ulonglong)uVar1; + if ((uVar1 >> 9 & 1) != 0) { + uVar1 = wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState + (param_1,uVar1,param_2); + local_res8 = CONCAT44(extraout_var,uVar1); } - return uVar3; + return local_res8; } ``` ## wil_InitializeFeatureStaging ### Match Info |Key|ai_8246.sys - ai_8457.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.83| |i_ratio|0.21| |m_ratio|0.89| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8246.sys|ai_8457.sys| | :---: | :---: | :---: | |name|wil_InitializeFeatureStaging|wil_InitializeFeatureStaging| |fullname|wil_InitializeFeatureStaging|wil_InitializeFeatureStaging| |refcount|2|2| |`length`|266|329| |called|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider
wil_details_EvaluateFeatureDependencies
wil_details_PopulateInitialConfiguredFeatureStates|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider
wil_details_EvaluateFeatureDependencies
wil_details_PopulateInitialConfiguredFeatureStates| |calling|DriverEntry|DriverEntry| |paramcount|0|0| |`address`|14003771c|14003871c| |sig|int __fastcall wil_InitializeFeatureStaging(void)|int __fastcall wil_InitializeFeatureStaging(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_InitializeFeatureStaging Diff ```diff --- wil_InitializeFeatureStaging +++ wil_InitializeFeatureStaging @@ -1,59 +1,70 @@ int wil_InitializeFeatureStaging(void) { bool bVar1; int iVar2; undefined **ppuVar3; + undefined **ppuVar4; undefined8 local_res8; + undefined **local_28; + undefined *local_20; + undefined8 local_18; bVar1 = false; if (g_wil_details_isFeatureStagingInitialized == 0) { g_wil_details_isFeatureStagingInitialized = 1; local_res8 = RtlQueryFeatureConfigurationChangeStamp(); wil_details_PopulateInitialConfiguredFeatureStates(); wil_details_EvaluateFeatureDependencies(); - for (ppuVar3 = &wil_details_featureDescriptors_a; ppuVar3 < &wil_details_featureDescriptors_z; - ppuVar3 = ppuVar3 + 1) { + ppuVar4 = &wil_details_featureDescriptors_a; + ppuVar3 = &wil_details_featureDescriptors_a; + do { if (*ppuVar3 != (undefined *)0x0) goto LAB_0; - } + ppuVar3 = ppuVar3 + 1; + } while (ppuVar3 < &wil_details_featureDescriptors_z); LAB_1: g_wil_details_recordFeatureUsage = wil_details_RecordFeatureUsageReporting; + for (; (local_28 = (undefined **)0x0, ppuVar4 < &wil_details_featureDescriptors_z && + (local_28 = ppuVar4, *ppuVar4 == (undefined *)0x0)); ppuVar4 = ppuVar4 + 1) { + } + local_20 = &wil_details_featureDescriptors_z; + local_18 = 0; iVar2 = RtlRegisterFeatureUsageProvider - (wil_details_OnFeatureUsageProviderFlushNotification,0, + (wil_details_OnFeatureUsageProviderFlushNotification,&local_28, &g_wil_details_featureUsageProvider); if (iVar2 != 0) { if (!bVar1) { g_wil_details_featureUsageProvider = 0; return iVar2; } g_wil_details_featureUsageProvider = 0; return 0; } } return 0; LAB_0: if (ppuVar3 == (undefined **)0x0) goto LAB_1; if (((*(char *)((longlong)ppuVar3 + 0x1d) == '\0') && (*(char *)((longlong)ppuVar3 + 0x1e) == '\0')) && (*(char *)((longlong)ppuVar3 + 0x1c) == '\0')) { iVar2 = RtlRegisterFeatureConfigurationChangeNotification (wil_details_ReevaluateOnFeatureConfigurationChange,0,&local_res8, &g_wil_details_featureChangeNotification); if (iVar2 == 0) { bVar1 = true; } else { g_wil_details_featureChangeNotification = 0; } goto LAB_1; } ppuVar3 = ppuVar3 + 7; while( true ) { - if (&UNK_2 < ppuVar3) goto LAB_1400377dd; + if (&UNK_2 < ppuVar3) goto LAB_1400387ed; if (*ppuVar3 != (undefined *)0x0) break; ppuVar3 = ppuVar3 + 1; } goto LAB_0; } ``` ## wil_details_EvaluateFeatureDependencies ### Match Info |Key|ai_8246.sys - ai_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.8| |i_ratio|0.21| |m_ratio|0.95| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8246.sys|ai_8457.sys| | :---: | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies|wil_details_EvaluateFeatureDependencies| |fullname|wil_details_EvaluateFeatureDependencies|wil_details_EvaluateFeatureDependencies| |refcount|3|3| |`length`|232|270| |`called`|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |calling|wil_InitializeFeatureStaging
wil_details_ReevaluateOnFeatureConfigurationChange|wil_InitializeFeatureStaging
wil_details_ReevaluateOnFeatureConfigurationChange| |paramcount|0|0| |`address`|14002132c|14002232c| |sig|undefined __fastcall wil_details_EvaluateFeatureDependencies(void)|undefined __fastcall wil_details_EvaluateFeatureDependencies(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_EvaluateFeatureDependencies Called Diff ```diff --- wil_details_EvaluateFeatureDependencies called +++ wil_details_EvaluateFeatureDependencies called @@ -1 +1 @@ -wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState ``` ### wil_details_EvaluateFeatureDependencies Diff ```diff --- wil_details_EvaluateFeatureDependencies +++ wil_details_EvaluateFeatureDependencies @@ -1,64 +1,65 @@ void wil_details_EvaluateFeatureDependencies(void) { uint uVar1; undefined **ppuVar2; undefined **ppuVar3; - undefined *puVar4; - bool bVar5; + bool bVar4; - puVar4 = (undefined *)0x0; ppuVar3 = &wil_details_featureDescriptors_a; ppuVar2 = &wil_details_featureDescriptors_a; do { - if (*ppuVar2 != (undefined *)0x0) goto joined_r0x000140021367; + if (*ppuVar2 != (undefined *)0x0) goto joined_r0x00014002236d; ppuVar2 = ppuVar2 + 1; } while (ppuVar2 < &wil_details_featureDescriptors_z); LAB_0: while( true ) { if (&UNK_1 < ppuVar3) { return; } if (*ppuVar3 != (undefined *)0x0) break; ppuVar3 = ppuVar3 + 1; } do { if (ppuVar3 == (undefined **)0x0) { return; } - wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState - ((uint *)*ppuVar3,(longlong)ppuVar3); + uVar1 = *(uint *)*ppuVar3; + if ((uVar1 >> 9 & 1) != 0) { + wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState + ((uint *)*ppuVar3,uVar1,(longlong)ppuVar3); + } ppuVar3 = ppuVar3 + 7; while( true ) { if (&UNK_1 < ppuVar3) { return; } - if (*ppuVar3 != puVar4) break; + if (*ppuVar3 != (undefined *)0x0) break; ppuVar3 = ppuVar3 + 1; } } while( true ); -joined_r0x000140021367: +joined_r0x00014002236d: while (ppuVar2 != (undefined **)0x0) { uVar1 = *(uint *)*ppuVar2; if ((uVar1 >> 9 & 1) != 0) { if ((uVar1 & 0x180) == 0) { - bVar5 = *(char *)((longlong)ppuVar2 + 0x1f) != '\0'; + bVar4 = *(char *)((longlong)ppuVar2 + 0x1f) != '\0'; } else { - bVar5 = (uVar1 & 0x180) == 0x100; + bVar4 = (uVar1 & 0x180) == 0x100; } LOCK(); - *(uint *)*ppuVar2 = *(uint *)*ppuVar2 ^ uVar1 & 0x40 ^ (uint)bVar5 << 6; + *(uint *)*ppuVar2 = *(uint *)*ppuVar2 ^ uVar1 & 0x40 ^ (uint)bVar4 << 6; UNLOCK(); } ppuVar2 = ppuVar2 + 7; while( true ) { - if (&UNK_1 < ppuVar2) goto LAB_1400213e1; + if (&UNK_1 < ppuVar2) goto LAB_1400223ea; if (*ppuVar2 != (undefined *)0x0) break; ppuVar2 = ppuVar2 + 1; } } goto LAB_0; } ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Match Info |Key|ai_8246.sys - ai_8457.sys| | :---: | :---: | |diff_type|code,length| |ratio|0.25| |i_ratio|0.42| |m_ratio|0.94| |b_ratio|0.61| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8246.sys|ai_8457.sys| | :---: | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3|3| |`length`|612|686| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_IsEnabledFallback|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_IsEnabledFallback| |paramcount|3|3| |address|140001b3c|140001b3c| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState Diff ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -1,151 +1,171 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState (uint *param_1,ulonglong param_2,longlong param_3) { - undefined8 *puVar1; - int iVar2; + uint uVar1; + undefined8 *puVar2; int iVar3; uint uVar4; uint uVar5; - uint uVar6; - ulonglong uVar7; - uint uVar8; + ulonglong uVar6; + uint uVar7; + ulonglong uVar8; uint uVar9; - ulonglong uVar10; - longlong *plVar11; + uint uVar10; + uint uVar11; uint uVar12; - bool bVar13; - undefined1 auStack_a8 [32]; - undefined8 local_88; - ulonglong local_80; - undefined8 local_78; + longlong *plVar13; + bool bVar14; + undefined1 auStack_b8 [32]; + int local_98; + undefined8 local_90; + ulonglong local_88; + longlong local_80; + uint *local_78; undefined8 local_70; - undefined8 uStack_68; - undefined8 local_60; + undefined8 local_68; + undefined8 uStack_60; undefined8 local_58; - undefined4 local_50; - ulonglong local_48; + undefined8 local_50; + undefined4 local_48; + ulonglong local_40; - local_48 = __security_cookie ^ (ulonglong)auStack_a8; - iVar2 = 0; - local_88 = param_2; + local_40 = __security_cookie ^ (ulonglong)auStack_b8; + local_98 = 0; + local_90 = param_2; + local_80 = param_3; + local_78 = param_1; if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) { - iVar2 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); + local_98 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); } + local_68 = 0; + uStack_60 = 0; + uVar12 = 1; local_70 = 0; - uStack_68 = 0; - uVar12 = 1; - local_78 = 0; uVar5 = 0; - local_60 = 0; local_58 = 0; local_50 = 0; + local_48 = 0; iVar3 = RtlQueryFeatureConfiguration (*(undefined4 *)(param_3 + 0x18),1 < (byte)(*(char *)(param_3 + 0x1c) - 2U), - &local_78,&local_58); + &local_70,&local_50); if (iVar3 == 0) { - uVar8 = local_58._4_4_ >> 7 & 1; - local_70 = CONCAT44(local_70._4_4_,local_58._4_4_ >> 4) & 0xffffffff00000003; - uVar4 = local_58._4_4_ >> 6 & 1; + uVar7 = local_50._4_4_ >> 7 & 1; + local_68 = CONCAT44(local_68._4_4_,local_50._4_4_ >> 4) & 0xffffffff00000003; + uVar4 = local_50._4_4_ >> 6 & 1; uVar5 = uVar12; - uVar6 = local_58._4_4_ >> 4 & 3; + uVar10 = local_50._4_4_ >> 4 & 3; LAB_0: - uVar8 = uVar8 << 10; - if (uVar4 != 0) { - uVar4 = 0x800; - goto LAB_1; + uVar7 = uVar7 << 10; + if (uVar4 == 0) goto LAB_1; + uVar4 = 0x800; + } + else { + uVar7 = 0; + uVar4 = 0; + uVar10 = (uint)local_68; + if (iVar3 != 0x117) goto LAB_0; + uVar7 = (local_50._4_4_ >> 7 & 1) << 10; + uVar5 = uVar12; +LAB_1: + uVar4 = 0; + } + uVar5 = -(uint)(uVar5 != 0) & uVar10 & 3; + uVar11 = uVar5 << 7; + if (uVar5 == 0) { + uVar5 = -(uint)(*(char *)(param_3 + 0x1f) != '\0') & 0x40; + } + else { + uVar5 = 0; + if (uVar10 == 2) { + uVar5 = 0x40; } } - else { - uVar8 = 0; - uVar4 = 0; - uVar6 = (uint)local_70; - if (iVar3 != 0x117) goto LAB_0; - uVar8 = (local_58._4_4_ >> 7 & 1) << 10; - uVar5 = uVar12; + uVar9 = uVar5 | uVar11 | uVar7 | uVar4; + uVar10 = uVar12; + if (((uVar7 | uVar4) == 0xc00) || (uVar10 = 0, uVar5 != 0)) { + plVar13 = *(longlong **)(param_3 + 0x20); + uVar7 = uVar12; + if (plVar13 != (longlong *)0x0) { + do { + while( true ) { + puVar2 = (undefined8 *)*plVar13; + if (puVar2 == (undefined8 *)0x0) goto LAB_2; + if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && + (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; + if ((uVar7 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { + uVar7 = 0; + goto LAB_2; + } + plVar13 = plVar13 + 1; + uVar7 = uVar12; + } + uVar1 = *(uint *)*puVar2; + local_88 = (ulonglong)uVar1; + uVar6 = local_88; + if ((uVar1 & 2) == 0) { + uVar6 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*puVar2,local_88,(longlong)puVar2); + } + if ((uVar7 == 0) || (uVar7 = uVar12, (uVar6 & 1) == 0)) { + uVar7 = 0; + } + plVar13 = plVar13 + 1; + } while (uVar7 != 0); + } +LAB_2: + if ((uVar10 != 0) && (uVar7 == 0)) { + uVar9 = uVar5 | uVar11 | uVar4; + } + param_3 = local_80; + if (((uVar9 & 0x40) != 0) && (uVar5 = uVar12, uVar7 != 0)) goto LAB_3; } - uVar4 = 0; -LAB_1: - uVar5 = -(uint)(uVar5 != 0) & uVar6 & 3; - if (uVar5 == 0) { - uVar9 = -(uint)(*(char *)(param_3 + 0x1f) != '\0') & 0x40; + uVar5 = 0; +LAB_3: + uVar9 = uVar9 | uVar5; + if (*(char *)(param_3 + 0x1c) == '\0') { + uVar12 = -(uint)(local_98 != 0) & 1; } - else { - uVar9 = 0; - if (uVar6 == 2) { - uVar9 = 0x40; + uVar6 = param_2 & 0xffffffff; + do { + uVar8 = param_2; + uVar5 = (uint)uVar6; + local_90 = CONCAT44(local_90._4_4_,uVar5); + if ((uVar12 != 0) && (local_90 = CONCAT44(local_90._4_4_,uVar5), (uVar6 & 2) == 0)) { + uVar10 = (uVar9 ^ uVar5) & 0x9c1 ^ uVar5; + uVar5 = uVar10 | 2; + local_90 = CONCAT44(local_90._4_4_,uVar10) | 2; } - } - uVar5 = uVar9 >> 6 ^ (uVar9 | uVar5 << 7 | uVar8 | uVar4); - if ((uVar9 != 0) && (plVar11 = *(longlong **)(param_3 + 0x20), plVar11 != (longlong *)0x0)) { - do { - puVar1 = (undefined8 *)*plVar11; - if (puVar1 == (undefined8 *)0x0) break; - if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') && - (*(char *)((longlong)puVar1 + 0x1d) == '\0')) { - uVar4 = *(uint *)*puVar1; - local_80 = (ulonglong)uVar4; - if ((uVar4 & 2) == 0) { - uVar7 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - ((uint *)*puVar1,local_80,(longlong)puVar1); - uVar4 = (uint)uVar7; - } - uVar6 = uVar5 & 0xfffffffe; - uVar5 = (uint)(((byte)uVar4 & (byte)uVar5 & 1) != 0); - } - else { - if (((uVar5 & 1) == 0) || (uVar6 = uVar12, *(char *)((longlong)puVar1 + 0x1f) == '\0')) { - uVar6 = 0; - } - uVar5 = uVar5 & 0xfffffffe; - } - uVar5 = uVar5 | uVar6; - plVar11 = plVar11 + 1; - } while ((uVar5 & 1) != 0); - } - if (*(char *)(param_3 + 0x1c) == '\0') { - uVar12 = -(uint)(iVar2 != 0) & 1; - } - uVar7 = param_2 & 0xffffffff; - do { - uVar10 = param_2; - uVar6 = (uint)uVar7; - local_88 = CONCAT44(local_88._4_4_,uVar6); - if ((uVar12 != 0) && (local_88 = CONCAT44(local_88._4_4_,uVar6), (uVar7 & 2) == 0)) { - uVar4 = (uVar5 ^ uVar6) & 0x9c1 ^ uVar6; - uVar6 = uVar4 | 2; - local_88 = CONCAT44(local_88._4_4_,uVar4) | 2; + if ((uVar8 & 4) == 0) { + uVar10 = (uVar9 ^ uVar5) & 0x400 ^ uVar5; + uVar5 = uVar10 | 4; + local_90 = CONCAT44(local_90._4_4_,uVar10) | 4; } - if ((uVar10 & 4) == 0) { - uVar4 = (uVar6 ^ uVar5) & 0x400 ^ uVar6; - uVar6 = uVar4 | 4; - local_88 = CONCAT44(local_88._4_4_,uVar4) | 4; - } - uVar7 = uVar10 & 0xffffffff; + uVar6 = uVar8 & 0xffffffff; LOCK(); - uVar4 = *param_1; - bVar13 = (uint)uVar10 == uVar4; - if (bVar13) { - *param_1 = uVar6; + uVar10 = *local_78; + bVar14 = (uint)uVar8 == uVar10; + if (bVar14) { + *local_78 = uVar5; } else { - uVar7 = (ulonglong)uVar4; + uVar6 = (ulonglong)uVar10; } UNLOCK(); - param_2 = uVar7; - } while (!bVar13); - if (((uVar10 & 4) == 0) && + param_2 = uVar6; + } while (!bVar14); + if (((uVar8 & 4) == 0) && (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) { (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) - (param_1,*(undefined1 *)(param_3 + 0x1c),iVar2); + (local_78,*(undefined1 *)(local_80 + 0x1c)); } if (uVar12 == 0) { - local_88 = CONCAT44(local_88._4_4_,(uVar5 ^ uVar6) & 0x9c1 ^ uVar6); + local_90 = CONCAT44(local_90._4_4_,(uVar5 ^ uVar9) & 0x9c1 ^ uVar5); } - return local_88; + return local_90; } ``` ## AiConvertFullImagePathToMacroFormat ### Match Info |Key|ai_8246.sys - ai_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.58| |i_ratio|0.39| |m_ratio|0.94| |b_ratio|0.77| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8246.sys|ai_8457.sys| | :---: | :---: | :---: | |name|AiConvertFullImagePathToMacroFormat|AiConvertFullImagePathToMacroFormat| |fullname|AiConvertFullImagePathToMacroFormat|AiConvertFullImagePathToMacroFormat| |refcount|2|2| |`length`|766|858| |`called`|AiAddImagePathWithMacro
AiAlloc
AipConvertToNtPath
AipIsPathMacroPrefix
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
__security_check_cookie
memmove|AiAddImagePathWithMacro
AiAlloc
AipConvertToNtPath
AipIsPathMacroPrefix
Feature_3858697530__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
__security_check_cookie
memmove| |calling|AipCollectImageProperties|AipCollectImageProperties| |paramcount|7|7| |`address`|14002cb54|14002dbe4| |sig|ulonglong __fastcall AiConvertFullImagePathToMacroFormat(longlong param_1, ushort * param_2, ushort * param_3, undefined4 * param_4, ushort * param_5, int param_6, int param_7)|ulonglong __fastcall AiConvertFullImagePathToMacroFormat(longlong param_1, ushort * param_2, ushort * param_3, undefined4 * param_4, ushort * param_5, int param_6, int param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### AiConvertFullImagePathToMacroFormat Called Diff ```diff --- AiConvertFullImagePathToMacroFormat called +++ AiConvertFullImagePathToMacroFormat called @@ -4,0 +5 @@ +Feature_3858697530__private_IsEnabledDeviceUsageNoInline ``` ### AiConvertFullImagePathToMacroFormat Diff ```diff --- AiConvertFullImagePathToMacroFormat +++ AiConvertFullImagePathToMacroFormat @@ -1,145 +1,174 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong AiConvertFullImagePathToMacroFormat (longlong param_1,ushort *param_2,ushort *param_3,undefined4 *param_4, ushort *param_5,int param_6,int param_7) { undefined1 uVar1; ulonglong uVar2; undefined7 extraout_var; undefined7 extraout_var_00; - ushort uVar3; - ulonglong uVar4; - ushort *puVar5; - undefined8 *puVar6; - uint uVar7; + uint uVar3; + void *pvVar4; + ulonglong uVar5; + ushort *puVar6; + undefined8 *puVar7; + uint uVar8; undefined1 auStack_b8 [32]; undefined8 local_98; void *pvStack_90; ulonglong local_88; - longlong lStack_80; + void *pvStack_80; undefined4 local_78; undefined4 uStack_74; undefined4 uStack_70; undefined4 uStack_6c; undefined8 local_68; undefined8 uStack_60; undefined8 local_58; undefined8 uStack_50; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStack_b8; pvStack_90 = (void *)0x0; local_98 = (ulonglong)param_2[1] << 0x10; local_88 = 0; - lStack_80 = 0; + pvStack_80 = (void *)0x0; pvStack_90 = (void *)AiAlloc((ulonglong)param_2[1]); if (pvStack_90 == (void *)0x0) { LAB_0: - uVar4 = 0xc0000017; + uVar5 = 0xc0000017; } else { RtlCopyUnicodeString(&local_98,param_2); uVar2 = AiAddImagePathWithMacro(param_1,(ushort *)&local_98); - uVar4 = uVar2 & 0xffffffff; + uVar5 = uVar2 & 0xffffffff; + pvVar4 = pvStack_90; if ((int)uVar2 < 0) { LAB_1: - if (pvStack_90 == (void *)0x0) { - return uVar4; + if (pvVar4 == (void *)0x0) { + return uVar5; } - ExFreePoolWithTag(pvStack_90,0); - return uVar4; + ExFreePoolWithTag(pvVar4,0); + return uVar5; } if ((param_3 != (ushort *)0x0) && (param_3 != param_2)) { local_98._0_4_ = CONCAT22(param_3[1],(ushort)local_98); pvStack_90 = (void *)AiAlloc((ulonglong)param_3[1]); if (pvStack_90 == (void *)0x0) goto LAB_0; RtlCopyUnicodeString(&local_98,param_3); uVar2 = AiAddImagePathWithMacro(param_1,(ushort *)&local_98); - uVar4 = uVar2 & 0xffffffff; + uVar5 = uVar2 & 0xffffffff; + pvVar4 = pvStack_90; if ((int)uVar2 < 0) goto LAB_1; } - puVar6 = DAT_2; + puVar7 = DAT_2; if ((*(longlong *)(param_5 + 4) != 0) && - (uVar1 = AipIsPathMacroPrefix(param_2,param_5), puVar6 = DAT_2, + (uVar1 = AipIsPathMacroPrefix(param_2,param_5), puVar7 = DAT_2, (int)CONCAT71(extraout_var,uVar1) != 0)) { local_68 = 0; uStack_60 = 0; local_58 = 0; uStack_50 = 0; local_78 = *param_4; uStack_74 = param_4[1]; uStack_70 = param_4[2]; uStack_6c = param_4[3]; if (param_6 != 0) { RtlInitUnicodeString(&local_68,L"%REMOVABLE%"); } if (param_7 != 0) { RtlInitUnicodeString(&local_58,L"%HOT%"); } - uVar7 = 0; - puVar5 = (ushort *)&local_78; + uVar8 = 0; + puVar6 = (ushort *)&local_78; do { - if (*(longlong *)(puVar5 + 4) != 0) { - uVar3 = (*param_2 - *param_5) + *puVar5; - local_98._0_4_ = CONCAT22(uVar3,uVar3); - pvStack_90 = (void *)AiAlloc((ulonglong)uVar3); + if (*(longlong *)(puVar6 + 4) != 0) { + uVar2 = Feature_3858697530__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { + uVar2 = (ulonglong)(ushort)((*param_2 - *param_5) + *puVar6); + } + else { + uVar3 = ((uint)*param_2 - (uint)*param_5) + (uint)*puVar6; + uVar2 = (ulonglong)uVar3; + if (0xfffe < uVar3) { + return 0xc0000106; + } + } + local_98._0_4_ = CONCAT22((short)uVar2,(short)uVar2); + pvStack_90 = (void *)AiAlloc(uVar2 & 0xffff); if (pvStack_90 == (void *)0x0) goto LAB_0; - memmove(pvStack_90,*(void **)(puVar5 + 4),(ulonglong)*puVar5); - memmove((void *)((ulonglong)*puVar5 + (longlong)pvStack_90), + memmove(pvStack_90,*(void **)(puVar6 + 4),(ulonglong)*puVar6); + memmove((void *)((ulonglong)*puVar6 + (longlong)pvStack_90), (void *)(*(longlong *)(param_2 + 4) + (ulonglong)*param_5), (ulonglong)*param_2 - (ulonglong)*param_5); uVar2 = AiAddImagePathWithMacro(param_1,(ushort *)&local_98); - uVar4 = uVar2 & 0xffffffff; + uVar5 = uVar2 & 0xffffffff; + pvVar4 = pvStack_90; if ((int)uVar2 < 0) goto LAB_1; } - uVar7 = uVar7 + 1; - puVar5 = puVar5 + 8; - puVar6 = DAT_2; - } while (uVar7 < 3); + uVar8 = uVar8 + 1; + puVar6 = puVar6 + 8; + puVar7 = DAT_2; + } while (uVar8 < 3); } - for (; (undefined8 **)puVar6 != &DAT_2; puVar6 = (undefined8 *)*puVar6) { - if ((*(uint *)(puVar6 + 2) & 8) == 0) { - uVar2 = AipConvertToNtPath(puVar6 + 5,&local_88); - uVar4 = uVar2 & 0xffffffff; + for (; (undefined8 **)puVar7 != &DAT_2; puVar7 = (undefined8 *)*puVar7) { + if ((*(uint *)(puVar7 + 2) & 8) == 0) { + uVar2 = AipConvertToNtPath(puVar7 + 5,&local_88); + uVar5 = uVar2 & 0xffffffff; if ((int)uVar2 < 0) { - return uVar4; + return uVar5; } } else { - local_88 = puVar6[5]; - lStack_80 = puVar6[6]; + local_88 = puVar7[5]; + pvStack_80 = (void *)puVar7[6]; } uVar1 = AipIsPathMacroPrefix(param_2,(ushort *)&local_88); if ((int)CONCAT71(extraout_var_00,uVar1) != 0) { - uVar3 = (*param_2 - (short)local_88) + *(short *)(puVar6 + 3); - local_98._0_4_ = CONCAT22(uVar3,uVar3); - pvStack_90 = (void *)AiAlloc((ulonglong)uVar3); - if (pvStack_90 == (void *)0x0) { - uVar4 = 0xc0000017; + uVar2 = Feature_3858697530__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { + uVar2 = (ulonglong)(ushort)((*param_2 - (ushort)local_88) + *(ushort *)(puVar7 + 3)); } else { - memmove(pvStack_90,(void *)puVar6[4],(ulonglong)*(ushort *)(puVar6 + 3)); - memmove((void *)((ulonglong)*(ushort *)(puVar6 + 3) + (longlong)pvStack_90), + uVar8 = ((uint)*param_2 - (uint)(ushort)local_88) + (uint)*(ushort *)(puVar7 + 3); + uVar2 = (ulonglong)uVar8; + if (0xfffe < uVar8) { + uVar5 = 0xc0000106; + pvVar4 = pvStack_80; + if (pvStack_80 == (void *)puVar7[6]) { + return 0xc0000106; + } + goto LAB_1; + } + } + local_98._0_4_ = CONCAT22((short)uVar2,(short)uVar2); + pvStack_90 = (void *)AiAlloc(uVar2 & 0xffff); + if (pvStack_90 == (void *)0x0) { + uVar5 = 0xc0000017; + } + else { + memmove(pvStack_90,(void *)puVar7[4],(ulonglong)*(ushort *)(puVar7 + 3)); + memmove((void *)((ulonglong)*(ushort *)(puVar7 + 3) + (longlong)pvStack_90), (void *)((local_88 & 0xffff) + *(longlong *)(param_2 + 4)), (ulonglong)*param_2 - (local_88 & 0xffff)); uVar2 = AiAddImagePathWithMacro(param_1,(ushort *)&local_98); - uVar4 = uVar2 & 0xffffffff; + uVar5 = uVar2 & 0xffffffff; if (((int)uVar2 < 0) && (pvStack_90 != (void *)0x0)) { ExFreePoolWithTag(pvStack_90,0); } } } - if ((lStack_80 != puVar6[6]) && (lStack_80 != 0)) { - ExFreePoolWithTag(lStack_80,0); + if ((pvStack_80 != (void *)puVar7[6]) && (pvStack_80 != (void *)0x0)) { + ExFreePoolWithTag(pvStack_80,0); } - if ((int)uVar4 < 0) { - return uVar4; + if ((int)uVar5 < 0) { + return uVar5; } } } - return uVar4; + return uVar5; } ``` ## wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState ### Match Info |Key|ai_8246.sys - ai_8457.sys| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address| |ratio|0.23| |i_ratio|0.2| |m_ratio|0.86| |b_ratio|0.71| |match_types|Implied Match| ### Function Meta Diff |Key|ai_8246.sys|ai_8457.sys| | :---: | :---: | :---: | |`name`|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |`fullname`|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |refcount|3|3| |`length`|215|265| |called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |calling|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |paramcount|2|3| |`address`|14002141c|14002247c| |`sig`|uint __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)|uint __fastcall wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState(uint * param_1, uint param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState Diff ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +++ wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState @@ -1,63 +1,74 @@ -uint wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState - (uint *param_1,longlong param_2) +uint wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState + (uint *param_1,uint param_2,longlong param_3) { - uint uVar1; - undefined8 *puVar2; - uint uVar3; + undefined8 *puVar1; + bool bVar2; + ulonglong uVar3; uint uVar4; - longlong *plVar5; + uint uVar5; uint uVar6; - bool bVar7; + longlong *plVar7; + bool bVar8; + bool bVar9; - uVar6 = *param_1; - uVar3 = uVar6; - if ((uVar6 >> 9 & 1) != 0) { - uVar4 = uVar6 >> 6 & 1; - if ((uVar4 != 0) && (plVar5 = *(longlong **)(param_2 + 0x20), plVar5 != (longlong *)0x0)) { + uVar6 = param_2 >> 6 & 1; + if (((param_2 & 0xc00) == 0xc00) || (bVar8 = false, bVar2 = true, uVar6 != 0)) { + plVar7 = *(longlong **)(param_3 + 0x20); + bVar8 = (param_2 & 0xc00) == 0xc00; + bVar9 = true; + bVar2 = true; + if (plVar7 != (longlong *)0x0) { do { while( true ) { - puVar2 = (undefined8 *)*plVar5; - if (puVar2 == (undefined8 *)0x0) goto LAB_0; - if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && - (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; - if ((uVar4 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { - uVar4 = 0; + puVar1 = (undefined8 *)*plVar7; + if (puVar1 == (undefined8 *)0x0) goto LAB_0; + if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') && + (*(char *)((longlong)puVar1 + 0x1d) == '\0')) break; + if ((!bVar9) || (*(char *)((longlong)puVar1 + 0x1f) == '\0')) { + bVar9 = false; goto LAB_0; } - uVar4 = 1; - plVar5 = plVar5 + 1; + plVar7 = plVar7 + 1; + bVar9 = true; } uVar3 = wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState - ((uint *)*puVar2,(longlong)puVar2); - if ((uVar4 == 0) || ((uVar3 & 1) == 0)) { - uVar4 = 0; + ((uint *)*puVar1,puVar1); + if ((!bVar9) || (bVar9 = true, (uVar3 & 1) == 0)) { + bVar9 = false; } - else { - uVar4 = 1; - } - plVar5 = plVar5 + 1; - } while (uVar4 != 0); + plVar7 = plVar7 + 1; + } while (bVar9); +LAB_0: + bVar2 = bVar9; + if ((uVar6 == 0) || (!bVar9)) { + uVar6 = 0; + } + else { + uVar6 = 1; + } } -LAB_0: - do { - uVar3 = uVar6 & 0xffffffce; - if ((uVar6 & 1) == uVar4) { - uVar3 = uVar6 & 0xfffffffe; - } - uVar3 = uVar3 & 0xfffffdff | uVar4; - LOCK(); - uVar1 = *param_1; - bVar7 = uVar6 == uVar1; - if (bVar7) { - *param_1 = uVar3; - uVar1 = uVar6; - } - uVar6 = uVar1; - UNLOCK(); - } while (!bVar7); } - return uVar3; + do { + uVar5 = param_2 & 0xfffffffe | uVar6; + if ((bVar8) && (!bVar2)) { + uVar5 = param_2 & 0xfffffbfe | uVar6; + } + uVar4 = uVar5 & 0xffffffcf; + if ((param_2 & 1) == uVar6) { + uVar4 = uVar5; + } + LOCK(); + uVar5 = *param_1; + bVar9 = param_2 == uVar5; + if (bVar9) { + *param_1 = uVar4 & 0xfffffdff; + uVar5 = param_2; + } + param_2 = uVar5; + UNLOCK(); + } while (!bVar9); + return uVar4 & 0xfffffdff; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## wil_details_IsEnabledFallback ### Match Info |Key|ai_8246.sys - ai_8457.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8246.sys|ai_8457.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|5|6| |length|146|146| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_PackagedComElevationSupport__private_IsEnabledFallback
Feature_Servicing_ApplockerCertCacheStartupFix__private_IsEnabledFallback
Feature_Servicing_ApplockerNoisyLogs__private_IsEnabledFallback
Feature_Servicing_ApplockerPickBestClaim__private_IsEnabledFallback|Feature_3858697530__private_IsEnabledFallback
Feature_PackagedComElevationSupport__private_IsEnabledFallback
Feature_Servicing_ApplockerCertCacheStartupFix__private_IsEnabledFallback
Feature_Servicing_ApplockerNoisyLogs__private_IsEnabledFallback
Feature_Servicing_ApplockerPickBestClaim__private_IsEnabledFallback| |paramcount|3|3| |`address`|140001e0c|140001e58| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_3858697530__private_IsEnabledFallback ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-18T23:58:37}