# ci_8737.dll-ci_8875.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [RtlStringCchCatW](#rtlstringcchcatw) * [RtlStringCopyWorkerW](#rtlstringcopyworkerw) * [Feature_1311764795__private_IsEnabledDeviceUsageNoInline](#feature_1311764795__private_isenableddeviceusagenoinline) * [Feature_1311764795__private_IsEnabledFallback](#feature_1311764795__private_isenabledfallback) * [SIPolicyCheckVerBlock](#sipolicycheckverblock) * [SIPolicyGetVersionInfo](#sipolicygetversioninfo) * [SIPolicyQuerySubVerBlock](#sipolicyquerysubverblock) * [SIPolicyQueryVersionFields](#sipolicyqueryversionfields) * [SIPolicyQueryVersionStrings](#sipolicyqueryversionstrings) * [Modified](#modified) * [RtlStringLengthWorkerW](#rtlstringlengthworkerw) * [RtlStringCchLengthW](#rtlstringcchlengthw) * [SIPolicyGetOriginalFilenameAndVersionFromImageBase](#sipolicygetoriginalfilenameandversionfromimagebase) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [RtlCompareUnicodeString](#rtlcompareunicodestring) * [RtlStringCbLengthW](#rtlstringcblengthw) * [__security_check_cookie](#__security_check_cookie) * [RtlInitUnicodeString](#rtlinitunicodestring) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [memset](#memset) # Visual Chart Diff ```mermaid flowchart LR RtlStringLengthWorkerW-3-old<--Match 98%-->RtlStringLengthWorkerW-3-new RtlStringCchLengthW-3-old<--Match 96%-->RtlStringCchLengthW-3-new SIPolicyGetOriginalFilenameAndVersionFromImageBase-9-old<--Match 97%-->SIPolicyGetOriginalFilenameAndVersionFromImageBase-9-new subgraph ci_8875.dll RtlStringLengthWorkerW-3-new RtlStringCchLengthW-3-new SIPolicyGetOriginalFilenameAndVersionFromImageBase-9-new subgraph Added direction LR RtlStringCchCatW RtlStringCopyWorkerW Feature_1311764795__private_IsEnabledDeviceUsageNoInline Feature_1311764795__private_IsEnabledFallback SIPolicyCheckVerBlock SIPolicyGetVersionInfo SIPolicyQuerySubVerBlock SIPolicyQueryVersionFields SIPolicyQueryVersionStrings end end subgraph ci_8737.dll RtlStringLengthWorkerW-3-old RtlStringCchLengthW-3-old SIPolicyGetOriginalFilenameAndVersionFromImageBase-9-old end ``` ```mermaid pie showData title Function Matches - 99.8397% "unmatched_funcs_len" : 9 "matched_funcs_len" : 5606 ``` ```mermaid pie showData title Matched Function Similarity - 99.8216% "matched_funcs_with_code_changes_len" : 3 "matched_funcs_with_non_code_changes_len" : 7 "matched_funcs_no_changes_len" : 5596 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 ci_8737.dll ci_8875.dll ``` #### Verbose Args

``` --old ['ci_8737.dll'] --new [['ci_8875.dll']] --engine VersionTrackingDiff --output-path ci_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/ci.dll/A1FCF91E119000/ci.dll -O ci.dll.x64.10.0.26100.8737 wget https://msdl.microsoft.com/download/symbols/ci.dll/F25A475E119000/ci.dll -O ci.dll.x64.10.0.26100.8875 ``` ## Binary Metadata Diff ```diff --- ci_8737.dll Meta +++ ci_8875.dll Meta @@ -1,44 +1,44 @@ -Program Name: ci_8737.dll +Program Name: ci_8875.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 1155296 +# of Bytes: 1155304 # of Memory Blocks: 17 -# of Instructions: 189073 -# of Defined Data: 10468 -# of Functions: 2803 -# of Symbols: 25803 +# of Instructions: 189599 +# of Defined Data: 10491 +# of Functions: 2812 +# of Symbols: 25890 # of Data Types: 400 # of Data Type Categories: 27 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Fri Aug 21 21:32:39 SGT 2026 +Date Created: Fri Aug 21 21:32:42 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/ci/ci_8737.dll -Executable MD5: fff104a8088c7edb3b1774bdfcc741bc -Executable SHA256: ac205af767df30ce6e7b6614097c301898d0143863aaaaaa1dce500bc6ab3b70 -FSRL: file:///tmp/ci/ci_8737.dll?MD5=fff104a8088c7edb3b1774bdfcc741bc +Executable Location: /tmp/ci/ci_8875.dll +Executable MD5: dcc1abb8259b499ed8c5f76976529ac3 +Executable SHA256: 18cc08a6bb3d0a1d4c7e503e7f9c79a2a100fe67f6352910cdad47944d3f8eb5 +FSRL: file:///tmp/ci/ci_8875.dll?MD5=dcc1abb8259b499ed8c5f76976529ac3 PDB Age: 1 PDB File: ci.pdb -PDB GUID: 9e30775a-de4c-d780-9fe1-2a05a0fbbba3 +PDB GUID: 13ac0731-e18b-da5c-29d9-7e457e6cc4cd PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Code Integrity Module -PE Property[FileVersion]: 10.0.26100.8737 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8875 (WinBuild.160101.0800) PE Property[InternalName]: ci.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: ci.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8737 +PE Property[ProductVersion]: 10.0.26100.8875 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra ci_8737.dll Decompiler Options

Ghidra ci_8737.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra ci_8737.dll Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra ci_8875.dll Decompiler Options

Ghidra ci_8875.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra ci_8875.dll Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|9| |deleted_funcs_len|0| |modified_funcs_len|10| |added_symbols_len|9| |deleted_symbols_len|6| |diff_time|5.21396803855896| |deleted_strings_len|0| |added_strings_len|1| |match_types|Counter({'SymbolsHash': 2795, 'ExternalsName': 268, 'ExactBytesFunctionHasher': 4, 'ExactInstructionsFunctionHasher': 1, 'BSIM': 1})| |items_to_process|34| |diff_types|Counter({'refcount': 8, 'address': 7, 'calling': 7, 'code': 3, 'length': 3, 'sig': 1, 'called': 1})| |unmatched_funcs_len|9| |total_funcs_len|5615| |matched_funcs_len|5606| |matched_funcs_with_code_changes_len|3| |matched_funcs_with_non_code_changes_len|7| |matched_funcs_no_changes_len|5596| |match_func_similarity_percent|99.8216%| |func_match_overall_percent|99.8397%| |first_matches|Counter({'SymbolsHash': 2795, 'ExactBytesFunctionHasher': 4, 'ExactInstructionsFunctionHasher': 1, 'BSIM': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 2795 "ExternalsName" : 268 "ExactBytesFunctionHasher" : 4 "ExactInstructionsFunctionHasher" : 1 "BSIM" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 2795 "ExactBytesFunctionHasher" : 4 "ExactInstructionsFunctionHasher" : 1 "BSIM" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 9 "deleted_funcs_len" : 0 "modified_funcs_len" : 10 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 9 "deleted_symbols_len" : 6 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 1 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1 @@ +u ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_0123456789abcdef_180035530|10|SIPolicyQueryVersionStrings| # Deleted # Added ## RtlStringCchCatW ### Function Meta |Key|ci_8875.dll| | :---: | :---: | |name|RtlStringCchCatW| |fullname|RtlStringCchCatW| |refcount|2| |length|83| |called|RtlStringCopyWorkerW
RtlStringLengthWorkerW| |calling|SIPolicyQueryVersionFields| |paramcount|3| |address|180018f48| |sig|undefined __fastcall RtlStringCchCatW(short * param_1, undefined8 param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- RtlStringCchCatW +++ RtlStringCchCatW @@ -0,0 +1,19 @@ + +void RtlStringCchCatW(short *param_1,undefined8 param_2,longlong param_3) + +{ + uint uVar1; + longlong *plVar2; + longlong lVar3; + longlong local_res10 [3]; + + local_res10[0] = 0; + lVar3 = 0x80; + plVar2 = local_res10; + uVar1 = RtlStringLengthWorkerW(param_1,0x80,plVar2); + if (-1 < (int)uVar1) { + RtlStringCopyWorkerW(param_1 + local_res10[0],lVar3 - local_res10[0],plVar2,param_3); + } + return; +} + ``` ## RtlStringCopyWorkerW ### Function Meta |Key|ci_8875.dll| | :---: | :---: | |name|RtlStringCopyWorkerW| |fullname|RtlStringCopyWorkerW| |refcount|2| |length|82| |called|| |calling|RtlStringCchCatW| |paramcount|4| |address|180018fd8| |sig|uint __fastcall RtlStringCopyWorkerW(short * param_1, longlong param_2, undefined8 param_3, longlong param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- RtlStringCopyWorkerW +++ RtlStringCopyWorkerW @@ -0,0 +1,28 @@ + +uint RtlStringCopyWorkerW(short *param_1,longlong param_2,undefined8 param_3,longlong param_4) + +{ + short sVar1; + longlong lVar2; + short *psVar3; + longlong lVar4; + + if (param_2 != 0) { + lVar2 = 0x7ffffffe; + lVar4 = param_4 - (longlong)param_1; + do { + if ((lVar2 == 0) || (sVar1 = *(short *)(lVar4 + (longlong)param_1), sVar1 == 0)) break; + *param_1 = sVar1; + lVar2 = lVar2 + -1; + param_1 = param_1 + 1; + param_2 = param_2 + -1; + } while (param_2 != 0); + } + psVar3 = param_1 + -1; + if (param_2 != 0) { + psVar3 = param_1; + } + *psVar3 = 0; + return ~-(uint)(param_2 != 0) & 0x80000005; +} + ``` ## Feature_1311764795__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|ci_8875.dll| | :---: | :---: | |name|Feature_1311764795__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1311764795__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_1311764795__private_IsEnabledFallback| |calling|SIPolicyGetOriginalFilenameAndVersionFromImageBase| |paramcount|0| |address|18001be30| |sig|ulonglong __fastcall Feature_1311764795__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1311764795__private_IsEnabledDeviceUsageNoInline +++ Feature_1311764795__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_1311764795__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_1311764795__private_featureState; + if ((Feature_1311764795__private_featureState & 0x10) == 0) { + uVar1 = Feature_1311764795__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_1311764795__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_1311764795__private_IsEnabledFallback ### Function Meta |Key|ci_8875.dll| | :---: | :---: | |name|Feature_1311764795__private_IsEnabledFallback| |fullname|Feature_1311764795__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1311764795__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|18001be68| |sig|undefined __fastcall Feature_1311764795__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1311764795__private_IsEnabledFallback +++ Feature_1311764795__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1311764795__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1311764795__private_descriptor); + return; +} + ``` ## SIPolicyCheckVerBlock ### Function Meta |Key|ci_8875.dll| | :---: | :---: | |name|SIPolicyCheckVerBlock| |fullname|SIPolicyCheckVerBlock| |refcount|3| |length|122| |called|RtlStringCbLengthW| |calling|SIPolicyQuerySubVerBlock| |paramcount|2| |address|180079e0c| |sig|longlong __fastcall SIPolicyCheckVerBlock(ushort * param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- SIPolicyCheckVerBlock +++ SIPolicyCheckVerBlock @@ -0,0 +1,29 @@ + +longlong SIPolicyCheckVerBlock(ushort *param_1,uint param_2) + +{ + ushort uVar1; + uint uVar2; + longlong lVar3; + longlong local_res18 [2]; + + lVar3 = 0; + local_res18[0] = 0; + if (7 < param_2) { + uVar1 = *param_1; + if ((7 < uVar1) && (uVar1 <= param_2)) { + uVar2 = RtlStringCbLengthW((short *)(param_1 + 3),(ulonglong)uVar1 - 6,local_res18); + if ((-1 < (int)uVar2) && + (uVar2 = ((int)local_res18[0] + 0xbU & 0xfffffffc) + (uint)param_1[1], uVar2 <= *param_1)) + { + uVar2 = uVar2 + 3 & 0xfffffffc; + if (param_2 < uVar2) { + uVar2 = param_2; + } + lVar3 = (ulonglong)uVar2 + (longlong)param_1; + } + } + } + return lVar3; +} + ``` ## SIPolicyGetVersionInfo ### Function Meta |Key|ci_8875.dll| | :---: | :---: | |name|SIPolicyGetVersionInfo| |fullname|SIPolicyGetVersionInfo| |refcount|2| |length|155| |called|SIPolicyQuerySubVerBlock
SIPolicyQueryVersionStrings| |calling|SIPolicyGetOriginalFilenameAndVersionFromImageBase| |paramcount|6| |address|180079e90| |sig|undefined8 __fastcall SIPolicyGetVersionInfo(ushort * param_1, uint param_2, undefined8 * param_3, undefined8 param_4, undefined8 param_5, longlong * param_6)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- SIPolicyGetVersionInfo +++ SIPolicyGetVersionInfo @@ -0,0 +1,32 @@ + +undefined8 +SIPolicyGetVersionInfo + (ushort *param_1,uint param_2,undefined8 *param_3,undefined8 param_4,ushort *param_5, + longlong *param_6) + +{ + char cVar1; + undefined8 uVar2; + longlong *plVar3; + ulonglong local_res20; + + param_5 = (ushort *)0x0; + local_res20 = 0; + if ((((0x5b < param_2) && (0x5b < *param_1)) && (*param_1 <= param_2)) && + (*(int *)(param_1 + 0x14) == -0x110fb43)) { + if (param_3 != (undefined8 *)0x0) { + *param_3 = CONCAT44(*(undefined4 *)(param_1 + 0x18),*(undefined4 *)(param_1 + 0x1a)); + } + plVar3 = (longlong *)¶m_5; + uVar2 = SIPolicyQuerySubVerBlock(param_1,L"\\VarFileInfo\\Translation",plVar3,&local_res20); + if ((int)uVar2 < 0) { + return uVar2; + } + if (((3 < local_res20) && (((ulonglong)param_5 & 1) == 0)) && + (cVar1 = SIPolicyQueryVersionStrings(param_1,param_5,plVar3,param_6), cVar1 != '\0')) { + return 0; + } + } + return 0xc0000225; +} + ``` ## SIPolicyQuerySubVerBlock ### Function Meta |Key|ci_8875.dll| | :---: | :---: | |name|SIPolicyQuerySubVerBlock| |fullname|SIPolicyQuerySubVerBlock| |refcount|3| |length|435| |called|RtlCompareUnicodeString
RtlInitUnicodeString
SIPolicyCheckVerBlock| |calling|SIPolicyGetVersionInfo
SIPolicyQueryVersionFields| |paramcount|4| |address|180079f34| |sig|undefined8 __fastcall SIPolicyQuerySubVerBlock(ushort * param_1, short * param_2, longlong * param_3, ulonglong * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- SIPolicyQuerySubVerBlock +++ SIPolicyQuerySubVerBlock @@ -0,0 +1,94 @@ + +undefined8 +SIPolicyQuerySubVerBlock(ushort *param_1,short *param_2,longlong *param_3,ulonglong *param_4) + +{ + ushort uVar1; + short sVar2; + int iVar3; + uint uVar4; + ushort *puVar5; + longlong lVar6; + ulonglong uVar7; + ulonglong uVar8; + uint uVar9; + uint uVar10; + ulonglong uVar11; + short *psVar12; + ushort *puVar13; + undefined8 local_48; + short *psStack_40; + undefined8 local_38; + undefined8 uStack_30; + + local_48 = 0; + psStack_40 = (short *)0x0; + local_38 = 0; + uStack_30 = 0; + if (((param_1[2] == 0) && ((ushort)(*param_1 - 8) < 0x7ff9)) && ((*param_1 & 1) == 0)) { + uVar11 = 2; + while( true ) { + while (psVar12 = param_2, *psVar12 == 0x5c) { + param_2 = psVar12 + 1; + } + puVar5 = (ushort *)SIPolicyCheckVerBlock(param_1,(uint)*param_1); + if (puVar5 == (ushort *)0x0) break; + sVar2 = *psVar12; + param_2 = psVar12; + if (sVar2 == 0) { + uVar8 = 0xffffffffffffffff; + do { + uVar7 = uVar8 + 1; + lVar6 = uVar8 + 4; + uVar8 = uVar7; + } while (param_1[lVar6] != 0); + uVar1 = param_1[1]; + uVar9 = (uint)uVar1; + uVar10 = (int)uVar7 * 2 + 0xbU & 0xfffffffc; + if ((uVar1 == 0) || ((param_1[2] == 0 && (uVar1 < 2)))) { + uVar8 = ((uVar7 & 0xffffffff) + 3) * 2; + } + else { + if (param_1[2] == 1) { + uVar4 = *param_1 - uVar10; + uVar9 = (uint)uVar1 * 2; + if (uVar4 <= (uint)uVar1 * 2) { + uVar9 = uVar4; + } + uVar9 = uVar9 & 0xfffffffe; + } + uVar8 = (ulonglong)uVar10; + uVar11 = (ulonglong)uVar9; + } + *param_4 = uVar11; + *param_3 = uVar8 + (longlong)param_1; + return 0; + } + do { + if (sVar2 == 0x5c) break; + param_2 = param_2 + 1; + sVar2 = *param_2; + } while (sVar2 != 0); + puVar13 = (ushort *)((ulonglong)*param_1 + (longlong)param_1); + param_1 = puVar5; + while( true ) { + lVar6 = SIPolicyCheckVerBlock(param_1,(int)puVar13 - (int)param_1); + if (lVar6 == 0) { + return 0xc0000225; + } + RtlInitUnicodeString(&local_38,param_1 + 3); + sVar2 = (short)param_2 - (short)psVar12; + local_48._0_4_ = CONCAT22(sVar2,sVar2); + psStack_40 = psVar12; + iVar3 = RtlCompareUnicodeString(&local_48,&local_38,1); + if (iVar3 == 0) break; + param_1 = (ushort *)((longlong)param_1 + ((ulonglong)*param_1 + 3 & 0xfffffffffffffffc)); + if (puVar13 <= param_1) { + return 0xc0000225; + } + } + } + } + return 0xc0000225; +} + ``` ## SIPolicyQueryVersionFields ### Function Meta |Key|ci_8875.dll| | :---: | :---: | |name|SIPolicyQueryVersionFields| |fullname|SIPolicyQueryVersionFields| |refcount|3| |length|307| |called|RtlStringCbLengthW
RtlStringCchCatW
SIPolicyQuerySubVerBlock| |calling|SIPolicyQueryVersionStrings| |paramcount|5| |address|18007a0f0| |sig|undefined1 __fastcall SIPolicyQueryVersionFields(ushort * param_1, short * param_2, undefined8 param_3, undefined8 param_4, longlong * param_5)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- SIPolicyQueryVersionFields +++ SIPolicyQueryVersionFields @@ -0,0 +1,67 @@ + +undefined1 +SIPolicyQueryVersionFields + (ushort *param_1,short *param_2,undefined8 param_3,undefined8 param_4,longlong *param_5) + +{ + short *psVar1; + int iVar2; + uint uVar3; + undefined8 uVar4; + short *psVar5; + undefined1 uVar6; + uint uVar7; + ulonglong uVar8; + short *psVar9; + short *psVar10; + longlong lVar11; + ulonglong local_res20; + short *local_38 [2]; + + uVar7 = 0; + uVar6 = 0; + uVar8 = 0xffffffffffffffff; + do { + uVar8 = uVar8 + 1; + } while (param_2[uVar8] != 0); + lVar11 = (longlong)&PTR_u_OriginalFileNam_18002e6f8 - (longlong)param_5; + psVar5 = param_2; + do { + local_38[0] = (short *)0x0; + local_res20 = 0; + if ((*param_5 != 0) && (*(longlong *)(*param_5 + 8) == 0)) { + param_2[uVar8 & 0xffffffff] = 0; + iVar2 = RtlStringCchCatW(param_2,psVar5,*(longlong *)(lVar11 + (longlong)param_5)); + if (iVar2 < 0) { + return uVar6; + } + psVar5 = param_2; + uVar4 = SIPolicyQuerySubVerBlock(param_1,param_2,(longlong *)local_38,&local_res20); + psVar1 = local_38[0]; + psVar9 = (short *)(local_res20 & 0xfffffffffffffffe); + if ((-1 < (int)uVar4) && ((longlong)psVar9 - 1U < 0xffff)) { + local_res20 = 0; + psVar10 = psVar9; + uVar3 = RtlStringCbLengthW(local_38[0],(ulonglong)psVar9,(longlong *)&local_res20); + psVar5 = psVar9; + if ((int)uVar3 < 0) { + *(short *)*param_5 = (short)psVar10; + } + else { + if (local_res20 == 0) goto LAB_18007a1f4; + *(short *)*param_5 = (short)local_res20; + } + uVar6 = 1; + *(short **)(*param_5 + 8) = psVar1; + *(short *)(*param_5 + 2) = (short)psVar10; + } + } +LAB_18007a1f4: + uVar7 = uVar7 + 1; + param_5 = param_5 + 1; + if (4 < uVar7) { + return uVar6; + } + } while( true ); +} + ``` ## SIPolicyQueryVersionStrings ### Function Meta |Key|ci_8875.dll| | :---: | :---: | |name|SIPolicyQueryVersionStrings| |fullname|SIPolicyQueryVersionStrings| |refcount|2| |length|549| |called|SIPolicyQueryVersionFields
__security_check_cookie
memset| |calling|SIPolicyGetVersionInfo| |paramcount|4| |address|18007a22c| |sig|char __fastcall SIPolicyQueryVersionStrings(ushort * param_1, ushort * param_2, undefined8 param_3, longlong * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- SIPolicyQueryVersionStrings +++ SIPolicyQueryVersionStrings @@ -0,0 +1,110 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +char SIPolicyQueryVersionStrings + (ushort *param_1,ushort *param_2,undefined8 param_3,longlong *param_4) + +{ + ushort uVar1; + wchar_t wVar2; + undefined *puVar3; + char cVar4; + char cVar5; + wchar_t *pwVar6; + wchar_t *pwVar7; + uint uVar8; + uint uVar9; + ushort *puVar10; + undefined **ppuVar11; + undefined8 uVar12; + longlong *plVar13; + longlong lVar14; + undefined1 auStackY_188 [32]; + ushort local_158 [8]; + wchar_t local_148 [18]; + wchar_t local_124; + wchar_t local_122; + wchar_t local_120; + wchar_t local_11e; + wchar_t local_11c; + wchar_t local_11a; + undefined4 local_118; + ulonglong local_48; + + local_48 = __security_cookie ^ (ulonglong)auStackY_188; + uVar9 = 0; + builtin_wcsncpy(local_148,L"\\StringFileInfo\\",0x11); + uVar12 = 0xde; + cVar5 = '\0'; + plVar13 = param_4; + memset(local_148 + 0x11,0,0xde); + puVar10 = local_158; + local_158[0] = param_2[1]; + lVar14 = 3; + local_158[1] = 0x4e4; + local_158[2] = 0x4b0; + do { + uVar1 = *param_2; + local_118 = 0x5c; + local_148[0x10] = L"0123456789abcdef"[uVar1 >> 0xc]; + local_148[0x11] = L"0123456789abcdef"[uVar1 >> 8 & 0xf]; + local_124 = L"0123456789abcdef"[uVar1 >> 4 & 0xf]; + local_122 = L"0123456789abcdef"[uVar1 & 0xf]; + uVar1 = *puVar10; + local_120 = L"0123456789abcdef"[uVar1 >> 0xc]; + local_11e = L"0123456789abcdef"[uVar1 >> 8 & 0xf]; + local_11c = L"0123456789abcdef"[uVar1 >> 4 & 0xf]; + local_11a = L"0123456789abcdef"[uVar1 & 0xf]; + cVar4 = SIPolicyQueryVersionFields(param_1,local_148,uVar12,plVar13,param_4); + plVar13 = (longlong *)0x1; + puVar10 = puVar10 + 1; + if (cVar4 != '\0') { + cVar5 = '\x01'; + } + lVar14 = lVar14 + -1; + } while (lVar14 != 0); + plVar13 = param_4; + uVar8 = uVar9; + if (cVar5 == '\0') { +LAB_18007a3a9: + ppuVar11 = &PTR_u__StringFileInfo_18002ecb0; + do { + puVar3 = *ppuVar11; + pwVar7 = local_148; + lVar14 = 0x80; + do { + if ((lVar14 == -0x7fffff7e) || + (wVar2 = *(wchar_t *)(((longlong)puVar3 - (longlong)local_148) + (longlong)pwVar7), + wVar2 == L'\0')) break; + *pwVar7 = wVar2; + pwVar7 = pwVar7 + 1; + lVar14 = lVar14 + -1; + } while (lVar14 != 0); + pwVar6 = pwVar7 + -1; + if (lVar14 != 0) { + pwVar6 = pwVar7; + } + *pwVar6 = L'\0'; + if (lVar14 == 0) { + return cVar5; + } + cVar4 = SIPolicyQueryVersionFields + (param_1,local_148,(longlong)puVar3 - (longlong)local_148,1,param_4); + if (cVar4 != '\0') { + cVar5 = '\x01'; + } + uVar9 = uVar9 + 1; + ppuVar11 = ppuVar11 + 1; + } while (uVar9 < 3); + } + else { + do { + if ((*plVar13 != 0) && (*(longlong *)(*plVar13 + 8) == 0)) goto LAB_18007a3a9; + uVar8 = uVar8 + 1; + plVar13 = plVar13 + 1; + } while (uVar8 < 5); + cVar5 = '\x01'; + } + return cVar5; +} + ``` # Modified *Modified functions contain code changes* ## RtlStringLengthWorkerW ### Match Info |Key|ci_8737.dll - ci_8875.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.9| |i_ratio|0.74| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|ci_8737.dll|ci_8875.dll| | :---: | :---: | :---: | |name|RtlStringLengthWorkerW|RtlStringLengthWorkerW| |fullname|RtlStringLengthWorkerW|RtlStringLengthWorkerW| |`refcount`|2|3| |`length`|64|58| |called||| |`calling`|RtlStringCchLengthW|RtlStringCchCatW
RtlStringCchLengthW| |paramcount|3|3| |`address`|180018f78|180019034| |`sig`|uint __fastcall RtlStringLengthWorkerW(short * param_1, undefined8 param_2, longlong * param_3)|uint __fastcall RtlStringLengthWorkerW(short * param_1, longlong param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RtlStringLengthWorkerW Calling Diff ```diff --- RtlStringLengthWorkerW calling +++ RtlStringLengthWorkerW calling @@ -0,0 +1 @@ +RtlStringCchCatW ``` ### RtlStringLengthWorkerW Diff ```diff --- RtlStringLengthWorkerW +++ RtlStringLengthWorkerW @@ -1,24 +1,24 @@ -uint RtlStringLengthWorkerW(short *param_1,undefined8 param_2,longlong *param_3) +uint RtlStringLengthWorkerW(short *param_1,longlong param_2,longlong *param_3) { uint uVar1; longlong lVar2; - lVar2 = 0x7ffffffe; + lVar2 = param_2; do { if (*param_1 == 0) break; param_1 = param_1 + 1; lVar2 = lVar2 + -1; } while (lVar2 != 0); uVar1 = ~-(uint)(lVar2 != 0) & 0xc000000d; if (param_3 != (longlong *)0x0) { if (lVar2 != 0) { - *param_3 = 0x7ffffffe - lVar2; + *param_3 = param_2 - lVar2; return uVar1; } *param_3 = 0; } return uVar1; } ``` ## RtlStringCchLengthW ### Match Info |Key|ci_8737.dll - ci_8875.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.94| |i_ratio|0.59| |m_ratio|0.96| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|ci_8737.dll|ci_8875.dll| | :---: | :---: | :---: | |name|RtlStringCchLengthW|RtlStringCchLengthW| |fullname|RtlStringCchLengthW|RtlStringCchLengthW| |refcount|2|2| |`length`|39|44| |called|RtlStringLengthWorkerW|RtlStringLengthWorkerW| |calling|SIPolicyStatusPrint|SIPolicyStatusPrint| |paramcount|3|3| |`address`|180018f48|180018fa4| |sig|uint __fastcall RtlStringCchLengthW(short * param_1, undefined8 param_2, longlong * param_3)|uint __fastcall RtlStringCchLengthW(short * param_1, undefined8 param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RtlStringCchLengthW Diff ```diff --- RtlStringCchLengthW +++ RtlStringCchLengthW @@ -1,21 +1,21 @@ uint RtlStringCchLengthW(short *param_1,undefined8 param_2,longlong *param_3) { uint uVar1; if (param_1 == (short *)0x0) { uVar1 = 0xc000000d; } else { - uVar1 = RtlStringLengthWorkerW(param_1,param_2,param_3); + uVar1 = RtlStringLengthWorkerW(param_1,0x7ffffffe,param_3); if (-1 < (int)uVar1) { return uVar1; } } if (param_3 != (longlong *)0x0) { *param_3 = 0; } return uVar1; } ``` ## SIPolicyGetOriginalFilenameAndVersionFromImageBase ### Match Info |Key|ci_8737.dll - ci_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.28| |i_ratio|0.73| |m_ratio|0.97| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|ci_8737.dll|ci_8875.dll| | :---: | :---: | :---: | |name|SIPolicyGetOriginalFilenameAndVersionFromImageBase|SIPolicyGetOriginalFilenameAndVersionFromImageBase| |fullname|SIPolicyGetOriginalFilenameAndVersionFromImageBase|SIPolicyGetOriginalFilenameAndVersionFromImageBase| |refcount|4|4| |`length`|924|974| |`called`|LdrResSearchResource
RtlInitUnicodeString
RtlStringCbCatW
RtlStringCbLengthW
RtlStringCbPrintfW
SIPolicyCanLoadResources
SIPolicyQuerySubVerBlock
__report_rangecheckfailure
__security_check_cookie|

Expand for full list:
Feature_1311764795__private_IsEnabledDeviceUsageNoInline
LdrResSearchResource
RtlInitUnicodeString
RtlStringCbCatW
RtlStringCbLengthW
RtlStringCbPrintfW
SIPolicyCanLoadResources
SIPolicyGetVersionInfo
SIPolicyQuerySubVerBlock
__report_rangecheckfailure
__security_check_cookie

| |calling|CipMitigatePPLBypassThroughInterpreters
CipTryGetProcessAppID
SIPolicyGetOriginalFilenameAndVersionFromImage|CipMitigatePPLBypassThroughInterpreters
CipTryGetProcessAppID
SIPolicyGetOriginalFilenameAndVersionFromImage| |paramcount|9|9| |`address`|180093068|1800936b8| |sig|ulonglong __fastcall SIPolicyGetOriginalFilenameAndVersionFromImageBase(ulonglong param_1, uint param_2, char param_3, longlong param_4, undefined8 * param_5, undefined8 param_6, undefined8 param_7, undefined8 param_8, undefined8 param_9)|ulonglong __fastcall SIPolicyGetOriginalFilenameAndVersionFromImageBase(ulonglong param_1, uint param_2, char param_3, longlong param_4, undefined8 * param_5, undefined8 param_6, undefined8 param_7, undefined8 param_8, undefined8 param_9)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SIPolicyGetOriginalFilenameAndVersionFromImageBase Called Diff ```diff --- SIPolicyGetOriginalFilenameAndVersionFromImageBase called +++ SIPolicyGetOriginalFilenameAndVersionFromImageBase called @@ -0,0 +1 @@ +Feature_1311764795__private_IsEnabledDeviceUsageNoInline @@ -6,0 +8 @@ +SIPolicyGetVersionInfo ``` ### SIPolicyGetOriginalFilenameAndVersionFromImageBase Diff ```diff --- SIPolicyGetOriginalFilenameAndVersionFromImageBase +++ SIPolicyGetOriginalFilenameAndVersionFromImageBase @@ -1,173 +1,169 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong SIPolicyGetOriginalFilenameAndVersionFromImageBase (ulonglong param_1,uint param_2,char param_3,longlong param_4, undefined8 *param_5,undefined8 param_6,undefined8 param_7,undefined8 param_8, undefined8 param_9) { code *pcVar1; bool bVar2; ushort *puVar3; - undefined8 uVar4; - longlong *plVar5; - ulonglong uVar6; - longlong lVar7; - ulonglong uVar8; + int iVar4; + uint uVar5; + uint uVar6; + undefined8 uVar7; + longlong *plVar8; ulonglong uVar9; ulonglong uVar10; - ulonglong uVar11; - undefined1 auStack_1e8 [32]; - ushort **local_1c8; - ulonglong *local_1c0; - longlong local_1b8; - longlong local_1b0; - uint local_1a8; - undefined1 local_1a4; + longlong lVar11; + ulonglong uVar12; + ulonglong uVar13; + undefined1 auStackY_1e8 [32]; + ushort **ppuVar14; ulonglong local_1a0; ulonglong local_198; - uint local_190; - uint local_18c; - ushort *local_188; + ushort *local_190; + uint local_188; + uint local_184; short *local_180; ushort *local_178; - uint local_170 [4]; + uint local_170; + undefined4 local_16c; + undefined4 local_168; longlong local_160 [4]; undefined8 local_140; wchar_t local_138 [128]; ulonglong local_38; - local_38 = __security_cookie ^ (ulonglong)auStack_1e8; + local_38 = __security_cookie ^ (ulonglong)auStackY_1e8; local_178 = (ushort *)0x0; local_1a0 = 0; - local_188 = (ushort *)0x0; + local_190 = (ushort *)0x0; local_180 = (short *)0x0; local_198 = 0; - local_170[0] = 0; - local_170[1] = 0x4e4; - local_170[2] = 0x4b0; + local_170 = 0; + local_16c = 0x4e4; + local_168 = 0x4b0; bVar2 = false; local_160[0] = param_4; local_160[1] = param_8; local_160[2] = param_9; local_160[3] = param_6; local_140 = 0; if (param_5 != (undefined8 *)0x0) { *param_5 = 0; } - plVar5 = local_160; - lVar7 = 5; + plVar8 = local_160; + lVar11 = 5; do { - if (*plVar5 != 0) { - RtlInitUnicodeString(*plVar5,0); + if (*plVar8 != 0) { + RtlInitUnicodeString(*plVar8,0); } - plVar5 = plVar5 + 1; - lVar7 = lVar7 + -1; - } while (lVar7 != 0); - local_1a8 = SIPolicyCanLoadResources(param_1,(ulonglong)param_2,param_3); - if ((int)local_1a8 < 0) { - uVar6 = 0xc000001f; + plVar8 = plVar8 + 1; + lVar11 = lVar11 + -1; + } while (lVar11 != 0); + iVar4 = SIPolicyCanLoadResources(param_1,(ulonglong)param_2,param_3); + if (iVar4 < 0) { + uVar9 = 0xc000001f; } else { - local_1c0 = &local_198; - local_1c8 = &local_188; - local_1b8 = lVar7; - local_1b0 = lVar7; + uVar10 = (ulonglong)(-(uint)(param_3 != '\0') & 0x81210); + ppuVar14 = &local_190; local_198 = (ulonglong)param_2; - local_1a8 = LdrResSearchResource(param_1,&DAT_0,3,-(uint)(param_3 != '\0') & 0x81210); - uVar6 = (ulonglong)local_1a8; - if (-1 < (int)local_1a8) { - if (((0x5b < local_198) && (*local_188 <= local_198)) && - (*(int *)(local_188 + 0x14) == -0x110fb43)) { - if (param_5 != (undefined8 *)0x0) { - *param_5 = CONCAT44(*(undefined4 *)(local_188 + 0x18),*(undefined4 *)(local_188 + 0x1a)); - } - uVar6 = SIPolicyQuerySubVerBlock - (local_188,L"\\VarFileInfo\\Translation",(longlong *)&local_178,&local_1a0 - ); - puVar3 = local_178; - local_1a8 = (uint)uVar6; - uVar6 = uVar6 & 0xffffffff; - uVar9 = 0; - if ((int)local_1a8 < 0) { - return uVar6; - } - if ((3 < local_1a0) && ((~(uint)local_178 & 1) != 0)) { - local_170[0] = (uint)local_178[1]; - local_18c = 0; - do { - if (2 < (uint)uVar9) { - return uVar6; - } - local_1c8 = (ushort **)CONCAT44(local_1c8._4_4_,local_170[uVar9]); - local_1a8 = RtlStringCbPrintfW(local_138,0x100,L"\\StringFileInfo\\%04x%04x\\", - (ulonglong)*puVar3); - uVar6 = (ulonglong)local_1a8; - uVar8 = 0; - if ((int)local_1a8 < 0) { - return uVar6; - } - uVar11 = 0xffffffffffffffff; + uVar5 = LdrResSearchResource(param_1,&DAT_0,3); + uVar9 = (ulonglong)uVar5; + if (-1 < (int)uVar5) { + uVar9 = Feature_1311764795__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 == 0) { + if (((0x5b < local_198) && (*local_190 <= local_198)) && + (*(int *)(local_190 + 0x14) == -0x110fb43)) { + if (param_5 != (undefined8 *)0x0) { + *param_5 = CONCAT44(*(undefined4 *)(local_190 + 0x18),*(undefined4 *)(local_190 + 0x1a)) + ; + } + uVar9 = SIPolicyQuerySubVerBlock + (local_190,L"\\VarFileInfo\\Translation",(longlong *)&local_178, + &local_1a0); + puVar3 = local_178; + uVar10 = uVar9 & 0xffffffff; + if ((int)uVar9 < 0) { + return uVar10; + } + if ((3 < local_1a0) && ((~(uint)local_178 & 1) != 0)) { + local_170 = (uint)local_178[1]; + local_184 = 0; do { - uVar11 = uVar11 + 1; - } while (local_138[uVar11] != L'\0'); - local_190 = 0; - uVar10 = uVar8; - while ((uint)uVar8 < 5) { - lVar7 = local_160[uVar8]; - if (lVar7 != 0) { - if (0xff < (uVar11 & 0xffffffff) * 2) { - __report_rangecheckfailure(); - pcVar1 = (code *)swi(3); - uVar6 = (*pcVar1)(); - return uVar6; - } - local_138[uVar11 & 0xffffffff] = (wchar_t)uVar10; - local_1a8 = RtlStringCbCatW(local_138,0x100, - (longlong)(&PTR_u_OriginalFileNam_18002e6f8)[uVar8]); - if ((int)local_1a8 < 0) { - return (ulonglong)local_1a8; - } - uVar4 = SIPolicyQuerySubVerBlock - (local_188,local_138,(longlong *)&local_180,&local_1a0); - local_1a8 = (uint)uVar4; - uVar6 = 0; - uVar10 = uVar6; - if (((int)local_1a8 < 0) || (0xfffe < local_1a0 - 1)) { - local_1a8 = 0; - } - else { - bVar2 = true; - local_1a4 = 1; - local_1a8 = RtlStringCbLengthW(local_180,local_1a0 * 2,(longlong *)&local_1a0); - uVar6 = (ulonglong)local_1a8; - if (((int)local_1a8 < 0) || (local_1a0 == 0)) { - uVar6 = uVar10 & 0xffffffff; - local_1a8 = (uint)uVar10; + uVar5 = local_184; + if (2 < local_184) { + return uVar10; + } + uVar6 = RtlStringCbPrintfW(local_138,0x100,L"\\StringFileInfo\\%04x%04x\\", + (ulonglong)*puVar3); + uVar10 = (ulonglong)uVar6; + uVar9 = 0; + if ((int)uVar6 < 0) { + return uVar10; + } + uVar13 = 0xffffffffffffffff; + do { + uVar13 = uVar13 + 1; + } while (local_138[uVar13] != L'\0'); + local_188 = 0; + uVar12 = uVar9; + while ((uint)uVar9 < 5) { + lVar11 = local_160[uVar9]; + if (lVar11 != 0) { + if (0xff < (uVar13 & 0xffffffff) * 2) { + __report_rangecheckfailure(); + pcVar1 = (code *)swi(3); + uVar9 = (*pcVar1)(); + return uVar9; } - else { - local_1a0 = local_1a0 + 2; - RtlInitUnicodeString(lVar7,local_180); - uVar10 = 0; + local_138[uVar13 & 0xffffffff] = (wchar_t)uVar12; + uVar6 = RtlStringCbCatW(local_138,0x100, + (longlong)(&PTR_u_OriginalFileNam_18002e6f8)[uVar9]); + if ((int)uVar6 < 0) { + return (ulonglong)uVar6; + } + uVar7 = SIPolicyQuerySubVerBlock + (local_190,local_138,(longlong *)&local_180,&local_1a0); + uVar10 = 0; + uVar12 = uVar10; + if ((-1 < (int)uVar7) && (local_1a0 - 1 < 0xffff)) { bVar2 = true; + uVar6 = RtlStringCbLengthW(local_180,local_1a0 * 2,(longlong *)&local_1a0); + uVar10 = (ulonglong)uVar6; + if (((int)uVar6 < 0) || (local_1a0 == 0)) { + uVar10 = uVar12 & 0xffffffff; + } + else { + local_1a0 = local_1a0 + 2; + RtlInitUnicodeString(lVar11,local_180); + uVar12 = 0; + bVar2 = true; + } } } + local_188 = (uint)uVar9 + 1; + uVar9 = (ulonglong)local_188; } - local_190 = (uint)uVar8 + 1; - uVar8 = (ulonglong)local_190; - } - if (bVar2) { - return uVar6; - } - local_18c = (uint)uVar9 + 1; - uVar9 = (ulonglong)local_18c; - } while( true ); + if (bVar2) { + return uVar10; + } + local_184 = uVar5 + 1; + } while( true ); + } } + uVar9 = 0xc0000225; } - uVar6 = 0xc0000225; + else { + uVar9 = SIPolicyGetVersionInfo(local_190,(uint)local_198,param_5,uVar10,ppuVar14,local_160); + uVar9 = uVar9 & 0xffffffff; + } } } - return uVar6; + return uVar9; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|ci_8737.dll - ci_8875.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ci_8737.dll|ci_8875.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|256|257| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|180029450|180029550| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## RtlCompareUnicodeString ### Match Info |Key|ci_8737.dll - ci_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ci_8737.dll|ci_8875.dll| | :---: | :---: | :---: | |name|RtlCompareUnicodeString|RtlCompareUnicodeString| |fullname|RtlCompareUnicodeString|RtlCompareUnicodeString| |`refcount`|11|12| |length|7|7| |called||| |`calling`|SIPolicyEnumerateKeySecureSettingSearchCompare
SIPolicyFileRuleCompare
SIPolicyQuerySubVerBlock
SIPolicySecureSettingSearchCompare|SIPolicyEnumerateKeySecureSettingSearchCompare
SIPolicyFileRuleCompare
SIPolicyQuerySubVerBlock
SIPolicyQuerySubVerBlock
SIPolicySecureSettingSearchCompare| |paramcount|0|0| |address|18000f357|18000f357| |sig|undefined RtlCompareUnicodeString(void)|undefined RtlCompareUnicodeString(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RtlCompareUnicodeString Calling Diff ```diff --- RtlCompareUnicodeString calling +++ RtlCompareUnicodeString calling @@ -3,0 +4 @@ +SIPolicyQuerySubVerBlock ``` ## RtlStringCbLengthW ### Match Info |Key|ci_8737.dll - ci_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ci_8737.dll|ci_8875.dll| | :---: | :---: | :---: | |name|RtlStringCbLengthW|RtlStringCbLengthW| |fullname|RtlStringCbLengthW|RtlStringCbLengthW| |`refcount`|2|4| |length|110|110| |called||| |`calling`|SIPolicyGetOriginalFilenameAndVersionFromImageBase|SIPolicyCheckVerBlock
SIPolicyGetOriginalFilenameAndVersionFromImageBase
SIPolicyQueryVersionFields| |paramcount|3|3| |address|180008d48|180008d48| |sig|uint __fastcall RtlStringCbLengthW(short * param_1, ulonglong param_2, longlong * param_3)|uint __fastcall RtlStringCbLengthW(short * param_1, ulonglong param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RtlStringCbLengthW Calling Diff ```diff --- RtlStringCbLengthW calling +++ RtlStringCbLengthW calling @@ -0,0 +1 @@ +SIPolicyCheckVerBlock @@ -1,0 +3 @@ +SIPolicyQueryVersionFields ``` ## __security_check_cookie ### Match Info |Key|ci_8737.dll - ci_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ci_8737.dll|ci_8875.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|283|284| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|

Expand for full list:
CiAuditDriverAllow
CiAuthRootParseCTL
CiAuthRootQueryChainByCerts
CiBuildEaCacheContents
CiCatDbMpSmartLockerEnable
CiCatDbQueryFileHash
CiCatDbSendSmartAppControlBlockToast2
CiCatDbSendSmartAppControlSwitchEnforceToast
CiCatDbSmartlockerDefenderCheck
CiCatDbVerifyCertInStore
CiConvertRtlTimeToSystemTime

CiConvertSystemTimeToRtlTime
CiFindFileOrHeaderHashInCatalogs
CiGetCatalogHint
CiGetCertPublisherName
CiGetOOBECompleteTime
CiGetUnlockInformation
CiHvciCalculateHeaderHash
CiHvciCalculateImageHash
CiInitializePolicy
CiInstrumentCreateSyntheticEA
CiInstrumentDefenderMrtId
CiInstrumentDefenderTriggeredNWModeChangeFailed
CiInstrumentDefenderTriggeredNWSwitchOff
CiInstrumentDefenderTriggeredNWSwitchOffIgnored
CiInstrumentDefenderTriggeredNWSwitchToEnforcementMode
CiInstrumentDriverBlock
CiInstrumentDriverSignatureRetry
CiInstrumentHVCI
CiInstrumentHstiInfo
CiInstrumentInitialize
CiInstrumentMissingCatalogHint
CiInstrumentPPLBypassBlocked
CiInstrumentPurgedEAWithValidHash
CiInstrumentSiPolicyInfo
CiInstrumentSignatureFailures
CiInstrumentSignatureFailuresForWNC
CiInstrumentSmartAppControlDecision
CiInstrumentSmartAppControlNoReEvaluation
CiInstrumentSwitchNWOff
CiInstrumentSwitchNWToEnforcementMode
CiInstrumentSwitchNWToEnforcementMode2
CiInstrumentTrustedLaunchPolicy
CiInstrumentUntrustedSource
CiInstrumentWindowsLockdownModeChange
CiIsFilePathAnIME
CiLogCacheEvent
CiLogCatalogReload
CiLogFileAndCatalogEvent
CiLogFileEvent
CiLogFileEventWithStatus
CiLogFileRequestedValidationEvent
CiLogFileRequestedValidationEventWithProcessName
CiLogHvciFailure
CiLogPerfEvent
CiLogPolicyEvent
CiLogQueryDynamicCodeTrust
CiLogSIPolicyEvent
CiLogSIPolicyRefresh
CiLogSIPolicyRefreshAttempt
CiLogSIPolicyRefreshFinished
CiLogSIPolicyRefreshIgnored
CiLogSIPolicySmartlockerEvent
CiLogSdlEvent
CiLogSignatureExpiryEvent
CiLogSignatureInformation
CiLogSmartAppControlFailureDetails
CiLogStatusEventWithCorrelationId
CiLogWhqlDriverExemption
CiLogWhqlSettingsEvent
CiMemSwap
CiReadFileAtPath
CiRegisterSiloMonitor
CiReloadCatalogsForHvci
CiRevalidateImage
CiSetCachedOriginClaim
CiSetDynamicCodeTrustClaim
CiSetFileCache
CiUnpackPolicy
CiValidateFullImagePages
CiValidateImageHeader
CiValidateImagePages
CipApplySiPolicyEx
CipAuthRootIsCertInAllowList
CipAuthRootIsCertInDisallowList
CipAuthRootLoadCTLsFromCrypt32Dll
CipCallPeauth
CipCatDbAlwaysUseResultsRunOnce
CipCatDbRpcConnect
CipCheckConfigOptions
CipCheckLicensing
CipCheckSignedFileSignatureButNotAuthenticodeHash
CipEnableJournalingAlways
CipEndpointSec
CipExternalAuthorizationCallback
CipFindFileHash
CipFindMatchingEndpointSecEntry
CipGetEnterpriseUmciFileHash
CipGetFileAttributes
CipGetFileCache
CipGetFullImagePathAndMacros
CipGetPageHashesForFile
CipGetRegistryParameters
CipGetRegistryValue
CipGetRegistryValue2
CipGetRegistryValueInternal
CipGetSbcpMergeListString
CipGetTenantIds
CipGetVolumeFlags
CipHvciRefreshPolicy
CipImageGetImageHashFromEa
CipIncrementWhqlOnlyCountersAndResetEvaluation
CipInstrumentVbsPolicyFailure
CipIsDeveloperModeEnabled
CipLoadAndValidateRevocationList
CipLogSIPolicySigner
CipMinCryptToAuthRoot2
CipOpenFile
CipPicrootExceptionsIncrementCounterHelper
CipPrepareDynamicDeveloperSigners
CipProcessSIPolicyFailure
CipQueryDynamicCodeTrustClaim
CipQueryLockDownPolicyRestriction
CipReadCustomSigningPolicy
CipRefreshPolicies
CipReportSiPolicyOverride
CipSetRevocationRuleAppliedIfRequired
CipSetSmartlockerRegEnabled
CipShouldReportPageHashesForDirectMappedImage
CipSmartHashImageFile
CipSmartlockerGetValidEA
CipTryGetProcessAppID
CipUpdateCustomKernelSignerEnabledState
CipValidateCertAgainstEKU
CipValidateEndpointSecPolicyFile
CipValidateFileInCache
CipValidateFileObjectByFileOrPageHash
CipValidateFirstPage
CipValidateImageHash
ComputeFlushPeriod
EnableFlushTimer
GetGRLFileName
Gvb3afc4
HashKComputeFirstPageHash
HashKComputeImageHash
HashKComputeMemoryHash
HashKComputeMemoryHashExcludeRanges
HashpImageGetDigestStream
HashpPadHash
HashpSelfTest
I_LocateCatalogPageHashesBlob
I_MinAsn1AdjustFileTime
I_MinAsn1ParseSingleAttribute
I_MinCryptCheckEKURequirements
I_MinCryptGetCertificateEKUs
I_MinCryptGetCommonName
I_MinCryptVerifyAuthenticodeTimeStamp
I_MinCryptVerifyRFC3161TimeStamp
I_PECheckMincryptPolicy
I_PEConfigOptions
I_PEVerifyAndLogPEAuthCerts
I_PEVerifyBootDrivers
I_PEWriteComponentLoadExEvents
KSRCacheGetPackageFlags2
KSRCacheGetPackageHostRuntimeDependencies
KSRCachepGetDependencyGraphIndexKey
KSRCachepGetPackageDataId
KSRCachepGetPackageDataKey
KSRCachepGetPackageFullNameFromPackageDataId
KSRCachepGetSupplierPackageDataId
KSRCachepGetUserDataId
KappxCheckTrustLabelAce
KappxDeriveHostRuntimeSupplierPackagesAndCatalogs
KappxpIncrementPackageStatusVersion
KappxpNotifyPackagedFile
KappxpQueryNormalizedPackageRepositoryDirPaths
KappxpSetPackageStatus
LookUpTableFlushComplete
MFGetGRL
MinAsn1DecodeGeneralizedTime
MinAsn1DecodeUtcTime
MinAsn1ExtractParsedCertificatesFromSignedData
MinAsn1ExtractValues
MinAsn1FindExtensionMatchingValue
MinAsn1FindPageHashesAttribute
MinAsn1ParseAndDecodeRDNComponent
MinAsn1ParseSingleExtensionValue
MinAsn1StringToOid
MinCrypK_CheckSignedFile
MinCrypK_FindPageHashesInSignedCert
MinCryptCheckCertsAndKeys
MinCryptDecodeHashAlgorithmIdentifier
MinCryptDecodeSignatureAlgorithmIdentifier
MinCryptIsKeyPresent
MinCryptQueryHashAlgorithmFromSignature
MinCryptVerifySignedHash2
MincrypK_TestPKCS1SignVerify
MincryptGetACSIdentityEKUInPolicy
MincryptGetOpusProgramNameFromAuthenticatedAttributes
MincryptIsEKUInPolicy
MincryptIsWeakCertHashAllowed
MincryptValidateBasicConstraints
Ordinal_2
PECheckComponentLoad
PECheckComponentLoadEx
PESetInitialState
SIPolicyBlockErrorCodePerPolicy2
SIPolicyGetOriginalFilenameAndVersionFromImageBase
SIPolicyGetSerializedPolicies
SIPolicyInitializeWellKnownSidBuffer
SIPolicyIsEkuInChain
SIPolicyIsSystemPolicy
SIPolicyIsValidEsSiPolicySupplemental
SIPolicyLoadAuthorizationTokens
SIPolicyPmGetAllPolicyFiles
SIPolicyPmGetLegacyPolicyFiles
SIPolicyPmGetPolicyFolderFiles
SIPolicyPmReadPolicy
SIPolicyQueryPolicyInformation
SIPolicyReorderPolicies
SIPolicyStatePreparePolicyHash
SIPolicyVerifySupplementalAuthorization
SIPolicyVerifyTokenSigned
SbIsSupplementalPolicyBoundToDevice
SbLoadFile
SbValidateAndParseDebugAuthToken
SbValidateAndParseSupplementalPolicyAuthorizationToken
SbValidateSkuUnlockToken
SbpPolicyIsRevoked
SymCryptDetectCpuFeaturesByCpuid
SymCryptEcDhSecretAgreementSelftest
SymCryptEcDsaSelftest
SymCryptEcDsaVerify
SymCryptEcpointMultiScalarMulWnafWithInterleaving
SymCryptEcpointScalarMulFixedWindow
SymCryptEcpointTransform
SymCryptEcurveAllocate
SymCryptFdefDecideModulusType
SymCryptFdefModInvGeneric
SymCryptHashAppendInternal
SymCryptHashCommonPaddingMd4Style
SymCryptInitEnvWindowsKernelmodeWin8_1nLater
SymCryptMontgomeryIsEqual
SymCryptParallelHashSetNextWork
SymCryptParallelSha256Append
SymCryptParallelSha256AppendBytes_serial
SymCryptParallelSha256Process
SymCryptParallelSha256Selftest
SymCryptRsaCoreDecCrt
SymCryptRsaPkcs1Verify
SymCryptRsaSelftest
SymCryptRsakeyCalculatePrivateFields
SymCryptSha1
SymCryptSha1Append
SymCryptSha1Result
SymCryptSha256
SymCryptSha256Append
SymCryptSha256Result
SymCryptSha384Result
SymCryptSha512
SymCryptSha512Append
SymCryptSha512AppendBlocks_ull
SymCryptSha512Result
SymCryptShortWeierstrassAddDiffNonZero
SymCryptShortWeierstrassAddSideChannelUnsafe
SymCryptShortWeierstrassDouble
SymCryptShortWeierstrassDoubleSpecializedAm3
SymCryptShortWeierstrassIsEqual
SymCryptShortWeierstrassOnCurve
SymCryptTwistedEdwardsAdd
SymCryptTwistedEdwardsDouble
SymCryptTwistedEdwardsIsEqual
SymCryptTwistedEdwardsOnCurve
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
VerifyCoreSignature
__GSHandlerCheckCommon
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>_>
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates

CiConvertSystemTimeToRtlTime
CiFindFileOrHeaderHashInCatalogs
CiGetCatalogHint
CiGetCertPublisherName
CiGetOOBECompleteTime
CiGetUnlockInformation
CiHvciCalculateHeaderHash
CiHvciCalculateImageHash
CiInitializePolicy
CiInstrumentCreateSyntheticEA
CiInstrumentDefenderMrtId
CiInstrumentDefenderTriggeredNWModeChangeFailed
CiInstrumentDefenderTriggeredNWSwitchOff
CiInstrumentDefenderTriggeredNWSwitchOffIgnored
CiInstrumentDefenderTriggeredNWSwitchToEnforcementMode
CiInstrumentDriverBlock
CiInstrumentDriverSignatureRetry
CiInstrumentHVCI
CiInstrumentHstiInfo
CiInstrumentInitialize
CiInstrumentMissingCatalogHint
CiInstrumentPPLBypassBlocked
CiInstrumentPurgedEAWithValidHash
CiInstrumentSiPolicyInfo
CiInstrumentSignatureFailures
CiInstrumentSignatureFailuresForWNC
CiInstrumentSmartAppControlDecision
CiInstrumentSmartAppControlNoReEvaluation
CiInstrumentSwitchNWOff
CiInstrumentSwitchNWToEnforcementMode
CiInstrumentSwitchNWToEnforcementMode2
CiInstrumentTrustedLaunchPolicy
CiInstrumentUntrustedSource
CiInstrumentWindowsLockdownModeChange
CiIsFilePathAnIME
CiLogCacheEvent
CiLogCatalogReload
CiLogFileAndCatalogEvent
CiLogFileEvent
CiLogFileEventWithStatus
CiLogFileRequestedValidationEvent
CiLogFileRequestedValidationEventWithProcessName
CiLogHvciFailure
CiLogPerfEvent
CiLogPolicyEvent
CiLogQueryDynamicCodeTrust
CiLogSIPolicyEvent
CiLogSIPolicyRefresh
CiLogSIPolicyRefreshAttempt
CiLogSIPolicyRefreshFinished
CiLogSIPolicyRefreshIgnored
CiLogSIPolicySmartlockerEvent
CiLogSdlEvent
CiLogSignatureExpiryEvent
CiLogSignatureInformation
CiLogSmartAppControlFailureDetails
CiLogStatusEventWithCorrelationId
CiLogWhqlDriverExemption
CiLogWhqlSettingsEvent
CiMemSwap
CiReadFileAtPath
CiRegisterSiloMonitor
CiReloadCatalogsForHvci
CiRevalidateImage
CiSetCachedOriginClaim
CiSetDynamicCodeTrustClaim
CiSetFileCache
CiUnpackPolicy
CiValidateFullImagePages
CiValidateImageHeader
CiValidateImagePages
CipApplySiPolicyEx
CipAuthRootIsCertInAllowList
CipAuthRootIsCertInDisallowList
CipAuthRootLoadCTLsFromCrypt32Dll
CipCallPeauth
CipCatDbAlwaysUseResultsRunOnce
CipCatDbRpcConnect
CipCheckConfigOptions
CipCheckLicensing
CipCheckSignedFileSignatureButNotAuthenticodeHash
CipEnableJournalingAlways
CipEndpointSec
CipExternalAuthorizationCallback
CipFindFileHash
CipFindMatchingEndpointSecEntry
CipGetEnterpriseUmciFileHash
CipGetFileAttributes
CipGetFileCache
CipGetFullImagePathAndMacros
CipGetPageHashesForFile
CipGetRegistryParameters
CipGetRegistryValue
CipGetRegistryValue2
CipGetRegistryValueInternal
CipGetSbcpMergeListString
CipGetTenantIds
CipGetVolumeFlags
CipHvciRefreshPolicy
CipImageGetImageHashFromEa
CipIncrementWhqlOnlyCountersAndResetEvaluation
CipInstrumentVbsPolicyFailure
CipIsDeveloperModeEnabled
CipLoadAndValidateRevocationList
CipLogSIPolicySigner
CipMinCryptToAuthRoot2
CipOpenFile
CipPicrootExceptionsIncrementCounterHelper
CipPrepareDynamicDeveloperSigners
CipProcessSIPolicyFailure
CipQueryDynamicCodeTrustClaim
CipQueryLockDownPolicyRestriction
CipReadCustomSigningPolicy
CipRefreshPolicies
CipReportSiPolicyOverride
CipSetRevocationRuleAppliedIfRequired
CipSetSmartlockerRegEnabled
CipShouldReportPageHashesForDirectMappedImage
CipSmartHashImageFile
CipSmartlockerGetValidEA
CipTryGetProcessAppID
CipUpdateCustomKernelSignerEnabledState
CipValidateCertAgainstEKU
CipValidateEndpointSecPolicyFile
CipValidateFileInCache
CipValidateFileObjectByFileOrPageHash
CipValidateFirstPage
CipValidateImageHash
ComputeFlushPeriod
EnableFlushTimer
GetGRLFileName
Gvb3afc4
HashKComputeFirstPageHash
HashKComputeImageHash
HashKComputeMemoryHash
HashKComputeMemoryHashExcludeRanges
HashpImageGetDigestStream
HashpPadHash
HashpSelfTest
I_LocateCatalogPageHashesBlob
I_MinAsn1AdjustFileTime
I_MinAsn1ParseSingleAttribute
I_MinCryptCheckEKURequirements
I_MinCryptGetCertificateEKUs
I_MinCryptGetCommonName
I_MinCryptVerifyAuthenticodeTimeStamp
I_MinCryptVerifyRFC3161TimeStamp
I_PECheckMincryptPolicy
I_PEConfigOptions
I_PEVerifyAndLogPEAuthCerts
I_PEVerifyBootDrivers
I_PEWriteComponentLoadExEvents
KSRCacheGetPackageFlags2
KSRCacheGetPackageHostRuntimeDependencies
KSRCachepGetDependencyGraphIndexKey
KSRCachepGetPackageDataId
KSRCachepGetPackageDataKey
KSRCachepGetPackageFullNameFromPackageDataId
KSRCachepGetSupplierPackageDataId
KSRCachepGetUserDataId
KappxCheckTrustLabelAce
KappxDeriveHostRuntimeSupplierPackagesAndCatalogs
KappxpIncrementPackageStatusVersion
KappxpNotifyPackagedFile
KappxpQueryNormalizedPackageRepositoryDirPaths
KappxpSetPackageStatus
LookUpTableFlushComplete
MFGetGRL
MinAsn1DecodeGeneralizedTime
MinAsn1DecodeUtcTime
MinAsn1ExtractParsedCertificatesFromSignedData
MinAsn1ExtractValues
MinAsn1FindExtensionMatchingValue
MinAsn1FindPageHashesAttribute
MinAsn1ParseAndDecodeRDNComponent
MinAsn1ParseSingleExtensionValue
MinAsn1StringToOid
MinCrypK_CheckSignedFile
MinCrypK_FindPageHashesInSignedCert
MinCryptCheckCertsAndKeys
MinCryptDecodeHashAlgorithmIdentifier
MinCryptDecodeSignatureAlgorithmIdentifier
MinCryptIsKeyPresent
MinCryptQueryHashAlgorithmFromSignature
MinCryptVerifySignedHash2
MincrypK_TestPKCS1SignVerify
MincryptGetACSIdentityEKUInPolicy
MincryptGetOpusProgramNameFromAuthenticatedAttributes
MincryptIsEKUInPolicy
MincryptIsWeakCertHashAllowed
MincryptValidateBasicConstraints
Ordinal_2
PECheckComponentLoad
PECheckComponentLoadEx
PESetInitialState
SIPolicyBlockErrorCodePerPolicy2
SIPolicyGetOriginalFilenameAndVersionFromImageBase
SIPolicyGetSerializedPolicies
SIPolicyInitializeWellKnownSidBuffer
SIPolicyIsEkuInChain
SIPolicyIsSystemPolicy
SIPolicyIsValidEsSiPolicySupplemental
SIPolicyLoadAuthorizationTokens
SIPolicyPmGetAllPolicyFiles
SIPolicyPmGetLegacyPolicyFiles
SIPolicyPmGetPolicyFolderFiles
SIPolicyPmReadPolicy
SIPolicyQueryPolicyInformation
SIPolicyQueryVersionStrings
SIPolicyReorderPolicies
SIPolicyStatePreparePolicyHash
SIPolicyVerifySupplementalAuthorization
SIPolicyVerifyTokenSigned
SbIsSupplementalPolicyBoundToDevice
SbLoadFile
SbValidateAndParseDebugAuthToken
SbValidateAndParseSupplementalPolicyAuthorizationToken
SbValidateSkuUnlockToken
SbpPolicyIsRevoked
SymCryptDetectCpuFeaturesByCpuid
SymCryptEcDhSecretAgreementSelftest
SymCryptEcDsaSelftest
SymCryptEcDsaVerify
SymCryptEcpointMultiScalarMulWnafWithInterleaving
SymCryptEcpointScalarMulFixedWindow
SymCryptEcpointTransform
SymCryptEcurveAllocate
SymCryptFdefDecideModulusType
SymCryptFdefModInvGeneric
SymCryptHashAppendInternal
SymCryptHashCommonPaddingMd4Style
SymCryptInitEnvWindowsKernelmodeWin8_1nLater
SymCryptMontgomeryIsEqual
SymCryptParallelHashSetNextWork
SymCryptParallelSha256Append
SymCryptParallelSha256AppendBytes_serial
SymCryptParallelSha256Process
SymCryptParallelSha256Selftest
SymCryptRsaCoreDecCrt
SymCryptRsaPkcs1Verify
SymCryptRsaSelftest
SymCryptRsakeyCalculatePrivateFields
SymCryptSha1
SymCryptSha1Append
SymCryptSha1Result
SymCryptSha256
SymCryptSha256Append
SymCryptSha256Result
SymCryptSha384Result
SymCryptSha512
SymCryptSha512Append
SymCryptSha512AppendBlocks_ull
SymCryptSha512Result
SymCryptShortWeierstrassAddDiffNonZero
SymCryptShortWeierstrassAddSideChannelUnsafe
SymCryptShortWeierstrassDouble
SymCryptShortWeierstrassDoubleSpecializedAm3
SymCryptShortWeierstrassIsEqual
SymCryptShortWeierstrassOnCurve
SymCryptTwistedEdwardsAdd
SymCryptTwistedEdwardsDouble
SymCryptTwistedEdwardsIsEqual
SymCryptTwistedEdwardsOnCurve
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
VerifyCoreSignature
__GSHandlerCheckCommon
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>_>
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates

| |paramcount|1|1| |`address`|180029680|180029780| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -219,0 +220 @@ +SIPolicyQueryVersionStrings ``` ## RtlInitUnicodeString ### Match Info |Key|ci_8737.dll - ci_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ci_8737.dll|ci_8875.dll| | :---: | :---: | :---: | |name|RtlInitUnicodeString|RtlInitUnicodeString| |fullname|RtlInitUnicodeString|RtlInitUnicodeString| |`refcount`|23|24| |length|7|7| |called||| |`calling`|

Expand for full list:
SIPolicyBuildPath
SIPolicyFreePolicyData
SIPolicyGetMacroPaths
SIPolicyGetOriginalFilenameAndVersionFromImageBase
SIPolicyGetSmbiosInformationFromPolicy
SIPolicyIsOemSupplementalPolicy
SIPolicyPmBuildPathFromPolicyID
SIPolicyPmFreeFileItems
SIPolicyPmGetBootPartitionPolicyFolder
SIPolicyPmGetLegacyPolicyFiles
SIPolicyPmGetOsDataPartitionPolicyFolder

SIPolicyPmGetSystemPartitionPolicyFolderCommon
SIPolicyPmGetTokenFileName
SIPolicyQuerySubVerBlock
SIPolicyStatusPrint
SbEFIGetVariable
SbLoadFile

SIPolicyPmGetSystemPartitionPolicyFolderCommon
SIPolicyPmGetTokenFileName
SIPolicyQuerySubVerBlock
SIPolicyQuerySubVerBlock
SIPolicyStatusPrint
SbEFIGetVariable
SbLoadFile

Expand for full list:
Feature_2390291770__private_IsEnabledFallback
Feature_CodeIntegrity_EccSupport__private_IsEnabledFallback
Feature_CodeIntegrity_TrustedLaunchPolicy__private_IsEnabledFallback
Feature_CodeIntegrity_TrustedLaunch_TrustedRootStore__private_IsEnabledFallback
Feature_SAC_ClientSideEnable__private_IsEnabledFallback
Feature_SAC_DefenderDisabledOverride__private_IsEnabledFallback
Feature_SAC_LocalLogging__private_IsEnabledFallback
Feature_SAC_SuppressNgenToasts__private_IsEnabledFallback
Feature_SAC_TwoWaySwitch__private_IsEnabledFallback
Feature_Servicing_CIRefreshBlocks8s__private_IsEnabledFallback
Feature_Servicing_CodeIntegrityPolicyDeadlock__private_IsEnabledFallback

Feature_Servicing_EndpointSec_AppIDTagging_6D_CFR__private_IsEnabledFallback
Feature_Servicing_EndpointSec_AppIDTagging__private_IsEnabledFallback
Feature_Servicing_EndpointSecurity_ComObjectRegression__private_IsEnabledFallback
Feature_Servicing_HotpatchLoaderFixes__private_IsEnabledFallback
Feature_Servicing_WhqlOnlyAllowBlockToasts__private_IsEnabledFallback
Feature_Servicing_WhqlOnlyContainment__private_IsEnabledFallback
Feature_TrustedLaunchHosts__private_IsEnabledFallback
Feature_TrustedLaunchSysAppsOSCatalog__private_IsEnabledFallback
Feature_TrustedLaunchWithDevModeAndTestSigning__private_IsEnabledFallback
Feature_TrustedLaunch__private_IsEnabledFallback
Feature_WNCPolicyAuditEvt__private_IsEnabledFallback

Expand for full list:
Feature_1311764795__private_IsEnabledFallback
Feature_2390291770__private_IsEnabledFallback
Feature_CodeIntegrity_EccSupport__private_IsEnabledFallback
Feature_CodeIntegrity_TrustedLaunchPolicy__private_IsEnabledFallback
Feature_CodeIntegrity_TrustedLaunch_TrustedRootStore__private_IsEnabledFallback
Feature_SAC_ClientSideEnable__private_IsEnabledFallback
Feature_SAC_DefenderDisabledOverride__private_IsEnabledFallback
Feature_SAC_LocalLogging__private_IsEnabledFallback
Feature_SAC_SuppressNgenToasts__private_IsEnabledFallback
Feature_SAC_TwoWaySwitch__private_IsEnabledFallback
Feature_Servicing_CIRefreshBlocks8s__private_IsEnabledFallback

Feature_Servicing_CodeIntegrityPolicyDeadlock__private_IsEnabledFallback
Feature_Servicing_EndpointSec_AppIDTagging_6D_CFR__private_IsEnabledFallback
Feature_Servicing_EndpointSec_AppIDTagging__private_IsEnabledFallback
Feature_Servicing_EndpointSecurity_ComObjectRegression__private_IsEnabledFallback
Feature_Servicing_HotpatchLoaderFixes__private_IsEnabledFallback
Feature_Servicing_WhqlOnlyAllowBlockToasts__private_IsEnabledFallback
Feature_Servicing_WhqlOnlyContainment__private_IsEnabledFallback
Feature_TrustedLaunchHosts__private_IsEnabledFallback
Feature_TrustedLaunchSysAppsOSCatalog__private_IsEnabledFallback
Feature_TrustedLaunchWithDevModeAndTestSigning__private_IsEnabledFallback
Feature_TrustedLaunch__private_IsEnabledFallback
Feature_WNCPolicyAuditEvt__private_IsEnabledFallback

| |paramcount|3|3| |`address`|1800193d0|180019488| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_1311764795__private_IsEnabledFallback ``` ## memset ### Match Info |Key|ci_8737.dll - ci_8875.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ci_8737.dll|ci_8875.dll| | :---: | :---: | :---: | |name|memset|memset| |fullname|memset|memset| |`refcount`|110|111| |length|236|236| |called||| |`calling`|

Expand for full list:
CBufferAllocate
CiAuthRootParseCTL
CiAuthRootQueryChainByCerts
CiBuildEaCacheContents
CiCatDbMpSmartLockerEnable
CiCatDbQueryFileHash
CiCatDbSendSmartAppControlBlockToast2
CiCatDbSendSmartAppControlSwitchEnforceToast
CiCatDbSmartlockerDefenderCheck
CiCatDbVerifyCertInStore
CiGetCertPublisherName

CiGetNextSignatureVerification
CiHvciCalculateHeaderHash
CiHvciCalculateImageHash
CiInitializeGlobalState
CiInitializeValidationContext
CiInstrumentDefenderMrtId
CiInstrumentSmartAppControlDecision
CiIsFilePathAnIME
CiLogQueryDynamicCodeTrust
CiLogSIPolicyEvent
CiLogSIPolicyRefresh
CiLogSignatureInformation
CiValidateFullImagePages
CiValidateImagePages
CipApplySiPolicyEx
CipAuthRootIsCertInAllowList
CipAuthRootIsCertInDisallowList
CipCatDbRpcConnect
CipExternalAuthorizationCallback
CipGetEnterpriseUmciFileHash
CipGetFullImagePathAndMacros
CipGetRegistryValue
CipGetRegistryValue2
CipGetRegistryValueInternal
CipGetTenantIds
CipImageGetImageHashFromEa
CipIsDeveloperModeEnabled
CipLogSIPolicySigner
CipMinCryptToAuthRoot2
CipParseFileCache
CipPrepareDynamicDeveloperSigners
CipQueryOneEA
CipReportSiPolicyOverride
CipSetUmciExclusionPaths
CipUpdateSePoolwithPageHashes
CreateTlgAggregateSession
Gvb3afc4
HashKComputeFirstPageHash
HashKComputeImageHash
HashKComputeMemoryHash
HashKComputeMemoryHashExcludeRanges
HashpHashMemory
HashpImageGetDigestStream
I_FreeCatalogData
I_ReloadCatalog
I_RemapCatalog
KSRCacheGetPackageHostRuntimeDependencies
KappxDeriveHostRuntimeSupplierPackagesAndCatalogs
MinCrypK_VerifySignedDataKModeEx
MinCryptCheckCertsAndKeys
MinCryptCopyAsn1IntToFixedBuffer
MinCryptParseRevocationList
SIPolicyFileRuleSearchCompare
SIPolicyIsEkuInChain
SIPolicyIsValidEsSiPolicySupplemental
SIPolicyPmGetLegacyPolicyFiles
SIPolicyReorderPolicies
SIPolicyStatePreparePolicyHash
SIPolicyStatusPrint
SIPolicyVerifyPolicyIsUefiSigned
SIPolicyVerifyPolicyIsWindowsSigned
SIPolicyVerifyTokenSigned
SbCheckPolicyIsWindowsSigned
SbpParsePolicy
SymCryptEcpointMultiScalarMulWnafWithInterleaving
SymCryptEcpointScalarMulFixedWindow
SymCryptFdefRawGetValue
SymCryptParallelHashProcess
SymCryptParallelSha256Append
SymCryptParallelSha256Process
SymCryptRsaPkcs1ApplySignaturePadding
SymCryptSha1
SymCryptSha1Result
SymCryptSha256
SymCryptSha512
SymCryptShortWeierstrassAddSideChannelUnsafe
SymCryptTwistedEdwardsAdd
SymCryptTwistedEdwardsDouble

CiGetNextSignatureVerification
CiHvciCalculateHeaderHash
CiHvciCalculateImageHash
CiInitializeGlobalState
CiInitializeValidationContext
CiInstrumentDefenderMrtId
CiInstrumentSmartAppControlDecision
CiIsFilePathAnIME
CiLogQueryDynamicCodeTrust
CiLogSIPolicyEvent
CiLogSIPolicyRefresh
CiLogSignatureInformation
CiValidateFullImagePages
CiValidateImagePages
CipApplySiPolicyEx
CipAuthRootIsCertInAllowList
CipAuthRootIsCertInDisallowList
CipCatDbRpcConnect
CipExternalAuthorizationCallback
CipGetEnterpriseUmciFileHash
CipGetFullImagePathAndMacros
CipGetRegistryValue
CipGetRegistryValue2
CipGetRegistryValueInternal
CipGetTenantIds
CipImageGetImageHashFromEa
CipIsDeveloperModeEnabled
CipLogSIPolicySigner
CipMinCryptToAuthRoot2
CipParseFileCache
CipPrepareDynamicDeveloperSigners
CipQueryOneEA
CipReportSiPolicyOverride
CipSetUmciExclusionPaths
CipUpdateSePoolwithPageHashes
CreateTlgAggregateSession
Gvb3afc4
HashKComputeFirstPageHash
HashKComputeImageHash
HashKComputeMemoryHash
HashKComputeMemoryHashExcludeRanges
HashpHashMemory
HashpImageGetDigestStream
I_FreeCatalogData
I_ReloadCatalog
I_RemapCatalog
KSRCacheGetPackageHostRuntimeDependencies
KappxDeriveHostRuntimeSupplierPackagesAndCatalogs
MinCrypK_VerifySignedDataKModeEx
MinCryptCheckCertsAndKeys
MinCryptCopyAsn1IntToFixedBuffer
MinCryptParseRevocationList
SIPolicyFileRuleSearchCompare
SIPolicyIsEkuInChain
SIPolicyIsValidEsSiPolicySupplemental
SIPolicyPmGetLegacyPolicyFiles
SIPolicyQueryVersionStrings
SIPolicyReorderPolicies
SIPolicyStatePreparePolicyHash
SIPolicyStatusPrint
SIPolicyVerifyPolicyIsUefiSigned
SIPolicyVerifyPolicyIsWindowsSigned
SIPolicyVerifyTokenSigned
SbCheckPolicyIsWindowsSigned
SbpParsePolicy
SymCryptEcpointMultiScalarMulWnafWithInterleaving
SymCryptEcpointScalarMulFixedWindow
SymCryptFdefRawGetValue
SymCryptParallelHashProcess
SymCryptParallelSha256Append
SymCryptParallelSha256Process
SymCryptRsaPkcs1ApplySignaturePadding
SymCryptSha1
SymCryptSha1Result
SymCryptSha256
SymCryptSha512
SymCryptShortWeierstrassAddSideChannelUnsafe
SymCryptTwistedEdwardsAdd
SymCryptTwistedEdwardsDouble

| |paramcount|3|3| |`address`|180029b80|180029c80| |sig|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### memset Calling Diff ```diff --- memset calling +++ memset calling @@ -67,0 +68 @@ +SIPolicyQueryVersionStrings ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-21T21:33:49}