# cldflt-2021-05.sys-cldflt-2021-06.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Modified](#modified) * [FUN_1c004c4f0](#fun_1c004c4f0) * [FUN_1c0002ec0](#fun_1c0002ec0) * [Modified (No Code Changes)](#modified-no-code-changes) # Visual Chart Diff ```mermaid flowchart LR FUN_1c004c4f0-3-old<--Match 83%-->FUN_1c004c4f0-3-new FUN_1c0002ec0-1-old<--Match 28%-->FUN_1c004c810-1-new subgraph cldflt-2021-06.sys FUN_1c004c4f0-3-new FUN_1c004c810-1-new end subgraph cldflt-2021-05.sys FUN_1c004c4f0-3-old FUN_1c0002ec0-1-old end ``` ```mermaid pie showData title Function Matches - 100.0000% "unmatched_funcs_len" : 0 "matched_funcs_len" : 2551 ``` ```mermaid pie showData title Matched Function Similarity - 99.8432% "matched_funcs_with_code_changes_len" : 2 "matched_funcs_with_non_code_changes_len" : 2 "matched_funcs_no_changes_len" : 2547 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --no-symbols --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 cldflt-2021-05.sys cldflt-2021-06.sys ``` #### Verbose Args

``` --old ['/sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2021-05.sys'] --new [['/sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2021-06.sys']] --engine VersionTrackingDiff --output-path /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2021-31969 --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols True --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/cldflt.sys/692B52FA82000/cldflt.sys -O cldflt.sys.x64.10.0.19041.1023 wget https://msdl.microsoft.com/download/symbols/cldflt.sys/8F864BFA82000/cldflt.sys -O cldflt.sys.x64.10.0.19041.1052 ``` ## Binary Metadata Diff ```diff --- cldflt-2021-05.sys Meta +++ cldflt-2021-06.sys Meta @@ -1,43 +1,43 @@ -Program Name: cldflt-2021-05.sys +Program Name: cldflt-2021-06.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f -# of Bytes: 506296 +# of Bytes: 506808 # of Memory Blocks: 13 -# of Instructions: 100124 -# of Defined Data: 2946 -# of Functions: 1275 -# of Symbols: 13403 +# of Instructions: 100166 +# of Defined Data: 2948 +# of Functions: 1276 +# of Symbols: 13413 # of Data Types: 168 # of Data Type Categories: 13 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Jul 26 18:42:16 SGT 2026 +Date Created: Sun Jul 26 18:42:20 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2021-05.sys -Executable MD5: 7630589486a903d309fe3309a2c2004b -Executable SHA256: c979d09ab0eee115236507e06cc2962ccc95c90918c57472388ba2ede48c5be3 -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2021-05.sys?MD5=7630589486a903d309fe3309a2c2004b +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2021-06.sys +Executable MD5: bb9373b4e4ac006e34f6f8a257d2bc8b +Executable SHA256: 237dd4da714c708046f91fbe4518f0af9619cbf8188953e7ff8c78f2bec28932 +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2021-06.sys?MD5=bb9373b4e4ac006e34f6f8a257d2bc8b PDB Age: 1 PDB File: cldflt.pdb -PDB GUID: 2d9fade0-d7c9-c730-a575-cbd304c140df +PDB GUID: a5a21040-94a8-42b0-3fff-9deaca4d8f51 PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Cloud Files Mini Filter Driver -PE Property[FileVersion]: 10.0.19041.1023 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.19041.1052 (WinBuild.160101.0800) PE Property[InternalName]: cldflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: cldflt.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.19041.1023 +PE Property[ProductVersion]: 10.0.19041.1052 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra cldflt-2021-05.sys Decompiler Options

Ghidra cldflt-2021-05.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra cldflt-2021-05.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|false| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra cldflt-2021-06.sys Decompiler Options

Ghidra cldflt-2021-06.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra cldflt-2021-06.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|0| |modified_funcs_len|4| |added_symbols_len|0| |deleted_symbols_len|0| |diff_time|6.610196828842163| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'ExactBytesFunctionHasher': 553, 'ExactInstructionsFunctionHasher': 339, 'SymbolsHash': 334, 'ExternalsName': 319, 'StructuralGraphHash': 161, 'BulkInstructionHash': 14, 'BSIM': 7, 'SigCallingCalledHasher': 2, 'Implied Match': 1})| |items_to_process|4| |diff_types|Counter({'refcount': 4, 'calling': 3, 'called': 3, 'code': 2, 'length': 2, 'sig': 2, 'name': 1, 'fullname': 1, 'address': 1})| |unmatched_funcs_len|0| |total_funcs_len|2551| |matched_funcs_len|2551| |matched_funcs_with_code_changes_len|2| |matched_funcs_with_non_code_changes_len|2| |matched_funcs_no_changes_len|2547| |match_func_similarity_percent|99.8432%| |func_match_overall_percent|100.0000%| |first_matches|Counter({'ExactBytesFunctionHasher': 553, 'ExactInstructionsFunctionHasher': 339, 'SymbolsHash': 334, 'StructuralGraphHash': 161, 'BulkInstructionHash': 14, 'BSIM': 7, 'SigCallingCalledHasher': 2, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 334 "ExternalsName" : 319 "ExactBytesFunctionHasher" : 553 "ExactInstructionsFunctionHasher" : 339 "BSIM" : 7 "BulkInstructionHash" : 14 "SigCallingCalledHasher" : 2 "StructuralGraphHash" : 161 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 334 "ExactBytesFunctionHasher" : 553 "ExactInstructionsFunctionHasher" : 339 "BSIM" : 7 "BulkInstructionHash" : 14 "SigCallingCalledHasher" : 2 "StructuralGraphHash" : 161 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 0 "modified_funcs_len" : 4 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 0 "deleted_symbols_len" : 0 ``` ## Strings *No string differences found* # Deleted # Added # Modified *Modified functions contain code changes* ## FUN_1c004c4f0 ### Match Info |Key|cldflt-2021-05.sys - cldflt-2021-06.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,called| |ratio|0.6| |i_ratio|0.5| |m_ratio|0.86| |b_ratio|0.83| |match_types|BSIM| ### Function Meta Diff |Key|cldflt-2021-05.sys|cldflt-2021-06.sys| | :---: | :---: | :---: | |name|FUN_1c004c4f0|FUN_1c004c4f0| |fullname|FUN_1c004c4f0|FUN_1c004c4f0| |`refcount`|6|3| |`length`|1036|779| |`called`|FLTMGR.SYS::FltFsControlFile
FUN_1c0002ec0
FUN_1c0008440
FUN_1c0009800
FUN_1c0009cf0
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlDecompressBuffer|FLTMGR.SYS::FltFsControlFile
FUN_1c0002ec0
FUN_1c0008440
FUN_1c0009800
FUN_1c004c810
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag| |calling|FUN_1c0043af0
FUN_1c004aa74|FUN_1c0043af0
FUN_1c004aa74| |paramcount|3|3| |address|1c004c4f0|1c004c4f0| |`sig`|int __fastcall FUN_1c004c4f0(undefined8 param_1, undefined8 param_2, undefined8 * param_3)|int __fastcall FUN_1c004c4f0(undefined8 param_1, undefined8 param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|DEFAULT|DEFAULT| |external|False|False| ### FUN_1c004c4f0 Called Diff ```diff --- FUN_1c004c4f0 called +++ FUN_1c004c4f0 called @@ -5 +5 @@ -FUN_1c0009cf0 +FUN_1c004c810 @@ -8 +7,0 @@ -NTOSKRNL.EXE::RtlDecompressBuffer ``` ### FUN_1c004c4f0 Diff ```diff --- FUN_1c004c4f0 +++ FUN_1c004c4f0 @@ -1,139 +1,96 @@ -int FUN_1c004c4f0(undefined8 param_1,undefined8 param_2,undefined8 *param_3) +int FUN_1c004c4f0(undefined8 param_1,undefined8 param_2,longlong *param_3) { int iVar1; uint *puVar2; - undefined8 *puVar3; - undefined2 uVar4; - undefined8 uVar5; - uint uVar6; - uint uVar7; - undefined8 uVar8; - uint local_res18 [2]; - undefined8 in_stack_ffffffffffffffa8; - ulonglong uVar9; - undefined4 uVar10; + undefined2 uVar3; + undefined8 uVar4; + uint uVar5; + undefined8 uVar6; + ulonglong uVar7; - uVar7 = (uint)((ulonglong)in_stack_ffffffffffffffa8 >> 0x20); *param_3 = 0; - uVar6 = 0x400; + uVar5 = 0x400; puVar2 = (uint *)ExAllocatePoolWithTag(1,0x400,0x70527348); if (puVar2 == (uint *)0x0) { FUN_1c0002ec0(-0x3fffff66); if ((undefined **)PTR_LOOP_1c0022170 == &PTR_LOOP_1c0022170) { return -0x3fffff66; } if ((*(uint *)(PTR_LOOP_1c0022170 + 0x2c) & 1) == 0) { return -0x3fffff66; } if ((byte)PTR_LOOP_1c0022170[0x29] < 2) { return -0x3fffff66; } - uVar4 = 0x10; + uVar3 = 0x10; LAB_0: - FUN_1c0008440(*(undefined8 *)(PTR_LOOP_1c0022170 + 0x18),uVar4,&DAT_1,param_1); + FUN_1c0008440(*(undefined8 *)(PTR_LOOP_1c0022170 + 0x18),uVar3,&DAT_1,param_1); return -0x3fffff66; } - uVar8 = 0x900a8; - uVar9 = (ulonglong)uVar7 << 0x20; - uVar5 = param_2; - iVar1 = FltFsControlFile(param_1,param_2,0x900a8,0,uVar9,puVar2,0x400,0); + uVar7 = 0; + uVar6 = 0x900a8; + uVar4 = param_2; + iVar1 = FltFsControlFile(param_1); FUN_1c0002ec0(iVar1); - uVar10 = (undefined4)(uVar9 >> 0x20); if ((iVar1 == -0x3fffffdd) || (iVar1 == -0x7ffffffb)) { ExFreePoolWithTag(puVar2,0x70527348); - uVar6 = 0x4000; + uVar5 = 0x4000; puVar2 = (uint *)ExAllocatePoolWithTag(1,0x4000,0x70527348); if (puVar2 == (uint *)0x0) { FUN_1c0002ec0(-0x3fffff66); if ((undefined **)PTR_LOOP_1c0022170 == &PTR_LOOP_1c0022170) { return -0x3fffff66; } if ((*(uint *)(PTR_LOOP_1c0022170 + 0x2c) & 1) == 0) { return -0x3fffff66; } if ((byte)PTR_LOOP_1c0022170[0x29] < 2) { return -0x3fffff66; } - uVar4 = 0x11; + uVar3 = 0x11; goto LAB_0; } - uVar8 = 0x900a8; - uVar9 = uVar9 & 0xffffffff00000000; - iVar1 = FltFsControlFile(param_1,param_2,0x900a8,0,uVar9,puVar2,0x4000,0); - uVar10 = (undefined4)(uVar9 >> 0x20); + uVar7 = 0; + uVar6 = 0x900a8; + iVar1 = FltFsControlFile(param_1); FUN_1c0002ec0(iVar1); - uVar5 = param_2; + uVar4 = param_2; } if (iVar1 < 0) { if ((((iVar1 == -0x3ffffd8b) || ((undefined **)PTR_LOOP_1c0022170 == &PTR_LOOP_1c0022170)) || ((*(uint *)(PTR_LOOP_1c0022170 + 0x2c) & 1) == 0)) || ((byte)PTR_LOOP_1c0022170[0x29] < 2)) goto LAB_2; - uVar4 = 0x12; + uVar3 = 0x12; } else { - if (uVar6 < (ushort)puVar2[1]) { + if (uVar5 < (ushort)puVar2[1]) { iVar1 = -0x3ffffd8b; FUN_1c0002ec0(-0x3ffffd8b); if ((((undefined **)PTR_LOOP_1c0022170 != &PTR_LOOP_1c0022170) && ((*(uint *)(PTR_LOOP_1c0022170 + 0x2c) & 1) != 0)) && (1 < (byte)PTR_LOOP_1c0022170[0x29]) ) { - FUN_1c0009800(*(undefined8 *)(PTR_LOOP_1c0022170 + 0x18),uVar5,uVar8,param_1); + FUN_1c0009800(*(undefined8 *)(PTR_LOOP_1c0022170 + 0x18),uVar4,uVar6,param_1); } goto LAB_2; } - local_res18[0] = 0; - if ((*puVar2 & 0xffff0fff) == DAT_3) { - if ((puVar2[2] >> 0xf & 1) == 0) { - *param_3 = puVar2; - iVar1 = 0; - } - else { - uVar7 = puVar2[2] >> 0x10; - puVar3 = (undefined8 *)ExAllocatePoolWithTag(1,uVar7 + 8,0x70527348); - if (puVar3 == (undefined8 *)0x0) { - iVar1 = -0x3fffff66; - FUN_1c0002ec0(-0x3fffff66); - } - else { - *puVar3 = *(undefined8 *)puVar2; - *(uint *)(puVar3 + 1) = puVar2[2]; - iVar1 = RtlDecompressBuffer(2,(longlong)puVar3 + 0xc,uVar7 - 4,puVar2 + 3, - CONCAT44(uVar10,uVar6 - 0xc),local_res18); - FUN_1c0002ec0(iVar1); - if ((iVar1 < 0) || (0xffff < local_res18[0])) { - FUN_1c0009cf0(); - iVar1 = -0x3fff30fe; - FUN_1c0002ec0(-0x3fff30fe); - ExFreePoolWithTag(puVar3,0x70527348); - } - else { - *(undefined2 *)((longlong)puVar3 + 4) = *(undefined2 *)((longlong)puVar2 + 10); - *param_3 = puVar3; - } - } - } - } - else { - FUN_1c0002ec0(-0x3fff30f5); - iVar1 = -0x3fff30f5; - } + iVar1 = FUN_1c004c810(puVar2,uVar5,param_3,uVar7); FUN_1c0002ec0(iVar1); if (-1 < iVar1) { if ((uint *)*param_3 == puVar2) { return iVar1; } goto LAB_2; } if ((((undefined **)PTR_LOOP_1c0022170 == &PTR_LOOP_1c0022170) || ((*(uint *)(PTR_LOOP_1c0022170 + 0x2c) & 1) == 0)) || ((byte)PTR_LOOP_1c0022170[0x29] < 2)) goto LAB_2; - uVar4 = 0x14; + uVar3 = 0x14; } - FUN_1c0008440(*(undefined8 *)(PTR_LOOP_1c0022170 + 0x18),uVar4,&DAT_1,param_1); + FUN_1c0008440(*(undefined8 *)(PTR_LOOP_1c0022170 + 0x18),uVar3,&DAT_1,param_1); LAB_2: ExFreePoolWithTag(puVar2,0x70527348); return iVar1; } ``` ## FUN_1c0002ec0 ### Match Info |Key|cldflt-2021-05.sys - cldflt-2021-06.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.19| |i_ratio|0.06| |m_ratio|0.56| |b_ratio|0.29| |match_types|Implied Match| ### Function Meta Diff |Key|cldflt-2021-05.sys|cldflt-2021-06.sys| | :---: | :---: | :---: | |`name`|FUN_1c0002ec0|FUN_1c004c810| |`fullname`|FUN_1c0002ec0|FUN_1c004c810| |`refcount`|1352|6| |`length`|147|369| |`called`|FUN_1c00716a4
NTOSKRNL.EXE::IoGetCurrentProcess|FUN_1c0002ec0
FUN_1c0009cf0
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlDecompressBuffer| |`calling`|

Expand for full list:
FUN_1c0001200
FUN_1c00014b4
FUN_1c0001d28
FUN_1c0002088
FUN_1c00022a0
FUN_1c00029f0
FUN_1c0002b50
FUN_1c0003020
FUN_1c0004610
FUN_1c0008108
FUN_1c0008610

FUN_1c0010c3c
FUN_1c00136f0
FUN_1c0015f60
FUN_1c00163f8
FUN_1c0016708
FUN_1c00169c8
FUN_1c0016ce0
FUN_1c0016ef0
FUN_1c00170f0
FUN_1c0017920
FUN_1c0017b0c
FUN_1c0017d64
FUN_1c002d070
FUN_1c002d700
FUN_1c002db00
FUN_1c002dd60
FUN_1c002dfe0
FUN_1c002f048
FUN_1c002f110
FUN_1c002f540
FUN_1c002fb40
FUN_1c00315c0
FUN_1c0032200
FUN_1c0032590
FUN_1c0032d80
FUN_1c0034200
FUN_1c0034570
FUN_1c0034730
FUN_1c0034a80
FUN_1c0034e50
FUN_1c0035010
FUN_1c0035264
FUN_1c00356e8
FUN_1c00359dc
FUN_1c0035b50
FUN_1c0035e80
FUN_1c00364d0
FUN_1c0036dd0
FUN_1c003762c
FUN_1c00377b0
FUN_1c0037960
FUN_1c0037d20
FUN_1c0038130
FUN_1c0038b50
FUN_1c0038c40
FUN_1c0039310
FUN_1c00394f0
FUN_1c0039994
FUN_1c0039eb8
FUN_1c003a444
FUN_1c003aab0
FUN_1c003ac70
FUN_1c003ad48
FUN_1c003aeb8
FUN_1c003b398
FUN_1c003be50
FUN_1c003bf8c
FUN_1c003c41c
FUN_1c003c5e0
FUN_1c003c86c
FUN_1c003cef4
FUN_1c003d600
FUN_1c003d890
FUN_1c003dc00
FUN_1c003e7d8
FUN_1c003e890
FUN_1c003e9fc
FUN_1c003eb14
FUN_1c003ed08
FUN_1c003edc8
FUN_1c003f090
FUN_1c003f370
FUN_1c003fe30
FUN_1c0040560
FUN_1c00409b0
FUN_1c0040b50
FUN_1c0041c40
FUN_1c0041da0
FUN_1c0042740
FUN_1c0042cc8
FUN_1c00431d0
FUN_1c0043af0
FUN_1c0044e50
FUN_1c00455cc
FUN_1c0045b84
FUN_1c0045d10
FUN_1c004614c
FUN_1c00473d4
FUN_1c00474c4
FUN_1c0047dc0
FUN_1c004809c
FUN_1c00480f8
FUN_1c00488a0
FUN_1c0049840
FUN_1c0049a90
FUN_1c004a230
FUN_1c004a51c
FUN_1c004aa74
FUN_1c004c3f8
FUN_1c004c4f0
FUN_1c004c958
FUN_1c004cfc8
FUN_1c004d168
FUN_1c004d31c
FUN_1c004d470
FUN_1c004d710
FUN_1c004d828
FUN_1c004e308
FUN_1c004e388
FUN_1c004e468
FUN_1c004ee40
FUN_1c004f220
FUN_1c004f388
FUN_1c00503f4
FUN_1c0050480
FUN_1c0050550
FUN_1c00505d0
FUN_1c0050620
FUN_1c0050670
FUN_1c0050850
FUN_1c0050940
FUN_1c0050ec0
FUN_1c0050f54
FUN_1c0051090
FUN_1c005149c
FUN_1c00517a0
FUN_1c0051fb0
FUN_1c0053f4c
FUN_1c00554e0
FUN_1c0055fec
FUN_1c0056aa8
FUN_1c005830c
FUN_1c0058410
FUN_1c00585ac
FUN_1c0059864
FUN_1c0059bf0
FUN_1c005a0c4
FUN_1c005a3ac
FUN_1c005b6a4
FUN_1c005b904
FUN_1c005be40
FUN_1c005c6e0
FUN_1c005c8a8
FUN_1c005dc70
FUN_1c005e0e8
FUN_1c005e720
FUN_1c005ea98
FUN_1c005ef64
FUN_1c005f180
FUN_1c005f238
FUN_1c00603e8
FUN_1c006063c
FUN_1c0060674
FUN_1c0060750
FUN_1c00609bc
FUN_1c0060aa4
FUN_1c0060be4
FUN_1c0060c48
FUN_1c0060db0
FUN_1c0060fcc
FUN_1c00610d8
FUN_1c006234c
FUN_1c0062aec
FUN_1c0062e6c
FUN_1c0063008
FUN_1c00631e0
FUN_1c0063360
FUN_1c00639b0
FUN_1c0064060
FUN_1c006421c
FUN_1c0064530
FUN_1c0064844
FUN_1c0064a78
FUN_1c0064fa0
FUN_1c0065270
FUN_1c0065780
FUN_1c0065dcc
FUN_1c0066020
FUN_1c00665c8
FUN_1c0066644
FUN_1c0066944
FUN_1c0066d9c
FUN_1c00674fc
FUN_1c00677a8
FUN_1c0067f54
FUN_1c00680b8
FUN_1c00681e8
FUN_1c00684d8
FUN_1c00687e4
FUN_1c0068984
FUN_1c0068b40
FUN_1c0068c4c
FUN_1c0068ed8
FUN_1c00694a4
FUN_1c006964c
FUN_1c0069844
FUN_1c0069fe0
FUN_1c006a268
FUN_1c006a474
FUN_1c006a550
FUN_1c006aa24
FUN_1c006aad8
FUN_1c006ad48
FUN_1c006aed0
FUN_1c006afb4
FUN_1c006b210
FUN_1c006c0c0
FUN_1c006c4d0
FUN_1c006c940
FUN_1c006cbc8
FUN_1c006d118
FUN_1c006d4d8
FUN_1c006d6f8
FUN_1c006da80
FUN_1c006db90
FUN_1c006e128
FUN_1c006e438
FUN_1c006f7e8
FUN_1c006f93c
FUN_1c006fcc0
FUN_1c006fd8c
FUN_1c00701e0
FUN_1c0070420
FUN_1c0070914
FUN_1c00709a0
FUN_1c0070c8c
FUN_1c0070d78
FUN_1c0071218
FUN_1c00714dc
FUN_1c00715cc
FUN_1c00717f0
FUN_1c0071a6c
FUN_1c007202c
FUN_1c0072108
FUN_1c0072340
FUN_1c007288c
FUN_1c0072bf4
FUN_1c0072df0
FUN_1c00731ac
FUN_1c00735f8
FUN_1c0074448
FUN_1c0074c28
FUN_1c0075208
FUN_1c007548c
FUN_1c0075784
FUN_1c0075a40
FUN_1c0075ca4
FUN_1c0075fb4
FUN_1c0076078
FUN_1c00763dc
FUN_1c007670c
FUN_1c0076960
FUN_1c0077330
FUN_1c0077580
FUN_1c00776a0
FUN_1c007778c
FUN_1c0077870
FUN_1c007845c
FUN_1c0078c58
FUN_1c0078dc4
FUN_1c0078eb0
FUN_1c0078fe8
FUN_1c00790ac
FUN_1c00791b8
FUN_1c00792b0
FUN_1c0079e80
FUN_1c0079f60
FUN_1c007a048
FUN_1c007c080
FUN_1c007c3b4

|FUN_1c004c4f0| |paramcount|1|4| |`address`|1c0002ec0|1c004c810| |`sig`|undefined __fastcall FUN_1c0002ec0(int param_1)|int __fastcall FUN_1c004c810(uint * param_1, int param_2, undefined8 * param_3, ulonglong param_4)| |sym_type|Function|Function| |sym_source|DEFAULT|DEFAULT| |external|False|False| ### FUN_1c0002ec0 Called Diff ```diff --- FUN_1c0002ec0 called +++ FUN_1c004c810 called @@ -1,2 +1,5 @@ -FUN_1c00716a4 -NTOSKRNL.EXE::IoGetCurrentProcess +FUN_1c0002ec0 +FUN_1c0009cf0 +NTOSKRNL.EXE::ExAllocatePoolWithTag +NTOSKRNL.EXE::ExFreePoolWithTag +NTOSKRNL.EXE::RtlDecompressBuffer ``` ### FUN_1c0002ec0 Calling Diff ```diff --- FUN_1c0002ec0 calling +++ FUN_1c004c810 calling @@ -1,110 +0,0 @@ -FUN_1c0001200 -FUN_1c00014b4 -FUN_1c0001d28 -FUN_1c0002088 -FUN_1c00022a0 -FUN_1c00029f0 -FUN_1c0002b50 -FUN_1c0003020 -FUN_1c0004610 -FUN_1c0008108 -FUN_1c0008610 -FUN_1c0010c3c -FUN_1c00136f0 -FUN_1c0015f60 -FUN_1c00163f8 -FUN_1c0016708 -FUN_1c00169c8 -FUN_1c0016ce0 -FUN_1c0016ef0 -FUN_1c00170f0 -FUN_1c0017920 -FUN_1c0017b0c -FUN_1c0017d64 -FUN_1c002d070 -FUN_1c002d700 -FUN_1c002db00 -FUN_1c002dd60 -FUN_1c002dfe0 -FUN_1c002f048 -FUN_1c002f110 -FUN_1c002f540 -FUN_1c002fb40 -FUN_1c00315c0 -FUN_1c0032200 -FUN_1c0032590 -FUN_1c0032d80 -FUN_1c0034200 -FUN_1c0034570 -FUN_1c0034730 -FUN_1c0034a80 -FUN_1c0034e50 -FUN_1c0035010 -FUN_1c0035264 -FUN_1c00356e8 -FUN_1c00359dc -FUN_1c0035b50 -FUN_1c0035e80 -FUN_1c00364d0 -FUN_1c0036dd0 -FUN_1c003762c -FUN_1c00377b0 -FUN_1c0037960 -FUN_1c0037d20 -FUN_1c0038130 -FUN_1c0038b50 -FUN_1c0038c40 -FUN_1c0039310 -FUN_1c00394f0 -FUN_1c0039994 -FUN_1c0039eb8 -FUN_1c003a444 -FUN_1c003aab0 -FUN_1c003ac70 -FUN_1c003ad48 -FUN_1c003aeb8 -FUN_1c003b398 -FUN_1c003be50 -FUN_1c003bf8c -FUN_1c003c41c -FUN_1c003c5e0 -FUN_1c003c86c -FUN_1c003cef4 -FUN_1c003d600 -FUN_1c003d890 -FUN_1c003dc00 -FUN_1c003e7d8 -FUN_1c003e890 -FUN_1c003e9fc -FUN_1c003eb14 -FUN_1c003ed08 -FUN_1c003edc8 -FUN_1c003f090 -FUN_1c003f370 -FUN_1c003fe30 -FUN_1c0040560 -FUN_1c00409b0 -FUN_1c0040b50 -FUN_1c0041c40 -FUN_1c0041da0 -FUN_1c0042740 -FUN_1c0042cc8 -FUN_1c00431d0 -FUN_1c0043af0 -FUN_1c0044e50 -FUN_1c00455cc -FUN_1c0045b84 -FUN_1c0045d10 -FUN_1c004614c -FUN_1c00473d4 -FUN_1c00474c4 -FUN_1c0047dc0 -FUN_1c004809c -FUN_1c00480f8 -FUN_1c00488a0 -FUN_1c0049840 -FUN_1c0049a90 -FUN_1c004a230 -FUN_1c004a51c -FUN_1c004aa74 -FUN_1c004c3f8 @@ -112,170 +1,0 @@ -FUN_1c004c958 -FUN_1c004cfc8 -FUN_1c004d168 -FUN_1c004d31c -FUN_1c004d470 -FUN_1c004d710 -FUN_1c004d828 -FUN_1c004e308 -FUN_1c004e388 -FUN_1c004e468 -FUN_1c004ee40 -FUN_1c004f220 -FUN_1c004f388 -FUN_1c00503f4 -FUN_1c0050480 -FUN_1c0050550 -FUN_1c00505d0 -FUN_1c0050620 -FUN_1c0050670 -FUN_1c0050850 -FUN_1c0050940 -FUN_1c0050ec0 -FUN_1c0050f54 -FUN_1c0051090 -FUN_1c005149c -FUN_1c00517a0 -FUN_1c0051fb0 -FUN_1c0053f4c -FUN_1c00554e0 -FUN_1c0055fec -FUN_1c0056aa8 -FUN_1c005830c -FUN_1c0058410 -FUN_1c00585ac -FUN_1c0059864 -FUN_1c0059bf0 -FUN_1c005a0c4 -FUN_1c005a3ac -FUN_1c005b6a4 -FUN_1c005b904 -FUN_1c005be40 -FUN_1c005c6e0 -FUN_1c005c8a8 -FUN_1c005dc70 -FUN_1c005e0e8 -FUN_1c005e720 -FUN_1c005ea98 -FUN_1c005ef64 -FUN_1c005f180 -FUN_1c005f238 -FUN_1c00603e8 -FUN_1c006063c -FUN_1c0060674 -FUN_1c0060750 -FUN_1c00609bc -FUN_1c0060aa4 -FUN_1c0060be4 -FUN_1c0060c48 -FUN_1c0060db0 -FUN_1c0060fcc -FUN_1c00610d8 -FUN_1c006234c -FUN_1c0062aec -FUN_1c0062e6c -FUN_1c0063008 -FUN_1c00631e0 -FUN_1c0063360 -FUN_1c00639b0 -FUN_1c0064060 -FUN_1c006421c -FUN_1c0064530 -FUN_1c0064844 -FUN_1c0064a78 -FUN_1c0064fa0 -FUN_1c0065270 -FUN_1c0065780 -FUN_1c0065dcc -FUN_1c0066020 -FUN_1c00665c8 -FUN_1c0066644 -FUN_1c0066944 -FUN_1c0066d9c -FUN_1c00674fc -FUN_1c00677a8 -FUN_1c0067f54 -FUN_1c00680b8 -FUN_1c00681e8 -FUN_1c00684d8 -FUN_1c00687e4 -FUN_1c0068984 -FUN_1c0068b40 -FUN_1c0068c4c -FUN_1c0068ed8 -FUN_1c00694a4 -FUN_1c006964c -FUN_1c0069844 -FUN_1c0069fe0 -FUN_1c006a268 -FUN_1c006a474 -FUN_1c006a550 -FUN_1c006aa24 -FUN_1c006aad8 -FUN_1c006ad48 -FUN_1c006aed0 -FUN_1c006afb4 -FUN_1c006b210 -FUN_1c006c0c0 -FUN_1c006c4d0 -FUN_1c006c940 -FUN_1c006cbc8 -FUN_1c006d118 -FUN_1c006d4d8 -FUN_1c006d6f8 -FUN_1c006da80 -FUN_1c006db90 -FUN_1c006e128 -FUN_1c006e438 -FUN_1c006f7e8 -FUN_1c006f93c -FUN_1c006fcc0 -FUN_1c006fd8c -FUN_1c00701e0 -FUN_1c0070420 -FUN_1c0070914 -FUN_1c00709a0 -FUN_1c0070c8c -FUN_1c0070d78 -FUN_1c0071218 -FUN_1c00714dc -FUN_1c00715cc -FUN_1c00717f0 -FUN_1c0071a6c -FUN_1c007202c -FUN_1c0072108 -FUN_1c0072340 -FUN_1c007288c -FUN_1c0072bf4 -FUN_1c0072df0 -FUN_1c00731ac -FUN_1c00735f8 -FUN_1c0074448 -FUN_1c0074c28 -FUN_1c0075208 -FUN_1c007548c -FUN_1c0075784 -FUN_1c0075a40 -FUN_1c0075ca4 -FUN_1c0075fb4 -FUN_1c0076078 -FUN_1c00763dc -FUN_1c007670c -FUN_1c0076960 -FUN_1c0077330 -FUN_1c0077580 -FUN_1c00776a0 -FUN_1c007778c -FUN_1c0077870 -FUN_1c007845c -FUN_1c0078c58 -FUN_1c0078dc4 -FUN_1c0078eb0 -FUN_1c0078fe8 -FUN_1c00790ac -FUN_1c00791b8 -FUN_1c00792b0 -FUN_1c0079e80 -FUN_1c0079f60 -FUN_1c007a048 -FUN_1c007c080 -FUN_1c007c3b4 ``` ### FUN_1c0002ec0 Diff ```diff --- FUN_1c0002ec0 +++ FUN_1c004c810 @@ -1,30 +1,48 @@ -void FUN_1c0002ec0(int param_1) +int FUN_1c004c810(uint *param_1,int param_2,undefined8 *param_3,ulonglong param_4) { - code *pcVar1; + ushort uVar1; int iVar2; - longlong lVar3; - int iVar4; - int local_res8 [8]; + undefined8 *puVar3; + ulonglong local_res20; - if (param_1 == 0) { - return; + local_res20 = param_4 & 0xffffffff00000000; + if ((*param_1 & 0xffff0fff) != DAT_0) { + FUN_1c0002ec0(-0x3fff30f5); + return -0x3fff30f5; } - local_res8[0] = 0; - iVar4 = 0; - if (((DAT_0 & 2) != 0) && - (iVar2 = FUN_1c00716a4(&DAT_1,L"BreakOnStatus",local_res8), iVar4 = local_res8[0], - iVar2 < 0)) { - iVar4 = DAT_2; + if ((3 < (ushort)param_1[1]) && (uVar1 = *(ushort *)((longlong)param_1 + 10), 3 < uVar1)) { + if ((param_1[2] & 0x8000) == 0) { + *param_3 = param_1; + return 0; + } + puVar3 = (undefined8 *)ExAllocatePoolWithTag(1,uVar1 + 8,0x70527348); + if (puVar3 == (undefined8 *)0x0) { + FUN_1c0002ec0(-0x3fffff66); + iVar2 = -0x3fffff66; + } + else { + *puVar3 = *(undefined8 *)param_1; + *(uint *)(puVar3 + 1) = param_1[2]; + iVar2 = RtlDecompressBuffer(2,(longlong)puVar3 + 0xc,uVar1 - 4,param_1 + 3,param_2 + -0xc, + &local_res20); + FUN_1c0002ec0(iVar2); + if ((iVar2 < 0) || (0xffff < (uint)local_res20)) { + FUN_1c0009cf0(); + FUN_1c0002ec0(-0x3fff30fe); + ExFreePoolWithTag(puVar3,0x70527348); + iVar2 = -0x3fff30fe; + } + else { + *(undefined2 *)((longlong)puVar3 + 4) = *(undefined2 *)((longlong)param_1 + 10); + *param_3 = puVar3; + } + } + return iVar2; } - if (((((DAT_0 & 2) != 0) && (param_1 == iVar4)) && - ((DAT_3 == (void *)0x0 || (DAT_3 == SystemReserved1[0xf])))) && - ((DAT_4 == 0 || (lVar3 = IoGetCurrentProcess(), DAT_4 == lVar3)))) { - pcVar1 = (code *)swi(3); - (*pcVar1)(); - return; - } - return; + FUN_1c0009cf0(); + FUN_1c0002ec0(-0x3fff30fe); + return -0x3fff30fe; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname _{Generated with `ghidriff` version: 1.0.0 on 2026-07-26T18:44:16}