# bfs.sys KB5094126 vs KB5101650 (CVE-2026-50458) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [BfsProcessHardLink](#bfsprocesshardlink) * [BfsResolveReparseTarget](#bfsresolvereparsetarget) * [BfsInsertDirectoryEntry_OLD](#bfsinsertdirectoryentry_old) * [NTOSKRNL.EXE::ZwFsControlFile](#ntoskrnlexezwfscontrolfile) * [Modified](#modified) * [BfsPreCleanupOperation](#bfsprecleanupoperation) * [BfsRegistryPreCreateCallback](#bfsregistryprecreatecallback) * [BfsProcessDelete](#bfsprocessdelete) * [BfsInsertDirectoryEntry](#bfsinsertdirectoryentry) * [BfsCheckAndReleaseIdlePolicy](#bfscheckandreleaseidlepolicy) * [BfsInsertPolicyEntryLocked](#bfsinsertpolicyentrylocked) * [DriverEntry](#driverentry) * [BfsProcessSetPolicyRequest](#bfsprocesssetpolicyrequest) * [BfsRegistryPostCreateCallback](#bfsregistrypostcreatecallback) * [BfsInitializeGlobalFileTable](#bfsinitializeglobalfiletable) * [BfsReleaseNamedPipeMapping](#bfsreleasenamedpipemapping) * [BfsPostCleanupOperation](#bfspostcleanupoperation) * [BfsIdleCheckWorkitemRoutine](#bfsidlecheckworkitemroutine) * [BfsGetPolicy](#bfsgetpolicy) * [BfsAddOrModifyEntry](#bfsaddormodifyentry) * [BfsCheckPolicyAndPerformRenameAsUser](#bfscheckpolicyandperformrenameasuser) * [BfsRemoveKeyValues](#bfsremovekeyvalues) * [BfsInsertNotPresentPolicyEntry](#bfsinsertnotpresentpolicyentry) * [BfsRenameEntry](#bfsrenameentry) * [BfsInsertPolicyEntry](#bfsinsertpolicyentry) * [BfsCreateStorage](#bfscreatestorage) * [BfsPostCreateOperation](#bfspostcreateoperation) * [BfsPreCreatePipeOperation](#bfsprecreatepipeoperation) * [BfsPreCreateOperation](#bfsprecreateoperation) * [BfsGetNotPresentPolicyEntryLocked](#bfsgetnotpresentpolicyentrylocked) * [BfsExpandDirectory](#bfsexpanddirectory) * [BfsCheckAndApplyPolicy](#bfscheckandapplypolicy) * [BfsPreSetInfoOperation](#bfspresetinfooperation) * [BfsDeviceIoControl](#bfsdeviceiocontrol) * [BfsProcessRename](#bfsprocessrename) * [BfsCreateDirectory](#bfscreatedirectory) * [BfsGetPolicyEntryLocked](#bfsgetpolicyentrylocked) * [BfsGetRegistryPrefix](#bfsgetregistryprefix) * [BfsGetNotPresentPolicyEntry](#bfsgetnotpresentpolicyentry) * [BfsCreatePolicyStorageDescriptor](#bfscreatepolicystoragedescriptor) * [BfsPostCreatePipeOperation](#bfspostcreatepipeoperation) * [BfsInsertDirectory](#bfsinsertdirectory) * [BfsGetRegistryPrefixEx](#bfsgetregistryprefixex) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [NTOSKRNL.EXE::PsDereferencePrimaryToken](#ntoskrnlexepsdereferenceprimarytoken) * [BfsAllocateBlock](#bfsallocateblock) * [NTOSKRNL.EXE::RtlPrefixUnicodeString](#ntoskrnlexertlprefixunicodestring) * [NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx](#ntoskrnlexeexacquirepushlockexclusiveex) * [NTOSKRNL.EXE::ZwOpenFile](#ntoskrnlexezwopenfile) * [FLTMGR.SYS::FltParseFileNameInformation](#fltmgrsysfltparsefilenameinformation) * [BfsGetFileName](#bfsgetfilename) * [NTOSKRNL.EXE::PsReferencePrimaryToken](#ntoskrnlexepsreferenceprimarytoken) * [NTOSKRNL.EXE::ExAcquireRundownProtection](#ntoskrnlexeexacquirerundownprotection) * [NTOSKRNL.EXE::ExAcquirePushLockSharedEx](#ntoskrnlexeexacquirepushlocksharedex) * [NTOSKRNL.EXE::RtlClearBits](#ntoskrnlexertlclearbits) * [__security_check_cookie](#__security_check_cookie) * [NTOSKRNL.EXE::RtlQueryPackageIdentity](#ntoskrnlexertlquerypackageidentity) * [NTOSKRNL.EXE::RtlFindClearBits](#ntoskrnlexertlfindclearbits) * [memset](#memset) * [NTOSKRNL.EXE::ZwClose](#ntoskrnlexezwclose) * [NTOSKRNL.EXE::RtlConvertSidToUnicodeString](#ntoskrnlexertlconvertsidtounicodestring) * [NTOSKRNL.EXE::KeEnterCriticalRegion](#ntoskrnlexekeentercriticalregion) * [FLTMGR.SYS::FltReleaseFileNameInformation](#fltmgrsysfltreleasefilenameinformation) * [NTOSKRNL.EXE::RtlInitializeBitMap](#ntoskrnlexertlinitializebitmap) * [_tlgWriteTransfer_EtwWriteTransfer](#_tlgwritetransfer_etwwritetransfer) * [NTOSKRNL.EXE::CmRegisterCallbackEx](#ntoskrnlexecmregistercallbackex) * [BfsWriteBlock](#bfswriteblock) * [BfsCalculateRegistryPrefix](#bfscalculateregistryprefix) * [NTOSKRNL.EXE::PsReferenceImpersonationToken](#ntoskrnlexepsreferenceimpersonationtoken) * [NTOSKRNL.EXE::RtlSetBits](#ntoskrnlexertlsetbits) * [FLTMGR.SYS::FltGetDestinationFileNameInformation](#fltmgrsysfltgetdestinationfilenameinformation) * [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag) * [BfsIsApplicableToken](#bfsisapplicabletoken) * [NTOSKRNL.EXE::KeLeaveCriticalRegion](#ntoskrnlexekeleavecriticalregion) * [NTOSKRNL.EXE::ExReleaseRundownProtection](#ntoskrnlexeexreleaserundownprotection) * [NTOSKRNL.EXE::RtlFreeUnicodeString](#ntoskrnlexertlfreeunicodestring) * [NTOSKRNL.EXE::RtlInitUnicodeString](#ntoskrnlexertlinitunicodestring) * [Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline](#feature_bfsfixbundle__private_isenableddeviceusagenoinline) * [BfsDereferencePolicyEntryEx](#bfsdereferencepolicyentryex) * [NTOSKRNL.EXE::ExAllocatePool2](#ntoskrnlexeexallocatepool2) * [BfsFreeBlock](#bfsfreeblock) * [NTOSKRNL.EXE::PsDereferenceImpersonationToken](#ntoskrnlexepsdereferenceimpersonationtoken) * [NTOSKRNL.EXE::IoGetCurrentProcess](#ntoskrnlexeiogetcurrentprocess) # Visual Chart Diff ```mermaid flowchart LR BfsPreCleanupOperation-3-old<--Match 92%-->BfsPreCleanupOperation-3-new BfsRegistryPreCreateCallback-3-old<--Match 50%-->BfsRegistryPreCreateCallback-3-new BfsProcessDelete-1-old<--Match 97%-->BfsProcessDelete-1-new BfsInsertDirectoryEntry-5-old<--Match 85%-->BfsInsertDirectoryEntry-5-new BfsCheckAndReleaseIdlePolicy-1-old<--Match 72%-->BfsCheckAndReleaseIdlePolicy-1-new BfsInsertPolicyEntryLocked-8-old<--Match 80%-->BfsInsertPolicyEntryLocked-8-new DriverEntry-1-old<--Match 56%-->DriverEntry-1-new BfsProcessSetPolicyRequest-2-old<--Match 95%-->BfsProcessSetPolicyRequest-2-new BfsRegistryPostCreateCallback-3-old<--Match 90%-->BfsRegistryPostCreateCallback-3-new BfsInitializeGlobalFileTable-3-old<--Match 94%-->BfsInitializeGlobalFileTable-3-new BfsReleaseNamedPipeMapping-2-old<--Match 70%-->BfsReleaseNamedPipeMapping-2-new BfsPostCleanupOperation-3-old<--Match 97%-->BfsPostCleanupOperation-3-new BfsIdleCheckWorkitemRoutine-3-old<--Match 80%-->BfsIdleCheckWorkitemRoutine-3-new BfsGetPolicy-4-old<--Match 84%-->BfsGetPolicy-4-new BfsAddOrModifyEntry-6-old<--Match 93%-->BfsAddOrModifyEntry-6-new BfsCheckPolicyAndPerformRenameAsUser-5-old<--Match 75%-->BfsCheckPolicyAndPerformRenameAsUser-5-new BfsRemoveKeyValues-1-old<--Match 95%-->BfsRemoveKeyValues-1-new BfsInsertNotPresentPolicyEntry-4-old<--Match 92%-->BfsInsertNotPresentPolicyEntry-4-new BfsRenameEntry-4-old<--Match 3%-->BfsRenameEntry-4-new BfsInsertPolicyEntry-8-old<--Match 56%-->BfsInsertPolicyEntry-8-new BfsCreateStorage-6-old<--Match 74%-->BfsCreateStorage-6-new BfsPostCreateOperation-4-old<--Match 98%-->BfsPostCreateOperation-4-new BfsPreCreatePipeOperation-3-old<--Match 88%-->BfsPreCreatePipeOperation-3-new BfsPreCreateOperation-3-old<--Match 51%-->BfsPreCreateOperation-3-new BfsGetNotPresentPolicyEntryLocked-4-old<--Match 90%-->BfsGetNotPresentPolicyEntryLocked-4-new BfsExpandDirectory-5-old<--Match 98%-->BfsExpandDirectory-5-new bfs-10.0.26100.8521.sys<--13ommited-->bfs-10.0.26100.8875.sys subgraph bfs-10.0.26100.8875.sys BfsPreCleanupOperation-3-new BfsRegistryPreCreateCallback-3-new BfsProcessDelete-1-new BfsInsertDirectoryEntry-5-new BfsCheckAndReleaseIdlePolicy-1-new BfsInsertPolicyEntryLocked-8-new DriverEntry-1-new BfsProcessSetPolicyRequest-2-new BfsRegistryPostCreateCallback-3-new BfsInitializeGlobalFileTable-3-new BfsReleaseNamedPipeMapping-2-new BfsPostCleanupOperation-3-new BfsIdleCheckWorkitemRoutine-3-new BfsGetPolicy-4-new BfsAddOrModifyEntry-6-new BfsCheckPolicyAndPerformRenameAsUser-5-new BfsRemoveKeyValues-1-new BfsInsertNotPresentPolicyEntry-4-new BfsRenameEntry-4-new BfsInsertPolicyEntry-8-new BfsCreateStorage-6-new BfsPostCreateOperation-4-new BfsPreCreatePipeOperation-3-new BfsPreCreateOperation-3-new BfsGetNotPresentPolicyEntryLocked-4-new BfsExpandDirectory-5-new subgraph Added direction LR BfsProcessHardLink BfsResolveReparseTarget BfsInsertDirectoryEntry_OLD NTOSKRNLEXE-ZwFsControlFile end end subgraph bfs-10.0.26100.8521.sys BfsPreCleanupOperation-3-old BfsRegistryPreCreateCallback-3-old BfsProcessDelete-1-old BfsInsertDirectoryEntry-5-old BfsCheckAndReleaseIdlePolicy-1-old BfsInsertPolicyEntryLocked-8-old DriverEntry-1-old BfsProcessSetPolicyRequest-2-old BfsRegistryPostCreateCallback-3-old BfsInitializeGlobalFileTable-3-old BfsReleaseNamedPipeMapping-2-old BfsPostCleanupOperation-3-old BfsIdleCheckWorkitemRoutine-3-old BfsGetPolicy-4-old BfsAddOrModifyEntry-6-old BfsCheckPolicyAndPerformRenameAsUser-5-old BfsRemoveKeyValues-1-old BfsInsertNotPresentPolicyEntry-4-old BfsRenameEntry-4-old BfsInsertPolicyEntry-8-old BfsCreateStorage-6-old BfsPostCreateOperation-4-old BfsPreCreatePipeOperation-3-old BfsPreCreateOperation-3-old BfsGetNotPresentPolicyEntryLocked-4-old BfsExpandDirectory-5-old end ``` ```mermaid pie showData title Function Matches - 99.5590% "unmatched_funcs_len" : 4 "matched_funcs_len" : 903 ``` ```mermaid pie showData title Matched Function Similarity - 79.1805% "matched_funcs_with_code_changes_len" : 38 "matched_funcs_with_non_code_changes_len" : 150 "matched_funcs_no_changes_len" : 715 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-50458\ghidra_projects --project-name CVE-2026-50458 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-50458\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title bfs.sys KB5094126 vs KB5101650 (CVE-2026-50458) bfs-10.0.26100.8521.sys bfs-10.0.26100.8875.sys ``` #### Verbose Args
``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2026-50458\\bfs-10.0.26100.8521.sys'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2026-50458\\bfs-10.0.26100.8875.sys']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-50458\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-50458\ghidra_projects --project-name CVE-2026-50458 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-50458\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title bfs.sys KB5094126 vs KB5101650 (CVE-2026-50458) ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/Bfs.sys/0731ED0C26000/Bfs.sys -O bfs.sys.x64.10.0.26100.8521 wget https://msdl.microsoft.com/download/symbols/Bfs.sys/89D111DA26000/Bfs.sys -O bfs.sys.x64.10.0.26100.8875 ``` ## Binary Metadata Diff ```diff --- bfs-10.0.26100.8521.sys Meta +++ bfs-10.0.26100.8875.sys Meta @@ -1,44 +1,44 @@ -Program Name: bfs-10.0.26100.8521.sys +Program Name: bfs-10.0.26100.8875.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f # of Bytes: 161872 # of Memory Blocks: 13 -# of Instructions: 22483 -# of Defined Data: 3308 -# of Functions: 455 -# of Symbols: 3479 +# of Instructions: 22862 +# of Defined Data: 3307 +# of Functions: 452 +# of Symbols: 3511 # of Data Types: 358 # of Data Type Categories: 22 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Mon Jul 27 19:09:32 SGT 2026 +Date Created: Mon Jul 27 19:09:38 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-50458/bfs-10.0.26100.8521.sys -Executable MD5: 343fae762d6f991d0fd7016b519ed8aa -Executable SHA256: 6b8df8f852adb8d416c01fff25d622345d31585c3b09c0f2df4eb1da528c1eb4 -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-50458/bfs-10.0.26100.8521.sys?MD5=343fae762d6f991d0fd7016b519ed8aa +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-50458/bfs-10.0.26100.8875.sys +Executable MD5: 7eb0f3617a8e1c841b20a645fae2fbc5 +Executable SHA256: ddb7e0cae6275e02cff53fb04d2fc5d66e15cf94686d47802dcbc4d62d1618bc +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-50458/bfs-10.0.26100.8875.sys?MD5=7eb0f3617a8e1c841b20a645fae2fbc5 PDB Age: 1 PDB File: bfs.pdb -PDB GUID: 3b60b15d-f4fd-8f20-efa4-ab94e160e927 +PDB GUID: 2e8bae6c-a79e-e5b6-83cf-944380807d56 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Bfs Filter Driver -PE Property[FileVersion]: 10.0.26100.8521 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8875 (WinBuild.160101.0800) PE Property[InternalName]: Bfs.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: Bfs.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8521 +PE Property[ProductVersion]: 10.0.26100.8875 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra bfs-10.0.26100.8521.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra bfs-10.0.26100.8521.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra bfs-10.0.26100.8521.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra bfs-10.0.26100.8875.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra bfs-10.0.26100.8875.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra bfs-10.0.26100.8875.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|4| |deleted_funcs_len|0| |modified_funcs_len|188| |added_symbols_len|34| |deleted_symbols_len|43| |diff_time|20.62260103225708| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 425, 'BulkBasicBlockMnemonicHash': 260, 'ExternalsName': 195, 'ExactBytesFunctionHasher': 1, 'ExactInstructionsFunctionHasher': 1, 'Implied Match': 1})| |items_to_process|269| |diff_types|Counter({'address': 179, 'refcount': 155, 'calling': 149, 'called': 145, 'sig': 116, 'name': 109, 'fullname': 109, 'code': 38, 'length': 38})| |unmatched_funcs_len|4| |total_funcs_len|907| |matched_funcs_len|903| |matched_funcs_with_code_changes_len|38| |matched_funcs_with_non_code_changes_len|150| |matched_funcs_no_changes_len|715| |match_func_similarity_percent|79.1805%| |func_match_overall_percent|99.5590%| |first_matches|Counter({'SymbolsHash': 425, 'BulkBasicBlockMnemonicHash': 260, 'ExactBytesFunctionHasher': 1, 'ExactInstructionsFunctionHasher': 1, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 425 "ExternalsName" : 195 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 1 "BulkBasicBlockMnemonicHash" : 260 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 425 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 1 "BulkBasicBlockMnemonicHash" : 260 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 4 "deleted_funcs_len" : 0 "modified_funcs_len" : 188 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 34 "deleted_symbols_len" : 43 ``` ## Strings *No string differences found* # Deleted # Added ## BfsProcessHardLink ### Function Meta |Key|bfs-10.0.26100.8875.sys| | :---: | :---: | |name|BfsProcessHardLink| |fullname|BfsProcessHardLink| |refcount|2| |length|1096| |called|
Expand for full list:
BfsDereferencePolicyEntryEx
BfsGetFileName
BfsGetPolicy
BfsGetPolicyEntry
BfsIsApplicableToken
BfsPolicyEntryExists
FLTMGR.SYS::FltGetDestinationFileNameInformation
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
NTOSKRNL.EXE::ExAcquireRundownProtectionNTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::PsDereferenceImpersonationToken
NTOSKRNL.EXE::PsDereferencePrimaryToken
NTOSKRNL.EXE::PsReferenceImpersonationToken
NTOSKRNL.EXE::PsReferencePrimaryToken
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsPreSetInfoOperation| |paramcount|2| |address|140004104| |sig|undefined4 __fastcall BfsProcessHardLink(longlong * param_1, longlong param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- BfsProcessHardLink +++ BfsProcessHardLink @@ -0,0 +1,176 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +undefined4 BfsProcessHardLink(longlong *param_1,longlong param_2) + +{ + short sVar1; + bool bVar2; + ulonglong uVar3; + char cVar4; + char cVar5; + byte bVar6; + int iVar7; + longlong lVar8; + undefined8 uVar9; + ulonglong uVar10; + ulonglong *puVar11; + ulonglong uVar12; + longlong lVar13; + longlong *plVar14; + short *psVar15; + undefined4 uVar16; + undefined4 uVar17; + undefined1 auStackY_f8 [32]; + undefined1 local_b8; + undefined1 local_b7; + undefined1 local_b6 [6]; + undefined8 local_b0; + short *psStack_a8; + int local_a0 [2]; + longlong *local_98; + longlong *local_90; + undefined8 *local_88; + undefined8 *local_80 [5]; + undefined8 *local_58; + undefined8 local_50; + ulonglong local_48; + + local_48 = __security_cookie ^ (ulonglong)auStackY_f8; + lVar8 = 0; + local_80[0] = (undefined8 *)0x0; + bVar2 = false; + local_b7 = 0; + local_90 = (longlong *)0x0; + uVar16 = 1; + local_b8 = 0; + local_a0[0] = 0; + local_b0 = 0; + local_98 = (longlong *)0x0; + local_88 = (undefined8 *)0x0; + if ((char)param_1[10] == '\0') { + return 1; + } + KeEnterCriticalRegion(); + cVar4 = ExAcquireRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); + uVar17 = uVar16; + if (cVar4 == '\0') goto LAB_140004474; + lVar8 = PsReferenceImpersonationToken(param_1[1],&local_b7,&local_b8,local_a0); + bVar2 = true; + if (lVar8 == 0) { + uVar9 = IoGetCurrentProcess(); + lVar8 = PsReferencePrimaryToken(uVar9); + bVar2 = false; + } + else { + uVar17 = 1; + if (local_a0[0] < 2) goto LAB_140004474; + } + cVar5 = BfsIsApplicableToken(lVar8,'\x01'); + uVar17 = uVar16; + if (cVar5 == '\0') goto LAB_140004474; + lVar13 = lVar8; + iVar7 = SeQueryInformationToken(lVar8,1,&local_88); + if ((iVar7 < 0) || + (lVar13 = lVar8, iVar7 = SeQueryInformationToken(lVar8,0x1f,local_80), iVar7 < 0)) { + if (3 < DAT_14001b000) { + local_b0 = CONCAT44(local_b0._4_4_,iVar7); + local_58 = &local_b0; + local_50 = 4; + _tlgWriteTransfer_EtwWriteTransfer(lVar13,&DAT_140018e11); + } + goto LAB_140004474; + } + bVar6 = BfsPolicyEntryExists + (*(undefined8 *)(param_2 + 8),*(undefined8 *)(param_2 + 0x18),0x14001b2d0, + (byte *)*local_88,(byte *)*local_80[0]); + if (bVar6 == 0) goto LAB_140004474; + plVar14 = *(longlong **)(param_2 + 8); + uVar10 = BfsGetPolicyEntry(plVar14,*(undefined8 *)(param_2 + 0x18),0x14001b2d0,(byte *)*local_88, + (byte *)*local_80[0],&local_b0); + uVar3 = local_b0; + iVar7 = (int)uVar10; + if (((iVar7 < 0) || + (plVar14 = param_1, iVar7 = FltGetFileNameInformation(param_1,0x101,&local_98), iVar7 < 0)) || + (plVar14 = local_98, iVar7 = FltParseFileNameInformation(), iVar7 < 0)) { +LAB_1400042dc: + if (3 < DAT_14001b000) { + local_b0 = CONCAT44(local_b0._4_4_,iVar7); + local_58 = &local_b0; + local_50 = 4; + _tlgWriteTransfer_EtwWriteTransfer(plVar14,&DAT_140018e11); + } + } + else { + plVar14 = *(longlong **)(param_2 + 0x18); + lVar13 = *(longlong *)(param_1[2] + 0x38); + iVar7 = FltGetDestinationFileNameInformation + (plVar14,*(undefined8 *)(param_1[2] + 8),*(undefined8 *)(lVar13 + 8), + lVar13 + 0x14); + if ((iVar7 < 0) || (plVar14 = local_90, iVar7 = FltParseFileNameInformation(), iVar7 < 0)) + goto LAB_1400042dc; + plVar14 = local_98; + puVar11 = (ulonglong *)BfsGetFileName((ushort *)&local_b0,(longlong)local_98); + local_b0 = *puVar11; + psStack_a8 = (short *)puVar11[1]; + uVar10 = BfsGetPolicy(*(longlong *)(uVar3 + 0x30),(ushort *)(plVar14 + 3),&local_b0,local_b6); + plVar14 = local_90; + puVar11 = (ulonglong *)BfsGetFileName((ushort *)&local_b0,(longlong)local_90); + local_b0 = *puVar11; + psStack_a8 = (short *)puVar11[1]; + if ((short)(uint)*puVar11 != 0) { + for (psVar15 = psStack_a8 + ((ulonglong)(((uint)*puVar11 & 0xffff) >> 1) - 1); + psStack_a8 < psVar15; psVar15 = psVar15 + -1) { + if (*psVar15 == 0x5c) goto LAB_14000441e; + } + if (*psVar15 == 0x5c) { +LAB_14000441e: + sVar1 = (short)((longlong)psVar15 - (longlong)psStack_a8 >> 1) * 2; + local_b0._4_4_ = (undefined4)(local_b0 >> 0x20); + local_b0._0_4_ = CONCAT22(sVar1,sVar1); + } + else { + local_b0 = (ulonglong)*(uint *)((longlong)puVar11 + 4) << 0x20; + } + } + uVar12 = BfsGetPolicy(*(longlong *)(uVar3 + 0x30),(ushort *)(plVar14 + 3),&local_b0,local_b6); + if (((int)uVar10 != 1) || ((int)uVar12 != 1)) { + *(undefined4 *)(param_1 + 3) = 0xc0000022; + param_1[4] = 0; + uVar16 = 4; + } + } + uVar17 = uVar16; + if (uVar3 != 0) { + BfsDereferencePolicyEntryEx(uVar3,'\0'); + } +LAB_140004474: + if (local_98 != (longlong *)0x0) { + FltReleaseFileNameInformation(); + } + if (local_90 != (longlong *)0x0) { + FltReleaseFileNameInformation(); + } + if (lVar8 != 0) { + if (bVar2) { + PsDereferenceImpersonationToken(); + } + else { + PsDereferencePrimaryToken(lVar8); + } + } + if (local_88 != (undefined8 *)0x0) { + ExFreePoolWithTag(local_88,0); + } + if (local_80[0] != (undefined8 *)0x0) { + ExFreePoolWithTag(local_80[0],0); + } + if (cVar4 != '\0') { + KeEnterCriticalRegion(); + ExReleaseRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); + } + return uVar17; +} + ``` ## BfsResolveReparseTarget ### Function Meta |Key|bfs-10.0.26100.8875.sys| | :---: | :---: | |name|BfsResolveReparseTarget| |fullname|BfsResolveReparseTarget| |refcount|2| |length|596| |called|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwFsControlFile
NTOSKRNL.EXE::ZwOpenFile
memcpy| |calling|BfsProcessSetPolicyRequest| |paramcount|2| |address|14000bd44| |sig|int __fastcall BfsResolveReparseTarget(undefined8 param_1, short * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- BfsResolveReparseTarget +++ BfsResolveReparseTarget @@ -0,0 +1,120 @@ + +int BfsResolveReparseTarget(undefined8 param_1,short *param_2) + +{ + int iVar1; + int *piVar2; + undefined8 *puVar3; + uint uVar4; + int *piVar5; + ushort uVar6; + int *piVar7; + int *_Src; + int *piVar8; + uint uVar9; + longlong local_res8; + undefined8 local_68; + undefined8 uStack_60; + undefined8 local_58; + undefined8 local_50; + undefined8 local_48; + undefined8 local_40; + undefined8 local_38; + undefined8 uStack_30; + + param_2[0] = 0; + param_2[1] = 0; + param_2[2] = 0; + param_2[3] = 0; + param_2[4] = 0; + param_2[5] = 0; + param_2[6] = 0; + param_2[7] = 0; + uVar9 = 0; + local_58 = 0x30; + local_res8 = 0; + local_40 = 0x600; + local_50 = 0; + local_68 = 0; + uStack_60 = 0; + local_38 = 0; + uStack_30 = 0; + local_48 = param_1; + iVar1 = ZwOpenFile(&local_res8,0x100080,&local_58,&local_68,7,0x200020); + if (iVar1 < 0) goto LAB_14000bf3e; + piVar2 = (int *)ExAllocatePool2(0x100,0x4000,0x50736642); + if (piVar2 == (int *)0x0) { + iVar1 = -0x3fffffe9; + goto LAB_14000bf3e; + } + iVar1 = ZwFsControlFile(local_res8,0,0,0,&local_68,0x900a8,0,0,piVar2,0x4000); + if (-1 < iVar1) { + if (*piVar2 == -0x7fffffe5) { + piVar5 = (int *)((ulonglong)*(ushort *)(piVar2 + 1) + 8 + (longlong)piVar2); + _Src = piVar2 + 2; + if ((*(ushort *)(piVar2 + 1) & 1) == 0) { + do { + piVar7 = _Src; + if (piVar5 <= piVar7) goto LAB_14000bf28; + uVar4 = uVar9 + 1; + if ((short)*piVar7 != 0) { + uVar4 = uVar9; + } + _Src = (int *)((longlong)piVar7 + 2); + uVar9 = uVar4; + } while (uVar4 < 3); + piVar8 = _Src; + if (_Src < piVar5) { + do { + if ((short)*piVar8 == 0) break; + piVar8 = (int *)((longlong)piVar8 + 2); + } while (piVar8 < piVar5); + uVar6 = (short)piVar8 - (short)_Src; + if (uVar6 != 0) { + if (((uVar6 < 4) || (*(short *)_Src != 0x5c)) || ((short)piVar7[1] != 0x5c)) { + puVar3 = (undefined8 *)ExAllocatePool2(0x100,uVar6 + 8,0x50736642); + *(undefined8 **)(param_2 + 4) = puVar3; + if (puVar3 == (undefined8 *)0x0) { + iVar1 = -0x3fffffe9; + } + else { + *param_2 = uVar6 + 8; + param_2[1] = uVar6 + 8; + *puVar3 = 0x5c003f003f005c; + memcpy((void *)(*(longlong *)(param_2 + 4) + 8),_Src,(ulonglong)uVar6); + iVar1 = 0; + } + goto LAB_14000bf2d; + } + goto LAB_14000be4d; + } + } + } +LAB_14000bf28: + iVar1 = -0x3fffffc7; + } + else { +LAB_14000be4d: + iVar1 = -0x3ffffd87; + } + } +LAB_14000bf2d: + ExFreePoolWithTag(piVar2,0); +LAB_14000bf3e: + if (local_res8 != 0) { + ZwClose(); + } + if ((iVar1 < 0) && (*(longlong *)(param_2 + 4) != 0)) { + ExFreePoolWithTag(*(longlong *)(param_2 + 4),0); + param_2[0] = 0; + param_2[1] = 0; + param_2[2] = 0; + param_2[3] = 0; + param_2[4] = 0; + param_2[5] = 0; + param_2[6] = 0; + param_2[7] = 0; + } + return iVar1; +} + ``` ## BfsInsertDirectoryEntry_OLD ### Function Meta |Key|bfs-10.0.26100.8875.sys| | :---: | :---: | |name|BfsInsertDirectoryEntry_OLD| |fullname|BfsInsertDirectoryEntry_OLD| |refcount|4| |length|1236| |called|
Expand for full list:
BfsAllocateBlock
BfsExpandDirectory
BfsFreeBlock
BfsWriteBlock
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlClearBitsNTOSKRNL.EXE::RtlFindClearBits
NTOSKRNL.EXE::RtlInitializeBitMap
NTOSKRNL.EXE::RtlSetBits
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memcpy
memset
| |calling|BfsAddOrModifyEntry
BfsCreateDirectory
BfsRenameEntry| |paramcount|5| |address|140014854| |sig|longlong __fastcall BfsInsertDirectoryEntry_OLD(longlong param_1, int param_2, uint param_3, undefined4 param_4, ushort * param_5)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- BfsInsertDirectoryEntry_OLD +++ BfsInsertDirectoryEntry_OLD @@ -0,0 +1,189 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +longlong BfsInsertDirectoryEntry_OLD + (longlong param_1,int param_2,uint param_3,undefined4 param_4,ushort *param_5) + +{ + longlong *plVar1; + bool bVar2; + int iVar3; + uint uVar4; + bool bVar5; + uint uVar6; + undefined4 *puVar7; + ulonglong uVar8; + undefined8 uVar9; + longlong lVar10; + longlong lVar11; + longlong *plVar12; + longlong lVar13; + undefined1 auStackY_d8 [32]; + uint local_a4; + char local_a0; + uint local_9c; + int local_98 [2]; + undefined4 local_90; + undefined4 local_8c; + undefined4 uStack_88; + longlong *local_80; + int local_78; + longlong local_70; + ushort *local_68; + uint *local_40; + undefined8 local_38; + ulonglong local_30; + + local_30 = __security_cookie ^ (ulonglong)auStackY_d8; + local_68 = param_5; + uStack_88 = 0; + local_90 = 0; + local_8c = 0; + local_a4 = param_3; + local_78 = param_2; + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(param_1,0); + local_98[0] = 0; + local_a0 = '\0'; + lVar13 = ((longlong *)**(longlong **)(param_1 + 0x10))[2]; + local_80 = (longlong *)**(longlong **)(param_1 + 0x10); + local_70 = lVar13; + do { + while( true ) { + plVar12 = local_80; + RtlInitializeBitMap(&local_90,lVar13 + 0x3e60,0x1e); + local_9c = RtlFindClearBits(&local_90,1,0); + if (local_9c != 0xffffffff) goto LAB_14001493c; + plVar1 = (longlong *)*plVar12; + if (plVar1 == (longlong *)*(longlong *)(param_1 + 0x10)) break; + lVar13 = plVar1[2]; + local_9c = 0xffffffff; + local_80 = plVar1; + local_70 = lVar13; + } + lVar10 = param_1; + uVar8 = BfsExpandDirectory(param_1,lVar13,(longlong)plVar12,&local_70,&local_80); + lVar13 = local_70; + if ((int)(uint)uVar8 < 0) { + if (3 < DAT_14001b000) { + local_40 = &local_9c; + local_38 = 4; + local_9c = (uint)uVar8; + _tlgWriteTransfer_EtwWriteTransfer(lVar10,&DAT_140018e11); + } + goto LAB_140014b7a; + } + RtlInitializeBitMap(&local_90,local_70 + 0x3e60,0x1e); + local_9c = RtlFindClearBits(&local_90,1,0); + plVar12 = local_80; + } while (local_9c == 0xffffffff); +LAB_14001493c: + lVar11 = (ulonglong)local_9c * 0x214; + lVar10 = lVar11 + lVar13; + RtlSetBits(&local_90,(ulonglong)local_9c,1); + memset((void *)(lVar13 + 0xc + lVar11),0,0x210); + iVar3 = local_78; + *(uint *)(lVar10 + 0xc) = local_a4; + *(int *)(lVar10 + 8) = local_78; + memcpy((void *)(lVar10 + 0x1c),*(void **)(local_68 + 4),(ulonglong)*local_68); + if (iVar3 == 2) { + *(undefined4 *)(lVar10 + 0x10) = param_4; + uVar9 = 0x100; + puVar7 = (undefined4 *)ExAllocatePool2(0x100,0x4000,0x62736642); + if (puVar7 == (undefined4 *)0x0) { + bVar2 = false; + if (3 < DAT_14001b000) { + local_40 = &local_a4; + local_a4 = 0xc0000017; + local_38 = 4; + _tlgWriteTransfer_EtwWriteTransfer(uVar9,&DAT_140018e11); + bVar2 = false; + } + goto LAB_140014b28; + } + plVar1 = (longlong *)(param_1 + 8); + lVar11 = *plVar1; + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(lVar11,0); + lVar11 = *plVar1; + bVar2 = true; + uVar9 = BfsAllocateBlock(lVar11,local_98); + if ((int)(uint)uVar9 < 0) { + if (3 < DAT_14001b000) { + local_40 = &local_a4; + local_38 = 4; + local_a4 = (uint)uVar9; + _tlgWriteTransfer_EtwWriteTransfer(lVar11,&DAT_140018e11); + } + goto LAB_140014b28; + } + local_a0 = '\x01'; + memset(puVar7 + 1,0,0x3ffc); + *puVar7 = 0x44736642; + *(int *)(lVar10 + 0x14) = local_98[0]; + uVar9 = BfsWriteBlock(*plVar1,local_98[0],puVar7); + local_a4 = (uint)uVar9; + ExFreePoolWithTag(); + uVar6 = local_a4; + uVar4 = local_a4; + if (-1 < (int)(uint)uVar9) { + puVar7 = (undefined4 *)*plVar1; + uVar9 = BfsWriteBlock((longlong)puVar7,0,*(undefined8 *)(puVar7 + 4)); + uVar6 = (uint)uVar9; + uVar4 = local_a4; + if (-1 < (int)(uint)uVar9) { + ExReleasePushLockExclusiveEx(*plVar1,0); + KeLeaveCriticalRegion(); + goto LAB_140014c7a; + } + } + local_a4 = uVar6; + bVar5 = bVar2; + if (3 < DAT_14001b000) { + local_40 = &local_a4; + local_38 = 4; + _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_140018e11); + uVar4 = local_a4; + } + } + else { + *(undefined4 *)(lVar10 + 0x10) = 0; +LAB_140014c7a: + lVar11 = *(longlong *)(param_1 + 8); + uVar9 = BfsWriteBlock(lVar11,(int)plVar12[3],lVar13); + if (-1 < (int)(uint)uVar9) { + ExReleasePushLockExclusiveEx(param_1,0); + KeLeaveCriticalRegion(); + return lVar10 + 8; + } + if (3 < DAT_14001b000) { + local_40 = &local_a4; + local_38 = 4; + local_a4 = (uint)uVar9; + _tlgWriteTransfer_EtwWriteTransfer(lVar11,&DAT_140018e11); + } + bVar2 = false; + puVar7 = (undefined4 *)0x0; + uVar4 = local_a4; + bVar5 = false; + if (local_a0 == '\0') goto LAB_140014b28; + } + bVar2 = bVar5; + local_a4 = uVar4; + puVar7 = (undefined4 *)0x0; + BfsFreeBlock(*(longlong *)(param_1 + 8),local_98[0]); +LAB_140014b28: + RtlClearBits(&local_90,local_9c,1); + if (puVar7 != (undefined4 *)0x0) { + ExFreePoolWithTag(puVar7,0); + } + if (bVar2) { + ExReleasePushLockExclusiveEx(*(undefined8 *)(param_1 + 8),0); + KeLeaveCriticalRegion(); + } +LAB_140014b7a: + ExReleasePushLockExclusiveEx(param_1,0); + KeLeaveCriticalRegion(); + return 0; +} + ``` ## NTOSKRNL.EXE::ZwFsControlFile ### Function Meta |Key|bfs-10.0.26100.8875.sys| | :---: | :---: | |name|ZwFsControlFile| |fullname|NTOSKRNL.EXE::ZwFsControlFile| |refcount|2| |length|0| |called|| |calling|BfsResolveReparseTarget| |paramcount|0| |address|EXTERNAL:00000023| |sig|undefined ZwFsControlFile(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::ZwFsControlFile* # Modified *Modified functions contain code changes* ## BfsPreCleanupOperation ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.38| |i_ratio|0.45| |m_ratio|0.94| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsPreCleanupOperation|BfsPreCleanupOperation| |fullname|BfsPreCleanupOperation|BfsPreCleanupOperation| |`refcount`|4|6| |`length`|825|759| |`called`|
Expand for full list:
FLTMGR.SYS::FltGetFileContext
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
Feature_2210080059__private_IsEnabledDeviceUsageNoInline
Feature_AppSiloBFSPagePoolCleanup__private_IsEnabledDeviceUsageNoInline
Feature_AppSiloSmbNoTrackDelete__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireRundownProtectionNTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
__security_check_cookie
|
Expand for full list:
FLTMGR.SYS::FltGetFileContext
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_AppSiloBFSPagePoolCleanup__private_IsEnabledDeviceUsageNoInline
Feature_AppSiloSmbNoTrackDelete__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegionNTOSKRNL.EXE::KeLeaveCriticalRegion
__security_check_cookie
| |calling||| |paramcount|3|3| |`address`|140002450|140002430| |sig|undefined8 __fastcall BfsPreCleanupOperation(longlong param_1, longlong param_2, longlong * param_3)|undefined8 __fastcall BfsPreCleanupOperation(longlong param_1, longlong param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsPreCleanupOperation Called Diff ```diff --- BfsPreCleanupOperation called +++ BfsPreCleanupOperation called @@ -5,2 +4,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline -Feature_2210080059__private_IsEnabledDeviceUsageNoInline ``` ### BfsPreCleanupOperation Diff ```diff --- BfsPreCleanupOperation +++ BfsPreCleanupOperation @@ -1,128 +1,112 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined8 BfsPreCleanupOperation(longlong param_1,longlong param_2,longlong *param_3) { ushort uVar1; longlong lVar2; char cVar3; int iVar4; ulonglong uVar5; bool bVar6; - undefined1 auStack_c8 [32]; - undefined4 local_a8; - undefined **local_a0; - int local_98; - int local_94; - longlong local_90; - longlong local_88; - undefined4 local_80; - undefined4 local_7c; - undefined8 local_78; - undefined *local_70; - uint local_68; - undefined4 local_64; + undefined1 auStack_b8 [32]; + undefined4 local_98; + undefined **local_90; + int local_88; + int local_84; + longlong local_80; + longlong local_78; + undefined4 local_70; + undefined4 local_6c; + undefined8 local_68; undefined *local_60; - undefined4 local_58; + uint local_58; undefined4 local_54; - int *local_50; - undefined8 local_48; - ulonglong local_40; + undefined *local_50; + undefined4 local_48; + undefined4 local_44; + int *local_40; + undefined8 local_38; + ulonglong local_30; - local_40 = __security_cookie ^ (ulonglong)auStack_c8; - local_90 = 0; - cVar3 = '\0'; - local_88 = 0; + local_30 = __security_cookie ^ (ulonglong)auStack_b8; + local_80 = 0; + local_78 = 0; uVar5 = Feature_AppSiloSmbNoTrackDelete__private_IsEnabledDeviceUsageNoInline(); if (((int)uVar5 != 0) && ((lVar2 = *(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 8) + 8), lVar2 == 0 || (*(int *)(lVar2 + 0x48) == 0x14)))) goto LAB_0; - uVar5 = Feature_2210080059__private_IsEnabledDeviceUsageNoInline(); - cVar3 = '\0'; - if ((int)uVar5 != 0) { - KeEnterCriticalRegion(); - cVar3 = ExAcquireRundownProtection(&gBfsRundownProtection); - uVar5 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 == 0) { - if (cVar3 == '\0') { - KeLeaveCriticalRegion(); - goto LAB_0; - } - } - else { - KeLeaveCriticalRegion(); - if (cVar3 == '\0') goto LAB_0; - } - } + KeEnterCriticalRegion(); + cVar3 = ExAcquireRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); + if (cVar3 == '\0') goto LAB_0; iVar4 = FltGetFileContext(*(undefined8 *)(param_2 + 0x18), - *(undefined8 *)(*(longlong *)(param_1 + 0x10) + 8),&local_90); + *(undefined8 *)(*(longlong *)(param_1 + 0x10) + 8),&local_80); if (-1 < iVar4) { uVar5 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar5 == 0) goto LAB_1; uVar5 = Feature_AppSiloBFSPagePoolCleanup__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar5 == 0) { - iVar4 = FltGetFileNameInformation(param_1,0x101,local_90 + 8); + iVar4 = FltGetFileNameInformation(param_1,0x101,local_80 + 8); if (-1 < iVar4) goto LAB_1; - if (DAT_2 < 4) goto LAB_14000261c; - local_50 = &local_94; - uVar1 = *(ushort *)PTR_DAT_3; - local_98 = 0x73; - local_94 = iVar4; + if (3 < DAT_2) { + local_40 = &local_84; + uVar1 = *(ushort *)PTR_DAT_3; + local_88 = 0x73; + local_84 = iVar4; +LAB_4: + local_58 = (uint)uVar1; + local_38 = 4; + local_44 = 1; + local_48 = 0x1e; + local_50 = &DAT_5; + local_54 = 2; + local_68 = 0; + local_6c = 3; + local_70 = 0xb000000; + local_90 = &local_60; + local_98 = 3; + local_60 = PTR_DAT_3; + EtwWriteTransfer(DAT_6,&local_70,0,0); + } } else { - if (*(longlong *)(local_90 + 8) != 0) { + if (*(longlong *)(local_80 + 8) != 0) { LAB_1: - *param_3 = local_90; + *param_3 = local_80; return 0; } - iVar4 = FltGetFileNameInformation(param_1,0x101,&local_88); + iVar4 = FltGetFileNameInformation(param_1,0x101,&local_78); if (-1 < iVar4) { LOCK(); - bVar6 = *(longlong *)(local_90 + 8) == 0; + bVar6 = *(longlong *)(local_80 + 8) == 0; if (bVar6) { - *(longlong *)(local_90 + 8) = local_88; + *(longlong *)(local_80 + 8) = local_78; } UNLOCK(); if (!bVar6) { - FltReleaseFileNameInformation(local_88); + FltReleaseFileNameInformation(local_78); } goto LAB_1; } - if (DAT_2 < 4) goto LAB_14000261c; - local_50 = &local_98; - uVar1 = *(ushort *)PTR_DAT_3; - local_94 = 0x73; - local_98 = iVar4; + if (3 < DAT_2) { + local_40 = &local_88; + uVar1 = *(ushort *)PTR_DAT_3; + local_84 = 0x73; + local_88 = iVar4; + goto LAB_4; + } } - local_68 = (uint)uVar1; - local_48 = 4; - local_54 = 1; - local_58 = 0x1e; - local_60 = &DAT_4; - local_64 = 2; - local_78 = 0; - local_7c = 3; - local_80 = 0xb000000; - local_a0 = &local_70; - local_a8 = 3; - local_70 = PTR_DAT_3; - EtwWriteTransfer(DAT_5,&local_80,0,0); } + KeEnterCriticalRegion(); + ExReleaseRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); LAB_0: - uVar5 = Feature_2210080059__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar5 != 0) && (cVar3 != '\0')) { - uVar5 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 != 0) { - KeEnterCriticalRegion(); - } - ExReleaseRundownProtection(&gBfsRundownProtection); - KeLeaveCriticalRegion(); - } uVar5 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar5 != 0) && (local_90 != 0)) { + if (((int)uVar5 != 0) && (local_80 != 0)) { FltReleaseContext(); } return 1; } ``` ## BfsRegistryPreCreateCallback ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.12| |i_ratio|0.16| |m_ratio|0.92| |b_ratio|0.5| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsRegistryPreCreateCallback|BfsRegistryPreCreateCallback| |fullname|BfsRegistryPreCreateCallback|BfsRegistryPreCreateCallback| |refcount|2|2| |`length`|1317|1149| |`called`|
Expand for full list:
BfsGetRegistryPrefix
BfsGetRegistryPrefixEx
BfsQueueIoWorkItemAndWait
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
Feature_1777540409__private_IsEnabledDeviceUsageNoInline
Feature_2470751545__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExAllocatePool2NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlPrefixUnicodeString
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsGetRegistryPrefix
BfsQueueIoWorkItemAndWait
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegionNTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlPrefixUnicodeString
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsRegistryCallback|BfsRegistryCallback| |paramcount|3|3| |`address`|140010fc8|140011310| |`sig`|ulonglong __fastcall BfsRegistryPreCreateCallback(undefined4 param_1, undefined8 * param_2, undefined8 * * param_3)|ulonglong __fastcall BfsRegistryPreCreateCallback(undefined4 param_1, undefined8 * param_2, ushort * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsRegistryPreCreateCallback Called Diff ```diff --- BfsRegistryPreCreateCallback called +++ BfsRegistryPreCreateCallback called @@ -2 +1,0 @@ -BfsGetRegistryPrefixEx @@ -4,3 +2,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline -Feature_1777540409__private_IsEnabledDeviceUsageNoInline -Feature_2470751545__private_IsEnabledDeviceUsageNoInline ``` ### BfsRegistryPreCreateCallback Diff ```diff --- BfsRegistryPreCreateCallback +++ BfsRegistryPreCreateCallback @@ -1,239 +1,201 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -ulonglong BfsRegistryPreCreateCallback(undefined4 param_1,undefined8 *param_2,undefined8 **param_3) +ulonglong BfsRegistryPreCreateCallback(undefined4 param_1,undefined8 *param_2,ushort *param_3) { - char cVar1; - uint uVar2; - uint uVar3; - ulonglong uVar4; - undefined4 *puVar5; - undefined8 **ppuVar6; - undefined4 *puVar7; + uint uVar1; + char cVar2; + char cVar3; + int iVar4; + int iVar5; + uint uVar6; + ulonglong uVar7; undefined4 *puVar8; - int iVar9; - ulonglong local_res18; + ushort *puVar9; + undefined8 **ppuVar10; + undefined4 *puVar11; + ulonglong unaff_R12; undefined1 auStack_f8 [40]; undefined1 *local_d0; - char local_c8; + int local_c8; int local_c4; - uint local_c0 [2]; - undefined8 local_b8; - undefined8 uStack_b0; - undefined8 local_a8; - undefined8 uStack_a0; - undefined8 *local_98; - undefined8 **ppuStack_90; - longlong local_88; + undefined8 local_c0; + undefined8 uStack_b8; + undefined8 *local_b0; + ushort *puStack_a8; + longlong local_a0; + undefined8 uStack_98; + undefined8 local_90; + undefined8 local_88; undefined8 uStack_80; - undefined8 local_78; - undefined1 local_70 [32]; - uint *local_50; - undefined4 local_48; - undefined4 local_44; - ulonglong local_40; + undefined1 local_78 [32]; + int *local_58; + undefined4 local_50; + undefined4 local_4c; + ulonglong local_48; - local_40 = __security_cookie ^ (ulonglong)auStack_f8; - local_78 = 0; - local_c8 = '\0'; - local_98 = (undefined8 *)0x0; - ppuStack_90 = (undefined8 **)0x0; - puVar5 = (undefined4 *)0x0; - puVar7 = (undefined4 *)0x0; + local_48 = __security_cookie ^ (ulonglong)auStack_f8; + local_90 = 0; + local_b0 = (undefined8 *)0x0; + puStack_a8 = (ushort *)0x0; + puVar8 = (undefined4 *)0x0; + puVar11 = (undefined4 *)0x0; + local_a0 = 0; + uStack_98 = 0; + local_c0 = 0; + uStack_b8 = 0; local_88 = 0; uStack_80 = 0; - local_b8 = 0; - uStack_b0 = 0; - local_a8 = 0; - uStack_a0 = 0; - RtlInitUnicodeString(&local_b8,L"\\Registry\\WC\\Silo"); - cVar1 = RtlPrefixUnicodeString(&local_b8,*param_2,1); - if (cVar1 == '\0') { - return local_res18; - } - uVar4 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - puVar8 = puVar5; - if ((int)uVar4 != 0) { + RtlInitUnicodeString(&local_c0,L"\\Registry\\WC\\Silo"); + cVar2 = RtlPrefixUnicodeString(&local_c0,*param_2,1); + if (cVar2 == '\0') { + return unaff_R12; + } + KeEnterCriticalRegion(); + cVar2 = ExAcquireRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); + iVar4 = local_c4; + if (cVar2 == '\0') goto LAB_0; + KeEnterCriticalRegion(); + ExAcquirePushLockSharedEx(&gBfsPolicyTable,0); + local_c8 = 1; + puVar9 = param_3; + uVar7 = BfsGetRegistryPrefix(param_3,&local_c0,&local_88,&local_c8); + iVar4 = (int)uVar7; + if (iVar4 < 0) { + if (iVar4 == -0x3ffffdd3) { + if (local_c8 == 1) { + ExReleasePushLockSharedEx(&gBfsPolicyTable,0); + KeLeaveCriticalRegion(); + } + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(&gBfsPolicyTable,0); + local_c8 = 2; + puVar9 = param_3; + uVar7 = BfsGetRegistryPrefix(param_3,&local_c0,&local_88,&local_c8); + iVar4 = (int)uVar7; + if (-1 < iVar4) goto LAB_1; + } + iVar5 = local_c8; + if (3 < DAT_2) { + local_4c = 0; + local_58 = &local_c4; + local_d0 = local_78; + local_50 = 4; + local_c4 = iVar4; + _tlgWriteTransfer_EtwWriteTransfer(puVar9,&DAT_3); + iVar5 = local_c8; + } +LAB_4: + if (iVar5 == 1) { + ExReleasePushLockSharedEx(&gBfsPolicyTable,0); + } + else { + iVar4 = local_c4; + if (iVar5 != 2) goto LAB_0; + ExReleasePushLockExclusiveEx(&gBfsPolicyTable,0); + } + KeLeaveCriticalRegion(); + iVar4 = local_c4; + } + else { +LAB_1: + cVar3 = RtlPrefixUnicodeString(&local_c0,*param_2,1); + if ((cVar3 == '\0') && (cVar3 = RtlPrefixUnicodeString(&local_88,*param_2,1), cVar3 == '\0')) { + if (local_c8 == 1) { + ExReleasePushLockSharedEx(&gBfsPolicyTable,0); +LAB_5: + KeLeaveCriticalRegion(); + } + else if (local_c8 == 2) { + ExReleasePushLockExclusiveEx(&gBfsPolicyTable,0); + goto LAB_5; + } + uVar7 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); + iVar4 = local_c4; + if ((int)uVar7 == 0) { + return unaff_R12; + } + goto LAB_0; + } + if (local_c8 == 1) { + ExReleasePushLockSharedEx(&gBfsPolicyTable,0); +LAB_6: + KeLeaveCriticalRegion(); + } + else if (local_c8 == 2) { + ExReleasePushLockExclusiveEx(&gBfsPolicyTable,0); + goto LAB_6; + } + ppuVar10 = &local_b0; + local_90 = CONCAT44(local_90._4_4_,param_1); + local_b0 = param_2; + puStack_a8 = param_3; + iVar5 = BfsQueueIoWorkItemAndWait(ppuVar10); + iVar4 = local_c4; + if (-1 < iVar5) { + uVar1 = uStack_98._4_4_; + puVar8 = puVar11; + if ((uint)uStack_98 == 0) { + if (uStack_98._4_4_ == 0) goto LAB_0; + ppuVar10 = (undefined8 **)0x100; + puVar8 = (undefined4 *)ExAllocatePool2(0x100,0x18,0x4f506642); + if (puVar8 != (undefined4 *)0x0) { + *puVar8 = 2; + puVar8[1] = uVar1; + puVar8[2] = uVar1; + puVar8[3] = *(undefined4 *)(param_2 + 3); + *(longlong *)(puVar8 + 4) = local_a0; + param_2[10] = puVar8; + iVar4 = local_c4; + goto LAB_0; + } + } + else { + if (((((uint)uStack_98 == uStack_98._4_4_) || ((uint)uStack_98 == 0)) || + ((*(uint *)(param_2 + 7) & 0x2020006) == 0)) || ((uStack_98 & 0x2000600000000) == 0)) + goto LAB_0; + ppuVar10 = (undefined8 **)0x100; + puVar8 = (undefined4 *)ExAllocatePool2(0x100,0x18,0x4f506642); + if (puVar8 != (undefined4 *)0x0) { + *puVar8 = 1; + uVar6 = uVar1; + if ((*(uint *)(param_2 + 7) >> 0x19 & 1) == 0) { + uVar6 = *(uint *)(param_2 + 7) & uVar1; + } + puVar8[1] = uVar6; + puVar8[2] = uVar1; + puVar8[3] = *(undefined4 *)(param_2 + 3); + *(longlong *)(puVar8 + 4) = local_a0; + param_2[10] = puVar8; + iVar5 = 0; + goto LAB_4; + } + } + iVar5 = -0x3fffffe9; + iVar4 = local_c4; + } + local_c4 = iVar5; + if (3 < DAT_2) { + local_4c = 0; + local_58 = &local_c4; + local_50 = 4; + local_d0 = local_78; + _tlgWriteTransfer_EtwWriteTransfer(ppuVar10,&DAT_3); + iVar4 = local_c4; + } + } +LAB_0: + local_c4 = iVar4; + if ((local_a0 != 0) && (puVar8 == (undefined4 *)0x0)) { + ObfDereferenceObject(); + } + if ((cVar2 != '\0') && (puVar8 == (undefined4 *)0x0)) { KeEnterCriticalRegion(); - cVar1 = ExAcquireRundownProtection(&gBfsRundownProtection); - local_c8 = cVar1; - uVar4 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar4 == 0) { - if (cVar1 != '\0') goto LAB_0; - KeLeaveCriticalRegion(); - puVar8 = puVar7; - iVar9 = 0; - } - else { - KeLeaveCriticalRegion(); -LAB_0: - iVar9 = 0; - local_c8 = cVar1; - if (cVar1 != '\0') goto LAB_1; - } - goto LAB_2; - } -LAB_1: - uVar4 = Feature_2470751545__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar4 != 0) { - KeEnterCriticalRegion(); - ExAcquirePushLockSharedEx(&gBfsPolicyTable,0); - local_c4 = 1; - ppuVar6 = param_3; - uVar4 = BfsGetRegistryPrefix((ushort *)param_3,&local_b8,&local_a8,&local_c4); - uVar2 = (uint)uVar4; - if ((int)uVar2 < 0) { - if (uVar2 == 0xc000022d) { - uVar4 = Feature_1777540409__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar4 == 0) || (local_c4 == 1)) { - ExReleasePushLockSharedEx(&gBfsPolicyTable,0); - KeLeaveCriticalRegion(); - } - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(&gBfsPolicyTable,0); - local_c4 = 2; - ppuVar6 = param_3; - uVar4 = BfsGetRegistryPrefix((ushort *)param_3,&local_b8,&local_a8,&local_c4); - uVar2 = (uint)uVar4; - if (-1 < (int)uVar2) goto LAB_3; - } - iVar9 = local_c4; - if (3 < DAT_4) { - local_44 = 0; - local_50 = local_c0; - local_d0 = local_70; - local_48 = 4; - local_c0[0] = uVar2; - _tlgWriteTransfer_EtwWriteTransfer(ppuVar6,&DAT_5); - iVar9 = local_c4; - } - goto LAB_2; - } -LAB_3: - cVar1 = RtlPrefixUnicodeString(&local_b8,*param_2,1); - if ((cVar1 != '\0') || (cVar1 = RtlPrefixUnicodeString(&local_a8,*param_2,1), cVar1 != '\0')) { - if (local_c4 == 1) { - ExReleasePushLockSharedEx(&gBfsPolicyTable,0); - } - else { - if (local_c4 != 2) goto LAB_6; - ExReleasePushLockExclusiveEx(&gBfsPolicyTable,0); - } - KeLeaveCriticalRegion(); - goto LAB_6; - } - if (local_c4 == 1) { - ExReleasePushLockSharedEx(&gBfsPolicyTable,0); -LAB_7: - KeLeaveCriticalRegion(); - } - else if (local_c4 == 2) { - ExReleasePushLockExclusiveEx(&gBfsPolicyTable,0); - goto LAB_7; - } - uVar4 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar4 == 0) { - return local_res18; - } - iVar9 = 0; - goto LAB_2; - } - ppuVar6 = param_3; - uVar2 = BfsGetRegistryPrefixEx((ushort *)param_3,&local_b8,&local_a8); - if ((int)uVar2 < 0) { -LAB_8: - puVar8 = puVar7; - iVar9 = 0; - if (3 < DAT_4) { -LAB_9: - local_44 = 0; - local_50 = local_c0; - local_48 = 4; - local_d0 = local_70; - local_c0[0] = uVar2; - _tlgWriteTransfer_EtwWriteTransfer(ppuVar6,&DAT_5); - puVar8 = puVar5; - iVar9 = 0; - } - } - else { - cVar1 = RtlPrefixUnicodeString(&local_b8,*param_2,1); - if ((cVar1 == '\0') && (cVar1 = RtlPrefixUnicodeString(&local_a8,*param_2,1), cVar1 == '\0')) { - return local_res18; - } -LAB_6: - iVar9 = 0; - ppuVar6 = &local_98; - local_78 = CONCAT44(local_78._4_4_,param_1); - local_98 = param_2; - ppuStack_90 = param_3; - uVar2 = BfsQueueIoWorkItemAndWait(ppuVar6); - if ((int)uVar2 < 0) goto LAB_8; - uVar2 = uStack_80._4_4_; - if ((uint)uStack_80 != 0) { - puVar8 = puVar7; - if (((((uint)uStack_80 == uStack_80._4_4_) || ((uint)uStack_80 == 0)) || - ((*(uint *)(param_2 + 7) & 0x2020006) == 0)) || ((uStack_80 & 0x2000600000000) == 0)) - goto LAB_2; - ppuVar6 = (undefined8 **)0x100; - puVar5 = (undefined4 *)ExAllocatePool2(0x100,0x18,0x4f506642); - if (puVar5 != (undefined4 *)0x0) { - *puVar5 = 1; - uVar3 = uVar2; - if ((*(uint *)(param_2 + 7) >> 0x19 & 1) == 0) { - uVar3 = *(uint *)(param_2 + 7) & uVar2; - } - puVar5[1] = uVar3; - puVar5[2] = uVar2; - goto LAB_10; - } -LAB_11: - uVar2 = 0xc0000017; - puVar8 = puVar5; - if (DAT_4 < 4) goto LAB_140011411; - goto LAB_9; - } - puVar8 = puVar7; - if (uStack_80._4_4_ != 0) { - ppuVar6 = (undefined8 **)0x100; - puVar5 = (undefined4 *)ExAllocatePool2(0x100,0x18,0x4f506642); - if (puVar5 == (undefined4 *)0x0) goto LAB_11; - *puVar5 = 2; - puVar5[1] = uVar2; - puVar5[2] = uVar2; -LAB_10: - puVar5[3] = *(undefined4 *)(param_2 + 3); - *(longlong *)(puVar5 + 4) = local_88; - param_2[10] = puVar5; - puVar8 = puVar5; - } - } -LAB_2: - uVar4 = Feature_2470751545__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar4 != 0) { - if (iVar9 == 1) { - ExReleasePushLockSharedEx(&gBfsPolicyTable,0); - } - else { - if (iVar9 != 2) goto LAB_12; - ExReleasePushLockExclusiveEx(&gBfsPolicyTable,0); - } - KeLeaveCriticalRegion(); - } -LAB_12: - if ((local_88 != 0) && (puVar8 == (undefined4 *)0x0)) { - ObfDereferenceObject(); - } - uVar4 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((((int)uVar4 != 0) && (local_c8 != '\0')) && (puVar8 == (undefined4 *)0x0)) { - uVar4 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar4 != 0) { - KeEnterCriticalRegion(); - } ExReleaseRundownProtection(&gBfsRundownProtection); KeLeaveCriticalRegion(); } - return local_res18; + return unaff_R12; } ``` ## BfsProcessDelete ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.39| |i_ratio|0.43| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsProcessDelete|BfsProcessDelete| |fullname|BfsProcessDelete|BfsProcessDelete| |refcount|3|3| |`length`|434|425| |`called`|BfsGetGlobalFileEntry
Feature_3499588921__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion|BfsGetGlobalFileEntry
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion| |calling|BfsPostCleanupOperation|BfsPostCleanupOperation| |paramcount|1|1| |`address`|14000eaa0|14000f100| |sig|undefined8 __fastcall BfsProcessDelete(ushort * param_1)|undefined8 __fastcall BfsProcessDelete(ushort * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsProcessDelete Called Diff ```diff --- BfsProcessDelete called +++ BfsProcessDelete called @@ -2 +1,0 @@ -Feature_3499588921__private_IsEnabledDeviceUsageNoInline ``` ### BfsProcessDelete Diff ```diff --- BfsProcessDelete +++ BfsProcessDelete @@ -1,88 +1,86 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ undefined8 BfsProcessDelete(ushort *param_1) { - longlong *plVar1; - longlong *plVar2; - code *pcVar3; - ulonglong uVar4; - longlong lVar5; + longlong lVar1; + code *pcVar2; + ulonglong uVar3; + longlong lVar4; + longlong *plVar5; undefined8 *puVar6; - undefined8 *puVar7; + undefined1 *puVar7; undefined1 *puVar8; - undefined1 *puVar9; undefined1 auStack_28 [8]; undefined1 auStack_20 [24]; + puVar7 = auStack_28; puVar8 = auStack_28; - puVar9 = auStack_28; - uVar4 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar4 == 0) { + uVar3 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 == 0) { return 0; } KeEnterCriticalRegion(); ExAcquirePushLockSharedEx(&gBfsGlobalFileTable,0); - lVar5 = BfsGetGlobalFileEntry(0x14001b1e0,param_1); - if (lVar5 == 0) { + lVar4 = BfsGetGlobalFileEntry(0x14001b200,param_1); + if (lVar4 == 0) { ExReleasePushLockSharedEx(&gBfsGlobalFileTable,0); goto LAB_0; } ExReleasePushLockSharedEx(); KeLeaveCriticalRegion(); KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(&DAT_1,0); KeEnterCriticalRegion(); ExAcquirePushLockSharedEx(&gBfsGlobalFileTable,0); - puVar6 = (undefined8 *)BfsGetGlobalFileEntry(0x14001b1e0,param_1); - puVar9 = auStack_28; - if (puVar6 != (undefined8 *)0x0) { - uVar4 = Feature_3499588921__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar4 == 0) || (*(char *)(puVar6 + 5) != '\x01')) { -LAB_2: - *(undefined1 *)(puVar6 + 5) = 1; - puVar7 = &DAT_3; - puVar6[6] = DAT_4; - puVar6[7] = _DAT_5; - puVar6 = puVar6 + 3; - if ((undefined8 *)*DAT_7 != &DAT_14001b210) goto LAB_14000ebe2; + lVar4 = BfsGetGlobalFileEntry(0x14001b200,param_1); + puVar8 = auStack_28; + if (lVar4 != 0) { + if (*(char *)(lVar4 + 0x28) == '\x01') { + *(undefined1 *)(lVar4 + 0x28) = 0; + plVar5 = (longlong *)(lVar4 + 0x18); + lVar1 = *plVar5; + if ((*(longlong **)(lVar1 + 8) == plVar5) && + (param_1 = *(ushort **)(lVar4 + 0x20), *(longlong **)param_1 == plVar5)) { + *(longlong *)param_1 = lVar1; + *(ushort **)(lVar1 + 8) = param_1; + *plVar5 = 0; + *(undefined8 *)(lVar4 + 0x20) = 0; + *(undefined8 *)(lVar4 + 0x30) = 0; + *(undefined8 *)(lVar4 + 0x38) = 0; + goto LAB_2; + } +LAB_3: + puVar6 = (undefined8 *)0x3; + pcVar2 = (code *)swi(0x29); + DAT_4 = (undefined8 *)(*pcVar2)(); + puVar7 = auStack_20; } else { - plVar1 = puVar6 + 3; - *(undefined1 *)(puVar6 + 5) = 0; - lVar5 = *plVar1; - if ((*(longlong **)(lVar5 + 8) == plVar1) && - (plVar2 = (longlong *)puVar6[4], (longlong *)*plVar2 == plVar1)) { - *plVar2 = lVar5; - *(longlong **)(lVar5 + 8) = plVar2; - *plVar1 = 0; - puVar6[4] = 0; - puVar6[6] = 0; - puVar6[7] = 0; - goto LAB_2; - } -LAB_6: - puVar7 = (undefined8 *)0x3; - pcVar3 = (code *)swi(0x29); - DAT_7 = (undefined8 *)(*pcVar3)(); - puVar8 = auStack_20; +LAB_2: + *(undefined1 *)(lVar4 + 0x28) = 1; + param_1 = (ushort *)&DAT_5; + *(undefined8 *)(lVar4 + 0x30) = DAT_6; + *(undefined8 *)(lVar4 + 0x38) = _DAT_7; + puVar6 = (undefined8 *)(lVar4 + 0x18); + if ((undefined8 *)*DAT_4 != &DAT_14001b230) goto LAB_14000f239; } - *puVar6 = puVar7; - puVar6[1] = DAT_7; - *DAT_7 = puVar6; - puVar9 = puVar8; - DAT_7 = puVar6; + *puVar6 = param_1; + puVar6[1] = DAT_4; + *DAT_4 = puVar6; + puVar8 = puVar7; + DAT_4 = puVar6; } - *(undefined8 *)(puVar9 + -8) = 0x14000ec0a; + *(undefined8 *)(puVar8 + -8) = 0x14000f261; ExReleasePushLockSharedEx(&gBfsGlobalFileTable,0); - *(undefined8 *)(puVar9 + -8) = 0x14000ec16; + *(undefined8 *)(puVar8 + -8) = 0x14000f26d; KeLeaveCriticalRegion(); - *(undefined8 *)(puVar9 + -8) = 0x14000ec2b; + *(undefined8 *)(puVar8 + -8) = 0x14000f282; ExReleasePushLockExclusiveEx(&DAT_1,0); LAB_0: - *(undefined8 *)(puVar9 + -8) = 0x14000ec45; + *(undefined8 *)(puVar8 + -8) = 0x14000f29c; KeLeaveCriticalRegion(); return 0; } ``` ## BfsInsertDirectoryEntry ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.78| |i_ratio|0.33| |m_ratio|0.99| |b_ratio|0.85| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsInsertDirectoryEntry|BfsInsertDirectoryEntry| |fullname|BfsInsertDirectoryEntry|BfsInsertDirectoryEntry| |refcount|4|4| |`length`|1236|1249| |`called`|
Expand for full list:
BfsAllocateBlock
BfsExpandDirectory
BfsFreeBlock
BfsWriteBlock
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlClearBitsNTOSKRNL.EXE::RtlFindClearBits
NTOSKRNL.EXE::RtlInitializeBitMap
NTOSKRNL.EXE::RtlSetBits
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memmove
memset
|
Expand for full list:
BfsAllocateBlock
BfsExpandDirectory
BfsFreeBlock
BfsWriteBlock
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlClearBitsNTOSKRNL.EXE::RtlFindClearBits
NTOSKRNL.EXE::RtlInitializeBitMap
NTOSKRNL.EXE::RtlSetBits
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memcpy
memset
| |calling|BfsAddOrModifyEntry
BfsCreateDirectory
BfsRenameEntry|BfsAddOrModifyEntry
BfsCreateDirectory
BfsRenameEntry| |paramcount|5|6| |`address`|140014220|14001436c| |`sig`|longlong __fastcall BfsInsertDirectoryEntry(longlong param_1, int param_2, uint param_3, undefined4 param_4, ushort * param_5)|longlong __fastcall BfsInsertDirectoryEntry(longlong param_1, int param_2, uint param_3, undefined4 param_4, int param_5, ushort * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsInsertDirectoryEntry Called Diff ```diff --- BfsInsertDirectoryEntry called +++ BfsInsertDirectoryEntry called @@ -17 +17 @@ -memmove +memcpy ``` ### BfsInsertDirectoryEntry Diff ```diff --- BfsInsertDirectoryEntry +++ BfsInsertDirectoryEntry @@ -1,189 +1,194 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ longlong BfsInsertDirectoryEntry - (longlong param_1,int param_2,uint param_3,undefined4 param_4,ushort *param_5) + (longlong param_1,int param_2,uint param_3,undefined4 param_4,int param_5, + ushort *param_6) { longlong *plVar1; bool bVar2; - int iVar3; - uint uVar4; - bool bVar5; + bool bVar3; + int iVar4; + uint uVar5; uint uVar6; - undefined4 *puVar7; - ulonglong uVar8; + ulonglong uVar7; + undefined4 *puVar8; undefined8 uVar9; longlong lVar10; longlong lVar11; longlong *plVar12; longlong lVar13; undefined1 auStackY_d8 [32]; uint local_a4; char local_a0; uint local_9c; int local_98 [2]; undefined4 local_90; undefined4 local_8c; undefined4 uStack_88; longlong *local_80; int local_78; longlong local_70; ushort *local_68; uint *local_40; undefined8 local_38; ulonglong local_30; local_30 = __security_cookie ^ (ulonglong)auStackY_d8; - local_68 = param_5; + local_68 = param_6; uStack_88 = 0; local_90 = 0; local_8c = 0; local_a4 = param_3; local_78 = param_2; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_1,0); local_98[0] = 0; local_a0 = '\0'; lVar13 = ((longlong *)**(longlong **)(param_1 + 0x10))[2]; local_80 = (longlong *)**(longlong **)(param_1 + 0x10); local_70 = lVar13; do { while( true ) { plVar12 = local_80; RtlInitializeBitMap(&local_90,lVar13 + 0x3e60,0x1e); local_9c = RtlFindClearBits(&local_90,1,0); if (local_9c != 0xffffffff) goto LAB_0; plVar1 = (longlong *)*plVar12; if (plVar1 == (longlong *)*(longlong *)(param_1 + 0x10)) break; lVar13 = plVar1[2]; local_9c = 0xffffffff; local_80 = plVar1; local_70 = lVar13; } lVar10 = param_1; - uVar8 = BfsExpandDirectory(param_1,lVar13,(longlong)plVar12,&local_70,&local_80); + uVar7 = BfsExpandDirectory(param_1,lVar13,(longlong)plVar12,&local_70,&local_80); lVar13 = local_70; - if ((int)(uint)uVar8 < 0) { + if ((int)(uint)uVar7 < 0) { if (3 < DAT_1) { local_40 = &local_9c; local_38 = 4; - local_9c = (uint)uVar8; + local_9c = (uint)uVar7; _tlgWriteTransfer_EtwWriteTransfer(lVar10,&DAT_2); } goto LAB_3; } RtlInitializeBitMap(&local_90,local_70 + 0x3e60,0x1e); local_9c = RtlFindClearBits(&local_90,1,0); plVar12 = local_80; } while (local_9c == 0xffffffff); LAB_0: lVar11 = (ulonglong)local_9c * 0x214; lVar10 = lVar11 + lVar13; RtlSetBits(&local_90,(ulonglong)local_9c,1); memset((void *)(lVar13 + 0xc + lVar11),0,0x210); - iVar3 = local_78; + iVar4 = local_78; *(uint *)(lVar10 + 0xc) = local_a4; *(int *)(lVar10 + 8) = local_78; - memmove((void *)(lVar10 + 0x1c),*(void **)(local_68 + 4),(ulonglong)*local_68); - if (iVar3 == 2) { + memcpy((void *)(lVar10 + 0x1c),*(void **)(local_68 + 4),(ulonglong)*local_68); + if (iVar4 == 2) { *(undefined4 *)(lVar10 + 0x10) = param_4; + if (param_5 != 0) { + *(int *)(lVar10 + 0x14) = param_5; + goto LAB_4; + } uVar9 = 0x100; - puVar7 = (undefined4 *)ExAllocatePool2(0x100,0x4000,0x62736642); - if (puVar7 == (undefined4 *)0x0) { + puVar8 = (undefined4 *)ExAllocatePool2(0x100,0x4000,0x62736642); + if (puVar8 == (undefined4 *)0x0) { bVar2 = false; if (3 < DAT_1) { local_40 = &local_a4; local_a4 = 0xc0000017; local_38 = 4; _tlgWriteTransfer_EtwWriteTransfer(uVar9,&DAT_2); bVar2 = false; } - goto LAB_4; + goto LAB_5; } plVar1 = (longlong *)(param_1 + 8); lVar11 = *plVar1; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(lVar11,0); lVar11 = *plVar1; bVar2 = true; uVar9 = BfsAllocateBlock(lVar11,local_98); if ((int)(uint)uVar9 < 0) { if (3 < DAT_1) { local_40 = &local_a4; local_38 = 4; local_a4 = (uint)uVar9; _tlgWriteTransfer_EtwWriteTransfer(lVar11,&DAT_2); } - goto LAB_4; + goto LAB_5; } local_a0 = '\x01'; - memset(puVar7 + 1,0,0x3ffc); - *puVar7 = 0x44736642; + memset(puVar8 + 1,0,0x3ffc); + *puVar8 = 0x44736642; *(int *)(lVar10 + 0x14) = local_98[0]; - uVar9 = BfsWriteBlock(*plVar1,local_98[0],puVar7); + uVar9 = BfsWriteBlock(*plVar1,local_98[0],puVar8); local_a4 = (uint)uVar9; ExFreePoolWithTag(); uVar6 = local_a4; - uVar4 = local_a4; + uVar5 = local_a4; if (-1 < (int)(uint)uVar9) { - puVar7 = (undefined4 *)*plVar1; - uVar9 = BfsWriteBlock((longlong)puVar7,0,*(undefined8 *)(puVar7 + 4)); + puVar8 = (undefined4 *)*plVar1; + uVar9 = BfsWriteBlock((longlong)puVar8,0,*(undefined8 *)(puVar8 + 4)); uVar6 = (uint)uVar9; - uVar4 = local_a4; + uVar5 = local_a4; if (-1 < (int)(uint)uVar9) { ExReleasePushLockExclusiveEx(*plVar1,0); KeLeaveCriticalRegion(); - goto LAB_5; + goto LAB_4; } } local_a4 = uVar6; - bVar5 = bVar2; + bVar3 = bVar2; if (3 < DAT_1) { local_40 = &local_a4; local_38 = 4; - _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_2); - uVar4 = local_a4; + _tlgWriteTransfer_EtwWriteTransfer(puVar8,&DAT_2); + uVar5 = local_a4; } } else { *(undefined4 *)(lVar10 + 0x10) = 0; -LAB_5: +LAB_4: lVar11 = *(longlong *)(param_1 + 8); uVar9 = BfsWriteBlock(lVar11,(int)plVar12[3],lVar13); if (-1 < (int)(uint)uVar9) { ExReleasePushLockExclusiveEx(param_1,0); KeLeaveCriticalRegion(); return lVar10 + 8; } if (3 < DAT_1) { local_40 = &local_a4; local_38 = 4; local_a4 = (uint)uVar9; _tlgWriteTransfer_EtwWriteTransfer(lVar11,&DAT_2); } + puVar8 = (undefined4 *)0x0; + uVar5 = local_a4; bVar2 = false; - puVar7 = (undefined4 *)0x0; - uVar4 = local_a4; - bVar5 = false; - if (local_a0 == '\0') goto LAB_4; + bVar3 = false; + if (local_a0 == '\0') goto LAB_5; } - bVar2 = bVar5; - local_a4 = uVar4; - puVar7 = (undefined4 *)0x0; + local_a4 = uVar5; + puVar8 = (undefined4 *)0x0; BfsFreeBlock(*(longlong *)(param_1 + 8),local_98[0]); -LAB_4: + bVar2 = bVar3; +LAB_5: RtlClearBits(&local_90,local_9c,1); - if (puVar7 != (undefined4 *)0x0) { - ExFreePoolWithTag(puVar7,0); + if (puVar8 != (undefined4 *)0x0) { + ExFreePoolWithTag(puVar8,0); } if (bVar2) { ExReleasePushLockExclusiveEx(*(undefined8 *)(param_1 + 8),0); KeLeaveCriticalRegion(); } LAB_3: ExReleasePushLockExclusiveEx(param_1,0); KeLeaveCriticalRegion(); return 0; } ``` ## BfsCheckAndReleaseIdlePolicy ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.22| |i_ratio|0.55| |m_ratio|0.84| |b_ratio|0.72| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsCheckAndReleaseIdlePolicy|BfsCheckAndReleaseIdlePolicy| |fullname|BfsCheckAndReleaseIdlePolicy|BfsCheckAndReleaseIdlePolicy| |refcount|2|2| |`length`|560|390| |`called`|
Expand for full list:
BfsDereferencePolicyEntryEx
Feature_3434922298__private_IsEnabledDeviceUsageNoInline
Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExCancelTimer
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeWaitForSingleObject
|BfsDereferencePolicyEntryEx
Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExCancelTimer
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeWaitForSingleObject| |calling|BfsIdleCheckWorkitemRoutine|BfsIdleCheckWorkitemRoutine| |paramcount|1|1| |`address`|1400062a4|140006510| |sig|undefined __fastcall BfsCheckAndReleaseIdlePolicy(longlong param_1)|undefined __fastcall BfsCheckAndReleaseIdlePolicy(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsCheckAndReleaseIdlePolicy Called Diff ```diff --- BfsCheckAndReleaseIdlePolicy called +++ BfsCheckAndReleaseIdlePolicy called @@ -2 +1,0 @@ -Feature_3434922298__private_IsEnabledDeviceUsageNoInline @@ -5 +3,0 @@ -NTOSKRNL.EXE::ExAcquirePushLockSharedEx @@ -8 +5,0 @@ -NTOSKRNL.EXE::ExReleasePushLockSharedEx ``` ### BfsCheckAndReleaseIdlePolicy Diff ```diff --- BfsCheckAndReleaseIdlePolicy +++ BfsCheckAndReleaseIdlePolicy @@ -1,129 +1,87 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void BfsCheckAndReleaseIdlePolicy(longlong param_1) { - undefined8 ****ppppuVar1; - undefined8 ****ppppuVar2; - undefined8 uVar3; - code *pcVar4; - int iVar5; - ulonglong uVar6; - undefined8 ****ppppuVar7; - undefined1 *puVar8; - longlong lVar9; + undefined8 *puVar1; + int *piVar2; + longlong ***ppplVar3; + longlong ***ppplVar4; + code *pcVar5; + int iVar6; + ulonglong uVar7; + undefined8 *puVar8; + longlong ***ppplVar9; + longlong lVar10; undefined8 local_res8; - undefined1 auStack_58 [8]; - undefined1 auStack_50 [24]; - undefined8 *local_38; - undefined8 ***local_28; - undefined8 ***local_20; + longlong **local_28; + longlong **local_20; - puVar8 = auStack_58; - local_20 = &local_28; - lVar9 = _DAT_0 + -3000000000; - local_28 = &local_28; - uVar6 = Feature_3434922298__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar6 == 0) { - KeEnterCriticalRegion(); - ExAcquirePushLockSharedEx(param_1,0); - } - else { - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_1,0); - } - ppppuVar1 = (undefined8 ****)(param_1 + 0x10); - ppppuVar7 = (undefined8 ****)*ppppuVar1; + local_20 = (longlong **)&local_28; + lVar10 = _DAT_0 + -3000000000; + local_28 = (longlong **)&local_28; + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(param_1,0); + puVar1 = (undefined8 *)(param_1 + 0x10); + puVar8 = (undefined8 *)*puVar1; do { - if (ppppuVar7 == ppppuVar1) { - uVar6 = Feature_3434922298__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar6 == 0) { - ExReleasePushLockSharedEx(param_1,0); - KeLeaveCriticalRegion(); + if (puVar8 == puVar1) { + ppplVar9 = (longlong ***)local_28; + if ((longlong ***)local_28 != &local_28) { + do { + ppplVar3 = ppplVar9 + -10; + ppplVar4 = ppplVar9 + 9; + ppplVar9 = (longlong ***)*ppplVar9; + if (*(int *)ppplVar4 == 2) { + BfsDereferencePolicyEntryEx((longlong)ppplVar3,'\x01'); + } + BfsDereferencePolicyEntryEx((longlong)ppplVar3,'\x01'); + } while (ppplVar9 != &local_28); + if ((undefined8 *)*puVar1 == puVar1) { + ExCancelTimer(*(undefined8 *)(param_1 + 0x20),0); + } } - if ((undefined8 ****)local_28 != &local_28) { - uVar6 = Feature_3434922298__private_IsEnabledDeviceUsageNoInline(); - ppppuVar7 = (undefined8 ****)local_28; - puVar8 = auStack_58; - if ((int)uVar6 != 0) goto LAB_1; - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_1,0); - ppppuVar7 = (undefined8 ****)local_28; - puVar8 = auStack_58; - goto LAB_1; - } -LAB_2: - *(undefined8 *)(puVar8 + -8) = 0x1400064a0; - uVar6 = Feature_3434922298__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar6 != 0) { - *(undefined8 *)(puVar8 + -8) = 0x1400064b0; - ExReleasePushLockExclusiveEx(param_1,0); - *(undefined8 *)(puVar8 + -8) = 0x1400064bc; - KeLeaveCriticalRegion(); - } + ExReleasePushLockExclusiveEx(param_1,0); + KeLeaveCriticalRegion(); return; } - uVar6 = Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar6 == 0) || (ppppuVar7[10] == (undefined8 ***)0x0)) { - if ((longlong)ppppuVar7[4] < lVar9) goto LAB_3; + uVar7 = Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar7 == 0) || (puVar8[10] == 0)) { + if ((longlong)puVar8[4] < lVar10) goto LAB_1; } else { local_res8 = 0; - local_38 = &local_res8; - iVar5 = KeWaitForSingleObject(ppppuVar7[10],0,0,0); - if (iVar5 != 0x102) { -LAB_3: + iVar6 = KeWaitForSingleObject(puVar8[10],0,0,0,&local_res8); + if (iVar6 != 0x102) { +LAB_1: LOCK(); - ppppuVar2 = ppppuVar7 + 0xb; - iVar5 = *(int *)ppppuVar2; - *(int *)ppppuVar2 = *(int *)ppppuVar2 + 1; + piVar2 = (int *)(puVar8 + 0xb); + iVar6 = *piVar2; + *piVar2 = *piVar2 + 1; UNLOCK(); - if (iVar5 == 1) { - ppppuVar2 = ppppuVar7 + 2; - if ((undefined8 ****)*local_20 != &local_28) { - pcVar4 = (code *)swi(0x29); - (*pcVar4)(3); - puVar8 = auStack_50; - do { - ppppuVar2 = (undefined8 ****)*ppppuVar7; - if (*(int *)(ppppuVar7 + 9) == 2) { - *(undefined8 *)(puVar8 + -8) = 0x14000644b; - BfsDereferencePolicyEntryEx((longlong)(ppppuVar7 + -10),'\x01'); - } - *(undefined8 *)(puVar8 + -8) = 0x140006455; - BfsDereferencePolicyEntryEx((longlong)(ppppuVar7 + -10),'\x01'); - ppppuVar7 = ppppuVar2; -LAB_1: - } while (ppppuVar7 != &local_28); - if ((undefined8 ****)*ppppuVar1 == ppppuVar1) { - uVar3 = *(undefined8 *)(param_1 + 0x20); - *(undefined8 *)(puVar8 + -8) = 0x140006470; - ExCancelTimer(uVar3,0); - } - *(undefined8 *)(puVar8 + -8) = 0x14000647a; - uVar6 = Feature_3434922298__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar6 == 0) { - *(undefined8 *)(puVar8 + -8) = 0x14000648a; - ExReleasePushLockExclusiveEx(param_1,0); - *(undefined8 *)(puVar8 + -8) = 0x140006496; - KeLeaveCriticalRegion(); - } - goto LAB_2; + if (iVar6 == 1) { + ppplVar9 = (longlong ***)(puVar8 + 2); + if ((longlong ***)*local_20 != &local_28) { + pcVar5 = (code *)swi(0x29); + (*pcVar5)(3); + pcVar5 = (code *)swi(3); + (*pcVar5)(); + return; } - *ppppuVar2 = &local_28; - ppppuVar7[3] = local_20; - *local_20 = ppppuVar2; - local_20 = ppppuVar2; + *ppplVar9 = (longlong **)&local_28; + puVar8[3] = local_20; + *local_20 = (longlong *)ppplVar9; + local_20 = (longlong **)ppplVar9; } else { LOCK(); - *(int *)(ppppuVar7 + 0xb) = *(int *)(ppppuVar7 + 0xb) + -1; + *(int *)(puVar8 + 0xb) = *(int *)(puVar8 + 0xb) + -1; UNLOCK(); } } } - ppppuVar7 = (undefined8 ****)*ppppuVar7; + puVar8 = (undefined8 *)*puVar8; } while( true ); } ``` ## BfsInsertPolicyEntryLocked ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.71| |i_ratio|0.72| |m_ratio|0.97| |b_ratio|0.8| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsInsertPolicyEntryLocked|BfsInsertPolicyEntryLocked| |fullname|BfsInsertPolicyEntryLocked|BfsInsertPolicyEntryLocked| |refcount|2|2| |`length`|1738|1837| |`called`|
Expand for full list:
BfsCreateStorage
BfsDereferencePolicyEntryEx
BfsInsertEntryHashTable
BfsLookupPolicyEntryHashTable
BfsOpenPolicyDirectory
FLTMGR.SYS::FltClose
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExSetTimerNTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeResetEvent
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlCopySid
NTOSKRNL.EXE::RtlFreeUnicodeString
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsCreateStorage
BfsDereferencePolicyEntryEx
BfsInsertEntryHashTable
BfsLookupPolicyEntryHashTable
BfsOpenPolicyDirectory
FLTMGR.SYS::FltClose
Feature_241429816__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExSetTimerNTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeResetEvent
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlCopySid
NTOSKRNL.EXE::RtlFreeUnicodeString
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsGetPolicyEntryLocked|BfsGetPolicyEntryLocked| |paramcount|8|8| |`address`|140008f30|140009268| |sig|ulonglong __fastcall BfsInsertPolicyEntryLocked(undefined8 * param_1, undefined8 param_2, longlong param_3, undefined8 param_4, longlong param_5, longlong param_6, int * param_7, longlong * param_8)|ulonglong __fastcall BfsInsertPolicyEntryLocked(undefined8 * param_1, undefined8 param_2, longlong param_3, undefined8 param_4, longlong param_5, longlong param_6, int * param_7, longlong * param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsInsertPolicyEntryLocked Called Diff ```diff --- BfsInsertPolicyEntryLocked called +++ BfsInsertPolicyEntryLocked called @@ -7 +7 @@ -Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline +Feature_241429816__private_IsEnabledDeviceUsageNoInline ``` ### BfsInsertPolicyEntryLocked Diff ```diff --- BfsInsertPolicyEntryLocked +++ BfsInsertPolicyEntryLocked @@ -1,298 +1,316 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ ulonglong BfsInsertPolicyEntryLocked (undefined8 *param_1,undefined8 param_2,longlong param_3,undefined8 param_4, longlong param_5,longlong param_6,int *param_7,longlong *param_8) { longlong *plVar1; code *pcVar2; bool bVar3; bool bVar4; longlong lVar5; uint uVar6; longlong lVar7; - longlong lVar8; + ulonglong uVar8; longlong lVar9; - ulonglong uVar10; + longlong lVar10; longlong lVar11; longlong *plVar12; undefined8 uVar13; longlong lVar14; undefined8 *puVar15; longlong *plVar16; ulonglong unaff_R12; undefined1 auStackY_118 [32]; char local_e7; char local_e6; uint local_e0 [2]; char local_d8; char local_d7; char local_d6; longlong local_d0; longlong local_c8; longlong local_c0; longlong local_b8; longlong local_b0; int *local_a8; undefined8 local_a0; undefined8 local_98; undefined8 uStack_90; undefined8 local_88; undefined8 uStack_80; uint *local_58; undefined8 local_50; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_118; local_a8 = param_7; - lVar9 = 0; + lVar10 = 0; local_d0 = 0; local_b0 = 0; local_e7 = '\0'; bVar3 = false; bVar4 = false; local_e6 = '\0'; local_d8 = '\0'; lVar11 = *(longlong *)(param_3 + 8); local_b8 = param_5; local_c0 = param_6; local_88 = 0; uStack_80 = 0; local_98 = 0; uStack_90 = 0; local_c8 = param_3; local_a0 = param_4; lVar7 = BfsLookupPolicyEntryHashTable(lVar11,param_4,param_5,param_6); lVar14 = local_b8; if (lVar7 == 0) { uVar13 = 0x100; - lVar8 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(local_b8 + 1) * 4 + 8,0x53736642); - if (lVar8 == 0) { + lVar9 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(local_b8 + 1) * 4 + 8,0x53736642); + if (lVar9 == 0) { if (3 < DAT_0) { local_e0[0] = 0xc0000017; local_58 = local_e0; local_50 = 4; _tlgWriteTransfer_EtwWriteTransfer(uVar13,&DAT_1); } goto LAB_2; } - uVar10 = 0x100; - lVar9 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(param_6 + 1) * 4 + 8,0x53736642); - if (lVar9 != 0) { - uVar10 = (ulonglong)((uint)*(byte *)(lVar14 + 1) * 4 + 8); - uVar6 = RtlCopySid(uVar10,lVar8,lVar14); + uVar8 = 0x100; + lVar10 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(param_6 + 1) * 4 + 8,0x53736642); + if (lVar10 != 0) { + uVar8 = (ulonglong)((uint)*(byte *)(lVar14 + 1) * 4 + 8); + uVar6 = RtlCopySid(uVar8,lVar9,lVar14); if ((int)uVar6 < 0) goto LAB_3; - uVar10 = (ulonglong)((uint)*(byte *)(local_c0 + 1) * 4 + 8); - uVar6 = RtlCopySid(uVar10,lVar9,local_c0); + uVar8 = (ulonglong)((uint)*(byte *)(local_c0 + 1) * 4 + 8); + uVar6 = RtlCopySid(uVar8,lVar10,local_c0); if ((int)uVar6 < 0) goto LAB_3; - uVar10 = 0x100; + uVar8 = 0x100; lVar7 = ExAllocatePool2(0x100,0xa0,0x45736642); if (lVar7 == 0) goto LAB_4; LOCK(); *(int *)(lVar7 + 0x98) = *(int *)(lVar7 + 0x98) + 1; UNLOCK(); lVar11 = ExAllocatePool2(0x40,0x18,0x76736642); lVar14 = 0; *(longlong *)(lVar7 + 0x28) = lVar11; if (lVar11 == 0) { uVar6 = 0xc0000017; lVar11 = lVar14; } else { - *(longlong *)(lVar7 + 0x18) = lVar8; - *(longlong *)(lVar7 + 0x20) = lVar9; + *(longlong *)(lVar7 + 0x18) = lVar9; + *(longlong *)(lVar7 + 0x20) = lVar10; *(undefined4 *)(lVar7 + 0x68) = 0; *(undefined4 *)(lVar7 + 0x38) = 0x10000001; *(undefined8 *)(lVar7 + 0x70) = 0; *(undefined8 *)(lVar7 + 0x78) = 0; *(undefined2 *)(lVar7 + 0x72) = 0; *(undefined8 *)(lVar7 + 0x78) = 0; *(undefined8 *)(lVar7 + 0x80) = 0; *(undefined8 *)(lVar7 + 0x88) = 0; *(undefined2 *)(lVar7 + 0x82) = 0; *(undefined8 *)(lVar7 + 0x88) = 0; KeInitializeEvent(lVar11,0,0); lVar11 = *(longlong *)(local_c8 + 8); uVar6 = BfsInsertEntryHashTable(lVar11,local_a0,lVar7); lVar5 = local_c8; + lVar10 = lVar14; lVar9 = lVar14; - lVar8 = lVar14; if (-1 < (int)uVar6) { LOCK(); *(int *)(lVar7 + 0x98) = *(int *)(lVar7 + 0x98) + 1; UNLOCK(); bVar3 = true; bVar4 = true; plVar16 = (longlong *)(local_c8 + 0x10); if ((longlong *)*plVar16 == plVar16) { ExSetTimer(*(undefined8 *)(local_c8 + 0x20),0xffffffffee1e5d00,300000000); } puVar15 = *(undefined8 **)(lVar5 + 0x18); plVar12 = (longlong *)(lVar7 + 0x40); if ((longlong *)*puVar15 != plVar16) goto LAB_5; *plVar12 = (longlong)plVar16; *(undefined8 **)(lVar7 + 0x48) = puVar15; *puVar15 = plVar12; *(longlong **)(lVar5 + 0x18) = plVar12; LOCK(); *(undefined8 *)(lVar7 + 0x60) = _DAT_6; UNLOCK(); goto LAB_7; } } goto LAB_8; } LAB_4: uVar6 = 0xc0000017; LAB_3: if (3 < DAT_0) { local_58 = local_e0; local_50 = 4; local_e0[0] = uVar6; - _tlgWriteTransfer_EtwWriteTransfer(uVar10,&DAT_1); + _tlgWriteTransfer_EtwWriteTransfer(uVar8,&DAT_1); } LAB_9: - ExFreePoolWithTag(lVar8,0); + ExFreePoolWithTag(lVar9,0); } else { if ((*(uint *)(lVar7 + 0x38) >> 0x1c & 1) == 0) { - if (*(uint *)(lVar7 + 0x38) != 2) goto LAB_10; - *(undefined4 *)(lVar7 + 0x38) = 0x10000001; - KeResetEvent(*(undefined8 *)(lVar7 + 0x28)); - uVar10 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - local_d8 = (int)uVar10 != 0; - LOCK(); - *(int *)(lVar7 + 0x98) = *(int *)(lVar7 + 0x98) + 1; - UNLOCK(); - bVar3 = false; + if (*(uint *)(lVar7 + 0x38) == 2) { + *(undefined4 *)(lVar7 + 0x38) = 0x10000001; + KeResetEvent(*(undefined8 *)(lVar7 + 0x28)); + uVar8 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + local_d8 = (int)uVar8 != 0; + LOCK(); + *(int *)(lVar7 + 0x98) = *(int *)(lVar7 + 0x98) + 1; + UNLOCK(); LAB_7: - lVar9 = 0; - puVar15 = &local_98; - uVar6 = RtlConvertSidToUnicodeString(puVar15,local_b8,1); - plVar16 = (longlong *)(ulonglong)uVar6; - if (-1 < (int)uVar6) { - puVar15 = &local_88; - local_e7 = '\x01'; - uVar6 = RtlConvertSidToUnicodeString(puVar15,local_c0,1); + puVar15 = &local_98; + uVar6 = RtlConvertSidToUnicodeString(puVar15,local_b8,1); plVar16 = (longlong *)(ulonglong)uVar6; if (-1 < (int)uVar6) { - local_e6 = '\x01'; - puVar15 = param_1; - uVar6 = BfsOpenPolicyDirectory(param_1,0,&local_98,'\0',&local_b0); + puVar15 = &local_88; + local_e7 = '\x01'; + uVar6 = RtlConvertSidToUnicodeString(puVar15,local_c0,1); plVar16 = (longlong *)(ulonglong)uVar6; if (-1 < (int)uVar6) { - uVar10 = BfsCreateStorage((longlong)param_1,0,local_b0,(ulonglong)&local_88,'\0', - &local_d0); - uVar6 = (uint)uVar10; - plVar16 = (longlong *)(uVar10 & 0xffffffff); + local_e6 = '\x01'; puVar15 = param_1; + uVar6 = BfsOpenPolicyDirectory(param_1,0,&local_98,'\0',&local_b0); + plVar16 = (longlong *)(ulonglong)uVar6; if (-1 < (int)uVar6) { - RtlFreeUnicodeString(&local_98); - RtlFreeUnicodeString(&local_88); - *(longlong *)(lVar7 + 0x30) = local_d0; - *(undefined4 *)(lVar7 + 0x38) = 0x10000000; - KeSetEvent(*(undefined8 *)(lVar7 + 0x28),0,0); - *param_8 = lVar7; - goto LAB_2; + uVar8 = BfsCreateStorage((longlong)param_1,0,local_b0,(ulonglong)&local_88,'\0', + &local_d0); + uVar6 = (uint)uVar8; + plVar16 = (longlong *)(uVar8 & 0xffffffff); + puVar15 = param_1; + if (-1 < (int)uVar6) { + RtlFreeUnicodeString(&local_98); + RtlFreeUnicodeString(&local_88); + *(longlong *)(lVar7 + 0x30) = local_d0; + *(undefined4 *)(lVar7 + 0x38) = 0x10000000; + KeSetEvent(*(undefined8 *)(lVar7 + 0x28),0,0); + *param_8 = lVar7; + goto LAB_2; + } } } } - } - if (3 < DAT_0) { - local_58 = local_e0; - local_50 = 4; - local_e0[0] = uVar6; - _tlgWriteTransfer_EtwWriteTransfer(puVar15,&DAT_1); - } - lVar8 = lVar9; - if (lVar7 != 0) goto LAB_11; + if (3 < DAT_0) { + local_58 = local_e0; + local_50 = 4; + local_e0[0] = uVar6; + _tlgWriteTransfer_EtwWriteTransfer(puVar15,&DAT_1); + } + } + else { + uVar8 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 != 0) { + lVar7 = 0; + } + plVar16 = (longlong *)0xc0000001; + if (3 < DAT_0) { + local_e0[0] = 0xc0000001; + local_58 = local_e0; + local_50 = 4; + _tlgWriteTransfer_EtwWriteTransfer(lVar11,&DAT_1); + } + } + lVar9 = 0; + lVar10 = 0; + if (lVar7 != 0) goto LAB_10; } else { LOCK(); *(int *)(lVar7 + 0x98) = *(int *)(lVar7 + 0x98) + 1; UNLOCK(); - if (*(int *)(lVar7 + 0x38) != 0x10000001) { -LAB_12: - *param_8 = lVar7; - return unaff_R12; - } - ExReleasePushLockExclusiveEx(local_c8); - KeLeaveCriticalRegion(); - *local_a8 = 0; - lVar11 = *(longlong *)(lVar7 + 0x28); - KeWaitForSingleObject(lVar11,0,0); - if (*(int *)(lVar7 + 0x38) == 0x10000000) goto LAB_12; -LAB_10: + if (*(int *)(lVar7 + 0x38) == 0x10000001) { + ExReleasePushLockExclusiveEx(); + KeLeaveCriticalRegion(); + *local_a8 = 0; + lVar11 = *(longlong *)(lVar7 + 0x28); + KeWaitForSingleObject(lVar11,0,0); + uVar8 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar8 != 0) || (*(int *)(lVar7 + 0x38) == 0x10000000)) goto LAB_11; + } + else { +LAB_11: + uVar8 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar8 == 0) || (*(int *)(lVar7 + 0x38) == 0x10000000)) { + *param_8 = lVar7; + return unaff_R12; + } + } uVar6 = 0xc0000001; - lVar8 = lVar9; + lVar9 = lVar10; LAB_8: plVar16 = (longlong *)(ulonglong)uVar6; if (3 < DAT_0) { local_58 = local_e0; local_50 = 4; local_e0[0] = uVar6; _tlgWriteTransfer_EtwWriteTransfer(lVar11,&DAT_1); } -LAB_11: +LAB_10: local_d6 = local_e7; local_d7 = local_e6; - uVar10 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar10 != 0) { + uVar8 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 != 0) { local_e6 = local_d7; local_e7 = local_d6; bVar4 = bVar3; if (local_d8 != '\0') { if (!bVar3) { *(undefined4 *)(lVar7 + 0x38) = 2; KeSetEvent(*(undefined8 *)(lVar7 + 0x28),0,0); local_e6 = local_d7; local_e7 = local_d6; } } } BfsDereferencePolicyEntryEx(lVar7,*local_a8 == 2); } if ((bVar4) && (lVar11 = BfsLookupPolicyEntryHashTable (*(undefined8 *)(local_c8 + 8),local_a0,local_b8,local_c0), lVar11 != 0)) { *(undefined4 *)(lVar11 + 0x38) = 1; plVar12 = (longlong *)(lVar11 + 0x40); lVar14 = *plVar12; if ((*(longlong **)(lVar14 + 8) != plVar12) || (plVar1 = *(longlong **)(lVar11 + 0x48), (longlong *)*plVar1 != plVar12)) { LAB_5: pcVar2 = (code *)swi(0x29); (*pcVar2)(3); pcVar2 = (code *)swi(3); (*pcVar2)(); return (ulonglong)plVar16; } *plVar1 = lVar14; *(longlong **)(lVar14 + 8) = plVar1; *plVar12 = 0; *(undefined8 *)(lVar11 + 0x48) = 0; - KeSetEvent(*(undefined8 *)(lVar11 + 0x28),0,0); + KeSetEvent(*(undefined8 *)(lVar11 + 0x28),0); BfsDereferencePolicyEntryEx(lVar11,'\x01'); } if (local_e7 != '\0') { RtlFreeUnicodeString(&local_98); } if (local_e6 != '\0') { RtlFreeUnicodeString(&local_88); } - if (lVar8 != 0) goto LAB_9; + if (lVar9 != 0) goto LAB_9; } - if (lVar9 != 0) { - ExFreePoolWithTag(lVar9,0); + if (lVar10 != 0) { + ExFreePoolWithTag(lVar10,0); } LAB_2: if (local_b0 != 0) { FltClose(); } return unaff_R12; } ``` ## DriverEntry ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.83| |i_ratio|0.32| |m_ratio|0.97| |b_ratio|0.57| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|DriverEntry|DriverEntry| |fullname|DriverEntry|DriverEntry| |refcount|2|2| |`length`|1541|1454| |`called`|
Expand for full list:
BfsCreatePolicyStorageDescriptor
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInitializePipeMappingTable
BfsInitializePolicyTable
BfsOpenPolicyRootDirectory
BfsReadDeleteThresholdFromRegistry
BfsSetApplicableCapabilitySid
BfsUninitializeGlobalFileTable
BfsUninitializePipeMappingTable
BfsUninitializePolicyTableBfsUpdatePolicySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
CNG.SYS::BCryptCloseAlgorithmProvider
CNG.SYS::BCryptOpenAlgorithmProvider
FLTMGR.SYS::FltRegisterFilter
FLTMGR.SYS::FltStartFiltering
FLTMGR.SYS::FltUnregisterFilter
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::CmRegisterCallbackEx
NTOSKRNL.EXE::CmUnRegisterCallback
NTOSKRNL.EXE::EtwUnregister
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializeRundownProtection
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::IoCreateDevice
NTOSKRNL.EXE::IoDeleteDevice
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::ZwClose
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
wil_InitializeFeatureStaging
wil_UninitializeFeatureStaging
|
Expand for full list:
BfsCreatePolicyStorageDescriptor
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInitializePipeMappingTable
BfsInitializePolicyTable
BfsOpenPolicyRootDirectory
BfsReadDeleteThresholdFromRegistry
BfsSetApplicableCapabilitySid
BfsUninitializeGlobalFileTable
BfsUninitializePipeMappingTable
BfsUninitializePolicyTableBfsUpdatePolicySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
CNG.SYS::BCryptCloseAlgorithmProvider
CNG.SYS::BCryptOpenAlgorithmProvider
FLTMGR.SYS::FltRegisterFilter
FLTMGR.SYS::FltStartFiltering
FLTMGR.SYS::FltUnregisterFilter
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::CmRegisterCallbackEx
NTOSKRNL.EXE::CmUnRegisterCallback
NTOSKRNL.EXE::EtwUnregister
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializeRundownProtection
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::IoCreateDevice
NTOSKRNL.EXE::IoDeleteDevice
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::ZwClose
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
wil_InitializeFeatureStaging
wil_UninitializeFeatureStaging
| |calling|entry|entry| |paramcount|1|1| |address|140021078|140021078| |sig|uint __fastcall DriverEntry(undefined * param_1)|uint __fastcall DriverEntry(undefined * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DriverEntry Called Diff ```diff --- DriverEntry called +++ DriverEntry called @@ -20 +19,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline ``` ### DriverEntry Diff ```diff --- DriverEntry +++ DriverEntry @@ -1,271 +1,254 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Type propagation algorithm not settling */ uint DriverEntry(undefined *param_1) { undefined1 uVar1; undefined1 uVar2; undefined1 uVar3; bool bVar4; uint uVar5; undefined8 uVar6; ulonglong uVar7; code *pcVar8; longlong *plVar9; undefined *puVar10; wchar_t *pwVar11; code *pcVar12; code *pcVar13; undefined1 auStack_e8 [32]; undefined8 *local_c8; undefined1 *local_c0; longlong *local_b8; uint local_a8; char local_a4 [4]; code *local_a0; longlong local_98; longlong local_90; undefined8 uStack_88; longlong local_80; undefined8 uStack_78; longlong local_70; undefined8 uStack_68; undefined1 local_60 [32]; uint *local_40; undefined8 local_38; ulonglong local_30; local_30 = __security_cookie ^ (ulonglong)auStack_e8; - local_90 = 0; - uStack_88 = 0; local_70 = 0; uStack_68 = 0; local_80 = 0; uStack_78 = 0; + local_90 = 0; + uStack_88 = 0; pcVar8 = (code *)param_1; wil_InitializeFeatureStaging(); pcVar12 = (code *)0x0; local_a0 = (code *)0x0; local_98 = 0; uVar1 = false; uVar2 = false; bVar4 = false; local_a4[0] = '\0'; uVar5 = BfsVerifyVolumeRootDescriptor(); pcVar13 = (code *)0x0; uVar3 = bVar4; if (-1 < (int)uVar5) { pcVar8 = (code *)&gBfsPolicyStorageDirectoryDescriptor; uVar5 = BfsCreatePolicyStorageDescriptor((undefined8 *)&gBfsPolicyStorageDirectoryDescriptor,3); pcVar13 = pcVar12; if (-1 < (int)uVar5) { pcVar8 = (code *)&gBfsPolicyStorageFileDescriptor; uVar5 = BfsCreatePolicyStorageDescriptor((undefined8 *)&gBfsPolicyStorageFileDescriptor,0); if (-1 < (int)uVar5) { ExInitializeRundownProtection(&gBfsRundownProtection); - pcVar8 = (code *)&local_80; + pcVar8 = (code *)&local_90; RtlInitUnicodeString(pcVar8,L"\\SystemRoot\\System32\\config\\BFS"); uVar6 = BfsInitializePolicyTable((longlong)pcVar8); uVar5 = (uint)uVar6; if (-1 < (int)uVar5) { uVar6 = BfsInitializePipeMappingTable((longlong)pcVar8); uVar5 = (uint)uVar6; if (-1 < (int)uVar5) { - plVar9 = &local_80; + plVar9 = &local_90; uVar5 = BfsOpenPolicyRootDirectory(plVar9,&local_a0); pcVar13 = local_a0; uVar3 = uVar1; if ((int)uVar5 < 0) { if (3 < DAT_0) { local_40 = &local_a8; local_38 = 4; local_c0 = local_60; local_a8 = uVar5; _tlgWriteTransfer_EtwWriteTransfer(plVar9,&DAT_1); pcVar13 = local_a0; } goto LAB_2; } uVar5 = BfsVerifyPolicySecurity((longlong)local_a0,local_a4); uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar7 != 0) { uVar7 = BfsReadDeleteThresholdFromRegistry(); gBfsDeleteThreshold = (undefined4)uVar7; } if (((-1 < (int)uVar5) && (local_a4[0] == '\0')) || (pcVar8 = pcVar13, uVar5 = BfsUpdatePolicySecurity(pcVar13), uVar3 = bVar4, -1 < (int)uVar5)) { pcVar8 = (code *)&gBfsBootDevice; uVar5 = BfsInitializeBootDevice((undefined4 *)&gBfsBootDevice); uVar3 = bVar4; if (-1 < (int)uVar5) { uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar7 != 0) { KeInitializeEvent(&DAT_3,0,0); } - *(code **)(param_1 + 0x70) = BfsClose; - *(code **)(param_1 + 0x100) = BfsClose; + *(code **)(param_1 + 0x70) = BfsCreate; + *(code **)(param_1 + 0x100) = BfsCreate; *(code **)(param_1 + 0xe0) = BfsDeviceIoControl; - *(code **)(param_1 + 0x80) = BfsClose; - RtlInitUnicodeString(&local_70,L"\\Device\\Bfs"); + *(code **)(param_1 + 0x80) = BfsCreate; + RtlInitUnicodeString(&local_80,L"\\Device\\Bfs"); pcVar8 = (code *)&gBfsSHA256Handle; uVar5 = BCryptOpenAlgorithmProvider(&gBfsSHA256Handle,L"SHA256",(LPCWSTR)0x0,0); if (-1 < (int)uVar5) { uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar7 == 0) { puVar10 = &FilterRegistration; } else { uVar7 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline (); if ((int)uVar7 == 0) { puVar10 = &FilterRegistrationGA; } else { puVar10 = &FilterRegistrationAgentic; } } pcVar8 = (code *)param_1; uVar5 = FltRegisterFilter(param_1,puVar10,&gBfsFilterHandle); uVar3 = uVar1; if (-1 < (int)uVar5) { uVar2 = true; uVar7 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline (); if (((int)uVar7 == 0) || (uVar5 = BfsSetApplicableCapabilitySid(), uVar3 = bVar4, -1 < (int)uVar5)) { local_b8 = &local_98; local_c0 = (undefined1 *)((ulonglong)local_c0 & 0xffffffffffffff00); local_c8 = (undefined8 *)CONCAT44(local_c8._4_4_,0x100); pcVar8 = (code *)param_1; - uVar5 = IoCreateDevice(param_1,0,&local_70,0x22); + uVar5 = IoCreateDevice(param_1,0,&local_80,0x22); uVar3 = bVar4; if (-1 < (int)uVar5) { pwVar11 = L"150000"; - RtlInitUnicodeString(&local_90); - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - pcVar8 = (code *)&gBfsRegistryCookie; - if ((int)uVar7 == 0) { - local_c0 = (undefined1 *)0x0; - pwVar11 = (wchar_t *)&local_90; - local_c8 = &gBfsRegistryCookie; - pcVar8 = BfsRegistryCallback; - uVar5 = CmRegisterCallbackEx(BfsRegistryCallback,pwVar11,param_1,0); - if ((int)uVar5 < 0) goto joined_r0x00014002144e; - bVar4 = true; - } + pcVar8 = (code *)&local_70; + RtlInitUnicodeString(); uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline (); - uVar3 = bVar4; if ((int)uVar7 != 0) { TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(); gBfsDeviceObject = local_98; gBfsRootDirectory = pcVar13; - uVar5 = BfsInitializeGlobalFileTable(pcVar8,pwVar11,0x14001b1e0); - if ((int)uVar5 < 0) goto joined_r0x00014002144e; + uVar5 = BfsInitializeGlobalFileTable(pcVar8,pwVar11,0x14001b200); + if ((int)uVar5 < 0) goto joined_r0x000140021400; } - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 != 0) { - local_c0 = (undefined1 *)0x0; - local_c8 = &gBfsRegistryCookie; - pcVar8 = BfsRegistryCallback; - uVar5 = CmRegisterCallbackEx(BfsRegistryCallback,&local_90,param_1,0); - if ((int)uVar5 < 0) goto joined_r0x00014002144e; - bVar4 = true; - } - pcVar8 = gBfsFilterHandle; - uVar5 = FltStartFiltering(); - uVar3 = bVar4; + local_c0 = (undefined1 *)0x0; + local_c8 = &gBfsRegistryCookie; + pcVar8 = BfsRegistryCallback; + uVar5 = CmRegisterCallbackEx(BfsRegistryCallback,&local_70,param_1,0); if (-1 < (int)uVar5) { - uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline - (); - if ((int)uVar7 != 0) { + pcVar8 = gBfsFilterHandle; + uVar5 = FltStartFiltering(); + uVar3 = true; + if (-1 < (int)uVar5) { + uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline + (); + if ((int)uVar7 != 0) { + return uVar5; + } + TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(); + gBfsDeviceObject = local_98; + gBfsRootDirectory = pcVar13; return uVar5; } - TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(); - gBfsDeviceObject = local_98; - gBfsRootDirectory = pcVar13; - return uVar5; } } } } } } } } } } } } -joined_r0x00014002144e: +joined_r0x000140021400: uVar1 = uVar2; if (3 < DAT_0) { local_40 = &local_a8; local_38 = 4; local_c0 = local_60; local_a8 = uVar5; _tlgWriteTransfer_EtwWriteTransfer(pcVar8,&DAT_1); } LAB_2: - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 != 0) { - KeEnterCriticalRegion(); - ExWaitForRundownProtectionRelease(&gBfsRundownProtection); - KeLeaveCriticalRegion(); - } + KeEnterCriticalRegion(); + ExWaitForRundownProtectionRelease(&gBfsRundownProtection); + KeLeaveCriticalRegion(); if (DAT_4 != 0) { ExFreePoolWithTag(DAT_4,0); } if (DAT_5 != 0) { ExFreePoolWithTag(DAT_5,0); } if (DAT_6 != 0) { ExFreePoolWithTag(DAT_6,0); } if (DAT_7 != 0) { ExFreePoolWithTag(DAT_7,0); } uVar7 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); if (((int)uVar7 != 0) && (gApplicableCapabilitySid != 0)) { ExFreePoolWithTag(gApplicableCapabilitySid,0); } BfsUninitializePipeMappingTable((undefined8 *)&gBfsPipeMappingTable); - BfsUninitializePolicyTable(0x14001b2b0); + BfsUninitializePolicyTable(0x14001b2d0); uVar7 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); if (((int)uVar7 != 0) && (uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(), (int)uVar7 != 0)) { - BfsUninitializeGlobalFileTable(0x14001b1e0); + BfsUninitializeGlobalFileTable(0x14001b200); } if (pcVar13 != (code *)0x0) { ZwClose(pcVar13); } if (local_98 != 0) { IoDeleteDevice(); } if ((bool)uVar1) { FltUnregisterFilter(gBfsFilterHandle); } if (gBfsSHA256Handle != (BCRYPT_ALG_HANDLE)0x0) { BCryptCloseAlgorithmProvider(gBfsSHA256Handle,0); } if ((bool)uVar3) { CmUnRegisterCallback(gBfsRegistryCookie); } if (DAT_8 != 0) { RtlFreeUnicodeString(&gBfsBootDevice); } uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); uVar6 = DAT_9; if ((int)uVar7 != 0) { DAT_9 = 0; DAT_0 = 0; EtwUnregister(uVar6); } wil_UninitializeFeatureStaging(); return uVar5; } ``` ## BfsProcessSetPolicyRequest ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.54| |i_ratio|0.4| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsProcessSetPolicyRequest|BfsProcessSetPolicyRequest| |fullname|BfsProcessSetPolicyRequest|BfsProcessSetPolicyRequest| |refcount|2|2| |`length`|1982|2212| |`called`|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsAllocateAndConcatenatePath
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsGetFileName
BfsGetFinalPathComponent
BfsGetPolicy
BfsGetPolicyEntry
BfsGetShareName
BfsIsApplicableTokenFLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
Feature_AppSiloBfsProcessSetPolicyRequestBufferCheck__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoCreateFile
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::RtlCompareUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwOpenFile
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memmove
|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsAllocateAndConcatenatePath
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsGetFileName
BfsGetFinalPathComponent
BfsGetPolicy
BfsGetPolicyEntry
BfsGetShareName
BfsIsApplicableTokenBfsResolveReparseTarget
FLTMGR.SYS::FltGetFileNameInformationUnsafe
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
Feature_AppSiloBfsProcessSetPolicyRequestBufferCheck__private_IsEnabledDeviceUsageNoInline
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoCreateFile
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::RtlCompareUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwOpenFile
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memcpy
| |calling|BfsDeviceIoControl|BfsDeviceIoControl| |paramcount|2|2| |`address`|14000ab30|14000aecc| |sig|ulonglong __fastcall BfsProcessSetPolicyRequest(undefined8 * param_1, uint param_2)|ulonglong __fastcall BfsProcessSetPolicyRequest(undefined8 * param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsProcessSetPolicyRequest Called Diff ```diff --- BfsProcessSetPolicyRequest called +++ BfsProcessSetPolicyRequest called @@ -11,0 +12 @@ +BfsResolveReparseTarget @@ -15,0 +17 @@ +Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline @@ -29 +31 @@ -memmove +memcpy ``` ### BfsProcessSetPolicyRequest Diff ```diff --- BfsProcessSetPolicyRequest +++ BfsProcessSetPolicyRequest @@ -1,290 +1,314 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Type propagation algorithm not settling */ ulonglong BfsProcessSetPolicyRequest(undefined8 *param_1,uint param_2) { int iVar1; ushort uVar2; longlong lVar3; char cVar4; uint uVar5; int iVar6; ulonglong uVar7; ushort *puVar8; ushort *******pppppppuVar9; short sVar10; uint uVar11; undefined1 *puVar12; longlong lVar13; longlong lVar14; bool bVar15; ulonglong local_res8; undefined1 auStackY_1b8 [32]; uint local_148 [2]; longlong local_140; undefined1 local_138 [8]; - longlong local_130; + ulonglong local_130; ushort *******local_128; ushort *******local_120; - undefined8 *local_118; - undefined8 *local_110; - ushort *******local_108; - ushort ******local_100; - longlong lStack_f8; - undefined8 local_f0; - void *pvStack_e8; - undefined8 local_d8; - undefined8 uStack_d0; - undefined8 local_c8; - longlong lStack_c0; - undefined8 local_b8; - undefined8 uStack_b0; - undefined8 *local_a8; - undefined8 uStack_a0; - undefined8 local_98; - ulonglong uStack_90; - undefined8 local_88; - undefined8 uStack_80; - undefined8 local_78; - undefined8 uStack_70; + undefined8 local_118; + void *pvStack_110; + undefined8 local_108; + void *pvStack_100; + undefined8 *local_f8; + undefined8 *local_f0; + ushort *******local_e8; + ushort ******local_e0; + longlong lStack_d8; + undefined8 local_d0; + longlong lStack_c8; + undefined4 local_c0; + undefined4 uStack_bc; + undefined8 uStack_b8; + undefined8 *local_b0; + undefined4 uStack_a8; + undefined4 uStack_a4; + undefined8 local_a0; + ulonglong uStack_98; + undefined8 local_90; + undefined8 uStack_88; + undefined8 local_80; + undefined8 uStack_78; ushort ******local_68; - undefined8 uStack_60; + void *pvStack_60; ushort *******local_58; undefined8 uStack_50; undefined8 local_48; ulonglong uStack_40; uint *local_38; undefined8 uStack_30; ulonglong local_28; local_28 = __security_cookie ^ (ulonglong)auStackY_1b8; + lVar13 = 0; + local_f0 = (undefined8 *)0x0; + local_128 = (ushort *******)0x0; + local_e0 = (ushort ******)0x0; + lStack_d8 = 0; lVar14 = 0; - local_110 = (undefined8 *)0x0; + local_80 = 0; + uStack_78 = 0; + local_140 = 0; + local_e8 = (ushort *******)0x0; + local_90 = 0; + uStack_88 = 0; + local_68 = (ushort ******)0x0; + pvStack_60 = (void *)0x0; + local_c0 = 0; + uStack_bc = 0; + uStack_b8 = 0; + local_b0 = (undefined8 *)0x0; + uStack_a8 = 0; + uStack_a4 = 0; + local_a0 = 0; + uStack_98 = uStack_98 & 0xffffffff00000000; + local_118 = (ushort ******)0x0; + pvStack_110 = (void *)0x0; + local_130 = 0; + local_d0 = 0; + lStack_c8 = 0; local_120 = (ushort *******)0x0; - local_100 = (ushort ******)0x0; - lStack_f8 = 0; - lVar13 = 0; - local_78 = 0; - uStack_70 = 0; - local_140 = 0; - local_108 = (ushort *******)0x0; - local_88 = 0; - uStack_80 = 0; - local_68 = (ushort ******)0x0; - uStack_60 = 0; - local_b8 = 0; - uStack_b0 = 0; - local_a8 = (undefined8 *)0x0; - uStack_a0 = 0; - local_98 = 0; - uStack_90 = uStack_90 & 0xffffffff00000000; - local_f0 = 0; - pvStack_e8 = (void *)0x0; - local_130 = 0; - local_c8 = 0; - lStack_c0 = 0; - local_128 = (ushort *******)0x0; - local_118 = (undefined8 *)0x0; + local_f8 = (undefined8 *)0x0; if (param_2 < 0x30) { return local_res8; } local_58 = (ushort *******)*param_1; uStack_50 = param_1[1]; local_48 = param_1[2]; uStack_40 = param_1[3]; local_38 = (uint *)param_1[4]; uStack_30 = param_1[5]; uVar7 = Feature_AppSiloBfsProcessSetPolicyRequestBufferCheck__private_IsEnabledDeviceUsageNoInline (); if (((int)uVar7 != 0) && ((uStack_40 & 1) != 0)) { return local_res8; } uVar2 = (ushort)uStack_40; uVar11 = (uint)(ushort)uStack_40; ProbeForRead(local_38,uVar11,2); if (uVar2 == 0) { return local_res8; } - pvStack_e8 = (void *)ExAllocatePool2(0x100,(ulonglong)uVar11,0x50736642); - if (pvStack_e8 == (void *)0x0) { + pvStack_110 = (void *)ExAllocatePool2(0x100,(ulonglong)uVar11,0x50736642); + if (pvStack_110 == (void *)0x0) { return local_res8; } - local_f0._0_4_ = CONCAT22((ushort)uStack_40,(ushort)uStack_40); - memmove(pvStack_e8,local_38,(ulonglong)uVar11); + local_118._0_4_ = CONCAT22((ushort)uStack_40,(ushort)uStack_40); + memcpy(pvStack_110,local_38,(ulonglong)uVar11); pppppppuVar9 = local_58; uVar5 = ObReferenceObjectByHandle(local_58,8,*(undefined8 *)SeTokenObjectType_exref,1); - lVar3 = lVar14; + lVar3 = lVar13; uVar11 = local_148[0]; if (-1 < (int)uVar5) { - pppppppuVar9 = local_128; - cVar4 = BfsIsApplicableToken(local_128,'\x01'); + pppppppuVar9 = local_120; + cVar4 = BfsIsApplicableToken(local_120,'\x01'); if (cVar4 == '\0') { uVar5 = 0xc000a200; uVar11 = local_148[0]; } else { - pppppppuVar9 = local_128; - uVar5 = SeQueryInformationToken(local_128,1,&local_118); - lVar3 = lVar13; + pppppppuVar9 = local_120; + uVar5 = SeQueryInformationToken(local_120,1,&local_f8); + lVar3 = lVar14; uVar11 = local_148[0]; if ((-1 < (int)uVar5) && - (pppppppuVar9 = local_128, uVar5 = SeQueryInformationToken(local_128,0x1f,&local_110), + (pppppppuVar9 = local_120, uVar5 = SeQueryInformationToken(local_120,0x1f,&local_f0), uVar11 = local_148[0], -1 < (int)uVar5)) { iVar1 = (int)uStack_50; - local_b8 = CONCAT44(local_b8._4_4_,0x30); - uStack_b0 = 0; - uStack_a0 = CONCAT44(uStack_a0._4_4_,0x600); - local_a8 = &local_f0; - local_98 = 0; - uStack_90 = 0; - pppppppuVar9 = (ushort *******)&local_120; - uVar5 = ZwOpenFile(pppppppuVar9,0x80000000,&local_b8,&local_88); + local_c0 = 0x30; + uStack_b8 = 0; + uStack_a8 = 0x600; + local_b0 = &local_118; + local_a0 = 0; + uStack_98 = 0; + pppppppuVar9 = (ushort *******)&local_128; + uVar5 = ZwOpenFile(pppppppuVar9,0x80000000,&local_c0,&local_90); + uVar7 = Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar7 != 0) && (uVar5 == 0xc0000279)) { + local_108 = (ushort ******)0x0; + pvStack_100 = (void *)0x0; + pppppppuVar9 = (ushort *******)&local_118; + uVar5 = BfsResolveReparseTarget(pppppppuVar9,(short *)&local_108); + if (-1 < (int)uVar5) { + ExFreePoolWithTag(pvStack_110,0); + local_118 = local_108; + pvStack_110 = pvStack_100; + local_c0 = 0x30; + uStack_b8 = 0; + uStack_a8 = 0x600; + local_b0 = &local_118; + local_a0 = 0; + uStack_98 = 0; + pppppppuVar9 = (ushort *******)&local_128; + uVar5 = ZwOpenFile(pppppppuVar9,0x80000000,&local_c0,&local_90); + } + } bVar15 = uVar5 == 0xc0000034; if (bVar15) { - pppppppuVar9 = (ushort *******)&local_120; - uVar5 = IoCreateFile(pppppppuVar9,0x80100000,&local_b8,&local_88); + pppppppuVar9 = (ushort *******)&local_128; + uVar5 = IoCreateFile(pppppppuVar9,0x80100000,&local_c0,&local_90); } - lVar3 = lVar14; + lVar3 = lVar13; uVar11 = local_148[0]; if (((-1 < (int)uVar5) && - (pppppppuVar9 = local_120, + (pppppppuVar9 = local_128, uVar5 = ObReferenceObjectByHandle - (local_120,0x80000000,*(undefined8 *)IoFileObjectType_exref,0), - lVar3 = lVar13, uVar11 = local_148[0], -1 < (int)uVar5)) && - (pppppppuVar9 = local_108, - uVar5 = FltGetFileNameInformationUnsafe(local_108,0,0x101,&local_140), + (local_128,0x80000000,*(undefined8 *)IoFileObjectType_exref,0), + lVar3 = lVar14, uVar11 = local_148[0], -1 < (int)uVar5)) && + (pppppppuVar9 = local_e8, + uVar5 = FltGetFileNameInformationUnsafe(local_e8,0,0x101,&local_140), uVar11 = local_148[0], -1 < (int)uVar5)) { - puVar8 = BfsGetFileName((ushort *)&local_d8,local_140); - local_100 = *(ushort *******)puVar8; - lStack_f8 = *(longlong *)(puVar8 + 4); - puVar8 = BfsGetShareName((ushort *)&local_d8,local_140); - local_c8 = *(undefined8 *)puVar8; - lStack_c0 = *(longlong *)(puVar8 + 4); + puVar8 = BfsGetFileName((ushort *)&local_108,local_140); + local_e0 = *(ushort *******)puVar8; + lStack_d8 = *(longlong *)(puVar8 + 4); + puVar8 = BfsGetShareName((ushort *)&local_108,local_140); + local_d0 = *(undefined8 *)puVar8; + lStack_c8 = *(longlong *)(puVar8 + 4); if (bVar15) { - pppppppuVar9 = (ushort *******)&local_d8; - puVar8 = BfsGetFinalPathComponent((ushort *)pppppppuVar9,&local_f0); - local_78 = *(undefined8 *)puVar8; - uStack_70 = *(undefined8 *)(puVar8 + 4); + pppppppuVar9 = (ushort *******)&local_108; + puVar8 = BfsGetFinalPathComponent((ushort *)pppppppuVar9,&local_118); + local_80 = *(undefined8 *)puVar8; + uStack_78 = *(undefined8 *)(puVar8 + 4); if (*puVar8 == 0) { - lVar3 = lVar14; + lVar3 = lVar13; uVar5 = 0xc000003a; uVar11 = local_148[0]; } else { - pppppppuVar9 = &local_100; + pppppppuVar9 = &local_e0; uVar5 = BfsAllocateAndConcatenatePath - ((short *)pppppppuVar9,(short *)&local_78,&local_100); - lVar14 = lStack_f8; + ((short *)pppppppuVar9,(short *)&local_80,&local_e0); + lVar13 = lStack_d8; uVar11 = local_148[0]; if (-1 < (int)uVar5) goto LAB_0; } } else { LAB_0: pppppppuVar9 = gBfsFilterHandle; - uVar7 = BfsGetPolicyEntry(gBfsFilterHandle,0,0x14001b2b0,(byte *)*local_118, - (byte *)*local_110,&local_130); - lVar3 = lVar14; + uVar7 = BfsGetPolicyEntry((longlong *)gBfsFilterHandle,0,0x14001b2d0,(byte *)*local_f8, + (byte *)*local_f0,&local_130); + lVar3 = lVar13; uVar5 = (uint)uVar7; uVar11 = local_148[0]; if (-1 < (int)(uint)uVar7) { if (((int)uStack_30 == 0) || ((int)uStack_30 == 1)) { - if ((lStack_c0 != 0) && - (iVar6 = RtlCompareUnicodeString(&local_100,&local_c8,1), iVar6 != 0)) { + if ((lStack_c8 != 0) && + (iVar6 = RtlCompareUnicodeString(&local_e0,&local_d0,1), iVar6 != 0)) { uVar7 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline (); if ((int)uVar7 == 0) { puVar12 = (undefined1 *)0x0; } else { puVar12 = local_138; } uVar7 = BfsGetPolicy(*(longlong *)(local_130 + 0x30),(ushort *)(local_140 + 0x18), - &local_c8,puVar12); + &local_d0,puVar12); if (1 < (int)uVar7 - 1U) { pppppppuVar9 = *(ushort ********)(local_130 + 0x30); uVar7 = BfsAddOrModifyEntry((longlong)pppppppuVar9,2,2,0, - (ushort *)(local_140 + 0x18),(short *)&local_c8); + (ushort *)(local_140 + 0x18),(short *)&local_d0); uVar5 = (uint)uVar7; uVar11 = local_148[0]; - if ((int)(uint)uVar7 < 0) goto joined_r0x00014000b1aa; + if ((int)(uint)uVar7 < 0) goto joined_r0x00014000b627; } } pppppppuVar9 = *(ushort ********)(local_130 + 0x30); uVar7 = BfsAddOrModifyEntry((longlong)pppppppuVar9,iVar1,uStack_50._4_4_, - (uint)local_48,(ushort *)(local_140 + 0x18), - (short *)&local_100); + (int)local_48,(ushort *)(local_140 + 0x18), + (short *)&local_e0); uVar5 = (uint)uVar7; uVar11 = local_148[0]; - if ((int)(uint)uVar7 < 0) goto joined_r0x00014000b1aa; + if ((int)(uint)uVar7 < 0) goto joined_r0x00014000b627; uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); uVar11 = local_148[0]; if ((int)uVar7 == 0) goto LAB_1; - uStack_d0 = *(undefined8 *)(local_140 + 0x10); + pvStack_100 = *(void **)(local_140 + 0x10); sVar10 = *(short *)(local_140 + 8) - *(short *)(local_140 + 0x48); - local_d8 = (ushort ******)(ulonglong)CONCAT22(sVar10,sVar10); - local_68 = local_d8; + local_108 = (ushort ******)(ulonglong)CONCAT22(sVar10,sVar10); + local_68 = local_108; pppppppuVar9 = (ushort *******)&gBfsGlobalFileTable; - uStack_60 = uStack_d0; + pvStack_60 = pvStack_100; uVar5 = BfsAddPolicyToGlobalFileTable - (0x14001b1e0,(byte *)*local_118,(byte *)*local_110, + (0x14001b200,(byte *)*local_f8,(byte *)*local_f0, (ushort *)&local_68,iVar1); } else { if ((int)uStack_30 != 2) goto LAB_1; pppppppuVar9 = *(ushort ********)(local_130 + 0x30); uVar7 = BfsDeleteEntry((longlong)pppppppuVar9,iVar1,(ushort *)(local_140 + 0x18), - &local_100); + &local_e0); uVar5 = (uint)uVar7; } uVar11 = local_148[0]; if (-1 < (int)uVar5) goto LAB_1; } } } } } } -joined_r0x00014000b1aa: +joined_r0x00014000b627: local_148[0] = uVar5; - lVar14 = lVar3; + lVar13 = lVar3; if (3 < DAT_2) { local_38 = local_148; uStack_30 = 4; _tlgWriteTransfer_EtwWriteTransfer(pppppppuVar9,&DAT_3); uVar11 = local_148[0]; } LAB_1: local_148[0] = uVar11; if (local_130 != 0) { BfsDereferencePolicyEntryEx(local_130,'\0'); } - if (lVar14 != 0) { - ExFreePoolWithTag(lVar14,0); + if (lVar13 != 0) { + ExFreePoolWithTag(lVar13,0); } if (local_140 != 0) { FltReleaseFileNameInformation(local_140); } - if (pvStack_e8 != (void *)0x0) { - ExFreePoolWithTag(pvStack_e8,0); + if (pvStack_110 != (void *)0x0) { + ExFreePoolWithTag(pvStack_110,0); + } + if (local_128 != (ushort *******)0x0) { + ZwClose(); + } + if (local_e8 != (ushort *******)0x0) { + ObfDereferenceObject(); } if (local_120 != (ushort *******)0x0) { - ZwClose(); - } - if (local_108 != (ushort *******)0x0) { ObfDereferenceObject(); } - if (local_128 != (ushort *******)0x0) { - ObfDereferenceObject(); - } - if (local_118 != (undefined8 *)0x0) { - ExFreePoolWithTag(local_118,0); - } - if (local_110 != (undefined8 *)0x0) { - ExFreePoolWithTag(local_110,0); + if (local_f8 != (undefined8 *)0x0) { + ExFreePoolWithTag(local_f8,0); + } + if (local_f0 != (undefined8 *)0x0) { + ExFreePoolWithTag(local_f0,0); } return local_res8; } ``` ## BfsRegistryPostCreateCallback ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.6| |i_ratio|0.53| |m_ratio|0.99| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsRegistryPostCreateCallback|BfsRegistryPostCreateCallback| |fullname|BfsRegistryPostCreateCallback|BfsRegistryPostCreateCallback| |refcount|2|2| |`length`|505|496| |`called`|
Expand for full list:
BfsAdjustRegistryKeySecurity
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObOpenObjectByPointer
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::SeQueryInformationToken
NTOSKRNL.EXE::ZwClose
__security_check_cookie_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsAdjustRegistryKeySecurity
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObOpenObjectByPointer
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::SeQueryInformationToken
NTOSKRNL.EXE::ZwClose
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsRegistryCallback|BfsRegistryCallback| |paramcount|3|3| |`address`|140010dc8|140011118| |sig|uint __fastcall BfsRegistryPostCreateCallback(undefined8 param_1, undefined8 * param_2, undefined8 * param_3)|uint __fastcall BfsRegistryPostCreateCallback(undefined8 param_1, undefined8 * param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsRegistryPostCreateCallback Called Diff ```diff --- BfsRegistryPostCreateCallback called +++ BfsRegistryPostCreateCallback called @@ -2 +1,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline ``` ### BfsRegistryPostCreateCallback Diff ```diff --- BfsRegistryPostCreateCallback +++ BfsRegistryPostCreateCallback @@ -1,94 +1,89 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ uint BfsRegistryPostCreateCallback(undefined8 param_1,undefined8 *param_2,undefined8 *param_3) { int *piVar1; longlong lVar2; undefined8 uVar3; uint uVar4; - ulonglong uVar5; - undefined8 *puVar6; + undefined8 *puVar5; undefined1 auStack_b8 [32]; undefined8 local_98; undefined1 *local_90; undefined8 **local_88; uint local_78 [2]; - longlong *local_70; - undefined8 *local_68; + undefined8 *local_70; + longlong *local_68; undefined1 local_60 [32]; uint *local_40; undefined4 local_38; undefined4 local_34; ulonglong local_30; local_30 = __security_cookie ^ (ulonglong)auStack_b8; piVar1 = (int *)param_2[4]; + local_70 = (undefined8 *)0x0; uVar4 = 0; - local_68 = (undefined8 *)0x0; - local_70 = (longlong *)0x0; + local_68 = (longlong *)0x0; if (piVar1 == (int *)0x0) goto LAB_0; lVar2 = param_2[2]; uVar4 = 0; if (*piVar1 != 0) { - local_88 = &local_68; + local_88 = &local_70; local_90 = (undefined1 *)((ulonglong)local_90 & 0xffffffffffffff00); local_98 = *(undefined8 *)CmKeyObjectType_exref; - puVar6 = *(undefined8 **)(piVar1 + 4); - uVar4 = ObOpenObjectByPointer(puVar6,0x200,0,piVar1[1]); + puVar5 = *(undefined8 **)(piVar1 + 4); + uVar4 = ObOpenObjectByPointer(puVar5,0x200,0,piVar1[1]); if ((int)uVar4 < 0) { LAB_1: if (3 < DAT_2) { local_34 = 0; local_40 = local_78; local_90 = local_60; local_38 = 4; local_78[0] = uVar4; - _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_3); + _tlgWriteTransfer_EtwWriteTransfer(puVar5,&DAT_3); } if ((uVar4 != 0xc0000503) && (*(longlong *)(piVar1 + 4) != 0)) { ObfDereferenceObject(); } } - else { - if (*piVar1 == 1) { - **(undefined8 **)(lVar2 + 0x48) = *(undefined8 *)(piVar1 + 4); - } - else { - if (*piVar1 != 2) goto LAB_4; - uVar4 = SeQueryInformationToken(param_3,0x1f,&local_70); - puVar6 = param_3; - if (((int)uVar4 < 0) || - (puVar6 = local_68, uVar4 = BfsAdjustRegistryKeySecurity(local_68,*local_70,piVar1[2]), - (int)uVar4 < 0)) goto LAB_1; - **(undefined8 **)(lVar2 + 0x48) = *(undefined8 *)(piVar1 + 4); - } + else if (*piVar1 == 1) { + **(undefined8 **)(lVar2 + 0x48) = *(undefined8 *)(piVar1 + 4); +LAB_4: uVar4 = 0xc0000503; *(int *)(lVar2 + 0x3c) = piVar1[1]; uVar3 = *(undefined8 *)(piVar1 + 4); *(undefined4 *)(param_2 + 3) = 0; *param_2 = uVar3; } + else if (*piVar1 == 2) { + uVar4 = SeQueryInformationToken(param_3,0x1f,&local_68); + puVar5 = param_3; + if (-1 < (int)uVar4) { + puVar5 = local_70; + uVar4 = BfsAdjustRegistryKeySecurity(local_70,*local_68,piVar1[2]); + if (-1 < (int)uVar4) { + **(undefined8 **)(lVar2 + 0x48) = *(undefined8 *)(piVar1 + 4); + goto LAB_4; + } + } + goto LAB_1; + } } -LAB_4: ExFreePoolWithTag(piVar1,0); - uVar5 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 != 0) { - uVar5 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 != 0) { - KeEnterCriticalRegion(); - } - ExReleaseRundownProtection(&gBfsRundownProtection); - KeLeaveCriticalRegion(); + KeEnterCriticalRegion(); + ExReleaseRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); +LAB_0: + if (local_68 != (longlong *)0x0) { + ExFreePoolWithTag(local_68,0); } -LAB_0: - if (local_70 != (longlong *)0x0) { - ExFreePoolWithTag(local_70,0); - } - if (local_68 != (undefined8 *)0x0) { + if (local_70 != (undefined8 *)0x0) { ZwClose(); } return uVar4; } ``` ## BfsInitializeGlobalFileTable ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.8| |i_ratio|0.73| |m_ratio|0.98| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsInitializeGlobalFileTable|BfsInitializeGlobalFileTable| |fullname|BfsInitializeGlobalFileTable|BfsInitializeGlobalFileTable| |refcount|2|2| |`length`|1140|1100| |`called`|
Expand for full list:
BfsGetRootDirectory
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsUninitializeGlobalFileTable
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializePushLock
NTOSKRNL.EXE::ExReleaseRundownProtectionNTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlCreateHashTable
NTOSKRNL.EXE::RtlDeleteHashTable
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::ZwQueryDirectoryFile
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsGetRootDirectory
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsUninitializeGlobalFileTable
Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializePushLock
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegionNTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlCreateHashTable
NTOSKRNL.EXE::RtlDeleteHashTable
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::ZwQueryDirectoryFile
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|DriverEntry|DriverEntry| |paramcount|3|3| |`address`|14000dedc|14000e55c| |sig|int __fastcall BfsInitializeGlobalFileTable(undefined8 param_1, undefined8 param_2, longlong param_3)|int __fastcall BfsInitializeGlobalFileTable(undefined8 param_1, undefined8 param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsInitializeGlobalFileTable Called Diff ```diff --- BfsInitializeGlobalFileTable called +++ BfsInitializeGlobalFileTable called @@ -4 +3,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline ``` ### BfsInitializeGlobalFileTable Diff ```diff --- BfsInitializeGlobalFileTable +++ BfsInitializeGlobalFileTable @@ -1,226 +1,213 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ int BfsInitializeGlobalFileTable(undefined8 param_1,undefined8 param_2,longlong param_3) { bool bVar1; char cVar2; char cVar3; int iVar4; - ulonglong uVar5; - longlong lVar6; - undefined8 uVar7; - undefined1 *puVar8; + longlong lVar5; + undefined8 uVar6; + undefined1 *puVar7; + ulonglong uVar8; longlong *plVar9; undefined1 *puVar10; undefined1 *puVar11; undefined1 auStack_198 [32]; undefined8 *local_178; undefined1 *local_170; undefined4 local_168; undefined4 local_160; bool local_158; undefined8 *local_150; undefined1 local_148; undefined4 local_138; undefined4 local_134; undefined4 local_130; int local_12c; undefined8 local_128; undefined8 uStack_120; undefined8 local_118; undefined8 uStack_110; undefined1 *local_108; undefined8 local_100; undefined8 uStack_f8; undefined1 local_f0 [32]; undefined4 *local_d0; undefined8 local_c8; undefined1 local_c0 [32]; undefined4 *local_a0; undefined8 local_98; undefined1 local_90 [32]; undefined4 *local_70; undefined8 local_68; undefined1 local_60 [32]; int *local_40; undefined8 local_38; ulonglong local_30; local_30 = __security_cookie ^ (ulonglong)auStack_198; local_108 = gBfsFilterHandle; + iVar4 = 0; bVar1 = false; local_118 = 0; uStack_110 = 0; local_128 = 0; uStack_120 = 0; local_100 = 0; uStack_f8 = 0; RtlInitUnicodeString(&local_128,L"S-1-*"); LOCK(); - lVar6 = *(longlong *)(param_3 + 0x40); - if (lVar6 == 0) { + lVar5 = *(longlong *)(param_3 + 0x40); + if (lVar5 == 0) { *(longlong *)(param_3 + 0x40) = -1; - lVar6 = 0; + lVar5 = 0; } UNLOCK(); - if (lVar6 == -1) { + if (lVar5 == -1) { local_178 = (undefined8 *)0x0; KeWaitForSingleObject(param_3 + 0x10,0,0,0); if ((*(longlong *)(param_3 + 0x40) != 0) && (*(longlong *)(param_3 + 0x40) != -1)) { return 0; } return -0x3fffffff; } - if (lVar6 != 0) { + if (lVar5 != 0) { return 0; } - iVar4 = 0; KeEnterCriticalRegion(); cVar2 = ExAcquireRundownProtection(&gBfsRundownProtection); - uVar5 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 == 0) { - if (cVar2 == '\0') { - KeLeaveCriticalRegion(); - iVar4 = 0; - goto LAB_0; - } - } - else { - KeLeaveCriticalRegion(); - if (cVar2 == '\0') goto LAB_0; - } + KeLeaveCriticalRegion(); + if (cVar2 == '\0') goto LAB_0; ExInitializePushLock(param_3); ExInitializePushLock(param_3 + 8); - lVar6 = ExAllocatePool2(0x100,0x28,0x54736642); + lVar5 = ExAllocatePool2(0x100,0x28,0x54736642); plVar9 = (longlong *)(param_3 + 0x28); - *plVar9 = lVar6; - if (lVar6 == 0) { + *plVar9 = lVar5; + if (lVar5 == 0) { iVar4 = -0x3fffffe9; if (3 < DAT_1) { local_138 = 0xc0000017; local_d0 = &local_138; local_170 = local_f0; local_c8 = 4; iVar4 = -0x3fffffe9; LAB_2: _tlgWriteTransfer_EtwWriteTransfer(plVar9,&DAT_3); } } else { cVar3 = RtlCreateHashTable(plVar9,0,0); if (cVar3 == '\0') { iVar4 = -0x3fffffff; if (3 < DAT_1) { local_a0 = &local_134; local_134 = 0xc0000001; local_170 = local_c0; local_98 = 4; iVar4 = -0x3fffffff; goto LAB_2; } } else { - lVar6 = param_3 + 0x30; + lVar5 = param_3 + 0x30; bVar1 = true; - *(longlong *)(param_3 + 0x38) = lVar6; - *(longlong *)lVar6 = lVar6; - uVar7 = BfsGetRootDirectory(); + *(longlong *)(param_3 + 0x38) = lVar5; + *(longlong *)lVar5 = lVar5; + uVar6 = BfsGetRootDirectory(); plVar9 = (longlong *)0x100; - puVar8 = (undefined1 *)ExAllocatePool2(0x100,0x186,0x4e736642); - uVar5 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar5 == 0) || (puVar8 != (undefined1 *)0x0)) { - uVar5 = Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline(); + puVar7 = (undefined1 *)ExAllocatePool2(0x100,0x186,0x4e736642); + uVar8 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar8 == 0) || (puVar7 != (undefined1 *)0x0)) { + uVar8 = Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline(); local_148 = 1; - local_158 = (int)uVar5 != 0; + local_158 = (int)uVar8 != 0; while( true ) { local_150 = &local_128; local_178 = &local_118; local_160 = 0xc; local_168 = 0x186; - local_170 = puVar8; - iVar4 = ZwQueryDirectoryFile(uVar7,0,0,0); + local_170 = puVar7; + iVar4 = ZwQueryDirectoryFile(uVar6,0,0,0); if (iVar4 < 0) break; - if (*(uint *)(puVar8 + 8) != 0) { - puVar11 = puVar8 + 0xc; - *(undefined2 *)(puVar8 + (ulonglong)(*(uint *)(puVar8 + 8) >> 1) * 2 + 0xc) = 0; + if (*(uint *)(puVar7 + 8) != 0) { + puVar11 = puVar7 + 0xc; + *(undefined2 *)(puVar7 + (ulonglong)(*(uint *)(puVar7 + 8) >> 1) * 2 + 0xc) = 0; RtlInitUnicodeString(&local_100); puVar10 = local_108; iVar4 = BfsLoadUserPolicyEntriesToGlobalFileTable (local_108,puVar11,param_3,(longlong)&local_100); if (iVar4 < 0) { if (3 < DAT_1) { local_40 = &local_12c; local_170 = local_60; local_38 = 4; local_12c = iVar4; _tlgWriteTransfer_EtwWriteTransfer(puVar10,&DAT_3); } goto LAB_4; } } - uVar5 = Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline(); + uVar8 = Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline(); local_148 = 0; - if ((int)uVar5 == 0) { + if ((int)uVar8 == 0) { local_158 = false; } else { local_158 = true; } } if ((iVar4 == -0x7ffffffa) || (iVar4 == -0x3ffffff1)) { iVar4 = 0; } LOCK(); *(undefined8 *)(param_3 + 0x40) = 1; UNLOCK(); LAB_4: - if (puVar8 != (undefined1 *)0x0) { - ExFreePoolWithTag(puVar8,0); + if (puVar7 != (undefined1 *)0x0) { + ExFreePoolWithTag(puVar7,0); } if (-1 < iVar4) goto LAB_0; } else { iVar4 = -0x3fffffe9; if (3 < DAT_1) { local_130 = 0xc0000017; local_70 = &local_130; local_170 = local_90; local_68 = 4; iVar4 = -0x3fffffe9; goto LAB_2; } } } } - uVar5 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 == 0) { + uVar8 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 == 0) { if (*(longlong *)(param_3 + 0x28) != 0) { if (bVar1) { RtlDeleteHashTable(); } ExFreePoolWithTag(*(undefined8 *)(param_3 + 0x28),0); *(undefined8 *)(param_3 + 0x28) = 0; } LOCK(); *(undefined8 *)(param_3 + 0x40) = 0; UNLOCK(); } else { BfsUninitializeGlobalFileTable(param_3); } LAB_0: KeSetEvent(param_3 + 0x10,0,0); if (cVar2 != '\0') { - uVar5 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 != 0) { - KeEnterCriticalRegion(); - } + KeEnterCriticalRegion(); ExReleaseRundownProtection(&gBfsRundownProtection); KeLeaveCriticalRegion(); return iVar4; } return iVar4; } ``` ## BfsReleaseNamedPipeMapping ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.39| |i_ratio|0.64| |m_ratio|0.81| |b_ratio|0.7| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsReleaseNamedPipeMapping|BfsReleaseNamedPipeMapping| |fullname|BfsReleaseNamedPipeMapping|BfsReleaseNamedPipeMapping| |refcount|5|5| |`length`|307|209| |`called`|BfsRemoveEntryHashTable
Feature_752421176__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlFreeUnicodeString|BfsRemoveEntryHashTable
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlFreeUnicodeString| |calling|BfsNamedPipeStreamHandleCleanup
BfsPostCreatePipeOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation|BfsNamedPipeStreamHandleCleanup
BfsPostCreatePipeOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation| |paramcount|2|2| |`address`|14000cef4|14000d624| |sig|undefined __fastcall BfsReleaseNamedPipeMapping(longlong param_1, longlong param_2)|undefined __fastcall BfsReleaseNamedPipeMapping(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsReleaseNamedPipeMapping Called Diff ```diff --- BfsReleaseNamedPipeMapping called +++ BfsReleaseNamedPipeMapping called @@ -2 +1,0 @@ -Feature_752421176__private_IsEnabledDeviceUsageNoInline ``` ### BfsReleaseNamedPipeMapping Diff ```diff --- BfsReleaseNamedPipeMapping +++ BfsReleaseNamedPipeMapping @@ -1,48 +1,29 @@ void BfsReleaseNamedPipeMapping(longlong param_1,longlong param_2) { int *piVar1; int iVar2; - ulonglong uVar3; - uVar3 = Feature_752421176__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 != 0) { - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_1,0); - } + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(param_1,0); LOCK(); piVar1 = (int *)(param_2 + 0x18); iVar2 = *piVar1; *piVar1 = *piVar1 + -1; UNLOCK(); - if (iVar2 == 1) { - uVar3 = Feature_752421176__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 == 0) { - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_1,0); + if ((iVar2 == 1) && (*(int *)(param_2 + 0x18) == 0)) { + if ((*(uint *)(param_2 + 0x1c) & 1) != 0) { + BfsRemoveEntryHashTable(*(undefined8 *)(param_1 + 8),param_2); } - if (*(int *)(param_2 + 0x18) == 0) { - if ((*(uint *)(param_2 + 0x1c) & 1) != 0) { - BfsRemoveEntryHashTable(*(undefined8 *)(param_1 + 8),param_2); - } - ExFreePoolWithTag(*(undefined8 *)(param_2 + 0x20),0); - ExFreePoolWithTag(*(undefined8 *)(param_2 + 0x28),0); - RtlFreeUnicodeString(param_2 + 0x30); - RtlFreeUnicodeString(param_2 + 0x40); - ExFreePoolWithTag(param_2,0); - } - uVar3 = Feature_752421176__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 == 0) { - ExReleasePushLockExclusiveEx(param_1,0); - KeLeaveCriticalRegion(); - } + ExFreePoolWithTag(*(undefined8 *)(param_2 + 0x20),0); + ExFreePoolWithTag(*(undefined8 *)(param_2 + 0x28),0); + RtlFreeUnicodeString(param_2 + 0x30); + RtlFreeUnicodeString(param_2 + 0x40); + ExFreePoolWithTag(param_2,0); } - uVar3 = Feature_752421176__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 != 0) { - ExReleasePushLockExclusiveEx(param_1,0); - KeLeaveCriticalRegion(); - } + ExReleasePushLockExclusiveEx(param_1,0); + KeLeaveCriticalRegion(); return; } ``` ## BfsPostCleanupOperation ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.96| |i_ratio|0.88| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsPostCleanupOperation|BfsPostCleanupOperation| |fullname|BfsPostCleanupOperation|BfsPostCleanupOperation| |refcount|4|4| |`length`|861|843| |`called`|
Expand for full list:
BfsProcessDelete
FLTMGR.SYS::FltFsControlFile
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReleaseContext
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
Feature_2210080059__private_IsEnabledDeviceUsageNoInline
Feature_BfsCleanupDeleteCheck__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegionNTOSKRNL.EXE::KeLeaveCriticalRegion
__security_check_cookie
|
Expand for full list:
BfsProcessDelete
FLTMGR.SYS::FltFsControlFile
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltReleaseContext
Feature_BfsCleanupDeleteCheck__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
__security_check_cookie
| |calling||| |paramcount|3|3| |address|140001780|140001780| |sig|undefined8 __fastcall BfsPostCleanupOperation(longlong param_1, longlong param_2, char * param_3)|undefined8 __fastcall BfsPostCleanupOperation(longlong param_1, longlong param_2, char * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsPostCleanupOperation Called Diff ```diff --- BfsPostCleanupOperation called +++ BfsPostCleanupOperation called @@ -5,2 +4,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline -Feature_2210080059__private_IsEnabledDeviceUsageNoInline ``` ### BfsPostCleanupOperation Diff ```diff --- BfsPostCleanupOperation +++ BfsPostCleanupOperation @@ -1,159 +1,153 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined8 BfsPostCleanupOperation(longlong param_1,longlong param_2,char *param_3) { int iVar1; ulonglong uVar2; undefined8 uVar3; ushort *puVar4; int iVar5; undefined1 auStack_118 [32]; undefined4 local_f8; ushort **local_f0; undefined4 local_e8; undefined8 local_e0; int local_d8; int local_d4; undefined4 local_d0; undefined4 local_cc; undefined8 local_c8; undefined8 local_c0; undefined8 uStack_b8; undefined8 local_b0; ushort *local_a8; undefined8 uStack_a0; undefined8 local_98; undefined8 uStack_90; undefined8 local_88; undefined8 uStack_80; undefined8 local_78; undefined8 uStack_70; ushort *local_68; uint local_60; undefined4 local_5c; undefined *local_58; undefined4 local_50; undefined4 local_4c; int *local_48; undefined8 local_40; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStack_118; puVar4 = (ushort *)0x0; local_b0 = 0; local_c0 = 0; uStack_b8 = 0; local_a8 = (ushort *)0x0; uStack_a0 = 0; local_98 = 0; uStack_90 = 0; local_88 = 0; uStack_80 = 0; local_78 = 0; uStack_70 = 0; iVar5 = 0; if (param_3 == (char *)0x0) goto LAB_0; if (*param_3 != '\0') { uVar2 = Feature_BfsCleanupDeleteCheck__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar2 == 0) { local_f0 = (ushort **)0x0; local_f8 = 5; iVar1 = FltQueryInformationFile (*(undefined8 *)(param_2 + 0x18), *(undefined8 *)(*(longlong *)(param_1 + 0x10) + 8),&local_c0,0x18); if (iVar1 == -0x3ffffedd) { local_f0 = &local_a8; local_e0 = 0; local_e8 = 0x40; local_f8 = 0; iVar1 = FltFsControlFile(*(undefined8 *)(param_2 + 0x18), *(undefined8 *)(*(longlong *)(param_1 + 0x10) + 8),0x9009c,0); if (iVar1 == -0x3ffffedd) { uVar2 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar2 != 0) { puVar4 = (ushort *)(*(longlong *)(param_3 + 8) + 8); } uVar3 = BfsProcessDelete(puVar4); iVar1 = (int)uVar3; if ((int)uVar3 < 0) { joined_r0x000140001a3e: iVar5 = iVar1; if (3 < DAT_1) { local_40 = 4; local_48 = &local_d4; local_cc = 3; local_d0 = 0xb000000; local_c8 = 0; local_60 = (uint)*(ushort *)PTR_DAT_2; local_58 = &DAT_3; local_5c = 2; local_50 = 0x1e; local_4c = 1; local_d8 = 0x73; local_f0 = &local_68; local_f8 = 3; local_d4 = iVar5; local_68 = (ushort *)PTR_DAT_2; EtwWriteTransfer(DAT_4,&local_d0,0,0); } goto LAB_0; } } else if (((iVar1 + 0x80000000U & 0x80000000) == 0) && (iVar1 != -0x3ffffd10)) goto joined_r0x000140001a3e; } } else if ((*(byte *)(param_1 + 0x20) & 4) != 0) { uVar2 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar2 != 0) { puVar4 = (ushort *)(*(longlong *)(param_3 + 8) + 8); } uVar3 = BfsProcessDelete(puVar4); iVar1 = (int)uVar3; if (iVar1 < 0) { iVar5 = iVar1; if (3 < DAT_1) { local_40 = 4; local_48 = &local_d8; local_68 = (ushort *)PTR_DAT_2; local_cc = 3; local_d0 = 0xb000000; local_c8 = 0; local_60 = (uint)*(ushort *)PTR_DAT_2; local_58 = &DAT_3; local_5c = 2; local_50 = 0x1e; local_4c = 1; local_d4 = 0x73; local_f0 = &local_68; local_f8 = 3; local_d8 = iVar1; EtwWriteTransfer(DAT_4,&local_d0,0,0); } goto LAB_0; } } } uVar2 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar2 == 0) { FltReleaseContext(param_3); } LAB_0: - uVar2 = Feature_2210080059__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar2 != 0) { - uVar2 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar2 != 0) { - KeEnterCriticalRegion(); - } - ExReleaseRundownProtection(&gBfsRundownProtection); - KeLeaveCriticalRegion(); - } + KeEnterCriticalRegion(); + ExReleaseRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); uVar2 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((((int)uVar2 != 0) || (iVar5 < 0)) && (param_3 != (char *)0x0)) { FltReleaseContext(param_3); } return 0; } ``` ## BfsIdleCheckWorkitemRoutine ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.47| |i_ratio|0.61| |m_ratio|0.88| |b_ratio|0.8| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsIdleCheckWorkitemRoutine|BfsIdleCheckWorkitemRoutine| |fullname|BfsIdleCheckWorkitemRoutine|BfsIdleCheckWorkitemRoutine| |refcount|3|3| |`length`|176|152| |`called`|BfsCheckAndReleaseIdlePolicy
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion|BfsCheckAndReleaseIdlePolicy
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion| |calling||| |paramcount|3|3| |`address`|140007fd0|140008300| |sig|undefined __fastcall BfsIdleCheckWorkitemRoutine(undefined8 param_1, longlong param_2, undefined8 param_3)|undefined __fastcall BfsIdleCheckWorkitemRoutine(undefined8 param_1, longlong param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsIdleCheckWorkitemRoutine Called Diff ```diff --- BfsIdleCheckWorkitemRoutine called +++ BfsIdleCheckWorkitemRoutine called @@ -2 +1,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline ``` ### BfsIdleCheckWorkitemRoutine Diff ```diff --- BfsIdleCheckWorkitemRoutine +++ BfsIdleCheckWorkitemRoutine @@ -1,30 +1,19 @@ void BfsIdleCheckWorkitemRoutine(undefined8 param_1,longlong param_2,undefined8 param_3) { char cVar1; - ulonglong uVar2; KeEnterCriticalRegion(); cVar1 = ExAcquireRundownProtection(&gBfsRundownProtection); - uVar2 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar2 == 0) { - if (cVar1 != '\0') goto LAB_0; + KeLeaveCriticalRegion(); + if (cVar1 != '\0') { + BfsCheckAndReleaseIdlePolicy(param_2); + KeEnterCriticalRegion(); + ExReleaseRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); } - else { - KeLeaveCriticalRegion(); - if (cVar1 == '\0') goto LAB_1; -LAB_0: - BfsCheckAndReleaseIdlePolicy(param_2); - uVar2 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar2 != 0) { - KeEnterCriticalRegion(); - } - ExReleaseRundownProtection(&gBfsRundownProtection); - } - KeLeaveCriticalRegion(); -LAB_1: IoFreeWorkItem(param_3); return; } ``` ## BfsGetPolicy ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.43| |i_ratio|0.6| |m_ratio|0.96| |b_ratio|0.84| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsGetPolicy|BfsGetPolicy| |fullname|BfsGetPolicy|BfsGetPolicy| |`refcount`|5|8| |`length`|571|625| |`called`|BfsCreateDirectory
BfsDereferenceTableEntry
BfsFindEntry
BfsGetPathComponent
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion|BfsCreateDirectory
BfsDereferenceTableEntry
BfsFindEntry
BfsGetPathComponent
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion| |`calling`|BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsProcessSetPolicyRequest|BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsProcessHardLink
BfsProcessSetPolicyRequest| |paramcount|4|4| |`address`|1400076cc|1400079a4| |sig|ulonglong __fastcall BfsGetPolicy(longlong param_1, ushort * param_2, undefined8 * param_3, undefined1 * param_4)|ulonglong __fastcall BfsGetPolicy(longlong param_1, ushort * param_2, undefined8 * param_3, undefined1 * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsGetPolicy Called Diff ```diff --- BfsGetPolicy called +++ BfsGetPolicy called @@ -5,0 +6 @@ +Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline ``` ### BfsGetPolicy Calling Diff ```diff --- BfsGetPolicy calling +++ BfsGetPolicy calling @@ -2,0 +3 @@ +BfsProcessHardLink ``` ### BfsGetPolicy Diff ```diff --- BfsGetPolicy +++ BfsGetPolicy @@ -1,98 +1,118 @@ ulonglong BfsGetPolicy(longlong param_1,ushort *param_2,undefined8 *param_3,undefined1 *param_4) { uint uVar1; uint uVar2; ulonglong uVar3; - ushort *puVar4; - longlong lVar5; - int iVar6; - ulonglong uVar7; - longlong lVar8; - uint uVar9; + ulonglong uVar4; + int *piVar5; + ushort *puVar6; + longlong lVar7; + int iVar8; + longlong lVar9; + ulonglong uVar10; + ulonglong uVar11; longlong local_res8; undefined8 local_58; undefined8 uStack_50; - ushort local_48 [16]; + ushort local_48 [8]; + undefined8 local_38; + wchar_t *local_30; local_58 = *param_3; uStack_50 = param_3[1]; - uVar7 = 0; + uVar11 = 0; local_res8 = 0; local_48[0] = 0; local_48[1] = 0; local_48[2] = 0; local_48[3] = 0; local_48[4] = 0; local_48[5] = 0; local_48[6] = 0; local_48[7] = 0; uVar3 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar3 != 0) { *param_4 = 0; } uVar3 = BfsCreateDirectory(param_1 + 0x30,param_2,1,&local_res8); - lVar8 = local_res8; if ((int)uVar3 < 0) { return 0; } - uVar9 = 0; - puVar4 = BfsGetPathComponent(local_48 + 8,&local_58,(undefined8 *)local_48); - local_58 = *(undefined8 *)puVar4; - uStack_50 = *(undefined8 *)(puVar4 + 4); + uVar4 = Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline(); + lVar9 = local_res8; + uVar3 = uVar11; + uVar10 = uVar11; + if ((int)uVar4 != 0) { + local_38 = 0; + local_30 = L""; + KeEnterCriticalRegion(); + ExAcquirePushLockSharedEx(lVar9,0); + piVar5 = (int *)BfsFindEntry(lVar9,&local_38); + ExReleasePushLockSharedEx(lVar9,0); + KeLeaveCriticalRegion(); + uVar3 = 0; + uVar10 = 0; + if ((piVar5 != (int *)0x0) && (*piVar5 == 2)) { + uVar3 = (ulonglong)(uint)piVar5[1]; + uVar10 = (ulonglong)(uint)piVar5[2]; + } + } + local_res8 = lVar9; + puVar6 = BfsGetPathComponent((ushort *)&local_38,&local_58,(undefined8 *)local_48); + local_58 = *(undefined8 *)puVar6; + uStack_50 = *(undefined8 *)(puVar6 + 4); KeEnterCriticalRegion(); - ExAcquirePushLockSharedEx(lVar8,0); - lVar5 = BfsFindEntry(lVar8,local_48); - ExReleasePushLockSharedEx(lVar8,0); - KeLeaveCriticalRegion(); - while (iVar6 = (int)uVar7, lVar5 != 0) { - uVar1 = *(uint *)(lVar5 + 8); - uVar2 = uVar1 | uVar9; - uVar9 = uVar1 & 0xfffffffe; + while( true ) { + ExAcquirePushLockSharedEx(lVar9,0); + lVar7 = BfsFindEntry(lVar9,local_48); + ExReleasePushLockSharedEx(lVar9,0); + KeLeaveCriticalRegion(); + iVar8 = (int)uVar3; + if (lVar7 == 0) break; + uVar1 = *(uint *)(lVar7 + 8); + uVar2 = uVar1 & 0xfffffffe; if ((uVar1 & 1) == 0) { - uVar9 = uVar2; + uVar2 = uVar1 | (uint)uVar10; } - uVar3 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 == 0) { - uVar7 = (ulonglong)*(uint *)(lVar5 + 4); + uVar10 = (ulonglong)uVar2; + uVar4 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + uVar3 = (ulonglong)*(uint *)(lVar7 + 4); } - else if ((((uVar9 & 2) == 0) || (iVar6 == 0)) || (iVar6 == 3)) { - uVar7 = (ulonglong)*(uint *)(lVar5 + 4); + else if ((((uVar2 & 2) == 0) || (iVar8 == 0)) || (iVar8 == 3)) { + uVar3 = (ulonglong)*(uint *)(lVar7 + 4); } - else if ((iVar6 == 2) && (*(uint *)(lVar5 + 4) == 1)) { - uVar7 = 1; + else if ((iVar8 == 2) && (*(uint *)(lVar7 + 4) == 1)) { + uVar3 = 1; } if ((ushort)local_58 < 2) goto LAB_0; - uVar3 = BfsCreateDirectory(lVar8,local_48,1,&local_res8); - if ((int)uVar3 < 0) { - BfsDereferenceTableEntry((undefined8 *)(lVar8 + -8)); - return uVar3 & 0xffffffff; + uVar4 = BfsCreateDirectory(lVar9,local_48,1,&local_res8); + if ((int)uVar4 < 0) { + BfsDereferenceTableEntry((undefined8 *)(lVar9 + -8)); + return uVar4 & 0xffffffff; } - BfsDereferenceTableEntry((undefined8 *)(lVar8 + -8)); - puVar4 = BfsGetPathComponent(local_48 + 8,&local_58,(undefined8 *)local_48); - local_58 = *(undefined8 *)puVar4; - uStack_50 = *(undefined8 *)(puVar4 + 4); + BfsDereferenceTableEntry((undefined8 *)(lVar9 + -8)); + puVar6 = BfsGetPathComponent((ushort *)&local_38,&local_58,(undefined8 *)local_48); + local_58 = *(undefined8 *)puVar6; + uStack_50 = *(undefined8 *)(puVar6 + 4); KeEnterCriticalRegion(); - lVar8 = local_res8; - ExAcquirePushLockSharedEx(local_res8,0); - lVar5 = BfsFindEntry(lVar8,local_48); - ExReleasePushLockSharedEx(lVar8,0); - KeLeaveCriticalRegion(); + lVar9 = local_res8; } - uVar3 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 == 0) { - if (((ushort)local_58 < 2) || ((uVar9 & 2) != 0)) goto LAB_0; + uVar4 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + if (((ushort)local_58 < 2) || ((uVar10 & 2) != 0)) goto LAB_0; } - else if (((ushort)local_58 < 2) || ((uVar9 & 2) != 0)) { - if ((iVar6 - 1U < 2) && ((uVar9 & 2) != 0)) { + else if (((ushort)local_58 < 2) || ((uVar10 & 2) != 0)) { + if ((iVar8 - 1U < 2) && ((uVar10 & 2) != 0)) { *param_4 = 1; } goto LAB_0; } - uVar7 = 0; + uVar3 = uVar11; LAB_0: - BfsDereferenceTableEntry((undefined8 *)(lVar8 + -8)); - return uVar7; + BfsDereferenceTableEntry((undefined8 *)(lVar9 + -8)); + return uVar3; } ``` ## BfsAddOrModifyEntry ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.24| |i_ratio|0.46| |m_ratio|0.97| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsAddOrModifyEntry|BfsAddOrModifyEntry| |fullname|BfsAddOrModifyEntry|BfsAddOrModifyEntry| |refcount|6|6| |`length`|660|708| |`called`|
Expand for full list:
BfsCreateDirectory
BfsDereferenceTableEntry
BfsFindEntry
BfsGetEntryBlock
BfsGetPathComponent
BfsInsertDirectoryEntry
BfsWriteBlock
Feature_AppSiloBfsInsertEntryValidityCheck__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAcquirePushLockSharedExNTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
|
Expand for full list:
BfsCreateDirectory
BfsDereferenceTableEntry
BfsFindEntry
BfsGetEntryBlock
BfsGetPathComponent
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsWriteBlock
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveExNTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
| |calling|BfsCheckAndApplyPolicy
BfsPerformPrompt
BfsPostCreateOperation
BfsProcessSetPolicyRequest|BfsCheckAndApplyPolicy
BfsPerformPrompt
BfsPostCreateOperation
BfsProcessSetPolicyRequest| |paramcount|6|6| |`address`|1400124fc|14001267c| |`sig`|ulonglong __fastcall BfsAddOrModifyEntry(longlong param_1, int param_2, uint param_3, uint param_4, ushort * param_5, short * param_6)|ulonglong __fastcall BfsAddOrModifyEntry(longlong param_1, int param_2, uint param_3, int param_4, ushort * param_5, short * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsAddOrModifyEntry Called Diff ```diff --- BfsAddOrModifyEntry called +++ BfsAddOrModifyEntry called @@ -6,0 +7 @@ +BfsInsertDirectoryEntry_OLD @@ -8 +9 @@ -Feature_AppSiloBfsInsertEntryValidityCheck__private_IsEnabledDeviceUsageNoInline +Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline ``` ### BfsAddOrModifyEntry Diff ```diff --- BfsAddOrModifyEntry +++ BfsAddOrModifyEntry @@ -1,124 +1,136 @@ -ulonglong BfsAddOrModifyEntry(longlong param_1,int param_2,uint param_3,uint param_4,ushort *param_5 - ,short *param_6) +ulonglong BfsAddOrModifyEntry(longlong param_1,int param_2,uint param_3,int param_4,ushort *param_5, + short *param_6) { - ushort uVar1; - bool bVar2; - int iVar3; - ulonglong uVar4; - ushort *puVar5; - longlong lVar6; - ulonglong uVar7; - uint uVar8; - short *psVar9; - short *psVar10; + int iVar1; + ushort uVar2; + bool bVar3; + bool bVar4; + ulonglong uVar5; + ushort *puVar6; + longlong lVar7; + ulonglong uVar8; + undefined8 *puVar9; + ulonglong uVar10; uint uVar11; - longlong local_88; - ushort local_80 [8]; - undefined8 local_70; - undefined8 uStack_68; - ushort local_60 [20]; + int iVar12; + ulonglong local_88; + longlong local_80; + ushort local_78 [8]; + undefined8 local_68; + undefined8 uStack_60; + ushort local_58 [16]; - psVar9 = param_6; - param_6 = (short *)0x0; - local_80[0] = 0; - local_80[1] = 0; - local_80[2] = 0; - local_80[3] = 0; - local_80[4] = 0; - local_80[5] = 0; - local_80[6] = 0; - local_80[7] = 0; - local_70 = *(undefined8 *)psVar9; - uStack_68 = *(undefined8 *)(psVar9 + 4); - if (((*psVar9 == 0) && (param_3 == 1)) && (param_4 == 2)) { - uVar4 = 0xc000000d; + local_88 = 0; + local_78[0] = 0; + local_78[1] = 0; + local_78[2] = 0; + local_78[3] = 0; + local_78[4] = 0; + local_78[5] = 0; + local_78[6] = 0; + local_78[7] = 0; + local_68 = *(undefined8 *)param_6; + uStack_60 = *(undefined8 *)(param_6 + 4); + if (((*param_6 == 0) && (param_3 == 1)) && (param_4 == 2)) { + uVar5 = 0xc000000d; } else { - uVar4 = BfsCreateDirectory(param_1 + 0x30,param_5,3,(longlong *)¶m_6); - if (-1 < (int)uVar4) { - bVar2 = true; - psVar9 = param_6; - uVar4 = uVar4 & 0xffffffff; + uVar5 = BfsCreateDirectory(param_1 + 0x30,param_5,3,(longlong *)&local_88); + if (-1 < (int)uVar5) { + bVar3 = true; + bVar4 = true; + uVar10 = local_88; + uVar5 = uVar5 & 0xffffffff; do { - puVar5 = BfsGetPathComponent(local_60,&local_70,(undefined8 *)local_80); - uVar1 = *puVar5; - local_70 = *(undefined8 *)puVar5; - uStack_68 = *(undefined8 *)(puVar5 + 4); + puVar6 = BfsGetPathComponent(local_58,&local_68,(undefined8 *)local_78); + uVar2 = *puVar6; + local_68 = *(undefined8 *)puVar6; + uStack_60 = *(undefined8 *)(puVar6 + 4); KeEnterCriticalRegion(); - ExAcquirePushLockSharedEx(psVar9,0); - lVar6 = BfsFindEntry((longlong)psVar9,local_80); - ExReleasePushLockSharedEx(psVar9,0); + ExAcquirePushLockSharedEx(uVar10,0); + lVar7 = BfsFindEntry(uVar10,local_78); + ExReleasePushLockSharedEx(uVar10,0); KeLeaveCriticalRegion(); - if (lVar6 == 0) { - iVar3 = 2; - uVar8 = 0; - uVar11 = uVar8; - if (uVar1 < 2) { - bVar2 = false; - uVar8 = param_3; - uVar11 = param_4; - iVar3 = param_2; + if (lVar7 == 0) { + uVar11 = 0; + iVar12 = 0; + bVar3 = bVar4; + if (uVar2 < 2) { + bVar3 = false; + uVar11 = param_3; + iVar12 = param_4; } - lVar6 = BfsInsertDirectoryEntry((longlong)psVar9,iVar3,uVar8,uVar11,local_80); - uVar7 = Feature_AppSiloBfsInsertEntryValidityCheck__private_IsEnabledDeviceUsageNoInline() - ; - if (((int)uVar7 != 0) && (lVar6 == 0)) { - uVar4 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar4 != 0) { - BfsDereferenceTableEntry((undefined8 *)(psVar9 + -4)); + uVar8 = Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 == 0) { + iVar1 = 2; + if (uVar2 < 2) { + iVar1 = param_2; + } + lVar7 = BfsInsertDirectoryEntry_OLD(uVar10,iVar1,uVar11,iVar12,local_78); + } + else { + iVar1 = 2; + if (uVar2 < 2) { + iVar1 = param_2; + } + lVar7 = BfsInsertDirectoryEntry(uVar10,iVar1,uVar11,iVar12,0,local_78); + } + bVar4 = bVar3; + if (lVar7 == 0) { + uVar5 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 != 0) { + BfsDereferenceTableEntry((undefined8 *)(uVar10 - 8)); } return 0xc0000017; } } - if (uVar1 < 2) { - psVar10 = psVar9; - if (bVar2) { - param_6 = (short *)((ulonglong)param_6 & 0xffffffff00000000); - local_88 = 0; + if (uVar2 < 2) { + if (bVar3) { + local_88 = local_88 & 0xffffffff00000000; + local_80 = 0; KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(psVar9,0); - *(uint *)(lVar6 + 4) = param_3; - *(uint *)(lVar6 + 8) = param_4; - uVar7 = BfsGetEntryBlock((longlong)psVar9,lVar6,&local_88,(undefined4 *)¶m_6); - psVar10 = (short *)0x0; - uVar4 = uVar7 & 0xffffffff; - if ((int)uVar7 < 0) { - ExReleasePushLockExclusiveEx(psVar9,0); + ExAcquirePushLockExclusiveEx(uVar10,0); + *(uint *)(lVar7 + 4) = param_3; + *(int *)(lVar7 + 8) = param_4; + uVar8 = BfsGetEntryBlock(uVar10,lVar7,&local_80,(undefined4 *)&local_88); + uVar5 = uVar8 & 0xffffffff; + if ((int)uVar8 < 0) { + ExReleasePushLockExclusiveEx(uVar10,0); KeLeaveCriticalRegion(); goto LAB_0; } - uVar7 = BfsWriteBlock(param_1,(int)param_6,local_88); - uVar4 = uVar7 & 0xffffffff; - ExReleasePushLockExclusiveEx(psVar9,0); + uVar8 = BfsWriteBlock(param_1,(int)local_88,local_80); + uVar5 = uVar8 & 0xffffffff; + ExReleasePushLockExclusiveEx(uVar10,0); KeLeaveCriticalRegion(); - BfsDereferenceTableEntry((undefined8 *)(psVar9 + -4)); - param_6 = (short *)0x0; - if ((int)uVar7 < 0) { - return uVar4; + BfsDereferenceTableEntry((undefined8 *)(uVar10 - 8)); + uVar10 = 0; + local_88 = 0; + if ((int)uVar8 < 0) { + return uVar5; } } } else { - uVar7 = BfsCreateDirectory((longlong)psVar9,local_80,1,(longlong *)¶m_6); - psVar9 = psVar9 + -4; - uVar4 = uVar7 & 0xffffffff; - if ((int)uVar7 < 0) goto LAB_1; - BfsDereferenceTableEntry((undefined8 *)psVar9); - psVar10 = param_6; + uVar8 = BfsCreateDirectory(uVar10,local_78,1,(longlong *)&local_88); + puVar9 = (undefined8 *)(uVar10 - 8); + uVar5 = uVar8 & 0xffffffff; + if ((int)uVar8 < 0) goto LAB_1; + BfsDereferenceTableEntry(puVar9); + uVar10 = local_88; } - psVar9 = psVar10; - } while (1 < uVar1); - uVar7 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar7 != 0) && (psVar10 != (short *)0x0)) { + } while (1 < uVar2); + uVar8 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar8 != 0) && (uVar10 != 0)) { LAB_0: - psVar9 = psVar9 + -4; + puVar9 = (undefined8 *)(uVar10 - 8); LAB_1: - BfsDereferenceTableEntry((undefined8 *)psVar9); + BfsDereferenceTableEntry(puVar9); } } } - return uVar4; + return uVar5; } ``` ## BfsCheckPolicyAndPerformRenameAsUser ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.13| |i_ratio|0.34| |m_ratio|0.88| |b_ratio|0.75| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsCheckPolicyAndPerformRenameAsUser|BfsCheckPolicyAndPerformRenameAsUser| |fullname|BfsCheckPolicyAndPerformRenameAsUser|BfsCheckPolicyAndPerformRenameAsUser| |refcount|2|2| |`length`|749|958| |`called`|
Expand for full list:
BfsDereferencePolicyEntryEx
BfsGetFileName
BfsGetPolicy
BfsGetPolicyEntry
BfsPolicyEntryExists
BfsQueueDeferredWorkItemAndWait
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::SeQueryInformationToken__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsDereferencePolicyEntryEx
BfsGetFileName
BfsGetPolicy
BfsGetPolicyEntry
BfsPolicyEntryExists
BfsQueueDeferredWorkItemAndWait
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInlineNTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsProcessRename|BfsProcessRename| |paramcount|5|5| |`address`|1400064dc|14000669c| |`sig`|undefined4 __fastcall BfsCheckPolicyAndPerformRenameAsUser(undefined8 * param_1, longlong param_2, undefined8 param_3, undefined8 * param_4, longlong param_5)|undefined4 __fastcall BfsCheckPolicyAndPerformRenameAsUser(longlong * param_1, longlong param_2, undefined8 param_3, longlong * param_4, longlong param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsCheckPolicyAndPerformRenameAsUser Called Diff ```diff --- BfsCheckPolicyAndPerformRenameAsUser called +++ BfsCheckPolicyAndPerformRenameAsUser called @@ -9,0 +10,2 @@ +Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline +Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline ``` ### BfsCheckPolicyAndPerformRenameAsUser Diff ```diff --- BfsCheckPolicyAndPerformRenameAsUser +++ BfsCheckPolicyAndPerformRenameAsUser @@ -1,134 +1,191 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined4 BfsCheckPolicyAndPerformRenameAsUser - (undefined8 *param_1,longlong param_2,undefined8 param_3,undefined8 *param_4, - longlong param_5) + (longlong *param_1,longlong param_2,undefined8 param_3,longlong *param_4,longlong param_5) { short sVar1; short *psVar2; - longlong lVar3; + ulonglong uVar3; byte bVar4; int iVar5; uint uVar6; ulonglong uVar7; - uint *puVar8; - undefined8 uVar9; - undefined8 *puVar10; - short *psVar11; - undefined4 uVar12; - undefined1 auStackY_108 [32]; - undefined1 local_d8 [8]; - undefined8 local_d0; - uint uStack_c8; - uint uStack_c4; + ulonglong *puVar8; + ulonglong uVar9; + undefined8 uVar10; + longlong *plVar11; + short *psVar12; + undefined4 uVar13; + undefined1 auStackY_118 [32]; + undefined1 local_e8 [8]; + undefined8 local_e0; + uint uStack_d8; + uint uStack_d4; + longlong *local_d0; + undefined8 *local_c8; undefined8 *local_c0; - undefined8 *local_b8; - undefined8 *local_b0; - undefined8 local_a8; - undefined8 *puStack_a0; - longlong local_98; - longlong lStack_90; - undefined8 local_88; - undefined8 *local_60; - undefined8 local_58; - ulonglong local_50; + undefined8 local_b8; + longlong *plStack_b0; + longlong local_a8; + ulonglong uStack_a0; + undefined8 local_98; + longlong local_90; + undefined8 *local_68; + undefined8 local_60; + ulonglong local_58; - local_50 = __security_cookie ^ (ulonglong)auStackY_108; - local_b8 = (undefined8 *)0x0; - local_88 = 0; - local_d0 = 0; - local_b0 = (undefined8 *)0x0; - uVar12 = 1; + local_58 = __security_cookie ^ (ulonglong)auStackY_118; + local_90 = param_5; + local_98 = 0; + local_c8 = (undefined8 *)0x0; + local_e0 = 0; + uVar13 = 1; local_c0 = (undefined8 *)0x0; - local_d8[0] = 0; + local_d0 = (longlong *)0x0; + local_e8[0] = 0; + local_b8 = 0; + plStack_b0 = (longlong *)0x0; local_a8 = 0; - puStack_a0 = (undefined8 *)0x0; - local_98 = 0; - lStack_90 = 0; - uVar9 = param_3; - iVar5 = SeQueryInformationToken(param_3,1,&local_b8); - if ((iVar5 < 0) || - (uVar9 = param_3, iVar5 = SeQueryInformationToken(param_3,0x1f,&local_b0), iVar5 < 0)) { - if (3 < DAT_0) { - local_d0 = CONCAT44(local_d0._4_4_,iVar5); - local_60 = &local_d0; - local_58 = 4; - _tlgWriteTransfer_EtwWriteTransfer(uVar9,&DAT_1); - } - goto LAB_2; - } - bVar4 = BfsPolicyEntryExists(param_1,param_2,0x14001b2b0,(byte *)*local_b8,(byte *)*local_b0); - if (bVar4 == 0) goto LAB_2; - puVar10 = param_1; - uVar7 = BfsGetPolicyEntry(param_1,param_2,0x14001b2b0,(byte *)*local_b8,(byte *)*local_b0, - &local_d0); - lVar3 = local_d0; - iVar5 = (int)uVar7; - if (iVar5 < 0) { -joined_r0x0001400066df: - if (3 < DAT_0) { - local_58 = 4; - local_d0._4_4_ = (undefined4)((ulonglong)local_d0 >> 0x20); - local_d0 = CONCAT44(local_d0._4_4_,iVar5); - local_60 = &local_d0; - _tlgWriteTransfer_EtwWriteTransfer(puVar10,&DAT_1); + uStack_a0 = 0; + uVar10 = param_3; + iVar5 = SeQueryInformationToken(param_3,1,&local_c8); + if (-1 < iVar5) { + uVar10 = param_3; + iVar5 = SeQueryInformationToken(param_3,0x1f,&local_c0); + if (-1 < iVar5) { + bVar4 = BfsPolicyEntryExists(param_1,param_2,0x14001b2d0,(byte *)*local_c8,(byte *)*local_c0); + if (bVar4 == 0) goto LAB_0; + plVar11 = param_1; + uVar7 = BfsGetPolicyEntry(param_1,param_2,0x14001b2d0,(byte *)*local_c8,(byte *)*local_c0, + &local_e0); + uVar3 = local_e0; + iVar5 = (int)uVar7; + if (iVar5 < 0) { +LAB_1: + if (3 < DAT_2) { + local_e0 = CONCAT44(local_e0._4_4_,iVar5); + local_68 = &local_e0; + local_60 = 4; + _tlgWriteTransfer_EtwWriteTransfer(plVar11,&DAT_3); + } + } + else { + puVar8 = (ulonglong *)BfsGetFileName((ushort *)&local_e0,param_5); + local_e0 = *puVar8; + uStack_d8 = (uint)puVar8[1]; + uStack_d4 = *(uint *)((longlong)puVar8 + 0xc); + psVar2 = (short *)puVar8[1]; + if ((short)(uint)*puVar8 != 0) { + for (psVar12 = psVar2 + ((ulonglong)(((uint)*puVar8 & 0xffff) >> 1) - 1); psVar2 < psVar12 + ; psVar12 = psVar12 + -1) { + if (*psVar12 == 0x5c) goto LAB_4; + } + if (*psVar12 == 0x5c) { +LAB_4: + sVar1 = (short)((longlong)psVar12 - (longlong)psVar2 >> 1) * 2; + local_e0._4_4_ = (undefined4)(local_e0 >> 0x20); + local_e0._0_4_ = CONCAT22(sVar1,sVar1); + } + else { + uVar7 = Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 != 0) { + local_e0 = local_e0 & 0xffffffff00000000; + } + } + } + uVar7 = BfsGetPolicy(*(longlong *)(uVar3 + 0x30),(ushort *)(param_5 + 0x18),&local_e0, + local_e8); + uVar9 = Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 == 0) { + if ((int)uVar7 == 1) { +LAB_5: + plVar11 = param_4; + iVar5 = FltGetFileNameInformation(param_4,0x101,&local_d0); + if (-1 < iVar5) { + plVar11 = local_d0; + iVar5 = FltParseFileNameInformation(); + if (-1 < iVar5) { + uVar7 = Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 != 0) { + plVar11 = local_d0; + puVar8 = (ulonglong *)BfsGetFileName((ushort *)&local_e0,(longlong)local_d0); + local_e0 = *puVar8; + uStack_d8 = (uint)puVar8[1]; + uStack_d4 = *(uint *)((longlong)puVar8 + 0xc); + psVar2 = (short *)puVar8[1]; + if ((short)(uint)*puVar8 != 0) { + for (psVar12 = psVar2 + ((ulonglong)(((uint)*puVar8 & 0xffff) >> 1) - 1); + psVar2 < psVar12; psVar12 = psVar12 + -1) { + if (*psVar12 == 0x5c) goto LAB_6; + } + if (*psVar12 == 0x5c) { +LAB_6: + sVar1 = (short)((longlong)psVar12 - (longlong)psVar2 >> 1) * 2; + local_e0._4_4_ = (undefined4)(local_e0 >> 0x20); + local_e0._0_4_ = CONCAT22(sVar1,sVar1); + } + else { + local_e0 = (ulonglong)*(uint *)((longlong)puVar8 + 4) << 0x20; + } + } + uVar7 = BfsGetPolicy(*(longlong *)(uVar3 + 0x30),(ushort *)(plVar11 + 3),&local_e0 + ,local_e8); + if ((int)uVar7 != 1) { + *(undefined4 *)(param_4 + 3) = 0xc0000022; + goto LAB_7; + } + } + plStack_b0 = local_d0; + local_a8 = local_90; + uStack_a0 = uVar3; + local_98 = (ulonglong)CONCAT31(local_98._5_3_,local_e8[0]) << 0x20; + local_b8 = param_3; + uVar6 = BfsQueueDeferredWorkItemAndWait + ((longlong)param_1,param_2,param_4,&local_b8, + BfsRenameAsUserCallback); + if (-1 < (int)uVar6) { + uVar6 = (uint)local_98; + } + *(uint *)(param_4 + 3) = uVar6; + goto LAB_7; + } + } + goto LAB_1; + } + } + else { + if ((int)uVar7 == 1) goto LAB_5; + *(undefined4 *)(param_4 + 3) = 0xc0000022; +LAB_7: + uVar13 = 4; + param_4[4] = 0; + } + } + if (uVar3 != 0) { + BfsDereferencePolicyEntryEx(uVar3,'\0'); + } + goto LAB_0; } } - else { - puVar8 = (uint *)BfsGetFileName((ushort *)&local_d0,param_5); - local_d0 = *(longlong *)puVar8; - uStack_c8 = puVar8[2]; - uStack_c4 = puVar8[3]; - psVar2 = *(short **)(puVar8 + 2); - if ((short)*puVar8 != 0) { - for (psVar11 = psVar2 + ((ulonglong)((*puVar8 & 0xffff) >> 1) - 1); psVar2 < psVar11; - psVar11 = psVar11 + -1) { - if (*psVar11 == 0x5c) goto LAB_3; - } - if (*psVar11 == 0x5c) { -LAB_3: - sVar1 = (short)((longlong)psVar11 - (longlong)psVar2 >> 1) * 2; - local_d0._4_4_ = (undefined4)((ulonglong)local_d0 >> 0x20); - local_d0._0_4_ = CONCAT22(sVar1,sVar1); - } - } - uVar7 = BfsGetPolicy(*(longlong *)(lVar3 + 0x30),(ushort *)(param_5 + 0x18),&local_d0,local_d8); - if ((int)uVar7 == 1) { - puVar10 = param_4; - iVar5 = FltGetFileNameInformation(param_4,0x101,&local_c0); - if ((iVar5 < 0) || (puVar10 = local_c0, iVar5 = FltParseFileNameInformation(), iVar5 < 0)) - goto joined_r0x0001400066df; - puStack_a0 = local_c0; - local_98 = param_5; - lStack_90 = lVar3; - local_88 = (ulonglong)CONCAT31(local_88._5_3_,local_d8[0]) << 0x20; - local_a8 = param_3; - uVar6 = BfsQueueDeferredWorkItemAndWait - ((longlong)param_1,param_2,param_4,&local_a8,BfsRenameAsUserCallback); - param_4[4] = 0; - uVar12 = 4; - if (-1 < (int)uVar6) { - uVar6 = (uint)local_88; - } - *(uint *)(param_4 + 3) = uVar6; - } + if (3 < DAT_2) { + local_e0 = CONCAT44(local_e0._4_4_,iVar5); + local_68 = &local_e0; + local_60 = 4; + _tlgWriteTransfer_EtwWriteTransfer(uVar10,&DAT_3); } - if (lVar3 != 0) { - BfsDereferencePolicyEntryEx(lVar3,'\0'); - } -LAB_2: - if (local_c0 != (undefined8 *)0x0) { +LAB_0: + if (local_d0 != (longlong *)0x0) { FltReleaseFileNameInformation(); } - if (local_b8 != (undefined8 *)0x0) { - ExFreePoolWithTag(local_b8,0); + if (local_c8 != (undefined8 *)0x0) { + ExFreePoolWithTag(local_c8,0); } - if (local_b0 != (undefined8 *)0x0) { - ExFreePoolWithTag(local_b0,0); + if (local_c0 != (undefined8 *)0x0) { + ExFreePoolWithTag(local_c0,0); } - return uVar12; + return uVar13; } ``` ## BfsRemoveKeyValues ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.94| |i_ratio|0.76| |m_ratio|0.97| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsRemoveKeyValues|BfsRemoveKeyValues| |fullname|BfsRemoveKeyValues|BfsRemoveKeyValues| |refcount|2|2| |`length`|527|488| |`called`|Feature_1576213819__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::ZwDeleteValueKey
NTOSKRNL.EXE::ZwEnumerateValueKey
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer|Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ZwDeleteValueKey
NTOSKRNL.EXE::ZwEnumerateValueKey
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer| |calling|BfsAdjustRegistryKeySecurity|BfsAdjustRegistryKeySecurity| |paramcount|1|1| |`address`|1400114f4|140011794| |sig|int __fastcall BfsRemoveKeyValues(undefined8 param_1)|int __fastcall BfsRemoveKeyValues(undefined8 param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsRemoveKeyValues Called Diff ```diff --- BfsRemoveKeyValues called +++ BfsRemoveKeyValues called @@ -1 +0,0 @@ -Feature_1576213819__private_IsEnabledDeviceUsageNoInline @@ -5 +3,0 @@ -NTOSKRNL.EXE::RtlInitUnicodeString ``` ### BfsRemoveKeyValues Diff ```diff --- BfsRemoveKeyValues +++ BfsRemoveKeyValues @@ -1,97 +1,91 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ int BfsRemoveKeyValues(undefined8 param_1) { int iVar1; int iVar2; int iVar3; longlong lVar4; ulonglong uVar5; undefined8 uVar6; undefined4 uVar7; undefined1 auStack_a8 [32]; undefined4 local_88; undefined4 *local_80; int local_78; undefined4 local_74; undefined8 local_70; longlong lStack_68; undefined4 local_60 [8]; int *local_40; undefined4 local_38; undefined4 local_34; ulonglong local_30; local_30 = __security_cookie ^ (ulonglong)auStack_a8; local_74 = 0; uVar7 = 0xd8; local_70 = 0; lStack_68 = 0; uVar6 = 0x100; iVar3 = 0; lVar4 = ExAllocatePool2(0x100,0xd8,0x56736642); if (lVar4 == 0) { LAB_0: iVar3 = -0x3fffffe9; if (3 < DAT_1) { local_34 = 0; local_78 = -0x3fffffe9; local_40 = &local_78; local_80 = local_60; local_38 = 4; _tlgWriteTransfer_EtwWriteTransfer(uVar6,&DAT_2); } } else { do { while( true ) { local_80 = &local_74; uVar6 = param_1; local_88 = uVar7; iVar2 = ZwEnumerateValueKey(param_1,0,0,lVar4); if ((iVar2 != -0x7ffffffb) && (iVar2 != -0x3fffffdd)) break; ExFreePoolWithTag(lVar4,0); uVar7 = local_74; uVar6 = 0x100; lVar4 = ExAllocatePool2(); if (lVar4 == 0) goto LAB_0; LAB_3: if (iVar2 == -0x7fffffe6) goto LAB_4; } if (iVar2 < 0) { uVar5 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); iVar1 = iVar2; if (((int)uVar5 == 0) && (iVar1 = iVar3, -1 < iVar3)) goto LAB_3; break; } - uVar5 = Feature_1576213819__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 == 0) { - RtlInitUnicodeString(&local_70,lVar4 + 0xc); - } - else { - local_70._0_4_ = CONCAT22(*(undefined2 *)(lVar4 + 8),*(undefined2 *)(lVar4 + 8)); - lStack_68 = lVar4 + 0xc; - } + local_70._0_4_ = CONCAT22(*(undefined2 *)(lVar4 + 8),*(undefined2 *)(lVar4 + 8)); + lStack_68 = lVar4 + 0xc; uVar6 = param_1; iVar3 = ZwDeleteValueKey(); iVar1 = iVar3; } while (-1 < iVar3); iVar3 = iVar1; if (3 < DAT_1) { local_34 = 0; local_40 = &local_78; local_80 = local_60; local_38 = 4; local_78 = iVar3; _tlgWriteTransfer_EtwWriteTransfer(uVar6,&DAT_2); } LAB_4: if (lVar4 != 0) { ExFreePoolWithTag(lVar4,0); } } return iVar3; } ``` ## BfsInsertNotPresentPolicyEntry ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.47| |i_ratio|0.73| |m_ratio|0.99| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsInsertNotPresentPolicyEntry|BfsInsertNotPresentPolicyEntry| |fullname|BfsInsertNotPresentPolicyEntry|BfsInsertNotPresentPolicyEntry| |refcount|2|2| |`length`|770|752| |`called`|
Expand for full list:
BfsDereferencePolicyEntryEx
BfsInsertEntryHashTable
BfsLookupPolicyEntryHashTable
Feature_3148938554__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegionNTOSKRNL.EXE::RtlCopySid
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsDereferencePolicyEntryEx
BfsInsertEntryHashTable
BfsLookupPolicyEntryHashTable
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlCopySid__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsPolicyEntryExists|BfsPolicyEntryExists| |paramcount|4|4| |`address`|140008180|140008498| |sig|ulonglong __fastcall BfsInsertNotPresentPolicyEntry(longlong param_1, undefined8 param_2, longlong param_3, longlong param_4)|ulonglong __fastcall BfsInsertNotPresentPolicyEntry(longlong param_1, undefined8 param_2, longlong param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsInsertNotPresentPolicyEntry Called Diff ```diff --- BfsInsertNotPresentPolicyEntry called +++ BfsInsertNotPresentPolicyEntry called @@ -4 +3,0 @@ -Feature_3148938554__private_IsEnabledDeviceUsageNoInline ``` ### BfsInsertNotPresentPolicyEntry Diff ```diff --- BfsInsertNotPresentPolicyEntry +++ BfsInsertNotPresentPolicyEntry @@ -1,138 +1,131 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsInsertNotPresentPolicyEntry (longlong param_1,undefined8 param_2,longlong param_3,longlong param_4) { uint uVar1; uint uVar2; longlong lVar3; - ulonglong uVar4; + longlong lVar4; ulonglong uVar5; longlong lVar6; ulonglong uVar7; ulonglong uVar8; - ulonglong uVar9; - ulonglong uVar10; undefined1 auStack_b8 [40]; undefined1 *local_90; uint local_88 [2]; undefined1 local_80 [32]; uint *local_60; undefined8 local_58; ulonglong local_50; local_50 = __security_cookie ^ (ulonglong)auStack_b8; + uVar5 = 0; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_1,0); lVar3 = BfsLookupPolicyEntryHashTable(*(undefined8 *)(param_1 + 8),param_2,param_3,param_4); if (lVar3 != 0) { uVar7 = 0x40000000; if (*(int *)(lVar3 + 0x38) != 0x10000000) { - uVar7 = 0; + uVar7 = uVar5; } ExReleasePushLockExclusiveEx(param_1,0); KeLeaveCriticalRegion(); return uVar7; } uVar7 = 0x100; - uVar4 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(param_3 + 1) * 4 + 8,0x53736642); + lVar4 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(param_3 + 1) * 4 + 8,0x53736642); lVar3 = 0; - uVar8 = uVar4; - if (uVar4 == 0) { - uVar10 = 0xc0000017; + if (lVar4 == 0) { + uVar8 = 0xc0000017; uVar2 = 0xc0000017; - uVar9 = 0; uVar1 = local_88[0]; } else { uVar7 = 0x100; uVar5 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(param_4 + 1) * 4 + 8,0x53736642); - uVar9 = uVar5; - if (uVar5 == 0) goto LAB_0; - uVar7 = (ulonglong)((uint)*(byte *)(param_3 + 1) * 4 + 8); - uVar2 = RtlCopySid(uVar7,uVar4,param_3); - uVar10 = (ulonglong)uVar2; - uVar1 = local_88[0]; - if (-1 < (int)uVar2) { - uVar7 = (ulonglong)((uint)*(byte *)(param_4 + 1) * 4 + 8); - uVar2 = RtlCopySid(uVar7,uVar5,param_4); - uVar10 = (ulonglong)uVar2; + if (uVar5 == 0) { + uVar8 = 0xc0000017; + uVar2 = 0xc0000017; + uVar1 = local_88[0]; + } + else { + uVar7 = (ulonglong)((uint)*(byte *)(param_3 + 1) * 4 + 8); + uVar2 = RtlCopySid(uVar7,lVar4,param_3); + uVar8 = (ulonglong)uVar2; uVar1 = local_88[0]; if (-1 < (int)uVar2) { - uVar7 = 0x100; - lVar3 = ExAllocatePool2(0x100,0xa0,0x45736642); - if (lVar3 != 0) { - LOCK(); - *(int *)(lVar3 + 0x98) = *(int *)(lVar3 + 0x98) + 1; - UNLOCK(); - uVar7 = 0x40; - lVar6 = ExAllocatePool2(0x40,0x18,0x76736642); - *(longlong *)(lVar3 + 0x28) = lVar6; - if (lVar6 != 0) { - *(ulonglong *)(lVar3 + 0x18) = uVar4; - uVar7 = Feature_3148938554__private_IsEnabledDeviceUsageNoInline(); - *(ulonglong *)(lVar3 + 0x20) = uVar5; - uVar8 = 0; - if ((int)uVar7 == 0) { - uVar8 = uVar4; + uVar7 = (ulonglong)((uint)*(byte *)(param_4 + 1) * 4 + 8); + uVar2 = RtlCopySid(uVar7,uVar5,param_4); + uVar8 = (ulonglong)uVar2; + uVar1 = local_88[0]; + if (-1 < (int)uVar2) { + uVar7 = 0x100; + lVar3 = ExAllocatePool2(0x100,0xa0,0x45736642); + if (lVar3 != 0) { + LOCK(); + *(int *)(lVar3 + 0x98) = *(int *)(lVar3 + 0x98) + 1; + UNLOCK(); + lVar6 = ExAllocatePool2(0x40,0x18,0x76736642); + uVar7 = 0; + *(longlong *)(lVar3 + 0x28) = lVar6; + if (lVar6 != 0) { + *(longlong *)(lVar3 + 0x18) = lVar4; + *(ulonglong *)(lVar3 + 0x20) = uVar5; + lVar4 = 0; + *(undefined4 *)(lVar3 + 0x68) = 0; + uVar5 = 0; + *(undefined4 *)(lVar3 + 0x38) = 2; + *(undefined8 *)(lVar3 + 0x70) = 0; + *(undefined8 *)(lVar3 + 0x78) = 0; + *(undefined2 *)(lVar3 + 0x72) = 0; + *(undefined8 *)(lVar3 + 0x78) = 0; + *(undefined8 *)(lVar3 + 0x80) = 0; + *(undefined8 *)(lVar3 + 0x88) = 0; + *(undefined2 *)(lVar3 + 0x82) = 0; + *(undefined8 *)(lVar3 + 0x88) = 0; + KeInitializeEvent(lVar6,0,0); + uVar7 = *(ulonglong *)(param_1 + 8); + uVar2 = BfsInsertEntryHashTable(uVar7,param_2,lVar3); + uVar8 = (ulonglong)uVar2; + uVar1 = local_88[0]; + if (-1 < (int)uVar2) goto LAB_0; + goto joined_r0x0001400086e3; } - uVar7 = Feature_3148938554__private_IsEnabledDeviceUsageNoInline(); - *(undefined4 *)(lVar3 + 0x38) = 2; - *(undefined4 *)(lVar3 + 0x68) = 0; - *(undefined8 *)(lVar3 + 0x70) = 0; - *(undefined8 *)(lVar3 + 0x78) = 0; - *(undefined2 *)(lVar3 + 0x72) = 0; - uVar9 = 0; - if ((int)uVar7 == 0) { - uVar9 = uVar5; - } - *(undefined8 *)(lVar3 + 0x78) = 0; - *(undefined8 *)(lVar3 + 0x80) = 0; - *(undefined8 *)(lVar3 + 0x88) = 0; - *(undefined2 *)(lVar3 + 0x82) = 0; - *(undefined8 *)(lVar3 + 0x88) = 0; - KeInitializeEvent(*(undefined8 *)(lVar3 + 0x28),0,0); - uVar7 = *(ulonglong *)(param_1 + 8); - uVar2 = BfsInsertEntryHashTable(uVar7,param_2,lVar3); - uVar10 = (ulonglong)uVar2; - uVar1 = local_88[0]; - if (-1 < (int)uVar2) goto LAB_1; - goto joined_r0x0001400083dd; } + uVar8 = 0xc0000017; + uVar2 = 0xc0000017; + uVar1 = local_88[0]; } -LAB_0: - uVar10 = 0xc0000017; - uVar2 = 0xc0000017; - uVar1 = local_88[0]; } } } -joined_r0x0001400083dd: +joined_r0x0001400086e3: local_88[0] = uVar2; - if (3 < DAT_2) { + if (3 < DAT_1) { local_58 = 4; local_60 = local_88; local_90 = local_80; - _tlgWriteTransfer_EtwWriteTransfer(uVar7,&DAT_3); + _tlgWriteTransfer_EtwWriteTransfer(uVar7,&DAT_2); uVar1 = local_88[0]; } -LAB_1: +LAB_0: local_88[0] = uVar1; ExReleasePushLockExclusiveEx(param_1); KeLeaveCriticalRegion(); - if ((int)uVar10 < 0) { + if ((int)uVar8 < 0) { if (lVar3 != 0) { BfsDereferencePolicyEntryEx(lVar3,'\0'); } - if (uVar8 != 0) { - ExFreePoolWithTag(uVar8,0); + if (lVar4 != 0) { + ExFreePoolWithTag(lVar4,0); } - if (uVar9 != 0) { - ExFreePoolWithTag(uVar9,0); + if (uVar5 != 0) { + ExFreePoolWithTag(uVar5,0); } } - return uVar10; + return uVar8; } ``` ## BfsRenameEntry ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.42| |i_ratio|0.56| |m_ratio|0.98| |b_ratio|0.03| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsRenameEntry|BfsRenameEntry| |fullname|BfsRenameEntry|BfsRenameEntry| |refcount|2|2| |`length`|1570|1609| |`called`|
Expand for full list:
BfsCreateDirectory
BfsDereferenceTableEntry
BfsFindEntry
BfsGetEntryBlock
BfsGetEntryIndex
BfsGetFinalPathComponent
BfsGetPathComponent
BfsInsertDirectoryEntry
BfsWriteBlock
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveExNTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlClearBits
NTOSKRNL.EXE::RtlInitializeBitMap
NTOSKRNL.EXE::RtlSetBits
__security_check_cookie
memmove
memset
|
Expand for full list:
BfsCreateDirectory
BfsDereferenceTableEntry
BfsFindEntry
BfsGetEntryBlock
BfsGetEntryIndex
BfsGetFinalPathComponent
BfsGetPathComponent
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsWriteBlock
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInlineNTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlClearBits
NTOSKRNL.EXE::RtlInitializeBitMap
NTOSKRNL.EXE::RtlSetBits
__security_check_cookie
memcpy
memset
| |calling|BfsRenameAsUserCallback|BfsRenameAsUserCallback| |paramcount|4|4| |`address`|140014a30|140015064| |sig|ulonglong __fastcall BfsRenameEntry(longlong param_1, ushort * param_2, undefined8 * param_3, undefined8 * param_4)|ulonglong __fastcall BfsRenameEntry(longlong param_1, ushort * param_2, undefined8 * param_3, undefined8 * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsRenameEntry Called Diff ```diff --- BfsRenameEntry called +++ BfsRenameEntry called @@ -8,0 +9 @@ +BfsInsertDirectoryEntry_OLD @@ -9,0 +11 @@ +Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline @@ -18 +20 @@ -memmove +memcpy ``` ### BfsRenameEntry Diff ```diff --- BfsRenameEntry +++ BfsRenameEntry @@ -1,338 +1,349 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsRenameEntry(longlong param_1,ushort *param_2,undefined8 *param_3,undefined8 *param_4) { - int iVar1; + undefined8 uVar1; undefined8 uVar2; undefined8 uVar3; - undefined8 uVar4; - int *piVar5; - uint uVar6; - undefined4 uVar7; + int *piVar4; + uint uVar5; + undefined4 uVar6; + int iVar7; ulonglong uVar8; ulonglong *puVar9; ushort *puVar10; ulonglong uVar11; longlong lVar12; ulonglong uVar13; undefined8 *puVar14; undefined8 *puVar15; undefined8 uVar16; int *piVar17; ulonglong uVar18; undefined8 *puVar19; ulonglong uVar20; ushort uVar21; longlong lVar22; - undefined1 auStackY_308 [32]; - undefined8 local_2d8; - ulonglong local_2d0 [2]; - ulonglong local_2c0; - undefined4 uStack_2b8; + undefined1 auStackY_318 [32]; + ulonglong local_2e8; + ulonglong local_2e0 [2]; + ulonglong local_2d0; + undefined4 uStack_2c8; + undefined4 uStack_2c4; + ushort local_2c0; + ushort uStack_2be; + ushort uStack_2bc; + ushort uStack_2ba; + ushort uStack_2b8; + ushort uStack_2b6; undefined4 uStack_2b4; - ushort local_2b0; - ushort uStack_2ae; - ushort uStack_2ac; - ushort uStack_2aa; - ushort uStack_2a8; - ushort uStack_2a6; - undefined4 uStack_2a4; - ulonglong local_2a0; - void *pvStack_298; - ushort local_290 [8]; - undefined8 local_280; - undefined8 uStack_278; - int local_268; - uint uStack_264; - undefined4 uStack_260; - undefined4 uStack_25c; - undefined1 auStack_254 [524]; - ulonglong local_48; + ulonglong local_2b0; + void *pvStack_2a8; + ushort local_2a0 [8]; + undefined8 local_290; + undefined8 uStack_288; + int local_278; + uint uStack_274; + undefined4 uStack_270; + int iStack_26c; + undefined1 auStack_264 [524]; + ulonglong local_58; - local_48 = __security_cookie ^ (ulonglong)auStackY_308; - local_2d8 = 0; - local_2d0[0] = 0; - local_2a0 = 0; - pvStack_298 = (void *)0x0; - local_290[0] = 0; - local_290[1] = 0; - local_290[2] = 0; - local_290[3] = 0; - local_290[4] = 0; - local_290[5] = 0; - local_290[6] = 0; - local_290[7] = 0; - local_280 = 0; - uStack_278 = 0; - uVar8 = BfsCreateDirectory(param_1 + 0x30,param_2,1,(longlong *)local_2d0); - uVar20 = local_2d0[0]; + local_58 = __security_cookie ^ (ulonglong)auStackY_318; + local_2e8 = 0; + local_2e0[0] = 0; + local_2b0 = 0; + pvStack_2a8 = (void *)0x0; + local_2a0[0] = 0; + local_2a0[1] = 0; + local_2a0[2] = 0; + local_2a0[3] = 0; + local_2a0[4] = 0; + local_2a0[5] = 0; + local_2a0[6] = 0; + local_2a0[7] = 0; + local_290 = 0; + uStack_288 = 0; + uVar8 = BfsCreateDirectory(param_1 + 0x30,param_2,1,(longlong *)local_2e0); + uVar20 = local_2e0[0]; if ((int)uVar8 < 0) { return uVar8; } - uVar7 = *(undefined4 *)param_3; - uStack_2a4 = *(undefined4 *)((longlong)param_3 + 0xc); - local_2b0 = (ushort)uVar7; - uStack_2ae = (ushort)((uint)uVar7 >> 0x10); - uStack_2ac = (ushort)*(undefined4 *)((longlong)param_3 + 4); - uStack_2aa = (ushort)((uint)*(undefined4 *)((longlong)param_3 + 4) >> 0x10); - uStack_2a8 = (ushort)*(undefined4 *)(param_3 + 1); - uStack_2a6 = (ushort)((uint)*(undefined4 *)(param_3 + 1) >> 0x10); - puVar9 = (ulonglong *)BfsGetFinalPathComponent((ushort *)&local_2c0,param_3); - local_2a0 = *puVar9; - pvStack_298 = (void *)puVar9[1]; - if (1 < (ushort)uVar7) { + uVar6 = *(undefined4 *)param_3; + uStack_2b4 = *(undefined4 *)((longlong)param_3 + 0xc); + local_2c0 = (ushort)uVar6; + uStack_2be = (ushort)((uint)uVar6 >> 0x10); + uStack_2bc = (ushort)*(undefined4 *)((longlong)param_3 + 4); + uStack_2ba = (ushort)((uint)*(undefined4 *)((longlong)param_3 + 4) >> 0x10); + uStack_2b8 = (ushort)*(undefined4 *)(param_3 + 1); + uStack_2b6 = (ushort)((uint)*(undefined4 *)(param_3 + 1) >> 0x10); + puVar9 = (ulonglong *)BfsGetFinalPathComponent((ushort *)&local_2d0,param_3); + local_2b0 = *puVar9; + pvStack_2a8 = (void *)puVar9[1]; + if (1 < (ushort)uVar6) { while( true ) { uVar21 = 2; - puVar10 = BfsGetPathComponent((ushort *)&local_2c0,(undefined8 *)&local_2b0, - (undefined8 *)local_290); - local_2b0 = *puVar10; - uStack_2ae = puVar10[1]; - uStack_2ac = puVar10[2]; - uStack_2aa = puVar10[3]; - uStack_2a8 = puVar10[4]; - uStack_2a6 = puVar10[5]; - uStack_2a4 = *(undefined4 *)(puVar10 + 6); - if (local_2b0 < uVar21) break; - uVar8 = BfsCreateDirectory(uVar20,local_290,1,(longlong *)local_2d0); + puVar10 = BfsGetPathComponent((ushort *)&local_2d0,(undefined8 *)&local_2c0, + (undefined8 *)local_2a0); + local_2c0 = *puVar10; + uStack_2be = puVar10[1]; + uStack_2bc = puVar10[2]; + uStack_2ba = puVar10[3]; + uStack_2b8 = puVar10[4]; + uStack_2b6 = puVar10[5]; + uStack_2b4 = *(undefined4 *)(puVar10 + 6); + if (local_2c0 < uVar21) break; + uVar8 = BfsCreateDirectory(uVar20,local_2a0,1,(longlong *)local_2e0); BfsDereferenceTableEntry((undefined8 *)(uVar20 - 8)); - uVar20 = local_2d0[0]; + uVar20 = local_2e0[0]; if ((int)uVar8 < 0) { return uVar8 & 0xffffffff; } } } - uVar8 = BfsCreateDirectory(param_1 + 0x30,param_2,1,&local_2d8); + uVar8 = BfsCreateDirectory(param_1 + 0x30,param_2,1,(longlong *)&local_2e8); uVar11 = uVar8 & 0xffffffff; if ((int)uVar8 < 0) goto LAB_0; - uVar7 = *(undefined4 *)param_4; - uStack_2a4 = *(undefined4 *)((longlong)param_4 + 0xc); - local_2b0 = (ushort)uVar7; - uStack_2ae = (ushort)((uint)uVar7 >> 0x10); - uStack_2ac = (ushort)*(undefined4 *)((longlong)param_4 + 4); - uStack_2aa = (ushort)((uint)*(undefined4 *)((longlong)param_4 + 4) >> 0x10); - uStack_2a8 = (ushort)*(undefined4 *)(param_4 + 1); - uStack_2a6 = (ushort)((uint)*(undefined4 *)(param_4 + 1) >> 0x10); - puVar9 = (ulonglong *)BfsGetFinalPathComponent((ushort *)&local_2c0,param_4); - local_2c0 = *puVar9; - uStack_2b8 = (undefined4)puVar9[1]; - uStack_2b4 = *(undefined4 *)((longlong)puVar9 + 0xc); - if (1 < (ushort)uVar7) { + uVar6 = *(undefined4 *)param_4; + uStack_2b4 = *(undefined4 *)((longlong)param_4 + 0xc); + local_2c0 = (ushort)uVar6; + uStack_2be = (ushort)((uint)uVar6 >> 0x10); + uStack_2bc = (ushort)*(undefined4 *)((longlong)param_4 + 4); + uStack_2ba = (ushort)((uint)*(undefined4 *)((longlong)param_4 + 4) >> 0x10); + uStack_2b8 = (ushort)*(undefined4 *)(param_4 + 1); + uStack_2b6 = (ushort)((uint)*(undefined4 *)(param_4 + 1) >> 0x10); + puVar9 = (ulonglong *)BfsGetFinalPathComponent((ushort *)&local_2d0,param_4); + local_2d0 = *puVar9; + uStack_2c8 = (undefined4)puVar9[1]; + uStack_2c4 = *(undefined4 *)((longlong)puVar9 + 0xc); + if (1 < (ushort)uVar6) { while( true ) { uVar21 = 2; - puVar10 = BfsGetPathComponent((ushort *)local_2d0,(undefined8 *)&local_2b0,&local_280); - uVar8 = local_2d8; - uStack_2a4 = *(undefined4 *)(puVar10 + 6); - local_2b0 = (ushort)*(undefined4 *)puVar10; - uStack_2ae = (ushort)((uint)*(undefined4 *)puVar10 >> 0x10); - uStack_2ac = (ushort)*(undefined4 *)(puVar10 + 2); - uStack_2aa = (ushort)((uint)*(undefined4 *)(puVar10 + 2) >> 0x10); - uStack_2a8 = (ushort)*(undefined4 *)(puVar10 + 4); - uStack_2a6 = (ushort)((uint)*(undefined4 *)(puVar10 + 4) >> 0x10); - if (local_2b0 < uVar21) break; - uVar11 = BfsCreateDirectory(local_2d8,(ushort *)&local_280,1,&local_2d8); + puVar10 = BfsGetPathComponent((ushort *)local_2e0,(undefined8 *)&local_2c0,&local_290); + uVar8 = local_2e8; + uStack_2b4 = *(undefined4 *)(puVar10 + 6); + local_2c0 = (ushort)*(undefined4 *)puVar10; + uStack_2be = (ushort)((uint)*(undefined4 *)puVar10 >> 0x10); + uStack_2bc = (ushort)*(undefined4 *)(puVar10 + 2); + uStack_2ba = (ushort)((uint)*(undefined4 *)(puVar10 + 2) >> 0x10); + uStack_2b8 = (ushort)*(undefined4 *)(puVar10 + 4); + uStack_2b6 = (ushort)((uint)*(undefined4 *)(puVar10 + 4) >> 0x10); + if (local_2c0 < uVar21) break; + uVar11 = BfsCreateDirectory(local_2e8,(ushort *)&local_290,1,(longlong *)&local_2e8); if (uVar8 != uVar20) { BfsDereferenceTableEntry((undefined8 *)(uVar8 - 8)); } if ((int)uVar11 < 0) { BfsDereferenceTableEntry((undefined8 *)(uVar20 - 8)); return uVar11 & 0xffffffff; } } } - uVar8 = local_2d8; - if (uVar20 == local_2d8) { - local_2d8 = (ulonglong)local_2d8._4_4_ << 0x20; - local_2d0[0] = 0; + uVar8 = local_2e8; + local_2e0[0] = local_2e0[0] & 0xffffffff00000000; + local_2e8 = 0; + if (uVar20 == uVar8) { KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(uVar20,0); - lVar12 = BfsFindEntry(uVar20,&local_2a0); + lVar12 = BfsFindEntry(uVar20,&local_2b0); if (lVar12 == 0) { uVar11 = 0xc0000225; } else { memset((void *)(lVar12 + 0x14),0,0x200); - memmove((void *)(lVar12 + 0x14),(void *)CONCAT44(uStack_2b4,uStack_2b8),local_2c0 & 0xffff); - uVar13 = BfsGetEntryBlock(uVar20,lVar12,(longlong *)local_2d0,(undefined4 *)&local_2d8); + memcpy((void *)(lVar12 + 0x14),(void *)CONCAT44(uStack_2c4,uStack_2c8),local_2d0 & 0xffff); + uVar13 = BfsGetEntryBlock(uVar20,lVar12,(longlong *)&local_2e8,(undefined4 *)local_2e0); uVar11 = uVar13 & 0xffffffff; if (-1 < (int)uVar13) { - uVar11 = BfsWriteBlock(param_1,(int)local_2d8,local_2d0[0]); + uVar11 = BfsWriteBlock(param_1,(int)local_2e0[0],local_2e8); uVar11 = uVar11 & 0xffffffff; } } ExReleasePushLockExclusiveEx(uVar20,0); KeLeaveCriticalRegion(); BfsDereferenceTableEntry((undefined8 *)(uVar8 - 8)); goto LAB_0; } - local_2d8 = (ulonglong)local_2d8._4_4_ << 0x20; - local_2d0[0] = 0; - uStack_2a8 = 0; - uStack_2a6 = 0; - local_2b0 = 0; - uStack_2ae = 0; - uStack_2ac = 0; - uStack_2aa = 0; + uStack_2b8 = 0; + uStack_2b6 = 0; + local_2c0 = 0; + uStack_2be = 0; + uStack_2bc = 0; + uStack_2ba = 0; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(uVar20,0); - puVar14 = (undefined8 *)BfsFindEntry(uVar20,&local_2a0); + puVar14 = (undefined8 *)BfsFindEntry(uVar20,&local_2b0); if (puVar14 == (undefined8 *)0x0) { uVar11 = 0xc0000225; LAB_1: ExReleasePushLockExclusiveEx(uVar20,0); KeLeaveCriticalRegion(); } else { lVar22 = 4; lVar12 = 4; puVar19 = puVar14; - piVar5 = &local_268; + piVar4 = &local_278; do { - piVar17 = piVar5; + piVar17 = piVar4; puVar15 = puVar19; uVar16 = puVar15[1]; - uVar2 = puVar15[2]; - uVar3 = puVar15[3]; + uVar1 = puVar15[2]; + uVar2 = puVar15[3]; *(undefined8 *)piVar17 = *puVar15; *(undefined8 *)(piVar17 + 2) = uVar16; uVar16 = puVar15[4]; - uVar4 = puVar15[5]; - *(undefined8 *)(piVar17 + 4) = uVar2; - *(undefined8 *)(piVar17 + 6) = uVar3; - uVar2 = puVar15[6]; - uVar3 = puVar15[7]; + uVar3 = puVar15[5]; + *(undefined8 *)(piVar17 + 4) = uVar1; + *(undefined8 *)(piVar17 + 6) = uVar2; + uVar1 = puVar15[6]; + uVar2 = puVar15[7]; *(undefined8 *)(piVar17 + 8) = uVar16; - *(undefined8 *)(piVar17 + 10) = uVar4; + *(undefined8 *)(piVar17 + 10) = uVar3; uVar16 = puVar15[8]; - uVar4 = puVar15[9]; - *(undefined8 *)(piVar17 + 0xc) = uVar2; - *(undefined8 *)(piVar17 + 0xe) = uVar3; - uVar2 = puVar15[10]; - uVar3 = puVar15[0xb]; + uVar3 = puVar15[9]; + *(undefined8 *)(piVar17 + 0xc) = uVar1; + *(undefined8 *)(piVar17 + 0xe) = uVar2; + uVar1 = puVar15[10]; + uVar2 = puVar15[0xb]; *(undefined8 *)(piVar17 + 0x10) = uVar16; - *(undefined8 *)(piVar17 + 0x12) = uVar4; + *(undefined8 *)(piVar17 + 0x12) = uVar3; uVar16 = puVar15[0xc]; - uVar4 = puVar15[0xd]; - *(undefined8 *)(piVar17 + 0x14) = uVar2; - *(undefined8 *)(piVar17 + 0x16) = uVar3; - uVar2 = puVar15[0xe]; - uVar3 = puVar15[0xf]; + uVar3 = puVar15[0xd]; + *(undefined8 *)(piVar17 + 0x14) = uVar1; + *(undefined8 *)(piVar17 + 0x16) = uVar2; + uVar1 = puVar15[0xe]; + uVar2 = puVar15[0xf]; *(undefined8 *)(piVar17 + 0x18) = uVar16; - *(undefined8 *)(piVar17 + 0x1a) = uVar4; - *(undefined8 *)(piVar17 + 0x1c) = uVar2; - *(undefined8 *)(piVar17 + 0x1e) = uVar3; + *(undefined8 *)(piVar17 + 0x1a) = uVar3; + *(undefined8 *)(piVar17 + 0x1c) = uVar1; + *(undefined8 *)(piVar17 + 0x1e) = uVar2; lVar12 = lVar12 + -1; puVar19 = puVar15 + 0x10; - piVar5 = piVar17 + 0x20; + piVar4 = piVar17 + 0x20; } while (lVar12 != 0); uVar16 = puVar15[0x11]; - iVar1 = *(int *)(puVar15 + 0x12); + iVar7 = *(int *)(puVar15 + 0x12); *(undefined8 *)(piVar17 + 0x20) = puVar15[0x10]; *(undefined8 *)(piVar17 + 0x22) = uVar16; - piVar17[0x24] = iVar1; - memset(auStack_254,0,0x200); - memmove(auStack_254,(void *)CONCAT44(uStack_2b4,uStack_2b8),local_2c0 & 0xffff); - uVar16 = BfsGetEntryBlock(uVar20,(longlong)puVar14,(longlong *)local_2d0, - (undefined4 *)&local_2d8); - uVar13 = local_2d0[0]; - uVar6 = (uint)uVar16; - if ((int)uVar6 < 0) { + piVar17[0x24] = iVar7; + memset(auStack_264,0,0x200); + memcpy(auStack_264,(void *)CONCAT44(uStack_2c4,uStack_2c8),local_2d0 & 0xffff); + uVar16 = BfsGetEntryBlock(uVar20,(longlong)puVar14,(longlong *)&local_2e8, + (undefined4 *)local_2e0); + uVar13 = local_2e8; + uVar5 = (uint)uVar16; + if ((int)uVar5 < 0) { LAB_2: - uVar11 = (ulonglong)uVar6; + uVar11 = (ulonglong)uVar5; goto LAB_1; } - uVar7 = BfsGetEntryIndex(local_2d0[0],(longlong)puVar14); - local_2d0[0] = CONCAT44(local_2d0[0]._4_4_,uVar7); - RtlInitializeBitMap(&local_2b0,uVar13 + 0x3e60,0x1e); - RtlClearBits(&local_2b0,local_2d0[0] & 0xffffffff,1); + uVar6 = BfsGetEntryIndex(local_2e8,(longlong)puVar14); + local_2e8 = CONCAT44(local_2e8._4_4_,uVar6); + RtlInitializeBitMap(&local_2c0,uVar13 + 0x3e60,0x1e); + RtlClearBits(&local_2c0,uVar6,1); memset(puVar14,0,0x214); ExReleasePushLockExclusiveEx(uVar20,0); KeLeaveCriticalRegion(); - lVar12 = BfsInsertDirectoryEntry(uVar8,local_268,uStack_264,uStack_260,(ushort *)&local_2c0); + uVar11 = Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar11 == 0) { + lVar12 = BfsInsertDirectoryEntry_OLD + (uVar8,local_278,uStack_274,uStack_270,(ushort *)&local_2d0); + } + else { + iVar7 = 0; + if (local_278 == 2) { + iVar7 = iStack_26c; + } + lVar12 = BfsInsertDirectoryEntry + (uVar8,local_278,uStack_274,uStack_270,iVar7,(ushort *)&local_2d0); + } if (lVar12 == 0) { KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(uVar20,0); - lVar12 = (local_2d0[0] & 0xffffffff) * 0x214; - piVar5 = &local_268; + uVar11 = local_2e8 & 0xffffffff; + lVar12 = uVar11 * 0x214; + piVar4 = &local_278; puVar14 = (undefined8 *)(uVar13 + 8 + lVar12); do { puVar19 = puVar14; - piVar17 = piVar5; + piVar17 = piVar4; uVar16 = *(undefined8 *)(piVar17 + 2); - uVar2 = *(undefined8 *)(piVar17 + 4); - uVar3 = *(undefined8 *)(piVar17 + 6); + uVar1 = *(undefined8 *)(piVar17 + 4); + uVar2 = *(undefined8 *)(piVar17 + 6); *puVar19 = *(undefined8 *)piVar17; puVar19[1] = uVar16; uVar16 = *(undefined8 *)(piVar17 + 8); - uVar4 = *(undefined8 *)(piVar17 + 10); - puVar19[2] = uVar2; - puVar19[3] = uVar3; - uVar2 = *(undefined8 *)(piVar17 + 0xc); - uVar3 = *(undefined8 *)(piVar17 + 0xe); + uVar3 = *(undefined8 *)(piVar17 + 10); + puVar19[2] = uVar1; + puVar19[3] = uVar2; + uVar1 = *(undefined8 *)(piVar17 + 0xc); + uVar2 = *(undefined8 *)(piVar17 + 0xe); puVar19[4] = uVar16; - puVar19[5] = uVar4; + puVar19[5] = uVar3; uVar16 = *(undefined8 *)(piVar17 + 0x10); - uVar4 = *(undefined8 *)(piVar17 + 0x12); - puVar19[6] = uVar2; - puVar19[7] = uVar3; - uVar2 = *(undefined8 *)(piVar17 + 0x14); - uVar3 = *(undefined8 *)(piVar17 + 0x16); + uVar3 = *(undefined8 *)(piVar17 + 0x12); + puVar19[6] = uVar1; + puVar19[7] = uVar2; + uVar1 = *(undefined8 *)(piVar17 + 0x14); + uVar2 = *(undefined8 *)(piVar17 + 0x16); puVar19[8] = uVar16; - puVar19[9] = uVar4; + puVar19[9] = uVar3; uVar16 = *(undefined8 *)(piVar17 + 0x18); - uVar4 = *(undefined8 *)(piVar17 + 0x1a); - puVar19[10] = uVar2; - puVar19[0xb] = uVar3; - uVar2 = *(undefined8 *)(piVar17 + 0x1c); - uVar3 = *(undefined8 *)(piVar17 + 0x1e); + uVar3 = *(undefined8 *)(piVar17 + 0x1a); + puVar19[10] = uVar1; + puVar19[0xb] = uVar2; + uVar1 = *(undefined8 *)(piVar17 + 0x1c); + uVar2 = *(undefined8 *)(piVar17 + 0x1e); puVar19[0xc] = uVar16; - puVar19[0xd] = uVar4; - puVar19[0xe] = uVar2; - puVar19[0xf] = uVar3; + puVar19[0xd] = uVar3; + puVar19[0xe] = uVar1; + puVar19[0xf] = uVar2; lVar22 = lVar22 + -1; - piVar5 = piVar17 + 0x20; + piVar4 = piVar17 + 0x20; puVar14 = puVar19 + 0x10; } while (lVar22 != 0); uVar16 = *(undefined8 *)(piVar17 + 0x22); - iVar1 = piVar17[0x24]; + iVar7 = piVar17[0x24]; lVar12 = lVar12 + uVar13; puVar19[0x10] = *(undefined8 *)(piVar17 + 0x20); puVar19[0x11] = uVar16; - *(int *)(puVar19 + 0x12) = iVar1; + *(int *)(puVar19 + 0x12) = iVar7; memset((void *)(lVar12 + 0x1c),0,0x200); - memmove((void *)(lVar12 + 0x1c),pvStack_298,local_2a0 & 0xffff); - RtlSetBits(&local_2b0,local_2d0[0] & 0xffffffff,1); - BfsWriteBlock(param_1,(int)local_2d8,uVar13); + memcpy((void *)(lVar12 + 0x1c),pvStack_2a8,local_2b0 & 0xffff); + RtlSetBits(&local_2c0,uVar11,1); + BfsWriteBlock(param_1,(int)local_2e0[0],uVar13); uVar11 = 0xc0000017; goto LAB_1; } - if (local_268 != 2) { + if (local_278 != 2) { LAB_3: KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(uVar20,0); - uVar16 = BfsWriteBlock(param_1,(int)local_2d8,uVar13); - uVar6 = (uint)uVar16; + uVar16 = BfsWriteBlock(param_1,(int)local_2e0[0],uVar13); + uVar5 = (uint)uVar16; goto LAB_2; } - local_2d0[0] = local_2d0[0] & 0xffffffff00000000; - local_2c0 = 0; + local_2e8 = local_2e8 & 0xffffffff00000000; + local_2d0 = 0; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(uVar8,0); - *(undefined4 *)(lVar12 + 0xc) = uStack_25c; - uVar18 = BfsGetEntryBlock(uVar8,lVar12,(longlong *)&local_2c0,(undefined4 *)local_2d0); + *(int *)(lVar12 + 0xc) = iStack_26c; + uVar18 = BfsGetEntryBlock(uVar8,lVar12,(longlong *)&local_2d0,(undefined4 *)&local_2e8); if (-1 < (int)uVar18) { - uVar18 = BfsWriteBlock(param_1,(int)local_2d0[0],local_2c0); + uVar18 = BfsWriteBlock(param_1,(int)local_2e8,local_2d0); } uVar11 = uVar18 & 0xffffffff; ExReleasePushLockExclusiveEx(uVar8,0); KeLeaveCriticalRegion(); if (-1 < (int)uVar18) goto LAB_3; } BfsDereferenceTableEntry((undefined8 *)(uVar20 - 8)); uVar20 = uVar8; LAB_0: BfsDereferenceTableEntry((undefined8 *)(uVar20 - 8)); return uVar11; } ``` ## BfsInsertPolicyEntry ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.09| |i_ratio|0.33| |m_ratio|0.98| |b_ratio|0.57| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsInsertPolicyEntry|BfsInsertPolicyEntry| |fullname|BfsInsertPolicyEntry|BfsInsertPolicyEntry| |refcount|3|3| |`length`|2007|2060| |`called`|
Expand for full list:
BfsCreateStorage
BfsDereferencePolicyEntryEx
BfsInsertEntryHashTable
BfsLookupPolicyEntryHashTable
BfsOpenPolicyDirectory
FLTMGR.SYS::FltClose
Feature_3148938554__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExSetTimer
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeResetEvent
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlCopySid
NTOSKRNL.EXE::RtlFreeUnicodeString
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsCreateStorage
BfsDereferencePolicyEntryEx
BfsInsertEntryHashTable
BfsLookupPolicyEntryHashTable
BfsOpenPolicyDirectory
FLTMGR.SYS::FltClose
Feature_2191465787__private_IsEnabledDeviceUsageNoInline
Feature_241429816__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExSetTimer
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeResetEvent
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlCopySid
NTOSKRNL.EXE::RtlFreeUnicodeString
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsGetPolicyEntry
BfsProcessCreatePolicyEntryRequest|BfsGetPolicyEntry
BfsProcessCreatePolicyEntryRequest| |paramcount|8|8| |`address`|140008750|140008a54| |`sig`|ulonglong __fastcall BfsInsertPolicyEntry(undefined8 * param_1, undefined8 param_2, longlong param_3, undefined8 param_4, longlong param_5, longlong param_6, char param_7, longlong * param_8)|ulonglong __fastcall BfsInsertPolicyEntry(longlong * param_1, undefined8 param_2, longlong param_3, undefined8 param_4, longlong param_5, longlong param_6, char param_7, ulonglong * param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsInsertPolicyEntry Called Diff ```diff --- BfsInsertPolicyEntry called +++ BfsInsertPolicyEntry called @@ -7,2 +7,2 @@ -Feature_3148938554__private_IsEnabledDeviceUsageNoInline -Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline +Feature_2191465787__private_IsEnabledDeviceUsageNoInline +Feature_241429816__private_IsEnabledDeviceUsageNoInline ``` ### BfsInsertPolicyEntry Diff ```diff --- BfsInsertPolicyEntry +++ BfsInsertPolicyEntry @@ -1,317 +1,328 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* WARNING: Type propagation algorithm not settling */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ ulonglong BfsInsertPolicyEntry - (undefined8 *param_1,undefined8 param_2,longlong param_3,undefined8 param_4, - longlong param_5,longlong param_6,char param_7,longlong *param_8) + (longlong *param_1,undefined8 param_2,longlong param_3,undefined8 param_4, + longlong param_5,longlong param_6,char param_7,ulonglong *param_8) { - longlong *plVar1; - longlong *plVar2; + undefined8 *puVar1; + longlong lVar2; code *pcVar3; - uint uVar4; - longlong lVar5; - longlong lVar6; - longlong lVar7; - ulonglong uVar8; - longlong lVar9; - undefined8 uVar10; - undefined8 *puVar11; - char cVar12; - char cVar13; + bool bVar4; + bool bVar5; + bool bVar6; + undefined8 uVar7; + uint uVar8; + ulonglong uVar9; + ulonglong uVar10; + ulonglong uVar11; + ulonglong uVar12; + longlong lVar13; + ulonglong uVar14; + longlong *plVar15; + longlong *plVar16; undefined1 auStackY_128 [32]; - char local_f8; - char local_f7; - undefined8 local_f0; + longlong local_f0; char local_e8; - char local_e7; - char local_e5; - undefined8 *local_e0; - longlong local_d8; + longlong *local_e0; + undefined8 local_d8; longlong local_d0; longlong local_c8; - undefined8 local_c0; - longlong local_b8; - longlong *local_b0; - undefined8 local_a8; - undefined8 uStack_a0; - undefined8 local_98; - undefined8 uStack_90; - undefined8 *local_68; + ulonglong *local_c0; + undefined8 local_b8; + longlong local_b0 [9]; + longlong *local_68; undefined8 local_60; ulonglong local_58; local_58 = __security_cookie ^ (ulonglong)auStackY_128; local_c8 = param_5; - lVar7 = 0; - local_d8 = 0; - local_b8 = 0; - cVar13 = '\0'; - local_f7 = '\0'; - cVar12 = '\0'; - local_f8 = '\0'; + uVar14 = 0; + local_f0 = 0; + local_b0[0] = 0; + bVar4 = false; + bVar6 = false; + bVar5 = false; local_e8 = '\0'; local_d0 = param_6; - local_b0 = param_8; - local_98 = 0; - uStack_90 = 0; - local_a8 = 0; - uStack_a0 = 0; - local_f0 = param_2; + local_c0 = param_8; + local_b0[3] = 0; + local_b0[4] = 0; + local_b0[1] = 0; + local_b0[2] = 0; local_e0 = param_1; - local_c0 = param_4; + local_d8 = param_2; + local_b8 = param_4; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(param_3,0); - uVar8 = *(ulonglong *)(param_3 + 8); - lVar5 = BfsLookupPolicyEntryHashTable(uVar8,local_c0,local_c8,param_6); - lVar9 = local_c8; - if (lVar5 == 0) { - lVar6 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(local_c8 + 1) * 4 + 8,0x53736642); - if ((lVar6 == 0) || - (lVar7 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(local_d0 + 1) * 4 + 8,0x53736642), - lVar7 == 0)) goto LAB_0; - uVar8 = (ulonglong)((uint)*(byte *)(lVar9 + 1) * 4 + 8); - uVar4 = RtlCopySid(uVar8,lVar6,lVar9); - if ((int)uVar4 < 0) { -LAB_1: - if (3 < DAT_2) { - local_f0 = CONCAT44(local_f0._4_4_,uVar4); + uVar9 = BfsLookupPolicyEntryHashTable(*(undefined8 *)(param_3 + 8),local_b8,local_c8,param_6); + lVar13 = local_c8; + uVar12 = uVar14; + if (uVar9 == 0) { + uVar10 = 0x100; + uVar11 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(local_c8 + 1) * 4 + 8,0x53736642); + uVar14 = uVar11; + if (uVar11 == 0) { +LAB_0: + uVar8 = 0xc0000017; + uVar14 = uVar11; + } + else { + uVar10 = 0x100; + uVar12 = ExAllocatePool2(0x100,(ulonglong)*(byte *)(local_d0 + 1) * 4 + 8,0x53736642); + if (uVar12 == 0) goto LAB_0; + uVar10 = (ulonglong)((uint)*(byte *)(lVar13 + 1) * 4 + 8); + uVar8 = RtlCopySid(uVar10,uVar11,lVar13); + if (-1 < (int)uVar8) { + uVar10 = (ulonglong)((uint)*(byte *)(local_d0 + 1) * 4 + 8); + uVar8 = RtlCopySid(uVar10,uVar12,local_d0); + if (-1 < (int)uVar8) { + uVar10 = 0x100; + uVar9 = ExAllocatePool2(0x100,0xa0,0x45736642); + if (uVar9 != 0) { + LOCK(); + *(int *)(uVar9 + 0x98) = *(int *)(uVar9 + 0x98) + 1; + UNLOCK(); + lVar13 = ExAllocatePool2(0x40,0x18,0x76736642); + uVar14 = 0; + *(longlong *)(uVar9 + 0x28) = lVar13; + uVar10 = uVar14; + if (lVar13 != 0) { + *(ulonglong *)(uVar9 + 0x18) = uVar11; + *(ulonglong *)(uVar9 + 0x20) = uVar12; + *(undefined4 *)(uVar9 + 0x68) = 0; + *(undefined4 *)(uVar9 + 0x38) = 0x10000001; + *(undefined8 *)(uVar9 + 0x70) = 0; + *(undefined8 *)(uVar9 + 0x78) = 0; + *(undefined2 *)(uVar9 + 0x72) = 0; + *(undefined8 *)(uVar9 + 0x78) = 0; + *(undefined8 *)(uVar9 + 0x80) = 0; + *(undefined8 *)(uVar9 + 0x88) = 0; + *(undefined2 *)(uVar9 + 0x82) = 0; + *(undefined8 *)(uVar9 + 0x88) = 0; + KeInitializeEvent(lVar13,0,0); + uVar10 = *(ulonglong *)(param_3 + 8); + uVar8 = BfsInsertEntryHashTable(uVar10,local_b8,uVar9); + uVar12 = uVar14; + if (-1 < (int)uVar8) { + LOCK(); + *(int *)(uVar9 + 0x98) = *(int *)(uVar9 + 0x98) + 1; + UNLOCK(); + plVar15 = (longlong *)(param_3 + 0x10); + bVar6 = true; + if ((longlong *)*plVar15 == plVar15) { + ExSetTimer(*(undefined8 *)(param_3 + 0x20),0xffffffffee1e5d00,300000000); + } + puVar1 = *(undefined8 **)(param_3 + 0x18); + plVar16 = (longlong *)(uVar9 + 0x40); + if ((longlong *)*puVar1 != plVar15) goto LAB_1; + *plVar16 = (longlong)plVar15; + *(undefined8 **)(uVar9 + 0x48) = puVar1; + *puVar1 = plVar16; + *(longlong **)(param_3 + 0x18) = plVar16; + LOCK(); + *(undefined8 *)(uVar9 + 0x60) = _DAT_2; + UNLOCK(); + goto LAB_3; + } + goto LAB_4; + } + } + goto LAB_0; + } + } + } +LAB_4: + if (3 < DAT_5) { + local_f0 = CONCAT44(local_f0._4_4_,uVar8); + local_68 = &local_f0; + local_60 = 4; + _tlgWriteTransfer_EtwWriteTransfer(uVar10,&DAT_6); + } +LAB_7: + ExReleasePushLockExclusiveEx(); + KeLeaveCriticalRegion(); + bVar5 = false; + bVar4 = false; + if (-1 < (int)uVar8) goto LAB_8; +LAB_9: + if (uVar9 != 0) goto LAB_10; + } + else { + if ((*(uint *)(uVar9 + 0x38) >> 0x1c & 1) == 0) { + if (*(uint *)(uVar9 + 0x38) != 2) { + uVar11 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + uVar10 = 0; + uVar8 = 0xc0000001; + if ((int)uVar11 != 0) { + uVar9 = uVar10; + } + goto LAB_4; + } + *(undefined4 *)(uVar9 + 0x38) = 0x10000001; + KeResetEvent(*(undefined8 *)(uVar9 + 0x28)); + uVar14 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + local_e8 = (int)uVar14 != 0; + LOCK(); + *(int *)(uVar9 + 0x98) = *(int *)(uVar9 + 0x98) + 1; + UNLOCK(); LAB_3: + ExReleasePushLockExclusiveEx(param_3,0); + KeLeaveCriticalRegion(); + plVar15 = local_b0 + 1; + uVar8 = RtlConvertSidToUnicodeString(plVar15,local_c8,1); + if (-1 < (int)uVar8) { + plVar15 = local_b0 + 3; + bVar4 = true; + uVar8 = RtlConvertSidToUnicodeString(plVar15,local_d0,1); + uVar7 = local_d8; + plVar16 = local_e0; + if ((int)uVar8 < 0) goto LAB_11; + bVar5 = true; + uVar8 = BfsOpenPolicyDirectory(local_e0,local_d8,local_b0 + 1,'\0',local_b0); + if ((int)uVar8 < 0) { + if (3 < DAT_5) { + local_f0 = CONCAT44(local_f0._4_4_,uVar8); + local_68 = &local_f0; + local_60 = 4; + _tlgWriteTransfer_EtwWriteTransfer(0,&DAT_6); + } + uVar14 = 0; + uVar12 = uVar14; + goto LAB_9; + } + uVar12 = BfsCreateStorage((longlong)plVar16,uVar7,local_b0[0],(ulonglong)(local_b0 + 3), + param_7,&local_f0); + uVar14 = 0; + uVar8 = (uint)uVar12; + plVar15 = plVar16; + if ((int)uVar8 < 0) goto LAB_11; + RtlFreeUnicodeString(local_b0 + 1); + RtlFreeUnicodeString(local_b0 + 3); + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(param_3); + *(longlong *)(uVar9 + 0x30) = local_f0; + *(undefined4 *)(uVar9 + 0x38) = 0x10000000; + KeSetEvent(*(undefined8 *)(uVar9 + 0x28),0,0); + *local_c0 = uVar9; + uVar12 = uVar14; + goto LAB_7; + } +LAB_11: + uVar14 = 0; + uVar12 = uVar14; + if (3 < DAT_5) { + local_f0 = CONCAT44(local_f0._4_4_,uVar8); local_68 = &local_f0; local_60 = 4; - _tlgWriteTransfer_EtwWriteTransfer(uVar8,&DAT_4); - } - } - else { - uVar8 = (ulonglong)((uint)*(byte *)(local_d0 + 1) * 4 + 8); - uVar4 = RtlCopySid(uVar8,lVar7,local_d0); - if ((int)uVar4 < 0) goto LAB_1; - lVar5 = ExAllocatePool2(0x100,0xa0,0x45736642); - if (lVar5 != 0) { - LOCK(); - *(int *)(lVar5 + 0x98) = *(int *)(lVar5 + 0x98) + 1; - UNLOCK(); - lVar9 = ExAllocatePool2(0x40,0x18,0x76736642); - *(longlong *)(lVar5 + 0x28) = lVar9; - if (lVar9 != 0) { - *(longlong *)(lVar5 + 0x18) = lVar6; - uVar8 = Feature_3148938554__private_IsEnabledDeviceUsageNoInline(); - *(longlong *)(lVar5 + 0x20) = lVar7; - if ((int)uVar8 != 0) { - lVar6 = 0; - } - uVar8 = Feature_3148938554__private_IsEnabledDeviceUsageNoInline(); - *(undefined4 *)(lVar5 + 0x38) = 0x10000001; - *(undefined4 *)(lVar5 + 0x68) = 0; - *(undefined8 *)(lVar5 + 0x70) = 0; - *(undefined8 *)(lVar5 + 0x78) = 0; - *(undefined2 *)(lVar5 + 0x72) = 0; - if ((int)uVar8 != 0) { - lVar7 = 0; - } - *(undefined8 *)(lVar5 + 0x78) = 0; - *(undefined8 *)(lVar5 + 0x80) = 0; - *(undefined8 *)(lVar5 + 0x88) = 0; - *(undefined2 *)(lVar5 + 0x82) = 0; - *(undefined8 *)(lVar5 + 0x88) = 0; - KeInitializeEvent(*(undefined8 *)(lVar5 + 0x28),0,0); - uVar8 = *(ulonglong *)(param_3 + 8); - uVar4 = BfsInsertEntryHashTable(uVar8,local_c0,lVar5); - if (-1 < (int)uVar4) { - LOCK(); - *(int *)(lVar5 + 0x98) = *(int *)(lVar5 + 0x98) + 1; - UNLOCK(); - plVar1 = (longlong *)(param_3 + 0x10); - local_f7 = '\x01'; - if ((longlong *)*plVar1 == plVar1) { - ExSetTimer(*(undefined8 *)(param_3 + 0x20),0xffffffffee1e5d00,300000000); - } - puVar11 = *(undefined8 **)(param_3 + 0x18); - plVar2 = (longlong *)(lVar5 + 0x40); - if ((longlong *)*puVar11 != plVar1) goto LAB_5; - *plVar2 = (longlong)plVar1; - *(undefined8 **)(lVar5 + 0x48) = puVar11; - *puVar11 = plVar2; - *(longlong **)(param_3 + 0x18) = plVar2; - LOCK(); - *(undefined8 *)(lVar5 + 0x60) = _DAT_6; - UNLOCK(); - goto LAB_7; - } - goto LAB_1; - } - } -LAB_0: - uVar8 = 0xc0000017; - uVar4 = 0xc0000017; - if (3 < DAT_2) { - local_f0 = CONCAT44(local_f0._4_4_,0xc0000017); - uVar4 = 0xc0000017; - goto LAB_3; - } - } -LAB_8: - ExReleasePushLockExclusiveEx(param_3); - KeLeaveCriticalRegion(); - cVar13 = '\0'; - local_f8 = '\0'; - cVar12 = cVar13; - if ((int)uVar4 < 0) { -LAB_9: - if (lVar5 != 0) { -LAB_10: - local_e5 = local_f7; - local_e7 = cVar12; - uVar8 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar8 != 0) && (local_f7 = local_e5, local_f8 = cVar12, local_e8 != '\0')) { - local_f8 = local_e7; - if (local_e5 == '\0') { - KeEnterCriticalRegion(uVar4,lVar6,lVar7,cVar13); - ExAcquirePushLockExclusiveEx(param_3); - *(undefined4 *)(lVar5 + 0x38) = 2; - KeSetEvent(*(undefined8 *)(lVar5 + 0x28),0,0); - ExReleasePushLockExclusiveEx(param_3); - KeLeaveCriticalRegion(); - local_f8 = local_e7; - local_f7 = local_e5; - } - } - BfsDereferencePolicyEntryEx(lVar5,'\0'); - } - if (local_f7 != '\0') { - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_3,0); - lVar9 = BfsLookupPolicyEntryHashTable - (*(undefined8 *)(param_3 + 8),local_c0,local_c8,local_d0); - if (lVar9 == 0) { - ExReleasePushLockExclusiveEx(param_3,0); - KeLeaveCriticalRegion(); - } - else { - plVar1 = (longlong *)(lVar9 + 0x40); - *(undefined4 *)(lVar9 + 0x38) = 1; - lVar5 = *plVar1; - if ((*(longlong **)(lVar5 + 8) != plVar1) || - (plVar2 = *(longlong **)(lVar9 + 0x48), (longlong *)*plVar2 != plVar1)) { -LAB_5: - pcVar3 = (code *)swi(0x29); - (*pcVar3)(3); - pcVar3 = (code *)swi(3); - uVar8 = (*pcVar3)(); - return uVar8; - } - *plVar2 = lVar5; - *(longlong **)(lVar5 + 8) = plVar2; - uVar8 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar8 != 0) { - *plVar1 = 0; - *(undefined8 *)(lVar9 + 0x48) = 0; - } - ExReleasePushLockExclusiveEx(param_3); - KeLeaveCriticalRegion(); - KeSetEvent(*(undefined8 *)(lVar9 + 0x28),0,0); - BfsDereferencePolicyEntryEx(lVar9,'\0'); - } - } - if (cVar13 != '\0') { - RtlFreeUnicodeString(&local_a8); - } - if (local_f8 != '\0') { - RtlFreeUnicodeString(&local_98); - } - if (lVar6 != 0) { - ExFreePoolWithTag(lVar6,0); - } - if (lVar7 != 0) { - ExFreePoolWithTag(lVar7,0); - } - } - if (local_b8 != 0) { - FltClose(); - } - uVar8 = (ulonglong)uVar4; - } - else { - lVar6 = lVar7; - if ((*(uint *)(lVar5 + 0x38) >> 0x1c & 1) == 0) { - if (*(uint *)(lVar5 + 0x38) != 2) { - uVar4 = 0xc0000001; - goto LAB_1; - } - *(undefined4 *)(lVar5 + 0x38) = 0x10000001; - KeResetEvent(*(undefined8 *)(lVar5 + 0x28)); - uVar8 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - local_e8 = (int)uVar8 != 0; - LOCK(); - *(int *)(lVar5 + 0x98) = *(int *)(lVar5 + 0x98) + 1; - UNLOCK(); -LAB_7: - ExReleasePushLockExclusiveEx(param_3,0); - KeLeaveCriticalRegion(); - puVar11 = &local_a8; - uVar4 = RtlConvertSidToUnicodeString(puVar11,local_c8,1); - if (-1 < (int)uVar4) { - puVar11 = &local_98; - cVar13 = '\x01'; - uVar4 = RtlConvertSidToUnicodeString(puVar11,local_d0,1); - if (-1 < (int)uVar4) { - cVar12 = '\x01'; - local_f8 = '\x01'; - puVar11 = local_e0; - uVar4 = BfsOpenPolicyDirectory(local_e0,local_f0,&local_a8,'\0',&local_b8); - if (-1 < (int)uVar4) { - puVar11 = local_e0; - uVar8 = BfsCreateStorage((longlong)local_e0,local_f0,local_b8,(ulonglong)&local_98, - param_7,&local_d8); - uVar4 = (uint)uVar8; - if (-1 < (int)uVar4) { - RtlFreeUnicodeString(&local_a8); - RtlFreeUnicodeString(&local_98); - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_3); - *(longlong *)(lVar5 + 0x30) = local_d8; - *(undefined4 *)(lVar5 + 0x38) = 0x10000000; - KeSetEvent(*(undefined8 *)(lVar5 + 0x28),0,0); - *local_b0 = lVar5; - goto LAB_8; - } - } - } - } - if (3 < DAT_2) { - local_f0 = CONCAT44(local_f0._4_4_,uVar4); - local_68 = &local_f0; - local_60 = 4; - _tlgWriteTransfer_EtwWriteTransfer(puVar11,&DAT_4); + _tlgWriteTransfer_EtwWriteTransfer(plVar15,&DAT_6); } goto LAB_9; } LOCK(); - *(int *)(lVar5 + 0x98) = *(int *)(lVar5 + 0x98) + 1; + *(int *)(uVar9 + 0x98) = *(int *)(uVar9 + 0x98) + 1; UNLOCK(); + lVar13 = param_3; ExReleasePushLockExclusiveEx(); KeLeaveCriticalRegion(); - if (*(int *)(lVar5 + 0x38) == 0x10000001) { - uVar10 = *(undefined8 *)(lVar5 + 0x28); - KeWaitForSingleObject(uVar10,0,0,0); - if (*(int *)(lVar5 + 0x38) != 0x10000000) { - uVar4 = 0xc0000001; - if (3 < DAT_2) { - local_f0 = CONCAT44(local_f0._4_4_,0xc0000001); - local_68 = &local_f0; - local_60 = 4; - _tlgWriteTransfer_EtwWriteTransfer(uVar10,&DAT_4); - lVar6 = 0; - lVar7 = 0; - uVar4 = 0xc0000001; - } - goto LAB_10; - } - } - *param_8 = lVar5; - uVar8 = 0; - } - return uVar8; + if (*(int *)(uVar9 + 0x38) == 0x10000001) { + lVar13 = *(longlong *)(uVar9 + 0x28); + KeWaitForSingleObject(lVar13,0,0,0); + uVar10 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar10 != 0) || (*(int *)(uVar9 + 0x38) == 0x10000000)) goto LAB_12; + } + else { +LAB_12: + uVar10 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar10 == 0) || (*(int *)(uVar9 + 0x38) == 0x10000000)) { + *param_8 = uVar9; + return 0; + } + } + uVar8 = 0xc0000001; + if (3 < DAT_5) { + local_f0 = CONCAT44(local_f0._4_4_,0xc0000001); + local_68 = &local_f0; + local_60 = 4; + _tlgWriteTransfer_EtwWriteTransfer(lVar13,&DAT_6); + uVar14 = 0; + uVar12 = 0; + uVar8 = 0xc0000001; + } +LAB_10: + local_f0 = CONCAT44(local_f0._4_4_,uVar8); + uVar10 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if ((((int)uVar10 != 0) && (local_e8 != '\0')) && (!bVar6)) { + KeEnterCriticalRegion(0,uVar8,uVar14,uVar12); + ExAcquirePushLockExclusiveEx(param_3); + *(undefined4 *)(uVar9 + 0x38) = 2; + KeSetEvent(*(undefined8 *)(uVar9 + 0x28),0,0); + ExReleasePushLockExclusiveEx(param_3); + KeLeaveCriticalRegion(); + uVar8 = (uint)local_f0; + } + BfsDereferencePolicyEntryEx(uVar9,'\0'); + } + if (bVar6) { + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(param_3,0); + lVar13 = BfsLookupPolicyEntryHashTable(*(undefined8 *)(param_3 + 8),local_b8,local_c8,local_d0); + if (lVar13 != 0) { + *(undefined4 *)(lVar13 + 0x38) = 1; + plVar15 = (longlong *)(lVar13 + 0x40); + lVar2 = *plVar15; + if ((*(longlong **)(lVar2 + 8) != plVar15) || + (plVar16 = *(longlong **)(lVar13 + 0x48), (longlong *)*plVar16 != plVar15)) { +LAB_1: + pcVar3 = (code *)swi(0x29); + (*pcVar3)(3); + pcVar3 = (code *)swi(3); + uVar14 = (*pcVar3)(); + return uVar14; + } + *plVar16 = lVar2; + *(longlong **)(lVar2 + 8) = plVar16; + uVar9 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 != 0) { + *(undefined8 *)(lVar13 + 0x40) = 0; + *(undefined8 *)(lVar13 + 0x48) = 0; + } + uVar9 = Feature_2191465787__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 == 0) { + ExReleasePushLockExclusiveEx(param_3); + KeLeaveCriticalRegion(); + } + KeSetEvent(*(undefined8 *)(lVar13 + 0x28),0,0); + uVar9 = Feature_2191465787__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 == 0) { + BfsDereferencePolicyEntryEx(lVar13,'\0'); + goto LAB_13; + } + BfsDereferencePolicyEntryEx(lVar13,'\x01'); + } + ExReleasePushLockExclusiveEx(param_3,0); + KeLeaveCriticalRegion(); + } +LAB_13: + if (bVar4) { + RtlFreeUnicodeString(local_b0 + 1); + } + if (bVar5) { + RtlFreeUnicodeString(local_b0 + 3); + } + if (uVar14 != 0) { + ExFreePoolWithTag(uVar14,0); + } + if (uVar12 != 0) { + ExFreePoolWithTag(uVar12,0); + } +LAB_8: + if (local_b0[0] != 0) { + FltClose(); + } + return (ulonglong)uVar8; } ``` ## BfsCreateStorage ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.98| |i_ratio|0.59| |m_ratio|0.99| |b_ratio|0.74| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsCreateStorage|BfsCreateStorage| |fullname|BfsCreateStorage|BfsCreateStorage| |refcount|4|4| |`length`|1412|1399| |`called`|
Expand for full list:
BfsAllocateBlock
BfsOpenRootDirectory
BfsReadBlock
BfsWriteBlock
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
Feature_1122292024__private_IsEnabledDeviceUsageNoInline
Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializePushLockNTOSKRNL.EXE::RtlInitializeBitMap
NTOSKRNL.EXE::RtlInitializeGenericTableAvl
NTOSKRNL.EXE::ZwQueryInformationFile
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
|
Expand for full list:
BfsAllocateBlock
BfsOpenRootDirectory
BfsReadBlock
BfsWriteBlock
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx2
Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializePushLock
NTOSKRNL.EXE::RtlInitializeBitMapNTOSKRNL.EXE::RtlInitializeGenericTableAvl
NTOSKRNL.EXE::ZwQueryInformationFile
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
| |calling|BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLoadUserPolicyEntriesToGlobalFileTable|BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLoadUserPolicyEntriesToGlobalFileTable| |paramcount|6|6| |`address`|140012d94|140012f40| |sig|ulonglong __fastcall BfsCreateStorage(longlong param_1, undefined8 param_2, undefined8 param_3, ulonglong param_4, char param_5, longlong * param_6)|ulonglong __fastcall BfsCreateStorage(longlong param_1, undefined8 param_2, undefined8 param_3, ulonglong param_4, char param_5, longlong * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsCreateStorage Called Diff ```diff --- BfsCreateStorage called +++ BfsCreateStorage called @@ -7 +6,0 @@ -Feature_1122292024__private_IsEnabledDeviceUsageNoInline ``` ### BfsCreateStorage Diff ```diff --- BfsCreateStorage +++ BfsCreateStorage @@ -1,289 +1,285 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsCreateStorage(longlong param_1,undefined8 param_2,undefined8 param_3,ulonglong param_4, char param_5,longlong *param_6) { int iVar1; uint uVar2; ulonglong uVar3; longlong lVar4; longlong lVar5; undefined4 *puVar6; undefined4 *_Dst; undefined4 *puVar8; undefined1 auStack_1a8 [32]; undefined8 local_188; undefined8 *local_180; undefined8 *local_178; undefined8 local_170; undefined4 local_168; undefined4 local_160; undefined4 local_158; undefined4 local_150; undefined8 local_148; undefined4 local_140; undefined4 local_138; undefined8 local_130; ulonglong local_128; longlong local_120; int local_118 [2]; undefined8 local_110; longlong lStack_108; undefined8 local_100; undefined8 uStack_f8; ulonglong local_f0; undefined8 uStack_e8; undefined *local_e0; ulonglong local_d8; longlong *local_d0; undefined8 local_c8; undefined8 uStack_c0; undefined8 local_b8 [4]; ulonglong *local_98; undefined8 local_90; undefined8 local_88; longlong lStack_80; undefined8 local_78; ulonglong *local_68; undefined8 local_60; ulonglong local_58; undefined4 *puVar7; local_58 = __security_cookie ^ (ulonglong)auStack_1a8; local_d0 = param_6; local_120 = 0; puVar7 = (undefined4 *)0x0; _Dst = (undefined4 *)0x0; *param_6 = 0; lVar4 = 0; puVar6 = (undefined4 *)0x0; puVar8 = (undefined4 *)0x0; local_e0 = (undefined *)0x0; local_d8 = local_d8 & 0xffffffff00000000; local_110 = 0; lStack_108 = 0; local_100 = 0; uStack_f8 = 0; local_f0 = 0; uStack_e8 = 0; local_128 = param_4; uVar3 = Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline(); if (((int)uVar3 == 0) || (param_5 == '\0')) { local_f0 = local_128; local_e0 = &gBfsPolicyStorageFileDescriptor; local_130 = 0; local_178 = &local_110; local_138 = 0x100; local_140 = 0; local_148 = 0; local_150 = 0x860; local_158 = 3; local_160 = 0; local_168 = 0x80; local_170 = 0; local_180 = &local_100; local_188 = CONCAT44(local_188._4_4_,0xc0110000); local_100 = CONCAT44(local_100._4_4_,0x30); uStack_e8 = CONCAT44(uStack_e8._4_4_,0x240); local_d8 = 0; uStack_f8 = param_3; uVar2 = FltCreateFileEx2(param_1,param_2,&local_120,0); uVar3 = (ulonglong)uVar2; if (-1 < (int)uVar2) goto LAB_0; LAB_1: _Dst = puVar7; if (3 < DAT_2) { local_128 = CONCAT44(local_128._4_4_,uVar2); local_68 = &local_128; local_180 = &local_88; local_60 = 4; LAB_3: _tlgWriteTransfer_EtwWriteTransfer(param_1,&DAT_4); } } else { lStack_108 = 2; local_110 = 0; local_120 = 0; LAB_0: param_1 = 0x100; lVar4 = ExAllocatePool2(0x100,0xd0,0x73736642); if (lVar4 == 0) { uVar2 = 0xc0000017; uVar3 = 0xc0000017; goto LAB_1; } ExInitializePushLock(lVar4); uVar3 = Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar3 != 0) { *(bool *)(lVar4 + 200) = param_5 != '\0'; } *(longlong *)(lVar4 + 8) = local_120; uVar3 = Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline(); + param_1 = local_120; if ((int)uVar3 != 0) { - if ((param_5 == '\0') && - (uVar3 = Feature_1122292024__private_IsEnabledDeviceUsageNoInline(), (int)uVar3 != 0)) { + if (param_5 == '\0') { if (lStack_108 == 2) goto LAB_5; local_188 = CONCAT44(local_188._4_4_,5); local_78 = 0; local_c8 = 0; uStack_c0 = 0; local_88 = 0; lStack_80 = 0; - param_1 = local_120; uVar2 = ZwQueryInformationFile(local_120,&local_c8,&local_88,0x18); uVar3 = (ulonglong)uVar2; _Dst = puVar7; puVar7 = puVar6; if ((int)uVar2 < 0) goto LAB_6; lVar5 = 2; if (lStack_80 == 0) goto LAB_7; } LAB_8: if (lStack_108 == 2) goto LAB_5; param_1 = 0x100; _Dst = (undefined4 *)ExAllocatePool2(0x100,0x4000,0x63736642); if (_Dst != (undefined4 *)0x0) { param_1 = lVar4; uVar3 = BfsReadBlock(lVar4,0,_Dst); uVar2 = (uint)uVar3; uVar3 = uVar3 & 0xffffffff; - puVar7 = puVar8; + puVar7 = puVar6; if (-1 < (int)uVar2) { *(undefined4 **)(lVar4 + 0x10) = _Dst; RtlInitializeBitMap(lVar4 + 0x18,_Dst + 6,0x1ff40); param_1 = lVar4; uVar3 = BfsOpenRootDirectory(lVar4); uVar2 = (uint)uVar3; uVar3 = uVar3 & 0xffffffff; if ((int)uVar2 < 0) goto LAB_6; ExInitializePushLock(lVar4 + 0x48); local_188 = 0; RtlInitializeGenericTableAvl (lVar4 + 0x50,BfsCompareTableEntries,BfsAllocateTableEntry,BfsFreeTableEntry); LAB_9: *local_d0 = lVar4; goto LAB_10; } goto LAB_6; } LAB_11: uVar2 = 0xc0000017; uVar3 = 0xc0000017; puVar7 = puVar6; LAB_6: puVar6 = puVar7; - if (DAT_2 < 4) goto LAB_14001325c; + if (DAT_2 < 4) goto LAB_14001346e; local_128 = CONCAT44(local_128._4_4_,uVar2); LAB_13: local_98 = &local_128; local_90 = 4; local_180 = local_b8; goto LAB_3; } - uVar3 = Feature_1122292024__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 == 0) goto LAB_8; if (lStack_108 != 2) { local_188 = CONCAT44(local_188._4_4_,5); local_78 = 0; local_c8 = 0; uStack_c0 = 0; local_88 = 0; lStack_80 = 0; - param_1 = local_120; uVar2 = ZwQueryInformationFile(local_120,&local_c8,&local_88,0x18); uVar3 = (ulonglong)uVar2; puVar7 = puVar8; if (-1 < (int)uVar2) { lVar5 = lStack_108; if (lStack_80 == 0) { lVar5 = 2; } LAB_7: lStack_108 = lVar5; goto LAB_8; } goto LAB_6; } LAB_5: local_118[0] = 0; local_128 = local_128 & 0xffffffff00000000; param_1 = 0x100; _Dst = (undefined4 *)ExAllocatePool2(0x100,0x4000,0x63736642); if (_Dst == (undefined4 *)0x0) goto LAB_11; memset(_Dst,0,0x4000); *_Dst = 0x43736642; _Dst[2] = 0x4000; _Dst[1] = _Dst[1] & 0xff000001 | 1; *(undefined1 *)((longlong)_Dst + 7) = 0; *(undefined4 **)(lVar4 + 0x10) = _Dst; RtlInitializeBitMap(lVar4 + 0x18,_Dst + 6,0x1ff40); ExInitializePushLock(lVar4 + 0x48); local_188 = 0; RtlInitializeGenericTableAvl (lVar4 + 0x50,BfsCompareTableEntries,BfsAllocateTableEntry,BfsFreeTableEntry); param_1 = lVar4; uVar3 = BfsAllocateBlock(lVar4,local_118); uVar2 = (uint)uVar3; uVar3 = uVar3 & 0xffffffff; - puVar7 = puVar6; + puVar7 = puVar8; if ((int)uVar2 < 0) goto LAB_6; if (local_118[0] == 0) { param_1 = lVar4; uVar3 = BfsAllocateBlock(lVar4,(int *)&local_128); uVar2 = (uint)uVar3; uVar3 = uVar3 & 0xffffffff; if (-1 < (int)uVar2) { iVar1 = (int)local_128; param_1 = 0x100; *(int *)(*(longlong *)(lVar4 + 0x10) + 0xc) = (int)local_128; puVar6 = (undefined4 *)ExAllocatePool2(0x100,0x4000,0x62736642); if (puVar6 == (undefined4 *)0x0) goto LAB_11; memset(puVar6 + 1,0,0x3ffc); *puVar6 = 0x44736642; param_1 = lVar4; uVar3 = BfsWriteBlock(lVar4,0,_Dst); uVar2 = (uint)uVar3; uVar3 = uVar3 & 0xffffffff; puVar7 = puVar6; if (-1 < (int)uVar2) { param_1 = lVar4; uVar3 = BfsWriteBlock(lVar4,iVar1,puVar6); uVar2 = (uint)uVar3; uVar3 = uVar3 & 0xffffffff; if (-1 < (int)uVar2) { param_1 = lVar4; uVar3 = BfsOpenRootDirectory(lVar4); uVar2 = (uint)uVar3; uVar3 = uVar3 & 0xffffffff; if (-1 < (int)uVar2) goto LAB_9; } } } goto LAB_6; } uVar3 = 0xc0000032; if (3 < DAT_2) { local_128 = CONCAT44(local_128._4_4_,0xc0000032); goto LAB_13; } } LAB_12: if (local_120 != 0) { FltClose(); } if (lVar4 != 0) { ExFreePoolWithTag(lVar4,0); } if (_Dst != (undefined4 *)0x0) { ExFreePoolWithTag(_Dst,0); } LAB_10: if (puVar6 != (undefined4 *)0x0) { ExFreePoolWithTag(puVar6,0); } return uVar3; } ``` ## BfsPostCreateOperation ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.87| |i_ratio|0.73| |m_ratio|0.99| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsPostCreateOperation|BfsPostCreateOperation| |fullname|BfsPostCreateOperation|BfsPostCreateOperation| |refcount|4|4| |`length`|2390|2368| |`called`|
Expand for full list:
BfsAddOrModifyEntry
BfsDereferencePolicyEntryEx
BfsGetFileContext
BfsGetFileName
BfsPerformPrompt
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltSetCallbackDataDirty
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInlineFeature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::PsGetCurrentProcessId
NTOSKRNL.EXE::RtlCheckTokenCapability
NTOSKRNL.EXE::RtlEqualUnicodeString
NTOSKRNL.EXE::RtlGetNextEntryHashTable
NTOSKRNL.EXE::RtlLookupEntryHashTable
NTOSKRNL.EXE::RtlUpcaseUnicodeChar
NTOSKRNL.EXE::SeCaptureSubjectContext
NTOSKRNL.EXE::SeQuerySessionIdToken
NTOSKRNL.EXE::SeReleaseSubjectContext
__security_check_cookie
|
Expand for full list:
BfsAddOrModifyEntry
BfsDereferencePolicyEntryEx
BfsGetFileContext
BfsGetFileName
BfsPerformPrompt
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleaseFileNameInformation
FLTMGR.SYS::FltSetCallbackDataDirty
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInlineFeature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::PsGetCurrentProcessId
NTOSKRNL.EXE::RtlCheckTokenCapability
NTOSKRNL.EXE::RtlEqualUnicodeString
NTOSKRNL.EXE::RtlGetNextEntryHashTable
NTOSKRNL.EXE::RtlLookupEntryHashTable
NTOSKRNL.EXE::RtlUpcaseUnicodeChar
NTOSKRNL.EXE::SeCaptureSubjectContext
NTOSKRNL.EXE::SeQuerySessionIdToken
NTOSKRNL.EXE::SeReleaseSubjectContext
__security_check_cookie
| |calling||| |paramcount|4|4| |`address`|140001af0|140001ae0| |sig|undefined8 __fastcall BfsPostCreateOperation(longlong param_1, longlong param_2, uint * param_3, ulonglong param_4)|undefined8 __fastcall BfsPostCreateOperation(longlong param_1, longlong param_2, uint * param_3, ulonglong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsPostCreateOperation Called Diff ```diff --- BfsPostCreateOperation called +++ BfsPostCreateOperation called @@ -9 +8,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline ``` ### BfsPostCreateOperation Diff ```diff --- BfsPostCreateOperation +++ BfsPostCreateOperation @@ -1,352 +1,347 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined8 BfsPostCreateOperation(longlong param_1,longlong param_2,uint *param_3,ulonglong param_4) { byte *pbVar1; uint *puVar2; longlong *plVar3; longlong lVar4; longlong *plVar5; code *pcVar6; char cVar7; ushort uVar8; int iVar9; ulonglong uVar10; ulonglong *puVar11; longlong lVar12; undefined8 uVar13; short sVar14; - ulonglong uVar15; - uint uVar16; - byte bVar17; - longlong lVar18; + int iVar15; + ulonglong uVar16; + uint uVar17; + byte bVar18; + longlong lVar19; undefined1 auStackY_d8 [32]; char local_a8; char local_a7; undefined8 local_98; ulonglong uStack_90; int local_88; int local_84; int local_80; int local_7c; undefined1 *local_78; undefined *local_70; undefined8 uStack_68; undefined *local_60; undefined4 local_58; undefined4 local_54; int *local_50; undefined8 local_48; ulonglong local_40; local_40 = __security_cookie ^ (ulonglong)auStackY_d8; local_78 = (undefined1 *)0x0; - lVar18 = 0; + lVar19 = 0; local_98 = 0; uStack_90 = 0; local_a7 = '\0'; uVar10 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); pbVar1 = (byte *)(param_1 + 0x20); if ((int)uVar10 == 0) { - bVar17 = *pbVar1 & 2; + bVar18 = *pbVar1 & 2; } else { - bVar17 = *(longlong *)pbVar1 == 2; + bVar18 = *(longlong *)pbVar1 == 2; } uVar10 = Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar10 == 0) { if ((param_4 & 1) == 0) goto LAB_0; LAB_1: if (param_3 == (uint *)0x0) goto LAB_2; } else { if ((param_4 & 1) == 0) { LAB_0: if (param_3 == (uint *)0x0) { LAB_3: uVar10 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if (((((int)uVar10 != 0) && (param_3 != (uint *)0x0)) && ((*param_3 & 4) != 0)) && - ((-1 < *(int *)(param_1 + 0x18) && (bVar17 != 0)))) { + ((-1 < *(int *)(param_1 + 0x18) && (bVar18 != 0)))) { lVar12 = *(longlong *)(param_3 + 0x16); uStack_90 = *(ulonglong *)(lVar12 + 0x10); sVar14 = *(short *)(lVar12 + 8) - *(short *)(lVar12 + 0x48); local_98 = (ulonglong)CONCAT22(sVar14,sVar14); KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(&DAT_4,0); KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(&gBfsGlobalFileTable,0); uVar13 = DAT_5; - uVar15 = 0; + uVar16 = 0; local_60 = (undefined *)0x0; local_70 = (undefined *)0x0; uStack_68 = 0; - uVar10 = uVar15; + uVar10 = uVar16; if ((local_98 & 0xfffe) == 0) { LAB_6: - uVar15 = 0xffffffffffffffff; + uVar16 = 0xffffffffffffffff; } else { do { uVar8 = RtlUpcaseUnicodeChar(*(undefined2 *)(uStack_90 + uVar10 * 2)); - uVar16 = (int)uVar10 + 1; - uVar15 = (uVar15 * 0x25 + ((ulonglong)uVar8 & 0xff)) * 0x25 + (ulonglong)(uVar8 >> 8); - uVar10 = (ulonglong)uVar16; - } while (uVar16 < (ushort)local_98 >> 1); - if (uVar15 == 0) goto LAB_6; - } - lVar12 = RtlLookupEntryHashTable(uVar13,uVar15,&local_70); + uVar17 = (int)uVar10 + 1; + uVar16 = (uVar16 * 0x25 + ((ulonglong)uVar8 & 0xff)) * 0x25 + (ulonglong)(uVar8 >> 8); + uVar10 = (ulonglong)uVar17; + } while (uVar17 < (ushort)local_98 >> 1); + if (uVar16 == 0) goto LAB_6; + } + lVar12 = RtlLookupEntryHashTable(uVar13,uVar16,&local_70); while (lVar12 != 0) { cVar7 = RtlEqualUnicodeString(&local_98,lVar12 + 0x40,1); if (cVar7 != '\0') { if (*(char *)(lVar12 + 0x28) != '\0') { plVar3 = (longlong *)(lVar12 + 0x18); *(undefined1 *)(lVar12 + 0x28) = 0; lVar4 = *plVar3; if ((*(longlong **)(lVar4 + 8) != plVar3) || (plVar5 = *(longlong **)(lVar12 + 0x20), (longlong *)*plVar5 != plVar3)) { pcVar6 = (code *)swi(0x29); (*pcVar6)(3); pcVar6 = (code *)swi(3); uVar13 = (*pcVar6)(); return uVar13; } *plVar5 = lVar4; *(longlong **)(lVar4 + 8) = plVar5; *plVar3 = 0; *(undefined8 *)(lVar12 + 0x20) = 0; *(undefined8 *)(lVar12 + 0x30) = 0; *(undefined8 *)(lVar12 + 0x38) = 0; } break; } lVar12 = RtlGetNextEntryHashTable(uVar13); } ExReleasePushLockExclusiveEx(&gBfsGlobalFileTable); KeLeaveCriticalRegion(); ExReleasePushLockExclusiveEx(&DAT_4); KeLeaveCriticalRegion(); } } else { if ((((*param_3 & 2) != 0) && (-1 < *(int *)(param_1 + 0x18))) && ((char)param_3[0x14] != '\0')) { iVar9 = BfsGetFileContext(param_2,*(undefined8 *)(*(longlong *)(param_1 + 0x10) + 8), &local_78); if (iVar9 < 0) { if (3 < DAT_7) { uStack_90 = 0; local_50 = &local_7c; local_70 = PTR_DAT_8; local_48 = 4; local_98 = 0x30b000000; local_60 = &DAT_9; uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_8); local_58 = 0x1e; local_54 = 1; local_80 = 0x73; local_7c = iVar9; EtwWriteTransfer(DAT_10,&local_98,0,0); - lVar18 = 0; + lVar19 = 0; } goto LAB_11; } *local_78 = 1; } if ((*param_3 & 1) == 0) goto LAB_3; - lVar18 = *(longlong *)(param_3 + 0x10); + lVar19 = *(longlong *)(param_3 + 0x10); param_3[0x10] = 0; param_3[0x11] = 0; if (param_3[2] == 0) { - uVar16 = *(uint *)(*(longlong *)(param_1 + 0x10) + 0x20); + uVar17 = *(uint *)(*(longlong *)(param_1 + 0x10) + 0x20); uVar10 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar10 == 0) { puVar2 = (uint *)(*(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8) + 0x14); *puVar2 = *puVar2 & 0xfff3ffff; FltSetCallbackDataDirty(param_1); } uVar10 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar10 == 0) { - if (((uVar16 & 1) == 0) || ((*pbVar1 & 2) == 0)) { - if ((((byte)uVar16 & 0x41) != 0x40) || ((*pbVar1 & 2) == 0)) goto LAB_12; + if (((uVar17 & 1) == 0) || ((*pbVar1 & 2) == 0)) { + if ((((byte)uVar17 & 0x41) != 0x40) || ((*pbVar1 & 2) == 0)) goto LAB_12; LAB_13: lVar12 = *(longlong *)(param_3 + 0xc); puVar11 = (ulonglong *)BfsGetFileName((ushort *)&local_98,lVar12); - iVar9 = 1; - uVar16 = 0; + iVar15 = 1; + iVar9 = 0; } else { LAB_14: lVar12 = *(longlong *)(param_3 + 0xc); puVar11 = (ulonglong *)BfsGetFileName((ushort *)&local_98,lVar12); + iVar15 = 2; iVar9 = 2; - uVar16 = 2; } local_98 = *puVar11; uStack_90 = puVar11[1]; - BfsAddOrModifyEntry(*(longlong *)(lVar18 + 0x30),iVar9,1,uVar16, + BfsAddOrModifyEntry(*(longlong *)(lVar19 + 0x30),iVar15,1,iVar9, (ushort *)(lVar12 + 0x18),(short *)&local_98); } else { - if ((((uVar16 & 1) != 0) && (bVar17 != 0)) && ((char)param_3[0x12] == '\0')) + if ((((uVar17 & 1) != 0) && (bVar18 != 0)) && ((char)param_3[0x12] == '\0')) goto LAB_14; - if (((((byte)uVar16 & 0x41) == 0x40) && (bVar17 != 0)) && ((char)param_3[0x12] == '\0')) + if (((((byte)uVar17 & 0x41) == 0x40) && (bVar18 != 0)) && ((char)param_3[0x12] == '\0')) goto LAB_13; } LAB_12: if (*(longlong *) (*(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8) + 0x20) != 0) { ObfDereferenceObject(); } uVar13 = *(undefined8 *)(param_3 + 6); lVar12 = *(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8); *(undefined8 *)(lVar12 + 0x20) = *(undefined8 *)(param_3 + 4); *(undefined8 *)(lVar12 + 0x28) = uVar13; uVar13 = *(undefined8 *)(param_3 + 10); *(undefined8 *)(lVar12 + 0x30) = *(undefined8 *)(param_3 + 8); *(undefined8 *)(lVar12 + 0x38) = uVar13; uVar10 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar10 == 0) { FltReleaseFileNameInformation(*(undefined8 *)(param_3 + 0xc)); - BfsDereferencePolicyEntryEx(lVar18,'\0'); + BfsDereferencePolicyEntryEx(lVar19,'\0'); ExFreePoolWithTag(param_3,0); return 0; } goto LAB_3; } if ((param_3[2] != 1) || (*(int *)(param_1 + 0x18) != -0x3fffffde)) goto LAB_3; - if (*(int *)(lVar18 + 0x68) != 0) { - if (*(int *)(lVar18 + 0x68) == 1) goto LAB_15; + if (*(int *)(lVar19 + 0x68) != 0) { + if (*(int *)(lVar19 + 0x68) == 1) goto LAB_15; goto LAB_3; } local_a8 = '\0'; iVar9 = RtlCheckTokenCapability (0,*(undefined8 *)(*(longlong *)SeExports_exref + 0x248),&local_a8); if ((iVar9 < 0) || (local_a8 == '\0')) { - *(undefined4 *)(lVar18 + 0x68) = 2; + *(undefined4 *)(lVar19 + 0x68) = 2; goto LAB_3; } - *(undefined4 *)(lVar18 + 0x68) = 1; + *(undefined4 *)(lVar19 + 0x68) = 1; LAB_15: SeCaptureSubjectContext(param_3 + 4); local_a7 = '\x01'; if (*(longlong *)(param_3 + 4) == 0) { LAB_16: uVar13 = PsGetCurrentProcessId(); *(undefined8 *)(param_3 + 0xe) = uVar13; uVar10 = BfsPerformPrompt(param_1,param_2,(longlong)param_3); if (-1 < (int)uVar10) goto LAB_3; if (3 < DAT_7) { local_48 = 4; local_50 = &local_84; local_70 = PTR_DAT_8; local_98 = 0x30b000000; uStack_90 = 0; local_60 = &DAT_9; uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_8); local_58 = 0x1e; local_54 = 1; local_88 = 0x73; local_84 = (int)uVar10; EtwWriteTransfer(DAT_10,&local_98,0,0); } } else { local_7c = 0; local_80 = 0; iVar9 = SeQuerySessionIdToken(*(undefined8 *)(param_3 + 8)); if (iVar9 < 0) { if (3 < DAT_7) { local_48 = 4; local_50 = &local_88; local_70 = PTR_DAT_8; local_98 = 0x30b000000; uStack_90 = 0; local_60 = &DAT_9; uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_8); local_58 = 0x1e; local_54 = 1; local_84 = 0x73; local_88 = iVar9; EtwWriteTransfer(DAT_10,&local_98,0,0); } } else { iVar9 = SeQuerySessionIdToken(*(undefined8 *)(param_3 + 4)); if (iVar9 < 0) { if (3 < DAT_7) { local_48 = 4; local_50 = &local_84; local_70 = PTR_DAT_8; local_98 = 0x30b000000; uStack_90 = 0; local_60 = &DAT_9; uStack_68 = CONCAT44(2,(uint)*(ushort *)PTR_DAT_8); local_58 = 0x1e; local_54 = 1; local_88 = 0x73; local_84 = iVar9; EtwWriteTransfer(DAT_10,&local_98,0,0); } } else if (local_7c == local_80) goto LAB_16; } } } LAB_11: - if (lVar18 != 0) { - BfsDereferencePolicyEntryEx(lVar18,'\0'); + if (lVar19 != 0) { + BfsDereferencePolicyEntryEx(lVar19,'\0'); } if (local_a7 != '\0') { SeReleaseSubjectContext(param_3 + 4); } goto LAB_1; } if (param_3 == (uint *)0x0) goto LAB_2; if ((*param_3 & 1) != 0) { - lVar18 = *(longlong *)(param_3 + 0x10); + lVar19 = *(longlong *)(param_3 + 0x10); param_3[0x10] = 0; param_3[0x11] = 0; if (param_3[2] == 0) { if (*(longlong *) (*(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8) + 0x20) != 0) { ObfDereferenceObject(); } uVar13 = *(undefined8 *)(param_3 + 6); lVar12 = *(longlong *)(*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x18) + 8); *(undefined8 *)(lVar12 + 0x20) = *(undefined8 *)(param_3 + 4); *(undefined8 *)(lVar12 + 0x28) = uVar13; uVar13 = *(undefined8 *)(param_3 + 10); *(undefined8 *)(lVar12 + 0x30) = *(undefined8 *)(param_3 + 8); *(undefined8 *)(lVar12 + 0x38) = uVar13; } goto LAB_11; } } if (*(longlong *)(param_3 + 0xc) != 0) { FltReleaseFileNameInformation(); } uVar10 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if (((int)uVar10 != 0) && (*(longlong *)(param_3 + 0x16) != 0)) { FltReleaseFileNameInformation(); } ExFreePoolWithTag(param_3,0); - uVar10 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar10 != 0) { - uVar10 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar10 != 0) { - KeEnterCriticalRegion(); - } - ExReleaseRundownProtection(&gBfsRundownProtection); - KeLeaveCriticalRegion(); - } + KeEnterCriticalRegion(); + ExReleaseRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); LAB_2: if (local_78 != (undefined1 *)0x0) { FltReleaseContext(); } return 0; } ``` ## BfsPreCreatePipeOperation ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.41| |i_ratio|0.67| |m_ratio|0.97| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsPreCreatePipeOperation|BfsPreCreatePipeOperation| |fullname|BfsPreCreatePipeOperation|BfsPreCreatePipeOperation| |refcount|6|6| |`length`|1401|1342| |`called`|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsGetFileName
BfsIsApplicableToken
BfsRedirectNamedPipe
BfsReleaseNamedPipeMapping
FLTMGR.SYS::FltFindExtraCreateParameter
FLTMGR.SYS::FltGetEcpListFromCallbackData
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltIsEcpFromUserMode
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_1199833401__private_IsEnabledDeviceUsageNoInlineFeature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::PsDereferenceImpersonationToken
NTOSKRNL.EXE::PsDereferencePrimaryToken
NTOSKRNL.EXE::PsReferenceImpersonationToken
NTOSKRNL.EXE::PsReferencePrimaryToken
NTOSKRNL.EXE::RtlPrefixUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsGetFileName
BfsIsApplicableToken
BfsRedirectNamedPipe
BfsReleaseNamedPipeMapping
FLTMGR.SYS::FltFindExtraCreateParameter
FLTMGR.SYS::FltGetEcpListFromCallbackData
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltIsEcpFromUserMode
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInlineNTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::PsDereferenceImpersonationToken
NTOSKRNL.EXE::PsDereferencePrimaryToken
NTOSKRNL.EXE::PsReferenceImpersonationToken
NTOSKRNL.EXE::PsReferencePrimaryToken
NTOSKRNL.EXE::RtlPrefixUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
| |calling||| |paramcount|3|3| |`address`|140003090|140002f30| |sig|int __fastcall BfsPreCreatePipeOperation(longlong param_1, longlong param_2, longlong * param_3)|int __fastcall BfsPreCreatePipeOperation(longlong param_1, longlong param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsPreCreatePipeOperation Called Diff ```diff --- BfsPreCreatePipeOperation called +++ BfsPreCreatePipeOperation called @@ -11 +10,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline ``` ### BfsPreCreatePipeOperation Diff ```diff --- BfsPreCreatePipeOperation +++ BfsPreCreatePipeOperation @@ -1,237 +1,217 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ int BfsPreCreatePipeOperation(longlong param_1,longlong param_2,longlong *param_3) { bool bVar1; bool bVar2; char cVar3; char cVar4; int iVar5; int iVar6; - ulonglong uVar7; + longlong lVar7; undefined8 uVar8; ushort *puVar9; - longlong lVar10; - int iVar11; - int iVar13; - longlong lVar14; + ulonglong uVar10; + longlong lVar11; + int iVar12; + int iVar14; undefined1 auStackY_108 [32]; int local_d8; int local_d4; undefined1 local_d0; undefined1 local_cf [7]; undefined4 local_c8; undefined4 local_c4; undefined8 local_c0; int local_b8 [2]; longlong local_b0; longlong local_a8; longlong *local_a0; longlong *local_98; undefined4 local_90; longlong local_88; undefined8 local_80; undefined8 uStack_78; ushort *local_70; uint local_68; undefined4 local_64; undefined *local_60; undefined4 local_58; undefined4 local_54; int *local_50; undefined8 local_48; ulonglong local_40; - int iVar12; + int iVar13; local_40 = __security_cookie ^ (ulonglong)auStackY_108; + lVar7 = 0; local_cf[0] = 0; local_d0 = 0; - iVar11 = 1; iVar12 = 1; + iVar13 = 1; local_a8 = 0; local_90 = 0; local_88 = 0; local_80 = 0; uStack_78 = 0; local_b8[0] = 0; if (*(char *)(param_1 + 0x50) == '\0') { return 1; } - lVar14 = 0; bVar1 = false; local_b0 = 0; local_98 = (longlong *)0x0; local_a0 = (longlong *)0x0; KeEnterCriticalRegion(); cVar3 = ExAcquireRundownProtection(&gBfsRundownProtection); - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 == 0) { - if (cVar3 != '\0') goto LAB_0; - KeLeaveCriticalRegion(); - iVar13 = iVar12; + KeLeaveCriticalRegion(); + iVar14 = iVar12; + iVar6 = local_d4; + if (cVar3 != '\0') { + *param_3 = 0; + lVar7 = PsReferenceImpersonationToken(*(undefined8 *)(param_1 + 8),local_cf,&local_d0,local_b8); + bVar1 = true; + if (lVar7 == 0) { + uVar8 = IoGetCurrentProcess(); + lVar7 = PsReferencePrimaryToken(uVar8); + bVar2 = false; + } + else { + iVar14 = iVar13; + iVar6 = local_d4; + bVar2 = true; + if (local_b8[0] < 2) goto LAB_0; + } + bVar1 = bVar2; + cVar4 = BfsIsApplicableToken(lVar7,'\x01'); + iVar14 = iVar12; iVar6 = local_d4; - } - else { - KeLeaveCriticalRegion(); - lVar14 = 0; - iVar13 = iVar11; - iVar6 = local_d4; - if (cVar3 != '\0') { -LAB_0: - *param_3 = 0; - lVar14 = PsReferenceImpersonationToken - (*(undefined8 *)(param_1 + 8),local_cf,&local_d0,local_b8); - bVar1 = true; - if (lVar14 == 0) { - uVar8 = IoGetCurrentProcess(); - lVar14 = PsReferencePrimaryToken(uVar8); - bVar2 = false; + if (cVar4 != '\0') { + iVar5 = FltGetFileNameInformation(param_1,0x101,&local_b0); + if (iVar5 < 0) { + iVar6 = local_d4; + if (3 < DAT_1) { + local_c0 = 0; + local_50 = &local_d8; + local_70 = (ushort *)PTR_DAT_2; + local_c4 = 3; + local_48 = 4; + local_c8 = 0xb000000; + local_68 = (uint)*(ushort *)PTR_DAT_2; + local_60 = &DAT_3; + local_64 = 2; + local_58 = 0x1e; + local_54 = 1; + local_d4 = 0x73; + local_d8 = iVar5; + EtwWriteTransfer(DAT_4,&local_c8,0,0); + iVar6 = local_d4; + } } else { - iVar13 = iVar12; - iVar6 = local_d4; - bVar2 = true; - if (local_b8[0] < 2) goto LAB_1; - } - bVar1 = bVar2; - cVar4 = BfsIsApplicableToken(lVar14,'\x01'); - iVar13 = iVar11; - iVar6 = local_d4; - if (cVar4 != '\0') { - iVar5 = FltGetFileNameInformation(param_1,0x101,&local_b0); - if (iVar5 < 0) { - iVar6 = local_d4; - if (3 < DAT_2) { - local_c0 = 0; - local_50 = &local_d8; - local_70 = (ushort *)PTR_DAT_3; - local_c4 = 3; - local_48 = 4; - local_c8 = 0xb000000; - local_68 = (uint)*(ushort *)PTR_DAT_3; - local_60 = &DAT_4; - local_64 = 2; - local_58 = 0x1e; - local_54 = 1; - local_d4 = 0x73; - local_d8 = iVar5; - EtwWriteTransfer(DAT_5,&local_c8,0,0); + puVar9 = BfsGetFileName((ushort *)&local_c8,local_b0); + local_80 = *(undefined8 *)puVar9; + uStack_78 = *(undefined8 *)(puVar9 + 4); + uVar10 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar10 == 0) || (iVar6 = local_d4, (short)local_80 != 0)) { + cVar4 = RtlPrefixUnicodeString(&LocalPrefixString,&local_80,1); + if ((cVar4 == '\0') && + (cVar4 = RtlPrefixUnicodeString(&SessionsPrefixString,&local_80,1), cVar4 == '\0')) { + iVar12 = SeQueryInformationToken(lVar7,1,&local_a0); iVar6 = local_d4; + if ((-1 < iVar12) && + (iVar12 = SeQueryInformationToken(lVar7,0x1f,&local_98), iVar6 = local_d4, + -1 < iVar12)) { + if ((*(uint *)(*(longlong *)(param_1 + 0x10) + 0x20) & 0xff000000) == 0x1000000) { + lVar11 = BfsAcquireNamedPipeMapping + (0x14001b2c0,(byte *)*local_a0,(byte *)*local_98, + (ushort *)(local_b0 + 8)); + iVar14 = iVar13; + iVar6 = local_d4; + if (lVar11 == 0) goto LAB_0; + BfsReleaseNamedPipeMapping(0x14001b2c0,lVar11); + } + iVar12 = BfsRedirectNamedPipe + (*(undefined8 *)(param_2 + 8),param_1,*local_a0,*local_98,local_b0, + (short *)&local_80); + iVar14 = (iVar12 >> 0x1f & 0xfffffffdU) + 4; + iVar6 = local_d4; + goto LAB_0; + } } - } - else { - puVar9 = BfsGetFileName((ushort *)&local_c8,local_b0); - local_80 = *(undefined8 *)puVar9; - uStack_78 = *(undefined8 *)(puVar9 + 4); - uVar7 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar7 == 0) || (iVar6 = local_d4, (short)local_80 != 0)) { - cVar4 = RtlPrefixUnicodeString(&LocalPrefixString,&local_80,1); - if ((cVar4 == '\0') && - (cVar4 = RtlPrefixUnicodeString(&SessionsPrefixString,&local_80,1), cVar4 == '\0')) { - iVar11 = SeQueryInformationToken(lVar14,1,&local_a0); + else { + iVar12 = FltGetEcpListFromCallbackData(*(undefined8 *)(param_2 + 8),param_1,&local_88); + iVar6 = local_d4; + if (-1 < iVar12) { + iVar14 = iVar13; + if (local_88 == 0) goto LAB_0; + local_a8 = 0; + iVar6 = FltFindExtraCreateParameter + (*(undefined8 *)(param_2 + 8),local_88,&BfsEcpType,&local_a8); + iVar12 = 0; + if (iVar6 != -0x3ffffddb) { + iVar12 = iVar6; + } iVar6 = local_d4; - if ((iVar11 < 0) || - (iVar11 = SeQueryInformationToken(lVar14,0x1f,&local_98), iVar6 = local_d4, - iVar11 < 0)) { -joined_r0x0001400034e1: - local_d4 = iVar11; - iVar13 = iVar12; - if (3 < DAT_2) { - local_c0 = 0; - local_c8 = 0xb000000; - local_50 = &local_d4; - local_c4 = 3; - local_48 = 4; - local_68 = (uint)*(ushort *)PTR_DAT_3; - local_60 = &DAT_4; - local_64 = 2; - local_58 = 0x1e; - local_54 = 1; - local_d8 = 0x73; - local_70 = (ushort *)PTR_DAT_3; - EtwWriteTransfer(DAT_5,&local_c8,0,0); - iVar6 = local_d4; - } - } - else { - if ((*(uint *)(*(longlong *)(param_1 + 0x10) + 0x20) & 0xff000000) == 0x1000000) { - lVar10 = BfsAcquireNamedPipeMapping - (0x14001b2a0,(byte *)*local_a0,(byte *)*local_98, - (ushort *)(local_b0 + 8)); - iVar13 = iVar12; - iVar6 = local_d4; - if (lVar10 == 0) goto LAB_1; - BfsReleaseNamedPipeMapping(0x14001b2a0,lVar10); - } - iVar11 = BfsRedirectNamedPipe - (*(undefined8 *)(param_2 + 8),param_1,*local_a0,*local_98, - local_b0,(short *)&local_80); - iVar13 = (iVar11 >> 0x1f & 0xfffffffdU) + 4; - iVar6 = local_d4; - } - } - else { - iVar11 = FltGetEcpListFromCallbackData(*(undefined8 *)(param_2 + 8),param_1,&local_88) - ; - iVar6 = local_d4; - if (iVar11 < 0) goto joined_r0x0001400034e1; - iVar13 = iVar12; - if (local_88 != 0) { - local_a8 = 0; - iVar6 = FltFindExtraCreateParameter - (*(undefined8 *)(param_2 + 8),local_88,&BfsEcpType,&local_a8); - iVar11 = 0; - if (iVar6 != -0x3ffffddb) { - iVar11 = iVar6; - } - iVar6 = local_d4; - if (iVar11 < 0) goto joined_r0x0001400034e1; + if (-1 < iVar12) { if ((local_a8 != 0) && (cVar4 = FltIsEcpFromUserMode(*(undefined8 *)(param_2 + 8)), iVar6 = local_d4, cVar4 == '\0')) { *param_3 = *(longlong *)(local_a8 + 8); - iVar13 = 0; + iVar14 = 0; } + goto LAB_0; } } } + local_d4 = iVar12; + iVar14 = iVar13; + if (3 < DAT_1) { + local_c0 = 0; + local_c8 = 0xb000000; + local_50 = &local_d4; + local_c4 = 3; + local_48 = 4; + local_68 = (uint)*(ushort *)PTR_DAT_2; + local_60 = &DAT_3; + local_64 = 2; + local_58 = 0x1e; + local_54 = 1; + local_d8 = 0x73; + local_70 = (ushort *)PTR_DAT_2; + EtwWriteTransfer(DAT_4,&local_c8,0,0); + iVar6 = local_d4; + } } } } } -LAB_1: +LAB_0: local_d4 = iVar6; if (local_b0 != 0) { FltReleaseFileNameInformation(); } - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 == 0) { - if (cVar3 == '\0') goto LAB_6; - } - else if ((cVar3 == '\0') || (*param_3 != 0)) goto LAB_6; - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 != 0) { + if ((cVar3 != '\0') && (*param_3 == 0)) { KeEnterCriticalRegion(); - } - ExReleaseRundownProtection(&gBfsRundownProtection); - KeLeaveCriticalRegion(); -LAB_6: + ExReleaseRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); + } if (local_a0 != (longlong *)0x0) { ExFreePoolWithTag(local_a0,0); } if (local_98 != (longlong *)0x0) { ExFreePoolWithTag(local_98,0); } - if (lVar14 != 0) { + if (lVar7 != 0) { if (bVar1) { PsDereferenceImpersonationToken(); } else { - PsDereferencePrimaryToken(lVar14); - } - } - return iVar13; + PsDereferencePrimaryToken(lVar7); + } + } + return iVar14; } ``` ## BfsPreCreateOperation ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.23| |i_ratio|0.44| |m_ratio|0.93| |b_ratio|0.51| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsPreCreateOperation|BfsPreCreateOperation| |fullname|BfsPreCreateOperation|BfsPreCreateOperation| |refcount|4|4| |`length`|2295|2029| |`called`|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsCheckAndApplyPolicy
BfsCheckDeleteList
BfsGetGlobalFileEntry
BfsIsApplicableToken
BfsReleaseNamedPipeMapping
BfsReparseNamedPipe
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltGetFileSystemType
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_1199833401__private_IsEnabledDeviceUsageNoInlineFeature_2210080059__private_IsEnabledDeviceUsageNoInline
Feature_AppSiloSmbNoTrackDelete__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::PsDereferenceImpersonationToken
NTOSKRNL.EXE::PsDereferencePrimaryToken
NTOSKRNL.EXE::PsReferenceImpersonationToken
NTOSKRNL.EXE::PsReferencePrimaryToken
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsCheckAndApplyPolicy
BfsCheckDeleteList
BfsGetGlobalFileEntry
BfsIsApplicableToken
BfsReleaseNamedPipeMapping
BfsReparseNamedPipe
FLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltGetFileSystemType
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_AppSiloSmbNoTrackDelete__private_IsEnabledDeviceUsageNoInlineFeature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::PsDereferenceImpersonationToken
NTOSKRNL.EXE::PsDereferencePrimaryToken
NTOSKRNL.EXE::PsReferenceImpersonationToken
NTOSKRNL.EXE::PsReferencePrimaryToken
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
| |calling||| |paramcount|3|3| |`address`|140002790|140002730| |sig|int __fastcall BfsPreCreateOperation(ushort * param_1, longlong param_2, longlong * param_3)|int __fastcall BfsPreCreateOperation(ushort * param_1, longlong param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsPreCreateOperation Called Diff ```diff --- BfsPreCreateOperation called +++ BfsPreCreateOperation called @@ -11,2 +10,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline -Feature_2210080059__private_IsEnabledDeviceUsageNoInline ``` ### BfsPreCreateOperation Diff ```diff --- BfsPreCreateOperation +++ BfsPreCreateOperation @@ -1,336 +1,298 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ int BfsPreCreateOperation(ushort *param_1,longlong param_2,longlong *param_3) { - ushort uVar1; - undefined2 uVar2; + byte bVar1; + uint uVar2; longlong *plVar3; char cVar4; - char cVar5; - int iVar6; + int iVar5; + uint *puVar6; ulonglong uVar7; - uint *puVar8; - longlong lVar9; - ushort *puVar10; - undefined8 uVar11; - uint uVar12; - short sVar13; + longlong lVar8; + uint *puVar9; + undefined8 uVar10; + uint *puVar11; + short sVar12; + uint *puVar13; int iVar14; undefined1 auStackY_138 [32]; int local_108; int local_104 [3]; undefined8 local_f8; undefined8 uStack_f0; char local_e8; + char local_e7; uint *local_e0; undefined1 local_d8; undefined1 local_d7 [7]; longlong local_d0; int local_c8; int local_c4; - longlong *local_c0; - undefined8 *local_b8; + uint *local_c0; + longlong *local_b8; undefined8 *local_b0; - ushort *local_a8; - longlong local_a0; + undefined8 *local_a8 [2]; ulonglong local_98; undefined8 uStack_90; undefined8 local_88; longlong lStack_80; undefined *local_78; uint local_70; undefined4 local_6c; undefined *local_68; undefined4 local_60; undefined4 local_5c; int *local_58; undefined8 local_50; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_138; - puVar8 = (uint *)0x0; - iVar6 = 0; + puVar11 = (uint *)0x0; + iVar5 = 0; local_d7[0] = 0; local_d8 = 0; local_c4 = 0; + local_e7 = '\0'; iVar14 = 1; - local_a8 = (ushort *)0x0; - local_e8 = '\0'; local_d0 = 0; local_98 = 0; uStack_90 = 0; + puVar13 = (uint *)0x0; local_c8 = 0; local_88 = 0; lStack_80 = 0; - local_a0 = 0; - cVar4 = '\0'; + local_c0 = (uint *)0x0; + local_a8[0] = (undefined8 *)0x0; local_b0 = (undefined8 *)0x0; - local_b8 = (undefined8 *)0x0; local_e0 = (uint *)0x0; - local_c0 = param_3; - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 != 0) { - *param_3 = 0; - } - uVar7 = Feature_2210080059__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 == 0) { -LAB_0: - if ((*(uint *)(*(longlong *)(param_1 + 8) + 0x20) & 0x1000) == 0) { -LAB_1: - uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 == 0) goto LAB_2; - iVar6 = FltGetFileSystemType(*(undefined8 *)(param_2 + 0x10),&local_c8); - if (iVar6 < 0) goto joined_r0x000140002b36; - uVar7 = Feature_AppSiloSmbNoTrackDelete__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 == 0) { - if (((local_c8 == 0x19) || (5 < *(byte *)(*(longlong *)(param_1 + 8) + 0x23))) || - ((0x2dU >> (*(byte *)(*(longlong *)(param_1 + 8) + 0x23) & 0x1f) & 1) == 0)) - goto LAB_2; - iVar6 = FltGetFileNameInformation(param_1,0x101,&local_d0); - if (iVar6 < 0) goto joined_r0x000140002b36; -LAB_3: - sVar13 = *(short *)(local_d0 + 8) - *(short *)(local_d0 + 0x48); - uStack_f0 = *(undefined8 *)(local_d0 + 0x10); - local_f8._0_4_ = CONCAT22(sVar13,sVar13); - uVar12 = (uint)local_f8; - local_f8 = (ulonglong)(uint)local_f8; - local_98 = (ulonglong)uVar12; - uStack_90 = uStack_f0; - KeEnterCriticalRegion(); - ExAcquirePushLockSharedEx(&gBfsGlobalFileTable,0); - lVar9 = BfsGetGlobalFileEntry(0x14001b1e0,(ushort *)&local_98); - ExReleasePushLockSharedEx(&gBfsGlobalFileTable,0); - KeLeaveCriticalRegion(); - if (lVar9 == 0) { - FltReleaseFileNameInformation(local_d0); -LAB_4: - local_d0 = 0; - goto LAB_2; - } - if ((puVar8 != (uint *)0x0) || - (puVar8 = (uint *)ExAllocatePool2(0x100,0x60,0x43736642), local_e0 = puVar8, - puVar8 != (uint *)0x0)) { - *puVar8 = *puVar8 | 4; - iVar14 = 0; - *(longlong *)(puVar8 + 0x16) = local_d0; - goto LAB_4; - } -LAB_5: - if (DAT_7 < 4) goto LAB_140002a3a; - local_104[0] = -0x3fffffe9; - iVar6 = local_104[0]; -LAB_8: - local_104[0] = iVar6; - uVar1 = *(ushort *)PTR_DAT_9; - goto LAB_10; - } - if (local_c8 != 0x19) { - lVar9 = *(longlong *)(*(longlong *)(*(longlong *)(param_1 + 8) + 8) + 8); - if ((((lVar9 != 0) && (*(int *)(lVar9 + 0x48) != 0x14)) && - (uVar12 = (uint)*(byte *)(*(longlong *)(param_1 + 8) + 0x23), uVar12 < 6)) && - ((0x2dU >> (uVar12 & 0x1f) & 1) != 0)) { - iVar6 = FltGetFileNameInformation(param_1,0x101,&local_d0); - if (-1 < iVar6) goto LAB_3; - goto joined_r0x000140002b36; - } - } -LAB_2: - if ((char)param_1[0x28] == '\0') { - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((((int)uVar7 != 0) && - (uVar7 = Feature_2210080059__private_IsEnabledDeviceUsageNoInline(), (int)uVar7 == 0)) - && (iVar14 == 0)) { - KeEnterCriticalRegion(); - cVar4 = ExAcquireRundownProtection(&gBfsRundownProtection); - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar7 != 0) || (cVar4 == '\0')) { -LAB_11: - KeLeaveCriticalRegion(); - } - } -LAB_12: - if (iVar6 < 0) goto LAB_6; - } - else { - uVar7 = Feature_2210080059__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 == 0) { - KeEnterCriticalRegion(); - cVar4 = ExAcquireRundownProtection(&gBfsRundownProtection); - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 == 0) { - if (cVar4 == '\0') goto LAB_11; - } - else { - KeLeaveCriticalRegion(); - if (cVar4 == '\0') goto LAB_12; - } - } - puVar10 = (ushort *) - PsReferenceImpersonationToken - (*(undefined8 *)(param_1 + 4),local_d7,&local_d8,&local_c4); - local_a8 = puVar10; - if (puVar10 == (ushort *)0x0) { - uVar11 = IoGetCurrentProcess(); - puVar10 = (ushort *)PsReferencePrimaryToken(uVar11); - } - else { - local_e8 = '\x01'; - if (local_c4 < 2) goto LAB_12; - } - local_a8 = puVar10; - cVar5 = BfsIsApplicableToken(puVar10,'\x01'); - if (cVar5 == '\0') goto LAB_12; - uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar7 == 0) && - (iVar6 = FltGetFileSystemType(*(undefined8 *)(param_2 + 0x10)), iVar6 < 0)) { -joined_r0x000140002b36: - if (DAT_7 < 4) goto LAB_140002a3a; - goto LAB_8; - } - if (local_c8 != 0x19) { - uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 != 0) { - uVar7 = BfsCheckDeleteList(*(undefined8 **)(param_2 + 8),*(undefined8 *)(param_2 + 0x18) - ); - iVar6 = (int)uVar7; - if (iVar6 < 0) goto joined_r0x000140002b36; - } - cVar5 = BfsCheckAndApplyPolicy - (*(ushort **)(param_2 + 8),*(longlong *)(param_2 + 0x18),puVar10,param_1 - ,(longlong *)&local_e0); - puVar8 = local_e0; - if (cVar5 != '\0') { - iVar14 = 0; - } - goto LAB_12; - } - iVar6 = SeQueryInformationToken(puVar10,1,&local_b8); - if (((iVar6 < 0) || (iVar6 = SeQueryInformationToken(puVar10,0x1f,&local_b0), iVar6 < 0)) || - (iVar6 = FltGetFileNameInformation(param_1,0x101,&local_d0), iVar6 < 0)) - goto joined_r0x000140002b36; - local_a0 = BfsAcquireNamedPipeMapping - (0x14001b2a0,(byte *)*local_b8,(byte *)*local_b0, - (ushort *)(local_d0 + 8)); - if (local_a0 != 0) { - uVar2 = *(undefined2 *)(local_a0 + 0x40); - lVar9 = local_a0 + 0x40; - lStack_80 = ExAllocatePool2(0x100,uVar2,0x46736642); - if (lStack_80 != 0) { - local_88._0_4_ = CONCAT22(uVar2,(undefined2)local_88); - RtlCopyUnicodeString(&local_88,lVar9); - BfsReparseNamedPipe((longlong)param_1,(undefined4 *)&local_88); - iVar14 = 4; - goto LAB_6; - } - goto LAB_5; - } - } - if (iVar14 == 0) { - *local_c0 = (longlong)puVar8; - goto LAB_13; - } - } - else { - puVar8 = (uint *)ExAllocatePool2(0x100,0x60,0x43736642); - local_e0 = puVar8; - if (puVar8 != (uint *)0x0) { - *puVar8 = *puVar8 | 2; - *(undefined1 *)(puVar8 + 0x14) = 1; - iVar14 = 0; - goto LAB_1; - } - if (3 < DAT_7) { - local_104[0] = -0x3fffffe9; - uVar1 = *(ushort *)PTR_DAT_9; -LAB_10: - local_f8 = 0x30b000000; - local_58 = local_104; - local_50 = 4; - local_5c = 1; - uStack_f0 = 0; - local_70 = (uint)uVar1; - local_6c = 2; - local_68 = &DAT_14; - local_60 = 0x1e; - local_108 = 0x73; - local_78 = PTR_DAT_9; - EtwWriteTransfer(DAT_15,&local_f8,0,0); - puVar8 = local_e0; - } - } -LAB_6: - if (puVar8 != (uint *)0x0) { - uVar7 = Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline(); - if ((((int)uVar7 != 0) && ((*puVar8 & 4) != 0)) && (*(longlong *)(puVar8 + 0x16) != 0)) { - FltReleaseFileNameInformation(); - } - ExFreePoolWithTag(puVar8,0); - } - } - else { - KeEnterCriticalRegion(); - cVar4 = ExAcquireRundownProtection(&gBfsRundownProtection); - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 == 0) { - if (cVar4 != '\0') goto LAB_0; - KeLeaveCriticalRegion(); - } - else { - KeLeaveCriticalRegion(); - if (cVar4 != '\0') goto LAB_0; - } - if (3 < DAT_7) { + *param_3 = 0; + local_b8 = param_3; + KeEnterCriticalRegion(); + local_e8 = ExAcquireRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); + puVar9 = puVar11; + if (local_e8 == '\0') { + if (3 < DAT_0) { local_108 = -0x3fffffff; uStack_f0 = 0; local_58 = &local_108; - local_78 = PTR_DAT_9; + local_78 = PTR_DAT_1; local_50 = 4; local_f8 = 0x30b000000; - local_70 = (uint)*(ushort *)PTR_DAT_9; - local_68 = &DAT_14; + local_70 = (uint)*(ushort *)PTR_DAT_1; + local_68 = &DAT_2; local_6c = 2; local_60 = 0x1e; local_5c = 1; local_104[0] = 0x73; - EtwWriteTransfer(DAT_15,&local_f8,0,0); - } - } + EtwWriteTransfer(DAT_3,&local_f8,0,0); + puVar11 = (uint *)0x0; + puVar9 = puVar13; + } + goto LAB_4; + } + puVar6 = puVar11; + if ((*(uint *)(*(longlong *)(param_1 + 8) + 0x20) & 0x1000) == 0) { +LAB_5: + uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) goto LAB_6; + iVar5 = FltGetFileSystemType(*(undefined8 *)(param_2 + 0x10)); + if (iVar5 < 0) goto LAB_7; + uVar7 = Feature_AppSiloSmbNoTrackDelete__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + if (local_c8 == 0x19) goto LAB_6; + bVar1 = *(byte *)(*(longlong *)(param_1 + 8) + 0x23); +LAB_8: + if ((5 < bVar1) || ((0x2dU >> (bVar1 & 0x1f) & 1) == 0)) goto LAB_6; + iVar5 = FltGetFileNameInformation(param_1,0x101,&local_d0); + puVar9 = puVar13; + if (iVar5 < 0) goto LAB_7; + sVar12 = *(short *)(local_d0 + 8) - *(short *)(local_d0 + 0x48); + uStack_f0 = *(undefined8 *)(local_d0 + 0x10); + local_f8._0_4_ = CONCAT22(sVar12,sVar12); + uVar2 = (uint)local_f8; + local_f8 = (ulonglong)(uint)local_f8; + local_98 = (ulonglong)uVar2; + uStack_90 = uStack_f0; + KeEnterCriticalRegion(); + ExAcquirePushLockSharedEx(&gBfsGlobalFileTable,0); + lVar8 = BfsGetGlobalFileEntry(0x14001b200,(ushort *)&local_98); + ExReleasePushLockSharedEx(&gBfsGlobalFileTable,0); + KeLeaveCriticalRegion(); + if (lVar8 == 0) { + FltReleaseFileNameInformation(local_d0); +LAB_9: + local_d0 = 0; + goto LAB_6; + } + if ((puVar6 != (uint *)0x0) || + (puVar6 = (uint *)ExAllocatePool2(0x100,0x60,0x43736642), local_e0 = puVar6, + puVar6 != (uint *)0x0)) { + *puVar6 = *puVar6 | 4; + iVar14 = 0; + *(longlong *)(puVar6 + 0x16) = local_d0; + goto LAB_9; + } + if (DAT_0 < 4) goto LAB_14000299c; + local_104[0] = -0x3fffffe9; + puVar9 = puVar11; + iVar5 = local_104[0]; +LAB_11: + local_104[0] = iVar5; + local_78 = PTR_DAT_1; + local_70 = (uint)*(ushort *)PTR_DAT_1; + goto LAB_12; + } + if (local_c8 != 0x19) { + lVar8 = *(longlong *)(*(longlong *)(*(longlong *)(param_1 + 8) + 8) + 8); + if ((lVar8 != 0) && (*(int *)(lVar8 + 0x48) != 0x14)) { + bVar1 = *(byte *)(*(longlong *)(param_1 + 8) + 0x23); + goto LAB_8; + } + } +LAB_6: + puVar9 = puVar11; + if ((char)param_1[0x28] == '\0') { LAB_13: - plVar3 = local_c0; - if (local_b8 != (undefined8 *)0x0) { - ExFreePoolWithTag(local_b8,0); - } + if (iVar5 < 0) goto LAB_10; + } + else { + puVar9 = (uint *)PsReferenceImpersonationToken + (*(undefined8 *)(param_1 + 4),local_d7,&local_d8,&local_c4); + if (puVar9 == (uint *)0x0) { + uVar10 = IoGetCurrentProcess(); + puVar9 = (uint *)PsReferencePrimaryToken(uVar10); + } + else { + local_e7 = '\x01'; + if (local_c4 < 2) goto LAB_13; + } + cVar4 = BfsIsApplicableToken(puVar9,'\x01'); + if (cVar4 == '\0') goto LAB_13; + uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar7 == 0) && + (iVar5 = FltGetFileSystemType(*(undefined8 *)(param_2 + 0x10)), iVar5 < 0)) { +LAB_7: + if (DAT_0 < 4) goto LAB_14000299c; + goto LAB_11; + } + if (local_c8 != 0x19) { + uVar7 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 != 0) { + uVar7 = BfsCheckDeleteList(*(longlong **)(param_2 + 8),*(undefined8 *)(param_2 + 0x18)); + iVar5 = (int)uVar7; + if (iVar5 < 0) goto LAB_7; + } + cVar4 = BfsCheckAndApplyPolicy + (*(ushort **)(param_2 + 8),*(longlong *)(param_2 + 0x18),(ushort *)puVar9, + param_1,(longlong *)&local_e0); + puVar6 = local_e0; + if (cVar4 != '\0') { + iVar14 = 0; + } + goto LAB_13; + } + iVar5 = SeQueryInformationToken(puVar9,1,&local_b0); + if (((iVar5 < 0) || (iVar5 = SeQueryInformationToken(puVar9,0x1f,local_a8), iVar5 < 0)) || + (iVar5 = FltGetFileNameInformation(param_1,0x101,&local_d0), iVar5 < 0)) + goto LAB_7; + puVar11 = (uint *)BfsAcquireNamedPipeMapping + (0x14001b2c0,(byte *)*local_b0,(byte *)*local_a8[0], + (ushort *)(local_d0 + 8)); + local_c0 = puVar11; + if (puVar11 != (uint *)0x0) { + uVar2 = puVar11[0x10]; + lStack_80 = ExAllocatePool2(0x100,(short)uVar2,0x46736642); + if (lStack_80 == 0) { + if (3 < DAT_0) { + local_104[0] = -0x3fffffe9; + local_78 = PTR_DAT_1; + local_70 = (uint)*(ushort *)PTR_DAT_1; + goto LAB_12; + } + } + else { + local_88._0_4_ = CONCAT22((short)uVar2,(undefined2)local_88); + RtlCopyUnicodeString(&local_88,puVar11 + 0x10); + BfsReparseNamedPipe((longlong)param_1,(undefined4 *)&local_88); + iVar14 = 4; + } + goto LAB_10; + } + } + if (iVar14 == 0) { + *local_b8 = (longlong)puVar6; + goto LAB_4; + } + } + else { + puVar6 = (uint *)ExAllocatePool2(0x100,0x60,0x43736642); + local_e0 = puVar6; + if (puVar6 != (uint *)0x0) { + *puVar6 = *puVar6 | 2; + *(undefined1 *)(puVar6 + 0x14) = 1; + iVar14 = 0; + goto LAB_5; + } + if (3 < DAT_0) { + local_104[0] = -0x3fffffe9; + local_78 = PTR_DAT_1; + local_70 = (uint)*(ushort *)PTR_DAT_1; +LAB_12: + local_58 = local_104; + local_f8 = 0x30b000000; + local_50 = 4; + local_5c = 1; + uStack_f0 = 0; + local_6c = 2; + local_68 = &DAT_2; + local_60 = 0x1e; + local_108 = 0x73; + PTR_DAT_1 = local_78; + EtwWriteTransfer(DAT_3,&local_f8,0,0); + puVar6 = local_e0; + } + } +LAB_10: + puVar11 = local_c0; + if (puVar6 != (uint *)0x0) { + uVar7 = Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline(); + if ((((int)uVar7 != 0) && ((*puVar6 & 4) != 0)) && (*(longlong *)(puVar6 + 0x16) != 0)) { + FltReleaseFileNameInformation(); + } + ExFreePoolWithTag(puVar6,0); + puVar11 = local_c0; + } +LAB_4: + plVar3 = local_b8; if (local_b0 != (undefined8 *)0x0) { ExFreePoolWithTag(local_b0,0); } - if (local_a0 != 0) { - BfsReleaseNamedPipeMapping(0x14001b2a0,local_a0); + if (local_a8[0] != (undefined8 *)0x0) { + ExFreePoolWithTag(local_a8[0],0); + } + if (puVar11 != (uint *)0x0) { + BfsReleaseNamedPipeMapping(0x14001b2c0,(longlong)puVar11); } if (local_d0 != 0) { FltReleaseFileNameInformation(); } - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 == 0) { - if (cVar4 == '\0') goto LAB_16; - } - else if ((cVar4 == '\0') || (*plVar3 != 0)) goto LAB_16; - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 != 0) { + if ((local_e8 != '\0') && (*plVar3 == 0)) { KeEnterCriticalRegion(); - } - ExReleaseRundownProtection(&gBfsRundownProtection); - KeLeaveCriticalRegion(); -LAB_16: - if (local_a8 != (ushort *)0x0) { - if (local_e8 == '\0') { - PsDereferencePrimaryToken(local_a8); + ExReleaseRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); + } + if (puVar9 != (uint *)0x0) { + if (local_e7 == '\0') { + PsDereferencePrimaryToken(puVar9); } else { PsDereferenceImpersonationToken(); } } return iVar14; } ``` ## BfsGetNotPresentPolicyEntryLocked ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.8| |i_ratio|0.75| |m_ratio|0.92| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsGetNotPresentPolicyEntryLocked|BfsGetNotPresentPolicyEntryLocked| |fullname|BfsGetNotPresentPolicyEntryLocked|BfsGetNotPresentPolicyEntryLocked| |refcount|2|2| |`length`|171|196| |`called`|BfsFinalHash
BfsLookupPolicyEntryHashTable
BfsUpdateHash
NTOSKRNL.EXE::RtlLengthSid|BfsFinalHash
BfsLookupPolicyEntryHashTable
BfsUpdateHash
Feature_241429816__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::RtlLengthSid| |calling|BfsGetRegistryPrefix|BfsGetRegistryPrefix| |paramcount|4|4| |`address`|140007568|140007828| |sig|undefined8 __fastcall BfsGetNotPresentPolicyEntryLocked(longlong param_1, byte * param_2, byte * param_3, longlong * param_4)|undefined8 __fastcall BfsGetNotPresentPolicyEntryLocked(longlong param_1, byte * param_2, byte * param_3, longlong * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsGetNotPresentPolicyEntryLocked Called Diff ```diff --- BfsGetNotPresentPolicyEntryLocked called +++ BfsGetNotPresentPolicyEntryLocked called @@ -3,0 +4 @@ +Feature_241429816__private_IsEnabledDeviceUsageNoInline ``` ### BfsGetNotPresentPolicyEntryLocked Diff ```diff --- BfsGetNotPresentPolicyEntryLocked +++ BfsGetNotPresentPolicyEntryLocked @@ -1,34 +1,39 @@ undefined8 BfsGetNotPresentPolicyEntryLocked(longlong param_1,byte *param_2,byte *param_3,longlong *param_4) { undefined8 uVar1; uint uVar2; undefined8 uVar3; longlong lVar4; - undefined8 uVar5; + ulonglong uVar5; + undefined8 uVar6; longlong local_res8; - uVar5 = 0; + uVar6 = 0; local_res8 = 0; uVar2 = RtlLengthSid(param_2); BfsUpdateHash(param_2,uVar2,&local_res8); uVar2 = RtlLengthSid(param_3); BfsUpdateHash(param_3,uVar2,&local_res8); uVar3 = BfsFinalHash(&local_res8); uVar1 = *(undefined8 *)(param_1 + 8); *param_4 = 0; lVar4 = BfsLookupPolicyEntryHashTable(uVar1,uVar3,param_2,param_3); if (lVar4 == 0) { - uVar5 = 0xc0190021; + uVar6 = 0xc0190021; } else { + uVar5 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar5 != 0) && (*(int *)(lVar4 + 0x38) != 2)) { + return 0xc0190021; + } LOCK(); *(int *)(lVar4 + 0x98) = *(int *)(lVar4 + 0x98) + 1; UNLOCK(); } *param_4 = lVar4; - return uVar5; + return uVar6; } ``` ## BfsExpandDirectory ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.75| |i_ratio|0.6| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsExpandDirectory|BfsExpandDirectory| |fullname|BfsExpandDirectory|BfsExpandDirectory| |`refcount`|2|3| |`length`|663|686| |`called`|
Expand for full list:
BfsAllocateBlock
BfsFreeBlock
BfsWriteBlock
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
__security_check_cookie_tlgWriteTransfer_EtwWriteTransfer
memset
|
Expand for full list:
BfsAllocateBlock
BfsFreeBlock
BfsWriteBlock
Feature_3879979322__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
__security_check_cookie_tlgWriteTransfer_EtwWriteTransfer
memset
| |`calling`|BfsInsertDirectoryEntry|BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD| |paramcount|5|5| |`address`|14001384c|1400139ec| |sig|ulonglong __fastcall BfsExpandDirectory(longlong param_1, longlong param_2, longlong param_3, undefined8 * param_4, undefined8 * param_5)|ulonglong __fastcall BfsExpandDirectory(longlong param_1, longlong param_2, longlong param_3, undefined8 * param_4, undefined8 * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsExpandDirectory Called Diff ```diff --- BfsExpandDirectory called +++ BfsExpandDirectory called @@ -4 +4 @@ -Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline +Feature_3879979322__private_IsEnabledDeviceUsageNoInline ``` ### BfsExpandDirectory Calling Diff ```diff --- BfsExpandDirectory calling +++ BfsExpandDirectory calling @@ -1,0 +2 @@ +BfsInsertDirectoryEntry_OLD ``` ### BfsExpandDirectory Diff ```diff --- BfsExpandDirectory +++ BfsExpandDirectory @@ -1,128 +1,134 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsExpandDirectory(longlong param_1,longlong param_2,longlong param_3,undefined8 *param_4, undefined8 *param_5) { longlong *plVar1; code *pcVar2; uint uVar3; uint uVar4; ulonglong uVar5; longlong *plVar6; undefined4 *puVar7; undefined8 uVar8; longlong lVar9; - undefined1 auStack_c8 [40]; - undefined1 *local_a0; - uint local_98 [2]; - longlong local_90; - undefined8 *local_88; - undefined1 local_80 [32]; - uint *local_60; - undefined4 local_58; - undefined4 local_54; - ulonglong local_50; + bool bVar10; + undefined1 auStack_d8 [40]; + undefined1 *local_b0; + uint local_a8 [2]; + longlong local_a0; + undefined8 *local_98; + undefined8 *local_90; + undefined1 local_88 [32]; + uint *local_68; + undefined4 local_60; + undefined4 local_5c; + ulonglong local_58; - local_50 = __security_cookie ^ (ulonglong)auStack_c8; + local_58 = __security_cookie ^ (ulonglong)auStack_d8; puVar7 = (undefined4 *)0x0; *param_4 = 0; - local_88 = param_5; + local_98 = param_5; *param_5 = 0; uVar8 = *(undefined8 *)(param_1 + 8); - local_98[0] = 0; - local_90 = param_3; + local_a8[0] = 0; + local_a0 = param_3; + local_90 = param_4; KeEnterCriticalRegion(); ExAcquirePushLockExclusiveEx(uVar8,0); - uVar5 = BfsAllocateBlock(*(longlong *)(param_1 + 8),(int *)local_98); + uVar5 = BfsAllocateBlock(*(longlong *)(param_1 + 8),(int *)local_a8); if ((int)uVar5 < 0) { ExReleasePushLockExclusiveEx(*(undefined8 *)(param_1 + 8),0); KeLeaveCriticalRegion(); return uVar5 & 0xffffffff; } lVar9 = 0x100; + bVar10 = false; plVar6 = (longlong *)ExAllocatePool2(0x100,0x20,0x4c736642); - uVar3 = local_98[0]; + uVar3 = local_a8[0]; if (plVar6 == (longlong *)0x0) { uVar4 = 0xc0000017; } else { lVar9 = 0x100; puVar7 = (undefined4 *)ExAllocatePool2(0x100,0x4000,0x62736642); if (puVar7 == (undefined4 *)0x0) { uVar4 = 0xc0000017; } else { plVar6[2] = (longlong)puVar7; *(uint *)(plVar6 + 3) = uVar3; lVar9 = *(longlong *)(param_1 + 0x10); plVar1 = *(longlong **)(lVar9 + 8); if (*plVar1 != lVar9) goto LAB_0; + *plVar6 = lVar9; plVar6[1] = (longlong)plVar1; - *plVar6 = lVar9; *plVar1 = (longlong)plVar6; *(longlong **)(lVar9 + 8) = plVar6; + uVar5 = Feature_3879979322__private_IsEnabledDeviceUsageNoInline(); + bVar10 = (int)uVar5 != 0; memset(puVar7 + 1,0,0x3ffc); *puVar7 = 0x44736642; lVar9 = *(longlong *)(param_1 + 8); uVar8 = BfsWriteBlock(lVar9,uVar3,puVar7); uVar4 = (uint)uVar8; if (-1 < (int)uVar4) { lVar9 = *(longlong *)(param_1 + 8); uVar8 = BfsWriteBlock(lVar9,0,*(undefined8 *)(lVar9 + 0x10)); uVar4 = (uint)uVar8; if (-1 < (int)uVar4) { *(uint *)(param_2 + 4) = uVar3; lVar9 = *(longlong *)(param_1 + 8); - uVar8 = BfsWriteBlock(lVar9,*(int *)(local_90 + 0x18),param_2); + uVar8 = BfsWriteBlock(lVar9,*(int *)(local_a0 + 0x18),param_2); uVar4 = (uint)uVar8; if (-1 < (int)uVar4) { - *local_88 = plVar6; - *param_4 = puVar7; + *local_98 = plVar6; + *local_90 = puVar7; goto LAB_1; } } } } } if (3 < DAT_2) { - local_54 = 0; - local_60 = local_98; - local_58 = 4; - local_a0 = local_80; - local_98[0] = uVar4; + local_5c = 0; + local_68 = local_a8; + local_60 = 4; + local_b0 = local_88; + local_a8[0] = uVar4; _tlgWriteTransfer_EtwWriteTransfer(lVar9,&DAT_3); } BfsFreeBlock(*(longlong *)(param_1 + 8),uVar3); - uVar5 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); + uVar5 = Feature_3879979322__private_IsEnabledDeviceUsageNoInline(); if (((int)uVar5 != 0) && (*(uint *)(param_2 + 4) == uVar3)) { *(undefined4 *)(param_2 + 4) = 0; } if (plVar6 != (longlong *)0x0) { - uVar5 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 != 0) { + uVar5 = Feature_3879979322__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar5 != 0) && (bVar10)) { lVar9 = *plVar6; if ((*(longlong **)(lVar9 + 8) != plVar6) || (plVar1 = (longlong *)plVar6[1], (longlong *)*plVar1 != plVar6)) { LAB_0: pcVar2 = (code *)swi(0x29); (*pcVar2)(3); pcVar2 = (code *)swi(3); uVar5 = (*pcVar2)(); return uVar5; } *plVar1 = lVar9; *(longlong **)(lVar9 + 8) = plVar1; } ExFreePoolWithTag(plVar6,0); } if (puVar7 != (undefined4 *)0x0) { ExFreePoolWithTag(puVar7,0); } LAB_1: ExReleasePushLockExclusiveEx(*(undefined8 *)(param_1 + 8),0); KeLeaveCriticalRegion(); return (ulonglong)uVar4; } ``` ## BfsCheckAndApplyPolicy ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.35| |i_ratio|0.59| |m_ratio|0.97| |b_ratio|0.5| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsCheckAndApplyPolicy|BfsCheckAndApplyPolicy| |fullname|BfsCheckAndApplyPolicy|BfsCheckAndApplyPolicy| |refcount|2|2| |`length`|1589|1647| |`called`|
Expand for full list:
BfsAddOrModifyEntry
BfsApplyPolicyAsUser
BfsDereferencePolicyEntryEx
BfsFileInPublisherDirectory
BfsGetFileName
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsPolicyEntryExists
BfsQueryAccessOnly
BfsQueueDeferredWorkItemAndWaitFLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReferenceFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_1827994938__private_IsEnabledDeviceUsageNoInline
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCheckTokenCapability
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsAddOrModifyEntry
BfsApplyPolicyAsUser
BfsDereferencePolicyEntryEx
BfsFileInPublisherDirectory
BfsGetFileName
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsPolicyEntryExists
BfsQueryAccessOnly
BfsQueueDeferredWorkItemAndWaitFLTMGR.SYS::FltGetFileNameInformation
FLTMGR.SYS::FltReferenceFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_241429816__private_IsEnabledDeviceUsageNoInline
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCheckTokenCapability
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsPreCreateOperation|BfsPreCreateOperation| |paramcount|5|5| |`address`|140005c68|140005e98| |sig|undefined1 __fastcall BfsCheckAndApplyPolicy(ushort * param_1, longlong param_2, ushort * param_3, ushort * param_4, longlong * param_5)|undefined1 __fastcall BfsCheckAndApplyPolicy(ushort * param_1, longlong param_2, ushort * param_3, ushort * param_4, longlong * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsCheckAndApplyPolicy Called Diff ```diff --- BfsCheckAndApplyPolicy called +++ BfsCheckAndApplyPolicy called @@ -15 +15 @@ -Feature_1827994938__private_IsEnabledDeviceUsageNoInline +Feature_241429816__private_IsEnabledDeviceUsageNoInline ``` ### BfsCheckAndApplyPolicy Diff ```diff --- BfsCheckAndApplyPolicy +++ BfsCheckAndApplyPolicy @@ -1,283 +1,285 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined1 BfsCheckAndApplyPolicy (ushort *param_1,longlong param_2,ushort *param_3,ushort *param_4,longlong *param_5) { - byte bVar1; - uint uVar2; - int iVar3; - uint uVar4; - undefined4 uVar5; + bool bVar1; + byte bVar2; + uint uVar3; + int iVar4; + uint uVar5; ulonglong uVar6; ushort *puVar7; - undefined8 uVar8; - longlong lVar9; + ulonglong uVar8; + undefined8 uVar9; longlong lVar10; undefined1 uVar11; ushort *puVar12; undefined1 auStackY_138 [32]; undefined1 local_108; - char local_107 [7]; uint local_100 [2]; undefined1 local_f8; char local_f7; undefined1 local_f6; - longlong local_f0; + ulonglong local_f0; longlong local_e8; undefined8 *local_e0; undefined8 *local_d8; ushort *local_d0; ushort *local_c8; longlong local_c0; undefined8 local_b8; undefined8 uStack_b0; undefined8 local_a8; undefined8 uStack_a0; ushort local_98 [24]; uint *local_68; - undefined4 local_60; - undefined4 local_5c; + undefined8 local_60; ulonglong local_58; local_58 = __security_cookie ^ (ulonglong)auStackY_138; local_f7 = '\0'; local_e0 = (undefined8 *)0x0; local_f0 = 0; local_108 = 0; local_e8 = 0; local_d8 = (undefined8 *)0x0; local_f6 = 0; local_a8 = 0; uStack_a0 = 0; uVar11 = 0; local_f8 = 0; puVar7 = param_3; local_d0 = param_3; - uVar2 = SeQueryInformationToken(param_3,1,&local_e0); - uVar4 = local_100[0]; - if ((-1 < (int)uVar2) && - (puVar7 = param_3, uVar2 = SeQueryInformationToken(param_3,0x1f,&local_d8), - uVar4 = local_100[0], -1 < (int)uVar2)) { - uVar2 = FltGetFileNameInformation(param_4,0x101,&local_e8); - if (uVar2 == 0xc0000201) { + uVar3 = SeQueryInformationToken(param_3,1,&local_e0); + uVar5 = local_100[0]; + if ((-1 < (int)uVar3) && + (puVar7 = param_3, uVar3 = SeQueryInformationToken(param_3,0x1f,&local_d8), + uVar5 = local_100[0], -1 < (int)uVar3)) { + uVar3 = FltGetFileNameInformation(param_4,0x101,&local_e8); + if (uVar3 == 0xc0000201) { local_c0 = 0; local_c8 = param_3; - uVar2 = BfsQueueDeferredWorkItemAndWait + uVar3 = BfsQueueDeferredWorkItemAndWait ((longlong)param_1,param_2,param_4,&local_c8, BfsQueryFileNameInformationCallback); local_e8 = local_c0; } - puVar7 = (ushort *)(ulonglong)uVar2; - uVar4 = local_100[0]; - if (-1 < (int)uVar2) { - bVar1 = BfsPolicyEntryExists(param_1,param_2,0x14001b2b0,(byte *)*local_e0,(byte *)*local_d8); + puVar7 = (ushort *)(ulonglong)uVar3; + uVar5 = local_100[0]; + if (-1 < (int)uVar3) { + bVar2 = BfsPolicyEntryExists(param_1,param_2,0x14001b2d0,(byte *)*local_e0,(byte *)*local_d8); uVar11 = local_108; - if (bVar1 == 0) { + if (bVar2 == 0) { puVar7 = (ushort *)&gBfsPolicyTable; - uVar8 = BfsGetNotPresentPolicyEntry - (0x14001b2b0,(byte *)*local_e0,(byte *)*local_d8,&local_f0); - uVar4 = (uint)uVar8; - lVar10 = local_f0; - if ((int)uVar4 < 0) goto LAB_0; + uVar9 = BfsGetNotPresentPolicyEntry + (0x14001b2d0,(byte *)*local_e0,(byte *)*local_d8,(longlong *)&local_f0); + uVar5 = (uint)uVar9; + uVar6 = local_f0; + if ((int)uVar5 < 0) goto LAB_0; LAB_1: - local_107[0] = '\0'; - uVar6 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar6 == 0) { + bVar1 = false; + uVar8 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 == 0) { puVar7 = (ushort *)0x0; - uVar4 = RtlCheckTokenCapability - (0,*(undefined8 *)(*(longlong *)SeExports_exref + 0x250),local_107); - } - else if (*(int *)(lVar10 + 0x6c) == 0) { + uVar5 = RtlCheckTokenCapability(); + } + else if (*(int *)(uVar6 + 0x6c) == 0) { puVar7 = (ushort *)0x0; - uVar4 = RtlCheckTokenCapability - (0,*(undefined8 *)(*(longlong *)SeExports_exref + 0x250),local_107); - uVar5 = 1; - if (local_107[0] == '\0') { - uVar5 = 2; - } - *(undefined4 *)(lVar10 + 0x6c) = uVar5; - } - else if (*(int *)(lVar10 + 0x6c) == 1) { - local_107[0] = '\x01'; + uVar5 = RtlCheckTokenCapability(); + *(undefined4 *)(uVar6 + 0x6c) = 2; + } + else if (*(int *)(uVar6 + 0x6c) == 1) { + bVar1 = true; } puVar12 = local_d0; - if ((int)uVar4 < 0) { - uVar2 = local_100[0]; - if (uVar4 == 0xc0000022) goto LAB_2; -joined_r0x00014000624a: - local_100[0] = uVar4; - if (3 < DAT_3) { -LAB_4: - local_5c = 0; - local_68 = local_100; - local_60 = 4; - _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_5); - uVar2 = local_100[0]; - } - } - else { - if (local_107[0] != '\0') { - puVar7 = local_d0; - uVar4 = BfsFileInPublisherDirectory(local_d0,local_e8,(ushort *)&local_f7,&local_a8); - uVar2 = local_100[0]; - if ((int)uVar4 < 0) goto joined_r0x00014000624a; - if (local_f7 == '\0') goto LAB_2; + lVar10 = 0; + if (-1 < (int)uVar5) { + if (!bVar1) goto LAB_2; + puVar7 = local_d0; + uVar5 = BfsFileInPublisherDirectory(local_d0,local_e8,(ushort *)&local_f7,&local_a8); + lVar10 = 0; + if ((int)uVar5 < 0) { + if (3 < DAT_4) goto LAB_1400062b5; +LAB_5: + uVar11 = (char)lVar10; + goto LAB_6; + } + if (local_f7 == '\0') goto LAB_2; + if (uVar6 == 0) { +LAB_7: + puVar7 = param_1; + uVar6 = BfsGetPolicyEntry((longlong *)param_1,param_2,0x14001b2d0,(byte *)*local_e0, + (byte *)*local_d8,&local_f0); + uVar5 = (uint)uVar6; + uVar6 = local_f0; + if ((int)uVar5 < 0) goto LAB_0; + } + else if (*(int *)(uVar6 + 0x38) == 2) { + BfsDereferencePolicyEntryEx(uVar6,'\0'); + uVar8 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + local_f0 = uVar6; + if ((int)uVar8 != 0) { + local_f0 = 0; + } + goto LAB_7; + } + if (*(int *)(uVar6 + 0x38) == 0x10000001) { + uVar8 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 != 0) { + BfsDereferencePolicyEntryEx(uVar6,'\0'); + local_f0 = 0; + } + uVar6 = BfsGetPolicyEntry((longlong *)param_1,param_2,0x14001b2d0,(byte *)*local_e0, + (byte *)*local_d8,&local_f0); + uVar5 = (uint)uVar6; + puVar7 = param_1; + if ((int)uVar5 < 0) goto LAB_0; + uVar8 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + uVar6 = local_f0; + if ((int)uVar8 == 0) { + BfsDereferencePolicyEntryEx(local_f0,'\0'); + } + } + BfsAddOrModifyEntry(*(longlong *)(uVar6 + 0x30),2,1,2,(ushort *)(local_e8 + 0x18), + (short *)&local_a8); + goto LAB_8; + } + if (uVar5 == 0xc0000022) { +LAB_2: + if ((local_e8 != lVar10) || + (uVar5 = FltGetFileNameInformation(param_4,0x101,&local_e8), puVar7 = param_4, + -1 < (int)uVar5)) { + lVar10 = *param_5; if (lVar10 == 0) { -LAB_6: - puVar7 = param_1; - uVar6 = BfsGetPolicyEntry((undefined8 *)param_1,param_2,0x14001b2b0,(byte *)*local_e0, - (byte *)*local_d8,&local_f0); - uVar4 = (uint)uVar6; - lVar10 = local_f0; - if ((int)uVar4 < 0) goto LAB_0; - } - else if (*(int *)(lVar10 + 0x38) == 2) { - BfsDereferencePolicyEntryEx(lVar10,'\0'); - goto LAB_6; - } - uVar6 = Feature_1827994938__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar6 != 0) && (*(int *)(lVar10 + 0x38) == 0x10000001)) { - uVar6 = BfsGetPolicyEntry((undefined8 *)param_1,param_2,0x14001b2b0,(byte *)*local_e0, - (byte *)*local_d8,&local_f0); - lVar10 = local_f0; - uVar4 = (uint)uVar6; - puVar7 = param_1; - if ((int)uVar4 < 0) goto LAB_0; - BfsDereferencePolicyEntryEx(local_f0,'\0'); - } - BfsAddOrModifyEntry(*(longlong *)(lVar10 + 0x30),2,1,2,(ushort *)(local_e8 + 0x18), - (short *)&local_a8); - goto LAB_7; - } -LAB_2: - if ((local_e8 == 0) && - (uVar4 = FltGetFileNameInformation(param_4,0x101,&local_e8), puVar7 = param_4, - uVar2 = local_100[0], (int)uVar4 < 0)) goto joined_r0x00014000624a; - lVar9 = *param_5; - if (lVar9 == 0) { - puVar7 = (ushort *)0x100; - lVar9 = ExAllocatePool2(0x100,0x60,0x43736642); - *param_5 = lVar9; - if (lVar9 == 0) { - uVar2 = local_100[0]; - if (DAT_3 < 4) goto LAB_140005e61; - local_100[0] = 0xc0000017; - goto LAB_4; - } - } - *(undefined4 *)(lVar9 + 8) = 1; - FltReferenceFileNameInformation(local_e8); - *(longlong *)(*param_5 + 0x30) = local_e8; - *(longlong *)(*param_5 + 0x40) = lVar10; - LOCK(); - *(int *)(lVar10 + 0x98) = *(int *)(lVar10 + 0x98) + 1; - UNLOCK(); - *(uint *)*param_5 = *(uint *)*param_5 | 1; - lVar10 = local_f0; - uVar11 = 1; - uVar2 = local_100[0]; - } + puVar7 = (ushort *)0x100; + lVar10 = ExAllocatePool2(0x100,0x60,0x43736642); + *param_5 = lVar10; + if (lVar10 == 0) { + if (3 < DAT_4) { + local_100[0] = 0xc0000017; + uVar5 = local_100[0]; + goto LAB_3; + } + goto LAB_6; + } + } + *(undefined4 *)(lVar10 + 8) = 1; + FltReferenceFileNameInformation(local_e8); + *(longlong *)(*param_5 + 0x30) = local_e8; + *(ulonglong *)(*param_5 + 0x40) = uVar6; + LOCK(); + *(int *)(uVar6 + 0x98) = *(int *)(uVar6 + 0x98) + 1; + UNLOCK(); + *(uint *)*param_5 = *(uint *)*param_5 | 1; + uVar6 = local_f0; + uVar11 = 1; + goto LAB_6; + } + goto LAB_9; + } + if (DAT_4 < 4) goto LAB_14000608c; +LAB_3: + local_100[0] = uVar5; + local_68 = local_100; + local_60 = 4; + _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_10); } else { puVar7 = param_1; - uVar6 = BfsGetPolicyEntry((undefined8 *)param_1,param_2,0x14001b2b0,(byte *)*local_e0, + uVar6 = BfsGetPolicyEntry((longlong *)param_1,param_2,0x14001b2d0,(byte *)*local_e0, (byte *)*local_d8,&local_f0); - uVar4 = (uint)uVar6; - if ((int)uVar4 < 0) { + uVar5 = (uint)uVar6; + if ((int)uVar5 < 0) { LAB_0: - lVar10 = local_f0; - uVar2 = local_100[0]; - if (3 < DAT_3) { - local_5c = 0; + uVar6 = local_f0; + if (3 < DAT_4) { local_68 = local_100; local_60 = 4; - local_100[0] = uVar4; - _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_5); - lVar10 = local_f0; - uVar2 = local_100[0]; + local_100[0] = uVar5; + _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_10); + uVar6 = local_f0; } } else { puVar7 = BfsGetFileName(local_98,local_e8); local_b8 = *(undefined8 *)puVar7; uStack_b0 = *(undefined8 *)(puVar7 + 4); - uVar6 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); - lVar10 = local_f0; + uVar8 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); + uVar6 = local_f0; puVar7 = *(ushort **)(local_f0 + 0x30); - if ((int)uVar6 == 0) { - uVar6 = BfsGetPolicy((longlong)puVar7,(ushort *)(local_e8 + 0x18),&local_b8, + if ((int)uVar8 == 0) { + uVar8 = BfsGetPolicy((longlong)puVar7,(ushort *)(local_e8 + 0x18),&local_b8, (undefined1 *)0x0); - iVar3 = (int)uVar6; + iVar4 = (int)uVar8; } else { - uVar6 = BfsGetPolicy((longlong)puVar7,(ushort *)(local_e8 + 0x18),&local_b8,&local_f8); - iVar3 = (int)uVar6; + uVar8 = BfsGetPolicy((longlong)puVar7,(ushort *)(local_e8 + 0x18),&local_b8,&local_f8); + iVar4 = (int)uVar8; puVar7 = (ushort *)CONCAT71((int7)((ulonglong)puVar7 >> 8),local_f8); local_f6 = local_f8; } - if (iVar3 == 0) goto LAB_1; + lVar10 = 0; + if (iVar4 == 0) goto LAB_1; puVar12 = local_d0; - if (iVar3 == 1) { -LAB_7: - uVar4 = BfsApplyPolicyAsUser - ((longlong)param_4,(longlong)puVar12,local_e8,lVar10,param_5); - puVar7 = param_4; - uVar2 = local_100[0]; - if ((int)uVar4 < 0) goto joined_r0x00014000624a; - uVar6 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar6 != 0) { + if (iVar4 != 1) { + if (iVar4 != 2) goto LAB_6; + uVar9 = BfsQueryAccessOnly((*(uint *)(*(longlong *)(param_4 + 8) + 0x20) & 1) + 1, + (longlong)param_4); + puVar12 = local_d0; + if ((char)uVar9 == '\0') { + uVar9 = BfsQueryAccessOnly((*(uint *)(*(longlong *)(param_4 + 8) + 0x20) & 1) + 1, + (longlong)param_4); + if ((char)uVar9 != '\0') goto LAB_5; + goto LAB_2; + } + } +LAB_8: + uVar5 = BfsApplyPolicyAsUser((longlong)param_4,(longlong)puVar12,local_e8,uVar6,param_5); + puVar7 = param_4; + if ((int)uVar5 < 0) { +LAB_9: + if (3 < DAT_4) goto LAB_1400062b5; + } + else { + uVar8 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 != 0) { *(undefined1 *)(*param_5 + 0x48) = local_f6; } uVar11 = 1; - uVar2 = local_100[0]; - } - else { - uVar2 = local_100[0]; - if (iVar3 == 2) { - uVar8 = BfsQueryAccessOnly((*(uint *)(*(longlong *)(param_4 + 8) + 0x20) & 1) + 1, - (longlong)param_4); - puVar12 = local_d0; - if ((char)uVar8 != '\0') goto LAB_7; - uVar8 = BfsQueryAccessOnly((*(uint *)(*(longlong *)(param_4 + 8) + 0x20) & 1) + 1, - (longlong)param_4); - uVar2 = local_100[0]; - if ((char)uVar8 == '\0') goto LAB_2; - } } } } -LAB_8: - local_100[0] = uVar2; - uVar4 = local_100[0]; - if (lVar10 != 0) { - BfsDereferencePolicyEntryEx(lVar10,'\0'); - uVar4 = local_100[0]; +LAB_6: + uVar5 = local_100[0]; + if (uVar6 != 0) { + BfsDereferencePolicyEntryEx(uVar6,'\0'); + uVar5 = local_100[0]; } - goto LAB_9; + goto LAB_11; } } - local_100[0] = uVar2; - if (3 < DAT_3) { - local_5c = 0; + local_100[0] = uVar3; + if (3 < DAT_4) { local_68 = local_100; local_60 = 4; - _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_5); - uVar4 = local_100[0]; - } -LAB_9: - local_100[0] = uVar4; + _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_10); + uVar5 = local_100[0]; + } +LAB_11: + local_100[0] = uVar5; if (local_e8 != 0) { FltReleaseFileNameInformation(); } if (local_e0 != (undefined8 *)0x0) { ExFreePoolWithTag(local_e0,0); } if (local_d8 != (undefined8 *)0x0) { ExFreePoolWithTag(local_d8,0); } return uVar11; } ``` ## BfsPreSetInfoOperation ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.8| |i_ratio|0.64| |m_ratio|0.9| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsPreSetInfoOperation|BfsPreSetInfoOperation| |fullname|BfsPreSetInfoOperation|BfsPreSetInfoOperation| |refcount|3|3| |`length`|166|203| |`called`|BfsGetFileContext
BfsProcessRename
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline|BfsGetFileContext
BfsProcessHardLink
BfsProcessRename
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline| |calling||| |paramcount|3|3| |`address`|140004200|140004030| |`sig`|undefined4 __fastcall BfsPreSetInfoOperation(undefined8 * param_1, longlong param_2, undefined8 * param_3)|undefined4 __fastcall BfsPreSetInfoOperation(longlong * param_1, longlong param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsPreSetInfoOperation Called Diff ```diff --- BfsPreSetInfoOperation called +++ BfsPreSetInfoOperation called @@ -1,0 +2 @@ +BfsProcessHardLink @@ -3,0 +5 @@ +Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline ``` ### BfsPreSetInfoOperation Diff ```diff --- BfsPreSetInfoOperation +++ BfsPreSetInfoOperation @@ -1,36 +1,45 @@ -undefined4 BfsPreSetInfoOperation(undefined8 *param_1,longlong param_2,undefined8 *param_3) +undefined4 BfsPreSetInfoOperation(longlong *param_1,longlong param_2,undefined8 *param_3) { int iVar1; undefined4 uVar2; ulonglong uVar3; undefined8 local_res20; local_res20 = 0; uVar2 = 1; uVar3 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); iVar1 = *(int *)(param_1[2] + 0x20); if ((int)uVar3 == 0) { if ((iVar1 != 0xd) && (iVar1 != 0x40)) { return 1; } LAB_0: iVar1 = BfsGetFileContext(param_2,*(undefined8 *)(param_1[2] + 8),&local_res20); if (-1 < iVar1) { *param_3 = local_res20; uVar2 = 0; } } else { - if (iVar1 != 10) { + if (iVar1 == 10) { +LAB_1: + uVar2 = BfsProcessRename(param_1,param_2); + return uVar2; + } + if (iVar1 != 0xb) { if ((iVar1 == 0xd) || (iVar1 == 0x40)) goto LAB_0; - if (iVar1 != 0x41) { + if (iVar1 == 0x41) goto LAB_1; + if (iVar1 != 0x48) { return 1; } } - uVar2 = BfsProcessRename(param_1,param_2); + uVar3 = Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 != 0) { + uVar2 = BfsProcessHardLink(param_1,param_2); + } } return uVar2; } ``` ## BfsDeviceIoControl ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.9| |i_ratio|0.59| |m_ratio|0.98| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsDeviceIoControl|BfsDeviceIoControl| |fullname|BfsDeviceIoControl|BfsDeviceIoControl| |refcount|4|4| |`length`|723|694| |`called`|
Expand for full list:
BfsCheckDeleteList
BfsProcessCreatePolicyEntryRequest
BfsProcessDeletePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyCleanupEventRequest
BfsProcessSetPolicyRequest
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInlineNTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ProbeForRead
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsCheckDeleteList
BfsProcessCreatePolicyEntryRequest
BfsProcessDeletePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyCleanupEventRequest
BfsProcessSetPolicyRequest
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtectionNTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ProbeForRead
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling||| |paramcount|2|2| |`address`|140003670|1400034d0| |sig|ulonglong __fastcall BfsDeviceIoControl(undefined8 param_1, ulonglong param_2)|ulonglong __fastcall BfsDeviceIoControl(undefined8 param_1, ulonglong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsDeviceIoControl Called Diff ```diff --- BfsDeviceIoControl called +++ BfsDeviceIoControl called @@ -8 +7,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline ``` ### BfsDeviceIoControl Diff ```diff --- BfsDeviceIoControl +++ BfsDeviceIoControl @@ -1,151 +1,148 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsDeviceIoControl(undefined8 param_1,ulonglong param_2) { int iVar1; longlong lVar2; char cVar3; uint extraout_EAX; uint uVar4; uint extraout_EAX_00; ulonglong uVar5; - undefined8 *puVar6; + longlong *plVar6; ulonglong uVar7; undefined1 auStack_98 [40]; undefined1 *local_70; char local_68; ulonglong local_60; - undefined8 *local_58; + longlong *local_58; longlong local_50; undefined1 local_48 [32]; ulonglong *local_28; undefined4 local_20; undefined4 local_1c; ulonglong local_18; local_18 = __security_cookie ^ (ulonglong)auStack_98; local_60 = param_2; KeEnterCriticalRegion(); cVar3 = ExAcquireRundownProtection(&gBfsRundownProtection); local_68 = cVar3; - uVar5 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((((int)uVar5 == 0) && (cVar3 != '\0')) || (KeLeaveCriticalRegion(), cVar3 != '\0')) { + KeLeaveCriticalRegion(); + if (cVar3 != '\0') { uVar5 = Feature_Servicing_BfsGAFeature__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar5 == 0) { LAB_0: lVar2 = *(longlong *)(param_2 + 0xb8); iVar1 = *(int *)(lVar2 + 0x18); local_50 = lVar2; if (iVar1 == 0x224008) { local_60 = local_60 & 0xffffffff00000000; if (*(uint *)(lVar2 + 0x10) < 8) { LAB_1: - puVar6 = (undefined8 *)0x0; + plVar6 = (longlong *)0x0; *(undefined8 *)(param_2 + 0x38) = 8; } else { - puVar6 = (undefined8 *)**(undefined8 **)(param_2 + 0x18); + plVar6 = (longlong *)**(undefined8 **)(param_2 + 0x18); if (3 < *(uint *)(lVar2 + 8)) { - uVar7 = BfsProcessQueryPolicySizeRequest(puVar6,(int *)&local_60); + uVar7 = BfsProcessQueryPolicySizeRequest(plVar6,(int *)&local_60); uVar7 = uVar7 & 0xffffffff; **(undefined4 **)(param_2 + 0x18) = (undefined4)local_60; *(undefined8 *)(param_2 + 0x38) = 4; LAB_2: *(int *)(param_2 + 0x30) = (int)uVar7; goto LAB_3; } *(undefined8 *)(param_2 + 0x38) = 4; } LAB_4: *(undefined4 *)(param_2 + 0x30) = 0xc0000023; LAB_5: uVar7 = 0xc0000023; if (3 < DAT_6) { local_60 = CONCAT44(local_60._4_4_,0xc0000023); goto LAB_7; } } else { - puVar6 = (undefined8 *)(ulonglong)(iVar1 - 0x22400fU); + plVar6 = (longlong *)(ulonglong)(iVar1 - 0x22400fU); if (iVar1 - 0x22400fU == 0) { - local_58 = (undefined8 *)0x0; + local_58 = (longlong *)0x0; if (*(uint *)(lVar2 + 0x10) < 8) { uVar5 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar5 != 0) goto LAB_4; goto LAB_5; } ProbeForRead(*(undefined8 *)(lVar2 + 0x20),*(uint *)(lVar2 + 0x10),8); - local_58 = (undefined8 *)**(undefined8 **)(lVar2 + 0x20); + local_58 = (longlong *)**(undefined8 **)(lVar2 + 0x20); uVar5 = BfsProcessQueryPolicyRequest (local_58,*(uint **)(param_2 + 0x70),*(uint *)(lVar2 + 8)); uVar4 = (uint)uVar5; } else if (iVar1 == 0x228004) { BfsProcessSetPolicyRequest(*(undefined8 **)(param_2 + 0x18),*(uint *)(lVar2 + 0x10)); uVar4 = extraout_EAX_00; } else { if (iVar1 != 0x228010) { if (iVar1 == 0x228014) { uVar5 = Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar5 != 0) { uVar4 = BfsProcessSetPolicyCleanupEventRequest (*(longlong **)(param_2 + 0x18),*(uint *)(lVar2 + 0x10)); goto LAB_8; } } else if ((iVar1 == 0x228018) && (uVar5 = Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline(), (int)uVar5 != 0)) { BfsProcessCreatePolicyEntryRequest (*(undefined8 **)(param_2 + 0x18),*(uint *)(lVar2 + 0x10)); uVar4 = extraout_EAX; LAB_8: uVar7 = (ulonglong)uVar4; goto LAB_2; } uVar7 = 0xc0000010; goto LAB_2; } if (*(uint *)(lVar2 + 0x10) < 8) goto LAB_1; uVar4 = BfsProcessDeletePolicyEntryRequest(**(longlong **)(param_2 + 0x18)); } uVar7 = (ulonglong)uVar4; *(uint *)(param_2 + 0x30) = uVar4; } } else { - puVar6 = gBfsFilterHandle; + plVar6 = gBfsFilterHandle; uVar5 = BfsCheckDeleteList(gBfsFilterHandle,0); uVar7 = uVar5 & 0xffffffff; if (-1 < (int)uVar5) goto LAB_0; if (3 < DAT_6) { local_60 = CONCAT44(local_60._4_4_,(int)uVar5); LAB_7: local_28 = &local_60; local_20 = 4; local_1c = 0; local_70 = local_48; - _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_9); + _tlgWriteTransfer_EtwWriteTransfer(plVar6,&DAT_9); } } LAB_3: if (cVar3 != '\0') { - uVar5 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 != 0) { - KeEnterCriticalRegion(); - } + KeEnterCriticalRegion(); ExReleaseRundownProtection(&gBfsRundownProtection); KeLeaveCriticalRegion(); goto LAB_10; } } uVar7 = 0xc0000010; *(undefined4 *)(param_2 + 0x30) = 0xc0000010; LAB_10: IofCompleteRequest(param_2,0); return uVar7; } ``` ## BfsProcessRename ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.69| |i_ratio|0.63| |m_ratio|0.96| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsProcessRename|BfsProcessRename| |fullname|BfsProcessRename|BfsProcessRename| |refcount|2|2| |`length`|601|561| |`called`|
Expand for full list:
BfsCheckPolicyAndPerformRenameAsUser
BfsIsApplicableToken
FLTMGR.SYS::FltGetDestinationFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegionNTOSKRNL.EXE::PsDereferenceImpersonationToken
NTOSKRNL.EXE::PsDereferencePrimaryToken
NTOSKRNL.EXE::PsReferenceImpersonationToken
NTOSKRNL.EXE::PsReferencePrimaryToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsCheckPolicyAndPerformRenameAsUser
BfsIsApplicableToken
FLTMGR.SYS::FltGetDestinationFileNameInformation
FLTMGR.SYS::FltParseFileNameInformation
FLTMGR.SYS::FltReleaseFileNameInformation
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::PsDereferenceImpersonationTokenNTOSKRNL.EXE::PsDereferencePrimaryToken
NTOSKRNL.EXE::PsReferenceImpersonationToken
NTOSKRNL.EXE::PsReferencePrimaryToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsPreSetInfoOperation|BfsPreSetInfoOperation| |paramcount|2|2| |`address`|1400042b0|140004554| |`sig`|undefined4 __fastcall BfsProcessRename(undefined8 * param_1, longlong param_2)|undefined4 __fastcall BfsProcessRename(longlong * param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsProcessRename Called Diff ```diff --- BfsProcessRename called +++ BfsProcessRename called @@ -6 +5,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline ``` ### BfsProcessRename Diff ```diff --- BfsProcessRename +++ BfsProcessRename @@ -1,101 +1,88 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -undefined4 BfsProcessRename(undefined8 *param_1,longlong param_2) +undefined4 BfsProcessRename(longlong *param_1,longlong param_2) { longlong lVar1; bool bVar2; char cVar3; char cVar4; int iVar5; undefined4 uVar6; - ulonglong uVar7; - longlong lVar8; - undefined8 uVar9; - longlong lVar10; + longlong lVar7; + undefined8 uVar8; + longlong lVar9; undefined1 auStackY_b8 [32]; undefined1 local_78; undefined1 local_77 [3]; int local_74; int local_70 [2]; longlong local_68; int *local_40; undefined4 local_38; undefined4 local_34; ulonglong local_30; local_30 = __security_cookie ^ (ulonglong)auStackY_b8; local_70[0] = 0; local_68 = 0; local_77[0] = 0; uVar6 = 1; local_78 = 0; - if (*(char *)(param_1 + 10) == '\0') { + if ((char)param_1[10] == '\0') { return 1; } KeEnterCriticalRegion(); cVar3 = ExAcquireRundownProtection(&gBfsRundownProtection); - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 == 0) { - if (cVar3 == '\0') { - KeLeaveCriticalRegion(); - goto LAB_0; - } - } - else { - KeLeaveCriticalRegion(); - if (cVar3 == '\0') goto LAB_0; - } - lVar8 = PsReferenceImpersonationToken(param_1[1],local_77,&local_78,local_70); + KeLeaveCriticalRegion(); + if (cVar3 == '\0') goto LAB_0; + lVar7 = PsReferenceImpersonationToken(param_1[1],local_77,&local_78,local_70); bVar2 = true; - if (lVar8 == 0) { - uVar9 = IoGetCurrentProcess(); - lVar8 = PsReferencePrimaryToken(uVar9); + if (lVar7 == 0) { + uVar8 = IoGetCurrentProcess(); + lVar7 = PsReferencePrimaryToken(uVar8); bVar2 = false; LAB_1: - cVar4 = BfsIsApplicableToken(lVar8,'\x01'); + cVar4 = BfsIsApplicableToken(lVar7,'\x01'); if (cVar4 != '\0') { - lVar10 = *(longlong *)(param_2 + 0x18); + lVar9 = *(longlong *)(param_2 + 0x18); lVar1 = *(longlong *)(param_1[2] + 0x38); iVar5 = FltGetDestinationFileNameInformation - (lVar10,*(undefined8 *)(param_1[2] + 8),*(undefined8 *)(lVar1 + 8), + (lVar9,*(undefined8 *)(param_1[2] + 8),*(undefined8 *)(lVar1 + 8), lVar1 + 0x14); - if ((iVar5 < 0) || (lVar10 = local_68, iVar5 = FltParseFileNameInformation(), iVar5 < 0)) { + if ((iVar5 < 0) || (lVar9 = local_68, iVar5 = FltParseFileNameInformation(), iVar5 < 0)) { if (3 < DAT_2) { local_34 = 0; local_40 = &local_74; local_38 = 4; local_74 = iVar5; - _tlgWriteTransfer_EtwWriteTransfer(lVar10,&DAT_3); + _tlgWriteTransfer_EtwWriteTransfer(lVar9,&DAT_3); } } else { uVar6 = BfsCheckPolicyAndPerformRenameAsUser - (*(undefined8 **)(param_2 + 8),*(longlong *)(param_2 + 0x18),lVar8,param_1 - ,local_68); + (*(longlong **)(param_2 + 8),*(longlong *)(param_2 + 0x18),lVar7,param_1, + local_68); } } - if (lVar8 == 0) goto LAB_0; + if (lVar7 == 0) goto LAB_0; if (!bVar2) { - PsDereferencePrimaryToken(lVar8); + PsDereferencePrimaryToken(lVar7); goto LAB_0; } } else if (1 < local_70[0]) goto LAB_1; - PsDereferenceImpersonationToken(lVar8); + PsDereferenceImpersonationToken(lVar7); LAB_0: if (local_68 != 0) { FltReleaseFileNameInformation(); } if (cVar3 != '\0') { - uVar7 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar7 != 0) { - KeEnterCriticalRegion(); - } + KeEnterCriticalRegion(); ExReleaseRundownProtection(&gBfsRundownProtection); KeLeaveCriticalRegion(); } return uVar6; } ``` ## BfsCreateDirectory ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.53| |i_ratio|0.43| |m_ratio|0.99| |b_ratio|0.53| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsCreateDirectory|BfsCreateDirectory| |fullname|BfsCreateDirectory|BfsCreateDirectory| |refcount|12|12| |`length`|946|944| |`called`|
Expand for full list:
BfsFindEntry
BfsFreeDirectoryBlockList
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsLocateDirectory
BfsReadBlock
Feature_3498538297__private_IsEnabledDeviceUsageNoInline
Feature_AppSiloBfsInsertEntryValidityCheck__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExAllocatePool2NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializePushLock
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlInitializeGenericTableAvl
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
|
Expand for full list:
BfsFindEntry
BfsFreeDirectoryBlockList
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsLocateDirectory
BfsReadBlock
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExAllocatePool2NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializePushLock
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlInitializeGenericTableAvl
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
| |calling|BfsAddOrModifyEntry
BfsDeleteEntry
BfsEnumeratePolicy
BfsGetPolicy
BfsRenameEntry|BfsAddOrModifyEntry
BfsDeleteEntry
BfsEnumeratePolicy
BfsGetPolicy
BfsRenameEntry| |paramcount|4|4| |`address`|1400129d8|140012b88| |sig|ulonglong __fastcall BfsCreateDirectory(longlong param_1, ushort * param_2, uint param_3, longlong * param_4)|ulonglong __fastcall BfsCreateDirectory(longlong param_1, ushort * param_2, uint param_3, longlong * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsCreateDirectory Called Diff ```diff --- BfsCreateDirectory called +++ BfsCreateDirectory called @@ -4,0 +5 @@ +BfsInsertDirectoryEntry_OLD @@ -7,2 +8 @@ -Feature_3498538297__private_IsEnabledDeviceUsageNoInline -Feature_AppSiloBfsInsertEntryValidityCheck__private_IsEnabledDeviceUsageNoInline +Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline ``` ### BfsCreateDirectory Diff ```diff --- BfsCreateDirectory +++ BfsCreateDirectory @@ -1,182 +1,177 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsCreateDirectory(longlong param_1,ushort *param_2,uint param_3,longlong *param_4) { longlong *plVar1; code *pcVar2; int iVar3; ulonglong uVar4; longlong lVar5; longlong *plVar6; longlong lVar7; ulonglong uVar8; - ulonglong uVar9; - longlong lVar10; + longlong lVar9; + undefined1 *puVar10; undefined1 *puVar11; undefined1 *puVar12; undefined1 auStackY_148 [8]; undefined1 auStackY_140 [24]; char local_118 [8]; undefined1 *local_110; undefined1 local_108 [8]; undefined8 local_100; longlong *local_f8; undefined1 local_78 [32]; undefined1 *local_58; undefined8 local_50; ulonglong local_48; - puVar12 = auStackY_148; + puVar10 = auStackY_148; + puVar11 = auStackY_148; local_48 = __security_cookie ^ (ulonglong)auStackY_148; memset(local_108,0,0x88); - lVar10 = param_1 + 0x18; + lVar9 = param_1 + 0x18; local_118[0] = '\0'; - uVar4 = BfsLocateDirectory(lVar10,param_2,param_4); - puVar11 = auStackY_148; + uVar4 = BfsLocateDirectory(lVar9,param_2,param_4); + puVar12 = auStackY_148; if (-1 < (int)uVar4) goto LAB_0; KeEnterCriticalRegion(); ExAcquirePushLockSharedEx(param_1,0); lVar5 = BfsFindEntry(param_1,param_2); ExReleasePushLockSharedEx(param_1,0); KeLeaveCriticalRegion(); if (lVar5 == 0) { if (param_3 == 1) { uVar4 = 0xc0000225; - puVar11 = auStackY_148; + puVar12 = auStackY_148; goto LAB_0; } if ((param_3 & 3) != 0) { - lVar5 = BfsInsertDirectoryEntry(param_1,2,0,0,param_2); - uVar4 = Feature_AppSiloBfsInsertEntryValidityCheck__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar4 != 0) && (lVar5 == 0)) { + uVar4 = Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + lVar5 = BfsInsertDirectoryEntry_OLD(param_1,2,0,0,param_2); + } + else { + lVar5 = BfsInsertDirectoryEntry(param_1,2,0,0,0,param_2); + } + if (lVar5 == 0) { uVar4 = 0xc0000017; - puVar11 = auStackY_148; + puVar12 = auStackY_148; goto LAB_0; } } } else if (*(int *)(lVar5 + 0xc) == 0) { uVar4 = 0xc0000032; - puVar11 = auStackY_148; + puVar12 = auStackY_148; goto LAB_0; } iVar3 = *(int *)(lVar5 + 0xc); lVar5 = 0x100; local_f8 = (longlong *)ExAllocatePool2(0x100,0x10,0x48736642); - puVar11 = auStackY_148; if (local_f8 == (longlong *)0x0) { LAB_1: - iVar3 = -0x3fffffe9; + lVar9 = lVar5; uVar4 = 0xc0000017; -LAB_2: - puVar12 = puVar11; - if (3 < DAT_3) { - *(int *)(puVar12 + 0x38) = iVar3; -LAB_4: + if (3 < DAT_2) { + local_110 = (undefined1 *)CONCAT44(local_110._4_4_,0xc0000017); + puVar11 = auStackY_148; +LAB_3: local_50 = 4; - local_58 = puVar12 + 0x38; - *(undefined1 **)(puVar12 + 0x28) = local_78; - *(undefined8 *)(puVar12 + -8) = 0x140012d44; - _tlgWriteTransfer_EtwWriteTransfer(lVar5,&DAT_5); + local_58 = puVar11 + 0x38; + *(undefined1 **)(puVar11 + 0x28) = local_78; + *(undefined8 *)(puVar11 + -8) = 0x140012ef2; + _tlgWriteTransfer_EtwWriteTransfer(lVar9,&DAT_4); } } else { local_f8[1] = (longlong)local_f8; *local_f8 = (longlong)local_f8; do { lVar5 = 0x100; plVar6 = (longlong *)ExAllocatePool2(0x100,0x20,0x4c736642); - puVar11 = auStackY_148; if (plVar6 == (longlong *)0x0) goto LAB_1; lVar5 = 0x100; lVar7 = ExAllocatePool2(0x100,0x4000,0x62736642); - puVar11 = auStackY_148; - if (lVar7 == 0) goto LAB_1; + if (lVar7 == 0) { +LAB_5: + iVar3 = -0x3fffffe9; + uVar4 = 0xc0000017; + puVar12 = puVar10; +LAB_6: + puVar11 = puVar12; + if (DAT_2 < 4) goto LAB_140012ef2; + *(int *)(puVar11 + 0x38) = iVar3; + lVar9 = lVar5; + goto LAB_3; + } plVar6[2] = lVar7; *(int *)(plVar6 + 3) = iVar3; plVar1 = (longlong *)local_f8[1]; if ((longlong *)*plVar1 != local_f8) { lVar5 = 3; pcVar2 = (code *)swi(0x29); (*pcVar2)(); - puVar11 = auStackY_140; - goto LAB_1; + puVar10 = auStackY_140; + goto LAB_5; } *plVar6 = (longlong)local_f8; plVar6[1] = (longlong)plVar1; *plVar1 = (longlong)plVar6; local_f8[1] = (longlong)plVar6; lVar5 = *(longlong *)(param_1 + 8); uVar4 = BfsReadBlock(lVar5,iVar3,lVar7); iVar3 = (int)uVar4; uVar4 = uVar4 & 0xffffffff; - puVar11 = auStackY_148; - if (iVar3 < 0) goto LAB_2; + puVar12 = auStackY_148; + if (iVar3 < 0) goto LAB_6; iVar3 = *(int *)(lVar7 + 4); } while (iVar3 != 0); local_100 = *(undefined8 *)(param_1 + 8); local_110 = local_108; - uVar4 = Feature_3498538297__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar4 != 0) { - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(lVar10,0); + KeEnterCriticalRegion(); + ExAcquirePushLockExclusiveEx(lVar9,0); + uVar8 = BfsInsertDirectory(lVar9,(longlong)param_2,(longlong *)&local_110,local_118); + puVar11 = local_110; + uVar4 = uVar8 & 0xffffffff; + if (-1 < (int)uVar8) { + if (local_118[0] == '\0') { + BfsFreeDirectoryBlockList(local_f8); + ExFreePoolWithTag(local_f8,0); + } + else { + ExInitializePushLock(local_110 + 0x18); + RtlInitializeGenericTableAvl + (puVar11 + 0x20,BfsCompareTableEntries,BfsAllocateTableEntry,BfsFreeTableEntry); + LOCK(); + *(int *)(param_1 + 0x90) = *(int *)(param_1 + 0x90) + 1; + UNLOCK(); + } + ExReleasePushLockExclusiveEx(lVar9,0); + KeLeaveCriticalRegion(); + *param_4 = (longlong)local_110; + puVar12 = auStackY_148; + goto LAB_0; } - lVar5 = lVar10; - uVar8 = BfsInsertDirectory(lVar10,(longlong)param_2,(longlong *)&local_110,local_118); - iVar3 = (int)uVar8; - uVar4 = uVar8 & 0xffffffff; - uVar9 = Feature_3498538297__private_IsEnabledDeviceUsageNoInline(); - puVar11 = local_110; - if ((int)uVar9 == 0) { - if (iVar3 < 0) { -LAB_6: - uVar4 = uVar8 & 0xffffffff; - puVar12 = auStackY_148; - if (3 < DAT_3) { - local_110 = (undefined1 *)CONCAT44(local_110._4_4_,iVar3); - puVar12 = auStackY_148; - goto LAB_4; - } - goto LAB_7; - } + ExReleasePushLockExclusiveEx(lVar9,0); + KeLeaveCriticalRegion(); + puVar11 = auStackY_148; + if (3 < DAT_2) { + local_110 = (undefined1 *)CONCAT44(local_110._4_4_,(int)uVar8); + puVar11 = auStackY_148; + goto LAB_3; } - else if (iVar3 < 0) { - ExReleasePushLockExclusiveEx(lVar10,0); - KeLeaveCriticalRegion(); - lVar5 = lVar10; - goto LAB_6; - } - if (local_118[0] == '\0') { - BfsFreeDirectoryBlockList(local_f8); - ExFreePoolWithTag(local_f8,0); - } - else { - ExInitializePushLock(local_110 + 0x18); - RtlInitializeGenericTableAvl - (puVar11 + 0x20,BfsCompareTableEntries,BfsAllocateTableEntry,BfsFreeTableEntry); - LOCK(); - *(int *)(param_1 + 0x90) = *(int *)(param_1 + 0x90) + 1; - UNLOCK(); - } - uVar8 = Feature_3498538297__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar8 != 0) { - ExReleasePushLockExclusiveEx(lVar10,0); - KeLeaveCriticalRegion(); - } - *param_4 = (longlong)local_110; - puVar11 = auStackY_148; - if (-1 < iVar3) goto LAB_0; } LAB_7: - *(undefined8 *)(puVar12 + -8) = 0x140012d4e; - BfsFreeDirectoryBlockList(*(longlong **)(puVar12 + 0x50)); - *(undefined8 *)(puVar12 + -8) = 0x140012d5c; - ExFreePoolWithTag(*(undefined8 *)(puVar12 + 0x50),0); - puVar11 = puVar12; + *(undefined8 *)(puVar11 + -8) = 0x140012efc; + BfsFreeDirectoryBlockList(*(longlong **)(puVar11 + 0x50)); + *(undefined8 *)(puVar11 + -8) = 0x140012f0a; + ExFreePoolWithTag(*(undefined8 *)(puVar11 + 0x50),0); + puVar12 = puVar11; LAB_0: - *(undefined8 *)(puVar11 + -8) = 0x140012d6f; + *(undefined8 *)(puVar12 + -8) = 0x140012f1d; return uVar4; } ``` ## BfsGetPolicyEntryLocked ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.56| |i_ratio|0.63| |m_ratio|0.96| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsGetPolicyEntryLocked|BfsGetPolicyEntryLocked| |fullname|BfsGetPolicyEntryLocked|BfsGetPolicyEntryLocked| |refcount|2|2| |`length`|564|600| |`called`|
Expand for full list:
BfsDereferencePolicyEntryEx
BfsFinalHash
BfsInsertPolicyEntryLocked
BfsLookupPolicyEntryHashTable
BfsUpdateHash
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlLengthSid
__security_check_cookie_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsDereferencePolicyEntryEx
BfsFinalHash
BfsInsertPolicyEntryLocked
BfsLookupPolicyEntryHashTable
BfsUpdateHash
Feature_241429816__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeWaitForSingleObject
NTOSKRNL.EXE::RtlLengthSid__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|BfsGetRegistryPrefix|BfsGetRegistryPrefix| |paramcount|7|7| |`address`|140007b40|140007e4c| |sig|undefined __fastcall BfsGetPolicyEntryLocked(undefined8 * param_1, undefined8 param_2, longlong param_3, byte * param_4, byte * param_5, int * param_6, longlong * param_7)|undefined __fastcall BfsGetPolicyEntryLocked(undefined8 * param_1, undefined8 param_2, longlong param_3, byte * param_4, byte * param_5, int * param_6, longlong * param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsGetPolicyEntryLocked Called Diff ```diff --- BfsGetPolicyEntryLocked called +++ BfsGetPolicyEntryLocked called @@ -5,0 +6 @@ +Feature_241429816__private_IsEnabledDeviceUsageNoInline ``` ### BfsGetPolicyEntryLocked Diff ```diff --- BfsGetPolicyEntryLocked +++ BfsGetPolicyEntryLocked @@ -1,94 +1,101 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void BfsGetPolicyEntryLocked (undefined8 *param_1,undefined8 param_2,longlong param_3,byte *param_4,byte *param_5, int *param_6,longlong *param_7) { uint uVar1; int extraout_EAX; undefined8 uVar2; longlong lVar3; - undefined8 uVar4; - char cVar5; + ulonglong uVar4; + undefined8 uVar5; + char cVar6; + undefined8 uVar7; undefined1 auStackY_c8 [32]; longlong local_88; longlong local_80; - undefined8 *local_78; + longlong *local_78; longlong *local_50; undefined8 local_48; ulonglong local_40; local_40 = __security_cookie ^ (ulonglong)auStackY_c8; local_88 = 0; - local_78 = param_1; + local_78 = param_7; uVar1 = RtlLengthSid(param_4); BfsUpdateHash(param_4,uVar1,&local_88); uVar1 = RtlLengthSid(param_5); BfsUpdateHash(param_5,uVar1,&local_88); uVar2 = BfsFinalHash(&local_88); *param_7 = 0; - uVar4 = uVar2; - lVar3 = BfsLookupPolicyEntryHashTable(*(undefined8 *)(param_3 + 8),uVar2,param_4,param_5); + uVar5 = *(undefined8 *)(param_3 + 8); + uVar7 = uVar2; + lVar3 = BfsLookupPolicyEntryHashTable(uVar5,uVar2,param_4,param_5); local_80 = lVar3; if ((lVar3 == 0) || ((*(uint *)(lVar3 + 0x38) & 0x10000000) == 0)) { if (*param_6 == 1) { return; } BfsInsertPolicyEntryLocked - (local_78,uVar4,param_3,uVar2,(longlong)param_4,(longlong)param_5,param_6,&local_80); + (param_1,uVar7,param_3,uVar2,(longlong)param_4,(longlong)param_5,param_6,&local_80); if (extraout_EAX < 0) { return; } +LAB_0: + LOCK(); + *(undefined8 *)(local_80 + 0x60) = _DAT_1; + UNLOCK(); + *local_78 = local_80; } else { LOCK(); *(int *)(lVar3 + 0x98) = *(int *)(lVar3 + 0x98) + 1; UNLOCK(); if (*(int *)(lVar3 + 0x38) == 0x10000001) { if (*param_6 == 1) { ExReleasePushLockSharedEx(); } else { ExReleasePushLockExclusiveEx(param_3); } KeLeaveCriticalRegion(); *param_6 = 0; - uVar4 = *(undefined8 *)(lVar3 + 0x28); - KeWaitForSingleObject(uVar4,0,0,0); - if (*(int *)(lVar3 + 0x38) != 0x10000000) { - if (3 < DAT_0) { - local_50 = &local_88; - local_88 = CONCAT44(local_88._4_4_,0xc0000001); - local_48 = 4; - _tlgWriteTransfer_EtwWriteTransfer(uVar4,&DAT_1); + uVar5 = *(undefined8 *)(lVar3 + 0x28); + KeWaitForSingleObject(uVar5,0,0,0); + uVar4 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar4 != 0) || (*(int *)(lVar3 + 0x38) == 0x10000000)) goto LAB_2; + } + else { +LAB_2: + uVar4 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar4 == 0) || (*(int *)(lVar3 + 0x38) == 0x10000000)) goto LAB_0; + } + if (3 < DAT_3) { + local_88 = CONCAT44(local_88._4_4_,0xc0000001); + local_50 = &local_88; + local_48 = 4; + _tlgWriteTransfer_EtwWriteTransfer(uVar5,&DAT_4); + } + lVar3 = local_80; + if (local_80 != 0) { + if (*param_6 == 2) { + cVar6 = '\x01'; + } + else { + if (*param_6 == 1) { + ExReleasePushLockSharedEx(param_3); + KeLeaveCriticalRegion(); + *param_6 = 0; } - lVar3 = local_80; - if (local_80 == 0) { - return; - } - if (*param_6 == 2) { - cVar5 = '\x01'; - } - else { - if (*param_6 == 1) { - ExReleasePushLockSharedEx(param_3); - KeLeaveCriticalRegion(); - *param_6 = 0; - } - cVar5 = '\0'; - } - BfsDereferencePolicyEntryEx(lVar3,cVar5); - return; + cVar6 = '\0'; } + BfsDereferencePolicyEntryEx(lVar3,cVar6); } } - LOCK(); - *(undefined8 *)(local_80 + 0x60) = _DAT_2; - UNLOCK(); - *param_7 = local_80; return; } ``` ## BfsGetRegistryPrefix ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.93| |i_ratio|0.67| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsGetRegistryPrefix|BfsGetRegistryPrefix| |fullname|BfsGetRegistryPrefix|BfsGetRegistryPrefix| |refcount|3|3| |`length`|876|867| |`called`|
Expand for full list:
BfsCalculateRegistryPrefix
BfsDereferencePolicyEntryEx
BfsGetNotPresentPolicyEntryLocked
BfsGetPolicyEntryLocked
BfsPolicyEntryExistsLocked
Feature_1777540409__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeStringNTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlQueryPackageIdentity
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
|
Expand for full list:
BfsCalculateRegistryPrefix
BfsDereferencePolicyEntryEx
BfsGetNotPresentPolicyEntryLocked
BfsGetPolicyEntryLocked
BfsPolicyEntryExistsLocked
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeStringNTOSKRNL.EXE::RtlQueryPackageIdentity
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
| |calling|BfsRegistryPreCreateCallback|BfsRegistryPreCreateCallback| |paramcount|4|4| |`address`|14001075c|140010dac| |sig|ulonglong __fastcall BfsGetRegistryPrefix(ushort * param_1, undefined8 * param_2, undefined8 * param_3, int * param_4)|ulonglong __fastcall BfsGetRegistryPrefix(ushort * param_1, undefined8 * param_2, undefined8 * param_3, int * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsGetRegistryPrefix Called Diff ```diff --- BfsGetRegistryPrefix called +++ BfsGetRegistryPrefix called @@ -6 +5,0 @@ -Feature_1777540409__private_IsEnabledDeviceUsageNoInline ``` ### BfsGetRegistryPrefix Diff ```diff --- BfsGetRegistryPrefix +++ BfsGetRegistryPrefix @@ -1,165 +1,164 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong BfsGetRegistryPrefix(ushort *param_1,undefined8 *param_2,undefined8 *param_3,int *param_4) { short *psVar1; uint uVar2; uint uVar3; ulonglong uVar4; ulonglong uVar5; ushort *puVar6; char cVar7; undefined8 uVar8; longlong lVar9; undefined1 auStackY_218 [32]; uint local_1d8 [2]; longlong local_1d0; undefined8 *local_1c8; undefined8 *local_1c0; undefined8 local_1b8; undefined8 local_1b0; undefined8 uStack_1a8; undefined8 local_1a0; undefined8 uStack_198; uint *local_170; undefined8 local_168; undefined1 local_158 [256]; ulonglong local_58; local_58 = __security_cookie ^ (ulonglong)auStackY_218; lVar9 = 0; local_1c0 = (undefined8 *)0x0; local_1a0 = 0; uStack_198 = 0; memset(local_158,0,0x100); local_1b8 = 0x100; local_1d0 = 0; local_1c8 = (undefined8 *)0x0; local_1b0 = 0; uStack_1a8 = 0; puVar6 = param_1; uVar2 = SeQueryInformationToken(param_1,1,&local_1c8); uVar4 = (ulonglong)uVar2; uVar3 = local_1d8[0]; if ((int)uVar2 < 0) { -joined_r0x0001400109ca: +joined_r0x000140011011: local_1d8[0] = uVar2; - if (DAT_1 < 4) goto LAB_140010a1e; + if (DAT_1 < 4) goto LAB_140011065; } else { uVar8 = 0x1f; puVar6 = param_1; uVar2 = SeQueryInformationToken(param_1,0x1f,&local_1c0); uVar4 = (ulonglong)uVar2; uVar3 = local_1d8[0]; - if ((int)uVar2 < 0) goto joined_r0x0001400109ca; + if ((int)uVar2 < 0) goto joined_r0x000140011011; puVar6 = gBfsFilterHandle; uVar4 = BfsPolicyEntryExistsLocked - (gBfsFilterHandle,uVar8,0x14001b2b0,(byte *)*local_1c8,(byte *)*local_1c0, + (gBfsFilterHandle,uVar8,0x14001b2d0,(byte *)*local_1c8,(byte *)*local_1c0, *param_4); uVar2 = (uint)uVar4; uVar4 = uVar4 & 0xffffffff; if (uVar2 == 0) { puVar6 = gBfsFilterHandle; uVar5 = BfsGetPolicyEntryLocked - ((undefined8 *)gBfsFilterHandle,uVar8,0x14001b2b0,(byte *)*local_1c8, + ((undefined8 *)gBfsFilterHandle,uVar8,0x14001b2d0,(byte *)*local_1c8, (byte *)*local_1c0,param_4,&local_1d0); LAB_2: uVar4 = uVar5 & 0xffffffff; lVar9 = local_1d0; if ((int)(uint)uVar5 < 0) { uVar3 = local_1d8[0]; if (3 < DAT_1) { local_170 = local_1d8; local_168 = 4; local_1d8[0] = (uint)uVar5; _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_3); lVar9 = local_1d0; uVar3 = local_1d8[0]; } goto LAB_0; } } else { if (uVar2 == 0xc0000225) { puVar6 = (ushort *)&gBfsPolicyTable; uVar5 = BfsGetNotPresentPolicyEntryLocked - (0x14001b2b0,(byte *)*local_1c8,(byte *)*local_1c0,&local_1d0); + (0x14001b2d0,(byte *)*local_1c8,(byte *)*local_1c0,&local_1d0); goto LAB_2; } uVar3 = local_1d8[0]; - if ((int)uVar2 < 0) goto joined_r0x0001400109ca; + if ((int)uVar2 < 0) goto joined_r0x000140011011; } psVar1 = (short *)(lVar9 + 0x70); if ((*psVar1 != 0) && (*(short *)(lVar9 + 0x80) != 0)) { LAB_4: uVar8 = *(undefined8 *)(lVar9 + 0x78); *param_2 = *(undefined8 *)psVar1; param_2[1] = uVar8; uVar8 = *(undefined8 *)(lVar9 + 0x88); *param_3 = *(undefined8 *)(lVar9 + 0x80); param_3[1] = uVar8; uVar3 = local_1d8[0]; goto LAB_0; } - uVar4 = Feature_1777540409__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar4 == 0) || (*param_4 == 2)) { + if (*param_4 == 2) { puVar6 = (ushort *)&local_1b0; uVar3 = RtlConvertSidToUnicodeString(puVar6,*local_1c8,1); uVar4 = (ulonglong)uVar3; if (-1 < (int)uVar3) { uVar2 = RtlQueryPackageIdentity(param_1,local_158,&local_1b8,0); uVar4 = (ulonglong)uVar2; puVar6 = param_1; uVar3 = local_1d8[0]; if (-1 < (int)uVar2) { RtlInitUnicodeString(&local_1a0,local_158); puVar6 = (ushort *)&local_1b0; uVar2 = BfsCalculateRegistryPrefix (puVar6,(ushort *)&local_1a0,(PUCHAR)psVar1,(PUCHAR)(lVar9 + 0x80)); uVar4 = (ulonglong)uVar2; uVar3 = local_1d8[0]; if (-1 < (int)uVar2) goto LAB_4; } - goto joined_r0x0001400109ca; + goto joined_r0x000140011011; } } else { uVar4 = 0xc000022d; } uVar3 = local_1d8[0]; - if (DAT_1 < 4) goto LAB_140010a1e; + if (DAT_1 < 4) goto LAB_140011065; local_1d8[0] = (uint)uVar4; } local_170 = local_1d8; local_168 = 4; _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_3); uVar3 = local_1d8[0]; LAB_0: local_1d8[0] = uVar3; RtlFreeUnicodeString(&local_1b0); if (local_1c8 != (undefined8 *)0x0) { ExFreePoolWithTag(); } if (local_1c0 != (undefined8 *)0x0) { ExFreePoolWithTag(); } if (lVar9 != 0) { if (*param_4 == 2) { cVar7 = '\x01'; } else { if (*param_4 == 1) { ExReleasePushLockSharedEx(&gBfsPolicyTable); KeLeaveCriticalRegion(); *param_4 = 0; } cVar7 = '\0'; } BfsDereferencePolicyEntryEx(lVar9,cVar7); } return uVar4; } ``` ## BfsGetNotPresentPolicyEntry ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.79| |i_ratio|0.76| |m_ratio|0.91| |b_ratio|0.85| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsGetNotPresentPolicyEntry|BfsGetNotPresentPolicyEntry| |fullname|BfsGetNotPresentPolicyEntry|BfsGetNotPresentPolicyEntry| |`refcount`|3|2| |`length`|246|297| |`called`|BfsFinalHash
BfsLookupPolicyEntryHashTable
BfsUpdateHash
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlLengthSid|BfsFinalHash
BfsLookupPolicyEntryHashTable
BfsUpdateHash
Feature_241429816__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlLengthSid| |`calling`|BfsCheckAndApplyPolicy
BfsGetRegistryPrefixEx|BfsCheckAndApplyPolicy| |paramcount|4|4| |`address`|140007468|1400076f8| |sig|undefined8 __fastcall BfsGetNotPresentPolicyEntry(longlong param_1, byte * param_2, byte * param_3, longlong * param_4)|undefined8 __fastcall BfsGetNotPresentPolicyEntry(longlong param_1, byte * param_2, byte * param_3, longlong * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsGetNotPresentPolicyEntry Called Diff ```diff --- BfsGetNotPresentPolicyEntry called +++ BfsGetNotPresentPolicyEntry called @@ -3,0 +4 @@ +Feature_241429816__private_IsEnabledDeviceUsageNoInline ``` ### BfsGetNotPresentPolicyEntry Calling Diff ```diff --- BfsGetNotPresentPolicyEntry calling +++ BfsGetNotPresentPolicyEntry calling @@ -2 +1,0 @@ -BfsGetRegistryPrefixEx ``` ### BfsGetNotPresentPolicyEntry Diff ```diff --- BfsGetNotPresentPolicyEntry +++ BfsGetNotPresentPolicyEntry @@ -1,36 +1,43 @@ undefined8 BfsGetNotPresentPolicyEntry(longlong param_1,byte *param_2,byte *param_3,longlong *param_4) { uint uVar1; undefined8 uVar2; longlong lVar3; - undefined8 uVar4; + ulonglong uVar4; + undefined8 uVar5; longlong local_res8; - uVar4 = 0; + uVar5 = 0; local_res8 = 0; uVar1 = RtlLengthSid(param_2); BfsUpdateHash(param_2,uVar1,&local_res8); uVar1 = RtlLengthSid(param_3); BfsUpdateHash(param_3,uVar1,&local_res8); uVar2 = BfsFinalHash(&local_res8); *param_4 = 0; KeEnterCriticalRegion(); ExAcquirePushLockSharedEx(param_1,0); lVar3 = BfsLookupPolicyEntryHashTable(*(undefined8 *)(param_1 + 8),uVar2,param_2,param_3); if (lVar3 == 0) { - uVar4 = 0xc0190021; + uVar5 = 0xc0190021; } else { + uVar4 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar4 != 0) && (*(int *)(lVar3 + 0x38) != 2)) { + ExReleasePushLockSharedEx(param_1,0); + KeLeaveCriticalRegion(); + return 0xc0190021; + } LOCK(); *(int *)(lVar3 + 0x98) = *(int *)(lVar3 + 0x98) + 1; UNLOCK(); } ExReleasePushLockSharedEx(param_1,0); KeLeaveCriticalRegion(); *param_4 = lVar3; - return uVar4; + return uVar5; } ``` ## BfsCreatePolicyStorageDescriptor ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.39| |i_ratio|0.51| |m_ratio|0.99| |b_ratio|0.47| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsCreatePolicyStorageDescriptor|BfsCreatePolicyStorageDescriptor| |fullname|BfsCreatePolicyStorageDescriptor|BfsCreatePolicyStorageDescriptor| |refcount|3|3| |`length`|862|870| |`called`|
Expand for full list:
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlAddAccessAllowedAceEx
NTOSKRNL.EXE::RtlAddMandatoryAce
NTOSKRNL.EXE::RtlCreateAcl
NTOSKRNL.EXE::RtlCreateSecurityDescriptor
NTOSKRNL.EXE::RtlLengthSid
NTOSKRNL.EXE::RtlSetControlSecurityDescriptor
NTOSKRNL.EXE::RtlSetDaclSecurityDescriptor
NTOSKRNL.EXE::RtlSetGroupSecurityDescriptorNTOSKRNL.EXE::RtlSetOwnerSecurityDescriptor
NTOSKRNL.EXE::RtlSetSaclSecurityDescriptor
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
Feature_217306426__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlAddAccessAllowedAceEx
NTOSKRNL.EXE::RtlAddMandatoryAce
NTOSKRNL.EXE::RtlCreateAcl
NTOSKRNL.EXE::RtlCreateSecurityDescriptor
NTOSKRNL.EXE::RtlLengthSid
NTOSKRNL.EXE::RtlSetControlSecurityDescriptor
NTOSKRNL.EXE::RtlSetDaclSecurityDescriptorNTOSKRNL.EXE::RtlSetGroupSecurityDescriptor
NTOSKRNL.EXE::RtlSetOwnerSecurityDescriptor
NTOSKRNL.EXE::RtlSetSaclSecurityDescriptor
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling|DriverEntry|DriverEntry| |paramcount|2|2| |`address`|1400152b8|140015910| |sig|uint __fastcall BfsCreatePolicyStorageDescriptor(undefined8 * param_1, undefined1 param_2)|uint __fastcall BfsCreatePolicyStorageDescriptor(undefined8 * param_1, undefined1 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsCreatePolicyStorageDescriptor Called Diff ```diff --- BfsCreatePolicyStorageDescriptor called +++ BfsCreatePolicyStorageDescriptor called @@ -0,0 +1 @@ +Feature_217306426__private_IsEnabledDeviceUsageNoInline ``` ### BfsCreatePolicyStorageDescriptor Diff ```diff --- BfsCreatePolicyStorageDescriptor +++ BfsCreatePolicyStorageDescriptor @@ -1,118 +1,116 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ uint BfsCreatePolicyStorageDescriptor(undefined8 *param_1,undefined1 param_2) { uint uVar1; int iVar2; int iVar3; undefined8 *puVar4; - undefined8 *puVar5; - ulonglong uVar6; + ulonglong uVar5; + undefined8 *puVar6; undefined8 *puVar7; undefined8 *puVar8; undefined8 *puVar9; undefined1 auStack_a8 [32]; undefined8 local_88; undefined1 *local_80; uint local_78 [2]; undefined1 local_70 [32]; uint *local_50; undefined8 local_48; ulonglong local_40; local_40 = __security_cookie ^ (ulonglong)auStack_a8; - puVar5 = (undefined8 *)0x0; + puVar4 = (undefined8 *)0x0; puVar8 = (undefined8 *)0x0; - puVar7 = param_1; + puVar6 = param_1; uVar1 = RtlCreateSecurityDescriptor(param_1,1); - puVar4 = puVar5; - puVar9 = puVar5; + puVar7 = puVar4; + puVar9 = puVar4; if ((((int)uVar1 < 0) || - (puVar7 = param_1, + (puVar6 = param_1, uVar1 = RtlSetOwnerSecurityDescriptor (param_1,*(undefined8 *)(*(longlong *)SeExports_exref + 0x108),0), - puVar4 = (undefined8 *)0x0, puVar9 = puVar8, (int)uVar1 < 0)) || - (puVar7 = param_1, + puVar7 = (undefined8 *)0x0, puVar9 = puVar8, (int)uVar1 < 0)) || + (puVar6 = param_1, uVar1 = RtlSetGroupSecurityDescriptor (param_1,*(undefined8 *)(*(longlong *)SeExports_exref + 0x108),0), - (int)uVar1 < 0)) { -LAB_0: - if (DAT_2 < 4) goto LAB_1400155ab; - } - else { - iVar2 = RtlLengthSid(*(undefined8 *)(*(longlong *)SeExports_exref + 0x220)); - iVar3 = RtlLengthSid(*(undefined8 *)(*(longlong *)SeExports_exref + 0x108)); - iVar2 = iVar2 + iVar3 + 0x18; - puVar4 = (undefined8 *)ExAllocatePool2(0x100,iVar2,0x41736642); + (int)uVar1 < 0)) goto LAB_0; + iVar2 = RtlLengthSid(*(undefined8 *)(*(longlong *)SeExports_exref + 0x220)); + iVar3 = RtlLengthSid(*(undefined8 *)(*(longlong *)SeExports_exref + 0x108)); + puVar6 = (undefined8 *)0x100; + iVar2 = iVar2 + iVar3 + 0x18; + puVar8 = (undefined8 *)ExAllocatePool2(0x100,iVar2,0x41736642); + puVar7 = puVar8; + if (puVar8 != (undefined8 *)0x0) { + puVar6 = param_1; + uVar1 = RtlSetControlSecurityDescriptor(param_1,0x3000,0x3000); + if (((int)uVar1 < 0) || (puVar6 = puVar8, uVar1 = RtlCreateAcl(puVar8,iVar2,2), (int)uVar1 < 0)) + goto LAB_0; + local_88 = *(undefined8 *)(*(longlong *)SeExports_exref + 0x220); + puVar6 = puVar8; + uVar1 = RtlAddAccessAllowedAceEx(puVar8,*(undefined1 *)puVar8,param_2,0x1f01ff); + if ((int)uVar1 < 0) goto LAB_0; + local_88 = *(undefined8 *)(*(longlong *)SeExports_exref + 0x108); + puVar6 = puVar8; + uVar1 = RtlAddAccessAllowedAceEx(puVar8,*(undefined1 *)puVar8,param_2,0x1f01ff); + if (((int)uVar1 < 0) || + (puVar6 = param_1, uVar1 = RtlSetDaclSecurityDescriptor(param_1,1,puVar8,0), (int)uVar1 < 0)) + goto LAB_0; + uVar5 = Feature_217306426__private_IsEnabledDeviceUsageNoInline(); + puVar7 = puVar4; + if ((int)uVar5 == 0) { + puVar7 = puVar8; + } + iVar2 = RtlLengthSid(*(undefined8 *)(*(longlong *)SeExports_exref + 0x1f0)); + puVar6 = (undefined8 *)0x100; + puVar4 = (undefined8 *)ExAllocatePool2(0x100,iVar2 + 0x10,0x41736642); if (puVar4 != (undefined8 *)0x0) { - puVar7 = param_1; - uVar1 = RtlSetControlSecurityDescriptor(param_1,0x3000,0x3000); - if ((-1 < (int)uVar1) && - (puVar7 = puVar4, uVar1 = RtlCreateAcl(puVar4,iVar2,2), -1 < (int)uVar1)) { - local_88 = *(undefined8 *)(*(longlong *)SeExports_exref + 0x220); - puVar7 = puVar4; - uVar1 = RtlAddAccessAllowedAceEx(puVar4,*(undefined1 *)puVar4,param_2,0x1f01ff); - if (-1 < (int)uVar1) { - local_88 = *(undefined8 *)(*(longlong *)SeExports_exref + 0x108); - puVar7 = puVar4; - uVar1 = RtlAddAccessAllowedAceEx(puVar4,*(undefined1 *)puVar4,param_2,0x1f01ff); - if ((-1 < (int)uVar1) && - (puVar7 = param_1, uVar1 = RtlSetDaclSecurityDescriptor(param_1,1,puVar4,0), - -1 < (int)uVar1)) { - iVar2 = RtlLengthSid(*(undefined8 *)(*(longlong *)SeExports_exref + 0x1f0)); - puVar5 = (undefined8 *)ExAllocatePool2(0x100,iVar2 + 0x10,0x41736642); - if (puVar5 == (undefined8 *)0x0) goto LAB_3; - puVar7 = puVar5; - uVar1 = RtlCreateAcl(puVar5,iVar2 + 0x10,2); - puVar9 = puVar5; - if (-1 < (int)uVar1) { - local_80 = (undefined1 *)CONCAT44(local_80._4_4_,7); - local_88 = CONCAT71(local_88._1_7_,0x11); - puVar7 = puVar5; - uVar1 = RtlAddMandatoryAce(puVar5,2,param_2, - *(undefined8 *)(*(longlong *)SeExports_exref + 0x1f0)); - if ((-1 < (int)uVar1) && - (puVar7 = param_1, uVar1 = RtlSetSaclSecurityDescriptor(param_1,1,puVar5,0), - -1 < (int)uVar1)) { - return uVar1; - } - } - } + puVar6 = puVar4; + uVar1 = RtlCreateAcl(puVar4,iVar2 + 0x10,2); + puVar9 = puVar4; + if (-1 < (int)uVar1) { + local_80 = (undefined1 *)CONCAT44(local_80._4_4_,7); + local_88 = CONCAT71(local_88._1_7_,0x11); + puVar6 = puVar4; + uVar1 = RtlAddMandatoryAce(puVar4,2,param_2, + *(undefined8 *)(*(longlong *)SeExports_exref + 0x1f0)); + if ((-1 < (int)uVar1) && + (puVar6 = param_1, uVar1 = RtlSetSaclSecurityDescriptor(param_1,1,puVar4,0), + -1 < (int)uVar1)) { + Feature_217306426__private_IsEnabledDeviceUsageNoInline(); + return uVar1; } } goto LAB_0; } -LAB_3: - puVar7 = (undefined8 *)0xc0000017; - uVar1 = 0xc0000017; - puVar9 = puVar5; - if (DAT_2 < 4) goto LAB_1400155ab; - local_78[0] = 0xc0000017; - uVar1 = local_78[0]; } - local_78[0] = uVar1; - uVar1 = local_78[0]; - local_50 = local_78; - local_48 = 4; - local_80 = local_70; - _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_4); -LAB_1: - uVar6 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar6 != 0) { + uVar1 = 0xc0000017; + puVar9 = puVar4; +LAB_0: + if (3 < DAT_1) { + local_50 = local_78; + local_48 = 4; + local_80 = local_70; + local_78[0] = uVar1; + _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_2); + } + uVar5 = Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 != 0) { *param_1 = 0; param_1[1] = 0; param_1[2] = 0; param_1[3] = 0; param_1[4] = 0; } - if (puVar4 != (undefined8 *)0x0) { - ExFreePoolWithTag(puVar4,0); + if (puVar7 != (undefined8 *)0x0) { + ExFreePoolWithTag(puVar7,0); } if (puVar9 != (undefined8 *)0x0) { ExFreePoolWithTag(puVar9,0); } return uVar1; } ``` ## BfsPostCreatePipeOperation ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.87| |i_ratio|0.77| |m_ratio|0.98| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsPostCreatePipeOperation|BfsPostCreatePipeOperation| |fullname|BfsPostCreatePipeOperation|BfsPostCreatePipeOperation| |refcount|4|4| |`length`|686|668| |`called`|
Expand for full list:
BfsInsertNamedPipeMapping
BfsReleaseNamedPipeMapping
FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltCancelFileOpen
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetCallbackDataDirty
FLTMGR.SYS::FltSetStreamHandleContext
Feature_1199833401__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtectionNTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
BfsInsertNamedPipeMapping
BfsReleaseNamedPipeMapping
FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltCancelFileOpen
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltSetCallbackDataDirty
FLTMGR.SYS::FltSetStreamHandleContext
Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegionNTOSKRNL.EXE::KeLeaveCriticalRegion
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |calling||| |paramcount|3|3| |`address`|140003ef0|140003d30| |sig|undefined8 __fastcall BfsPostCreatePipeOperation(undefined * param_1, longlong param_2, undefined8 * param_3)|undefined8 __fastcall BfsPostCreatePipeOperation(undefined * param_1, longlong param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsPostCreatePipeOperation Called Diff ```diff --- BfsPostCreatePipeOperation called +++ BfsPostCreatePipeOperation called @@ -8 +7,0 @@ -Feature_1199833401__private_IsEnabledDeviceUsageNoInline ``` ### BfsPostCreatePipeOperation Diff ```diff --- BfsPostCreatePipeOperation +++ BfsPostCreatePipeOperation @@ -1,114 +1,108 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined8 BfsPostCreatePipeOperation(undefined *param_1,longlong param_2,undefined8 *param_3) { bool bVar1; bool bVar2; int extraout_EAX; int iVar3; ulonglong uVar4; undefined *puVar5; uint uVar6; undefined1 auStackY_c8 [32]; char local_88 [4]; int local_84; undefined4 *local_80; longlong local_78; longlong local_70; int *local_48; undefined4 local_40; undefined4 local_3c; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStackY_c8; local_70 = 0; bVar1 = false; local_78 = 0; local_80 = (undefined4 *)0x0; iVar3 = *(int *)(param_1 + 0x18); local_88[0] = '\0'; if (iVar3 < 0) { puVar5 = param_1; bVar2 = false; - if (DAT_1 < 4) goto LAB_140004090; + if (DAT_1 < 4) goto LAB_140003ed0; LAB_2: bVar1 = bVar2; local_48 = &local_84; local_3c = 0; local_40 = 4; local_84 = iVar3; _tlgWriteTransfer_EtwWriteTransfer(puVar5,&DAT_3); } else { if (param_3 == (undefined8 *)0x0) { return 0; } bVar1 = true; puVar5 = &gBfsPipeMappingTable; uVar6 = BfsInsertNamedPipeMapping - (0x14001b2a0,(byte *)*param_3,(byte *)param_3[1],(ushort *)(param_3 + 2), + (0x14001b2c0,(byte *)*param_3,(byte *)param_3[1],(ushort *)(param_3 + 2), param_3 + 4,local_88,&local_78); param_3 = (undefined8 *)CONCAT44((int)((ulonglong)param_3 >> 0x20),uVar6); iVar3 = extraout_EAX; if (extraout_EAX < 0) { -joined_r0x00014000404e: +joined_r0x000140003e8e: bVar2 = true; - if (3 < DAT_1) goto LAB_140004064; + if (3 < DAT_1) goto LAB_140003ea4; } else { puVar5 = *(undefined **)(param_2 + 8); iVar3 = FltAllocateContext(puVar5,0x10,0x10,1); - if (iVar3 < 0) goto joined_r0x00014000404e; + if (iVar3 < 0) goto joined_r0x000140003e8e; *local_80 = 1; *(longlong *)(local_80 + 2) = local_78; puVar5 = *(undefined **)(param_2 + 0x18); iVar3 = FltSetStreamHandleContext(puVar5,*(undefined8 *)(param_2 + 0x20),0,local_80); uVar4 = Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline(); if ((int)uVar4 == 0) { - if (iVar3 < 0) goto joined_r0x00014000404e; + if (iVar3 < 0) goto joined_r0x000140003e8e; } else { - if (iVar3 < 0) goto joined_r0x00014000404e; + if (iVar3 < 0) goto joined_r0x000140003e8e; if (local_70 != 0) { FltReleaseContext(); } } } } if (local_80 != (undefined4 *)0x0) { FltReleaseContext(); } LAB_0: if (param_3 != (undefined8 *)0x0) { if (local_88[0] == '\0') { ExFreePoolWithTag(*param_3,0); ExFreePoolWithTag(param_3[1],0); ExFreePoolWithTag(param_3[3],0); ExFreePoolWithTag(param_3[5],0); } ExFreePoolWithTag(param_3,0); - uVar4 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar4 != 0) { - uVar4 = Feature_1199833401__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar4 != 0) { - KeEnterCriticalRegion(); - } - ExReleaseRundownProtection(&gBfsRundownProtection); - KeLeaveCriticalRegion(); - } + KeEnterCriticalRegion(); + ExReleaseRundownProtection(&gBfsRundownProtection); + KeLeaveCriticalRegion(); } if (iVar3 < 0) { if (local_78 != 0) { - BfsReleaseNamedPipeMapping(0x14001b2a0,local_78); + BfsReleaseNamedPipeMapping(0x14001b2c0,local_78); } if (bVar1) { *(int *)(param_1 + 0x18) = iVar3; FltSetCallbackDataDirty(param_1); FltCancelFileOpen(*(undefined8 *)(param_2 + 0x18),*(undefined8 *)(param_2 + 0x20)); } } return 0; } ``` ## BfsInsertDirectory ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.28| |i_ratio|0.55| |m_ratio|0.92| |b_ratio|0.83| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsInsertDirectory|BfsInsertDirectory| |fullname|BfsInsertDirectory|BfsInsertDirectory| |refcount|2|2| |`length`|649|548| |`called`|
Expand for full list:
BfsDereferenceTableEntry
Feature_3498538297__private_IsEnabledDeviceUsageNoInline
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlCopyUnicodeStringNTOSKRNL.EXE::RtlInsertElementGenericTableAvl
__security_check_cookie
memset
|BfsDereferenceTableEntry
Feature_241429816__private_IsEnabledDeviceUsageNoInline
Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlInsertElementGenericTableAvl
__security_check_cookie
memset| |calling|BfsCreateDirectory|BfsCreateDirectory| |paramcount|4|4| |`address`|140013f90|140014140| |sig|undefined8 __fastcall BfsInsertDirectory(longlong param_1, longlong param_2, longlong * param_3, char * param_4)|undefined8 __fastcall BfsInsertDirectory(longlong param_1, longlong param_2, longlong * param_3, char * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsInsertDirectory Called Diff ```diff --- BfsInsertDirectory called +++ BfsInsertDirectory called @@ -2 +2 @@ -Feature_3498538297__private_IsEnabledDeviceUsageNoInline +Feature_241429816__private_IsEnabledDeviceUsageNoInline @@ -5 +4,0 @@ -NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx @@ -8,3 +6,0 @@ -NTOSKRNL.EXE::ExReleasePushLockExclusiveEx -NTOSKRNL.EXE::KeEnterCriticalRegion -NTOSKRNL.EXE::KeLeaveCriticalRegion ``` ### BfsInsertDirectory Diff ```diff --- BfsInsertDirectory +++ BfsInsertDirectory @@ -1,116 +1,111 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined8 BfsInsertDirectory(longlong param_1,longlong param_2,longlong *param_3,char *param_4) { undefined8 *puVar1; longlong lVar2; ulonglong uVar3; - bool bVar4; undefined1 auStack_108 [32]; longlong local_e8; undefined8 local_e0; undefined8 uStack_d8; undefined8 local_d0; undefined8 uStack_c8; undefined8 local_c0; undefined8 uStack_b8; undefined8 local_b0; undefined8 uStack_a8; undefined8 local_a0; undefined8 uStack_98; - undefined8 local_90; - undefined8 uStack_88; + undefined4 local_90; + undefined4 uStack_8c; + undefined4 uStack_88; + undefined4 uStack_84; undefined8 local_80; undefined8 uStack_78; - undefined8 uStack_70; - undefined8 uStack_68; + undefined4 uStack_70; + undefined4 uStack_6c; + undefined4 uStack_68; + undefined4 uStack_64; undefined8 uStack_60; longlong local_58; int local_50; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStack_108; memset(&local_e0,0,0x98); local_e8 = ExAllocatePool2(0x100,0x10,0x4e736642); - if (local_e8 != 0) { - lVar2 = ExAllocatePool2(0x100,*(undefined2 *)(param_2 + 2),0x4e736642); - if (lVar2 == 0) { - ExFreePoolWithTag(local_e8,0); + if (local_e8 == 0) { + return 0xc0000017; + } + lVar2 = ExAllocatePool2(0x100,*(undefined2 *)(param_2 + 2),0x4e736642); + if (lVar2 == 0) { + ExFreePoolWithTag(local_e8,0); + return 0xc0000017; + } + *(longlong *)(local_e8 + 8) = lVar2; + *(undefined2 *)(local_e8 + 2) = *(undefined2 *)(param_2 + 2); + RtlCopyUnicodeString(local_e8,param_2); + local_58 = param_1 + -0x18; + LOCK(); + *(int *)(param_1 + 0x78) = *(int *)(param_1 + 0x78) + 1; + UNLOCK(); + LOCK(); + local_50 = local_50 + 1; + UNLOCK(); + puVar1 = (undefined8 *)*param_3; + local_e0 = *puVar1; + uStack_d8 = puVar1[1]; + local_d0 = puVar1[2]; + uStack_c8 = puVar1[3]; + local_c0 = puVar1[4]; + uStack_b8 = puVar1[5]; + local_b0 = puVar1[6]; + uStack_a8 = puVar1[7]; + local_a0 = puVar1[8]; + uStack_98 = puVar1[9]; + local_90 = *(undefined4 *)(puVar1 + 10); + uStack_8c = *(undefined4 *)((longlong)puVar1 + 0x54); + uStack_88 = *(undefined4 *)(puVar1 + 0xb); + uStack_84 = *(undefined4 *)((longlong)puVar1 + 0x5c); + local_80 = puVar1[0xc]; + uStack_78 = puVar1[0xd]; + uStack_70 = *(undefined4 *)(puVar1 + 0xe); + uStack_6c = *(undefined4 *)((longlong)puVar1 + 0x74); + uStack_68 = *(undefined4 *)(puVar1 + 0xf); + uStack_64 = *(undefined4 *)((longlong)puVar1 + 0x7c); + uStack_60 = puVar1[0x10]; + lVar2 = RtlInsertElementGenericTableAvl(param_1 + 8,&local_e8,0xa0,param_4); + uVar3 = Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar3 != 0) && (lVar2 == 0)) { + ExFreePoolWithTag(*(undefined8 *)(local_e8 + 8),0); + ExFreePoolWithTag(local_e8,0); + BfsDereferenceTableEntry((undefined8 *)(param_1 + -0x20)); + return 0xc0000017; + } + *param_3 = lVar2 + 8; + uVar3 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 == 0) { + if (param_4 == (char *)0x0) goto LAB_0; + } + else if (*param_4 == '\0') { + uVar3 = Feature_241429816__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 != 0) { + LOCK(); + *(int *)(lVar2 + 0x98) = *(int *)(lVar2 + 0x98) + 1; + UNLOCK(); } - else { - *(longlong *)(local_e8 + 8) = lVar2; - *(undefined2 *)(local_e8 + 2) = *(undefined2 *)(param_2 + 2); - RtlCopyUnicodeString(local_e8,param_2); - local_58 = param_1 + -0x18; - LOCK(); - *(int *)(param_1 + 0x78) = *(int *)(param_1 + 0x78) + 1; - UNLOCK(); - LOCK(); - local_50 = local_50 + 1; - UNLOCK(); - puVar1 = (undefined8 *)*param_3; - local_e0 = *puVar1; - uStack_d8 = puVar1[1]; - local_d0 = puVar1[2]; - uStack_c8 = puVar1[3]; - local_c0 = puVar1[4]; - uStack_b8 = puVar1[5]; - local_b0 = puVar1[6]; - uStack_a8 = puVar1[7]; - local_a0 = puVar1[8]; - uStack_98 = puVar1[9]; - local_90 = puVar1[10]; - uStack_88 = puVar1[0xb]; - local_80 = puVar1[0xc]; - uStack_78 = puVar1[0xd]; - uStack_70 = puVar1[0xe]; - uStack_68 = puVar1[0xf]; - uStack_60 = puVar1[0x10]; - uVar3 = Feature_3498538297__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 == 0) { - KeEnterCriticalRegion(); - ExAcquirePushLockExclusiveEx(param_1,0); - } - lVar2 = RtlInsertElementGenericTableAvl(param_1 + 8,&local_e8,0xa0,param_4); - uVar3 = Feature_3498538297__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 == 0) { - ExReleasePushLockExclusiveEx(param_1,0); - KeLeaveCriticalRegion(); - } - uVar3 = Feature_BfsFixBundle2__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar3 == 0) || (lVar2 != 0)) { - *param_3 = lVar2 + 8; - uVar3 = Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 == 0) { - bVar4 = param_4 == (char *)0x0; - } - else { - bVar4 = *param_4 == '\0'; - } - if (bVar4) { - ExFreePoolWithTag(*(undefined8 *)(local_e8 + 8),0); - ExFreePoolWithTag(local_e8,0); - BfsDereferenceTableEntry((undefined8 *)(param_1 + -0x20)); - } - else { - LOCK(); - *(int *)(lVar2 + 0x98) = *(int *)(lVar2 + 0x98) + 1; - UNLOCK(); - } - return 0; - } - uVar3 = Feature_3498538297__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar3 == 0) { - ExReleasePushLockExclusiveEx(param_1,0); - KeLeaveCriticalRegion(); - } - ExFreePoolWithTag(*(undefined8 *)(local_e8 + 8),0); - ExFreePoolWithTag(local_e8,0); - BfsDereferenceTableEntry((undefined8 *)(param_1 + -0x20)); - } +LAB_0: + ExFreePoolWithTag(*(undefined8 *)(local_e8 + 8),0); + ExFreePoolWithTag(local_e8,0); + BfsDereferenceTableEntry((undefined8 *)(param_1 + -0x20)); + return 0; } - return 0xc0000017; + LOCK(); + *(int *)(lVar2 + 0x98) = *(int *)(lVar2 + 0x98) + 1; + UNLOCK(); + return 0; } ``` ## BfsGetRegistryPrefixEx ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,called| |ratio|0.13| |i_ratio|0.27| |m_ratio|0.91| |b_ratio|0.43| |match_types|Implied Match| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |`name`|BfsGetRegistryPrefixEx|BfsGetRegistryPrefix| |`fullname`|BfsGetRegistryPrefixEx|BfsGetRegistryPrefix| |`refcount`|2|3| |`length`|751|867| |`called`|
Expand for full list:
BfsCalculateRegistryPrefix
BfsDereferencePolicyEntryEx
BfsGetNotPresentPolicyEntry
BfsGetPolicyEntry
BfsPolicyEntryExists
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlQueryPackageIdentity
NTOSKRNL.EXE::SeQueryInformationToken__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
|
Expand for full list:
BfsCalculateRegistryPrefix
BfsDereferencePolicyEntryEx
BfsGetNotPresentPolicyEntryLocked
BfsGetPolicyEntryLocked
BfsPolicyEntryExistsLocked
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeStringNTOSKRNL.EXE::RtlQueryPackageIdentity
NTOSKRNL.EXE::SeQueryInformationToken
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
memset
| |calling|BfsRegistryPreCreateCallback|BfsRegistryPreCreateCallback| |paramcount|3|4| |`address`|140010ad0|140010dac| |`sig`|uint __fastcall BfsGetRegistryPrefixEx(ushort * param_1, undefined8 * param_2, undefined8 * param_3)|ulonglong __fastcall BfsGetRegistryPrefix(ushort * param_1, undefined8 * param_2, undefined8 * param_3, int * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsGetRegistryPrefixEx Called Diff ```diff --- BfsGetRegistryPrefixEx called +++ BfsGetRegistryPrefix called @@ -3,3 +3,3 @@ -BfsGetNotPresentPolicyEntry -BfsGetPolicyEntry -BfsPolicyEntryExists +BfsGetNotPresentPolicyEntryLocked +BfsGetPolicyEntryLocked +BfsPolicyEntryExistsLocked @@ -6,0 +7,2 @@ +NTOSKRNL.EXE::ExReleasePushLockSharedEx +NTOSKRNL.EXE::KeLeaveCriticalRegion ``` ### BfsGetRegistryPrefixEx Diff ```diff --- BfsGetRegistryPrefixEx +++ BfsGetRegistryPrefix @@ -1,119 +1,164 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -uint BfsGetRegistryPrefixEx(ushort *param_1,undefined8 *param_2,undefined8 *param_3) +ulonglong BfsGetRegistryPrefix(ushort *param_1,undefined8 *param_2,undefined8 *param_3,int *param_4) { short *psVar1; - byte bVar2; + uint uVar2; uint uVar3; ulonglong uVar4; - undefined8 uVar5; + ulonglong uVar5; ushort *puVar6; - undefined8 *puVar7; - longlong lVar8; - undefined1 auStackY_1f8 [32]; - uint local_1c8 [2]; - longlong local_1c0; - undefined8 *local_1b8; - undefined8 *local_1b0; - undefined8 local_1a8; - ushort local_1a0 [8]; - undefined8 local_190; - undefined8 uStack_188; - uint *local_160; - undefined8 local_158; - undefined1 local_148 [256]; - ulonglong local_48; + char cVar7; + undefined8 uVar8; + longlong lVar9; + undefined1 auStackY_218 [32]; + uint local_1d8 [2]; + longlong local_1d0; + undefined8 *local_1c8; + undefined8 *local_1c0; + undefined8 local_1b8; + undefined8 local_1b0; + undefined8 uStack_1a8; + undefined8 local_1a0; + undefined8 uStack_198; + uint *local_170; + undefined8 local_168; + undefined1 local_158 [256]; + ulonglong local_58; - local_48 = __security_cookie ^ (ulonglong)auStackY_1f8; - local_1b0 = (undefined8 *)0x0; - local_190 = 0; - uStack_188 = 0; - memset(local_148,0,0x100); - local_1a8 = 0x100; - local_1c0 = 0; - local_1b8 = (undefined8 *)0x0; - local_1a0[0] = 0; - local_1a0[1] = 0; - local_1a0[2] = 0; - local_1a0[3] = 0; - local_1a0[4] = 0; - local_1a0[5] = 0; - local_1a0[6] = 0; - local_1a0[7] = 0; + local_58 = __security_cookie ^ (ulonglong)auStackY_218; + lVar9 = 0; + local_1c0 = (undefined8 *)0x0; + local_1a0 = 0; + uStack_198 = 0; + memset(local_158,0,0x100); + local_1b8 = 0x100; + local_1d0 = 0; + local_1c8 = (undefined8 *)0x0; + local_1b0 = 0; + uStack_1a8 = 0; puVar6 = param_1; - uVar3 = SeQueryInformationToken(param_1,1,&local_1b8); - lVar8 = 0; - if (((int)uVar3 < 0) || - (puVar6 = param_1, uVar3 = SeQueryInformationToken(param_1,0x1f,&local_1b0), lVar8 = 0, - (int)uVar3 < 0)) goto LAB_0; - bVar2 = BfsPolicyEntryExists(gBfsFilterHandle,0,0x14001b2b0,(byte *)*local_1b8,(byte *)*local_1b0) - ; - if (bVar2 == 1) { - puVar7 = gBfsFilterHandle; - uVar4 = BfsGetPolicyEntry(gBfsFilterHandle,0,0x14001b2b0,(byte *)*local_1b8,(byte *)*local_1b0, - &local_1c0); - uVar3 = (uint)uVar4; + uVar2 = SeQueryInformationToken(param_1,1,&local_1c8); + uVar4 = (ulonglong)uVar2; + uVar3 = local_1d8[0]; + if ((int)uVar2 < 0) { +joined_r0x000140011011: + local_1d8[0] = uVar2; + if (DAT_1 < 4) goto LAB_140011065; } else { - puVar7 = (undefined8 *)&gBfsPolicyTable; - uVar5 = BfsGetNotPresentPolicyEntry - (0x14001b2b0,(byte *)*local_1b8,(byte *)*local_1b0,&local_1c0); - uVar3 = (uint)uVar5; + uVar8 = 0x1f; + puVar6 = param_1; + uVar2 = SeQueryInformationToken(param_1,0x1f,&local_1c0); + uVar4 = (ulonglong)uVar2; + uVar3 = local_1d8[0]; + if ((int)uVar2 < 0) goto joined_r0x000140011011; + puVar6 = gBfsFilterHandle; + uVar4 = BfsPolicyEntryExistsLocked + (gBfsFilterHandle,uVar8,0x14001b2d0,(byte *)*local_1c8,(byte *)*local_1c0, + *param_4); + uVar2 = (uint)uVar4; + uVar4 = uVar4 & 0xffffffff; + if (uVar2 == 0) { + puVar6 = gBfsFilterHandle; + uVar5 = BfsGetPolicyEntryLocked + ((undefined8 *)gBfsFilterHandle,uVar8,0x14001b2d0,(byte *)*local_1c8, + (byte *)*local_1c0,param_4,&local_1d0); +LAB_2: + uVar4 = uVar5 & 0xffffffff; + lVar9 = local_1d0; + if ((int)(uint)uVar5 < 0) { + uVar3 = local_1d8[0]; + if (3 < DAT_1) { + local_170 = local_1d8; + local_168 = 4; + local_1d8[0] = (uint)uVar5; + _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_3); + lVar9 = local_1d0; + uVar3 = local_1d8[0]; + } + goto LAB_0; + } + } + else { + if (uVar2 == 0xc0000225) { + puVar6 = (ushort *)&gBfsPolicyTable; + uVar5 = BfsGetNotPresentPolicyEntryLocked + (0x14001b2d0,(byte *)*local_1c8,(byte *)*local_1c0,&local_1d0); + goto LAB_2; + } + uVar3 = local_1d8[0]; + if ((int)uVar2 < 0) goto joined_r0x000140011011; + } + psVar1 = (short *)(lVar9 + 0x70); + if ((*psVar1 != 0) && (*(short *)(lVar9 + 0x80) != 0)) { +LAB_4: + uVar8 = *(undefined8 *)(lVar9 + 0x78); + *param_2 = *(undefined8 *)psVar1; + param_2[1] = uVar8; + uVar8 = *(undefined8 *)(lVar9 + 0x88); + *param_3 = *(undefined8 *)(lVar9 + 0x80); + param_3[1] = uVar8; + uVar3 = local_1d8[0]; + goto LAB_0; + } + if (*param_4 == 2) { + puVar6 = (ushort *)&local_1b0; + uVar3 = RtlConvertSidToUnicodeString(puVar6,*local_1c8,1); + uVar4 = (ulonglong)uVar3; + if (-1 < (int)uVar3) { + uVar2 = RtlQueryPackageIdentity(param_1,local_158,&local_1b8,0); + uVar4 = (ulonglong)uVar2; + puVar6 = param_1; + uVar3 = local_1d8[0]; + if (-1 < (int)uVar2) { + RtlInitUnicodeString(&local_1a0,local_158); + puVar6 = (ushort *)&local_1b0; + uVar2 = BfsCalculateRegistryPrefix + (puVar6,(ushort *)&local_1a0,(PUCHAR)psVar1,(PUCHAR)(lVar9 + 0x80)); + uVar4 = (ulonglong)uVar2; + uVar3 = local_1d8[0]; + if (-1 < (int)uVar2) goto LAB_4; + } + goto joined_r0x000140011011; + } + } + else { + uVar4 = 0xc000022d; + } + uVar3 = local_1d8[0]; + if (DAT_1 < 4) goto LAB_140011065; + local_1d8[0] = (uint)uVar4; } - lVar8 = local_1c0; - if ((int)uVar3 < 0) { - if (3 < DAT_1) { - local_160 = local_1c8; - local_158 = 4; - local_1c8[0] = uVar3; - _tlgWriteTransfer_EtwWriteTransfer(puVar7,&DAT_2); - lVar8 = local_1c0; - } - goto LAB_3; - } - psVar1 = (short *)(local_1c0 + 0x70); - if ((*psVar1 == 0) || (*(short *)(local_1c0 + 0x80) == 0)) { - puVar6 = local_1a0; - uVar3 = RtlConvertSidToUnicodeString(puVar6,*local_1b8,1); - if ((-1 < (int)uVar3) && - (uVar3 = RtlQueryPackageIdentity(param_1,local_148,&local_1a8,0), puVar6 = param_1, - -1 < (int)uVar3)) { - RtlInitUnicodeString(&local_190,local_148); - puVar6 = local_1a0; - uVar3 = BfsCalculateRegistryPrefix - (puVar6,(ushort *)&local_190,(PUCHAR)psVar1,(PUCHAR)(lVar8 + 0x80)); - if (-1 < (int)uVar3) goto LAB_4; - } + local_170 = local_1d8; + local_168 = 4; + _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_3); + uVar3 = local_1d8[0]; LAB_0: - if (3 < DAT_1) { - local_160 = local_1c8; - local_158 = 4; - local_1c8[0] = uVar3; - _tlgWriteTransfer_EtwWriteTransfer(puVar6,&DAT_2); - } - } - else { -LAB_4: - uVar5 = *(undefined8 *)(lVar8 + 0x78); - *param_2 = *(undefined8 *)psVar1; - param_2[1] = uVar5; - uVar5 = *(undefined8 *)(lVar8 + 0x88); - *param_3 = *(undefined8 *)(lVar8 + 0x80); - param_3[1] = uVar5; - } -LAB_3: - RtlFreeUnicodeString(local_1a0); - if (local_1b8 != (undefined8 *)0x0) { + local_1d8[0] = uVar3; + RtlFreeUnicodeString(&local_1b0); + if (local_1c8 != (undefined8 *)0x0) { ExFreePoolWithTag(); } - if (local_1b0 != (undefined8 *)0x0) { + if (local_1c0 != (undefined8 *)0x0) { ExFreePoolWithTag(); } - if (lVar8 != 0) { - BfsDereferencePolicyEntryEx(lVar8,'\0'); + if (lVar9 != 0) { + if (*param_4 == 2) { + cVar7 = '\x01'; + } + else { + if (*param_4 == 1) { + ExReleasePushLockSharedEx(&gBfsPolicyTable); + KeLeaveCriticalRegion(); + *param_4 = 0; + } + cVar7 = '\0'; + } + BfsDereferencePolicyEntryEx(lVar9,cVar7); } - return uVar3; + return uVar4; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|76|78| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|140015be8|140016298| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## wil_details_IsEnabledFallback ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|26|23| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|
Expand for full list:
Feature_1122292024__private_IsEnabledFallback
Feature_1199833401__private_IsEnabledFallback
Feature_1576213819__private_IsEnabledFallback
Feature_1777540409__private_IsEnabledFallback
Feature_1827994938__private_IsEnabledFallback
Feature_2210080059__private_IsEnabledFallback
Feature_2470751545__private_IsEnabledFallback
Feature_3148938554__private_IsEnabledFallback
Feature_3434922298__private_IsEnabledFallback
Feature_3498538297__private_IsEnabledFallback
Feature_3499588921__private_IsEnabledFallbackFeature_752421176__private_IsEnabledFallback
Feature_AgenticAppContainerBfsSupport__private_IsEnabledFallback
Feature_AppSiloBFSPagePoolCleanup__private_IsEnabledFallback
Feature_AppSiloBfsInsertEntryValidityCheck__private_IsEnabledFallback
Feature_AppSiloBfsProcessSetPolicyRequestBufferCheck__private_IsEnabledFallback
Feature_AppSiloEnumeratePolicyCheck__private_IsEnabledFallback
Feature_AppSiloSmbNoTrackDelete__private_IsEnabledFallback
Feature_BfsCleanupDeleteCheck__private_IsEnabledFallback
Feature_BfsDeadlockFix__private_IsEnabledFallback
Feature_BfsFixBundle2__private_IsEnabledFallback
Feature_BfsFixBundle__private_IsEnabledFallback
Feature_BfsInMemoryPolicies__private_IsEnabledFallback
Feature_DecoupleAppContainerAndIntegrityLevel__private_IsEnabledFallback
Feature_Servicing_BfsGAFeature__private_IsEnabledFallback
|
Expand for full list:
Feature_217306426__private_IsEnabledFallback
Feature_2191465787__private_IsEnabledFallback
Feature_241429816__private_IsEnabledFallback
Feature_3879979322__private_IsEnabledFallback
Feature_474460473__private_IsEnabledFallback
Feature_AgenticAppContainerBfsSupport__private_IsEnabledFallback
Feature_AppSiloBFSPagePoolCleanup__private_IsEnabledFallback
Feature_AppSiloBfsProcessSetPolicyRequestBufferCheck__private_IsEnabledFallback
Feature_AppSiloEnumeratePolicyCheck__private_IsEnabledFallback
Feature_AppSiloSmbNoTrackDelete__private_IsEnabledFallback
Feature_BfsCleanupDeleteCheck__private_IsEnabledFallbackFeature_BfsDeadlockFix__private_IsEnabledFallback
Feature_BfsDirMoveBlockLeak__private_IsEnabledFallback
Feature_BfsFixBundle2__private_IsEnabledFallback
Feature_BfsFixBundle__private_IsEnabledFallback
Feature_BfsHardLinkDeny__private_IsEnabledFallback
Feature_BfsInMemoryPolicies__private_IsEnabledFallback
Feature_BfsProcessAppxReparse__private_IsEnabledFallback
Feature_BfsRenameSourceCheck__private_IsEnabledFallback
Feature_BfsVolumeRootPolicy__private_IsEnabledFallback
Feature_DecoupleAppContainerAndIntegrityLevel__private_IsEnabledFallback
Feature_Servicing_BfsGAFeature__private_IsEnabledFallback
| |paramcount|3|3| |`address`|1400052c4|1400054ec| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1,12 +1,5 @@ -Feature_1122292024__private_IsEnabledFallback -Feature_1199833401__private_IsEnabledFallback -Feature_1576213819__private_IsEnabledFallback -Feature_1777540409__private_IsEnabledFallback -Feature_1827994938__private_IsEnabledFallback -Feature_2210080059__private_IsEnabledFallback -Feature_2470751545__private_IsEnabledFallback -Feature_3148938554__private_IsEnabledFallback -Feature_3434922298__private_IsEnabledFallback -Feature_3498538297__private_IsEnabledFallback -Feature_3499588921__private_IsEnabledFallback -Feature_752421176__private_IsEnabledFallback +Feature_217306426__private_IsEnabledFallback +Feature_2191465787__private_IsEnabledFallback +Feature_241429816__private_IsEnabledFallback +Feature_3879979322__private_IsEnabledFallback +Feature_474460473__private_IsEnabledFallback @@ -15 +7,0 @@ -Feature_AppSiloBfsInsertEntryValidityCheck__private_IsEnabledFallback @@ -20,0 +13 @@ +Feature_BfsDirMoveBlockLeak__private_IsEnabledFallback @@ -22,0 +16 @@ +Feature_BfsHardLinkDeny__private_IsEnabledFallback @@ -23,0 +18,3 @@ +Feature_BfsProcessAppxReparse__private_IsEnabledFallback +Feature_BfsRenameSourceCheck__private_IsEnabledFallback +Feature_BfsVolumeRootPolicy__private_IsEnabledFallback ``` ## NTOSKRNL.EXE::PsDereferencePrimaryToken ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|PsDereferencePrimaryToken|PsDereferencePrimaryToken| |fullname|NTOSKRNL.EXE::PsDereferencePrimaryToken|NTOSKRNL.EXE::PsDereferencePrimaryToken| |`refcount`|5|6| |length|0|0| |called||| |`calling`|BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessRename
BfsRegistryCallback|BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessHardLink
BfsProcessRename
BfsRegistryCallback| |paramcount|0|0| |`address`|EXTERNAL:0000007b|EXTERNAL:0000007c| |sig|undefined PsDereferencePrimaryToken(void)|undefined PsDereferencePrimaryToken(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::PsDereferencePrimaryToken Calling Diff ```diff --- NTOSKRNL.EXE::PsDereferencePrimaryToken calling +++ NTOSKRNL.EXE::PsDereferencePrimaryToken calling @@ -2,0 +3 @@ +BfsProcessHardLink ``` ## BfsAllocateBlock ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsAllocateBlock|BfsAllocateBlock| |fullname|BfsAllocateBlock|BfsAllocateBlock| |`refcount`|5|6| |length|101|101| |called|NTOSKRNL.EXE::RtlFindClearBits
NTOSKRNL.EXE::RtlSetBits|NTOSKRNL.EXE::RtlFindClearBits
NTOSKRNL.EXE::RtlSetBits| |`calling`|BfsCreateStorage
BfsExpandDirectory
BfsInsertDirectoryEntry|BfsCreateStorage
BfsExpandDirectory
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD| |paramcount|2|2| |`address`|140012798|140012948| |sig|undefined8 __fastcall BfsAllocateBlock(longlong param_1, int * param_2)|undefined8 __fastcall BfsAllocateBlock(longlong param_1, int * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsAllocateBlock Calling Diff ```diff --- BfsAllocateBlock calling +++ BfsAllocateBlock calling @@ -3,0 +4 @@ +BfsInsertDirectoryEntry_OLD ``` ## NTOSKRNL.EXE::RtlPrefixUnicodeString ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|RtlPrefixUnicodeString|RtlPrefixUnicodeString| |fullname|NTOSKRNL.EXE::RtlPrefixUnicodeString|NTOSKRNL.EXE::RtlPrefixUnicodeString| |`refcount`|8|6| |length|0|0| |called||| |calling|BfsPreCreatePipeOperation
BfsRegistryPreCreateCallback|BfsPreCreatePipeOperation
BfsRegistryPreCreateCallback| |paramcount|0|0| |`address`|EXTERNAL:00000034|EXTERNAL:00000035| |sig|undefined RtlPrefixUnicodeString(void)|undefined RtlPrefixUnicodeString(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|ExAcquirePushLockExclusiveEx|ExAcquirePushLockExclusiveEx| |fullname|NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx|NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx| |`refcount`|38|37| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsExpandDirectory
BfsInsertDirectory
BfsInsertDirectoryEntryBfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsPostCreateOperation
BfsProcessDelete
BfsProcessSetPolicyCleanupEventRequest
BfsRegistryPreCreateCallback
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsRenameEntry
BfsUninitializePipeMappingTable
|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsExpandDirectory
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLDBfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsPostCreateOperation
BfsProcessDelete
BfsProcessSetPolicyCleanupEventRequest
BfsRegistryPreCreateCallback
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsRenameEntry
BfsUninitializePipeMappingTable
| |paramcount|0|0| |address|EXTERNAL:00000012|EXTERNAL:00000012| |sig|undefined ExAcquirePushLockExclusiveEx(void)|undefined ExAcquirePushLockExclusiveEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx Calling Diff ```diff --- NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx calling +++ NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx calling @@ -10 +9,0 @@ -BfsInsertDirectory @@ -11,0 +11 @@ +BfsInsertDirectoryEntry_OLD ``` ## NTOSKRNL.EXE::ZwOpenFile ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|ZwOpenFile|ZwOpenFile| |fullname|NTOSKRNL.EXE::ZwOpenFile|NTOSKRNL.EXE::ZwOpenFile| |`refcount`|5|7| |length|0|0| |called||| |`calling`|BfsProcessSetPolicyRequest
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyVolumeRootDescriptor|BfsProcessSetPolicyRequest
BfsResolveReparseTarget
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyVolumeRootDescriptor| |paramcount|0|0| |`address`|EXTERNAL:00000066|EXTERNAL:00000067| |sig|undefined ZwOpenFile(void)|undefined ZwOpenFile(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ZwOpenFile Calling Diff ```diff --- NTOSKRNL.EXE::ZwOpenFile calling +++ NTOSKRNL.EXE::ZwOpenFile calling @@ -1,0 +2 @@ +BfsResolveReparseTarget ``` ## FLTMGR.SYS::FltParseFileNameInformation ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|FltParseFileNameInformation|FltParseFileNameInformation| |fullname|FLTMGR.SYS::FltParseFileNameInformation|FLTMGR.SYS::FltParseFileNameInformation| |`refcount`|3|5| |length|0|0| |called||| |`calling`|BfsCheckPolicyAndPerformRenameAsUser
BfsProcessRename|BfsCheckPolicyAndPerformRenameAsUser
BfsProcessHardLink
BfsProcessRename| |paramcount|0|0| |`address`|EXTERNAL:000000b4|EXTERNAL:000000b6| |sig|undefined FltParseFileNameInformation(void)|undefined FltParseFileNameInformation(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### FLTMGR.SYS::FltParseFileNameInformation Calling Diff ```diff --- FLTMGR.SYS::FltParseFileNameInformation calling +++ FLTMGR.SYS::FltParseFileNameInformation calling @@ -1,0 +2 @@ +BfsProcessHardLink ``` ## BfsGetFileName ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.85| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsGetFileName|BfsGetFileName| |fullname|BfsGetFileName|BfsGetFileName| |`refcount`|11|14| |length|119|119| |called||| |`calling`|BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsFileInPublisherDirectory
BfsPostCreateOperation
BfsPreCreatePipeOperation
BfsProcessSetPolicyRequest
BfsRenameAsUserCallback|BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsFileInPublisherDirectory
BfsPostCreateOperation
BfsPreCreatePipeOperation
BfsProcessHardLink
BfsProcessSetPolicyRequest
BfsRenameAsUserCallback| |paramcount|2|2| |`address`|140007360|1400075f0| |sig|ushort * __fastcall BfsGetFileName(ushort * param_1, longlong param_2)|ushort * __fastcall BfsGetFileName(ushort * param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsGetFileName Calling Diff ```diff --- BfsGetFileName calling +++ BfsGetFileName calling @@ -5,0 +6 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::PsReferencePrimaryToken ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|PsReferencePrimaryToken|PsReferencePrimaryToken| |fullname|NTOSKRNL.EXE::PsReferencePrimaryToken|NTOSKRNL.EXE::PsReferencePrimaryToken| |`refcount`|5|6| |length|0|0| |called||| |`calling`|BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessRename
BfsRegistryCallback|BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessHardLink
BfsProcessRename
BfsRegistryCallback| |paramcount|0|0| |`address`|EXTERNAL:00000082|EXTERNAL:00000083| |sig|undefined PsReferencePrimaryToken(void)|undefined PsReferencePrimaryToken(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::PsReferencePrimaryToken Calling Diff ```diff --- NTOSKRNL.EXE::PsReferencePrimaryToken calling +++ NTOSKRNL.EXE::PsReferencePrimaryToken calling @@ -2,0 +3 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::ExAcquireRundownProtection ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|ExAcquireRundownProtection|ExAcquireRundownProtection| |fullname|NTOSKRNL.EXE::ExAcquireRundownProtection|NTOSKRNL.EXE::ExAcquireRundownProtection| |`refcount`|11|10| |length|0|0| |called||| |`calling`|BfsDeviceIoControl
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessRename
BfsRegistryPreCreateCallback|BfsDeviceIoControl
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessHardLink
BfsProcessRename
BfsRegistryPreCreateCallback| |paramcount|0|0| |`address`|EXTERNAL:00000086|EXTERNAL:0000008f| |sig|undefined ExAcquireRundownProtection(void)|undefined ExAcquireRundownProtection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAcquireRundownProtection Calling Diff ```diff --- NTOSKRNL.EXE::ExAcquireRundownProtection calling +++ NTOSKRNL.EXE::ExAcquireRundownProtection calling @@ -6,0 +7 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::ExAcquirePushLockSharedEx ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|ExAcquirePushLockSharedEx|ExAcquirePushLockSharedEx| |fullname|NTOSKRNL.EXE::ExAcquirePushLockSharedEx|NTOSKRNL.EXE::ExAcquirePushLockSharedEx| |`refcount`|23|22| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsEnumerateDirectory
BfsEnumeratePolicy
BfsGetNotPresentPolicyEntry
BfsGetPolicyBfsGetPolicyEntry
BfsLocateDirectory
BfsPolicyEntryExists
BfsPreCreateOperation
BfsPreloadPolicyEntriesForDeleteList
BfsProcessCreatePolicyEntryRequest
BfsProcessDelete
BfsRegistryPreCreateCallback
|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsEnumerateDirectory
BfsEnumeratePolicy
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntryBfsLocateDirectory
BfsPolicyEntryExists
BfsPreCreateOperation
BfsPreloadPolicyEntriesForDeleteList
BfsProcessCreatePolicyEntryRequest
BfsProcessDelete
BfsRegistryPreCreateCallback
| |paramcount|0|0| |address|EXTERNAL:0000001b|EXTERNAL:0000001b| |sig|undefined ExAcquirePushLockSharedEx(void)|undefined ExAcquirePushLockSharedEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAcquirePushLockSharedEx Calling Diff ```diff --- NTOSKRNL.EXE::ExAcquirePushLockSharedEx calling +++ NTOSKRNL.EXE::ExAcquirePushLockSharedEx calling @@ -4 +3,0 @@ -BfsCheckAndReleaseIdlePolicy ``` ## NTOSKRNL.EXE::RtlClearBits ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|RtlClearBits|RtlClearBits| |fullname|NTOSKRNL.EXE::RtlClearBits|NTOSKRNL.EXE::RtlClearBits| |`refcount`|5|6| |length|0|0| |called||| |`calling`|BfsDeleteEntry
BfsFreeBlock
BfsInsertDirectoryEntry
BfsRenameEntry|BfsDeleteEntry
BfsFreeBlock
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsRenameEntry| |paramcount|0|0| |`address`|EXTERNAL:00000046|EXTERNAL:00000047| |sig|undefined RtlClearBits(void)|undefined RtlClearBits(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlClearBits Calling Diff ```diff --- NTOSKRNL.EXE::RtlClearBits calling +++ NTOSKRNL.EXE::RtlClearBits calling @@ -3,0 +4 @@ +BfsInsertDirectoryEntry_OLD ``` ## __security_check_cookie ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|88|89| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAddPolicyToGlobalFileTable
BfsAdjustRegistryKeySecurity
BfsAllocateAndConcatenatePath
BfsApplyPolicyAsUser
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsCreateDirectory
BfsCreateGlobalFileEntryBfsCreatePolicyStorageDescriptor
BfsCreateStorage
BfsDeleteFileFromGlobalFileTable
BfsDeviceIoControl
BfsEnumeratePolicy
BfsExpandDirectory
BfsFileInPublisherDirectory
BfsFileOpenAsUserCallback
BfsGetFileContext
BfsGetPolicyEntry
BfsGetPolicyEntryLocked
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsGetRegistryPrefixEx
BfsGetUserToken
BfsImpersonateToken
BfsImpersonateUser
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertNotPresentPolicyEntryLocked
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsIsApplicableToken
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsLocateDirectory
BfsOpenPolicyDirectory
BfsOpenPolicyRootDirectory
BfsOpenRootDirectory
BfsPerformPrompt
BfsPostCleanupOperation
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessCreatePolicyEntryRequest
BfsProcessDeletePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessRename
BfsProcessSetPolicyCleanupEventRequest
BfsProcessSetPolicyRequest
BfsPromptForConsent
BfsQueryFileNameInformationCallback
BfsQueueDeferredWorkItemAndWait
BfsQueueIoWorkItemAndWait
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryCallback
BfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveKeyValues
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsRenameAsUserCallback
BfsRenameEntry
BfsSetApplicableCapabilitySid
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateSecurityDescriptor
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates
|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAddPolicyToGlobalFileTable
BfsAdjustRegistryKeySecurity
BfsAllocateAndConcatenatePath
BfsApplyPolicyAsUser
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsCreateDirectory
BfsCreateGlobalFileEntryBfsCreatePolicyStorageDescriptor
BfsCreateStorage
BfsDeleteFileFromGlobalFileTable
BfsDeviceIoControl
BfsEnumeratePolicy
BfsExpandDirectory
BfsFileInPublisherDirectory
BfsFileOpenAsUserCallback
BfsGetFileContext
BfsGetPolicyEntry
BfsGetPolicyEntryLocked
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsGetUserToken
BfsImpersonateToken
BfsImpersonateUser
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertNotPresentPolicyEntryLocked
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsIsApplicableToken
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsLocateDirectory
BfsOpenPolicyDirectory
BfsOpenPolicyRootDirectory
BfsOpenRootDirectory
BfsPerformPrompt
BfsPostCleanupOperation
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessCreatePolicyEntryRequest
BfsProcessDeletePolicyEntryRequest
BfsProcessHardLink
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessRename
BfsProcessSetPolicyCleanupEventRequest
BfsProcessSetPolicyRequest
BfsPromptForConsent
BfsQueryFileNameInformationCallback
BfsQueueDeferredWorkItemAndWait
BfsQueueIoWorkItemAndWait
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryCallback
BfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveKeyValues
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsRenameAsUserCallback
BfsRenameEntry
BfsSetApplicableCapabilitySid
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateSecurityDescriptor
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates
| |paramcount|1|1| |`address`|140015de0|140016490| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -25 +24,0 @@ -BfsGetRegistryPrefixEx @@ -32,0 +32 @@ +BfsInsertDirectoryEntry_OLD @@ -52,0 +53 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::RtlQueryPackageIdentity ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|RtlQueryPackageIdentity|RtlQueryPackageIdentity| |fullname|NTOSKRNL.EXE::RtlQueryPackageIdentity|NTOSKRNL.EXE::RtlQueryPackageIdentity| |`refcount`|3|2| |length|0|0| |called||| |`calling`|BfsGetRegistryPrefix
BfsGetRegistryPrefixEx|BfsGetRegistryPrefix| |paramcount|0|0| |`address`|EXTERNAL:0000003d|EXTERNAL:0000003e| |sig|undefined RtlQueryPackageIdentity(void)|undefined RtlQueryPackageIdentity(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlQueryPackageIdentity Calling Diff ```diff --- NTOSKRNL.EXE::RtlQueryPackageIdentity calling +++ NTOSKRNL.EXE::RtlQueryPackageIdentity calling @@ -2 +1,0 @@ -BfsGetRegistryPrefixEx ``` ## NTOSKRNL.EXE::RtlFindClearBits ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|RtlFindClearBits|RtlFindClearBits| |fullname|NTOSKRNL.EXE::RtlFindClearBits|NTOSKRNL.EXE::RtlFindClearBits| |`refcount`|4|6| |length|0|0| |called||| |`calling`|BfsAllocateBlock
BfsInsertDirectoryEntry|BfsAllocateBlock
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD| |paramcount|0|0| |`address`|EXTERNAL:00000043|EXTERNAL:00000044| |sig|undefined RtlFindClearBits(void)|undefined RtlFindClearBits(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlFindClearBits Calling Diff ```diff --- NTOSKRNL.EXE::RtlFindClearBits calling +++ NTOSKRNL.EXE::RtlFindClearBits calling @@ -2,0 +3 @@ +BfsInsertDirectoryEntry_OLD ``` ## memset ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|memset|memset| |fullname|memset|memset| |`refcount`|24|25| |length|236|236| |called||| |`calling`|
Expand for full list:
BfsCreateDirectory
BfsCreateStorage
BfsDeleteEntry
BfsExpandDirectory
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsGetRegistryPrefixEx
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsLoadUserPolicyEntriesToGlobalFileTableBfsLocateDirectory
BfsProcessQueryPolicyRequest
BfsQueueDeferredWorkItemAndWait
BfsRenameEntry
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
|
Expand for full list:
BfsCreateDirectory
BfsCreateStorage
BfsDeleteEntry
BfsExpandDirectory
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsInsertNamedPipeMapping
BfsLoadUserPolicyEntriesToGlobalFileTableBfsLocateDirectory
BfsProcessQueryPolicyRequest
BfsQueueDeferredWorkItemAndWait
BfsRenameEntry
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
| |paramcount|3|3| |`address`|140016200|140016880| |sig|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### memset Calling Diff ```diff --- memset calling +++ memset calling @@ -7 +6,0 @@ -BfsGetRegistryPrefixEx @@ -9,0 +9 @@ +BfsInsertDirectoryEntry_OLD ``` ## NTOSKRNL.EXE::ZwClose ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|ZwClose|ZwClose| |fullname|NTOSKRNL.EXE::ZwClose|NTOSKRNL.EXE::ZwClose| |`refcount`|23|24| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsApplyPolicyAsUser
BfsGetUserToken
BfsImpersonateToken
BfsImpersonateUser
BfsInitializeBootDevice
BfsIsApplicableToken
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsProcessSetPolicyRequest
BfsReadDeleteThresholdFromRegistry
BfsRegistryPostCreateCallbackBfsUnload
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsApplyPolicyAsUser
BfsGetUserToken
BfsImpersonateToken
BfsImpersonateUser
BfsInitializeBootDevice
BfsIsApplicableToken
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsProcessSetPolicyRequest
BfsReadDeleteThresholdFromRegistry
BfsRegistryPostCreateCallbackBfsResolveReparseTarget
BfsUnload
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
| |paramcount|0|0| |`address`|EXTERNAL:00000070|EXTERNAL:00000071| |sig|undefined ZwClose(void)|undefined ZwClose(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ZwClose Calling Diff ```diff --- NTOSKRNL.EXE::ZwClose calling +++ NTOSKRNL.EXE::ZwClose calling @@ -11,0 +12 @@ +BfsResolveReparseTarget ``` ## NTOSKRNL.EXE::RtlConvertSidToUnicodeString ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|RtlConvertSidToUnicodeString|RtlConvertSidToUnicodeString| |fullname|NTOSKRNL.EXE::RtlConvertSidToUnicodeString|NTOSKRNL.EXE::RtlConvertSidToUnicodeString| |`refcount`|14|13| |length|0|0| |called||| |`calling`|BfsGetRegistryPrefix
BfsGetRegistryPrefixEx
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsPerformPrompt
BfsPolicyEntryExists
BfsPolicyEntryExistsLocked
BfsRemovePolicyEntry|BfsGetRegistryPrefix
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsPerformPrompt
BfsPolicyEntryExists
BfsPolicyEntryExistsLocked
BfsRemovePolicyEntry| |paramcount|0|0| |address|EXTERNAL:00000018|EXTERNAL:00000018| |sig|undefined RtlConvertSidToUnicodeString(void)|undefined RtlConvertSidToUnicodeString(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlConvertSidToUnicodeString Calling Diff ```diff --- NTOSKRNL.EXE::RtlConvertSidToUnicodeString calling +++ NTOSKRNL.EXE::RtlConvertSidToUnicodeString calling @@ -2 +1,0 @@ -BfsGetRegistryPrefixEx ``` ## NTOSKRNL.EXE::KeEnterCriticalRegion ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|KeEnterCriticalRegion|KeEnterCriticalRegion| |fullname|NTOSKRNL.EXE::KeEnterCriticalRegion|NTOSKRNL.EXE::KeEnterCriticalRegion| |`refcount`|85|84| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsDeviceIoControl
BfsEnumerateDirectoryBfsEnumeratePolicy
BfsExpandDirectory
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsLocateDirectory
BfsPolicyEntryExists
BfsPostCleanupOperation
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsPreloadPolicyEntriesForDeleteList
BfsProcessCreatePolicyEntryRequest
BfsProcessDelete
BfsProcessRename
BfsProcessSetPolicyCleanupEventRequest
BfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsRenameEntry
BfsUninitializePipeMappingTable
BfsUnload
DriverEntry
|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsDeviceIoControl
BfsEnumerateDirectoryBfsEnumeratePolicy
BfsExpandDirectory
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsLocateDirectory
BfsPolicyEntryExists
BfsPostCleanupOperation
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsPreloadPolicyEntriesForDeleteList
BfsProcessCreatePolicyEntryRequest
BfsProcessDelete
BfsProcessHardLink
BfsProcessRename
BfsProcessSetPolicyCleanupEventRequest
BfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsRenameEntry
BfsUninitializePipeMappingTable
BfsUnload
DriverEntry
| |paramcount|0|0| |`address`|EXTERNAL:00000085|EXTERNAL:00000088| |sig|undefined KeEnterCriticalRegion(void)|undefined KeEnterCriticalRegion(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeEnterCriticalRegion Calling Diff ```diff --- NTOSKRNL.EXE::KeEnterCriticalRegion calling +++ NTOSKRNL.EXE::KeEnterCriticalRegion calling @@ -19 +18,0 @@ -BfsInsertDirectory @@ -20,0 +20 @@ +BfsInsertDirectoryEntry_OLD @@ -34,0 +35 @@ +BfsProcessHardLink ``` ## FLTMGR.SYS::FltReleaseFileNameInformation ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|FltReleaseFileNameInformation|FltReleaseFileNameInformation| |fullname|FLTMGR.SYS::FltReleaseFileNameInformation|FLTMGR.SYS::FltReleaseFileNameInformation| |`refcount`|16|18| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsFileContextCleanup
BfsGenerateFileName
BfsPostCreateOperation
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessRename
BfsProcessSetPolicyRequest
BfsQueryFileNameInformationCallback
|
Expand for full list:
BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsFileContextCleanup
BfsGenerateFileName
BfsPostCreateOperation
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessHardLink
BfsProcessRename
BfsProcessSetPolicyRequestBfsQueryFileNameInformationCallback
| |paramcount|0|0| |`address`|EXTERNAL:00000096|EXTERNAL:00000097| |sig|undefined FltReleaseFileNameInformation(void)|undefined FltReleaseFileNameInformation(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### FLTMGR.SYS::FltReleaseFileNameInformation Calling Diff ```diff --- FLTMGR.SYS::FltReleaseFileNameInformation calling +++ FLTMGR.SYS::FltReleaseFileNameInformation calling @@ -8,0 +9 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::RtlInitializeBitMap ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|RtlInitializeBitMap|RtlInitializeBitMap| |fullname|NTOSKRNL.EXE::RtlInitializeBitMap|NTOSKRNL.EXE::RtlInitializeBitMap| |`refcount`|11|13| |length|0|0| |called||| |`calling`|BfsCreateStorage
BfsDeleteEntry
BfsEnumerateDirectory
BfsFindEntry
BfsGetEntryBlock
BfsGetEntryIndex
BfsInsertDirectoryEntry
BfsRenameEntry|BfsCreateStorage
BfsDeleteEntry
BfsEnumerateDirectory
BfsFindEntry
BfsGetEntryBlock
BfsGetEntryIndex
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsRenameEntry| |paramcount|0|0| |`address`|EXTERNAL:00000048|EXTERNAL:00000049| |sig|undefined RtlInitializeBitMap(void)|undefined RtlInitializeBitMap(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlInitializeBitMap Calling Diff ```diff --- NTOSKRNL.EXE::RtlInitializeBitMap calling +++ NTOSKRNL.EXE::RtlInitializeBitMap calling @@ -7,0 +8 @@ +BfsInsertDirectoryEntry_OLD ``` ## _tlgWriteTransfer_EtwWriteTransfer ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.97| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|_tlgWriteTransfer_EtwWriteTransfer|_tlgWriteTransfer_EtwWriteTransfer| |fullname|_tlgWriteTransfer_EtwWriteTransfer|_tlgWriteTransfer_EtwWriteTransfer| |`refcount`|119|126| |length|163|163| |called|NTOSKRNL.EXE::EtwWriteTransfer|NTOSKRNL.EXE::EtwWriteTransfer| |`calling`|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAddPolicyToGlobalFileTable
BfsAdjustRegistryKeySecurity
BfsAllocateAndConcatenatePath
BfsApplyPolicyAsUser
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsCreateDirectory
BfsCreateGlobalFileEntryBfsCreatePolicyStorageDescriptor
BfsCreateStorage
BfsDeleteFileFromGlobalFileTable
BfsDeviceIoControl
BfsEnumeratePolicy
BfsExpandDirectory
BfsFileInPublisherDirectory
BfsFileOpenAsUserCallback
BfsGetFileContext
BfsGetPolicyEntry
BfsGetPolicyEntryLocked
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsGetRegistryPrefixEx
BfsGetUserToken
BfsImpersonateToken
BfsImpersonateUser
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertNotPresentPolicyEntryLocked
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenPolicyDirectory
BfsOpenPolicyRootDirectory
BfsOpenRootDirectory
BfsPerformPrompt
BfsPostCreatePipeOperation
BfsProcessCreatePolicyEntryRequest
BfsProcessDeletePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessRename
BfsProcessSetPolicyCleanupEventRequest
BfsProcessSetPolicyRequest
BfsPromptForConsent
BfsQueryFileNameInformationCallback
BfsQueueDeferredWorkItemAndWait
BfsQueueIoWorkItemAndWait
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryCallback
BfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveKeyValues
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsRenameAsUserCallback
BfsSetApplicableCapabilitySid
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateSecurityDescriptor
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAddPolicyToGlobalFileTable
BfsAdjustRegistryKeySecurity
BfsAllocateAndConcatenatePath
BfsApplyPolicyAsUser
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsCreateDirectory
BfsCreateGlobalFileEntryBfsCreatePolicyStorageDescriptor
BfsCreateStorage
BfsDeleteFileFromGlobalFileTable
BfsDeviceIoControl
BfsEnumeratePolicy
BfsExpandDirectory
BfsFileInPublisherDirectory
BfsFileOpenAsUserCallback
BfsGetFileContext
BfsGetPolicyEntry
BfsGetPolicyEntryLocked
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsGetUserToken
BfsImpersonateToken
BfsImpersonateUser
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertNotPresentPolicyEntryLocked
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenPolicyDirectory
BfsOpenPolicyRootDirectory
BfsOpenRootDirectory
BfsPerformPrompt
BfsPostCreatePipeOperation
BfsProcessCreatePolicyEntryRequest
BfsProcessDeletePolicyEntryRequest
BfsProcessHardLink
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessRename
BfsProcessSetPolicyCleanupEventRequest
BfsProcessSetPolicyRequest
BfsPromptForConsent
BfsQueryFileNameInformationCallback
BfsQueueDeferredWorkItemAndWait
BfsQueueIoWorkItemAndWait
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryCallback
BfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveKeyValues
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsRenameAsUserCallback
BfsSetApplicableCapabilitySid
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateSecurityDescriptor
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
| |paramcount|2|2| |address|140001008|140001008| |sig|undefined __fastcall _tlgWriteTransfer_EtwWriteTransfer(undefined8 param_1, byte * param_2)|undefined __fastcall _tlgWriteTransfer_EtwWriteTransfer(undefined8 param_1, byte * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### _tlgWriteTransfer_EtwWriteTransfer Calling Diff ```diff --- _tlgWriteTransfer_EtwWriteTransfer calling +++ _tlgWriteTransfer_EtwWriteTransfer calling @@ -25 +24,0 @@ -BfsGetRegistryPrefixEx @@ -31,0 +31 @@ +BfsInsertDirectoryEntry_OLD @@ -44,0 +45 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::CmRegisterCallbackEx ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|CmRegisterCallbackEx|CmRegisterCallbackEx| |fullname|NTOSKRNL.EXE::CmRegisterCallbackEx|NTOSKRNL.EXE::CmRegisterCallbackEx| |`refcount`|3|2| |length|0|0| |called||| |calling|DriverEntry|DriverEntry| |paramcount|0|0| |`address`|EXTERNAL:00000005|EXTERNAL:00000007| |sig|undefined CmRegisterCallbackEx(void)|undefined CmRegisterCallbackEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## BfsWriteBlock ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsWriteBlock|BfsWriteBlock| |fullname|BfsWriteBlock|BfsWriteBlock| |`refcount`|15|18| |length|148|148| |called|Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ZwWriteFile|Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ZwWriteFile| |`calling`|BfsAddOrModifyEntry
BfsCreateStorage
BfsDeleteEntry
BfsExpandDirectory
BfsInsertDirectoryEntry
BfsRenameEntry|BfsAddOrModifyEntry
BfsCreateStorage
BfsDeleteEntry
BfsExpandDirectory
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsRenameEntry| |paramcount|3|3| |`address`|14001505c|1400156b4| |sig|undefined8 __fastcall BfsWriteBlock(longlong param_1, int param_2, undefined8 param_3)|undefined8 __fastcall BfsWriteBlock(longlong param_1, int param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsWriteBlock Calling Diff ```diff --- BfsWriteBlock calling +++ BfsWriteBlock calling @@ -5,0 +6 @@ +BfsInsertDirectoryEntry_OLD ``` ## BfsCalculateRegistryPrefix ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.8| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsCalculateRegistryPrefix|BfsCalculateRegistryPrefix| |fullname|BfsCalculateRegistryPrefix|BfsCalculateRegistryPrefix| |`refcount`|3|2| |length|892|892| |called|
Expand for full list:
CNG.SYS::BCryptCreateHash
CNG.SYS::BCryptDestroyHash
CNG.SYS::BCryptFinishHash
CNG.SYS::BCryptGetProperty
CNG.SYS::BCryptHashData
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeStringNTOSKRNL.EXE::RtlStringFromGUID
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
|
Expand for full list:
CNG.SYS::BCryptCreateHash
CNG.SYS::BCryptDestroyHash
CNG.SYS::BCryptFinishHash
CNG.SYS::BCryptGetProperty
CNG.SYS::BCryptHashData
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlCopyUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeStringNTOSKRNL.EXE::RtlStringFromGUID
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
| |`calling`|BfsGetRegistryPrefix
BfsGetRegistryPrefixEx|BfsGetRegistryPrefix| |paramcount|4|4| |`address`|1400103d8|140010a28| |sig|int __fastcall BfsCalculateRegistryPrefix(ushort * param_1, ushort * param_2, PUCHAR param_3, PUCHAR param_4)|int __fastcall BfsCalculateRegistryPrefix(ushort * param_1, ushort * param_2, PUCHAR param_3, PUCHAR param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsCalculateRegistryPrefix Calling Diff ```diff --- BfsCalculateRegistryPrefix calling +++ BfsCalculateRegistryPrefix calling @@ -2 +1,0 @@ -BfsGetRegistryPrefixEx ``` ## NTOSKRNL.EXE::PsReferenceImpersonationToken ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|PsReferenceImpersonationToken|PsReferenceImpersonationToken| |fullname|NTOSKRNL.EXE::PsReferenceImpersonationToken|NTOSKRNL.EXE::PsReferenceImpersonationToken| |`refcount`|7|8| |length|0|0| |called||| |`calling`|BfsImpersonateToken
BfsImpersonateUser
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessRename
BfsRegistryCallback|BfsImpersonateToken
BfsImpersonateUser
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessHardLink
BfsProcessRename
BfsRegistryCallback| |paramcount|0|0| |`address`|EXTERNAL:00000083|EXTERNAL:00000084| |sig|undefined PsReferenceImpersonationToken(void)|undefined PsReferenceImpersonationToken(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::PsReferenceImpersonationToken Calling Diff ```diff --- NTOSKRNL.EXE::PsReferenceImpersonationToken calling +++ NTOSKRNL.EXE::PsReferenceImpersonationToken calling @@ -4,0 +5 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::RtlSetBits ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|RtlSetBits|RtlSetBits| |fullname|NTOSKRNL.EXE::RtlSetBits|NTOSKRNL.EXE::RtlSetBits| |`refcount`|4|5| |length|0|0| |called||| |`calling`|BfsAllocateBlock
BfsInsertDirectoryEntry
BfsRenameEntry|BfsAllocateBlock
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsRenameEntry| |paramcount|0|0| |`address`|EXTERNAL:00000044|EXTERNAL:00000045| |sig|undefined RtlSetBits(void)|undefined RtlSetBits(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlSetBits Calling Diff ```diff --- NTOSKRNL.EXE::RtlSetBits calling +++ NTOSKRNL.EXE::RtlSetBits calling @@ -2,0 +3 @@ +BfsInsertDirectoryEntry_OLD ``` ## FLTMGR.SYS::FltGetDestinationFileNameInformation ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|FltGetDestinationFileNameInformation|FltGetDestinationFileNameInformation| |fullname|FLTMGR.SYS::FltGetDestinationFileNameInformation|FLTMGR.SYS::FltGetDestinationFileNameInformation| |`refcount`|2|3| |length|0|0| |called||| |`calling`|BfsProcessRename|BfsProcessHardLink
BfsProcessRename| |paramcount|0|0| |address|EXTERNAL:000000b5|EXTERNAL:000000b5| |sig|undefined FltGetDestinationFileNameInformation(void)|undefined FltGetDestinationFileNameInformation(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### FLTMGR.SYS::FltGetDestinationFileNameInformation Calling Diff ```diff --- FLTMGR.SYS::FltGetDestinationFileNameInformation calling +++ FLTMGR.SYS::FltGetDestinationFileNameInformation calling @@ -0,0 +1 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::ExFreePoolWithTag ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|ExFreePoolWithTag|ExFreePoolWithTag| |fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag| |`refcount`|167|172| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAddPolicyToGlobalFileTable
BfsAdjustRegistryKeySecurity
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsClearGlobalFileEntry
BfsCloseRootDirectory
BfsCloseStorage
BfsCreateDirectory
BfsCreateGlobalFileEntryBfsCreatePolicyStorageDescriptor
BfsCreateStorage
BfsDeleteFileFromGlobalFileTable
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsEnumeratePolicy
BfsExpandDirectory
BfsFreeDirectoryBlockList
BfsFreePreloadList
BfsFreeTableEntry
BfsGetRegistryPrefix
BfsGetRegistryPrefixEx
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInitializePipeMappingTable
BfsInitializePolicyTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertNotPresentPolicyEntryLocked
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenRootDirectory
BfsPerformPrompt
BfsPolicyEntryExists
BfsPolicyEntryExistsLocked
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessCreatePolicyEntryRequest
BfsProcessDeletePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyCleanupEventRequest
BfsProcessSetPolicyRequest
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryPostCreateCallback
BfsReleaseNamedPipeMapping
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveKeyValues
BfsRemovePolicyFromGlobalFileTable
BfsReparseNamedPipe
BfsSetApplicableCapabilitySid
BfsUninitializeGlobalFileTable
BfsUninitializePipeMappingTable
BfsUninitializePolicyTable
BfsUnload
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
KappxParsePackageFullNameFromToken
MIDL_user_free
|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAddPolicyToGlobalFileTable
BfsAdjustRegistryKeySecurity
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsClearGlobalFileEntry
BfsCloseRootDirectory
BfsCloseStorage
BfsCreateDirectory
BfsCreateGlobalFileEntryBfsCreatePolicyStorageDescriptor
BfsCreateStorage
BfsDeleteFileFromGlobalFileTable
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsEnumeratePolicy
BfsExpandDirectory
BfsFreeDirectoryBlockList
BfsFreePreloadList
BfsFreeTableEntry
BfsGetRegistryPrefix
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInitializePipeMappingTable
BfsInitializePolicyTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertNotPresentPolicyEntryLocked
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenRootDirectory
BfsPerformPrompt
BfsPolicyEntryExists
BfsPolicyEntryExistsLocked
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessCreatePolicyEntryRequest
BfsProcessDeletePolicyEntryRequest
BfsProcessHardLink
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyCleanupEventRequest
BfsProcessSetPolicyRequest
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryPostCreateCallback
BfsReleaseNamedPipeMapping
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemoveKeyValues
BfsRemovePolicyFromGlobalFileTable
BfsReparseNamedPipe
BfsResolveReparseTarget
BfsSetApplicableCapabilitySid
BfsUninitializeGlobalFileTable
BfsUninitializePipeMappingTable
BfsUninitializePolicyTable
BfsUnload
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
KappxParsePackageFullNameFromToken
MIDL_user_free
| |paramcount|0|0| |`address`|EXTERNAL:0000007e|EXTERNAL:0000007f| |sig|undefined ExFreePoolWithTag(void)|undefined ExFreePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExFreePoolWithTag Calling Diff ```diff --- NTOSKRNL.EXE::ExFreePoolWithTag calling +++ NTOSKRNL.EXE::ExFreePoolWithTag calling @@ -23 +22,0 @@ -BfsGetRegistryPrefixEx @@ -29,0 +29 @@ +BfsInsertDirectoryEntry_OLD @@ -45,0 +46 @@ +BfsProcessHardLink @@ -57,0 +59 @@ +BfsResolveReparseTarget ``` ## BfsIsApplicableToken ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.93| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsIsApplicableToken|BfsIsApplicableToken| |fullname|BfsIsApplicableToken|BfsIsApplicableToken| |`refcount`|11|12| |length|881|881| |called|Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ObOpenObjectByPointer
NTOSKRNL.EXE::RtlCheckTokenCapability
NTOSKRNL.EXE::SeQueryInformationToken
NTOSKRNL.EXE::ZwClose
__security_check_cookie|Feature_AgenticAppContainerBfsSupport__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ObOpenObjectByPointer
NTOSKRNL.EXE::RtlCheckTokenCapability
NTOSKRNL.EXE::SeQueryInformationToken
NTOSKRNL.EXE::ZwClose
__security_check_cookie| |`calling`|BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessCreatePolicyEntryRequest
BfsProcessDeletePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessRename
BfsProcessSetPolicyCleanupEventRequest
BfsProcessSetPolicyRequest
BfsRegistryCallback|
Expand for full list:
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessCreatePolicyEntryRequest
BfsProcessDeletePolicyEntryRequest
BfsProcessHardLink
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessRename
BfsProcessSetPolicyCleanupEventRequest
BfsProcessSetPolicyRequest
BfsRegistryCallback
| |paramcount|2|2| |address|140001280|140001280| |sig|undefined1 __fastcall BfsIsApplicableToken(undefined8 param_1, char param_2)|undefined1 __fastcall BfsIsApplicableToken(undefined8 param_1, char param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsIsApplicableToken Calling Diff ```diff --- BfsIsApplicableToken calling +++ BfsIsApplicableToken calling @@ -4,0 +5 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::KeLeaveCriticalRegion ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|KeLeaveCriticalRegion|KeLeaveCriticalRegion| |fullname|NTOSKRNL.EXE::KeLeaveCriticalRegion|NTOSKRNL.EXE::KeLeaveCriticalRegion| |`refcount`|114|108| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsDeviceIoControl
BfsEnumerateDirectoryBfsEnumeratePolicy
BfsExpandDirectory
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsGetPolicyEntryLocked
BfsGetRegistryPrefix
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLocateDirectory
BfsPolicyEntryExists
BfsPostCleanupOperation
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsPreloadPolicyEntriesForDeleteList
BfsProcessCreatePolicyEntryRequest
BfsProcessDelete
BfsProcessRename
BfsProcessSetPolicyCleanupEventRequest
BfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsRenameEntry
BfsUninitializePipeMappingTable
BfsUnload
DriverEntry
|
Expand for full list:
BfsAcquireNamedPipeMapping
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCheckAndReleaseIdlePolicy
BfsCheckDeleteList
BfsCreateDirectory
BfsDeleteEntry
BfsDereferencePolicyEntryEx
BfsDereferenceTableEntry
BfsDeviceIoControl
BfsEnumerateDirectoryBfsEnumeratePolicy
BfsExpandDirectory
BfsGetNotPresentPolicyEntry
BfsGetPolicy
BfsGetPolicyEntry
BfsGetPolicyEntryLocked
BfsGetRegistryPrefix
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLocateDirectory
BfsPolicyEntryExists
BfsPostCleanupOperation
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsPreloadPolicyEntriesForDeleteList
BfsProcessCreatePolicyEntryRequest
BfsProcessDelete
BfsProcessHardLink
BfsProcessRename
BfsProcessSetPolicyCleanupEventRequest
BfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
BfsReleaseNamedPipeMapping
BfsRemovePolicyEntry
BfsRemovePolicyFromGlobalFileTable
BfsRenameEntry
BfsUninitializePipeMappingTable
BfsUnload
DriverEntry
| |paramcount|0|0| |`address`|EXTERNAL:00000087|EXTERNAL:00000090| |sig|undefined KeLeaveCriticalRegion(void)|undefined KeLeaveCriticalRegion(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeLeaveCriticalRegion Calling Diff ```diff --- NTOSKRNL.EXE::KeLeaveCriticalRegion calling +++ NTOSKRNL.EXE::KeLeaveCriticalRegion calling @@ -21 +20,0 @@ -BfsInsertDirectory @@ -22,0 +22 @@ +BfsInsertDirectoryEntry_OLD @@ -37,0 +38 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::ExReleaseRundownProtection ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|ExReleaseRundownProtection|ExReleaseRundownProtection| |fullname|NTOSKRNL.EXE::ExReleaseRundownProtection|NTOSKRNL.EXE::ExReleaseRundownProtection| |`refcount`|13|14| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsDeviceIoControl
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsPostCleanupOperation
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessRename
BfsRegistryPostCreateCallbackBfsRegistryPreCreateCallback
|
Expand for full list:
BfsDeviceIoControl
BfsIdleCheckWorkitemRoutine
BfsInitializeGlobalFileTable
BfsPostCleanupOperation
BfsPostCreateOperation
BfsPostCreatePipeOperation
BfsPreCleanupOperation
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessHardLink
BfsProcessRenameBfsRegistryPostCreateCallback
BfsRegistryPreCreateCallback
| |paramcount|0|0| |`address`|EXTERNAL:0000007d|EXTERNAL:0000007e| |sig|undefined ExReleaseRundownProtection(void)|undefined ExReleaseRundownProtection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExReleaseRundownProtection Calling Diff ```diff --- NTOSKRNL.EXE::ExReleaseRundownProtection calling +++ NTOSKRNL.EXE::ExReleaseRundownProtection calling @@ -9,0 +10 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::RtlFreeUnicodeString ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|RtlFreeUnicodeString|RtlFreeUnicodeString| |fullname|NTOSKRNL.EXE::RtlFreeUnicodeString|NTOSKRNL.EXE::RtlFreeUnicodeString| |`refcount`|37|36| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAllocateAndConcatenatePath
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsDereferenceTableEntry
BfsEnumeratePolicy
BfsFileInPublisherDirectory
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsGetRegistryPrefixEx
BfsInsertPolicyEntry
BfsInsertPolicyEntryLockedBfsLoadUserPolicyEntriesToGlobalFileTable
BfsPerformPrompt
BfsPolicyEntryExists
BfsPolicyEntryExistsLocked
BfsProcessQueryPolicyRequest
BfsReleaseNamedPipeMapping
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemovePolicyEntry
BfsUnload
DriverEntry
|
Expand for full list:
BfsAllocateAndConcatenatePath
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsDereferenceTableEntry
BfsEnumeratePolicy
BfsFileInPublisherDirectory
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLoadUserPolicyEntriesToGlobalFileTableBfsPerformPrompt
BfsPolicyEntryExists
BfsPolicyEntryExistsLocked
BfsProcessQueryPolicyRequest
BfsReleaseNamedPipeMapping
BfsRemoveAllPoliciesFromGlobalFileTable
BfsRemovePolicyEntry
BfsUnload
DriverEntry
| |paramcount|0|0| |`address`|EXTERNAL:0000006e|EXTERNAL:0000006f| |sig|undefined RtlFreeUnicodeString(void)|undefined RtlFreeUnicodeString(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlFreeUnicodeString Calling Diff ```diff --- NTOSKRNL.EXE::RtlFreeUnicodeString calling +++ NTOSKRNL.EXE::RtlFreeUnicodeString calling @@ -9 +8,0 @@ -BfsGetRegistryPrefixEx ``` ## NTOSKRNL.EXE::RtlInitUnicodeString ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|RtlInitUnicodeString|RtlInitUnicodeString| |fullname|NTOSKRNL.EXE::RtlInitUnicodeString|NTOSKRNL.EXE::RtlInitUnicodeString| |`refcount`|30|28| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAllocateAndConcatenatePath
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsEnumeratePolicy
BfsFindEntry
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsGetRegistryPrefixEx
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsLoadUserPolicyEntriesToGlobalFileTableBfsRegistryPreCreateCallback
BfsRemoveKeyValues
BfsRemovePolicyEntry
BfsSetApplicableCapabilitySid
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
|
Expand for full list:
BfsAllocateAndConcatenatePath
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsEnumeratePolicy
BfsFindEntry
BfsGetPublisherIdFromToken
BfsGetRegistryPrefix
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsRegistryPreCreateCallbackBfsRemovePolicyEntry
BfsSetApplicableCapabilitySid
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyVolumeRootDescriptor
DriverEntry
| |paramcount|0|0| |`address`|EXTERNAL:00000067|EXTERNAL:00000068| |sig|undefined RtlInitUnicodeString(void)|undefined RtlInitUnicodeString(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlInitUnicodeString Calling Diff ```diff --- NTOSKRNL.EXE::RtlInitUnicodeString calling +++ NTOSKRNL.EXE::RtlInitUnicodeString calling @@ -8 +7,0 @@ -BfsGetRegistryPrefixEx @@ -13 +11,0 @@ -BfsRemoveKeyValues ``` ## Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.69| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline|Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline|Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline| |`refcount`|37|30| |length|49|49| |called|Feature_BfsFixBundle__private_IsEnabledFallback|Feature_BfsFixBundle__private_IsEnabledFallback| |`calling`|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCreateGlobalFileEntry
BfsCreatePolicyStorageDescriptor
BfsDeleteFileFromGlobalFileTable
BfsDeviceIoControl
BfsEnumerateDirectory
BfsEnumeratePolicy
BfsExpandDirectory
BfsIdleCheckTimerCallback
BfsImpersonateTokenBfsImpersonateUser
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenRootDirectory
BfsPerformPrompt
BfsPostCreateOperation
BfsRedirectNamedPipe
BfsRegistryPreCreateCallback
BfsRemoveKeyValues
BfsRevertTokenImpersonation
DriverEntry
|
Expand for full list:
BfsAddOrModifyEntry
BfsAddPolicyToGlobalFileTable
BfsCreatePolicyStorageDescriptor
BfsDeleteFileFromGlobalFileTable
BfsDeviceIoControl
BfsEnumerateDirectory
BfsEnumeratePolicy
BfsIdleCheckTimerCallback
BfsImpersonateToken
BfsImpersonateUser
BfsInitializeBootDeviceBfsInitializeGlobalFileTable
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenRootDirectory
BfsPerformPrompt
BfsPostCreateOperation
BfsRedirectNamedPipe
BfsRegistryPreCreateCallback
BfsRemoveKeyValues
BfsRevertTokenImpersonation
DriverEntry
| |paramcount|0|0| |`address`|1400049b4|140004b88| |sig|ulonglong __fastcall Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(void)|ulonglong __fastcall Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline Calling Diff ```diff --- Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline calling +++ Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline calling @@ -3 +2,0 @@ -BfsCreateGlobalFileEntry @@ -9 +7,0 @@ -BfsExpandDirectory @@ -15,2 +12,0 @@ -BfsInsertPolicyEntry -BfsInsertPolicyEntryLocked ``` ## BfsDereferencePolicyEntryEx ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.68| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsDereferencePolicyEntryEx|BfsDereferencePolicyEntryEx| |fullname|BfsDereferencePolicyEntryEx|BfsDereferencePolicyEntryEx| |`refcount`|28|30| |length|376|376| |called|BfsCloseStorage
BfsRemoveEntryHashTable
Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObfDereferenceObject|BfsCloseStorage
BfsRemoveEntryHashTable
Feature_BfsInMemoryPolicies__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleasePushLockExclusiveEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ObfDereferenceObject| |`calling`|
Expand for full list:
BfsCheckAndApplyPolicy
BfsCheckAndReleaseIdlePolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsDeleteFileFromGlobalFileTable
BfsFreePreloadList
BfsGetPolicyEntry
BfsGetPolicyEntryLocked
BfsGetRegistryPrefix
BfsGetRegistryPrefixEx
BfsInsertNotPresentPolicyEntry
BfsInsertNotPresentPolicyEntryLockedBfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsPerformPrompt
BfsPostCreateOperation
BfsProcessCreatePolicyEntryRequest
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyRequest
BfsRemovePolicyEntry
BfsUninitializePolicyTable
|
Expand for full list:
BfsCheckAndApplyPolicy
BfsCheckAndReleaseIdlePolicy
BfsCheckPolicyAndPerformRenameAsUser
BfsDeleteFileFromGlobalFileTable
BfsFreePreloadList
BfsGetPolicyEntry
BfsGetPolicyEntryLocked
BfsGetRegistryPrefix
BfsInsertNotPresentPolicyEntry
BfsInsertNotPresentPolicyEntryLocked
BfsInsertPolicyEntryBfsInsertPolicyEntryLocked
BfsPerformPrompt
BfsPostCreateOperation
BfsProcessCreatePolicyEntryRequest
BfsProcessHardLink
BfsProcessQueryPolicyRequest
BfsProcessQueryPolicySizeRequest
BfsProcessSetPolicyRequest
BfsRemovePolicyEntry
BfsUninitializePolicyTable
| |paramcount|2|2| |`address`|1400067d0|140006a64| |sig|undefined __fastcall BfsDereferencePolicyEntryEx(longlong param_1, char param_2)|undefined __fastcall BfsDereferencePolicyEntryEx(longlong param_1, char param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsDereferencePolicyEntryEx Calling Diff ```diff --- BfsDereferencePolicyEntryEx calling +++ BfsDereferencePolicyEntryEx calling @@ -9 +8,0 @@ -BfsGetRegistryPrefixEx @@ -16,0 +16 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::ExAllocatePool2 ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|ExAllocatePool2|ExAllocatePool2| |fullname|NTOSKRNL.EXE::ExAllocatePool2|NTOSKRNL.EXE::ExAllocatePool2| |`refcount`|91|94| |length|0|0| |called||| |`calling`|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAdjustRegistryKeySecurity
BfsAllocateAndConcatenatePath
BfsAllocateTableEntry
BfsApplyPolicyAsUser
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsCreateDirectory
BfsCreateGlobalFileEntry
BfsCreatePolicyStorageDescriptorBfsCreateStorage
BfsEnumeratePolicy
BfsExpandDirectory
BfsGetPublisherIdFromToken
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInitializePipeMappingTable
BfsInitializePolicyTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertNotPresentPolicyEntryLocked
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenRootDirectory
BfsPerformPrompt
BfsPolicyEntryExists
BfsPolicyEntryExistsLocked
BfsPreCreateOperation
BfsPreloadPolicyEntriesForDeleteList
BfsProcessSetPolicyRequest
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryPreCreateCallback
BfsRemoveKeyValues
BfsSetApplicableCapabilitySid
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
KappxParsePackageFullNameFromToken
MIDL_user_allocate
|
Expand for full list:
BfsAccessRegistryKeyAsUserCallback
BfsAdjustRegistryKeySecurity
BfsAllocateAndConcatenatePath
BfsAllocateTableEntry
BfsApplyPolicyAsUser
BfsBuildPathFromComponents
BfsCalculateRegistryPrefix
BfsCheckAndApplyPolicy
BfsCreateDirectory
BfsCreateGlobalFileEntry
BfsCreatePolicyStorageDescriptorBfsCreateStorage
BfsEnumeratePolicy
BfsExpandDirectory
BfsGetPublisherIdFromToken
BfsInitializeBootDevice
BfsInitializeGlobalFileTable
BfsInitializePipeMappingTable
BfsInitializePolicyTable
BfsInsertDirectory
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD
BfsInsertNamedPipeMapping
BfsInsertNotPresentPolicyEntry
BfsInsertNotPresentPolicyEntryLocked
BfsInsertPolicyEntry
BfsInsertPolicyEntryLocked
BfsLoadUserPolicyEntriesToGlobalFileTable
BfsOpenRootDirectory
BfsPerformPrompt
BfsPolicyEntryExists
BfsPolicyEntryExistsLocked
BfsPreCreateOperation
BfsPreloadPolicyEntriesForDeleteList
BfsProcessSetPolicyRequest
BfsReadDeleteThresholdFromRegistry
BfsRedirectNamedPipe
BfsRegistryPreCreateCallback
BfsRemoveKeyValues
BfsResolveReparseTarget
BfsSetApplicableCapabilitySid
BfsUpdateGlobalFilePolicy
BfsUpdatePolicySecurity
BfsUpdateUserPolicyDirectorySecurity
BfsVerifyPolicySecurity
BfsVerifyVolumeRootDescriptor
KappxParsePackageFullNameFromToken
MIDL_user_allocate
| |paramcount|0|0| |`address`|EXTERNAL:00000084|EXTERNAL:00000087| |sig|undefined ExAllocatePool2(void)|undefined ExAllocatePool2(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAllocatePool2 Calling Diff ```diff --- NTOSKRNL.EXE::ExAllocatePool2 calling +++ NTOSKRNL.EXE::ExAllocatePool2 calling @@ -21,0 +22 @@ +BfsInsertDirectoryEntry_OLD @@ -38,0 +40 @@ +BfsResolveReparseTarget ``` ## BfsFreeBlock ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|BfsFreeBlock|BfsFreeBlock| |fullname|BfsFreeBlock|BfsFreeBlock| |`refcount`|3|4| |length|78|78| |called|NTOSKRNL.EXE::RtlClearBits
NTOSKRNL.EXE::RtlTestBit|NTOSKRNL.EXE::RtlClearBits
NTOSKRNL.EXE::RtlTestBit| |`calling`|BfsExpandDirectory
BfsInsertDirectoryEntry|BfsExpandDirectory
BfsInsertDirectoryEntry
BfsInsertDirectoryEntry_OLD| |paramcount|2|2| |`address`|140013c08|140013dbc| |sig|undefined8 __fastcall BfsFreeBlock(longlong param_1, undefined4 param_2)|undefined8 __fastcall BfsFreeBlock(longlong param_1, undefined4 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BfsFreeBlock Calling Diff ```diff --- BfsFreeBlock calling +++ BfsFreeBlock calling @@ -2,0 +3 @@ +BfsInsertDirectoryEntry_OLD ``` ## NTOSKRNL.EXE::PsDereferenceImpersonationToken ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|PsDereferenceImpersonationToken|PsDereferenceImpersonationToken| |fullname|NTOSKRNL.EXE::PsDereferenceImpersonationToken|NTOSKRNL.EXE::PsDereferenceImpersonationToken| |`refcount`|8|9| |length|0|0| |called||| |`calling`|BfsImpersonateToken
BfsImpersonateUser
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessRename
BfsRegistryCallback
BfsRevertTokenImpersonation|BfsImpersonateToken
BfsImpersonateUser
BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessHardLink
BfsProcessRename
BfsRegistryCallback
BfsRevertTokenImpersonation| |paramcount|0|0| |`address`|EXTERNAL:0000007c|EXTERNAL:0000007d| |sig|undefined PsDereferenceImpersonationToken(void)|undefined PsDereferenceImpersonationToken(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::PsDereferenceImpersonationToken Calling Diff ```diff --- NTOSKRNL.EXE::PsDereferenceImpersonationToken calling +++ NTOSKRNL.EXE::PsDereferenceImpersonationToken calling @@ -4,0 +5 @@ +BfsProcessHardLink ``` ## NTOSKRNL.EXE::IoGetCurrentProcess ### Match Info |Key|bfs-10.0.26100.8521.sys - bfs-10.0.26100.8875.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|bfs-10.0.26100.8521.sys|bfs-10.0.26100.8875.sys| | :---: | :---: | :---: | |name|IoGetCurrentProcess|IoGetCurrentProcess| |fullname|NTOSKRNL.EXE::IoGetCurrentProcess|NTOSKRNL.EXE::IoGetCurrentProcess| |`refcount`|5|6| |length|0|0| |called||| |`calling`|BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessRename
BfsRegistryCallback|BfsPreCreateOperation
BfsPreCreatePipeOperation
BfsProcessHardLink
BfsProcessRename
BfsRegistryCallback| |paramcount|0|0| |`address`|EXTERNAL:00000081|EXTERNAL:00000082| |sig|undefined IoGetCurrentProcess(void)|undefined IoGetCurrentProcess(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::IoGetCurrentProcess Calling Diff ```diff --- NTOSKRNL.EXE::IoGetCurrentProcess calling +++ NTOSKRNL.EXE::IoGetCurrentProcess calling @@ -2,0 +3 @@ +BfsProcessHardLink ``` Generated with `ghidriff` version: 1.0.0 on 2026-07-27T19:10:26