# bfs.sys KB5048667 vs KB5050009 (CVE-2025-21315, CVE-2025-21372) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_2880249144__private_IsEnabledDeviceUsageNoInline](#feature_2880249144__private_isenableddeviceusagenoinline) * [Feature_2880249144__private_IsEnabledFallback](#feature_2880249144__private_isenabledfallback) * [Feature_752421176__private_IsEnabledDeviceUsageNoInline](#feature_752421176__private_isenableddeviceusagenoinline) * [Feature_752421176__private_IsEnabledFallback](#feature_752421176__private_isenabledfallback) * [Modified](#modified) * [BfsCheckAndReleaseIdlePolicy](#bfscheckandreleaseidlepolicy) * [BfsProcessSetPolicyRequest](#bfsprocesssetpolicyrequest) * [BfsGetPolicyEntry](#bfsgetpolicyentry) * [BfsProcessQueryPolicySizeRequest](#bfsprocessquerypolicysizerequest) * [BfsReleaseNamedPipeMapping](#bfsreleasenamedpipemapping) * [BfsProcessQueryPolicyRequest](#bfsprocessquerypolicyrequest) * [BfsUninitializePolicyTable](#bfsuninitializepolicytable) * [BfsDeleteFileFromGlobalFileTable](#bfsdeletefilefromglobalfiletable) * [BfsInsertNotPresentPolicyEntry](#bfsinsertnotpresentpolicyentry) * [BfsInsertPolicyEntry](#bfsinsertpolicyentry) * [BfsPostCreateOperation](#bfspostcreateoperation) * [BfsCheckAndApplyPolicy](#bfscheckandapplypolicy) * [BfsPerformPrompt](#bfsperformprompt) * [BfsRemovePolicyEntry](#bfsremovepolicyentry) * [BfsGetRegistryPrefix](#bfsgetregistryprefix) * [BfsDereferencePolicyEntry](#bfsdereferencepolicyentry) * [Modified (No Code Changes)](#modified-no-code-changes) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [NTOSKRNL.EXE::ExReleasePushLockExclusiveEx](#ntoskrnlexeexreleasepushlockexclusiveex) * [NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx](#ntoskrnlexeexacquirepushlockexclusiveex) * [NTOSKRNL.EXE::KeEnterCriticalRegion](#ntoskrnlexekeentercriticalregion) * [_tlgWriteTransfer_EtwWriteTransfer](#_tlgwritetransfer_etwwritetransfer) * [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag) * [NTOSKRNL.EXE::KeLeaveCriticalRegion](#ntoskrnlexekeleavecriticalregion) * [BfsRemoveEntryHashTable](#bfsremoveentryhashtable) # Visual Chart Diff ```mermaid flowchart LR BfsCheckAndReleaseIdlePolicy-1-old<--Match 94%-->BfsCheckAndReleaseIdlePolicy-1-new BfsProcessSetPolicyRequest-2-old<--Match 99%-->BfsProcessSetPolicyRequest-2-new BfsGetPolicyEntry-6-old<--Match 97%-->BfsGetPolicyEntry-6-new BfsProcessQueryPolicySizeRequest-2-old<--Match 98%-->BfsProcessQueryPolicySizeRequest-2-new BfsReleaseNamedPipeMapping-2-old<--Match 72%-->BfsReleaseNamedPipeMapping-2-new BfsProcessQueryPolicyRequest-3-old<--Match 97%-->BfsProcessQueryPolicyRequest-3-new BfsUninitializePolicyTable-1-old<--Match 92%-->BfsUninitializePolicyTable-1-new BfsDeleteFileFromGlobalFileTable-3-old<--Match 96%-->BfsDeleteFileFromGlobalFileTable-3-new BfsInsertNotPresentPolicyEntry-4-old<--Match 98%-->BfsInsertNotPresentPolicyEntry-4-new BfsInsertPolicyEntry-7-old<--Match 59%-->BfsInsertPolicyEntry-7-new BfsPostCreateOperation-4-old<--Match 65%-->BfsPostCreateOperation-4-new BfsCheckAndApplyPolicy-5-old<--Match 97%-->BfsCheckAndApplyPolicy-5-new BfsPerformPrompt-3-old<--Match 99%-->BfsPerformPrompt-3-new BfsRemovePolicyEntry-5-old<--Match 95%-->BfsRemovePolicyEntry-5-new BfsGetRegistryPrefix-3-old<--Match 98%-->BfsGetRegistryPrefix-3-new BfsDereferencePolicyEntry-1-old<--Match 81%-->BfsDereferencePolicyEntryEx-1-new subgraph bfs-10.0.26100.2894.sys BfsCheckAndReleaseIdlePolicy-1-new BfsProcessSetPolicyRequest-2-new BfsGetPolicyEntry-6-new BfsProcessQueryPolicySizeRequest-2-new BfsReleaseNamedPipeMapping-2-new BfsProcessQueryPolicyRequest-3-new BfsUninitializePolicyTable-1-new BfsDeleteFileFromGlobalFileTable-3-new BfsInsertNotPresentPolicyEntry-4-new BfsInsertPolicyEntry-7-new BfsPostCreateOperation-4-new BfsCheckAndApplyPolicy-5-new BfsPerformPrompt-3-new BfsRemovePolicyEntry-5-new BfsGetRegistryPrefix-3-new BfsDereferencePolicyEntryEx-1-new subgraph Added direction LR Feature_2880249144__private_IsEnabledDeviceUsageNoInline Feature_2880249144__private_IsEnabledFallback Feature_752421176__private_IsEnabledDeviceUsageNoInline Feature_752421176__private_IsEnabledFallback end end subgraph bfs-10.0.26100.2454.sys BfsCheckAndReleaseIdlePolicy-1-old BfsProcessSetPolicyRequest-2-old BfsGetPolicyEntry-6-old BfsProcessQueryPolicySizeRequest-2-old BfsReleaseNamedPipeMapping-2-old BfsProcessQueryPolicyRequest-3-old BfsUninitializePolicyTable-1-old BfsDeleteFileFromGlobalFileTable-3-old BfsInsertNotPresentPolicyEntry-4-old BfsInsertPolicyEntry-7-old BfsPostCreateOperation-4-old BfsCheckAndApplyPolicy-5-old BfsPerformPrompt-3-old BfsRemovePolicyEntry-5-old BfsGetRegistryPrefix-3-old BfsDereferencePolicyEntry-1-old end ``` ```mermaid pie showData title Function Matches - 99.4730% "unmatched_funcs_len" : 4 "matched_funcs_len" : 755 ``` ```mermaid pie showData title Matched Function Similarity - 96.6887% "matched_funcs_with_code_changes_len" : 16 "matched_funcs_with_non_code_changes_len" : 9 "matched_funcs_no_changes_len" : 730 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2025-21315\ghidra_projects --project-name CVE-2025-21315 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2025-21315\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title bfs.sys KB5048667 vs KB5050009 (CVE-2025-21315, CVE-2025-21372) bfs-10.0.26100.2454.sys bfs-10.0.26100.2894.sys ``` #### Verbose Args
``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2025-21315\\bfs-10.0.26100.2454.sys'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2025-21315\\bfs-10.0.26100.2894.sys']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2025-21315\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2025-21315\ghidra_projects --project-name CVE-2025-21315 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2025-21315\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title bfs.sys KB5048667 vs KB5050009 (CVE-2025-21315, CVE-2025-21372) ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/Bfs.sys/85B25AE020000/Bfs.sys -O bfs.sys.x64.10.0.26100.2454 wget https://msdl.microsoft.com/download/symbols/Bfs.sys/8971CFE320000/Bfs.sys -O bfs.sys.x64.10.0.26100.2894 ``` ## Binary Metadata Diff ```diff --- bfs-10.0.26100.2454.sys Meta +++ bfs-10.0.26100.2894.sys Meta @@ -1,44 +1,44 @@ -Program Name: bfs-10.0.26100.2454.sys +Program Name: bfs-10.0.26100.2894.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f # of Bytes: 137296 # of Memory Blocks: 13 -# of Instructions: 17119 -# of Defined Data: 2632 -# of Functions: 377 -# of Symbols: 2778 +# of Instructions: 17383 +# of Defined Data: 2667 +# of Functions: 382 +# of Symbols: 2802 # of Data Types: 357 # of Data Type Categories: 22 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Sat Jul 25 10:29:35 SGT 2026 +Date Created: Sat Jul 25 10:29:40 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2025-21315/bfs-10.0.26100.2454.sys -Executable MD5: fd7a10b9101ca946001093e123aca654 -Executable SHA256: a1c9561331f0aae5303ddb72ee5f15243530f555bd8200647f7f18ebabe05612 -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2025-21315/bfs-10.0.26100.2454.sys?MD5=fd7a10b9101ca946001093e123aca654 +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2025-21315/bfs-10.0.26100.2894.sys +Executable MD5: 14fe4e5017b7ac88bd2e49930c9bd6d4 +Executable SHA256: 160b366016361bae8bc2693f729e20beec6a068dd466b5410ed83ee8b100e1e9 +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2025-21315/bfs-10.0.26100.2894.sys?MD5=14fe4e5017b7ac88bd2e49930c9bd6d4 PDB Age: 1 PDB File: bfs.pdb -PDB GUID: c256305f-00c1-fa5f-7cd2-4a45c525d363 +PDB GUID: 9b43b4ad-6f32-59e7-4e0a-e9d3b6b2abd5 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Bfs Filter Driver -PE Property[FileVersion]: 10.0.26100.2454 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.2894 (WinBuild.160101.0800) PE Property[InternalName]: Bfs.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: Bfs.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.2454 +PE Property[ProductVersion]: 10.0.26100.2894 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra bfs-10.0.26100.2454.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra bfs-10.0.26100.2454.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra bfs-10.0.26100.2454.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra bfs-10.0.26100.2894.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra bfs-10.0.26100.2894.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra bfs-10.0.26100.2894.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|4| |deleted_funcs_len|0| |modified_funcs_len|25| |added_symbols_len|6| |deleted_symbols_len|0| |diff_time|15.987828493118286| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 376, 'ExternalsName': 185, 'Implied Match': 1})| |items_to_process|35| |diff_types|Counter({'address': 18, 'code': 16, 'length': 16, 'called': 16, 'refcount': 9, 'calling': 8, 'sig': 5, 'name': 1, 'fullname': 1})| |unmatched_funcs_len|4| |total_funcs_len|759| |matched_funcs_len|755| |matched_funcs_with_code_changes_len|16| |matched_funcs_with_non_code_changes_len|9| |matched_funcs_no_changes_len|730| |match_func_similarity_percent|96.6887%| |func_match_overall_percent|99.4730%| |first_matches|Counter({'SymbolsHash': 376, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 376 "ExternalsName" : 185 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 376 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 4 "deleted_funcs_len" : 0 "modified_funcs_len" : 25 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 6 "deleted_symbols_len" : 0 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_2880249144__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|bfs-10.0.26100.2894.sys| | :---: | :---: | |name|Feature_2880249144__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_2880249144__private_IsEnabledDeviceUsageNoInline| |refcount|21| |length|49| |called|Feature_2880249144__private_IsEnabledFallback| |calling|
Expand for full list:
BfsCheckAndApplyPolicy
BfsCheckAndReleaseIdlePolicy
BfsDeleteFileFromGlobalFileTable
BfsGetPolicyEntry
BfsGetRegistryPrefix
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsPerformPrompt
BfsPostCreateOperation
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequestBfsProcessSetPolicyRequest
BfsRemovePolicyEntry
BfsUninitializePolicyTable
| |paramcount|0| |address|1c0003808| |sig|ulonglong __fastcall Feature_2880249144__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2880249144__private_IsEnabledDeviceUsageNoInline +++ Feature_2880249144__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_2880249144__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_2880249144__private_featureState; + if ((Feature_2880249144__private_featureState & 0x10) == 0) { + uVar1 = Feature_2880249144__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_2880249144__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_2880249144__private_IsEnabledFallback ### Function Meta |Key|bfs-10.0.26100.2894.sys| | :---: | :---: | |name|Feature_2880249144__private_IsEnabledFallback| |fullname|Feature_2880249144__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_2880249144__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1c0003840| |sig|undefined __fastcall Feature_2880249144__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2880249144__private_IsEnabledFallback +++ Feature_2880249144__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_2880249144__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_2880249144__private_descriptor); + return; +} + ``` ## Feature_752421176__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|bfs-10.0.26100.2894.sys| | :---: | :---: | |name|Feature_752421176__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_752421176__private_IsEnabledDeviceUsageNoInline| |refcount|5| |length|49| |called|Feature_752421176__private_IsEnabledFallback| |calling|BfsReleaseNamedPipeMapping| |paramcount|0| |address|1c0009edc| |sig|ulonglong __fastcall Feature_752421176__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_752421176__private_IsEnabledDeviceUsageNoInline +++ Feature_752421176__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_752421176__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_752421176__private_featureState; + if ((Feature_752421176__private_featureState & 0x10) == 0) { + uVar1 = Feature_752421176__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_752421176__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_752421176__private_IsEnabledFallback ### Function Meta |Key|bfs-10.0.26100.2894.sys| | :---: | :---: | |name|Feature_752421176__private_IsEnabledFallback| |fullname|Feature_752421176__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_752421176__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1c0009f14| |sig|undefined __fastcall Feature_752421176__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_752421176__private_IsEnabledFallback +++ Feature_752421176__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_752421176__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_752421176__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## BfsCheckAndReleaseIdlePolicy ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.61| |i_ratio|0.68| |m_ratio|0.94| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsCheckAndReleaseIdlePolicy|BfsCheckAndReleaseIdlePolicy| |fullname|BfsCheckAndReleaseIdlePolicy|BfsCheckAndReleaseIdlePolicy| |refcount|2|2| |`length`|408|450| |`called`|BfsDereferencePolicyEntry
BfsRemoveEntryHashTable
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExCancelTimer
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion|
Expand for full list:
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsRemoveEntryHashTable
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExCancelTimer
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
| |calling|BfsIdleCheckWorkitemRoutine|BfsIdleCheckWorkitemRoutine| |paramcount|1|1| |`address`|1c0004e00|1c0004ea4| |sig|undefined __fastcall BfsCheckAndReleaseIdlePolicy(longlong param_1)|undefined __fastcall BfsCheckAndReleaseIdlePolicy(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsCheckAndReleaseIdlePolicy Called Diff ```diff --- BfsCheckAndReleaseIdlePolicy called +++ BfsCheckAndReleaseIdlePolicy called @@ -1,0 +2 @@ +BfsDereferencePolicyEntryEx @@ -2,0 +4 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsCheckAndReleaseIdlePolicy Diff ```diff --- BfsCheckAndReleaseIdlePolicy +++ BfsCheckAndReleaseIdlePolicy @@ -1,94 +1,112 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void BfsCheckAndReleaseIdlePolicy(longlong param_1) { undefined8 *puVar1; int *piVar2; undefined8 ***pppuVar3; int iVar4; undefined8 uVar5; code *pcVar6; - undefined8 *puVar7; - undefined8 ***pppuVar8; - undefined1 *puVar9; + ulonglong uVar7; + undefined8 *puVar8; + undefined8 ***pppuVar9; + undefined1 *puVar10; undefined1 auStack_38 [8]; undefined1 auStack_30 [24]; undefined8 **local_18; undefined8 **local_10; - puVar9 = auStack_38; + puVar10 = auStack_38; local_10 = &local_18; - pppuVar8 = (undefined8 ***)(_DAT_0 + -3000000000); + pppuVar9 = (undefined8 ***)(_DAT_0 + -3000000000); local_18 = &local_18; KeEnterCriticalRegion(); ExAcquirePushLockSharedEx(param_1,0); puVar1 = (undefined8 *)(param_1 + 0x10); - puVar7 = (undefined8 *)*puVar1; + puVar8 = (undefined8 *)*puVar1; do { - if (puVar7 == puVar1) { + if (puVar8 == puVar1) { ExReleasePushLockSharedEx(param_1,0); KeLeaveCriticalRegion(); if ((undefined8 ***)local_18 != &local_18) { KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_1,0); - pppuVar8 = (undefined8 ***)local_18; - while (pppuVar8 != &local_18) { + pppuVar9 = (undefined8 ***)local_18; + while (pppuVar9 != &local_18) { LAB_1: - pppuVar3 = pppuVar8 + -10; - if (*(int *)(pppuVar8 + 8) == 2) { - uVar5 = *(undefined8 *)(param_1 + 8); - *(undefined8 *)(puVar9 + -8) = 0x1c0004f29; - BfsRemoveEntryHashTable(uVar5,pppuVar3); - pppuVar8 = (undefined8 ***)*pppuVar8; - *(undefined8 *)(puVar9 + -8) = 0x1c0004f34; + pppuVar3 = pppuVar9 + -10; + if (*(int *)(pppuVar9 + 8) == 2) { + *(undefined8 *)(puVar10 + -8) = 0x1c0004fc6; + uVar7 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + uVar5 = *(undefined8 *)(param_1 + 8); + *(undefined8 *)(puVar10 + -8) = 0x1c0004fd6; + BfsRemoveEntryHashTable(uVar5,pppuVar3); + pppuVar9 = (undefined8 ***)*pppuVar9; + *(undefined8 *)(puVar10 + -8) = 0x1c0004fe1; + BfsDereferencePolicyEntry((longlong)pppuVar3); + } + else { + pppuVar9 = (undefined8 ***)*pppuVar9; + *(undefined8 *)(puVar10 + -8) = 0x1c0004ff0; + BfsDereferencePolicyEntryEx((longlong)pppuVar3,'\x01'); + } + } + else { + pppuVar9 = (undefined8 ***)*pppuVar9; + } + *(undefined8 *)(puVar10 + -8) = 0x1c0004ffa; + uVar7 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + *(undefined8 *)(puVar10 + -8) = 0x1c0005006; BfsDereferencePolicyEntry((longlong)pppuVar3); } else { - pppuVar8 = (undefined8 ***)*pppuVar8; + *(undefined8 *)(puVar10 + -8) = 0x1c000500f; + BfsDereferencePolicyEntryEx((longlong)pppuVar3,'\x01'); } - *(undefined8 *)(puVar9 + -8) = 0x1c0004f41; - BfsDereferencePolicyEntry((longlong)pppuVar3); } if ((undefined8 *)*puVar1 == puVar1) { uVar5 = *(undefined8 *)(param_1 + 0x20); - *(undefined8 *)(puVar9 + -8) = 0x1c0004f5c; + *(undefined8 *)(puVar10 + -8) = 0x1c000502a; ExCancelTimer(uVar5,0); } - *(undefined8 *)(puVar9 + -8) = 0x1c0004f6d; + *(undefined8 *)(puVar10 + -8) = 0x1c000503b; ExReleasePushLockExclusiveEx(param_1,0); - *(undefined8 *)(puVar9 + -8) = 0x1c0004f79; + *(undefined8 *)(puVar10 + -8) = 0x1c0005047; KeLeaveCriticalRegion(); } return; } - if ((longlong)puVar7[4] < (longlong)pppuVar8) { + if ((longlong)puVar8[4] < (longlong)pppuVar9) { LOCK(); - piVar2 = (int *)(puVar7 + 10); + piVar2 = (int *)(puVar8 + 10); iVar4 = *piVar2; *piVar2 = *piVar2 + 1; UNLOCK(); if (iVar4 == 1) { - pppuVar3 = (undefined8 ***)(puVar7 + 2); + pppuVar3 = (undefined8 ***)(puVar8 + 2); if ((undefined8 ***)*local_10 != &local_18) { pcVar6 = (code *)swi(0x29); (*pcVar6)(3); - puVar9 = auStack_30; + puVar10 = auStack_30; goto LAB_1; } - puVar7[3] = local_10; + puVar8[3] = local_10; *pppuVar3 = &local_18; *local_10 = pppuVar3; local_10 = pppuVar3; } else { LOCK(); - *(int *)(puVar7 + 10) = *(int *)(puVar7 + 10) + -1; + *(int *)(puVar8 + 10) = *(int *)(puVar8 + 10) + -1; UNLOCK(); } } - puVar7 = (undefined8 *)*puVar7; + puVar8 = (undefined8 *)*puVar8; } while( true ); } ``` ## BfsProcessSetPolicyRequest ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.97| |i_ratio|0.8| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsProcessSetPolicyRequest|BfsProcessSetPolicyRequest| |fullname|BfsProcessSetPolicyRequest|BfsProcessSetPolicyRequest| |refcount|2|2| |`length`|1909|1938| |`called`|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsAllocateAndConcatenatePath
BfsDeleteEntry
BfsDereferencePolicyEntry
BfsGetFileName
BfsGetFinalPathComponent
BfsGetPolicy
BfsGetPolicyEntry
BfsGetShareName
BfsIsApplicableTokenFLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoCreateFile
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::RtlCompareUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwOpenFile
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memcpy
|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsAllocateAndConcatenatePath
BfsDeleteEntry
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsGetFileName
BfsGetFinalPathComponent
BfsGetPolicy
BfsGetPolicyEntry
BfsGetShareNameBfsIsApplicableToken
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoCreateFile
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::RtlCompareUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwOpenFile
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memcpy
| |calling|BfsDeviceIoControl|BfsDeviceIoControl| |paramcount|2|2| |`address`|1c0007984|1c0007c08| |sig|ulonglong __fastcall BfsProcessSetPolicyRequest(undefined8 * param_1, uint param_2)|ulonglong __fastcall BfsProcessSetPolicyRequest(undefined8 * param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsProcessSetPolicyRequest Called Diff ```diff --- BfsProcessSetPolicyRequest called +++ BfsProcessSetPolicyRequest called @@ -5,0 +6 @@ +BfsDereferencePolicyEntryEx @@ -13,0 +15 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsProcessSetPolicyRequest Diff ```diff --- BfsProcessSetPolicyRequest +++ BfsProcessSetPolicyRequest @@ -1,277 +1,284 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Type propagation algorithm not settling */ ulonglong BfsProcessSetPolicyRequest(undefined8 *param_1,uint param_2) { int iVar1; ushort uVar2; uint uVar3; longlong lVar4; bool bVar5; uint uVar6; int iVar7; ushort *puVar8; ulonglong uVar9; ushort *******pppppppuVar10; short sVar11; longlong lVar12; longlong lVar13; ulonglong local_res8; undefined1 auStackY_1a8 [32]; uint local_138 [2]; longlong local_130; longlong local_128; ushort *******local_120; ushort *******local_118; undefined8 *local_110; undefined8 *local_108; ushort *******local_100; ushort ******local_f8; longlong lStack_f0; undefined8 local_e8; void *pvStack_e0; undefined8 local_d8; undefined8 uStack_d0; undefined8 local_c8; longlong lStack_c0; undefined8 local_b8; undefined8 uStack_b0; undefined8 *local_a8; undefined8 uStack_a0; undefined8 local_98; ulonglong uStack_90; undefined8 local_88; undefined8 uStack_80; undefined8 local_78; undefined8 uStack_70; ushort ******local_68; undefined8 uStack_60; ushort *******local_58; undefined8 uStack_50; uint local_48; undefined4 uStack_44; undefined4 uStack_40; undefined4 uStack_3c; uint *local_38; undefined8 uStack_30; ulonglong local_28; local_28 = __security_cookie ^ (ulonglong)auStackY_1a8; lVar13 = 0; local_108 = (undefined8 *)0x0; local_118 = (ushort *******)0x0; local_f8 = (ushort ******)0x0; lStack_f0 = 0; lVar12 = 0; local_78 = 0; uStack_70 = 0; local_130 = 0; local_100 = (ushort *******)0x0; local_88 = 0; uStack_80 = 0; local_68 = (ushort ******)0x0; uStack_60 = 0; local_b8 = 0; uStack_b0 = 0; local_a8 = (undefined8 *)0x0; uStack_a0 = 0; local_98 = 0; uStack_90 = uStack_90 & 0xffffffff00000000; local_e8 = 0; pvStack_e0 = (void *)0x0; local_128 = 0; local_c8 = 0; lStack_c0 = 0; local_120 = (ushort *******)0x0; local_110 = (undefined8 *)0x0; if (param_2 < 0x30) { return local_res8; } local_58 = (ushort *******)*param_1; uStack_50 = param_1[1]; local_48 = *(uint *)(param_1 + 2); uStack_44 = *(undefined4 *)((longlong)param_1 + 0x14); uStack_40 = *(undefined4 *)(param_1 + 3); uStack_3c = *(undefined4 *)((longlong)param_1 + 0x1c); local_38 = (uint *)param_1[4]; uStack_30 = param_1[5]; uVar2 = (ushort)uStack_40; uVar9 = (ulonglong)(ushort)uStack_40; ProbeForRead(local_38,uVar9,2); if (uVar2 == 0) { return local_res8; } pvStack_e0 = (void *)ExAllocatePool2(0x100,uVar9,0x50736642); if (pvStack_e0 == (void *)0x0) { return local_res8; } local_e8._0_4_ = CONCAT22(uVar2,uVar2); memcpy(pvStack_e0,local_38,uVar9); pppppppuVar10 = local_58; uVar6 = ObReferenceObjectByHandle(local_58,8,*(undefined8 *)SeTokenObjectType_exref,1); lVar4 = lVar13; uVar3 = local_138[0]; if (-1 < (int)uVar6) { pppppppuVar10 = local_120; bVar5 = BfsIsApplicableToken(local_120); if (bVar5) { pppppppuVar10 = local_120; uVar6 = SeQueryInformationToken(local_120,1,&local_110); lVar4 = lVar12; uVar3 = local_138[0]; if ((-1 < (int)uVar6) && (pppppppuVar10 = local_120, uVar6 = SeQueryInformationToken(local_120,0x1f,&local_108), uVar3 = local_138[0], -1 < (int)uVar6)) { iVar1 = (int)uStack_50; local_b8 = CONCAT44(local_b8._4_4_,0x30); uStack_b0 = 0; uStack_a0 = CONCAT44(uStack_a0._4_4_,0x600); local_a8 = &local_e8; local_98 = 0; uStack_90 = 0; pppppppuVar10 = (ushort *******)&local_118; uVar6 = ZwOpenFile(pppppppuVar10,0x80000000,&local_b8,&local_88); bVar5 = uVar6 == 0xc0000034; if (bVar5) { pppppppuVar10 = (ushort *******)&local_118; uVar6 = IoCreateFile(pppppppuVar10,0x80100000,&local_b8,&local_88); } lVar4 = lVar13; uVar3 = local_138[0]; if (((-1 < (int)uVar6) && (pppppppuVar10 = local_118, uVar6 = ObReferenceObjectByHandle (local_118,0x80000000,*(undefined8 *)IoFileObjectType_exref,0), lVar4 = lVar12, uVar3 = local_138[0], -1 < (int)uVar6)) && (pppppppuVar10 = local_100, uVar6 = FltGetFileNameInformationUnsafe(local_100,0,0x101,&local_130), uVar3 = local_138[0], -1 < (int)uVar6)) { puVar8 = BfsGetFileName((ushort *)&local_d8,local_130); local_f8 = *(ushort *******)puVar8; lStack_f0 = *(longlong *)(puVar8 + 4); puVar8 = BfsGetShareName((ushort *)&local_d8,local_130); local_c8 = *(undefined8 *)puVar8; lStack_c0 = *(longlong *)(puVar8 + 4); if (bVar5) { pppppppuVar10 = (ushort *******)&local_d8; puVar8 = BfsGetFinalPathComponent((ushort *)pppppppuVar10,&local_e8); local_78 = *(undefined8 *)puVar8; uStack_70 = *(undefined8 *)(puVar8 + 4); if (*puVar8 == 0) { lVar4 = lVar13; uVar6 = 0xc000003a; uVar3 = local_138[0]; } else { pppppppuVar10 = &local_f8; uVar6 = BfsAllocateAndConcatenatePath ((short *)pppppppuVar10,(short *)&local_78,&local_f8); lVar13 = lStack_f0; uVar3 = local_138[0]; if (-1 < (int)uVar6) goto LAB_0; } } else { LAB_0: pppppppuVar10 = gBfsFilterHandle; uVar9 = BfsGetPolicyEntry(gBfsFilterHandle,0,0x1c0016210,(byte *)*local_110, (byte *)*local_108,&local_128); lVar4 = lVar13; uVar6 = (uint)uVar9; uVar3 = local_138[0]; if (-1 < (int)(uint)uVar9) { if (((int)uStack_30 == 0) || ((int)uStack_30 == 1)) { if ((lStack_c0 != 0) && ((iVar7 = RtlCompareUnicodeString(&local_f8,&local_c8,1), lVar12 = local_128, iVar7 != 0 && (uVar9 = BfsGetPolicy(*(longlong *)(local_128 + 0x30), (ushort *)(local_130 + 0x18),&local_c8), 1 < (int)uVar9 - 1U)))) { pppppppuVar10 = *(ushort ********)(lVar12 + 0x30); uVar9 = BfsAddOrModifyEntry((longlong)pppppppuVar10,2,2,0, (ushort *)(local_130 + 0x18),(short *)&local_c8); uVar6 = (uint)uVar9; uVar3 = local_138[0]; - if ((int)(uint)uVar9 < 0) goto joined_r0x0001c0007fb7; + if ((int)(uint)uVar9 < 0) goto joined_r0x0001c000823b; } pppppppuVar10 = *(ushort ********)(local_128 + 0x30); uVar9 = BfsAddOrModifyEntry((longlong)pppppppuVar10,iVar1,uStack_50._4_4_,local_48, (ushort *)(local_130 + 0x18),(short *)&local_f8); uVar6 = (uint)uVar9; uVar3 = local_138[0]; - if ((int)(uint)uVar9 < 0) goto joined_r0x0001c0007fb7; + if ((int)(uint)uVar9 < 0) goto joined_r0x0001c000823b; uVar9 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); uVar3 = local_138[0]; if ((int)uVar9 == 0) goto LAB_1; uStack_d0 = *(undefined8 *)(local_130 + 0x10); sVar11 = *(short *)(local_130 + 8) - *(short *)(local_130 + 0x48); local_d8 = (ushort ******)(ulonglong)CONCAT22(sVar11,sVar11); local_68 = local_d8; pppppppuVar10 = (ushort *******)&gBfsGlobalFileTable; uStack_60 = uStack_d0; uVar6 = BfsAddPolicyToGlobalFileTable (0x1c0016140,(byte *)*local_110,(byte *)*local_108, (ushort *)&local_68,iVar1); } else { if ((int)uStack_30 != 2) goto LAB_1; pppppppuVar10 = *(ushort ********)(local_128 + 0x30); uVar9 = BfsDeleteEntry((longlong)pppppppuVar10,iVar1,(ushort *)(local_130 + 0x18), &local_f8); uVar6 = (uint)uVar9; } uVar3 = local_138[0]; if (-1 < (int)uVar6) goto LAB_1; } } } } } else { uVar6 = 0xc000a200; uVar3 = local_138[0]; } } -joined_r0x0001c0007fb7: +joined_r0x0001c000823b: local_138[0] = uVar6; lVar13 = lVar4; if (3 < DAT_2) { local_38 = local_138; uStack_30 = 4; _tlgWriteTransfer_EtwWriteTransfer(pppppppuVar10,&DAT_3); uVar3 = local_138[0]; } LAB_1: local_138[0] = uVar3; + lVar12 = local_128; if (local_128 != 0) { - BfsDereferencePolicyEntry(local_128); + uVar9 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 == 0) { + BfsDereferencePolicyEntry(local_128); + } + else { + BfsDereferencePolicyEntryEx(lVar12,'\0'); + } } if (lVar13 != 0) { ExFreePoolWithTag(lVar13,0); } if (local_130 != 0) { FltReleaseFileNameInformation(local_130); } if (pvStack_e0 != (void *)0x0) { ExFreePoolWithTag(pvStack_e0,0); } if (local_118 != (ushort *******)0x0) { ZwClose(); } if (local_100 != (ushort *******)0x0) { ObfDereferenceObject(); } if (local_120 != (ushort *******)0x0) { ObfDereferenceObject(); } if (local_110 != (undefined8 *)0x0) { ExFreePoolWithTag(local_110,0); } if (local_108 != (undefined8 *)0x0) { ExFreePoolWithTag(local_108,0); } return local_res8; } ``` ## BfsGetPolicyEntry ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.89| |i_ratio|0.84| |m_ratio|0.97| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsGetPolicyEntry|BfsGetPolicyEntry| |fullname|BfsGetPolicyEntry|BfsGetPolicyEntry| |refcount|9|9| |`length`|525|546| |`called`|
Expand for full list:
BfsDereferencePolicyEntry
BfsFinalHash
BfsInsertPolicyEntry
BfsLookupPolicyEntryHashTable
BfsUpdateHash
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlLengthSid__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsFinalHash
BfsInsertPolicyEntry
BfsLookupPolicyEntryHashTable
BfsUpdateHash
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegionNTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlLengthSid
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsCheckAndApplyPolicy
BfsDeleteFileFromGlobalFileTable
BfsGetRegistryPrefix
BfsPerformPrompt
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyRequest|BfsCheckAndApplyPolicy
BfsDeleteFileFromGlobalFileTable
BfsGetRegistryPrefix
BfsPerformPrompt
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyRequest| |paramcount|6|6| |`address`|1c0005d58|1c0005f88| |`sig`|ulonglong __fastcall BfsGetPolicyEntry(undefined8 * param_1, undefined8 param_2, longlong param_3, byte * param_4, byte * param_5, longlong * param_6)|ulonglong __fastcall BfsGetPolicyEntry(undefined8 * param_1, ulonglong param_2, longlong param_3, byte * param_4, byte * param_5, longlong * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsGetPolicyEntry Called Diff ```diff --- BfsGetPolicyEntry called +++ BfsGetPolicyEntry called @@ -1,0 +2 @@ +BfsDereferencePolicyEntryEx @@ -5,0 +7 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsGetPolicyEntry Diff ```diff --- BfsGetPolicyEntry +++ BfsGetPolicyEntry @@ -1,80 +1,86 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -ulonglong BfsGetPolicyEntry(undefined8 *param_1,undefined8 param_2,longlong param_3,byte *param_4, +ulonglong BfsGetPolicyEntry(undefined8 *param_1,ulonglong param_2,longlong param_3,byte *param_4, byte *param_5,longlong *param_6) { uint uVar1; undefined8 uVar2; longlong lVar3; ulonglong uVar4; ulonglong uVar5; undefined1 auStackY_d8 [32]; longlong local_98; longlong local_90; - undefined8 local_88; + ulonglong local_88; longlong *local_60; undefined4 local_58; undefined4 local_54; ulonglong local_50; local_50 = __security_cookie ^ (ulonglong)auStackY_d8; local_98 = 0; local_88 = param_2; uVar1 = RtlLengthSid(param_4); BfsUpdateHash(param_4,uVar1,&local_98); uVar1 = RtlLengthSid(param_5); BfsUpdateHash(param_5,uVar1,&local_98); uVar2 = BfsFinalHash(&local_98); *param_6 = 0; KeEnterCriticalRegion(); ExAcquirePushLockSharedEx(param_3,0); lVar3 = BfsLookupPolicyEntryHashTable(*(undefined8 *)(param_3 + 8),uVar2,param_4,param_5); local_90 = lVar3; if ((lVar3 == 0) || ((*(uint *)(lVar3 + 0x38) & 0x10000000) == 0)) { ExReleasePushLockSharedEx(param_3,0); KeLeaveCriticalRegion(); uVar4 = BfsInsertPolicyEntry (param_1,local_88,param_3,uVar2,(longlong)param_4,(longlong)param_5,&local_90) ; uVar5 = uVar4 & 0xffffffff; if (-1 < (int)uVar4) goto LAB_0; - if (DAT_2 < 4) goto LAB_1c0005f17; + if (DAT_2 < 4) goto LAB_1c0006147; local_98 = CONCAT44(local_98._4_4_,(int)uVar4); } else { LOCK(); *(int *)(lVar3 + 0x90) = *(int *)(lVar3 + 0x90) + 1; UNLOCK(); uVar5 = 0; - ExReleasePushLockSharedEx(param_3,0); + ExReleasePushLockSharedEx(param_3); KeLeaveCriticalRegion(); if (*(int *)(lVar3 + 0x38) != 0x10000001) { LAB_0: LOCK(); *(undefined8 *)(local_90 + 0x60) = _DAT_3; UNLOCK(); *param_6 = local_90; return uVar5; } param_1 = *(undefined8 **)(lVar3 + 0x28); KeWaitForSingleObject(param_1,0,0,0); if (*(int *)(lVar3 + 0x38) == 0x10000000) goto LAB_0; uVar5 = 0xc0000001; - if (DAT_2 < 4) goto LAB_1c0005f17; + if (DAT_2 < 4) goto LAB_1c0006147; local_98 = CONCAT44(local_98._4_4_,0xc0000001); } local_54 = 0; local_60 = &local_98; local_58 = 4; _tlgWriteTransfer_EtwWriteTransfer(param_1,&DAT_4); LAB_1: + lVar3 = local_90; if (local_90 == 0) { return uVar5; } - BfsDereferencePolicyEntry(local_90); + uVar4 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 != 0) { + BfsDereferencePolicyEntryEx(lVar3,'\0'); + return uVar5; + } + BfsDereferencePolicyEntry(lVar3); return uVar5; } ``` ## BfsProcessQueryPolicySizeRequest ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.65| |i_ratio|0.75| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsProcessQueryPolicySizeRequest|BfsProcessQueryPolicySizeRequest| |fullname|BfsProcessQueryPolicySizeRequest|BfsProcessQueryPolicySizeRequest| |refcount|2|2| |`length`|563|581| |`called`|
Expand for full list:
BfsDereferencePolicyEntry
BfsEnumeratePolicy
BfsGetPolicyEntry
BfsIsApplicableToken
BfsPolicyEntryExists
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsEnumeratePolicy
BfsGetPolicyEntry
BfsIsApplicableToken
BfsPolicyEntryExists
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::SeQueryInformationToken__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsDeviceIoControl|BfsDeviceIoControl| |paramcount|2|2| |`address`|1c0007748|1c00079bc| |sig|ulonglong __fastcall BfsProcessQueryPolicySizeRequest(undefined8 * param_1, int * param_2)|ulonglong __fastcall BfsProcessQueryPolicySizeRequest(undefined8 * param_1, int * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsProcessQueryPolicySizeRequest Called Diff ```diff --- BfsProcessQueryPolicySizeRequest called +++ BfsProcessQueryPolicySizeRequest called @@ -1,0 +2 @@ +BfsDereferencePolicyEntryEx @@ -5,0 +7 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsProcessQueryPolicySizeRequest Diff ```diff --- BfsProcessQueryPolicySizeRequest +++ BfsProcessQueryPolicySizeRequest @@ -1,100 +1,107 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsProcessQueryPolicySizeRequest(undefined8 *param_1,int *param_2) { bool bVar1; byte bVar2; uint uVar3; - undefined8 *puVar4; - ulonglong uVar5; + ulonglong uVar4; + undefined8 *puVar5; + ulonglong uVar6; undefined1 auStackY_a8 [32]; uint local_78 [2]; undefined8 *local_70; undefined8 *local_68; undefined8 *local_60; undefined8 *local_58 [5]; int *local_30; undefined8 local_28; ulonglong local_20; local_20 = __security_cookie ^ (ulonglong)auStackY_a8; local_58[0] = (undefined8 *)0x0; + local_70 = (undefined8 *)0x0; local_68 = (undefined8 *)0x0; - local_70 = (undefined8 *)0x0; local_60 = (undefined8 *)0x0; uVar3 = ObReferenceObjectByHandle(param_1,8,*(undefined8 *)SeTokenObjectType_exref,1); - uVar5 = (ulonglong)uVar3; + uVar6 = (ulonglong)uVar3; if ((int)uVar3 < 0) goto LAB_0; - param_1 = local_70; - bVar1 = BfsIsApplicableToken(local_70); + param_1 = local_68; + bVar1 = BfsIsApplicableToken(local_68); if (bVar1) { - param_1 = local_70; - uVar3 = SeQueryInformationToken(local_70,1,&local_60); - uVar5 = (ulonglong)uVar3; + param_1 = local_68; + uVar3 = SeQueryInformationToken(local_68,1,&local_60); + uVar6 = (ulonglong)uVar3; if (-1 < (int)uVar3) { - param_1 = local_70; - uVar3 = SeQueryInformationToken(local_70,0x1f,local_58); - uVar5 = (ulonglong)uVar3; + param_1 = local_68; + uVar3 = SeQueryInformationToken(local_68,0x1f,local_58); + uVar6 = (ulonglong)uVar3; if (-1 < (int)uVar3) { param_1 = gBfsFilterHandle; bVar2 = BfsPolicyEntryExists (gBfsFilterHandle,0,0x1c0016210,(byte *)*local_60,(byte *)*local_58[0]); if (bVar2 == 0) { - uVar5 = 0xc000000f; + uVar6 = 0xc000000f; goto LAB_1; } - puVar4 = gBfsFilterHandle; - uVar5 = BfsGetPolicyEntry(gBfsFilterHandle,0,0x1c0016210,(byte *)*local_60, - (byte *)*local_58[0],(longlong *)&local_68); - uVar3 = (uint)uVar5; - uVar5 = uVar5 & 0xffffffff; + puVar5 = gBfsFilterHandle; + uVar6 = BfsGetPolicyEntry(gBfsFilterHandle,0,0x1c0016210,(byte *)*local_60, + (byte *)*local_58[0],(longlong *)&local_70); + uVar3 = (uint)uVar6; + uVar6 = uVar6 & 0xffffffff; if ((int)uVar3 < 0) { LAB_2: if (3 < DAT_3) { local_30 = (int *)local_78; local_28 = 4; local_78[0] = uVar3; - _tlgWriteTransfer_EtwWriteTransfer(puVar4,&DAT_4); + _tlgWriteTransfer_EtwWriteTransfer(puVar5,&DAT_4); } } else { - puVar4 = local_68; - uVar5 = BfsEnumeratePolicy((longlong)local_68,(longlong *)0x0,(uint *)0x0,param_2); - uVar3 = (uint)uVar5; - uVar5 = uVar5 & 0xffffffff; + puVar5 = local_70; + uVar6 = BfsEnumeratePolicy((longlong)local_70,(longlong *)0x0,(uint *)0x0,param_2); + uVar3 = (uint)uVar6; + uVar6 = uVar6 & 0xffffffff; if ((int)uVar3 < 0) goto LAB_2; } - if (local_68 != (undefined8 *)0x0) { - BfsDereferencePolicyEntry((longlong)local_68); + if (local_70 != (undefined8 *)0x0) { + uVar4 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + BfsDereferencePolicyEntry((longlong)local_70); + } + else { + BfsDereferencePolicyEntryEx((longlong)local_70,'\0'); + } } goto LAB_5; } } LAB_0: - if (DAT_3 < 4) goto LAB_1c0007916; + if (DAT_3 < 4) goto LAB_1c0007b9c; } else { - uVar5 = 0xc000a200; + uVar6 = 0xc000a200; LAB_1: - if (DAT_3 < 4) goto LAB_1c0007916; - uVar3 = (uint)uVar5; + if (DAT_3 < 4) goto LAB_1c0007b9c; + uVar3 = (uint)uVar6; } local_78[0] = uVar3; local_30 = (int *)local_78; local_28 = 4; _tlgWriteTransfer_EtwWriteTransfer(param_1,&DAT_4); LAB_5: - if (local_70 != (undefined8 *)0x0) { + if (local_68 != (undefined8 *)0x0) { ObfDereferenceObject(); } if (local_60 != (undefined8 *)0x0) { ExFreePoolWithTag(local_60,0); } if (local_58[0] != (undefined8 *)0x0) { ExFreePoolWithTag(local_58[0],0); } - return uVar5; + return uVar6; } ``` ## BfsReleaseNamedPipeMapping ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.71| |i_ratio|0.73| |m_ratio|0.81| |b_ratio|0.72| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsReleaseNamedPipeMapping|BfsReleaseNamedPipeMapping| |fullname|BfsReleaseNamedPipeMapping|BfsReleaseNamedPipeMapping| |refcount|5|5| |`length`|213|307| |`called`|BfsRemoveEntryHashTable
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlFreeUnicodeString|BfsRemoveEntryHashTable
Feature_752421176__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlFreeUnicodeString| |calling|BfsNamedPipeStreamHandleCleanup
BfsPostCreatePipeOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation|BfsNamedPipeStreamHandleCleanup
BfsPostCreatePipeOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation| |paramcount|2|2| |`address`|1c000993c|1c0009c2c| |sig|undefined __fastcall BfsReleaseNamedPipeMapping(longlong param_1, longlong param_2)|undefined __fastcall BfsReleaseNamedPipeMapping(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsReleaseNamedPipeMapping Called Diff ```diff --- BfsReleaseNamedPipeMapping called +++ BfsReleaseNamedPipeMapping called @@ -1,0 +2 @@ +Feature_752421176__private_IsEnabledDeviceUsageNoInline ``` ### BfsReleaseNamedPipeMapping Diff ```diff --- BfsReleaseNamedPipeMapping +++ BfsReleaseNamedPipeMapping @@ -1,31 +1,48 @@ void BfsReleaseNamedPipeMapping(longlong param_1,longlong param_2) { int *piVar1; int iVar2; + ulonglong uVar3; + uVar3 = Feature_752421176__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 != 0) { + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(param_1,0); + } LOCK(); piVar1 = (int *)(param_2 + 0x18); iVar2 = *piVar1; *piVar1 = *piVar1 + -1; UNLOCK(); if (iVar2 == 1) { - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_1,0); + uVar3 = Feature_752421176__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 == 0) { + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(param_1,0); + } if (*(int *)(param_2 + 0x18) == 0) { if ((*(uint *)(param_2 + 0x1c) & 1) != 0) { BfsRemoveEntryHashTable(*(undefined8 *)(param_1 + 8),param_2); } ExFreePoolWithTag(*(undefined8 *)(param_2 + 0x20),0); ExFreePoolWithTag(*(undefined8 *)(param_2 + 0x28),0); RtlFreeUnicodeString(param_2 + 0x30); RtlFreeUnicodeString(param_2 + 0x40); ExFreePoolWithTag(param_2,0); } + uVar3 = Feature_752421176__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 == 0) { + ExReleasePushLockExclusiveEx(param_1,0); + KeLeaveCriticalRegion(); + } + } + uVar3 = Feature_752421176__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 != 0) { ExReleasePushLockExclusiveEx(param_1,0); KeLeaveCriticalRegion(); } return; } ``` ## BfsProcessQueryPolicyRequest ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.5| |i_ratio|0.63| |m_ratio|0.99| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsProcessQueryPolicyRequest|BfsProcessQueryPolicyRequest| |fullname|BfsProcessQueryPolicyRequest|BfsProcessQueryPolicyRequest| |refcount|2|2| |`length`|964|985| |`called`|
Expand for full list:
BfsDereferencePolicyEntry
BfsEnumeratePolicy
BfsGetPolicyEntry
BfsIsApplicableToken
BfsPolicyEntryExists
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ProbeForWrite
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeStringNTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
|
Expand for full list:
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsEnumeratePolicy
BfsGetPolicyEntry
BfsIsApplicableToken
BfsPolicyEntryExists
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ProbeForWriteNTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
| |calling|BfsDeviceIoControl|BfsDeviceIoControl| |paramcount|3|3| |`address`|1c0007328|1c0007588| |sig|ulonglong __fastcall BfsProcessQueryPolicyRequest(undefined8 * param_1, uint * param_2, uint param_3)|ulonglong __fastcall BfsProcessQueryPolicyRequest(undefined8 * param_1, uint * param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsProcessQueryPolicyRequest Called Diff ```diff --- BfsProcessQueryPolicyRequest called +++ BfsProcessQueryPolicyRequest called @@ -1,0 +2 @@ +BfsDereferencePolicyEntryEx @@ -5,0 +7 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsProcessQueryPolicyRequest Diff ```diff --- BfsProcessQueryPolicyRequest +++ BfsProcessQueryPolicyRequest @@ -1,164 +1,173 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsProcessQueryPolicyRequest(undefined8 *param_1,uint *param_2,uint param_3) { undefined8 ****ppppuVar1; code *pcVar2; undefined8 ***pppuVar3; bool bVar4; byte bVar5; uint uVar6; ulonglong uVar7; - undefined1 *puVar8; - undefined8 ****ppppuVar9; - uint *puVar10; + ulonglong uVar8; + undefined1 *puVar9; + undefined8 ****ppppuVar10; + uint *puVar11; undefined1 auStackY_e8 [8]; undefined1 auStackY_e0 [24]; uint local_b8; uint local_b4; undefined8 *local_b0; - undefined8 ***local_a8; + undefined8 *local_a8; undefined8 ***local_a0; - undefined8 *local_98; + undefined8 ***local_98; undefined8 *local_90; - uint local_88; - undefined4 local_84; - uint *local_80; - undefined8 *local_78; + undefined8 *local_88; + uint local_80; + undefined4 local_7c; + uint *local_78; longlong local_70; uint *puStack_68; uint *local_40; undefined4 local_38; undefined4 local_34; ulonglong local_30; - puVar8 = auStackY_e8; + puVar9 = auStackY_e8; local_30 = __security_cookie ^ (ulonglong)auStackY_e8; + local_88 = (undefined8 *)0x0; + local_b0 = (undefined8 *)0x0; + local_a8 = (undefined8 *)0x0; local_90 = (undefined8 *)0x0; - local_78 = (undefined8 *)0x0; - local_b0 = (undefined8 *)0x0; - local_98 = (undefined8 *)0x0; if ((param_2 == (uint *)0x0) || (param_3 == 0)) { - uVar7 = 0xc000000d; + uVar8 = 0xc000000d; goto LAB_0; } local_b4 = 0; local_b8 = 0; - local_a0 = &local_a8; - local_a8 = &local_a8; + local_98 = &local_a0; + local_a0 = &local_a0; ProbeForWrite(param_2,param_3,4); uVar6 = ObReferenceObjectByHandle(param_1,8,*(undefined8 *)SeTokenObjectType_exref,1); - uVar7 = (ulonglong)uVar6; + uVar8 = (ulonglong)uVar6; if ((int)uVar6 < 0) goto LAB_1; - param_1 = local_b0; - bVar4 = BfsIsApplicableToken(local_b0); + param_1 = local_a8; + bVar4 = BfsIsApplicableToken(local_a8); if (bVar4) { - param_1 = local_b0; - uVar6 = SeQueryInformationToken(local_b0,1,&local_98); - uVar7 = (ulonglong)uVar6; + param_1 = local_a8; + uVar6 = SeQueryInformationToken(local_a8,1,&local_90); + uVar8 = (ulonglong)uVar6; if ((int)uVar6 < 0) { LAB_1: - if (3 < DAT_3) goto LAB_1c0007404; + if (3 < DAT_3) goto LAB_1c0007664; } else { - param_1 = local_b0; - uVar6 = SeQueryInformationToken(local_b0,0x1f,&local_90); - uVar7 = (ulonglong)uVar6; + param_1 = local_a8; + uVar6 = SeQueryInformationToken(local_a8,0x1f,&local_88); + uVar8 = (ulonglong)uVar6; if ((int)uVar6 < 0) goto LAB_1; bVar5 = BfsPolicyEntryExists - (gBfsFilterHandle,0,0x1c0016210,(byte *)*local_98,(byte *)*local_90); + (gBfsFilterHandle,0,0x1c0016210,(byte *)*local_90,(byte *)*local_88); if (bVar5 != 0) { param_1 = gBfsFilterHandle; - uVar7 = BfsGetPolicyEntry(gBfsFilterHandle,0,0x1c0016210,(byte *)*local_98,(byte *)*local_90 - ,(longlong *)&local_78); - uVar6 = (uint)uVar7; - uVar7 = uVar7 & 0xffffffff; + uVar8 = BfsGetPolicyEntry(gBfsFilterHandle,0,0x1c0016210,(byte *)*local_90,(byte *)*local_88 + ,(longlong *)&local_b0); + uVar6 = (uint)uVar8; + uVar8 = uVar8 & 0xffffffff; if (-1 < (int)uVar6) { - param_1 = local_78; - uVar7 = BfsEnumeratePolicy((longlong)local_78,(longlong *)&local_a8,&local_b8, + param_1 = local_b0; + uVar8 = BfsEnumeratePolicy((longlong)local_b0,(longlong *)&local_a0,&local_b8, (int *)&local_b4); - uVar6 = (uint)uVar7; - uVar7 = uVar7 & 0xffffffff; + uVar6 = (uint)uVar8; + uVar8 = uVar8 & 0xffffffff; if (-1 < (int)uVar6) { if (param_3 < local_b4) { - uVar7 = 0xc0000023; + uVar8 = 0xc0000023; goto LAB_4; } memset(param_2,0,(ulonglong)local_b4); *param_2 = local_b8; - local_88 = 0; - puVar10 = param_2 + (ulonglong)local_b8 * 8 + 2; - for (ppppuVar9 = (undefined8 ****)local_a8; uVar6 = local_88, local_80 = puVar10, - ppppuVar9 != &local_a8; ppppuVar9 = (undefined8 ****)*ppppuVar9) { - uVar7 = (ulonglong)local_88; - param_2[uVar7 * 8 + 2] = *(uint *)(ppppuVar9 + 2); - param_2[uVar7 * 8 + 4] = *(uint *)(ppppuVar9 + 3); - param_2[uVar7 * 8 + 3] = *(uint *)((longlong)ppppuVar9 + 0x14); - local_70 = (ulonglong)*(ushort *)((longlong)ppppuVar9 + 0x22) << 0x10; - puStack_68 = puVar10; - RtlCopyUnicodeString(&local_70,ppppuVar9 + 4); - *(longlong *)(param_2 + uVar7 * 8 + 6) = local_70; - *(uint **)(param_2 + uVar7 * 8 + 6 + 2) = puStack_68; - puVar10 = (uint *)((longlong)puVar10 + - (ulonglong)*(ushort *)((longlong)ppppuVar9 + 0x22)); - local_88 = uVar6 + 1; + local_80 = 0; + puVar11 = param_2 + (ulonglong)local_b8 * 8 + 2; + for (ppppuVar10 = (undefined8 ****)local_a0; uVar6 = local_80, local_78 = puVar11, + ppppuVar10 != &local_a0; ppppuVar10 = (undefined8 ****)*ppppuVar10) { + uVar8 = (ulonglong)local_80; + param_2[uVar8 * 8 + 2] = *(uint *)(ppppuVar10 + 2); + param_2[uVar8 * 8 + 4] = *(uint *)(ppppuVar10 + 3); + param_2[uVar8 * 8 + 3] = *(uint *)((longlong)ppppuVar10 + 0x14); + local_70 = (ulonglong)*(ushort *)((longlong)ppppuVar10 + 0x22) << 0x10; + puStack_68 = puVar11; + RtlCopyUnicodeString(&local_70); + *(longlong *)(param_2 + uVar8 * 8 + 6) = local_70; + *(uint **)(param_2 + uVar8 * 8 + 6 + 2) = puStack_68; + puVar11 = (uint *)((longlong)puVar11 + + (ulonglong)*(ushort *)((longlong)ppppuVar10 + 0x22)); + local_80 = uVar6 + 1; } - uVar7 = 0; - local_84 = 0; + uVar8 = 0; + local_7c = 0; goto LAB_5; } } goto LAB_1; } } } else { - uVar7 = 0xc000a200; + uVar8 = 0xc000a200; LAB_4: - if (DAT_3 < 4) goto LAB_1c0007665; - uVar6 = (uint)uVar7; + if (DAT_3 < 4) goto LAB_1c00078c5; + uVar6 = (uint)uVar8; LAB_2: local_b8 = uVar6; local_40 = &local_b8; local_38 = 4; local_34 = 0; _tlgWriteTransfer_EtwWriteTransfer(param_1,&DAT_6); } LAB_5: - while (pppuVar3 = local_a8, puVar8 = auStackY_e8, (undefined8 ****)local_a8 != &local_a8) { - ppppuVar9 = (undefined8 ****)*local_a8; - if (((undefined8 ****)local_a8[1] != &local_a8) || (ppppuVar9[1] != local_a8)) { + while (pppuVar3 = local_a0, puVar9 = auStackY_e8, (undefined8 ****)local_a0 != &local_a0) { + ppppuVar10 = (undefined8 ****)*local_a0; + if (((undefined8 ****)local_a0[1] != &local_a0) || (ppppuVar10[1] != local_a0)) { pcVar2 = (code *)swi(0x29); (*pcVar2)(3); - puVar8 = auStackY_e0; + puVar9 = auStackY_e0; break; } - ppppuVar9[1] = &local_a8; - ppppuVar1 = (undefined8 ****)(local_a8 + 4); - local_a8 = ppppuVar9; + ppppuVar10[1] = &local_a0; + ppppuVar1 = (undefined8 ****)(local_a0 + 4); + local_a0 = ppppuVar10; RtlFreeUnicodeString(ppppuVar1); ExFreePoolWithTag(pppuVar3); } - if (*(longlong *)(puVar8 + 0x70) != 0) { - *(undefined8 *)(puVar8 + -8) = 0x1c00076cf; - BfsDereferencePolicyEntry(*(longlong *)(puVar8 + 0x70)); + if (*(longlong *)(puVar9 + 0x38) != 0) { + *(undefined8 *)(puVar9 + -8) = 0x1c000792d; + uVar7 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + *(undefined8 *)(puVar9 + -8) = 0x1c0007944; + BfsDereferencePolicyEntry(*(longlong *)(puVar9 + 0x38)); + } + else { + *(undefined8 *)(puVar9 + -8) = 0x1c000793d; + BfsDereferencePolicyEntryEx(*(longlong *)(puVar9 + 0x38),'\0'); + } } - if (*(longlong *)(puVar8 + 0x38) != 0) { - *(undefined8 *)(puVar8 + -8) = 0x1c00076e0; + if (*(longlong *)(puVar9 + 0x40) != 0) { + *(undefined8 *)(puVar9 + -8) = 0x1c0007955; ObfDereferenceObject(); } - if (*(longlong *)(puVar8 + 0x50) != 0) { - *(undefined8 *)(puVar8 + -8) = 0x1c00076f8; - ExFreePoolWithTag(*(longlong *)(puVar8 + 0x50),0); + if (*(longlong *)(puVar9 + 0x58) != 0) { + *(undefined8 *)(puVar9 + -8) = 0x1c000796d; + ExFreePoolWithTag(*(longlong *)(puVar9 + 0x58),0); } - if (*(longlong *)(puVar8 + 0x58) != 0) { - *(undefined8 *)(puVar8 + -8) = 0x1c0007710; - ExFreePoolWithTag(*(longlong *)(puVar8 + 0x58),0); + if (*(longlong *)(puVar9 + 0x60) != 0) { + *(undefined8 *)(puVar9 + -8) = 0x1c0007985; + ExFreePoolWithTag(*(longlong *)(puVar9 + 0x60),0); } LAB_0: - *(undefined8 *)(puVar8 + -8) = 0x1c0007730; - return uVar7; + *(undefined8 *)(puVar9 + -8) = 0x1c00079a5; + return uVar8; } ``` ## BfsUninitializePolicyTable ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.8| |i_ratio|0.81| |m_ratio|0.93| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsUninitializePolicyTable|BfsUninitializePolicyTable| |fullname|BfsUninitializePolicyTable|BfsUninitializePolicyTable| |refcount|3|3| |`length`|223|252| |`called`|BfsDereferencePolicyEntry
BfsRemoveEntryHashTable
NTOSKRNL.EXE::ExDeleteTimer
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlDeleteHashTable
NTOSKRNL.EXE::RtlEndEnumerationHashTable
NTOSKRNL.EXE::RtlEnumerateEntryHashTable
NTOSKRNL.EXE::RtlInitEnumerationHashTable|BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsRemoveEntryHashTable
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExDeleteTimer
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlDeleteHashTable
NTOSKRNL.EXE::RtlEndEnumerationHashTable
NTOSKRNL.EXE::RtlEnumerateEntryHashTable
NTOSKRNL.EXE::RtlInitEnumerationHashTable| |calling|BfsUnload
DriverEntry|BfsUnload
DriverEntry| |paramcount|1|1| |`address`|1c00085a0|1c0008878| |sig|undefined __fastcall BfsUninitializePolicyTable(longlong param_1)|undefined __fastcall BfsUninitializePolicyTable(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsUninitializePolicyTable Called Diff ```diff --- BfsUninitializePolicyTable called +++ BfsUninitializePolicyTable called @@ -1,0 +2 @@ +BfsDereferencePolicyEntryEx @@ -2,0 +4 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsUninitializePolicyTable Diff ```diff --- BfsUninitializePolicyTable +++ BfsUninitializePolicyTable @@ -1,42 +1,49 @@ void BfsUninitializePolicyTable(longlong param_1) { - longlong lVar1; + ulonglong uVar1; + longlong lVar2; undefined8 local_48; undefined8 uStack_40; undefined8 local_38; undefined8 local_30; undefined8 uStack_28; undefined8 local_20; undefined8 uStack_18; undefined8 local_10; local_30 = 0; uStack_28 = 0; local_20 = 0; uStack_18 = 0; local_10 = 0; local_48 = 0; uStack_40 = 0; local_38 = 0; if (*(longlong *)(param_1 + 0x20) != 0) { ExDeleteTimer(*(longlong *)(param_1 + 0x20),1,1,&local_48); *(undefined8 *)(param_1 + 0x20) = 0; } if (*(longlong *)(param_1 + 8) != 0) { RtlInitEnumerationHashTable(*(longlong *)(param_1 + 8),&local_30); while( true ) { - lVar1 = RtlEnumerateEntryHashTable(*(undefined8 *)(param_1 + 8),&local_30); - if (lVar1 == 0) break; - BfsRemoveEntryHashTable(*(undefined8 *)(param_1 + 8),lVar1); - BfsDereferencePolicyEntry(lVar1); + lVar2 = RtlEnumerateEntryHashTable(*(undefined8 *)(param_1 + 8),&local_30); + if (lVar2 == 0) break; + uVar1 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar1 == 0) { + BfsRemoveEntryHashTable(*(undefined8 *)(param_1 + 8),lVar2); + BfsDereferencePolicyEntry(lVar2); + } + else { + BfsDereferencePolicyEntryEx(lVar2,'\x01'); + } } RtlEndEnumerationHashTable(*(undefined8 *)(param_1 + 8),&local_30); RtlDeleteHashTable(*(undefined8 *)(param_1 + 8)); ExFreePoolWithTag(*(undefined8 *)(param_1 + 8),0); *(undefined8 *)(param_1 + 8) = 0; } return; } ``` ## BfsDeleteFileFromGlobalFileTable ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.68| |i_ratio|0.65| |m_ratio|0.98| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsDeleteFileFromGlobalFileTable|BfsDeleteFileFromGlobalFileTable| |fullname|BfsDeleteFileFromGlobalFileTable|BfsDeleteFileFromGlobalFileTable| |refcount|2|2| |`length`|614|635| |`called`|
Expand for full list:
BfsClearGlobalFileEntry
BfsDeleteEntry
BfsDereferencePolicyEntry
BfsGetGlobalFileEntry
BfsGetPolicyEntry
BfsRemoveEntryHashTable
BfsRemoveFileEntryFromDeleteList
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlEndEnumerationHashTable
NTOSKRNL.EXE::RtlEnumerateEntryHashTable
NTOSKRNL.EXE::RtlInitEnumerationHashTable__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsClearGlobalFileEntry
BfsDeleteEntry
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsGetGlobalFileEntry
BfsGetPolicyEntry
BfsRemoveEntryHashTable
BfsRemoveFileEntryFromDeleteList
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlEndEnumerationHashTableNTOSKRNL.EXE::RtlEnumerateEntryHashTable
NTOSKRNL.EXE::RtlInitEnumerationHashTable
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsCheckDeleteList|BfsCheckDeleteList| |paramcount|3|3| |`address`|1c000a284|1c000a628| |`sig`|undefined8 __fastcall BfsDeleteFileFromGlobalFileTable(undefined8 * param_1, undefined8 param_2, ushort * param_3)|undefined8 __fastcall BfsDeleteFileFromGlobalFileTable(undefined8 * param_1, ulonglong param_2, ushort * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsDeleteFileFromGlobalFileTable Called Diff ```diff --- BfsDeleteFileFromGlobalFileTable called +++ BfsDeleteFileFromGlobalFileTable called @@ -3,0 +4 @@ +BfsDereferencePolicyEntryEx @@ -7,0 +9 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsDeleteFileFromGlobalFileTable Diff ```diff --- BfsDeleteFileFromGlobalFileTable +++ BfsDeleteFileFromGlobalFileTable @@ -1,116 +1,123 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -undefined8 BfsDeleteFileFromGlobalFileTable(undefined8 *param_1,undefined8 param_2,ushort *param_3) +undefined8 BfsDeleteFileFromGlobalFileTable(undefined8 *param_1,ulonglong param_2,ushort *param_3) { short sVar1; longlong lVar2; ulonglong uVar3; - longlong lVar4; - int iVar5; - longlong lVar6; - uint uVar7; + ulonglong uVar4; + longlong lVar5; + int iVar6; + longlong lVar7; uint uVar8; + uint uVar9; undefined1 auStackY_f8 [32]; longlong local_c8; undefined8 local_c0; longlong lStack_b8; ushort local_b0 [4]; longlong lStack_a8; undefined8 local_a0; undefined8 uStack_98; undefined8 local_90; undefined8 uStack_88; undefined8 local_80; longlong *local_58; undefined4 local_50; undefined4 local_4c; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_f8; local_80 = 0; local_a0 = 0; uStack_98 = 0; local_90 = 0; uStack_88 = 0; local_c0 = 0; lStack_b8 = 0; local_b0[0] = 0; local_b0[1] = 0; local_b0[2] = 0; local_b0[3] = 0; lStack_a8 = 0; lVar2 = BfsGetGlobalFileEntry(0x1c0016140,param_3); - iVar5 = 0; + iVar6 = 0; uVar3 = 0; - uVar8 = (uint)(*(ushort *)(lVar2 + 0x40) >> 1); - if (uVar8 != 0) { - lVar4 = *(longlong *)(lVar2 + 0x48); + uVar9 = (uint)(*(ushort *)(lVar2 + 0x40) >> 1); + if (uVar9 != 0) { + lVar5 = *(longlong *)(lVar2 + 0x48); do { - if ((*(short *)(lVar4 + uVar3 * 2) == 0x5c) && (iVar5 = iVar5 + 1, iVar5 == 3)) + if ((*(short *)(lVar5 + uVar3 * 2) == 0x5c) && (iVar6 = iVar6 + 1, iVar6 == 3)) goto LAB_0; - uVar7 = (int)uVar3 + 1; - uVar3 = (ulonglong)uVar7; - } while (uVar7 < uVar8); - if (iVar5 == 3) { + uVar8 = (int)uVar3 + 1; + uVar3 = (ulonglong)uVar8; + } while (uVar8 < uVar9); + if (iVar6 == 3) { LAB_0: sVar1 = (short)uVar3 * 2; - uVar8 = (int)uVar3 + 1; + uVar9 = (int)uVar3 + 1; local_b0[1] = sVar1; local_b0[0] = sVar1; - lStack_b8 = *(longlong *)(lVar2 + 0x48) + (ulonglong)uVar8 * 2; - sVar1 = *(short *)(lVar2 + 0x40) + (short)uVar8 * -2; + lStack_b8 = *(longlong *)(lVar2 + 0x48) + (ulonglong)uVar9 * 2; + sVar1 = *(short *)(lVar2 + 0x40) + (short)uVar9 * -2; local_c0._0_4_ = CONCAT22(sVar1,sVar1); - lStack_a8 = lVar4; + lStack_a8 = lVar5; if (*(longlong *)(lVar2 + 0x58) != 0) { RtlInitEnumerationHashTable(*(longlong *)(lVar2 + 0x58),&local_a0); - while (lVar4 = RtlEnumerateEntryHashTable(*(undefined8 *)(lVar2 + 0x58),&local_a0), - lVar4 != 0) { + while (lVar5 = RtlEnumerateEntryHashTable(*(undefined8 *)(lVar2 + 0x58),&local_a0), + lVar5 != 0) { local_c8 = 0; - if (*(longlong *)(lVar4 + 0x28) <= *(longlong *)(lVar2 + 0x30)) { - uVar3 = BfsGetPolicyEntry(param_1,param_2,0x1c0016210,*(byte **)(lVar4 + 0x18), - *(byte **)(lVar4 + 0x20),&local_c8); - lVar6 = local_c8; + if (*(longlong *)(lVar5 + 0x28) <= *(longlong *)(lVar2 + 0x30)) { + uVar3 = BfsGetPolicyEntry(param_1,param_2,0x1c0016210,*(byte **)(lVar5 + 0x18), + *(byte **)(lVar5 + 0x20),&local_c8); + lVar7 = local_c8; if (-1 < (int)uVar3) { uVar3 = BfsDeleteEntry(*(longlong *)(local_c8 + 0x30),*(int *)(lVar2 + 0x50),local_b0, &local_c0); - BfsDereferencePolicyEntry(lVar6); - iVar5 = 0; + uVar4 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + BfsDereferencePolicyEntry(lVar7); + } + else { + BfsDereferencePolicyEntryEx(lVar7,'\0'); + } + iVar6 = 0; if ((int)uVar3 != -0x3ffffddb) { - iVar5 = (int)uVar3; + iVar6 = (int)uVar3; } - if (iVar5 < 0) { + if (iVar6 < 0) { if (DAT_1 < 4) { return 0; } local_4c = 0; - local_c8 = CONCAT44(local_c8._4_4_,iVar5); + local_c8 = CONCAT44(local_c8._4_4_,iVar6); local_58 = &local_c8; local_50 = 4; - _tlgWriteTransfer_EtwWriteTransfer(lVar6,&DAT_2); + _tlgWriteTransfer_EtwWriteTransfer(lVar7,&DAT_2); return 0; } } - ExFreePoolWithTag(*(undefined8 *)(lVar4 + 0x18),0); - ExFreePoolWithTag(*(undefined8 *)(lVar4 + 0x20),0); - BfsRemoveEntryHashTable(*(undefined8 *)(lVar2 + 0x58),lVar4); - ExFreePoolWithTag(lVar4,0); + ExFreePoolWithTag(*(undefined8 *)(lVar5 + 0x18),0); + ExFreePoolWithTag(*(undefined8 *)(lVar5 + 0x20),0); + BfsRemoveEntryHashTable(*(undefined8 *)(lVar2 + 0x58),lVar5); + ExFreePoolWithTag(lVar5,0); } } RtlEndEnumerationHashTable(*(undefined8 *)(lVar2 + 0x58),&local_a0); } BfsRemoveFileEntryFromDeleteList(lVar2); if (*(int *)(*(longlong *)(lVar2 + 0x58) + 0x14) != 0) { return 0; } BfsRemoveEntryHashTable(DAT_3,lVar2); BfsClearGlobalFileEntry(lVar2); ExFreePoolWithTag(lVar2,0); return 0; } } BfsRemoveFileEntryFromDeleteList(lVar2); return 0; } ``` ## BfsInsertNotPresentPolicyEntry ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.94| |i_ratio|0.84| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsInsertNotPresentPolicyEntry|BfsInsertNotPresentPolicyEntry| |fullname|BfsInsertNotPresentPolicyEntry|BfsInsertNotPresentPolicyEntry| |refcount|2|2| |`length`|745|763| |`called`|
Expand for full list:
BfsDereferencePolicyEntry
BfsInsertEntryHashTable
BfsLookupPolicyEntryHashTable
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlCopySid__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsInsertEntryHashTable
BfsLookupPolicyEntryHashTable
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEventNTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlCopySid
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsPolicyEntryExists|BfsPolicyEntryExists| |paramcount|4|4| |`address`|1c0006314|1c0006564| |sig|ulonglong __fastcall BfsInsertNotPresentPolicyEntry(longlong param_1, undefined8 param_2, longlong param_3, longlong param_4)|ulonglong __fastcall BfsInsertNotPresentPolicyEntry(longlong param_1, undefined8 param_2, longlong param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsInsertNotPresentPolicyEntry Called Diff ```diff --- BfsInsertNotPresentPolicyEntry called +++ BfsInsertNotPresentPolicyEntry called @@ -1,0 +2 @@ +BfsDereferencePolicyEntryEx @@ -3,0 +5 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsInsertNotPresentPolicyEntry Diff ```diff --- BfsInsertNotPresentPolicyEntry +++ BfsInsertNotPresentPolicyEntry @@ -1,129 +1,135 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsInsertNotPresentPolicyEntry (longlong param_1,undefined8 param_2,longlong param_3,longlong param_4) { uint uVar1; uint uVar2; longlong lVar3; longlong lVar4; ulonglong uVar5; longlong lVar6; ulonglong uVar7; ulonglong uVar8; undefined1 auStack_b8 [40]; undefined1 *local_90; uint local_88 [2]; undefined1 local_80 [32]; uint *local_60; undefined8 local_58; ulonglong local_50; local_50 = __security_cookie ^ (ulonglong)auStack_b8; uVar5 = 0; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_1,0); lVar3 = BfsLookupPolicyEntryHashTable(*(undefined8 *)(param_1 + 8),param_2,param_3,param_4); if (lVar3 != 0) { uVar7 = 0x40000000; if (*(int *)(lVar3 + 0x38) != 0x10000000) { uVar7 = uVar5; } ExReleasePushLockExclusiveEx(param_1,0); KeLeaveCriticalRegion(); return uVar7; } uVar7 = 0x100; lVar4 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(param_3 + 1) * 4 + 8,0x53736642); lVar3 = 0; if (lVar4 == 0) { uVar8 = 0xc0000017; uVar2 = 0xc0000017; uVar1 = local_88[0]; } else { uVar7 = 0x100; uVar5 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(param_4 + 1) * 4 + 8,0x53736642); if (uVar5 == 0) { uVar8 = 0xc0000017; uVar2 = 0xc0000017; uVar1 = local_88[0]; } else { uVar7 = (ulonglong)((uint)*(byte *)(param_3 + 1) * 4 + 8); uVar2 = RtlCopySid(uVar7,lVar4,param_3); uVar8 = (ulonglong)uVar2; uVar1 = local_88[0]; if (-1 < (int)uVar2) { uVar7 = (ulonglong)((uint)*(byte *)(param_4 + 1) * 4 + 8); uVar2 = RtlCopySid(uVar7,uVar5,param_4); uVar8 = (ulonglong)uVar2; uVar1 = local_88[0]; if (-1 < (int)uVar2) { uVar7 = 0x100; lVar3 = ExAllocatePool2(0x100,0x98,0x45736642); if (lVar3 != 0) { LOCK(); *(int *)(lVar3 + 0x90) = *(int *)(lVar3 + 0x90) + 1; UNLOCK(); lVar6 = ExAllocatePool2(0x40,0x18,0x76736642); uVar7 = 0; *(longlong *)(lVar3 + 0x28) = lVar6; if (lVar6 != 0) { *(undefined4 *)(lVar3 + 0x68) = 0; *(longlong *)(lVar3 + 0x18) = lVar4; *(ulonglong *)(lVar3 + 0x20) = uVar5; *(undefined4 *)(lVar3 + 0x38) = 2; *(undefined8 *)(lVar3 + 0x70) = 0; *(undefined8 *)(lVar3 + 0x78) = 0; *(undefined2 *)(lVar3 + 0x72) = 0; *(undefined8 *)(lVar3 + 0x78) = 0; *(undefined8 *)(lVar3 + 0x80) = 0; *(undefined8 *)(lVar3 + 0x88) = 0; *(undefined2 *)(lVar3 + 0x82) = 0; *(undefined8 *)(lVar3 + 0x88) = 0; KeInitializeEvent(lVar6,0,0); uVar7 = *(ulonglong *)(param_1 + 8); uVar2 = BfsInsertEntryHashTable(uVar7,param_2,lVar3); uVar8 = (ulonglong)uVar2; uVar1 = local_88[0]; if (-1 < (int)uVar2) goto LAB_0; - goto joined_r0x0001c000655a; + goto joined_r0x0001c00067aa; } } uVar8 = 0xc0000017; uVar2 = 0xc0000017; uVar1 = local_88[0]; } } } } -joined_r0x0001c000655a: +joined_r0x0001c00067aa: local_88[0] = uVar2; if (3 < DAT_1) { local_58 = 4; local_60 = local_88; local_90 = local_80; _tlgWriteTransfer_EtwWriteTransfer(uVar7,&DAT_2); uVar1 = local_88[0]; } LAB_0: local_88[0] = uVar1; - ExReleasePushLockExclusiveEx(param_1,0); + ExReleasePushLockExclusiveEx(param_1); KeLeaveCriticalRegion(); if ((int)uVar8 < 0) { if (lVar3 != 0) { - BfsDereferencePolicyEntry(lVar3); + uVar7 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + BfsDereferencePolicyEntry(lVar3); + } + else { + BfsDereferencePolicyEntryEx(lVar3,'\0'); + } } if (lVar4 != 0) { ExFreePoolWithTag(lVar4,0); } if (uVar5 != 0) { ExFreePoolWithTag(uVar5,0); } } return uVar8; } ``` ## BfsInsertPolicyEntry ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.54| |i_ratio|0.46| |m_ratio|0.99| |b_ratio|0.59| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsInsertPolicyEntry|BfsInsertPolicyEntry| |fullname|BfsInsertPolicyEntry|BfsInsertPolicyEntry| |refcount|2|2| |`length`|1832|1828| |`called`|
Expand for full list:
BfsCreateStorage
BfsDereferencePolicyEntry
BfsInsertEntryHashTable
BfsLookupPolicyEntryHashTable
BfsOpenPolicyDirectory
BfsRemoveEntryHashTable
FLTMGR.SYS::FltClose
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTagNTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExSetTimer
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeResetEvent
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlCopySid
NTOSKRNL.EXE::RtlFreeUnicodeString
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsCreateStorage
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsInsertEntryHashTable
BfsLookupPolicyEntryHashTable
BfsOpenPolicyDirectory
BfsRemoveEntryHashTable
FLTMGR.SYS::FltClose
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveExNTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExSetTimer
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeResetEvent
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlCopySid
NTOSKRNL.EXE::RtlFreeUnicodeString
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsGetPolicyEntry|BfsGetPolicyEntry| |paramcount|7|7| |`address`|1c0006604|1c0006868| |`sig`|ulonglong __fastcall BfsInsertPolicyEntry(undefined8 * param_1, undefined8 param_2, longlong param_3, undefined8 param_4, longlong param_5, longlong param_6, longlong * param_7)|ulonglong __fastcall BfsInsertPolicyEntry(undefined8 * param_1, ulonglong param_2, longlong param_3, undefined8 param_4, longlong param_5, longlong param_6, longlong * param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsInsertPolicyEntry Called Diff ```diff --- BfsInsertPolicyEntry called +++ BfsInsertPolicyEntry called @@ -2,0 +3 @@ +BfsDereferencePolicyEntryEx @@ -7,0 +9 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsInsertPolicyEntry Diff ```diff --- BfsInsertPolicyEntry +++ BfsInsertPolicyEntry @@ -1,286 +1,308 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ ulonglong BfsInsertPolicyEntry - (undefined8 *param_1,undefined8 param_2,longlong param_3,undefined8 param_4, + (undefined8 *param_1,ulonglong param_2,longlong param_3,undefined8 param_4, longlong param_5,longlong param_6,longlong *param_7) { longlong *plVar1; longlong *plVar2; code *pcVar3; bool bVar4; bool bVar5; uint uVar6; uint uVar7; longlong lVar8; - ulonglong uVar9; + longlong lVar9; longlong lVar10; - longlong lVar11; + ulonglong uVar11; longlong lVar12; undefined8 uVar13; undefined8 *puVar14; - undefined1 auStackY_118 [32]; + undefined1 auStackY_128 [32]; + char local_f8; + ulonglong local_f0; + char local_e7; undefined8 local_e0; - char local_d8; + longlong *local_d8; longlong local_d0; longlong local_c8; undefined8 local_c0; longlong local_b8; - undefined8 local_b0; + undefined8 *local_b0; undefined8 local_a8; undefined8 uStack_a0; undefined8 local_98; undefined8 uStack_90; - undefined8 *local_68; - undefined8 local_60; - ulonglong local_58; + longlong local_88; + ulonglong *local_60; + undefined8 local_58; + ulonglong local_50; - local_58 = __security_cookie ^ (ulonglong)auStackY_118; - lVar11 = 0; - local_d0 = param_5; - local_c8 = param_6; + local_50 = __security_cookie ^ (ulonglong)auStackY_128; + local_c8 = param_5; + lVar10 = 0; + local_e0 = 0; + local_b8 = 0; + bVar4 = false; + local_f8 = '\0'; + bVar5 = false; + local_d0 = param_6; + local_d8 = param_7; local_98 = 0; uStack_90 = 0; - local_b0 = 0; local_a8 = 0; uStack_a0 = 0; - local_b8 = 0; - bVar4 = false; - local_d8 = '\0'; - bVar5 = false; - local_e0 = param_2; + local_f0 = param_2; local_c0 = param_4; + local_b0 = param_1; + local_88 = param_3; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_3,0); - uVar9 = *(ulonglong *)(param_3 + 8); - lVar8 = BfsLookupPolicyEntryHashTable(uVar9,local_c0,param_5,param_6); + uVar11 = *(ulonglong *)(param_3 + 8); + lVar8 = BfsLookupPolicyEntryHashTable(uVar11,local_c0,local_c8,param_6); + lVar12 = local_c8; if (lVar8 == 0) { - lVar10 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(local_d0 + 1) * 4 + 8,0x53736642); - if ((lVar10 == 0) || - (lVar11 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(param_6 + 1) * 4 + 8,0x53736642), - lVar11 == 0)) goto LAB_0; - uVar9 = (ulonglong)((uint)*(byte *)(local_d0 + 1) * 4 + 8); - uVar7 = RtlCopySid(uVar9,lVar10,local_d0); - if ((int)uVar7 < 0) { + lVar9 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(local_c8 + 1) * 4 + 8,0x53736642); + if ((lVar9 == 0) || + (lVar10 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(local_d0 + 1) * 4 + 8,0x53736642), + lVar10 == 0)) goto LAB_0; + uVar11 = (ulonglong)((uint)*(byte *)(lVar12 + 1) * 4 + 8); + uVar6 = RtlCopySid(uVar11,lVar9,lVar12); + if ((int)uVar6 < 0) { LAB_1: if (3 < DAT_2) { - local_e0 = CONCAT44(local_e0._4_4_,uVar7); + local_f0 = CONCAT44(local_f0._4_4_,uVar6); LAB_3: - local_68 = &local_e0; - local_60 = 4; - _tlgWriteTransfer_EtwWriteTransfer(uVar9,&DAT_4); + local_60 = &local_f0; + local_58 = 4; + _tlgWriteTransfer_EtwWriteTransfer(uVar11,&DAT_4); } } else { - uVar9 = (ulonglong)((uint)*(byte *)(local_c8 + 1) * 4 + 8); - uVar7 = RtlCopySid(uVar9,lVar11,local_c8); - if ((int)uVar7 < 0) goto LAB_1; + uVar11 = (ulonglong)((uint)*(byte *)(local_d0 + 1) * 4 + 8); + uVar6 = RtlCopySid(uVar11,lVar10,local_d0); + if ((int)uVar6 < 0) goto LAB_1; lVar8 = ExAllocatePool2(0x100,0x98,0x45736642); if (lVar8 != 0) { LOCK(); *(int *)(lVar8 + 0x90) = *(int *)(lVar8 + 0x90) + 1; UNLOCK(); lVar12 = ExAllocatePool2(0x40,0x18,0x76736642); *(longlong *)(lVar8 + 0x28) = lVar12; if (lVar12 != 0) { - *(longlong *)(lVar8 + 0x18) = lVar10; - *(longlong *)(lVar8 + 0x20) = lVar11; + *(longlong *)(lVar8 + 0x18) = lVar9; + *(longlong *)(lVar8 + 0x20) = lVar10; *(undefined4 *)(lVar8 + 0x38) = 0x10000001; *(undefined4 *)(lVar8 + 0x68) = 0; *(undefined8 *)(lVar8 + 0x70) = 0; *(undefined8 *)(lVar8 + 0x78) = 0; *(undefined2 *)(lVar8 + 0x72) = 0; *(undefined8 *)(lVar8 + 0x78) = 0; *(undefined8 *)(lVar8 + 0x80) = 0; *(undefined8 *)(lVar8 + 0x88) = 0; *(undefined2 *)(lVar8 + 0x82) = 0; *(undefined8 *)(lVar8 + 0x88) = 0; KeInitializeEvent(lVar12,0,0); - uVar9 = *(ulonglong *)(param_3 + 8); - uVar7 = BfsInsertEntryHashTable(uVar9,local_c0,lVar8); - if (-1 < (int)uVar7) { + uVar11 = *(ulonglong *)(param_3 + 8); + uVar6 = BfsInsertEntryHashTable(uVar11,local_c0,lVar8); + if (-1 < (int)uVar6) { LOCK(); *(int *)(lVar8 + 0x90) = *(int *)(lVar8 + 0x90) + 1; UNLOCK(); plVar1 = (longlong *)(param_3 + 0x10); - local_d8 = '\x01'; + local_f8 = '\x01'; if ((longlong *)*plVar1 == plVar1) { ExSetTimer(*(undefined8 *)(param_3 + 0x20),0xffffffffee1e5d00,300000000); } puVar14 = *(undefined8 **)(param_3 + 0x18); plVar2 = (longlong *)(lVar8 + 0x40); if ((longlong *)*puVar14 != plVar1) goto LAB_5; *plVar2 = (longlong)plVar1; *(undefined8 **)(lVar8 + 0x48) = puVar14; *puVar14 = plVar2; *(longlong **)(param_3 + 0x18) = plVar2; LOCK(); *(undefined8 *)(lVar8 + 0x60) = _DAT_6; UNLOCK(); goto LAB_7; } goto LAB_1; } } LAB_0: - uVar9 = 0xc0000017; - uVar7 = 0xc0000017; + uVar11 = 0xc0000017; + uVar6 = 0xc0000017; if (3 < DAT_2) { - local_e0 = CONCAT44(local_e0._4_4_,0xc0000017); + local_f0 = CONCAT44(local_f0._4_4_,0xc0000017); + uVar6 = 0xc0000017; goto LAB_3; } } LAB_8: - ExReleasePushLockExclusiveEx(param_3,0); + ExReleasePushLockExclusiveEx(param_3); KeLeaveCriticalRegion(); - bVar5 = false; bVar4 = false; - if ((int)uVar7 < 0) { + bVar5 = bVar4; + if ((int)uVar6 < 0) { LAB_9: if (lVar8 != 0) { LAB_10: - BfsDereferencePolicyEntry(lVar8); - } - if (local_d8 != '\0') { + local_e7 = local_f8; + uVar11 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar11 == 0) { + BfsDereferencePolicyEntry(lVar8); + } + else { + BfsDereferencePolicyEntryEx(lVar8,'\0'); + local_f8 = local_e7; + } + } + if (local_f8 != '\0') { + local_f0 = local_f0 & 0xffffffff00000000; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_3,0); - lVar8 = BfsLookupPolicyEntryHashTable - (*(undefined8 *)(param_3 + 8),local_c0,local_d0,local_c8); - if (lVar8 == 0) { + lVar12 = BfsLookupPolicyEntryHashTable + (*(undefined8 *)(param_3 + 8),local_c0,local_c8,local_d0); + if (lVar12 == 0) { ExReleasePushLockExclusiveEx(param_3,0); KeLeaveCriticalRegion(); } else { - *(undefined4 *)(lVar8 + 0x38) = 1; - uVar6 = BfsRemoveEntryHashTable(*(undefined8 *)(param_3 + 8),lVar8); - plVar1 = (longlong *)(lVar8 + 0x40); - lVar12 = *plVar1; - if ((*(longlong **)(lVar12 + 8) != plVar1) || - (plVar2 = *(longlong **)(lVar8 + 0x48), (longlong *)*plVar2 != plVar1)) { + *(undefined4 *)(lVar12 + 0x38) = 1; + uVar11 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar11 == 0) { + uVar7 = BfsRemoveEntryHashTable(*(undefined8 *)(param_3 + 8),lVar12); + local_f0 = CONCAT44(local_f0._4_4_,uVar7); + } + plVar1 = (longlong *)(lVar12 + 0x40); + lVar8 = *plVar1; + if ((*(longlong **)(lVar8 + 8) != plVar1) || + (plVar2 = *(longlong **)(lVar12 + 0x48), (longlong *)*plVar2 != plVar1)) { LAB_5: pcVar3 = (code *)swi(0x29); (*pcVar3)(3); pcVar3 = (code *)swi(3); - uVar9 = (*pcVar3)(); - return uVar9; - } - *plVar2 = lVar12; - *(longlong **)(lVar12 + 8) = plVar2; - uVar9 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar9 != 0) { + uVar11 = (*pcVar3)(); + return uVar11; + } + *plVar2 = lVar8; + *(longlong **)(lVar8 + 8) = plVar2; + uVar11 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar11 != 0) { *plVar1 = 0; - *(undefined8 *)(lVar8 + 0x48) = 0; - } - ExReleasePushLockExclusiveEx(param_3,0); + *(undefined8 *)(lVar12 + 0x48) = 0; + } + ExReleasePushLockExclusiveEx(local_88); KeLeaveCriticalRegion(); - KeSetEvent(*(undefined8 *)(lVar8 + 0x28),0,0); - if (-1 < (int)uVar6) { - BfsDereferencePolicyEntry(lVar8); + KeSetEvent(*(undefined8 *)(lVar12 + 0x28),0,0); + uVar11 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar11 == 0) { + if (-1 < (int)local_f0) { + BfsDereferencePolicyEntry(lVar12); + } + } + else { + BfsDereferencePolicyEntryEx(lVar12,'\0'); } } } if (bVar4) { RtlFreeUnicodeString(&local_a8); } if (bVar5) { RtlFreeUnicodeString(&local_98); } + if (lVar9 != 0) { + ExFreePoolWithTag(lVar9,0); + } if (lVar10 != 0) { ExFreePoolWithTag(lVar10,0); } - if (lVar11 != 0) { - ExFreePoolWithTag(lVar11,0); - } } if (local_b8 != 0) { FltClose(); } - uVar9 = (ulonglong)uVar7; + uVar11 = (ulonglong)uVar6; } else { - lVar10 = lVar11; + lVar9 = lVar10; if ((*(uint *)(lVar8 + 0x38) >> 0x1c & 1) == 0) { if (*(uint *)(lVar8 + 0x38) != 2) { - uVar7 = 0xc0000001; + uVar6 = 0xc0000001; goto LAB_1; } *(undefined4 *)(lVar8 + 0x38) = 0x10000001; KeResetEvent(*(undefined8 *)(lVar8 + 0x28)); LOCK(); *(int *)(lVar8 + 0x90) = *(int *)(lVar8 + 0x90) + 1; UNLOCK(); LAB_7: ExReleasePushLockExclusiveEx(param_3,0); KeLeaveCriticalRegion(); puVar14 = &local_a8; - uVar7 = RtlConvertSidToUnicodeString(puVar14,local_d0,1); - if ((int)uVar7 < 0) { -LAB_11: - if (3 < DAT_2) { - local_e0 = CONCAT44(local_e0._4_4_,uVar7); - local_68 = &local_e0; - local_60 = 4; - _tlgWriteTransfer_EtwWriteTransfer(puVar14,&DAT_4); - } - } - else { + uVar6 = RtlConvertSidToUnicodeString(puVar14,local_c8,1); + if (-1 < (int)uVar6) { puVar14 = &local_98; bVar4 = true; - uVar7 = RtlConvertSidToUnicodeString(puVar14,local_c8,1); - if ((int)uVar7 < 0) goto LAB_11; - bVar5 = true; - puVar14 = param_1; - uVar7 = BfsOpenPolicyDirectory(param_1,local_e0,&local_a8,'\0',&local_b8); - if ((int)uVar7 < 0) goto LAB_11; - uVar9 = BfsCreateStorage((undefined4 *)param_1,local_e0,local_b8,&local_98,&local_b0); - uVar7 = (uint)uVar9; - if (-1 < (int)uVar7) { - RtlFreeUnicodeString(&local_a8); - RtlFreeUnicodeString(&local_98); - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_3,0); - *(undefined8 *)(lVar8 + 0x30) = local_b0; - *(undefined4 *)(lVar8 + 0x38) = 0x10000000; - KeSetEvent(*(undefined8 *)(lVar8 + 0x28),0,0); - *param_7 = lVar8; - goto LAB_8; - } - if (3 < DAT_2) { - local_e0 = CONCAT44(local_e0._4_4_,uVar7); - local_68 = &local_e0; - local_60 = 4; - _tlgWriteTransfer_EtwWriteTransfer(param_1,&DAT_4); - } + uVar6 = RtlConvertSidToUnicodeString(puVar14,local_d0,1); + if (-1 < (int)uVar6) { + bVar5 = true; + puVar14 = local_b0; + uVar6 = BfsOpenPolicyDirectory(local_b0,local_f0,&local_a8,'\0',&local_b8); + if (-1 < (int)uVar6) { + puVar14 = local_b0; + uVar11 = BfsCreateStorage((undefined4 *)local_b0,local_f0,local_b8,&local_98,&local_e0); + uVar6 = (uint)uVar11; + if (-1 < (int)uVar6) { + RtlFreeUnicodeString(&local_a8); + RtlFreeUnicodeString(&local_98); + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(param_3); + *(undefined8 *)(lVar8 + 0x30) = local_e0; + *(undefined4 *)(lVar8 + 0x38) = 0x10000000; + KeSetEvent(*(undefined8 *)(lVar8 + 0x28),0,0); + *local_d8 = lVar8; + goto LAB_8; + } + } + } + } + if (3 < DAT_2) { + local_f0 = CONCAT44(local_f0._4_4_,uVar6); + local_60 = &local_f0; + local_58 = 4; + _tlgWriteTransfer_EtwWriteTransfer(puVar14,&DAT_4); } goto LAB_9; } LOCK(); *(int *)(lVar8 + 0x90) = *(int *)(lVar8 + 0x90) + 1; UNLOCK(); - ExReleasePushLockExclusiveEx(param_3,0); + ExReleasePushLockExclusiveEx(param_3); KeLeaveCriticalRegion(); if (*(int *)(lVar8 + 0x38) == 0x10000001) { uVar13 = *(undefined8 *)(lVar8 + 0x28); KeWaitForSingleObject(uVar13,0,0,0); if (*(int *)(lVar8 + 0x38) != 0x10000000) { - uVar7 = 0xc0000001; + uVar6 = 0xc0000001; if (3 < DAT_2) { - local_e0 = CONCAT44(local_e0._4_4_,0xc0000001); - local_68 = &local_e0; - local_60 = 4; + local_f0 = CONCAT44(local_f0._4_4_,0xc0000001); + local_60 = &local_f0; + local_58 = 4; _tlgWriteTransfer_EtwWriteTransfer(uVar13,&DAT_4); - lVar11 = 0; + lVar9 = 0; lVar10 = 0; - uVar7 = 0xc0000001; + uVar6 = 0xc0000001; } goto LAB_10; } } *param_7 = lVar8; - uVar9 = 0; + uVar11 = 0; } - return uVar9; + return uVar11; } ``` ## BfsPostCreateOperation ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.65| |i_ratio|0.77| |m_ratio|0.99| |b_ratio|0.65| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsPostCreateOperation|BfsPostCreateOperation| |fullname|BfsPostCreateOperation|BfsPostCreateOperation| |refcount|4|4| |`length`|2094|2134| |`called`|
Expand for full list:
BfsAddOrModifyEntry
BfsDereferencePolicyEntry
BfsGetFileContext
BfsGetFileName
BfsPerformPrompt
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltSetCallbackDataDirty
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquirePushLockExclusiveExNTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::PsGetCurrentProcessId
NTOSKRNL.EXE::RtlCheckTokenCapability
NTOSKRNL.EXE::RtlEqualUnicodeString
NTOSKRNL.EXE::RtlGetNextEntryHashTable
NTOSKRNL.EXE::RtlLookupEntryHashTable
NTOSKRNL.EXE::RtlUpcaseUnicodeChar
NTOSKRNL.EXE::SeCaptureSubjectContext
NTOSKRNL.EXE::SeQuerySessionIdToken
NTOSKRNL.EXE::SeReleaseSubjectContext
__security_check_cookie
|
Expand for full list:
BfsAddOrModifyEntry
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsGetFileContext
BfsGetFileName
BfsPerformPrompt
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltSetCallbackDataDirty
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInlineNTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::PsGetCurrentProcessId
NTOSKRNL.EXE::RtlCheckTokenCapability
NTOSKRNL.EXE::RtlEqualUnicodeString
NTOSKRNL.EXE::RtlGetNextEntryHashTable
NTOSKRNL.EXE::RtlLookupEntryHashTable
NTOSKRNL.EXE::RtlUpcaseUnicodeChar
NTOSKRNL.EXE::SeCaptureSubjectContext
NTOSKRNL.EXE::SeQuerySessionIdToken
NTOSKRNL.EXE::SeReleaseSubjectContext
__security_check_cookie
| |calling||| |paramcount|4|4| |address|1c0001c60|1c0001c60| |sig|undefined8 __fastcall BfsPostCreateOperation(longlong param_1, longlong param_2, uint * param_3, ulonglong param_4)|undefined8 __fastcall BfsPostCreateOperation(longlong param_1, longlong param_2, uint * param_3, ulonglong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsPostCreateOperation Called Diff ```diff --- BfsPostCreateOperation called +++ BfsPostCreateOperation called @@ -2,0 +3 @@ +BfsDereferencePolicyEntryEx @@ -8,0 +10 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsPostCreateOperation Diff ```diff --- BfsPostCreateOperation +++ BfsPostCreateOperation @@ -1,296 +1,329 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined8 BfsPostCreateOperation(longlong param_1,longlong param_2,uint *param_3,ulonglong param_4) { uint *puVar1; longlong *plVar2; longlong lVar3; longlong *plVar4; code *pcVar5; bool bVar6; - bool bVar7; + undefined1 *puVar7; char cVar8; ushort uVar9; int iVar10; ulonglong *puVar11; ulonglong uVar12; longlong lVar13; - ulonglong uVar14; - undefined8 uVar15; + undefined8 uVar14; + ulonglong uVar15; short sVar16; - uint uVar17; - ulonglong uVar18; - undefined1 auStackY_d8 [32]; + ulonglong uVar17; + undefined1 *puVar18; + undefined1 *puVar19; + uint uVar20; + undefined1 auStackY_d8 [8]; + undefined1 auStackY_d0 [24]; char local_a8 [16]; undefined8 local_98; ulonglong uStack_90; int local_88; int local_84; int local_80; int local_7c; undefined1 *local_78; undefined *local_70; undefined8 uStack_68; undefined *local_60; undefined4 local_58; undefined4 local_54; int *local_50; undefined8 local_48; ulonglong local_40; + puVar19 = auStackY_d8; + puVar18 = auStackY_d8; local_40 = __security_cookie ^ (ulonglong)auStackY_d8; - uVar14 = 0; - bVar7 = false; + uVar15 = 0; + bVar6 = false; local_78 = (undefined1 *)0x0; local_98 = 0; uStack_90 = 0; + puVar7 = auStackY_d8; if ((param_4 & 1) == 0) { - uVar18 = uVar14; + uVar17 = uVar15; if (param_3 == (uint *)0x0) goto LAB_0; if ((((*param_3 & 2) == 0) || (*(int *)(param_1 + 0x18) < 0)) || ((char)param_3[0x12] == '\0')) { LAB_1: - uVar18 = 0; + uVar17 = 0; if ((*param_3 & 1) == 0) goto LAB_0; - uVar18 = *(ulonglong *)(param_3 + 0x10); + uVar17 = *(ulonglong *)(param_3 + 0x10); param_3[0x10] = 0; param_3[0x11] = 0; if (param_3[2] == 0) { - uVar17 = *(uint *)(*(longlong *)(param_1 + 0x10) + 0x20); + uVar20 = *(uint *)(*(longlong *)(param_1 + 0x10) + 0x20); puVar1 = (uint *)(*(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8) + 0x14); *puVar1 = *puVar1 & 0xfff3ffff; FltSetCallbackDataDirty(param_1); - if (((uVar17 & 1) == 0) || ((*(byte *)(param_1 + 0x20) & 2) == 0)) { - if ((((byte)uVar17 & 0x41) == 0x40) && ((*(byte *)(param_1 + 0x20) & 2) != 0)) { + if (((uVar20 & 1) == 0) || ((*(byte *)(param_1 + 0x20) & 2) == 0)) { + if ((((byte)uVar20 & 0x41) == 0x40) && ((*(byte *)(param_1 + 0x20) & 2) != 0)) { lVar13 = *(longlong *)(param_3 + 0xc); puVar11 = (ulonglong *)BfsGetFileName((ushort *)&local_98,lVar13); iVar10 = 1; - uVar17 = 0; + uVar20 = 0; goto LAB_2; } } else { lVar13 = *(longlong *)(param_3 + 0xc); puVar11 = (ulonglong *)BfsGetFileName((ushort *)&local_98,lVar13); iVar10 = 2; - uVar17 = 2; + uVar20 = 2; LAB_2: local_98 = *puVar11; uStack_90 = puVar11[1]; - BfsAddOrModifyEntry(*(longlong *)(uVar18 + 0x30),iVar10,1,uVar17,(ushort *)(lVar13 + 0x18) + BfsAddOrModifyEntry(*(longlong *)(uVar17 + 0x30),iVar10,1,uVar20,(ushort *)(lVar13 + 0x18) ,(short *)&local_98); } if (*(longlong *) (*(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8) + 0x20) != 0) { ObfDereferenceObject(); } - uVar15 = *(undefined8 *)(param_3 + 6); + uVar14 = *(undefined8 *)(param_3 + 6); lVar13 = *(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8); *(undefined8 *)(lVar13 + 0x20) = *(undefined8 *)(param_3 + 4); - *(undefined8 *)(lVar13 + 0x28) = uVar15; - uVar15 = *(undefined8 *)(param_3 + 10); + *(undefined8 *)(lVar13 + 0x28) = uVar14; + uVar14 = *(undefined8 *)(param_3 + 10); *(undefined8 *)(lVar13 + 0x30) = *(undefined8 *)(param_3 + 8); - *(undefined8 *)(lVar13 + 0x38) = uVar15; + *(undefined8 *)(lVar13 + 0x38) = uVar14; uVar12 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar12 == 0) { FltReleaseFileNameInformation(*(undefined8 *)(param_3 + 0xc)); - BfsDereferencePolicyEntry(uVar18); + uVar15 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar15 == 0) { + BfsDereferencePolicyEntry(uVar17); + } + else { + BfsDereferencePolicyEntryEx(uVar17,'\0'); + } ExFreePoolWithTag(param_3,0); - return 0; + goto LAB_3; } LAB_0: - bVar6 = bVar7; uVar12 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if (((((int)uVar12 != 0) && (param_3 != (uint *)0x0)) && ((*param_3 & 4) != 0)) && ((-1 < *(int *)(param_1 + 0x18) && ((*(byte *)(param_1 + 0x20) & 2) != 0)))) { lVar13 = *(longlong *)(param_3 + 0x14); uStack_90 = *(ulonglong *)(lVar13 + 0x10); sVar16 = *(short *)(lVar13 + 8) - *(short *)(lVar13 + 0x48); local_98 = (ulonglong)CONCAT22(sVar16,sVar16); KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(&DAT_3,0); + ExAcquirePushLockExclusiveEx(&DAT_4,0); KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(&gBfsGlobalFileTable,0); - uVar15 = DAT_4; + uVar14 = DAT_5; local_60 = (undefined *)0x0; local_70 = (undefined *)0x0; uStack_68 = 0; - uVar12 = uVar14; + uVar12 = uVar15; if ((local_98 & 0xfffe) == 0) { -LAB_5: - uVar14 = 0xffffffffffffffff; +LAB_6: + uVar15 = 0xffffffffffffffff; } else { do { uVar9 = RtlUpcaseUnicodeChar(*(undefined2 *)(uStack_90 + uVar12 * 2)); - uVar17 = (int)uVar12 + 1; - uVar12 = (ulonglong)uVar17; - uVar14 = (uVar14 * 0x25 + ((ulonglong)uVar9 & 0xff)) * 0x25 + (ulonglong)(uVar9 >> 8); - } while (uVar17 < (ushort)local_98 >> 1); - if (uVar14 == 0) goto LAB_5; - } - lVar13 = RtlLookupEntryHashTable(uVar15,uVar14,&local_70); + uVar20 = (int)uVar12 + 1; + uVar15 = (uVar15 * 0x25 + ((ulonglong)uVar9 & 0xff)) * 0x25 + (ulonglong)(uVar9 >> 8); + uVar12 = (ulonglong)uVar20; + } while (uVar20 < (ushort)local_98 >> 1); + if (uVar15 == 0) goto LAB_6; + } + lVar13 = RtlLookupEntryHashTable(uVar14,uVar15,&local_70); while (lVar13 != 0) { cVar8 = RtlEqualUnicodeString(&local_98,lVar13 + 0x40,1); if (cVar8 != '\0') { if (*(char *)(lVar13 + 0x28) != '\0') { plVar2 = (longlong *)(lVar13 + 0x18); *(undefined1 *)(lVar13 + 0x28) = 0; lVar3 = *plVar2; if ((*(longlong **)(lVar3 + 8) != plVar2) || (plVar4 = *(longlong **)(lVar13 + 0x20), (longlong *)*plVar4 != plVar2)) { + uVar17 = 3; pcVar5 = (code *)swi(0x29); - (*pcVar5)(3); - pcVar5 = (code *)swi(3); - uVar15 = (*pcVar5)(); - return uVar15; + (*pcVar5)(); + puVar18 = auStackY_d0; + goto LAB_7; } *plVar4 = lVar3; *(longlong **)(lVar3 + 8) = plVar4; *plVar2 = 0; *(undefined8 *)(lVar13 + 0x20) = 0; *(undefined8 *)(lVar13 + 0x30) = 0; *(undefined8 *)(lVar13 + 0x38) = 0; } break; } - lVar13 = RtlGetNextEntryHashTable(uVar15,&local_70); - } - ExReleasePushLockExclusiveEx(&gBfsGlobalFileTable,0); + lVar13 = RtlGetNextEntryHashTable(uVar14); + } + ExReleasePushLockExclusiveEx(&gBfsGlobalFileTable); KeLeaveCriticalRegion(); - ExReleasePushLockExclusiveEx(&DAT_3,0); + ExReleasePushLockExclusiveEx(&DAT_4); KeLeaveCriticalRegion(); } } else { if ((param_3[2] != 1) || (*(int *)(param_1 + 0x18) != -0x3fffffde)) goto LAB_0; - if (*(int *)(uVar18 + 0x68) != 0) { - if (*(int *)(uVar18 + 0x68) == 1) goto LAB_6; + if (*(int *)(uVar17 + 0x68) != 0) { + if (*(int *)(uVar17 + 0x68) == 1) goto LAB_8; goto LAB_0; } local_a8[0] = '\0'; iVar10 = RtlCheckTokenCapability (0,*(undefined8 *)(*(longlong *)SeExports_exref + 0x248),local_a8); if ((iVar10 < 0) || (local_a8[0] == '\0')) { - *(undefined4 *)(uVar18 + 0x68) = 2; + *(undefined4 *)(uVar17 + 0x68) = 2; goto LAB_0; } - *(undefined4 *)(uVar18 + 0x68) = 1; -LAB_6: + *(undefined4 *)(uVar17 + 0x68) = 1; +LAB_8: SeCaptureSubjectContext(param_3 + 4); bVar6 = true; if (*(longlong *)(param_3 + 4) == 0) { -LAB_7: - uVar15 = PsGetCurrentProcessId(); - *(undefined8 *)(param_3 + 0xe) = uVar15; +LAB_9: + uVar14 = PsGetCurrentProcessId(); + *(undefined8 *)(param_3 + 0xe) = uVar14; uVar12 = BfsPerformPrompt(param_1,param_2,(longlong)param_3); - bVar7 = true; if (-1 < (int)uVar12) goto LAB_0; - if (3 < DAT_8) { + if (3 < DAT_10) { local_48 = 4; local_50 = &local_84; - local_70 = PTR_DAT_9; + local_70 = PTR_DAT_11; local_98 = 0x30b000000; uStack_90 = 0; - local_60 = &DAT_10; - uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_9); + local_60 = &DAT_12; + uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_11); local_58 = 0x1e; local_54 = 1; local_88 = 0x73; local_84 = (int)uVar12; - EtwWriteTransfer(DAT_11,&local_98,0,0); + EtwWriteTransfer(DAT_13,&local_98,0,0); } } else { local_7c = 0; local_80 = 0; - iVar10 = SeQuerySessionIdToken(*(undefined8 *)(param_3 + 8),&local_7c); + iVar10 = SeQuerySessionIdToken(*(undefined8 *)(param_3 + 8)); if (iVar10 < 0) { - if (3 < DAT_8) { + if (3 < DAT_10) { local_48 = 4; local_50 = &local_88; - local_70 = PTR_DAT_9; + local_70 = PTR_DAT_11; local_98 = 0x30b000000; uStack_90 = 0; - local_60 = &DAT_10; - uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_9); + local_60 = &DAT_12; + uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_11); local_58 = 0x1e; local_54 = 1; local_84 = 0x73; local_88 = iVar10; - EtwWriteTransfer(DAT_11,&local_98,0,0); + EtwWriteTransfer(DAT_13,&local_98,0,0); } } else { - iVar10 = SeQuerySessionIdToken(*(undefined8 *)(param_3 + 4),&local_80); + iVar10 = SeQuerySessionIdToken(*(undefined8 *)(param_3 + 4)); if (iVar10 < 0) { - if (3 < DAT_8) { + if (3 < DAT_10) { local_48 = 4; local_50 = &local_84; - local_70 = PTR_DAT_9; + local_70 = PTR_DAT_11; local_98 = 0x30b000000; uStack_90 = 0; - local_60 = &DAT_10; - uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_9); + local_60 = &DAT_12; + uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_11); local_58 = 0x1e; local_54 = 1; local_88 = 0x73; local_84 = iVar10; - EtwWriteTransfer(DAT_11,&local_98,0,0); + EtwWriteTransfer(DAT_13,&local_98,0,0); } } - else if (local_7c == local_80) goto LAB_7; + else if (local_7c == local_80) goto LAB_9; } } } - if (uVar18 != 0) { - BfsDereferencePolicyEntry(uVar18); + puVar19 = auStackY_d8; + if (uVar17 != 0) { + uVar15 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar15 == 0) { + BfsDereferencePolicyEntry(uVar17); + puVar19 = auStackY_d8; + } + else { +LAB_7: + *(undefined8 *)(puVar18 + -8) = 0x1c000241a; + BfsDereferencePolicyEntryEx(uVar17,'\0'); + puVar19 = puVar18; + } } + puVar7 = puVar19; if (bVar6) { + *(undefined8 *)(puVar19 + -8) = 0x1c000242a; SeReleaseSubjectContext(param_3 + 4); } - goto LAB_12; + goto LAB_14; } iVar10 = BfsGetFileContext(param_2,*(undefined8 *)(*(longlong *)(param_1 + 0x10) + 8),&local_78) ; if (-1 < iVar10) { *local_78 = 1; goto LAB_1; } - if (3 < DAT_8) { + puVar19 = auStackY_d8; + if (3 < DAT_10) { local_48 = 4; local_50 = &local_7c; - local_70 = PTR_DAT_9; + local_70 = PTR_DAT_11; local_98 = 0x30b000000; uStack_90 = 0; - local_60 = &DAT_10; - uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_9); + local_60 = &DAT_12; + uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_11); local_58 = 0x1e; local_54 = 1; local_80 = 0x73; local_7c = iVar10; - EtwWriteTransfer(DAT_11,&local_98,0,0); - } + EtwWriteTransfer(DAT_13,&local_98,0,0); + puVar19 = auStackY_d8; + } +LAB_15: + if (*(longlong *)(param_3 + 0xc) != 0) { + *(undefined8 *)(puVar19 + -8) = 0x1c0002444; + FltReleaseFileNameInformation(); + } + *(undefined8 *)(puVar19 + -8) = 0x1c000244e; + uVar15 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar15 != 0) && (*(longlong *)(param_3 + 0x14) != 0)) { + *(undefined8 *)(puVar19 + -8) = 0x1c0002462; + FltReleaseFileNameInformation(); + } + *(undefined8 *)(puVar19 + -8) = 0x1c0002473; + ExFreePoolWithTag(param_3,0); } else { -LAB_12: - if (param_3 == (uint *)0x0) goto LAB_13; +LAB_14: + puVar19 = puVar7; + if (param_3 != (uint *)0x0) goto LAB_15; } - if (*(longlong *)(param_3 + 0xc) != 0) { - FltReleaseFileNameInformation(); - } - uVar14 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar14 != 0) && (*(longlong *)(param_3 + 0x14) != 0)) { - FltReleaseFileNameInformation(); - } - ExFreePoolWithTag(param_3,0); -LAB_13: if (local_78 != (undefined1 *)0x0) { + *(undefined8 *)(puVar19 + -8) = 0x1c0002488; FltReleaseContext(); } +LAB_3: + *(undefined8 *)(puVar19 + -8) = 0x1c000249b; return 0; } ``` ## BfsCheckAndApplyPolicy ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.93| |i_ratio|0.75| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsCheckAndApplyPolicy|BfsCheckAndApplyPolicy| |fullname|BfsCheckAndApplyPolicy|BfsCheckAndApplyPolicy| |refcount|2|2| |`length`|1286|1322| |`called`|
Expand for full list:
BfsAddOrModifyEntry
BfsApplyPolicyAsUser
BfsDereferencePolicyEntry
BfsFileInPublisherDirectory
BfsGetFileName
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsPolicyEntryExists
BfsQueryAccessOnly
BfsQueueDeferredWorkItemAndWaitFLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReferenceFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCheckTokenCapability
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsAddOrModifyEntry
BfsApplyPolicyAsUser
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsFileInPublisherDirectory
BfsGetFileName
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsPolicyEntryExists
BfsQueryAccessOnlyBfsQueueDeferredWorkItemAndWait
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReferenceFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCheckTokenCapability
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsPreCreateOperation|BfsPreCreateOperation| |paramcount|5|5| |`address`|1c00048f0|1c0004970| |`sig`|undefined1 __fastcall BfsCheckAndApplyPolicy(undefined8 * param_1, longlong param_2, ushort * param_3, ushort * param_4, longlong * param_5)|undefined1 __fastcall BfsCheckAndApplyPolicy(undefined8 * param_1, ulonglong param_2, ushort * param_3, ushort * param_4, longlong * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsCheckAndApplyPolicy Called Diff ```diff --- BfsCheckAndApplyPolicy called +++ BfsCheckAndApplyPolicy called @@ -3,0 +4 @@ +BfsDereferencePolicyEntryEx @@ -14,0 +16 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsCheckAndApplyPolicy Diff ```diff --- BfsCheckAndApplyPolicy +++ BfsCheckAndApplyPolicy @@ -1,223 +1,236 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined1 BfsCheckAndApplyPolicy - (undefined8 *param_1,longlong param_2,ushort *param_3,ushort *param_4,longlong *param_5) + (undefined8 *param_1,ulonglong param_2,ushort *param_3,ushort *param_4,longlong *param_5) { uint uVar1; byte bVar2; uint uVar3; int iVar4; ulonglong uVar5; ushort *puVar6; undefined8 uVar7; longlong lVar8; undefined8 *puVar9; longlong lVar10; undefined1 uVar11; undefined1 auStackY_118 [32]; uint local_e8; char local_e4; char local_e3 [3]; longlong local_e0; longlong local_d8; undefined8 *local_d0; undefined8 *local_c8; ushort *local_c0; longlong local_b8; undefined8 local_b0; undefined8 uStack_a8; undefined8 local_a0; undefined8 uStack_98; ushort local_90 [24]; uint *local_60; undefined8 local_58; ulonglong local_50; undefined1 uVar12; local_50 = __security_cookie ^ (ulonglong)auStackY_118; local_e3[0] = '\0'; local_d0 = (undefined8 *)0x0; local_e0 = 0; local_d8 = 0; local_c8 = (undefined8 *)0x0; uVar12 = 0; uVar11 = 0; local_b0 = 0; uStack_a8 = 0; puVar6 = param_3; uVar3 = SeQueryInformationToken(param_3,1,&local_d0); uVar1 = local_e8; if ((-1 < (int)uVar3) && (puVar6 = param_3, uVar3 = SeQueryInformationToken(param_3,0x1f,&local_c8), uVar1 = local_e8, -1 < (int)uVar3)) { uVar3 = FltGetFileNameInformation(param_4,0x101,&local_d8); if (uVar3 == 0xc0000201) { local_b8 = 0; local_c0 = param_3; uVar3 = BfsQueueDeferredWorkItemAndWait ((longlong)param_1,param_2,param_4,&local_c0, BfsQueryFileNameInformationCallback); local_d8 = local_b8; } puVar6 = (ushort *)(ulonglong)uVar3; uVar1 = local_e8; if (-1 < (int)uVar3) { bVar2 = BfsPolicyEntryExists(param_1,param_2,0x1c0016210,(byte *)*local_d0,(byte *)*local_c8); uVar11 = uVar12; if (bVar2 == 0) { puVar9 = (undefined8 *)&gBfsPolicyTable; uVar7 = BfsGetNotPresentPolicyEntry (0x1c0016210,(byte *)*local_d0,(byte *)*local_c8,&local_e0); lVar10 = local_e0; uVar3 = (uint)uVar7; uVar1 = local_e8; - if ((int)(uint)uVar7 < 0) goto joined_r0x0001c0004c5f; + if ((int)(uint)uVar7 < 0) goto joined_r0x0001c0004cf1; LAB_0: local_e4 = '\0'; puVar6 = (ushort *)0x0; uVar3 = RtlCheckTokenCapability (0,*(undefined8 *)(*(longlong *)SeExports_exref + 0x250),&local_e4); if ((int)uVar3 < 0) { if (uVar3 != 0xc0000022) goto LAB_1; LAB_2: if ((local_d8 == 0) && (uVar3 = FltGetFileNameInformation(param_4,0x101,&local_d8), puVar6 = param_4, (int)uVar3 < 0)) goto LAB_1; lVar8 = *param_5; if (lVar8 != 0) { LAB_3: *(undefined4 *)(lVar8 + 8) = 1; FltReferenceFileNameInformation(local_d8); *(longlong *)(*param_5 + 0x30) = local_d8; *(longlong *)(*param_5 + 0x40) = lVar10; LOCK(); *(int *)(lVar10 + 0x90) = *(int *)(lVar10 + 0x90) + 1; UNLOCK(); uVar11 = 1; *(uint *)*param_5 = *(uint *)*param_5 | 1; lVar10 = local_e0; uVar1 = local_e8; goto LAB_4; } puVar6 = (ushort *)0x100; lVar8 = ExAllocatePool2(0x100,0x58,0x43736642); *param_5 = lVar8; if (lVar8 != 0) goto LAB_3; uVar1 = local_e8; - if (DAT_5 < 4) goto LAB_1c0004d82; + if (DAT_5 < 4) goto LAB_1c0004e14; local_e8 = 0xc0000017; } else { if (local_e4 == '\0') goto LAB_2; puVar6 = param_3; uVar3 = BfsFileInPublisherDirectory(param_3,local_d8,(ushort *)local_e3,&local_b0); if ((int)uVar3 < 0) goto LAB_1; if (local_e3[0] == '\0') goto LAB_2; if (lVar10 == 0) { LAB_6: uVar5 = BfsGetPolicyEntry(param_1,param_2,0x1c0016210,(byte *)*local_d0, (byte *)*local_c8,&local_e0); lVar10 = local_e0; uVar3 = (uint)uVar5; puVar9 = param_1; uVar1 = local_e8; - if ((int)(uint)uVar5 < 0) goto joined_r0x0001c0004c5f; + if ((int)(uint)uVar5 < 0) goto joined_r0x0001c0004cf1; } else if (*(int *)(lVar10 + 0x38) == 2) { - BfsDereferencePolicyEntry(lVar10); + uVar5 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 == 0) { + BfsDereferencePolicyEntry(lVar10); + } + else { + BfsDereferencePolicyEntryEx(lVar10,'\0'); + } goto LAB_6; } BfsAddOrModifyEntry(*(longlong *)(lVar10 + 0x30),2,1,2,(ushort *)(local_d8 + 0x18), (short *)&local_b0); LAB_7: uVar3 = BfsApplyPolicyAsUser((longlong)param_4,(longlong)param_3,local_d8,lVar10,param_5); puVar6 = param_4; if (-1 < (int)uVar3) { uVar11 = 1; uVar1 = local_e8; goto LAB_4; } LAB_1: uVar1 = local_e8; local_e8 = uVar3; - if (DAT_5 < 4) goto LAB_1c0004d82; + if (DAT_5 < 4) goto LAB_1c0004e14; } local_60 = &local_e8; local_58 = 4; _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_8); uVar1 = local_e8; } else { puVar9 = param_1; uVar5 = BfsGetPolicyEntry(param_1,param_2,0x1c0016210,(byte *)*local_d0,(byte *)*local_c8, &local_e0); uVar3 = (uint)uVar5; uVar1 = local_e8; if ((int)(uint)uVar5 < 0) { -joined_r0x0001c0004c5f: +joined_r0x0001c0004cf1: local_e8 = uVar3; lVar10 = local_e0; if (3 < DAT_5) { local_58 = 4; local_60 = &local_e8; _tlgWriteTransfer_EtwWriteTransfer(puVar9,&DAT_8); lVar10 = local_e0; uVar1 = local_e8; } } else { lVar8 = local_d8; puVar6 = BfsGetFileName(local_90,local_d8); lVar10 = local_e0; local_a0 = *(undefined8 *)puVar6; uStack_98 = *(undefined8 *)(puVar6 + 4); uVar5 = BfsGetPolicy(*(longlong *)(local_e0 + 0x30),(ushort *)(lVar8 + 0x18),&local_a0); iVar4 = (int)uVar5; if (iVar4 == 0) goto LAB_0; if (iVar4 == 1) goto LAB_7; uVar1 = local_e8; if (iVar4 == 2) { uVar7 = BfsQueryAccessOnly((*(uint *)(*(longlong *)(param_4 + 8) + 0x20) & 1) + 1, (longlong)param_4); if ((char)uVar7 != '\0') goto LAB_7; uVar7 = BfsQueryAccessOnly((*(uint *)(*(longlong *)(param_4 + 8) + 0x20) & 1) + 1, (longlong)param_4); uVar1 = local_e8; if ((char)uVar7 == '\0') goto LAB_2; } } } LAB_4: local_e8 = uVar1; uVar1 = local_e8; if (lVar10 != 0) { - BfsDereferencePolicyEntry(lVar10); - uVar1 = local_e8; + uVar5 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 == 0) { + BfsDereferencePolicyEntry(lVar10); + uVar1 = local_e8; + } + else { + BfsDereferencePolicyEntryEx(lVar10,'\0'); + uVar1 = local_e8; + } } goto LAB_9; } } local_e8 = uVar3; if (3 < DAT_5) { local_60 = &local_e8; local_58 = 4; _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_8); uVar1 = local_e8; } LAB_9: local_e8 = uVar1; if (local_d8 != 0) { FltReleaseFileNameInformation(); } if (local_d0 != (undefined8 *)0x0) { ExFreePoolWithTag(local_d0,0); } if (local_c8 != (undefined8 *)0x0) { ExFreePoolWithTag(local_c8,0); } return uVar11; } ``` ## BfsPerformPrompt ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.98| |i_ratio|0.82| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsPerformPrompt|BfsPerformPrompt| |fullname|BfsPerformPrompt|BfsPerformPrompt| |refcount|2|2| |`length`|1395|1413| |`called`|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsDereferencePolicyEntry
BfsGetPolicyEntry
BfsGetUserToken
BfsPromptForConsent
BfsQueryAccessOnly
BfsQueueDeferredWorkItemAndWait
FLTMGR.SYS::FltReissueSynchronousIo
FLTMGR.SYS::FltSetCallbackDataDirty
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInlineNTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
RtlStringCbCopyUnicodeString
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsGetPolicyEntry
BfsGetUserToken
BfsPromptForConsent
BfsQueryAccessOnly
BfsQueueDeferredWorkItemAndWait
FLTMGR.SYS::FltReissueSynchronousIo
FLTMGR.SYS::FltSetCallbackDataDirtyFeature_2880249144__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
RtlStringCbCopyUnicodeString
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsPostCreateOperation|BfsPostCreateOperation| |paramcount|3|3| |`address`|1c000b970|1c000bd20| |sig|ulonglong __fastcall BfsPerformPrompt(longlong param_1, longlong param_2, longlong param_3)|ulonglong __fastcall BfsPerformPrompt(longlong param_1, longlong param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsPerformPrompt Called Diff ```diff --- BfsPerformPrompt called +++ BfsPerformPrompt called @@ -3,0 +4 @@ +BfsDereferencePolicyEntryEx @@ -10,0 +12 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsPerformPrompt Diff ```diff --- BfsPerformPrompt +++ BfsPerformPrompt @@ -1,256 +1,262 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsPerformPrompt(longlong param_1,longlong param_2,longlong param_3) { uint *puVar1; short sVar2; ushort uVar3; longlong lVar4; longlong lVar5; undefined8 uVar6; undefined8 uVar7; undefined8 uVar8; int iVar9; uint uVar10; undefined2 *puVar11; ulonglong uVar12; undefined8 uVar13; short sVar14; longlong lVar15; undefined8 *puVar16; undefined1 *puVar17; undefined8 *puVar18; ulonglong uVar19; uint uVar20; undefined1 auStackY_168 [32]; longlong local_138; char local_130; char local_12f; undefined8 *local_128 [2]; undefined8 local_118; longlong lStack_110; longlong local_108; undefined8 *local_100; undefined8 local_f8; longlong lStack_f0; longlong local_e8; undefined2 *local_e0; undefined8 local_d8; undefined1 *puStack_d0; undefined8 *local_c8; undefined8 uStack_c0; undefined8 local_b8; ulonglong local_a8; longlong lStack_a0; longlong *local_78; undefined4 local_70; undefined4 local_6c; ulonglong local_68; local_68 = __security_cookie ^ (ulonglong)auStackY_168; puVar18 = *(undefined8 **)(param_3 + 0x10); local_b8 = 0; lVar15 = 0; local_100 = (undefined8 *)0x0; local_12f = '\0'; local_138 = 0; local_130 = '\0'; uVar20 = 3; local_128[0] = (undefined8 *)0x0; local_108 = 0; local_c8 = (undefined8 *)0x0; uStack_c0 = 0; local_a8 = 0; lStack_a0 = 0; local_d8 = 0; puStack_d0 = (undefined1 *)0x0; if (puVar18 == (undefined8 *)0x0) { puVar18 = *(undefined8 **)(param_3 + 0x20); } puVar16 = puVar18; local_e8 = param_2; uVar10 = SeQueryInformationToken(puVar18,1,local_128); uVar19 = (ulonglong)uVar10; if ((int)uVar10 < 0) { LAB_0: - if (DAT_2 < 4) goto LAB_1c000be55; + if (DAT_2 < 4) goto LAB_1c000c217; local_138 = CONCAT44(local_138._4_4_,uVar10); } else { puVar16 = puVar18; uVar10 = SeQueryInformationToken(puVar18,0x1f,&local_100); uVar19 = (ulonglong)uVar10; if ((int)uVar10 < 0) goto LAB_0; puVar16 = &local_d8; uVar10 = RtlConvertSidToUnicodeString(puVar16,*local_128[0],1); uVar19 = (ulonglong)uVar10; if ((int)uVar10 < 0) goto LAB_0; uStack_c0 = *(undefined8 *)(param_3 + 0x30); puVar16 = *(undefined8 **)(param_2 + 8); local_12f = '\x01'; local_c8 = puVar18; uVar10 = BfsQueueDeferredWorkItemAndWait ((longlong)puVar16,*(longlong *)(param_2 + 0x18),param_1,&local_c8, BfsFileOpenAsUserCallback); uVar19 = (ulonglong)uVar10; if ((int)uVar10 < 0) goto LAB_0; iVar9 = (int)local_b8; puVar16 = (undefined8 *)0x100; local_f8 = (ulonglong)*(ushort *)(*(longlong *)(param_3 + 0x30) + 0x18) + 2; puVar11 = (undefined2 *)ExAllocatePool2(0x100,local_f8,0x4e736642); local_e0 = puVar11; if (puVar11 != (undefined2 *)0x0) { RtlStringCbCopyUnicodeString (puVar11,local_f8,(ushort *)(*(longlong *)(param_3 + 0x30) + 0x18)); lVar4 = *(longlong *)(param_3 + 0x30); uVar3 = *(ushort *)(lVar4 + 0x18); lStack_110 = *(longlong *)(lVar4 + 0x10) + ((ulonglong)uVar3 & 0xfffffffffffffffe); local_118._0_4_ = CONCAT22((*(short *)(lVar4 + 10) - *(short *)(lVar4 + 0x48)) - uVar3, (*(short *)(lVar4 + 8) - *(short *)(lVar4 + 0x48)) - uVar3); local_118 = (ulonglong)(uint)local_118; local_f8 = local_118; puVar17 = puStack_d0; lStack_f0 = lStack_110; uVar12 = BfsPromptForConsent(puStack_d0,puVar11,lStack_110,*(undefined8 *)(param_3 + 0x38), &local_130); uVar19 = uVar12 & 0xffffffff; if ((int)uVar12 < 0) { if (3 < DAT_2) { local_138 = CONCAT44(local_138._4_4_,(int)uVar12); LAB_3: local_6c = 0; local_78 = &local_138; local_70 = 4; _tlgWriteTransfer_EtwWriteTransfer(puVar17,&DAT_4); } } else if (local_130 == '\x01') { uVar20 = BfsGetUserToken((longlong)puVar18,&local_108); lVar15 = local_108; uVar19 = (ulonglong)uVar20; if ((int)uVar20 < 0) { if (3 < DAT_2) { local_6c = 0; local_138 = CONCAT44(local_138._4_4_,uVar20); local_78 = &local_138; local_70 = 4; _tlgWriteTransfer_EtwWriteTransfer(puVar18,&DAT_4); lVar15 = local_108; } } else { lVar4 = *(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8); uVar13 = *(undefined8 *)(lVar4 + 0x20); uVar6 = *(undefined8 *)(lVar4 + 0x28); uVar7 = *(undefined8 *)(lVar4 + 0x30); uVar8 = *(undefined8 *)(lVar4 + 0x38); *(longlong *)(lVar4 + 0x20) = local_108; *(undefined4 *) (*(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8) + 0x28) = 2; FltReissueSynchronousIo(*(undefined8 *)(local_e8 + 0x18),param_1); puVar1 = (uint *)(*(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8) + 0x14); *puVar1 = *puVar1 & 0xfff3ffff; FltSetCallbackDataDirty(param_1); puVar17 = *(undefined1 **)(*(longlong *)(param_1 + 0x10) + 0x18); lVar4 = *(longlong *)(puVar17 + 8); *(undefined8 *)(lVar4 + 0x20) = uVar13; *(undefined8 *)(lVar4 + 0x28) = uVar6; *(undefined8 *)(lVar4 + 0x30) = uVar7; *(undefined8 *)(lVar4 + 0x38) = uVar8; uVar20 = *(uint *)(param_1 + 0x18); uVar19 = (ulonglong)uVar20; if (-1 < (int)uVar20) { uVar13 = BfsQueryAccessOnly(iVar9,param_1); uVar20 = ((char)uVar13 != '\0') + 1; goto LAB_5; } if (3 < DAT_2) { local_138 = CONCAT44(local_138._4_4_,uVar20); goto LAB_3; } } } else { LAB_5: puVar18 = gBfsFilterHandle; uVar19 = BfsGetPolicyEntry(gBfsFilterHandle,0,0x1c0016210,(byte *)*local_128[0], (byte *)*local_100,&local_138); lVar4 = local_138; uVar10 = (uint)uVar19; uVar19 = uVar19 & 0xffffffff; if ((int)uVar10 < 0) { LAB_6: if (3 < DAT_2) { local_6c = 0; local_138 = CONCAT44(local_138._4_4_,uVar10); local_78 = &local_138; local_70 = 4; _tlgWriteTransfer_EtwWriteTransfer(puVar18,&DAT_4); } } else { lStack_f0 = lStack_110 + 2; puVar18 = *(undefined8 **)(local_138 + 0x30); sVar14 = (short)local_f8 + -2; sVar2 = local_f8._2_2_ + -2; local_f8._0_4_ = CONCAT22(sVar2,sVar14); uVar19 = BfsAddOrModifyEntry((longlong)puVar18,iVar9,uVar20,0, (ushort *)(*(longlong *)(param_3 + 0x30) + 0x18), (short *)&local_f8); uVar10 = (uint)uVar19; uVar19 = uVar19 & 0xffffffff; if ((int)uVar10 < 0) goto LAB_6; uVar12 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar12 != 0) { lVar5 = *(longlong *)(param_3 + 0x30); lStack_110 = *(longlong *)(lVar5 + 0x10); sVar14 = *(short *)(lVar5 + 8) - *(short *)(lVar5 + 0x48); local_118._0_4_ = CONCAT22(sVar14,sVar14); local_118 = (ulonglong)(uint)local_118; puVar18 = (undefined8 *)&gBfsGlobalFileTable; local_a8 = local_118; lStack_a0 = lStack_110; uVar10 = BfsAddPolicyToGlobalFileTable (0x1c0016140,(byte *)*local_128[0],(byte *)*local_100, (ushort *)&local_a8,iVar9); uVar19 = (ulonglong)uVar10; if ((int)uVar10 < 0) goto LAB_6; } } if (lVar4 != 0) { - BfsDereferencePolicyEntry(lVar4); + uVar12 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar12 == 0) { + BfsDereferencePolicyEntry(lVar4); + } + else { + BfsDereferencePolicyEntryEx(lVar4,'\0'); + } } } ExFreePoolWithTag(local_e0,0); goto LAB_1; } uVar19 = 0xc0000017; lVar15 = 0; - if (DAT_2 < 4) goto LAB_1c000be55; + if (DAT_2 < 4) goto LAB_1c000c217; local_138 = CONCAT44(local_138._4_4_,0xc0000017); } local_6c = 0; local_78 = &local_138; local_70 = 4; _tlgWriteTransfer_EtwWriteTransfer(puVar16,&DAT_4); lVar15 = 0; LAB_1: if (local_128[0] != (undefined8 *)0x0) { ExFreePoolWithTag(local_128[0],0); } if (local_100 != (undefined8 *)0x0) { ExFreePoolWithTag(local_100,0); } if (local_12f != '\0') { RtlFreeUnicodeString(&local_d8); } if (lVar15 != 0) { ObfDereferenceObject(lVar15); } return uVar19; } ``` ## BfsRemovePolicyEntry ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.85| |i_ratio|0.83| |m_ratio|0.96| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsRemovePolicyEntry|BfsRemovePolicyEntry| |fullname|BfsRemovePolicyEntry|BfsRemovePolicyEntry| |refcount|2|2| |`length`|701|754| |`called`|
Expand for full list:
BfsDereferencePolicyEntry
BfsFinalHash
BfsLookupPolicyEntryHashTable
BfsOpenPolicyDirectory
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveEntryHashTable
BfsUpdateHash
FLTMGR.SYS::FltClose
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveExNTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlLengthSid
NTOSKRNL.EXE::ZwDeleteFile
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsFinalHash
BfsLookupPolicyEntryHashTable
BfsOpenPolicyDirectory
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveEntryHashTable
BfsUpdateHash
FLTMGR.SYS::FltClose
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInlineNTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlLengthSid
NTOSKRNL.EXE::ZwDeleteFile
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsProcessDeletePolicyEntryRequest|BfsProcessDeletePolicyEntryRequest| |paramcount|5|5| |`address`|1c0008270|1c0008510| |sig|int __fastcall BfsRemovePolicyEntry(undefined8 param_1, undefined8 param_2, longlong param_3, byte * param_4, byte * param_5)|int __fastcall BfsRemovePolicyEntry(undefined8 param_1, undefined8 param_2, longlong param_3, byte * param_4, byte * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsRemovePolicyEntry Called Diff ```diff --- BfsRemovePolicyEntry called +++ BfsRemovePolicyEntry called @@ -1,0 +2 @@ +BfsDereferencePolicyEntryEx @@ -8,0 +10 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsRemovePolicyEntry Diff ```diff --- BfsRemovePolicyEntry +++ BfsRemovePolicyEntry @@ -1,113 +1,130 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ int BfsRemovePolicyEntry (undefined8 param_1,undefined8 param_2,longlong param_3,byte *param_4,byte *param_5) { uint uVar1; int iVar2; undefined8 uVar3; longlong lVar4; ulonglong uVar5; undefined8 *puVar6; undefined1 auStackY_108 [32]; longlong local_d8; longlong local_d0; undefined8 local_c8; undefined8 uStack_c0; undefined8 local_b8; undefined8 uStack_b0; undefined8 local_a8; longlong lStack_a0; undefined8 *local_98; undefined8 uStack_90; undefined8 local_88; undefined8 uStack_80; longlong *local_58; undefined8 local_50; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_108; local_d0 = 0; local_a8 = 0; lStack_a0 = 0; local_d8 = 0; local_98 = (undefined8 *)0x0; uStack_90 = 0; local_88 = 0; uStack_80 = 0; local_c8 = 0; uStack_c0 = 0; local_b8 = 0; uStack_b0 = 0; uVar1 = RtlLengthSid(param_4); BfsUpdateHash(param_4,uVar1,&local_d8); uVar1 = RtlLengthSid(param_5); BfsUpdateHash(param_5,uVar1,&local_d8); uVar3 = BfsFinalHash(&local_d8); KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_3,0); lVar4 = BfsLookupPolicyEntryHashTable(*(undefined8 *)(param_3 + 8),uVar3,param_4,param_5); if (lVar4 != 0) { - BfsRemoveEntryHashTable(*(undefined8 *)(param_3 + 8),lVar4); + uVar5 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 == 0) { + BfsRemoveEntryHashTable(*(undefined8 *)(param_3 + 8),lVar4); + } + else { + if (*(int *)(lVar4 + 0x38) != 0x10000000) { + iVar2 = 0; + lVar4 = 0; + goto LAB_0; + } + *(undefined4 *)(lVar4 + 0x38) = 0x10000002; + } uVar5 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar5 != 0) { BfsRemoveAllPoliciesFromGlobalFileTable(0x1c0016140,lVar4); } - BfsDereferencePolicyEntry(lVar4); + uVar5 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 == 0) { + BfsDereferencePolicyEntry(lVar4); + } + else { + BfsDereferencePolicyEntryEx(lVar4,'\x01'); + } } RtlInitUnicodeString(&local_b8,0); RtlInitUnicodeString(&local_c8,0); puVar6 = &local_b8; iVar2 = RtlConvertSidToUnicodeString(puVar6,param_4,1); lVar4 = 0; if (-1 < iVar2) { puVar6 = &local_c8; iVar2 = RtlConvertSidToUnicodeString(puVar6,param_5,1); lVar4 = 0; if (-1 < iVar2) { iVar2 = BfsOpenPolicyDirectory(param_1,0,&local_b8,'\x01',&local_d0); lVar4 = local_d0; if (iVar2 < 0) { - if (3 < DAT_0) { + if (3 < DAT_1) { local_d8 = CONCAT44(local_d8._4_4_,iVar2); local_58 = &local_d8; local_50 = 4; - _tlgWriteTransfer_EtwWriteTransfer(param_1,&DAT_1); + _tlgWriteTransfer_EtwWriteTransfer(param_1,&DAT_2); lVar4 = local_d0; } - goto LAB_2; + goto LAB_0; } local_98 = &local_c8; lStack_a0 = local_d0; puVar6 = &local_a8; local_88 = 0; uStack_80 = 0; local_a8 = CONCAT44(local_a8._4_4_,0x30); uStack_90 = CONCAT44(uStack_90._4_4_,0x40); iVar2 = ZwDeleteFile(); - if (-1 < iVar2) goto LAB_2; + if (-1 < iVar2) goto LAB_0; } } - if (3 < DAT_0) { + if (3 < DAT_1) { local_d8 = CONCAT44(local_d8._4_4_,iVar2); local_58 = &local_d8; local_50 = 4; - _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_1); + _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_2); } -LAB_2: +LAB_0: ExReleasePushLockExclusiveEx(param_3,0); KeLeaveCriticalRegion(); if ((short)local_c8 != 0) { RtlFreeUnicodeString(&local_c8); } if ((short)local_b8 != 0) { RtlFreeUnicodeString(&local_b8); } if (lVar4 != 0) { FltClose(lVar4); } return iVar2; } ``` ## BfsGetRegistryPrefix ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.86| |i_ratio|0.84| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsGetRegistryPrefix|BfsGetRegistryPrefix| |fullname|BfsGetRegistryPrefix|BfsGetRegistryPrefix| |refcount|2|2| |`length`|749|767| |`called`|
Expand for full list:
BfsCalculateRegistryPrefix
BfsDereferencePolicyEntry
BfsGetNotPresentPolicyEntry
BfsGetPolicyEntry
BfsPolicyEntryExists
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlQueryPackageIdentity
NTOSKRNL.EXE::SeQueryInformationToken__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
|
Expand for full list:
BfsCalculateRegistryPrefix
BfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsGetNotPresentPolicyEntry
BfsGetPolicyEntry
BfsPolicyEntryExists
Feature_2880249144__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeStringNTOSKRNL.EXE::RtlQueryPackageIdentity
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
| |calling|BfsRegistryPreCreateCallback|BfsRegistryPreCreateCallback| |paramcount|3|3| |`address`|1c000c9cc|1c000cd8c| |sig|uint __fastcall BfsGetRegistryPrefix(ushort * param_1, undefined8 * param_2, undefined8 * param_3)|uint __fastcall BfsGetRegistryPrefix(ushort * param_1, undefined8 * param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsGetRegistryPrefix Called Diff ```diff --- BfsGetRegistryPrefix called +++ BfsGetRegistryPrefix called @@ -2,0 +3 @@ +BfsDereferencePolicyEntryEx @@ -5,0 +7 @@ +Feature_2880249144__private_IsEnabledDeviceUsageNoInline ``` ### BfsGetRegistryPrefix Diff ```diff --- BfsGetRegistryPrefix +++ BfsGetRegistryPrefix @@ -1,119 +1,125 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ uint BfsGetRegistryPrefix(ushort *param_1,undefined8 *param_2,undefined8 *param_3) { short *psVar1; byte bVar2; uint uVar3; - ulonglong uVar4; - undefined8 uVar5; + undefined8 uVar4; + ulonglong uVar5; ushort *puVar6; undefined8 *puVar7; longlong lVar8; undefined1 auStackY_1f8 [32]; uint local_1c8 [2]; longlong local_1c0; undefined8 *local_1b8; undefined8 *local_1b0; undefined8 local_1a8; ushort local_1a0 [8]; undefined8 local_190; undefined8 uStack_188; uint *local_160; undefined8 local_158; undefined1 local_148 [256]; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_1f8; local_1b0 = (undefined8 *)0x0; local_190 = 0; uStack_188 = 0; memset(local_148,0,0x100); local_1a8 = 0x100; local_1c0 = 0; local_1b8 = (undefined8 *)0x0; local_1a0[0] = 0; local_1a0[1] = 0; local_1a0[2] = 0; local_1a0[3] = 0; local_1a0[4] = 0; local_1a0[5] = 0; local_1a0[6] = 0; local_1a0[7] = 0; puVar6 = param_1; uVar3 = SeQueryInformationToken(param_1,1,&local_1b8); lVar8 = 0; if (((int)uVar3 < 0) || (puVar6 = param_1, uVar3 = SeQueryInformationToken(param_1,0x1f,&local_1b0), lVar8 = 0, (int)uVar3 < 0)) goto LAB_0; bVar2 = BfsPolicyEntryExists(gBfsFilterHandle,0,0x1c0016210,(byte *)*local_1b8,(byte *)*local_1b0) ; if (bVar2 == 1) { puVar7 = gBfsFilterHandle; - uVar4 = BfsGetPolicyEntry(gBfsFilterHandle,0,0x1c0016210,(byte *)*local_1b8,(byte *)*local_1b0, + uVar5 = BfsGetPolicyEntry(gBfsFilterHandle,0,0x1c0016210,(byte *)*local_1b8,(byte *)*local_1b0, &local_1c0); - uVar3 = (uint)uVar4; + uVar3 = (uint)uVar5; } else { puVar7 = (undefined8 *)&gBfsPolicyTable; - uVar5 = BfsGetNotPresentPolicyEntry + uVar4 = BfsGetNotPresentPolicyEntry (0x1c0016210,(byte *)*local_1b8,(byte *)*local_1b0,&local_1c0); - uVar3 = (uint)uVar5; + uVar3 = (uint)uVar4; } lVar8 = local_1c0; if ((int)uVar3 < 0) { if (3 < DAT_1) { local_160 = local_1c8; local_158 = 4; local_1c8[0] = uVar3; _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_2); lVar8 = local_1c0; } goto LAB_3; } psVar1 = (short *)(local_1c0 + 0x70); if ((*psVar1 == 0) || (*(short *)(local_1c0 + 0x80) == 0)) { puVar6 = local_1a0; uVar3 = RtlConvertSidToUnicodeString(puVar6,*local_1b8,1); if ((-1 < (int)uVar3) && (uVar3 = RtlQueryPackageIdentity(param_1,local_148,&local_1a8,0), puVar6 = param_1, -1 < (int)uVar3)) { RtlInitUnicodeString(&local_190,local_148); puVar6 = local_1a0; uVar3 = BfsCalculateRegistryPrefix (puVar6,(ushort *)&local_190,(PUCHAR)psVar1,(PUCHAR)(lVar8 + 0x80)); if (-1 < (int)uVar3) goto LAB_4; } LAB_0: if (3 < DAT_1) { local_160 = local_1c8; local_158 = 4; local_1c8[0] = uVar3; _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_2); } } else { LAB_4: - uVar5 = *(undefined8 *)(lVar8 + 0x78); + uVar4 = *(undefined8 *)(lVar8 + 0x78); *param_2 = *(undefined8 *)psVar1; - param_2[1] = uVar5; - uVar5 = *(undefined8 *)(lVar8 + 0x88); + param_2[1] = uVar4; + uVar4 = *(undefined8 *)(lVar8 + 0x88); *param_3 = *(undefined8 *)(lVar8 + 0x80); - param_3[1] = uVar5; + param_3[1] = uVar4; } LAB_3: RtlFreeUnicodeString(local_1a0); if (local_1b8 != (undefined8 *)0x0) { - ExFreePoolWithTag(local_1b8,0); + ExFreePoolWithTag(); } if (local_1b0 != (undefined8 *)0x0) { - ExFreePoolWithTag(local_1b0,0); + ExFreePoolWithTag(); } if (lVar8 != 0) { - BfsDereferencePolicyEntry(lVar8); + uVar5 = Feature_2880249144__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 == 0) { + BfsDereferencePolicyEntry(lVar8); + } + else { + BfsDereferencePolicyEntryEx(lVar8,'\0'); + } } return uVar3; } ``` ## BfsDereferencePolicyEntry ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address,called| |ratio|0.92| |i_ratio|0.64| |m_ratio|0.85| |b_ratio|0.81| |match_types|Implied Match| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |`name`|BfsDereferencePolicyEntry|BfsDereferencePolicyEntryEx| |`fullname`|BfsDereferencePolicyEntry|BfsDereferencePolicyEntryEx| |refcount|19|19| |`length`|233|343| |`called`|BfsCloseStorage
NTOSKRNL.EXE::ExFreePoolWithTag|BfsCloseStorage
BfsRemoveEntryHashTable
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion| |calling|
Expand for full list:
BfsCheckAndApplyPolicy
BfsCheckAndReleaseIdlePolicy
BfsDeleteFileFromGlobalFileTable
BfsGetPolicyEntry
BfsGetRegistryPrefix
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsPerformPrompt
BfsPostCreateOperation
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequestBfsProcessSetPolicyRequest
BfsRemovePolicyEntry
BfsUninitializePolicyTable
|
Expand for full list:
BfsCheckAndApplyPolicy
BfsCheckAndReleaseIdlePolicy
BfsDeleteFileFromGlobalFileTable
BfsGetPolicyEntry
BfsGetRegistryPrefix
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsPerformPrompt
BfsPostCreateOperation
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequestBfsProcessSetPolicyRequest
BfsRemovePolicyEntry
BfsUninitializePolicyTable
| |paramcount|1|2| |`address`|1c0004fa0|1c0005160| |`sig`|undefined __fastcall BfsDereferencePolicyEntry(longlong param_1)|undefined __fastcall BfsDereferencePolicyEntryEx(longlong param_1, char param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsDereferencePolicyEntry Called Diff ```diff --- BfsDereferencePolicyEntry called +++ BfsDereferencePolicyEntryEx called @@ -1,0 +2,2 @@ +BfsRemoveEntryHashTable +NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx @@ -2,0 +5,3 @@ +NTOSKRNL.EXE::ExReleasePushLockExclusiveEx +NTOSKRNL.EXE::KeEnterCriticalRegion +NTOSKRNL.EXE::KeLeaveCriticalRegion ``` ### BfsDereferencePolicyEntry Diff ```diff --- BfsDereferencePolicyEntry +++ BfsDereferencePolicyEntryEx @@ -1,54 +1,63 @@ -void BfsDereferencePolicyEntry(longlong param_1) +void BfsDereferencePolicyEntryEx(longlong param_1,char param_2) { longlong *plVar1; int *piVar2; int iVar3; longlong lVar4; longlong *plVar5; code *pcVar6; + if (param_2 == '\0') { + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(&gBfsPolicyTable,0); + } LOCK(); piVar2 = (int *)(param_1 + 0x90); iVar3 = *piVar2; *piVar2 = *piVar2 + -1; UNLOCK(); if (iVar3 == 1) { if (*(longlong *)(param_1 + 0x18) != 0) { ExFreePoolWithTag(*(longlong *)(param_1 + 0x18),0); } if (*(longlong *)(param_1 + 0x20) != 0) { ExFreePoolWithTag(*(longlong *)(param_1 + 0x20),0); } if (*(longlong *)(param_1 + 0x28) != 0) { ExFreePoolWithTag(*(longlong *)(param_1 + 0x28),0); } if (*(longlong *)(param_1 + 0x30) != 0) { BfsCloseStorage(*(longlong *)(param_1 + 0x30)); } plVar1 = (longlong *)(param_1 + 0x40); lVar4 = *plVar1; if ((lVar4 != 0) && (*(longlong *)(param_1 + 0x48) != 0)) { if ((*(longlong **)(lVar4 + 8) != plVar1) || (plVar5 = *(longlong **)(param_1 + 0x48), (longlong *)*plVar5 != plVar1)) { pcVar6 = (code *)swi(0x29); (*pcVar6)(3); pcVar6 = (code *)swi(3); (*pcVar6)(); return; } *plVar5 = lVar4; *(longlong **)(lVar4 + 8) = plVar5; } if (*(longlong *)(param_1 + 0x78) != 0) { ExFreePoolWithTag(*(longlong *)(param_1 + 0x78),0); } if (*(longlong *)(param_1 + 0x88) != 0) { ExFreePoolWithTag(*(longlong *)(param_1 + 0x88),0); } + BfsRemoveEntryHashTable(DAT_0,param_1); ExFreePoolWithTag(param_1,0); + } + if (param_2 == '\0') { + ExReleasePushLockExclusiveEx(&gBfsPolicyTable,0); + KeLeaveCriticalRegion(); } return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## wil_details_IsEnabledFallback ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|2|4| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_Servicing_BfsGAFeature__private_IsEnabledFallback|Feature_2880249144__private_IsEnabledFallback
Feature_752421176__private_IsEnabledFallback
Feature_Servicing_BfsGAFeature__private_IsEnabledFallback| |paramcount|3|3| |`address`|1c0003fe8|1c000405c| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1,2 @@ +Feature_2880249144__private_IsEnabledFallback +Feature_752421176__private_IsEnabledFallback ``` ## NTOSKRNL.EXE::ExReleasePushLockExclusiveEx ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|ExReleasePushLockExclusiveEx|ExReleasePushLockExclusiveEx| |fullname|NTOSKRNL.EXE::ExReleasePushLockExclusiveEx|NTOSKRNL.EXE::ExReleasePushLockExclusiveEx| |`refcount`|34|36| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsDeleteEntry
BfsDereferenceTableEntry
BfsExpandDirectory
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntryBfsInsertPolicyEntry
BfsPostCreateOperation
BfsProcessDelete
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUninitializePipeMappingTable
|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsExpandDirectory
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMappingBfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsPostCreateOperation
BfsProcessDelete
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUninitializePipeMappingTable
| |paramcount|0|0| |address|EXTERNAL:00000018|EXTERNAL:00000018| |sig|undefined ExReleasePushLockExclusiveEx(void)|undefined ExReleasePushLockExclusiveEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExReleasePushLockExclusiveEx Calling Diff ```diff --- NTOSKRNL.EXE::ExReleasePushLockExclusiveEx calling +++ NTOSKRNL.EXE::ExReleasePushLockExclusiveEx calling @@ -5,0 +6 @@ +BfsDereferencePolicyEntryEx ``` ## NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|ExAcquirePushLockExclusiveEx|ExAcquirePushLockExclusiveEx| |fullname|NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx|NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx| |`refcount`|26|28| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsDeleteEntry
BfsDereferenceTableEntry
BfsExpandDirectory
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntryBfsInsertPolicyEntry
BfsPostCreateOperation
BfsProcessDelete
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUninitializePipeMappingTable
|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsExpandDirectory
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMappingBfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsPostCreateOperation
BfsProcessDelete
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUninitializePipeMappingTable
| |paramcount|0|0| |address|EXTERNAL:00000017|EXTERNAL:00000017| |sig|undefined ExAcquirePushLockExclusiveEx(void)|undefined ExAcquirePushLockExclusiveEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx Calling Diff ```diff --- NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx calling +++ NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx calling @@ -5,0 +6 @@ +BfsDereferencePolicyEntryEx ``` ## NTOSKRNL.EXE::KeEnterCriticalRegion ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|KeEnterCriticalRegion|KeEnterCriticalRegion| |fullname|NTOSKRNL.EXE::KeEnterCriticalRegion|NTOSKRNL.EXE::KeEnterCriticalRegion| |`refcount`|49|51| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsDereferenceTableEntry
BfsDeviceIoControl
BfsEnumerateDirectory
BfsEnumeratePolicyBfsExpandDirectory
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsLocateDirectory
BfsPolicyEntryExists
BfsPostCreateOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessDelete
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUninitializePipeMappingTable
BfsUnload
|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsDeviceIoControl
BfsEnumerateDirectoryBfsEnumeratePolicy
BfsExpandDirectory
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsLocateDirectory
BfsPolicyEntryExists
BfsPostCreateOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessDelete
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUninitializePipeMappingTable
BfsUnload
| |paramcount|0|0| |address|EXTERNAL:00000080|EXTERNAL:00000080| |sig|undefined KeEnterCriticalRegion(void)|undefined KeEnterCriticalRegion(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeEnterCriticalRegion Calling Diff ```diff --- NTOSKRNL.EXE::KeEnterCriticalRegion calling +++ NTOSKRNL.EXE::KeEnterCriticalRegion calling @@ -7,0 +8 @@ +BfsDereferencePolicyEntryEx ``` ## _tlgWriteTransfer_EtwWriteTransfer ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.97| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|_tlgWriteTransfer_EtwWriteTransfer|_tlgWriteTransfer_EtwWriteTransfer| |fullname|_tlgWriteTransfer_EtwWriteTransfer|_tlgWriteTransfer_EtwWriteTransfer| |`refcount`|106|105| |length|163|163| |called|NTOSKRNL.EXE::EtwWriteTransfer|NTOSKRNL.EXE::EtwWriteTransfer| |calling|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAddPolicyToGlobalFileTable
BfsAdjustRegistryKeySecurity
BfsAllocateAndConcatenatePath
BfsApplyPolicyAsUser
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsCreateDirectory
BfsCreateGlobalFileEntry
BfsCreatePolicyStorageDescriptorBfsCreateStorage
BfsDeleteFileFromGlobalFileTable
BfsDeviceIoControl
BfsEnumeratePolicy
BfsExpandDirectory
BfsFileInPublisherDirectory
BfsFileOpenAsUserCallback
BfsGetFileContext
BfsGetPolicyEntry
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsGetUserToken
BfsImpersonateToken
BfsImpersonateUser
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsIsApplicableToken
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenPolicyDirectory
BfsOpenPolicyRootDirectory
BfsOpenRootDirectory
BfsPerformPrompt
BfsPostCreatePipeOperation
BfsPreCreatePipeOperation
BfsProcessDeletePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyRequest
BfsPromptForConsent
BfsQueryFileNameInformationCallback
BfsQueueDeferredWorkItemAndWait
BfsQueueIoWorkItemAndWait
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryCallback
BfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveKeyValues
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateSecurityDescriptor
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAddPolicyToGlobalFileTable
BfsAdjustRegistryKeySecurity
BfsAllocateAndConcatenatePath
BfsApplyPolicyAsUser
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsCreateDirectory
BfsCreateGlobalFileEntry
BfsCreatePolicyStorageDescriptorBfsCreateStorage
BfsDeleteFileFromGlobalFileTable
BfsDeviceIoControl
BfsEnumeratePolicy
BfsExpandDirectory
BfsFileInPublisherDirectory
BfsFileOpenAsUserCallback
BfsGetFileContext
BfsGetPolicyEntry
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsGetUserToken
BfsImpersonateToken
BfsImpersonateUser
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsIsApplicableToken
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenPolicyDirectory
BfsOpenPolicyRootDirectory
BfsOpenRootDirectory
BfsPerformPrompt
BfsPostCreatePipeOperation
BfsPreCreatePipeOperation
BfsProcessDeletePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyRequest
BfsPromptForConsent
BfsQueryFileNameInformationCallback
BfsQueueDeferredWorkItemAndWait
BfsQueueIoWorkItemAndWait
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryCallback
BfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveKeyValues
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateSecurityDescriptor
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
| |paramcount|2|2| |address|1c0001008|1c0001008| |sig|undefined __fastcall _tlgWriteTransfer_EtwWriteTransfer(undefined8 param_1, byte * param_2)|undefined __fastcall _tlgWriteTransfer_EtwWriteTransfer(undefined8 param_1, byte * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::ExFreePoolWithTag ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|ExFreePoolWithTag|ExFreePoolWithTag| |fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag| |`refcount`|142|148| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAdjustRegistryKeySecurity
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsClearGlobalFileEntry
BfsCloseStorage
BfsCreateDirectory
BfsCreateGlobalFileEntry
BfsCreatePolicyStorageDescriptor
BfsCreateStorage
BfsDeleteFileFromGlobalFileTableBfsDereferencePolicyEntry
BfsDereferenceTableEntry
BfsEnumeratePolicy
BfsExpandDirectory
BfsFreeDirectoryBlockList
BfsFreeTableEntry
BfsGetRegistryPrefix
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInitializePipeMappingTable
BfsInitializePolicyTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenRootDirectory
BfsPerformPrompt
BfsPolicyEntryExists
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessDeletePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyRequest
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryPostCreateCallback
BfsReleaseNamedPipeMapping
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveKeyValues
BfsRemovePolicyFromGlobalFileTable
BfsReparseNamedPipe
BfsUninitializeGlobalFileTable
BfsUninitializePipeMappingTable
BfsUninitializePolicyTable
BfsUnload
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
KappxParsePackageFullNameFromToken
MIDL_user_free
|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAdjustRegistryKeySecurity
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsClearGlobalFileEntry
BfsCloseStorage
BfsCreateDirectory
BfsCreateGlobalFileEntry
BfsCreatePolicyStorageDescriptor
BfsCreateStorage
BfsDeleteFileFromGlobalFileTableBfsDereferencePolicyEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsEnumeratePolicy
BfsExpandDirectory
BfsFreeDirectoryBlockList
BfsFreeTableEntry
BfsGetRegistryPrefix
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInitializePipeMappingTable
BfsInitializePolicyTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenRootDirectory
BfsPerformPrompt
BfsPolicyEntryExists
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessDeletePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyRequest
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryPostCreateCallback
BfsReleaseNamedPipeMapping
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveKeyValues
BfsRemovePolicyFromGlobalFileTable
BfsReparseNamedPipe
BfsUninitializeGlobalFileTable
BfsUninitializePipeMappingTable
BfsUninitializePolicyTable
BfsUnload
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
KappxParsePackageFullNameFromToken
MIDL_user_free
| |paramcount|0|0| |address|EXTERNAL:0000007a|EXTERNAL:0000007a| |sig|undefined ExFreePoolWithTag(void)|undefined ExFreePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExFreePoolWithTag Calling Diff ```diff --- NTOSKRNL.EXE::ExFreePoolWithTag calling +++ NTOSKRNL.EXE::ExFreePoolWithTag calling @@ -12,0 +13 @@ +BfsDereferencePolicyEntryEx ``` ## NTOSKRNL.EXE::KeLeaveCriticalRegion ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|KeLeaveCriticalRegion|KeLeaveCriticalRegion| |fullname|NTOSKRNL.EXE::KeLeaveCriticalRegion|NTOSKRNL.EXE::KeLeaveCriticalRegion| |`refcount`|64|66| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsDereferenceTableEntry
BfsDeviceIoControl
BfsEnumerateDirectory
BfsEnumeratePolicyBfsExpandDirectory
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsLocateDirectory
BfsPolicyEntryExists
BfsPostCreateOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessDelete
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUninitializePipeMappingTable
BfsUnload
|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsDeviceIoControl
BfsEnumerateDirectoryBfsEnumeratePolicy
BfsExpandDirectory
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsLocateDirectory
BfsPolicyEntryExists
BfsPostCreateOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessDelete
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUninitializePipeMappingTable
BfsUnload
| |paramcount|0|0| |address|EXTERNAL:00000082|EXTERNAL:00000082| |sig|undefined KeLeaveCriticalRegion(void)|undefined KeLeaveCriticalRegion(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeLeaveCriticalRegion Calling Diff ```diff --- NTOSKRNL.EXE::KeLeaveCriticalRegion calling +++ NTOSKRNL.EXE::KeLeaveCriticalRegion calling @@ -7,0 +8 @@ +BfsDereferencePolicyEntryEx ``` ## BfsRemoveEntryHashTable ### Match Info |Key|bfs-10.0.26100.2454.sys - bfs-10.0.26100.2894.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.2454.sys|bfs-10.0.26100.2894.sys| | :---: | :---: | :---: | |name|BfsRemoveEntryHashTable|BfsRemoveEntryHashTable| |fullname|BfsRemoveEntryHashTable|BfsRemoveEntryHashTable| |`refcount`|13|14| |length|35|35| |called|NTOSKRNL.EXE::RtlRemoveEntryHashTable|NTOSKRNL.EXE::RtlRemoveEntryHashTable| |`calling`|BfsCheckAndReleaseIdlePolicy
BfsClearGlobalFileEntry
BfsDeleteFileFromGlobalFileTable
BfsInsertPolicyEntry
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUninitializeGlobalFileTable
BfsUninitializePipeMappingTable
BfsUninitializePolicyTable|
Expand for full list:
BfsCheckAndReleaseIdlePolicy
BfsClearGlobalFileEntry
BfsDeleteFileFromGlobalFileTable
BfsDereferencePolicyEntryEx
BfsInsertPolicyEntry
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsUninitializeGlobalFileTable
BfsUninitializePipeMappingTable
BfsUninitializePolicyTable
| |paramcount|2|2| |`address`|1c000ff54|1c0010324| |sig|uint __fastcall BfsRemoveEntryHashTable(undefined8 param_1, undefined8 param_2)|uint __fastcall BfsRemoveEntryHashTable(undefined8 param_1, undefined8 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsRemoveEntryHashTable Calling Diff ```diff --- BfsRemoveEntryHashTable calling +++ BfsRemoveEntryHashTable calling @@ -3,0 +4 @@ +BfsDereferencePolicyEntryEx ``` Generated with `ghidriff` version: 1.0.0 on 2026-07-25T10:30:23