# appid.sys 22621.2506 vs 22621.3155 (CVE-2024-21338, manual pair) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_2959575357__private_IsEnabled](#feature_2959575357__private_isenabled) * [wil_details_FeatureStateCache_GetCachedFeatureEnabledState](#wil_details_featurestatecache_getcachedfeatureenabledstate) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [NTOSKRNL.EXE::ExGetPreviousMode](#ntoskrnlexeexgetpreviousmode) * [Modified](#modified) * [AipDeviceIoControlDispatch](#aipdeviceiocontroldispatch) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [__security_check_cookie](#__security_check_cookie) * [NTOSKRNL.EXE::RtlQueryFeatureConfiguration](#ntoskrnlexertlqueryfeatureconfiguration) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) # Visual Chart Diff ```mermaid flowchart LR AipDeviceIoControlDispatch-2-old<--Match 96%-->AipDeviceIoControlDispatch-2-new subgraph appid-10.0.22621.3155.sys AipDeviceIoControlDispatch-2-new subgraph Added direction LR Feature_2959575357__private_IsEnabled wil_details_FeatureStateCache_GetCachedFeatureEnabledState wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState NTOSKRNLEXE-ExGetPreviousMode end end subgraph appid-10.0.22621.2506.sys AipDeviceIoControlDispatch-2-old end ``` ```mermaid pie showData title Function Matches - 99.6661% "unmatched_funcs_len" : 4 "matched_funcs_len" : 1194 ``` ```mermaid pie showData title Matched Function Similarity - 99.4975% "matched_funcs_with_code_changes_len" : 1 "matched_funcs_with_non_code_changes_len" : 5 "matched_funcs_no_changes_len" : 1188 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2024-21338\ghidra_projects --project-name CVE-2024-21338 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2024-21338\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title appid.sys 22621.2506 vs 22621.3155 (CVE-2024-21338, manual pair) appid-10.0.22621.2506.sys appid-10.0.22621.3155.sys ``` #### Verbose Args

``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2024-21338\\appid-10.0.22621.2506.sys'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2024-21338\\appid-10.0.22621.3155.sys']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2024-21338\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2024-21338\ghidra_projects --project-name CVE-2024-21338 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2024-21338\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title appid.sys 22621.2506 vs 22621.3155 (CVE-2024-21338, manual pair) ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/appid.sys/3A1540623A000/appid.sys -O appid.sys.x64.10.0.22621.3139 wget https://msdl.microsoft.com/download/symbols/appid.sys/57ADA8423A000/appid.sys -O appid.sys.x64.10.0.22621.3640 ``` ## Binary Metadata Diff ```diff --- appid-10.0.22621.2506.sys Meta +++ appid-10.0.22621.3155.sys Meta @@ -1,44 +1,44 @@ -Program Name: appid-10.0.22621.2506.sys +Program Name: appid-10.0.22621.3155.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f # of Bytes: 243792 # of Memory Blocks: 13 -# of Instructions: 30979 -# of Defined Data: 3605 -# of Functions: 597 -# of Symbols: 5273 +# of Instructions: 31225 +# of Defined Data: 3614 +# of Functions: 601 +# of Symbols: 5302 # of Data Types: 395 # of Data Type Categories: 26 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Tue Jul 28 08:16:41 SGT 2026 +Date Created: Tue Jul 28 08:16:48 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2024-21338/appid-10.0.22621.2506.sys -Executable MD5: ebdd7f5b509765abc337fee440db8b1d -Executable SHA256: 7c093eb0eeae4abb6abad3a78382d2cb089c2b7b83390eb162682f4b724807c6 -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2024-21338/appid-10.0.22621.2506.sys?MD5=ebdd7f5b509765abc337fee440db8b1d +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2024-21338/appid-10.0.22621.3155.sys +Executable MD5: 6f8d831817a3e29dfe5a44cbecf70b2b +Executable SHA256: d5a405d155740eea0a998adcd7425cd0eab7779bf58a6e82c57b9d4459b52d1a +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2024-21338/appid-10.0.22621.3155.sys?MD5=6f8d831817a3e29dfe5a44cbecf70b2b PDB Age: 1 PDB File: appid.pdb -PDB GUID: 110bd669-fcfd-1829-3b70-704202423bc5 +PDB GUID: 1511b1fb-dcec-d6ef-8433-af04797dabb7 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: AppID Driver -PE Property[FileVersion]: 10.0.22621.3139 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.22621.3640 (WinBuild.160101.0800) PE Property[InternalName]: appid.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: appid.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.22621.3139 +PE Property[ProductVersion]: 10.0.22621.3640 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra appid-10.0.22621.2506.sys Decompiler Options

Ghidra appid-10.0.22621.2506.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra appid-10.0.22621.2506.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra appid-10.0.22621.3155.sys Decompiler Options

Ghidra appid-10.0.22621.3155.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra appid-10.0.22621.3155.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|4| |deleted_funcs_len|0| |modified_funcs_len|6| |added_symbols_len|8| |deleted_symbols_len|1| |diff_time|15.83517575263977| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 597, 'ExternalsName': 214})| |items_to_process|19| |diff_types|Counter({'refcount': 5, 'address': 4, 'calling': 4, 'code': 1, 'length': 1, 'called': 1})| |unmatched_funcs_len|4| |total_funcs_len|1198| |matched_funcs_len|1194| |matched_funcs_with_code_changes_len|1| |matched_funcs_with_non_code_changes_len|5| |matched_funcs_no_changes_len|1188| |match_func_similarity_percent|99.4975%| |func_match_overall_percent|99.6661%| |first_matches|Counter({'SymbolsHash': 597})| ```mermaid pie showData title All Matches "SymbolsHash" : 597 "ExternalsName" : 214 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 597 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 4 "deleted_funcs_len" : 0 "modified_funcs_len" : 6 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 8 "deleted_symbols_len" : 1 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_2959575357__private_IsEnabled ### Function Meta |Key|appid-10.0.22621.3155.sys| | :---: | :---: | |name|Feature_2959575357__private_IsEnabled| |fullname|Feature_2959575357__private_IsEnabled| |refcount|2| |length|126| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|AipDeviceIoControlDispatch| |paramcount|0| |address|1c0001148| |sig|uint __fastcall Feature_2959575357__private_IsEnabled(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2959575357__private_IsEnabled +++ Feature_2959575357__private_IsEnabled @@ -0,0 +1,23 @@ + +uint Feature_2959575357__private_IsEnabled(void) + +{ + uint uVar1; + ulonglong uVar2; + uint uVar3; + ulonglong local_res8; + + local_res8 = (ulonglong)(uint)Feature_2959575357__private_featureState; + uVar1 = (uint)Feature_2959575357__private_featureState; + if (((uint)Feature_2959575357__private_featureState & 1) == 0) { + uVar2 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)&Feature_2959575357__private_featureState,local_res8,0x1c0015ef0); + uVar1 = (uint)uVar2; + } + uVar3 = uVar1 >> 3 & 1; + wil_details_FeatureReporting_ReportUsageToService + ((uint *)&Feature_2959575357__private_reporting,0x2be4732,uVar1 >> 8 & 1,uVar1 >> 9 & 1, + &Feature_2959575357_logged_traits,uVar3); + return uVar3; +} + ``` ## wil_details_FeatureStateCache_GetCachedFeatureEnabledState ### Function Meta |Key|appid-10.0.22621.3155.sys| | :---: | :---: | |name|wil_details_FeatureStateCache_GetCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_GetCachedFeatureEnabledState| |refcount|2| |length|45| |called|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |paramcount|2| |address|1c00016f8| |sig|ulonglong __fastcall wil_details_FeatureStateCache_GetCachedFeatureEnabledState(uint * param_1, undefined8 param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_GetCachedFeatureEnabledState +++ wil_details_FeatureStateCache_GetCachedFeatureEnabledState @@ -0,0 +1,14 @@ + +ulonglong wil_details_FeatureStateCache_GetCachedFeatureEnabledState(uint *param_1,longlong param_2) + +{ + undefined8 local_res8; + + local_res8 = (ulonglong)*param_1; + if ((*param_1 & 1) == 0) { + local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (param_1,local_res8,param_2); + } + return local_res8; +} + ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|appid-10.0.22621.3155.sys| | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3| |length|564| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureStateCache_GetCachedFeatureEnabledState| |calling|Feature_2959575357__private_IsEnabled
wil_details_FeatureStateCache_GetCachedFeatureEnabledState| |paramcount|3| |address|1c000172c| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -0,0 +1,150 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (uint *param_1,ulonglong param_2,longlong param_3) + +{ + undefined8 *puVar1; + uint uVar2; + byte bVar3; + byte bVar4; + int iVar5; + int iVar6; + uint uVar7; + ulonglong uVar8; + uint uVar9; + uint uVar10; + ulonglong uVar11; + longlong *plVar12; + uint uVar13; + bool bVar14; + bool bVar15; + undefined1 auStack_98 [32]; + undefined8 local_78; + undefined8 local_70; + undefined8 local_68; + undefined8 uStack_60; + undefined8 local_58; + undefined8 local_50; + undefined4 local_48; + ulonglong local_40; + + local_40 = __security_cookie ^ (ulonglong)auStack_98; + iVar5 = 0; + local_78 = param_2; + if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != 0) { + iVar5 = (*(code *)g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); + } + local_68 = 0; + uStack_60 = 0; + bVar3 = 1; + local_70 = 0; + local_58 = 0; + local_50 = 0; + local_48 = 0; + iVar6 = RtlQueryFeatureConfiguration + (*(undefined4 *)(param_3 + 0x10),1 < (byte)(*(char *)(param_3 + 0x14) - 2U), + &local_70,&local_50); + if (iVar6 == 0) { + uVar7 = local_50._4_4_ >> 7 & 1; + local_68 = CONCAT44(local_68._4_4_,local_50._4_4_ >> 4) & 0xffffffff00000003; + uVar9 = local_50._4_4_ >> 6 & 1; + uVar13 = local_50._4_4_ >> 4 & 3; + bVar4 = bVar3; +LAB_1c00017df: + bVar3 = bVar4; + uVar7 = uVar7 << 8; + if (uVar9 != 0) { + uVar9 = 0x200; + goto LAB_1c000180b; + } + } + else { + uVar7 = 0; + uVar9 = 0; + uVar13 = (uint)local_68; + bVar4 = 0; + if (iVar6 != 0x117) goto LAB_1c00017df; + uVar7 = (local_50._4_4_ >> 7 & 1) << 8; + } + uVar9 = 0; +LAB_1c000180b: + uVar10 = -(uint)bVar3 & uVar13 & 3; + if (uVar10 == 0) { + uVar2 = -(uint)(*(char *)(param_3 + 0x17) != '\0') & 0x10; + } + else { + uVar2 = 0; + if (uVar13 == 2) { + uVar2 = 0x10; + } + } + uVar13 = (uVar2 | uVar10 << 5 | uVar7 | uVar9) ^ uVar2 >> 1; + if (((uVar13 & 8) != 0) && (plVar12 = *(longlong **)(param_3 + 0x18), plVar12 != (longlong *)0x0)) + { + do { + puVar1 = (undefined8 *)*plVar12; + if (puVar1 == (undefined8 *)0x0) break; + if ((*(char *)((longlong)puVar1 + 0x16) == '\0') && + (*(char *)((longlong)puVar1 + 0x15) == '\0')) { + uVar8 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState((uint *)*puVar1,puVar1); + if ((uVar13 & 8) == 0) goto LAB_1c0001896; + bVar14 = (uVar8 & 8) == 0; +LAB_1c000188d: + if (bVar14) goto LAB_1c0001896; + uVar7 = 8; + } + else { + if ((uVar13 & 8) != 0) { + bVar14 = *(char *)((longlong)puVar1 + 0x17) == '\0'; + goto LAB_1c000188d; + } +LAB_1c0001896: + uVar7 = 0; + } + plVar12 = plVar12 + 1; + uVar13 = uVar13 & 0xfffffff7 | uVar7; + } while (uVar7 != 0); + } + bVar14 = *(char *)(param_3 + 0x14) != '\0'; + uVar8 = param_2 & 0xffffffff; + do { + uVar11 = param_2; + uVar7 = (uint)uVar8; + local_78 = CONCAT44(local_78._4_4_,uVar7); + if ((bVar14 || iVar5 != 0) && (local_78 = CONCAT44(local_78._4_4_,uVar7), (uVar8 & 1) == 0)) { + uVar9 = (uVar7 ^ uVar13) & 0x278 ^ uVar7; + uVar7 = uVar9 | 1; + local_78 = CONCAT44(local_78._4_4_,uVar9) | 1; + } + if ((uVar11 & 2) == 0) { + uVar9 = uVar7 ^ (uVar13 ^ uVar7) & 0x100; + uVar7 = uVar9 | 2; + local_78 = CONCAT44(local_78._4_4_,uVar9) | 2; + } + uVar8 = uVar11 & 0xffffffff; + LOCK(); + uVar9 = *param_1; + bVar15 = (uint)uVar11 == uVar9; + if (bVar15) { + *param_1 = uVar7; + } + else { + uVar8 = (ulonglong)uVar9; + } + UNLOCK(); + param_2 = uVar8; + } while (!bVar15); + if (((uVar11 & 2) == 0) && (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != 0)) + { + (*(code *)g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) + (param_1,*(undefined1 *)(param_3 + 0x14),iVar5); + } + if (!bVar14 && iVar5 == 0) { + local_78 = CONCAT44(local_78._4_4_,uVar7 ^ (uVar13 ^ uVar7) & 0x278); + } + return local_78; +} + ``` ## NTOSKRNL.EXE::ExGetPreviousMode ### Function Meta |Key|appid-10.0.22621.3155.sys| | :---: | :---: | |name|ExGetPreviousMode| |fullname|NTOSKRNL.EXE::ExGetPreviousMode| |refcount|2| |length|0| |called|| |calling|AipDeviceIoControlDispatch| |paramcount|0| |address|EXTERNAL:000000a9| |sig|undefined ExGetPreviousMode(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::ExGetPreviousMode* # Modified *Modified functions contain code changes* ## AipDeviceIoControlDispatch ### Match Info |Key|appid-10.0.22621.2506.sys - appid-10.0.22621.3155.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.4| |i_ratio|0.48| |m_ratio|0.99| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|appid-10.0.22621.2506.sys|appid-10.0.22621.3155.sys| | :---: | :---: | :---: | |name|AipDeviceIoControlDispatch|AipDeviceIoControlDispatch| |fullname|AipDeviceIoControlDispatch|AipDeviceIoControlDispatch| |refcount|4|4| |`length`|1646|1677| |`called`|

Expand for full list:
AiReloadCertificate
AiServiceStarted
AiServiceStopped
AiUnreferenceProcOriginList
AipForEachPlugin
AipReadConfigOptions
AipSmartHashImageFile
AipTransactionBegin
NTOSKRNL.EXE::ExEnterCriticalRegionAndAcquireResourceExclusive
NTOSKRNL.EXE::ExReleaseResourceAndLeaveCriticalRegion
NTOSKRNL.EXE::IofCompleteRequest

NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ZwResetEvent
NTOSKRNL.EXE::ZwSetEvent
ReplacePolicyRef
SrpGetHitCount
SrpInheritOrigin
SrpOpenTrackInstallIoctl
SrpPolicyTransactionRollback
SrpUpdatePolicy
SrpVerifyDll
WPP_SF_
WPP_SF_D
__security_check_cookie
memset

Expand for full list:
AiReloadCertificate
AiServiceStarted
AiServiceStopped
AiUnreferenceProcOriginList
AipForEachPlugin
AipReadConfigOptions
AipSmartHashImageFile
AipTransactionBegin
Feature_2959575357__private_IsEnabled
NTOSKRNL.EXE::ExEnterCriticalRegionAndAcquireResourceExclusive
NTOSKRNL.EXE::ExGetPreviousMode

NTOSKRNL.EXE::ExReleaseResourceAndLeaveCriticalRegion
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ZwResetEvent
NTOSKRNL.EXE::ZwSetEvent
ReplacePolicyRef
SrpGetHitCount
SrpInheritOrigin
SrpOpenTrackInstallIoctl
SrpPolicyTransactionRollback
SrpUpdatePolicy
SrpVerifyDll
WPP_SF_
WPP_SF_D
__security_check_cookie
memset

| |calling||| |paramcount|2|2| |address|1c001df20|1c001df20| |sig|uint __fastcall AipDeviceIoControlDispatch(longlong param_1, longlong param_2)|uint __fastcall AipDeviceIoControlDispatch(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### AipDeviceIoControlDispatch Called Diff ```diff --- AipDeviceIoControlDispatch called +++ AipDeviceIoControlDispatch called @@ -8,0 +9 @@ +Feature_2959575357__private_IsEnabled @@ -9,0 +11 @@ +NTOSKRNL.EXE::ExGetPreviousMode ``` ### AipDeviceIoControlDispatch Diff ```diff --- AipDeviceIoControlDispatch +++ AipDeviceIoControlDispatch @@ -1,279 +1,282 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ uint AipDeviceIoControlDispatch(longlong param_1,longlong param_2) { ulonglong *puVar1; int iVar2; longlong lVar3; undefined8 *puVar4; longlong *plVar5; - uint uVar6; + char cVar6; + uint uVar7; uint extraout_EAX; - undefined8 uVar7; - ulonglong uVar8; - undefined2 uVar9; - longlong lVar10; + undefined8 uVar8; + ulonglong uVar9; + undefined2 uVar10; + longlong lVar11; undefined1 auStackY_d8 [32]; undefined8 local_a8; undefined1 local_98 [16]; longlong local_88; int local_80; undefined8 local_78; undefined4 local_70; undefined8 local_68; undefined4 local_60; ulonglong *local_58; int local_50; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_d8; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x14, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); } lVar3 = *(longlong *)(param_2 + 0xb8); puVar1 = (ulonglong *)(param_2 + 0x38); *puVar1 = 0; iVar2 = *(int *)(lVar3 + 0x18); - if (g_AppId == param_1) { - if (iVar2 == 0x22a000) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x15, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - uVar6 = AiReloadCertificate(*(ushort **)(param_2 + 0x18),*(uint *)(lVar3 + 0x10)); - goto LAB_0; - } - if (iVar2 == 0x22a008) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x17, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - uVar6 = AiServiceStarted(*(undefined8 *)(lVar3 + 0x30)); - if (-1 < (int)uVar6) { - DAT_1 = *(undefined8 *)(lVar3 + 0x30); - } - local_a8 = (ulonglong)local_a8._4_4_ << 0x20; - ZwSetEvent(DAT_2,&local_a8); - goto LAB_0; - } - if (iVar2 == 0x22a00c) { - local_a8 = local_a8 & 0xffffffff00000000; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x18, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - uVar8 = AiServiceStopped(*(longlong *)(lVar3 + 0x30)); - uVar6 = (uint)uVar8; - if (-1 < (int)uVar6) { - DAT_1 = 0; - } - ZwResetEvent(DAT_2,&local_a8); - goto LAB_0; - } - if (iVar2 == 0x22a010) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x19, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - uVar7 = AipReadConfigOptions(); - uVar6 = (uint)uVar7; - goto LAB_0; - } - if (iVar2 == 0x22a014) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1a, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - if (*(int *)(lVar3 + 8) == 0x30) { - puVar4 = *(undefined8 **)(param_2 + 0x18); - *puVar4 = &DAT_3; - puVar4[1] = &DAT_4; - puVar4[2] = &DAT_5; - puVar4[3] = &DAT_6; - puVar4[4] = AiReleaseOriginProcessData; - puVar4[5] = AiAllocUninstallStringData; - *puVar1 = 0x30; - goto LAB_7; - } - } - else { - if (iVar2 != 0x22a018) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { - uVar9 = 0x1c; -LAB_8: - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar9, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids,iVar2); - } -LAB_9: - uVar6 = 0xc0000010; - goto LAB_0; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1b, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - if (*(int *)(lVar3 + 0x10) == 0x20) { - uVar6 = AipSmartHashImageFile(*(longlong *)(param_2 + 0x18),0,0,0); - goto LAB_0; - } - } -LAB_10: - uVar6 = 0xc000000d; - } - else { - if (DAT_11 != param_1) { + if (g_AppId != param_1) { + if (DAT_0 != param_1) { memset(local_98,0,0x50); local_78 = *(undefined8 *)(param_2 + 0x18); local_70 = *(undefined4 *)(lVar3 + 0x10); local_50 = 0; local_60 = *(undefined4 *)(lVar3 + 8); local_88 = param_1; local_80 = iVar2; local_68 = local_78; local_58 = puVar1; - uVar7 = AipForEachPlugin(AipPluginInvokeIoctlCallback,local_98); - uVar6 = 0xc0000010; + uVar8 = AipForEachPlugin(AipPluginInvokeIoctlCallback,local_98); + uVar7 = 0xc0000010; if (local_50 != 0) { - uVar6 = (uint)uVar7; - } - goto LAB_0; + uVar7 = (uint)uVar8; + } + goto LAB_1; } if (iVar2 == 0x225804) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1e, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - uVar8 = SrpVerifyDll(*(undefined8 **)(param_2 + 0x18),*(uint *)(lVar3 + 0x10), + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + uVar9 = SrpVerifyDll(*(undefined8 **)(param_2 + 0x18),*(uint *)(lVar3 + 0x10), (uint *)*(undefined8 **)(param_2 + 0x18), (wchar_t *)(ulonglong)*(uint *)(lVar3 + 8), *(undefined1 *)(param_2 + 0x40),(longlong *)puVar1); - uVar6 = (uint)uVar8; - goto LAB_0; + uVar7 = (uint)uVar9; + goto LAB_1; } if (iVar2 == 0x225818) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x23, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - uVar8 = SrpInheritOrigin(*(undefined8 **)(param_2 + 0x18),*(uint *)(lVar3 + 0x10)); - uVar6 = (uint)uVar8; - goto LAB_0; + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + uVar9 = SrpInheritOrigin(*(undefined8 **)(param_2 + 0x18),*(uint *)(lVar3 + 0x10)); + uVar7 = (uint)uVar9; + goto LAB_1; } if (iVar2 == 0x22581c) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x24, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - uVar8 = SrpOpenTrackInstallIoctl(); - uVar6 = (uint)uVar8; - goto LAB_0; + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + uVar9 = SrpOpenTrackInstallIoctl(); + uVar7 = (uint)uVar9; + goto LAB_1; } if (iVar2 == 0x225820) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x25, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); } local_a8 = 0; - uVar6 = ObReferenceObjectByHandle + uVar7 = ObReferenceObjectByHandle (0xffffffffffffffff,0x1fffff,*(undefined8 *)PsProcessType_exref,0); - uVar8 = local_a8; - if (-1 < (int)uVar6) { + uVar9 = local_a8; + if (-1 < (int)uVar7) { AiUnreferenceProcOriginList(local_a8); - ObfDereferenceObject(uVar8); - } - goto LAB_0; + ObfDereferenceObject(uVar9); + } + goto LAB_1; } if (iVar2 == 0x229800) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1d, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - uVar6 = SrpUpdatePolicy(); - goto LAB_0; + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + uVar7 = SrpUpdatePolicy(); + goto LAB_1; } if (iVar2 == 0x229808) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1f, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); } SrpGetHitCount(*(wchar_t **)(param_2 + 0x18),*(uint *)(lVar3 + 0x10), (longlong)*(wchar_t **)(param_2 + 0x18),*(uint *)(lVar3 + 8),puVar1); - uVar6 = extraout_EAX; - goto LAB_0; + uVar7 = extraout_EAX; + goto LAB_1; } if (iVar2 == 0x22980c) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x20, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); - } - uVar6 = AipTransactionBegin(*(ulonglong **)(param_2 + 0x18),*(int *)(lVar3 + 0x10), + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + uVar7 = AipTransactionBegin(*(ulonglong **)(param_2 + 0x18),*(int *)(lVar3 + 0x10), *(ulonglong **)(param_2 + 0x18),*(int *)(lVar3 + 8),puVar1); - goto LAB_0; + goto LAB_1; } if (iVar2 == 0x229810) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x21, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); } plVar5 = *(longlong **)(param_2 + 0x18); - if (*(int *)(lVar3 + 0x10) != 0x10) goto LAB_10; - ExEnterCriticalRegionAndAcquireResourceExclusive(&DAT_12); - lVar3 = DAT_13; - lVar10 = 0; - if ((*plVar5 == DAT_14) && (plVar5[1] == DAT_1c00163c8)) { - DAT_13 = 0; - DAT_14 = 0; - DAT_15 = 0; - lVar10 = lVar3; - } - ExReleaseResourceAndLeaveCriticalRegion(&DAT_12); - if (lVar10 == 0) { - uVar6 = 0xc0000212; - goto LAB_0; - } - ReplacePolicyRef(lVar10); + if (*(int *)(lVar3 + 0x10) != 0x10) goto LAB_2; + ExEnterCriticalRegionAndAcquireResourceExclusive(&DAT_3); + lVar3 = DAT_4; + lVar11 = 0; + if ((*plVar5 == DAT_5) && (plVar5[1] == DAT_1c00163e8)) { + DAT_4 = 0; + DAT_5 = 0; + DAT_6 = 0; + lVar11 = lVar3; + } + ExReleaseResourceAndLeaveCriticalRegion(&DAT_3); + if (lVar11 == 0) { + uVar7 = 0xc0000212; + goto LAB_1; + } + ReplacePolicyRef(lVar11); } else { if (iVar2 != 0x229814) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { - uVar9 = 0x26; - goto LAB_8; + uVar10 = 0x26; + goto LAB_7; } - goto LAB_9; + goto LAB_8; } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x22, - &WPP_1ce862bc955b392889c1b25f85145990_Traceguids); + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); } SrpPolicyTransactionRollback(); } +LAB_9: + uVar7 = 0; + goto LAB_1; + } + if (iVar2 == 0x22a000) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x15, + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + uVar7 = AiReloadCertificate(*(ushort **)(param_2 + 0x18),*(uint *)(lVar3 + 0x10)); + goto LAB_1; + } + if (iVar2 == 0x22a008) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x17, + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + uVar7 = AiServiceStarted(*(undefined8 *)(lVar3 + 0x30)); + if (-1 < (int)uVar7) { + DAT_10 = *(undefined8 *)(lVar3 + 0x30); + } + local_a8 = (ulonglong)local_a8._4_4_ << 0x20; + ZwSetEvent(DAT_11,&local_a8); + goto LAB_1; + } + if (iVar2 == 0x22a00c) { + local_a8 = local_a8 & 0xffffffff00000000; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x18, + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + uVar9 = AiServiceStopped(*(longlong *)(lVar3 + 0x30)); + uVar7 = (uint)uVar9; + if (-1 < (int)uVar7) { + DAT_10 = 0; + } + ZwResetEvent(DAT_11,&local_a8); + goto LAB_1; + } + if (iVar2 == 0x22a010) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x19, + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + uVar8 = AipReadConfigOptions(); + uVar7 = (uint)uVar8; + goto LAB_1; + } + if (iVar2 == 0x22a014) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1a, + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + if (*(int *)(lVar3 + 8) == 0x30) { + puVar4 = *(undefined8 **)(param_2 + 0x18); + *puVar4 = &DAT_12; + puVar4[1] = &DAT_13; + puVar4[2] = &DAT_14; + puVar4[3] = &DAT_15; + puVar4[4] = AiReleaseOriginProcessData; + puVar4[5] = AiAllocUninstallStringData; + *puVar1 = 0x30; + goto LAB_9; + } +LAB_2: + uVar7 = 0xc000000d; + } + else { + if (iVar2 == 0x22a018) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1b, + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids); + } + uVar7 = Feature_2959575357__private_IsEnabled(); + if ((uVar7 == 0) || (cVar6 = ExGetPreviousMode(), cVar6 == '\0')) { + if (*(int *)(lVar3 + 0x10) == 0x20) { + uVar7 = AipSmartHashImageFile(*(longlong *)(param_2 + 0x18),0,0,0); + goto LAB_1; + } + goto LAB_2; + } + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) { + uVar10 = 0x1c; LAB_7: - uVar6 = 0; - } -LAB_0: - *(uint *)(param_2 + 0x30) = uVar6; + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar10, + &WPP_9fed954e24023a5a6dae708fb6376e6f_Traceguids,iVar2); + } +LAB_8: + uVar7 = 0xc0000010; + } +LAB_1: + *(uint *)(param_2 + 0x30) = uVar7; IofCompleteRequest(param_2,0); - return uVar6; + return uVar7; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|appid-10.0.22621.2506.sys - appid-10.0.22621.3155.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|appid-10.0.22621.2506.sys|appid-10.0.22621.3155.sys| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|65|66| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|1c0005c88|1c0005f78| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## __security_check_cookie ### Match Info |Key|appid-10.0.22621.2506.sys - appid-10.0.22621.3155.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|appid-10.0.22621.2506.sys|appid-10.0.22621.3155.sys| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|71|72| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|

Expand for full list:
AiCapturePackageMoniker
AiConvertFullImagePathToMacroFormat
AiGetCatalogLastWriteTime
AiGetOriginalFileName
AiGetPlugins
AiGetPolicy
AiGetPublisherCache
AiGetTrustedPublisherName
AiGetTrustedPublisherNameFromCache
AiGetUninstallStringEa
AiGetVolumeInfo

AiLogAppxSrpRuleEvent
AiLogCheckCmdlineAgainstUninstallString
AiLogFileAndStatusEvent
AiLogSmartlockerEnforcementStatusEvent
AiLogSrpRuleEvent
AiLogStatusEvent
AiParseAndTagUninstallerFromUninstallString
AiProcessNotifyRoutine
AiRemoveProcFromTracking
AiRtlFindCharInUnicodeString
AiSetAttributesExe
AiSetTokenAttributes
AiVerifyFile
AiVerifyPackageMoniker
AipAllocCertName
AipCollectImageProperties
AipCreateProcessNotifyRoutine
AipDeviceIoControlDispatch
AipGUIDFromString
AipGetImageId
AipGetPeImageVersionInfo
AipGetTrustedPublisherNameFromService
AipReadConfigOptions
AipSetServicePublisherInfoInCache
AipSmartHashImageFile
AipTransactionBegin
AipUnload
AipkIsCertificateTrusted
AipkLoadRegCache
AppHashComputeFileHashesInternal
AppHashComputeImageHashInternal
CreateFqbnString
DriverEntry
EdpPluginNotifyRoutine
EdppEnableAudit
EdppImpersonateProcess
EdppIsEnterpriseSMBFile
EdppProcessEnumRoutine
PluginInvokeCallback
QueryAttributes
SmartlockerGetValidEA
SmartlockerTelemetrizeOriginInfo
SrpCreatePluginFileName
SrpDeleteEnterpriseContextToken
SrpIsOnlySmartAppControlEnabledForPolicyType
SrpPolicyTransactionBegin
SrpUpdatePolicy
SrpVerifyDll
SrppAccessCheck
SrppIsApplicationEDPResourceSet
SrppIsApplicationEDPResourceSetKernel
SrppPluginAccessCheck
SymCryptDetectCpuFeaturesByCpuid
WdagPluginEvaluate
WdagPluginNotifyRoutine
__GSHandlerCheckCommon
wil_InitializeFeatureStaging
wil_details_FeatureReporting_ReportUsageToService
wil_details_OnFeatureConfigurationChange

| |paramcount|1|1| |address|1c00010c0|1c00010c0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -69,0 +70 @@ +wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ``` ## NTOSKRNL.EXE::RtlQueryFeatureConfiguration ### Match Info |Key|appid-10.0.22621.2506.sys - appid-10.0.22621.3155.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|appid-10.0.22621.2506.sys|appid-10.0.22621.3155.sys| | :---: | :---: | :---: | |name|RtlQueryFeatureConfiguration|RtlQueryFeatureConfiguration| |fullname|NTOSKRNL.EXE::RtlQueryFeatureConfiguration|NTOSKRNL.EXE::RtlQueryFeatureConfiguration| |`refcount`|3|4| |length|0|0| |called||| |`calling`|wil_InitializeFeatureStaging
wil_details_OnFeatureConfigurationChange|wil_InitializeFeatureStaging
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_OnFeatureConfigurationChange| |paramcount|0|0| |`address`|EXTERNAL:000000a7|EXTERNAL:000000a8| |sig|undefined RtlQueryFeatureConfiguration(void)|undefined RtlQueryFeatureConfiguration(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlQueryFeatureConfiguration Calling Diff ```diff --- NTOSKRNL.EXE::RtlQueryFeatureConfiguration calling +++ NTOSKRNL.EXE::RtlQueryFeatureConfiguration calling @@ -1,0 +2 @@ +wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ``` ## wil_details_FeatureReporting_ReportUsageToService ### Match Info |Key|appid-10.0.22621.2506.sys - appid-10.0.22621.3155.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.87| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|appid-10.0.22621.2506.sys|appid-10.0.22621.3155.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |`refcount`|11|12| |length|304|304| |called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |`calling`|AiGetTrustedPublisherName
AiReloadCertificate
AipAddCertFromCertStore
AipAllocCertName|AiGetTrustedPublisherName
AiReloadCertificate
AipAddCertFromCertStore
AipAllocCertName
Feature_2959575357__private_IsEnabled| |paramcount|6|6| |`address`|1c000217c|1c00015c0| |sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(uint * param_1, undefined4 param_2, int param_3, int param_4, undefined8 param_5, int param_6)|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(uint * param_1, undefined4 param_2, int param_3, int param_4, undefined8 param_5, int param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToService Calling Diff ```diff --- wil_details_FeatureReporting_ReportUsageToService calling +++ wil_details_FeatureReporting_ReportUsageToService calling @@ -4,0 +5 @@ +Feature_2959575357__private_IsEnabled ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-07-28T08:17:37}