# cldflt-09.sys-cldflt-10.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_899985722__private_IsEnabledFallback](#feature_899985722__private_isenabledfallback) * [Feature_29931835__private_IsEnabledDeviceUsage](#feature_29931835__private_isenableddeviceusage) * [Feature_29931835__private_IsEnabledFallback](#feature_29931835__private_isenabledfallback) * [Modified](#modified) * [WPP_SF_qqsDd](#wpp_sf_qqsdd) * [CldStreamQueryProgress](#cldstreamqueryprogress) * [CldiPortProcessAbortHydration](#cldiportprocessaborthydration) * [HsmpOpCreatePlaceholders](#hsmpopcreateplaceholders) * [CldSyncGetSyncProviderProcess](#cldsyncgetsyncproviderprocess) * [Modified (No Code Changes)](#modified-no-code-changes) * [memcpy](#memcpy) * [NTOSKRNL.EXE::ProbeForWrite](#ntoskrnlexeprobeforwrite) * [NTOSKRNL.EXE::FsRtlLookupBaseMcbEntry](#ntoskrnlexefsrtllookupbasemcbentry) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [WPP_SF_iid](#wpp_sf_iid) * [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag) * [HsmDbgBreakOnStatus](#hsmdbgbreakonstatus) * [NTOSKRNL.EXE::ExAllocatePool2](#ntoskrnlexeexallocatepool2) # Visual Chart Diff ```mermaid flowchart LR WPP_SF_qqsDd-6-old<--Match 97%-->WPP_SF_qqsDd-6-new CldStreamQueryProgress-4-old<--Match 37%-->CldStreamQueryProgress-4-new CldiPortProcessAbortHydration-3-old<--Match 97%-->CldiPortProcessAbortHydration-3-new HsmpOpCreatePlaceholders-6-old<--Match 78%-->HsmpOpCreatePlaceholders-6-new CldSyncGetSyncProviderProcess-1-old<--Match 45%-->Feature_899985722__private_IsEnabledDeviceUsage-1-new subgraph cldflt-10.sys WPP_SF_qqsDd-6-new CldStreamQueryProgress-4-new CldiPortProcessAbortHydration-3-new HsmpOpCreatePlaceholders-6-new Feature_899985722__private_IsEnabledDeviceUsage-1-new subgraph Added direction LR Feature_899985722__private_IsEnabledFallback Feature_29931835__private_IsEnabledDeviceUsage Feature_29931835__private_IsEnabledFallback end end subgraph cldflt-09.sys WPP_SF_qqsDd-6-old CldStreamQueryProgress-4-old CldiPortProcessAbortHydration-3-old HsmpOpCreatePlaceholders-6-old CldSyncGetSyncProviderProcess-1-old end ``` ```mermaid pie showData title Function Matches - 99.8905% "unmatched_funcs_len" : 3 "matched_funcs_len" : 2737 ``` ```mermaid pie showData title Matched Function Similarity - 99.5250% "matched_funcs_with_code_changes_len" : 5 "matched_funcs_with_non_code_changes_len" : 8 "matched_funcs_no_changes_len" : 2724 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 cldflt-09.sys cldflt-10.sys ``` #### Verbose Args
``` --old ['cldflt-09.sys'] --new [['cldflt-10.sys']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/cldflt.sys/B5371DB08C000/cldflt.sys -O cldflt.sys.x64.10.0.22621.5983 wget https://msdl.microsoft.com/download/symbols/cldflt.sys/F5F18A338C000/cldflt.sys -O cldflt.sys.x64.10.0.22621.1488 ``` ## Binary Metadata Diff ```diff --- cldflt-09.sys Meta +++ cldflt-10.sys Meta @@ -1,44 +1,44 @@ -Program Name: cldflt-09.sys +Program Name: cldflt-10.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f -# of Bytes: 577696 +# of Bytes: 577744 # of Memory Blocks: 14 -# of Instructions: 107660 -# of Defined Data: 7231 -# of Functions: 1368 -# of Symbols: 15277 +# of Instructions: 107843 +# of Defined Data: 7253 +# of Functions: 1372 +# of Symbols: 15298 # of Data Types: 193 # of Data Type Categories: 13 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Thu Aug 27 23:26:05 SGT 2026 +Date Created: Thu Aug 27 23:26:11 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/cldflt-09.sys -Executable MD5: c3785a17ede556825c74d3779d11b0c1 -Executable SHA256: 782c244ffc264b76a30dbb868540dcfa7c6c2eaa352d42bc9063ddd4cc0257ba -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/cldflt-09.sys?MD5=c3785a17ede556825c74d3779d11b0c1 +Executable Location: /C:/Users/Jacob/Downloads/pdbs/cldflt-10.sys +Executable MD5: 41e7c53c92fb622eb93526dc154d2f53 +Executable SHA256: 92baad640f5f90cdb9383bd8ec5d4f27b66892542bb2793a0e41bf64e6f64b6c +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/cldflt-10.sys?MD5=41e7c53c92fb622eb93526dc154d2f53 PDB Age: 1 PDB File: cldflt.pdb -PDB GUID: ab843acd-7a2a-13a0-340c-d9d2457647c2 +PDB GUID: d343ad59-739c-1f02-cfa0-acd7edd83a42 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Cloud Files Mini Filter Driver -PE Property[FileVersion]: 10.0.22621.5983 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.22621.1488 (WinBuild.160101.0800) PE Property[InternalName]: cldflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: cldflt.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.22621.5983 +PE Property[ProductVersion]: 10.0.22621.1488 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra cldflt-09.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra cldflt-09.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra cldflt-09.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra cldflt-10.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra cldflt-10.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra cldflt-10.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|3| |deleted_funcs_len|0| |modified_funcs_len|13| |added_symbols_len|11| |deleted_symbols_len|5| |diff_time|18.336546659469604| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1368, 'ExternalsName': 332, 'Implied Match': 1})| |items_to_process|32| |diff_types|Counter({'refcount': 9, 'address': 8, 'code': 5, 'length': 5, 'calling': 4, 'called': 4, 'sig': 2, 'name': 1, 'fullname': 1})| |unmatched_funcs_len|3| |total_funcs_len|2740| |matched_funcs_len|2737| |matched_funcs_with_code_changes_len|5| |matched_funcs_with_non_code_changes_len|8| |matched_funcs_no_changes_len|2724| |match_func_similarity_percent|99.5250%| |func_match_overall_percent|99.8905%| |first_matches|Counter({'SymbolsHash': 1368, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1368 "ExternalsName" : 332 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1368 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 3 "deleted_funcs_len" : 0 "modified_funcs_len" : 13 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 11 "deleted_symbols_len" : 5 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_899985722__private_IsEnabledFallback ### Function Meta |Key|cldflt-10.sys| | :---: | :---: | |name|Feature_899985722__private_IsEnabledFallback| |fullname|Feature_899985722__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_899985722__private_IsEnabledDeviceUsage| |paramcount|2| |address|1c000c13c| |sig|undefined __fastcall Feature_899985722__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_899985722__private_IsEnabledFallback +++ Feature_899985722__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_899985722__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_899985722__private_descriptor); + return; +} + ``` ## Feature_29931835__private_IsEnabledDeviceUsage ### Function Meta |Key|cldflt-10.sys| | :---: | :---: | |name|Feature_29931835__private_IsEnabledDeviceUsage| |fullname|Feature_29931835__private_IsEnabledDeviceUsage| |refcount|3| |length|49| |called|Feature_29931835__private_IsEnabledFallback| |calling|HsmpOpCreatePlaceholders| |paramcount|0| |address|1c001c1d0| |sig|ulonglong __fastcall Feature_29931835__private_IsEnabledDeviceUsage(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_29931835__private_IsEnabledDeviceUsage +++ Feature_29931835__private_IsEnabledDeviceUsage @@ -0,0 +1,17 @@ + +ulonglong Feature_29931835__private_IsEnabledDeviceUsage(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_29931835__private_featureState; + if ((Feature_29931835__private_featureState & 0x10) == 0) { + uVar1 = Feature_29931835__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_29931835__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_29931835__private_IsEnabledFallback ### Function Meta |Key|cldflt-10.sys| | :---: | :---: | |name|Feature_29931835__private_IsEnabledFallback| |fullname|Feature_29931835__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_29931835__private_IsEnabledDeviceUsage| |paramcount|2| |address|1c001c208| |sig|undefined __fastcall Feature_29931835__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_29931835__private_IsEnabledFallback +++ Feature_29931835__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_29931835__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_29931835__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## WPP_SF_qqsDd ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.96| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|WPP_SF_qqsDd|WPP_SF_qqsDd| |fullname|WPP_SF_qqsDd|WPP_SF_qqsDd| |refcount|2|2| |`length`|200|202| |called|_guard_dispatch_icall|_guard_dispatch_icall| |calling|QueryIfEAExists|QueryIfEAExists| |paramcount|6|6| |`address`|1c001c804|1c001c8a8| |sig|undefined __fastcall WPP_SF_qqsDd(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, char * param_6)|undefined __fastcall WPP_SF_qqsDd(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, char * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_qqsDd Diff ```diff --- WPP_SF_qqsDd +++ WPP_SF_qqsDd @@ -1,34 +1,34 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void WPP_SF_qqsDd(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4, undefined8 param_5,char *param_6) { longlong lVar1; longlong lVar2; char *pcVar3; undefined8 local_res20; if (param_6 == (char *)0x0) { lVar2 = 5; } else { lVar1 = -1; do { lVar2 = lVar1; lVar1 = lVar2 + 1; } while (param_6[lVar1] != '\0'); lVar2 = lVar2 + 2; } pcVar3 = param_6; if (param_6 == (char *)0x0) { pcVar3 = "NULL"; } local_res20 = param_4; (*pfnWppTraceMessage) - (param_1,0x2b,&WPP_82523a333133377590fb434d691aa7f9_Traceguids,0x82,&local_res20,8, + (param_1,0x2b,&WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids,0x85,&local_res20,8, ¶m_5,8,pcVar3,lVar2,&stack0x00000038,4,&stack0x00000040,4,0); return; } ``` ## CldStreamQueryProgress ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.09| |i_ratio|0.37| |m_ratio|0.97| |b_ratio|0.37| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|CldStreamQueryProgress|CldStreamQueryProgress| |fullname|CldStreamQueryProgress|CldStreamQueryProgress| |refcount|2|2| |`length`|5255|5527| |`called`|
Expand for full list:
CldSyncGetRootInfo
CldSyncGetSyncProviderProcess
CldSyncReferenceStream
CldiStreamRestartCountdownTimer
CldiStreamStopCountdownTimer
CldiSyncReleaseRundown
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
HsmDbgBreakOnStatus
HsmOsGetProcessSessionIdFromEproccess
HsmOsIsInSameSessionHsmiQueryFileRange
HsmpGetStreamSize
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::FsRtlAddBaseMcbEntry
NTOSKRNL.EXE::FsRtlInitializeBaseMcbEx
NTOSKRNL.EXE::FsRtlLookupBaseMcbEntry
NTOSKRNL.EXE::FsRtlRemoveBaseMcbEntry
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ProbeForWrite
TlmWriteZeroRangeQueryProgress
WPP_SF_d
WPP_SF_iid
WPP_SF_qiiiiiiiDiid
memcpy
memset
|
Expand for full list:
CldSyncGetRootInfo
CldSyncGetSyncProviderProcess
CldSyncReferenceStream
CldiStreamRestartCountdownTimer
CldiStreamStopCountdownTimer
CldiSyncReleaseRundown
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
Feature_899985722__private_IsEnabledDeviceUsage
HsmDbgBreakOnStatus
HsmOsGetProcessSessionIdFromEproccessHsmOsIsInSameSession
HsmiQueryFileRange
HsmpGetStreamSize
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::FsRtlAddBaseMcbEntry
NTOSKRNL.EXE::FsRtlInitializeBaseMcbEx
NTOSKRNL.EXE::FsRtlLookupBaseMcbEntry
NTOSKRNL.EXE::FsRtlRemoveBaseMcbEntry
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ProbeForWrite
TlmWriteZeroRangeQueryProgress
WPP_SF_d
WPP_SF_iid
WPP_SF_qiiiiiiiDiid
memcpy
memset
| |calling|CldiPortProcessQueryProgress|CldiPortProcessQueryProgress| |paramcount|4|4| |`address`|1c00411f4|1c00412e4| |sig|ulonglong __fastcall CldStreamQueryProgress(uint param_1, longlong param_2, uint param_3, uint * param_4)|ulonglong __fastcall CldStreamQueryProgress(uint param_1, longlong param_2, uint param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldStreamQueryProgress Called Diff ```diff --- CldStreamQueryProgress called +++ CldStreamQueryProgress called @@ -8,0 +9 @@ +Feature_899985722__private_IsEnabledDeviceUsage ``` ### CldStreamQueryProgress Diff ```diff --- CldStreamQueryProgress +++ CldStreamQueryProgress @@ -1,650 +1,693 @@ /* WARNING: Type propagation algorithm not settling */ ulonglong CldStreamQueryProgress(uint param_1,longlong param_2,uint param_3,uint *param_4) { - ulonglong *******pppppppuVar1; - ulonglong *****pppppuVar2; + longlong *****ppppplVar1; + longlong *****ppppplVar2; code *pcVar3; undefined4 uVar4; undefined4 uVar5; undefined4 uVar6; - ulonglong *******pppppppuVar7; - char cVar8; - uint uVar9; - int iVar10; - int iVar11; - longlong lVar12; - ulonglong *****pppppuVar13; - ulonglong ****ppppuVar14; - ulonglong ******ppppppuVar15; - ulonglong ******ppppppuVar16; - ulonglong ****ppppuVar17; - ulonglong uVar18; - ulonglong ***pppuVar19; - ulonglong ******ppppppuVar20; - ulonglong **ppuVar21; - ulonglong ******ppppppuVar22; - undefined2 uVar23; - ulonglong uVar24; - undefined8 *puVar25; - ulonglong ******ppppppuVar26; - uint uVar27; - ulonglong *****pppppuVar28; - undefined8 uVar29; + char cVar7; + uint uVar8; + int iVar9; + uint uVar10; + longlong lVar11; + longlong *******ppppppplVar12; + longlong ******pppppplVar13; + longlong *****ppppplVar14; + longlong ****pppplVar15; + ulonglong uVar16; + longlong ***ppplVar17; + longlong ******pppppplVar18; + longlong ****pppplVar19; + longlong **pplVar20; + longlong ******pppppplVar21; + undefined2 uVar22; + ulonglong uVar23; + undefined8 *puVar24; + uint uVar25; + uint uVar26; + int iVar27; + longlong *****ppppplVar28; + longlong *plVar29; + longlong lVar30; + longlong ******pppppplVar31; + undefined8 uVar32; uint local_178; - byte local_168 [8]; - ulonglong ******local_160; - ulonglong ******local_158; - uint local_150; - longlong local_148; - uint local_140; - uint local_13c; - longlong local_138; - uint local_130; - ulonglong *local_128; - ulonglong ******local_120; - ulonglong ******local_118; - ulonglong ******local_110; - ulonglong *local_108; - ulonglong ******local_100; - int local_f8; - longlong local_f0; - uint local_e8; - uint local_e4; - ulonglong ****local_e0; + byte local_174 [4]; + longlong ******local_170; + longlong ******local_168; + longlong *****local_160; + uint local_158; + longlong local_150; + longlong ******local_148; + longlong local_140; + uint local_138; + uint local_134; + longlong *local_130; + longlong ******local_128; + longlong ******local_120; + longlong ******local_118; + longlong ******local_110; + longlong *local_108; + int local_100; + longlong ******local_f8; + uint local_f0; + longlong ***local_e8; + longlong ******local_e0; undefined8 local_d8; undefined8 uStack_d0; undefined8 local_c8; undefined8 uStack_c0; undefined8 local_b8; - ulonglong *******pppppppuStack_b0; - ulonglong *******local_a8; - ulonglong ***local_a0; - ulonglong ****local_98; - ulonglong ******local_90; - undefined8 local_88; - undefined8 uStack_80; - undefined8 local_78; - undefined8 uStack_70; - undefined8 local_68; - undefined8 *******pppppppuStack_60; - undefined8 *******local_58; + longlong *******ppppppplStack_b0; + longlong *******local_a8; + longlong *****local_a0; + longlong ******local_98; + undefined8 local_90; + undefined8 uStack_88; + undefined8 local_80; + undefined8 uStack_78; + undefined8 local_70; + undefined8 *******pppppppuStack_68; + undefined8 *******local_60; + longlong ****local_58; + undefined8 local_50; + undefined8 uStack_48; - ppppppuVar22 = (ulonglong ******)0x0; - local_160 = (ulonglong ******)0x0; - local_150 = 0; + pppppplVar21 = (longlong ******)0x0; + local_170 = (longlong ******)0x0; + local_158 = 0; local_178 = 0; - local_158 = (ulonglong ******)0x0; - lVar12 = IoGetCurrentProcess(); - local_f8 = HsmOsGetProcessSessionIdFromEproccess(lVar12); - local_88 = 0; - uStack_80 = 0; - local_78 = 0; - uStack_70 = 0; - local_68 = 0; - pppppppuStack_60 = (undefined8 *******)0x0; - local_58 = (undefined8 *******)0x0; + local_168 = (longlong ******)0x0; + lVar11 = IoGetCurrentProcess(); + local_100 = HsmOsGetProcessSessionIdFromEproccess(lVar11); + local_90 = 0; + uStack_88 = 0; + local_80 = 0; + uStack_78 = 0; + local_70 = 0; + pppppppuStack_68 = (undefined8 *******)0x0; + local_60 = (undefined8 *******)0x0; local_d8 = 0; uStack_d0 = 0; local_c8 = 0; uStack_c0 = 0; local_b8 = 0; - pppppppuStack_b0 = (ulonglong *******)0x0; - local_a8 = (ulonglong *******)0x0; - local_148 = 0; - local_138 = 0; - local_128 = (ulonglong *)0x0; - local_108 = (ulonglong *)0x0; - local_168[0] = 0; + ppppppplStack_b0 = (longlong *******)0x0; + local_a8 = (longlong *******)0x0; + local_150 = 0; + local_140 = 0; + local_130 = (longlong *)0x0; + local_108 = (longlong *)0x0; + local_174[0] = 0; KeEnterCriticalRegion(); - uVar9 = CldiStreamStopCountdownTimer(); - HsmDbgBreakOnStatus(uVar9); - if (-1 < (int)uVar9) { - local_58 = &pppppppuStack_60; - pppppppuStack_60 = &pppppppuStack_60; - local_a8 = (ulonglong *******)&pppppppuStack_b0; - pppppppuStack_b0 = (ulonglong *******)&pppppppuStack_b0; + uVar8 = CldiStreamStopCountdownTimer(); + HsmDbgBreakOnStatus(uVar8); + uVar25 = 0; + if ((int)uVar8 < 0) { + pppppplVar31 = pppppplVar21; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x3f, + &WPP_0869541e88223b892cef0f9955765e5b_Traceguids,uVar8); + } + } + else { + local_60 = &pppppppuStack_68; + pppppppuStack_68 = &pppppppuStack_68; + local_a8 = (longlong *******)&ppppppplStack_b0; + ppppppplStack_b0 = (longlong *******)&ppppppplStack_b0; KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite(&DAT_0,1); - if ((ulonglong ********)DAT_1[1] == &DAT_1) { - pppppppuStack_b0 = DAT_1; - local_a8 = (ulonglong *******)&DAT_1; - DAT_1[1] = (ulonglong ******)&pppppppuStack_b0; - DAT_1 = (ulonglong *******)&pppppppuStack_b0; - if ((ulonglong ********)*DAT_2 == &DAT_1c00266d0) { - pppppppuStack_60 = &DAT_1; - local_58 = DAT_2; - *DAT_2 = &pppppppuStack_60; - DAT_2 = &pppppppuStack_60; - ppppppuVar16 = ppppppuVar22; - pppppppuVar1 = pppppppuStack_b0; -LAB_3: + ppppppplVar12 = DAT_1; + if ((longlong ********)DAT_1[1] != &DAT_1) goto LAB_1c00428d4; + ppppppplStack_b0 = DAT_1; + local_a8 = (longlong *******)&DAT_1; + DAT_1[1] = (longlong ******)&ppppppplStack_b0; + DAT_1 = (longlong *******)&ppppppplStack_b0; + if ((longlong ********)*DAT_3 != &DAT_1c00266d0) goto LAB_1c00428d4; + pppppppuStack_68 = &DAT_1; + local_60 = DAT_3; + *DAT_3 = &pppppppuStack_68; + DAT_3 = &pppppppuStack_68; + pppppplVar31 = pppppplVar21; + pppppplVar18 = pppppplVar21; + if ((undefined8 ********)ppppppplVar12 != &pppppppuStack_68) { +LAB_4: + local_f8 = (longlong ******)CONCAT44(local_f8._4_4_,(int)pppppplVar18); + local_118 = (longlong ******)0x0; + local_110 = (longlong ******)0x0; + (*ppppppplVar12)[1] = (longlong *****)&ppppppplStack_b0; + *local_a8 = (longlong ******)ppppppplVar12; + ppppppplStack_b0 = (longlong *******)*ppppppplVar12; + *ppppppplVar12 = (longlong ******)&ppppppplStack_b0; + ppppppplVar12[1] = (longlong ******)local_a8; + uVar26 = *(uint *)(ppppppplVar12 + -5); + local_148 = (longlong ******)CONCAT44(local_148._4_4_,uVar26); + local_a8 = ppppppplVar12; + if (uVar26 == 0) goto LAB_5; + uVar26 = uVar26 & 0xffff; + local_134 = *(uint *)((longlong)ppppppplVar12 + 0x2c); + local_50 = ppppppplVar12[3]; + uStack_48 = ppppppplVar12[4]; + local_98 = ppppppplVar12[0xb]; + if (ppppppplVar12[7] == (longlong ******)0x0) { + local_120 = ppppppplVar12[0xc]; + } + else { + local_120 = (longlong ******)ppppppplVar12[7][5]; + } + pppppplVar31 = ppppppplVar12[10]; + local_160 = *pppppplVar31; + local_58 = local_160[1]; + local_e8 = local_160[2][4]; + local_138 = uVar26; + local_e0 = pppppplVar31; + lVar11 = CldSyncGetSyncProviderProcess((longlong)local_e8); + local_a0 = (longlong *****)(**pppppplVar31)[5]; + if (pppppplVar31[7] == (longlong *****)0x0) { + iVar27 = *(int *)(ppppppplVar12 + 5); + } + else { + iVar27 = *(int *)(pppppplVar31[7] + 10); + } + if ((lVar11 == 0) || (uVar26 = 1 << ((char)uVar26 - 1U & 0x1f), (param_1 & uVar26) == 0)) { +LAB_6: + pppppplVar18 = (longlong ******)(ulonglong)local_158; + goto LAB_5; + } + iVar9 = HsmOsGetProcessSessionIdFromEproccess(lVar11); + cVar7 = HsmOsIsInSameSession(iVar9,iVar27,local_100); + if (cVar7 == '\0') goto LAB_6; + if (local_138 == 1) { + local_118 = ppppppplVar12[0x27]; + local_110 = ppppppplVar12[0x28]; + } + ExReleaseResourceLite(&DAT_0); + KeLeaveCriticalRegion(); + local_168 = (longlong ******)CldSyncReferenceStream((longlong)local_e8,local_a0,0); + if (local_168 == (longlong ******)0x0) { +LAB_7: + KeEnterCriticalRegion(); + ExAcquireResourceExclusiveLite(&DAT_0,1); + goto LAB_6; + } + iVar27 = local_178 - 1; + pppppplVar18 = pppppplVar21; + uVar10 = uVar25; + if (0 < iVar27) { do { - pppppppuStack_b0 = pppppppuVar1; - pppppppuVar7 = pppppppuStack_b0; - local_f0 = CONCAT44(local_f0._4_4_,(int)ppppppuVar16); - if ((undefined8 ********)pppppppuStack_b0 == &pppppppuStack_60) goto LAB_4; - local_118 = (ulonglong ******)0x0; - local_110 = (ulonglong ******)0x0; - (*pppppppuStack_b0)[1] = (ulonglong *****)&pppppppuStack_b0; - *local_a8 = (ulonglong ******)pppppppuStack_b0; - pppppppuVar1 = (ulonglong *******)*pppppppuStack_b0; - *pppppppuStack_b0 = (ulonglong ******)&pppppppuStack_b0; - pppppppuStack_b0[1] = (ulonglong ******)local_a8; - local_a8 = pppppppuStack_b0; - local_e8 = *(uint *)(pppppppuStack_b0 + -5); - } while (local_e8 == 0); - uVar27 = local_e8 & 0xffff; - local_130 = *(uint *)((longlong)pppppppuStack_b0 + 0x2c); - ppppppuVar16 = pppppppuStack_b0[3]; - ppppppuVar20 = pppppppuStack_b0[4]; - local_90 = pppppppuStack_b0[0xb]; - if (pppppppuStack_b0[7] == (ulonglong ******)0x0) { - local_100 = pppppppuStack_b0[0xc]; - } - else { - local_100 = (ulonglong ******)pppppppuStack_b0[7][5]; - } - ppppppuVar26 = pppppppuStack_b0[10]; - pppppuVar28 = *ppppppuVar26; - local_e0 = pppppuVar28[1]; - local_a0 = pppppuVar28[2][4]; - local_13c = uVar27; - pppppppuStack_b0 = pppppppuVar1; - lVar12 = CldSyncGetSyncProviderProcess((longlong)local_a0); - local_98 = (ulonglong ****)(**ppppppuVar26)[5]; - if (ppppppuVar26[7] == (ulonglong *****)0x0) { - local_140 = *(uint *)(pppppppuVar7 + 5); - } - else { - local_140 = *(uint *)(ppppppuVar26[7] + 10); - } - if ((lVar12 == 0) || (uVar27 = 1 << ((char)uVar27 - 1U & 0x1f), (param_1 & uVar27) == 0)) { -LAB_5: - ppppppuVar16 = (ulonglong ******)(ulonglong)local_150; - pppppppuVar1 = pppppppuStack_b0; - goto LAB_3; - } - iVar10 = HsmOsGetProcessSessionIdFromEproccess(lVar12); - cVar8 = HsmOsIsInSameSession(iVar10,local_140,local_f8); - if (cVar8 == '\0') goto LAB_5; - if (local_13c == 1) { - local_118 = pppppppuVar7[0x27]; - local_110 = pppppppuVar7[0x28]; - } - ExReleaseResourceLite(&DAT_0); - KeLeaveCriticalRegion(); - local_158 = (ulonglong ******)CldSyncReferenceStream((longlong)local_a0,local_98,0); - if (local_158 == (ulonglong ******)0x0) { -LAB_6: - KeEnterCriticalRegion(); - ExAcquireResourceExclusiveLite(&DAT_0,1); - goto LAB_5; - } - local_140 = 0; - iVar10 = local_178 - 1; - ppppppuVar15 = ppppppuVar22; - if (0 < iVar10) { - do { - iVar11 = (int)(iVar10 + (uint)ppppppuVar15) / 2; - local_140 = iVar11 + 1; - if (ppppppuVar26 <= local_160[(longlong)iVar11 * 2]) { - local_140 = (uint)ppppppuVar15; - iVar10 = iVar11; - } - ppppppuVar15 = (ulonglong ******)(ulonglong)local_140; - } while ((int)local_140 < iVar10); - } - lVar12 = (longlong)(int)local_140; - if (((int)local_140 < (int)local_178) && - ((ulonglong ******)local_160[lVar12 * 2] == ppppppuVar26)) { - pppppuVar13 = local_160[lVar12 * 2 + 1]; - goto LAB_7; - } - if (local_178 == local_150) { - local_150 = local_150 + 4; - local_120 = (ulonglong ******) - ExAllocatePool2(0x100,(longlong)(int)local_150 << 4,0x67706c43); - if (local_120 != (ulonglong ******)0x0) { - local_f0 = (longlong)(int)local_f0; - if (local_160 != (ulonglong ******)0x0) { - memcpy(local_120,local_160,local_f0 << 4); - ExFreePoolWithTag(local_160); - } - memset(local_120 + local_f0 * 2,0,0x40); - local_160 = local_120; - goto LAB_8; + iVar9 = (int)(iVar27 + (uint)pppppplVar18) / 2; + uVar10 = iVar9 + 1; + if (pppppplVar31 <= local_170[(longlong)iVar9 * 2]) { + uVar10 = (uint)pppppplVar18; + iVar27 = iVar9; } - uVar9 = 0xc000009a; + pppppplVar18 = (longlong ******)(ulonglong)uVar10; + } while ((int)uVar10 < iVar27); + } + lVar11 = (longlong)(int)uVar10; + if (((int)uVar10 < (int)local_178) && ((longlong ******)local_170[lVar11 * 2] == pppppplVar31) + ) { + pppppplVar18 = (longlong ******)local_170[lVar11 * 2 + 1]; + ppppplVar28 = local_160; + goto LAB_8; + } + if (local_178 == local_158) { + local_158 = local_158 + 4; + local_128 = (longlong ******)ExAllocatePool2(0x100,(longlong)(int)local_158 << 4,0x67706c43) + ; + if (local_128 == (longlong ******)0x0) { + uVar8 = 0xc000009a; HsmDbgBreakOnStatus(-0x3fffff66); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; + pppppplVar21 = local_168; + pppppplVar31 = local_170; + uVar25 = local_178; if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_9; - uVar23 = 0x40; + uVar22 = 0x40; +LAB_10: + uVar8 = 0xc000009a; + ppppplVar28 = local_160; +LAB_11: + WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar22, + &WPP_0869541e88223b892cef0f9955765e5b_Traceguids,ppppplVar28); + pppppplVar21 = local_168; + pppppplVar31 = local_170; + uVar25 = local_178; + goto LAB_9; } - else { -LAB_8: - ppppppuVar15 = local_160 + lVar12 * 2; - local_120 = ppppppuVar15; - if ((int)local_140 < (int)local_178) { - memcpy(ppppppuVar15 + 2,ppppppuVar15,(longlong)(int)(local_178 - local_140) << 4); - } - *ppppppuVar15 = (ulonglong *****)0x0; - ppppppuVar15[1] = (ulonglong *****)0x0; - FltReferenceContext(**ppppppuVar26); - *ppppppuVar15 = (ulonglong *****)ppppppuVar26; - local_178 = local_178 + 1; - pppppuVar13 = (ulonglong *****)ExAllocatePool2(0x100,0xc0,0x67706c43); - if (pppppuVar13 != (ulonglong *****)0x0) { - local_120[1] = pppppuVar13; - *(uint *)((longlong)pppppuVar13 + 0x44) = uVar27; - if ((int)local_e8 < 0) { - uVar27 = uVar27 | 0x80000000; - *(uint *)((longlong)pppppuVar13 + 0x44) = uVar27; - } - if ((local_e8 & 0x40000000) != 0) { - *(uint *)((longlong)pppppuVar13 + 0x44) = uVar27 | 0x40000000; - } - pppuVar19 = local_a0; - ppppuVar14 = (ulonglong ****)CldSyncGetSyncProviderProcess((longlong)local_a0); - pppppuVar13[0xd] = ppppuVar14; - ppppppuVar15 = ppppppuVar22; - if (pppuVar19 != (ulonglong ***)0x0) { - ppppppuVar15 = (ulonglong ******)*pppuVar19; - } - pppppuVar13[0xe] = (ulonglong ****)ppppppuVar15; - pppppuVar13[0xf] = local_98; - if (local_13c - 1 < 2) { - pppuVar19 = *local_e0; - uVar4 = *(undefined4 *)((longlong)pppuVar19 + 0x34); - uVar5 = *(undefined4 *)(pppuVar19 + 7); - uVar6 = *(undefined4 *)((longlong)pppuVar19 + 0x3c); - *(undefined4 *)(pppppuVar13 + 0x11) = *(undefined4 *)(pppuVar19 + 6); - *(undefined4 *)((longlong)pppppuVar13 + 0x8c) = uVar4; - *(undefined4 *)(pppppuVar13 + 0x12) = uVar5; - *(undefined4 *)((longlong)pppppuVar13 + 0x94) = uVar6; - pppppuVar13[0x13] = (ulonglong ****)(**ppppppuVar26)[2][4]; - if (local_13c == 1) { - cVar8 = FsRtlInitializeBaseMcbEx(pppppuVar13,1,0); - if (cVar8 == '\0') { - uVar9 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar23 = 0x42; - goto LAB_10; - } - goto LAB_9; - } - cVar8 = FsRtlInitializeBaseMcbEx(pppppuVar13 + 3,1); - if (cVar8 != '\0') { - ppppuVar14 = (ulonglong ****)HsmpGetStreamSize((longlong)*pppppuVar28); - pppppuVar13[0x17] = ppppuVar14; - goto LAB_7; - } - uVar9 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_9; - uVar23 = 0x43; - goto LAB_10; - } - } -LAB_7: - if ((pppppuVar13[9] == (ulonglong ****)0x0) || - ((longlong)local_90 < (longlong)pppppuVar13[9])) { - pppppuVar13[9] = (ulonglong ****)local_90; - } - if ((longlong)pppppuVar13[10] < (longlong)local_100) { - pppppuVar13[10] = (ulonglong ****)local_100; - } - if (*(int *)(pppppuVar13 + 6) == 0) { - *(uint *)(pppppuVar13 + 6) = local_130; - } - *(ulonglong *******)((longlong)pppppuVar13 + 0x34) = ppppppuVar16; - *(ulonglong *******)((longlong)pppppuVar13 + 0x3c) = ppppppuVar20; - if (local_13c == 1) { - lVar12 = ((ulonglong)~*(uint *)((longlong)**ppppppuVar26 + 0x1c) & 2) * 0x800; - uVar18 = ~(lVar12 - 1U); - uVar24 = uVar18 & (ulonglong)local_118; - lVar12 = ((longlong)local_110 + (longlong)local_118 + lVar12 + -1 & uVar18) - uVar24; - if ((0 < lVar12) && - (cVar8 = FsRtlAddBaseMcbEntry(pppppuVar13,uVar24,uVar24,lVar12), cVar8 == '\0')) { - HsmDbgBreakOnStatus(-0x3fffff66); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; - uVar9 = 0xc000009a; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((uVar9 = 0xc000009a, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0 && - (1 < (byte)WPP_GLOBAL_Control[0x29])))) { - uVar23 = 0x44; - goto LAB_10; - } - goto LAB_9; - } - if (lVar12 == 0) { - lVar12 = CldSyncGetRootInfo((longlong)pppppuVar28[2][4]); - TlmWriteZeroRangeQueryProgress - ((**ppppppuVar26)[2][4],pppppuVar13[0x17],pppppuVar13[0xb], - pppppuVar13[0xc],pppppuVar13[0x14],pppppuVar13[0x15],pppppuVar13[0x16],0, - 0,lVar12,0); - } - } - CldiSyncReleaseRundown((longlong)local_158); - local_158 = (ulonglong ******)0x0; - goto LAB_6; - } - uVar9 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_9; - uVar23 = 0x41; + lVar30 = (longlong)(int)local_f8; + if (local_170 != (longlong ******)0x0) { + memcpy(local_128,local_170,lVar30 << 4); + ExFreePoolWithTag(local_170); } -LAB_10: - uVar9 = 0xc000009a; -LAB_11: - WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar23, - &WPP_1f7736cd5b1c3e3a98f9d3c9be5493de_Traceguids,pppppuVar28); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; - goto LAB_9; - } - } - goto LAB_12; - } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x3f, - &WPP_1f7736cd5b1c3e3a98f9d3c9be5493de_Traceguids,uVar9); - } - local_178 = 0; - ppppppuVar16 = ppppppuVar22; - goto LAB_9; -LAB_13: - ppppppuVar20 = (ulonglong ******)((longlong)ppppppuVar20 + local_138); - goto LAB_14; -code_r0x0001c0041f84: - if (local_148 != -1) { - pppppuVar2[0x14] = (ulonglong ****)((longlong)pppppuVar2[0x14] - local_138); - } - ppppppuVar20 = (ulonglong ******)((longlong)ppppppuVar20 + local_138); - goto LAB_15; -LAB_4: - ExReleaseResourceLite(&DAT_0,pppppppuStack_b0); - KeLeaveCriticalRegion(); - ppppppuVar26 = (ulonglong ******)(longlong)(int)local_178; - local_130 = local_178 * 0x90; - *param_4 = local_130; - ppppppuVar16 = local_160; - ppppppuVar20 = ppppppuVar22; - ppppppuVar15 = ppppppuVar26; - if (param_3 < local_130) { - uVar9 = 0x801c0001; - HsmDbgBreakOnStatus(-0x7fe3ffff); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x45, - &WPP_1f7736cd5b1c3e3a98f9d3c9be5493de_Traceguids,0x801c0001); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; - } - } - else { - while (local_100 = ppppppuVar15, local_118 = ppppppuVar16, local_110 = ppppppuVar20, - (longlong)ppppppuVar20 < (longlong)ppppppuVar26) { - pppppuVar13 = *ppppppuVar16; - pppppuVar28 = (ulonglong *****)*pppppuVar13; - pppppuVar2 = ppppppuVar16[1]; - pppppuVar2[0xb] = pppppuVar13[6]; - pppppuVar2[0xc] = pppppuVar13[5]; - if ((*(uint *)((longlong)pppppuVar2 + 0x44) & 2) == 0) { - local_128 = (ulonglong *)0x0; - while (ppppppuVar16 = ppppppuVar22, (longlong)local_128 < (longlong)pppppuVar2[0x17]) { - uVar9 = HsmiQueryFileRange((longlong)*pppppuVar28,0x4244,&local_128,pppppuVar2 + 0x17, - local_168,&local_108); - HsmDbgBreakOnStatus(uVar9); - if ((int)uVar9 < 0) { - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; + memset(local_128 + lVar30 * 2,0,0x40); + local_170 = local_128; + } + pppppplVar13 = local_170 + lVar11 * 2; + if ((int)uVar10 < (int)local_178) { + memcpy(pppppplVar13 + 2,pppppplVar13,(longlong)(int)(local_178 - uVar10) << 4); + } + pppppplVar31 = local_e0; + *pppppplVar13 = (longlong *****)0x0; + pppppplVar13[1] = (longlong *****)0x0; + FltReferenceContext(**local_e0); + *pppppplVar13 = (longlong *****)pppppplVar31; + local_178 = local_178 + 1; + pppppplVar18 = (longlong ******)ExAllocatePool2(0x100,0xc0,0x67706c43); + local_128 = pppppplVar18; + local_f8 = pppppplVar18; + if (pppppplVar18 == (longlong ******)0x0) { + uVar8 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + pppppplVar21 = local_168; + pppppplVar31 = local_170; + uVar25 = local_178; + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_9; + uVar22 = 0x41; + goto LAB_10; + } + pppppplVar13[1] = (longlong *****)pppppplVar18; + *(uint *)((longlong)pppppplVar18 + 0x44) = uVar26; + if ((int)local_148 < 0) { + uVar26 = uVar26 | 0x80000000; + *(uint *)((longlong)pppppplVar18 + 0x44) = uVar26; + } + if (((ulonglong)local_148 & 0x40000000) != 0) { + *(uint *)((longlong)pppppplVar18 + 0x44) = uVar26 | 0x40000000; + } + uVar16 = Feature_899985722__private_IsEnabledDeviceUsage(); + ppplVar17 = local_e8; + if ((int)uVar16 == 0) { + pppppplVar13 = (longlong ******)CldSyncGetSyncProviderProcess((longlong)local_e8); + } + else { + pppppplVar13 = pppppplVar21; + if ((local_e8 != (longlong ***)0x0) && + (pppppplVar18 = local_128, local_e8[0xc] != (longlong **)0x0)) { + pppppplVar13 = (longlong ******)(ulonglong)*(uint *)(local_e8[0xc] + 0x10); + } + } + local_f8[0xd] = (longlong *****)pppppplVar13; + pppppplVar13 = pppppplVar21; + if (ppplVar17 != (longlong ***)0x0) { + pppppplVar13 = (longlong ******)*ppplVar17; + } + pppppplVar18[0xe] = (longlong *****)pppppplVar13; + pppppplVar18[0xf] = local_a0; + ppppplVar28 = local_160; + if (local_138 - 1 < 2) { + ppplVar17 = *local_58; + uVar4 = *(undefined4 *)((longlong)ppplVar17 + 0x34); + uVar5 = *(undefined4 *)(ppplVar17 + 7); + uVar6 = *(undefined4 *)((longlong)ppplVar17 + 0x3c); + *(undefined4 *)(pppppplVar18 + 0x11) = *(undefined4 *)(ppplVar17 + 6); + *(undefined4 *)((longlong)pppppplVar18 + 0x8c) = uVar4; + *(undefined4 *)(pppppplVar18 + 0x12) = uVar5; + *(undefined4 *)((longlong)pppppplVar18 + 0x94) = uVar6; + pppppplVar18[0x13] = (longlong *****)(**pppppplVar31)[2][4]; + if (local_138 == 1) { + cVar7 = FsRtlInitializeBaseMcbEx(pppppplVar18,1,0); + if (cVar7 == '\0') { + uVar8 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + pppppplVar21 = local_168; + pppppplVar31 = local_170; + uVar25 = local_178; if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_9; - uVar23 = 0x46; - goto LAB_11; + uVar22 = 0x42; + goto LAB_10; } - if (local_168[0] != 0) { - local_e0 = (ulonglong ****)((longlong)local_108 - (longlong)local_128); - if ((0 < (longlong)local_e0) && - (cVar8 = FsRtlAddBaseMcbEntry(pppppuVar2 + 3,local_128,local_128,local_e0), - cVar8 == '\0')) { - uVar9 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || - ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_9; - uVar23 = 0x47; - goto LAB_16; - } - if (local_e0 == (ulonglong ****)0x0) { - lVar12 = CldSyncGetRootInfo((longlong)pppppuVar28[2][4]); + cVar7 = FsRtlInitializeBaseMcbEx(pppppplVar18 + 3,1); + ppppplVar28 = local_160; + if (cVar7 == '\0') { + uVar8 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + pppppplVar21 = local_168; + pppppplVar31 = local_170; + uVar25 = local_178; + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_9; + uVar22 = 0x43; + goto LAB_10; + } + ppppplVar14 = (longlong *****)HsmpGetStreamSize((longlong)*local_160); + pppppplVar18[0x17] = ppppplVar14; + } + } +LAB_8: + if ((pppppplVar18[9] == (longlong *****)0x0) || + ((longlong)local_98 < (longlong)pppppplVar18[9])) { + pppppplVar18[9] = (longlong *****)local_98; + } + if ((longlong)pppppplVar18[10] < (longlong)local_120) { + pppppplVar18[10] = (longlong *****)local_120; + } + if (*(int *)(pppppplVar18 + 6) == 0) { + *(uint *)(pppppplVar18 + 6) = local_134; + } + *(undefined4 *)((longlong)pppppplVar18 + 0x34) = (undefined4)local_50; + *(undefined4 *)(pppppplVar18 + 7) = local_50._4_4_; + *(undefined4 *)((longlong)pppppplVar18 + 0x3c) = (undefined4)uStack_48; + *(undefined4 *)(pppppplVar18 + 8) = uStack_48._4_4_; + if (local_138 != 1) { +LAB_12: + CldiSyncReleaseRundown((longlong)local_168); + local_168 = (longlong ******)0x0; + goto LAB_7; + } + lVar11 = (ulonglong)(~*(uint *)((longlong)**pppppplVar31 + 0x1c) & 2) * 0x800; + uVar16 = ~(lVar11 - 1U); + uVar23 = uVar16 & (ulonglong)local_118; + lVar11 = ((longlong)local_110 + (longlong)local_118 + lVar11 + -1 & uVar16) - uVar23; + if ((lVar11 < 1) || + (cVar7 = FsRtlAddBaseMcbEntry(pppppplVar18,uVar23,uVar23,lVar11), cVar7 != '\0')) { + if (lVar11 == 0) { + pplVar20 = (**pppppplVar31)[2][4]; + lVar11 = CldSyncGetRootInfo((longlong)ppppplVar28[2][4]); + TlmWriteZeroRangeQueryProgress + (pplVar20,pppppplVar18[0x17],pppppplVar18[0xb],pppppplVar18[0xc], + pppppplVar18[0x14],pppppplVar18[0x15],pppppplVar18[0x16],0,0,lVar11,0); + } + goto LAB_12; + } + uVar8 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + pppppplVar21 = local_168; + pppppplVar31 = local_170; + uVar25 = local_178; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar22 = 0x44; +LAB_13: + uVar8 = 0xc000009a; + goto LAB_11; + } + goto LAB_9; + } +LAB_14: + ExReleaseResourceLite(&DAT_0); + KeLeaveCriticalRegion(); + local_134 = local_178 * 0x90; + *param_4 = local_134; + uVar25 = local_178; + if (param_3 < local_134) { + uVar8 = 0x801c0001; + HsmDbgBreakOnStatus(-0x7fe3ffff); + pppppplVar21 = local_168; + pppppplVar31 = local_170; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x45, + &WPP_0869541e88223b892cef0f9955765e5b_Traceguids,0x801c0001); + pppppplVar21 = local_168; + pppppplVar31 = local_170; + } + } + else { + pppppplVar18 = (longlong ******)(longlong)(int)local_178; + local_110 = pppppplVar18; + if (0 < (int)local_178) { + local_118 = (longlong ******)0x0; + do { + ppppplVar14 = *pppppplVar31; + ppppplVar28 = (longlong *****)*ppppplVar14; + ppppplVar2 = pppppplVar31[1]; + ppppplVar2[0xb] = ppppplVar14[6]; + ppppplVar2[0xc] = ppppplVar14[5]; + local_160 = ppppplVar28; + local_120 = pppppplVar31; + if ((*(uint *)((longlong)ppppplVar2 + 0x44) & 2) == 0) { + local_130 = (longlong *)0x0; + ppppplVar1 = ppppplVar2 + 0x17; + if (0 < (longlong)*ppppplVar1) { + do { + uVar8 = HsmiQueryFileRange((longlong)*ppppplVar28,0x4244,&local_130,ppppplVar1, + local_174,&local_108); + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { + pppppplVar21 = local_168; + pppppplVar31 = local_170; + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_9; + uVar22 = 0x46; + goto LAB_11; + } + if (local_174[0] != 0) { + lVar11 = (longlong)local_108 - (longlong)local_130; + if ((0 < lVar11) && + (cVar7 = FsRtlAddBaseMcbEntry(ppppplVar2 + 3,local_130,local_130,lVar11), + cVar7 == '\0')) { + uVar8 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + pppppplVar21 = local_168; + pppppplVar31 = local_170; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || + ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_9; + uVar22 = 0x47; + goto LAB_10; + } + ppppplVar28 = local_160; + if (lVar11 == 0) { + plVar29 = (**ppppplVar14)[2][4]; + lVar11 = CldSyncGetRootInfo((longlong)local_160[2][4]); + TlmWriteZeroRangeQueryProgress + (plVar29,*ppppplVar1,ppppplVar2[0xb],ppppplVar2[0xc],ppppplVar2[0x14], + ppppplVar2[0x15],ppppplVar2[0x16],0,0,lVar11,1); + } + ppppplVar2[0x16] = + (longlong ****) + ((longlong)local_108 + ((longlong)ppppplVar2[0x16] - (longlong)local_130)); + } + local_130 = local_108; + } while ((longlong)local_108 < (longlong)*ppppplVar1); + } + local_148 = (longlong ******)0x0; + cVar7 = FsRtlLookupBaseMcbEntry(ppppplVar2,0,&local_150,&local_140,0,0,0); + while (cVar7 != '\0') { + if (local_140 == 0) { + HsmDbgBreakOnStatus(-0x3fff30ee); + pppppplVar31 = local_148; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x48, + (**ppppplVar14)[2],ppppplVar28); + } + lVar11 = CldSyncGetRootInfo((longlong)ppppplVar28[2][4]); + pplVar20 = (**ppppplVar14)[2]; + uVar32 = 2; + pppplVar19 = ppppplVar2[0x16]; + pppplVar15 = ppppplVar2[0x15]; + goto LAB_15; + } + if (local_150 != -1) { + ppppplVar2[0x15] = (longlong ****)((longlong)ppppplVar2[0x15] + local_140); + } + local_148 = (longlong ******)((longlong)local_148 + local_140); + cVar7 = FsRtlLookupBaseMcbEntry(ppppplVar2,local_148,&local_150,&local_140,0,0,0); + } + local_148 = (longlong ******)0x0; + while (cVar7 = FsRtlLookupBaseMcbEntry + (ppppplVar2 + 3,local_148,&local_150,&local_140,0,0,0), + cVar7 != '\0') { + if (local_140 == 0) { + HsmDbgBreakOnStatus(-0x3fff30ee); + ppppplVar28 = local_160; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x49, + (**ppppplVar14)[2],local_160); + } + lVar11 = CldSyncGetRootInfo((longlong)ppppplVar28[2][4]); + pplVar20 = (**ppppplVar14)[2]; + uVar32 = 3; + pppplVar19 = ppppplVar2[0x16]; + pppplVar15 = ppppplVar2[0x15]; + pppppplVar31 = local_148; + goto LAB_15; + } + if ((local_150 != -1) && + (cVar7 = FsRtlRemoveBaseMcbEntry(ppppplVar2,local_148), cVar7 == '\0')) { + HsmDbgBreakOnStatus(-0x3fffff66); + pppppplVar21 = local_168; + pppppplVar31 = local_170; + uVar8 = 0xc000009a; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((uVar8 = 0xc000009a, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || + ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_9; + uVar22 = 0x4a; + goto LAB_13; + } + local_148 = (longlong ******)((longlong)local_148 + local_140); + } + ppppplVar2[0x14] = ppppplVar2[0x15]; + pppppplVar31 = pppppplVar21; +LAB_16: + cVar7 = FsRtlLookupBaseMcbEntry(ppppplVar2,pppppplVar31,&local_150,&local_140,0,0,0); + if (cVar7 != '\0') { + if (local_140 != 0) goto code_r0x0001c0042103; + HsmDbgBreakOnStatus(-0x3fff30ee); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4b, + (**ppppplVar14)[2],ppppplVar28); + } + lVar11 = CldSyncGetRootInfo((longlong)ppppplVar28[2][4]); + pplVar20 = (**ppppplVar14)[2]; + uVar32 = 4; + pppplVar19 = ppppplVar2[0x16]; + pppplVar15 = ppppplVar2[0x15]; +LAB_15: TlmWriteZeroRangeQueryProgress - ((**pppppuVar13)[2][4],pppppuVar2[0x17],pppppuVar2[0xb],pppppuVar2[0xc], - pppppuVar2[0x14],pppppuVar2[0x15],pppppuVar2[0x16],0,0,lVar12,1); - } - pppppuVar2[0x16] = - (ulonglong ****) - ((longlong)local_108 + ((longlong)pppppuVar2[0x16] - (longlong)local_128)); + (pplVar20[4],ppppplVar2[0x17],ppppplVar2[0xb],ppppplVar2[0xc], + ppppplVar2[0x14],pppplVar15,pppplVar19,local_150,pppppplVar31,lVar11,uVar32 + ); + pppppplVar21 = local_168; + pppppplVar31 = local_170; + uVar8 = 0xc000cf12; + goto LAB_9; + } + pppplVar15 = (longlong ****)HsmpGetStreamSize((longlong)**ppppplVar14); + pppplVar19 = ppppplVar2[0x14]; + if ((longlong)pppplVar15 < (longlong)ppppplVar2[0x14]) { + pppplVar19 = pppplVar15; + } + ppppplVar2[0x14] = pppplVar19; + pppplVar15 = (longlong ****)HsmpGetStreamSize((longlong)**ppppplVar14); + pppplVar19 = ppppplVar2[0x15]; + pppppplVar18 = local_110; + if ((longlong)pppplVar15 < (longlong)ppppplVar2[0x15]) { + pppplVar19 = pppplVar15; + } } - local_128 = local_108; - } - while (cVar8 = FsRtlLookupBaseMcbEntry(pppppuVar2,ppppppuVar16,&local_148,&local_138,0,0,0), - ppppppuVar20 = ppppppuVar22, cVar8 != '\0') { - if (local_138 == 0) { - HsmDbgBreakOnStatus(-0x3fff30ee); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x48,(**pppppuVar13)[2] - ,pppppuVar28); - } - lVar12 = CldSyncGetRootInfo((longlong)pppppuVar28[2][4]); - ppuVar21 = (**pppppuVar13)[2]; - uVar29 = 2; - ppppppuVar20 = ppppppuVar16; - goto LAB_17; + else { + ppppplVar2[0x14] = ppppplVar14[9]; + pppplVar19 = ppppplVar14[8]; } - if (local_148 != -1) { - pppppuVar2[0x15] = (ulonglong ****)((longlong)pppppuVar2[0x15] + local_138); - } - ppppppuVar16 = (ulonglong ******)((longlong)ppppppuVar16 + local_138); - } -LAB_14: - cVar8 = FsRtlLookupBaseMcbEntry(pppppuVar2 + 3,ppppppuVar20,&local_148,&local_138,0,0,0); - if (cVar8 != '\0') { - if (local_138 != 0) { - if ((local_148 == -1) || - (cVar8 = FsRtlRemoveBaseMcbEntry(pppppuVar2,ppppppuVar20), cVar8 != '\0')) - goto LAB_13; - uVar9 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar23 = 0x4a; -LAB_16: - uVar9 = 0xc000009a; - goto LAB_11; - } - goto LAB_9; - } - HsmDbgBreakOnStatus(-0x3fff30ee); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x49,(**pppppuVar13)[2], - pppppuVar28); - } - lVar12 = CldSyncGetRootInfo((longlong)pppppuVar28[2][4]); - ppuVar21 = (**pppppuVar13)[2]; - uVar29 = 3; - goto LAB_17; - } - pppppuVar2[0x14] = pppppuVar2[0x15]; - ppppppuVar20 = ppppppuVar22; -LAB_15: - cVar8 = FsRtlLookupBaseMcbEntry(pppppuVar2,ppppppuVar20,&local_148,&local_138,0,0,0); - if (cVar8 != '\0') { - if (local_138 != 0) goto code_r0x0001c0041f84; - HsmDbgBreakOnStatus(-0x3fff30ee); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4b,(**pppppuVar13)[2], - pppppuVar28); - } - lVar12 = CldSyncGetRootInfo((longlong)pppppuVar28[2][4]); - ppuVar21 = (**pppppuVar13)[2]; - uVar29 = 4; -LAB_17: - uVar9 = 0xc000cf12; - TlmWriteZeroRangeQueryProgress - (ppuVar21[4],pppppuVar2[0x17],pppppuVar2[0xb],pppppuVar2[0xc],pppppuVar2[0x14], - pppppuVar2[0x15],pppppuVar2[0x16],local_148,ppppppuVar20,lVar12,uVar29); - ppppppuVar22 = local_158; - ppppppuVar16 = local_160; - goto LAB_9; - } - ppppuVar17 = (ulonglong ****)HsmpGetStreamSize((longlong)**pppppuVar13); - ppppuVar14 = pppppuVar2[0x14]; - if ((longlong)ppppuVar17 < (longlong)pppppuVar2[0x14]) { - ppppuVar14 = ppppuVar17; - } - pppppuVar2[0x14] = ppppuVar14; - ppppuVar17 = (ulonglong ****)HsmpGetStreamSize((longlong)**pppppuVar13); - ppppuVar14 = pppppuVar2[0x15]; - ppppppuVar26 = local_100; - if ((longlong)ppppuVar17 < (longlong)pppppuVar2[0x15]) { - ppppuVar14 = ppppuVar17; - } - } - else { - pppppuVar2[0x14] = pppppuVar13[9]; - ppppuVar14 = pppppuVar13[8]; - } - pppppuVar2[0x15] = ppppuVar14; - ppppppuVar16 = local_118 + 2; - ppppppuVar15 = local_100; - ppppppuVar20 = (ulonglong ******)((longlong)local_110 + 1); - } - ProbeForWrite(param_2,local_130,1); - local_e4 = 0; - while (iVar10 = (int)ppppppuVar22, ppppppuVar22 = local_158, ppppppuVar16 = local_160, - iVar10 < (int)local_178) { - pppppuVar28 = local_160[(longlong)iVar10 * 2 + 1]; - puVar25 = (undefined8 *)((longlong)iVar10 * 0x90 + param_2); - ppppuVar14 = pppppuVar28[7]; - *puVar25 = pppppuVar28[6]; - puVar25[1] = ppppuVar14; - ppppuVar14 = pppppuVar28[9]; - puVar25[2] = pppppuVar28[8]; - puVar25[3] = ppppuVar14; - ppppuVar14 = pppppuVar28[0xb]; - puVar25[4] = pppppuVar28[10]; - puVar25[5] = ppppuVar14; - ppppuVar14 = pppppuVar28[0xd]; - puVar25[6] = pppppuVar28[0xc]; - puVar25[7] = ppppuVar14; - ppppuVar14 = pppppuVar28[0xf]; - puVar25[8] = pppppuVar28[0xe]; - puVar25[9] = ppppuVar14; - ppppuVar14 = pppppuVar28[0x11]; - puVar25[10] = pppppuVar28[0x10]; - puVar25[0xb] = ppppuVar14; - ppppuVar14 = pppppuVar28[0x13]; - puVar25[0xc] = pppppuVar28[0x12]; - puVar25[0xd] = ppppuVar14; - ppppuVar14 = pppppuVar28[0x15]; - puVar25[0xe] = pppppuVar28[0x14]; - puVar25[0xf] = ppppuVar14; - ppppuVar14 = pppppuVar28[0x17]; - puVar25[0x10] = pppppuVar28[0x16]; - puVar25[0x11] = ppppuVar14; - local_e4 = iVar10 + 1; - ppppppuVar22 = (ulonglong ******)(ulonglong)local_e4; + ppppplVar2[0x15] = pppplVar19; + local_118 = (longlong ******)((longlong)local_118 + 1); + pppppplVar31 = local_120 + 2; + local_120 = pppppplVar31; + } while ((longlong)local_118 < (longlong)pppppplVar18); + } + ProbeForWrite(param_2,local_134,1); + local_f0 = 0; + while (iVar27 = (int)pppppplVar21, pppppplVar21 = local_168, pppppplVar31 = local_170, + iVar27 < (int)local_178) { + ppppplVar28 = local_170[(longlong)iVar27 * 2 + 1]; + puVar24 = (undefined8 *)((longlong)iVar27 * 0x90 + param_2); + pppplVar19 = ppppplVar28[7]; + *puVar24 = ppppplVar28[6]; + puVar24[1] = pppplVar19; + pppplVar19 = ppppplVar28[9]; + puVar24[2] = ppppplVar28[8]; + puVar24[3] = pppplVar19; + pppplVar19 = ppppplVar28[0xb]; + puVar24[4] = ppppplVar28[10]; + puVar24[5] = pppplVar19; + pppplVar19 = ppppplVar28[0xd]; + puVar24[6] = ppppplVar28[0xc]; + puVar24[7] = pppplVar19; + pppplVar19 = ppppplVar28[0xf]; + puVar24[8] = ppppplVar28[0xe]; + puVar24[9] = pppplVar19; + pppplVar19 = ppppplVar28[0x11]; + puVar24[10] = ppppplVar28[0x10]; + puVar24[0xb] = pppplVar19; + pppplVar19 = ppppplVar28[0x13]; + puVar24[0xc] = ppppplVar28[0x12]; + puVar24[0xd] = pppplVar19; + pppplVar19 = ppppplVar28[0x15]; + puVar24[0xe] = ppppplVar28[0x14]; + puVar24[0xf] = pppplVar19; + pppplVar19 = ppppplVar28[0x17]; + puVar24[0x10] = ppppplVar28[0x16]; + puVar24[0x11] = pppplVar19; + local_f0 = iVar27 + 1; + pppppplVar21 = (longlong ******)(ulonglong)local_f0; + } } } LAB_9: - if (ppppppuVar22 != (ulonglong ******)0x0) { - CldiSyncReleaseRundown((longlong)ppppppuVar22); + if (pppppplVar21 != (longlong ******)0x0) { + CldiSyncReleaseRundown((longlong)pppppplVar21); } KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite(&DAT_0,1); - if (((undefined8 ********)pppppppuStack_60[1] == &pppppppuStack_60) && - ((undefined8 ********)*local_58 == &pppppppuStack_60)) { - *local_58 = pppppppuStack_60; - pppppppuStack_60[1] = local_58; - if (((ulonglong ********)pppppppuStack_b0[1] == &pppppppuStack_b0) && - ((ulonglong ********)*local_a8 == &pppppppuStack_b0)) { - *local_a8 = (ulonglong ******)pppppppuStack_b0; - pppppppuStack_b0[1] = (ulonglong ******)local_a8; + if (((undefined8 ********)pppppppuStack_68[1] == &pppppppuStack_68) && + ((undefined8 ********)*local_60 == &pppppppuStack_68)) { + *local_60 = pppppppuStack_68; + pppppppuStack_68[1] = local_60; + if (((longlong ********)ppppppplStack_b0[1] == &ppppppplStack_b0) && + ((longlong ********)*local_a8 == &ppppppplStack_b0)) { + *local_a8 = (longlong ******)ppppppplStack_b0; + ppppppplStack_b0[1] = (longlong ******)local_a8; ExReleaseResourceLite(&DAT_0); KeLeaveCriticalRegion(); CldiStreamRestartCountdownTimer(); - if (ppppppuVar16 != (ulonglong ******)0x0) { - lVar12 = (longlong)(int)local_178; - ppppppuVar22 = ppppppuVar16; - if (0 < (int)local_178) { + if (pppppplVar31 != (longlong ******)0x0) { + lVar11 = (longlong)(int)uVar25; + pppppplVar21 = pppppplVar31; + if (0 < (int)uVar25) { do { - if (*ppppppuVar16 != (ulonglong *****)0x0) { - FltReleaseContext(***ppppppuVar16); - } - pppppuVar28 = ppppppuVar16[1]; - if (pppppuVar28 != (ulonglong *****)0x0) { - if (pppppuVar28[2] != (ulonglong ****)0x0) { - FsRtlUninitializeBaseMcb(pppppuVar28); + if (*pppppplVar21 != (longlong *****)0x0) { + FltReleaseContext(***pppppplVar21); + } + ppppplVar28 = pppppplVar21[1]; + if (ppppplVar28 != (longlong *****)0x0) { + if (ppppplVar28[2] != (longlong ****)0x0) { + FsRtlUninitializeBaseMcb(ppppplVar28); } - if (pppppuVar28[5] != (ulonglong ****)0x0) { - FsRtlUninitializeBaseMcb(pppppuVar28 + 3); + if (ppppplVar28[5] != (longlong ****)0x0) { + FsRtlUninitializeBaseMcb(ppppplVar28 + 3); } - ExFreePoolWithTag(pppppuVar28,0x67706c43); - } - ppppppuVar16 = ppppppuVar16 + 2; - lVar12 = lVar12 + -1; - ppppppuVar22 = local_160; - } while (lVar12 != 0); + ExFreePoolWithTag(ppppplVar28,0x67706c43); + } + lVar11 = lVar11 + -1; + pppppplVar21 = pppppplVar21 + 2; + } while (lVar11 != 0); } - ExFreePoolWithTag(ppppppuVar22,0x67706c43); + ExFreePoolWithTag(pppppplVar31,0x67706c43); } KeLeaveCriticalRegion(); - return (ulonglong)uVar9; + return (ulonglong)uVar8; } } -LAB_12: +LAB_2: pcVar3 = (code *)swi(0x29); (*pcVar3)(3); pcVar3 = (code *)swi(3); - uVar18 = (*pcVar3)(); - return uVar18; + uVar16 = (*pcVar3)(); + return uVar16; +LAB_5: + ppppppplVar12 = ppppppplStack_b0; + pppppplVar31 = local_170; + if ((undefined8 ********)ppppppplStack_b0 == &pppppppuStack_68) goto LAB_14; + goto LAB_4; +code_r0x0001c0042103: + if (local_150 != -1) { + ppppplVar2[0x14] = (longlong ****)((longlong)ppppplVar2[0x14] - local_140); + } + pppppplVar31 = (longlong ******)((longlong)pppppplVar31 + local_140); + goto LAB_16; } ``` ## CldiPortProcessAbortHydration ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.9| |i_ratio|0.82| |m_ratio|0.99| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|CldiPortProcessAbortHydration|CldiPortProcessAbortHydration| |fullname|CldiPortProcessAbortHydration|CldiPortProcessAbortHydration| |refcount|2|2| |`length`|1651|1674| |`called`|CldSyncAbortOperation
CldiPortLookupSyncRootNoLock
FLTMGR.SYS::FltAcquirePushLockSharedEx
FLTMGR.SYS::FltReleasePushLockEx
HsmDbgBreakOnStatus
HsmOsBlockPlaceholderAccessByProcessId
NTOSKRNL.EXE::RtlEnumerateGenericTableWithoutSplayingAvl
WPP_SF_dd
WPP_SF_id|CldSyncAbortOperation
CldiPortLookupSyncRootNoLock
FLTMGR.SYS::FltAcquirePushLockSharedEx
FLTMGR.SYS::FltReleasePushLockEx
Feature_899985722__private_IsEnabledDeviceUsage
HsmDbgBreakOnStatus
HsmOsBlockPlaceholderAccessByProcessId
NTOSKRNL.EXE::RtlEnumerateGenericTableWithoutSplayingAvl
WPP_SF_dd
WPP_SF_id| |calling|CldiPortProcessFilterControl|CldiPortProcessFilterControl| |paramcount|3|3| |address|1c0038ad8|1c0038ad8| |sig|int __fastcall CldiPortProcessAbortHydration(undefined8 param_1, longlong param_2, uint param_3)|int __fastcall CldiPortProcessAbortHydration(undefined8 param_1, longlong param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiPortProcessAbortHydration Called Diff ```diff --- CldiPortProcessAbortHydration called +++ CldiPortProcessAbortHydration called @@ -4,0 +5 @@ +Feature_899985722__private_IsEnabledDeviceUsage ``` ### CldiPortProcessAbortHydration Diff ```diff --- CldiPortProcessAbortHydration +++ CldiPortProcessAbortHydration @@ -1,248 +1,260 @@ int CldiPortProcessAbortHydration(undefined8 param_1,longlong param_2,uint param_3) { ushort *puVar1; uint uVar2; uint uVar3; uint uVar4; int iVar5; - longlong lVar6; - ulonglong uVar7; + ulonglong uVar6; + longlong lVar7; char cVar8; undefined2 uVar9; int iVar10; undefined8 *puVar11; uint uVar12; int iVar13; - longlong local_res20; + ulonglong local_res20; longlong local_58; longlong local_50; longlong local_48; puVar1 = (ushort *)(param_2 + 0xe); local_res20 = 0; iVar13 = 0; uVar12 = 0; - local_58 = 0; local_48 = 0; local_50 = 0; + local_58 = 0; iVar5 = -0x3ffffddb; if ((((((param_3 < 0x18) || (*puVar1 < 0xf)) || (uVar2 = *(uint *)(param_2 + 8), uVar2 < 0x88)) || (0x11 < *(ushort *)(param_2 + 0x80))) || (((uVar3 = *(uint *)(param_2 + 0x84), uVar3 != 0 && ((uVar3 < (uint)*puVar1 * 8 + 0x10 || (uVar2 < uVar3)))) || (uVar2 < *(ushort *)(param_2 + 0x82))))) || (((uVar4 = *(ushort *)(param_2 + 0x82) + uVar3, uVar4 < uVar3 || (uVar2 < uVar4)) || ((*(ushort *)(param_2 + 0x80) != 10 || (*(short *)(param_2 + 0x82) != 4)))))) { iVar10 = -0x3ffffddb; } else { iVar10 = 0; iVar13 = *(int *)((ulonglong)*(uint *)(param_2 + 0x84) + param_2); } HsmDbgBreakOnStatus(iVar10); if (iVar10 < 0) { if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return iVar10; } if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0) { return iVar10; } if ((byte)WPP_GLOBAL_Control[0x29] < 2) { return iVar10; } uVar9 = 0x4b; } else { iVar10 = iVar5; if ((((((0x17 < param_3) && (0xd < *puVar1)) && (uVar2 = *(uint *)(param_2 + 8), 0x7f < uVar2)) && (*(ushort *)(param_2 + 0x78) < 0x12)) && ((uVar3 = *(uint *)(param_2 + 0x7c), uVar3 == 0 || (((uint)*puVar1 * 8 + 0x10 <= uVar3 && (uVar3 <= uVar2)))))) && (((*(ushort *)(param_2 + 0x7a) <= uVar2 && ((uVar4 = *(ushort *)(param_2 + 0x7a) + uVar3, uVar3 <= uVar4 && (uVar4 <= uVar2)))) && ((*(ushort *)(param_2 + 0x78) == 6 && (*(short *)(param_2 + 0x7a) == 8)))))) { - local_res20 = *(longlong *)((ulonglong)*(uint *)(param_2 + 0x7c) + param_2); + local_res20 = *(ulonglong *)((ulonglong)*(uint *)(param_2 + 0x7c) + param_2); iVar10 = 0; } HsmDbgBreakOnStatus(iVar10); if (iVar10 < 0) { if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return iVar10; } if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0) { return iVar10; } if ((byte)WPP_GLOBAL_Control[0x29] < 2) { return iVar10; } uVar9 = 0x4c; } else { iVar10 = iVar5; if ((((0x17 < param_3) && (4 < *puVar1)) && (uVar2 = *(uint *)(param_2 + 8), 0x37 < uVar2)) && ((*(ushort *)(param_2 + 0x30) < 0x12 && ((((uVar3 = *(uint *)(param_2 + 0x34), uVar3 == 0 || (((uint)*puVar1 * 8 + 0x10 <= uVar3 && (uVar3 <= uVar2)))) && (*(ushort *)(param_2 + 0x32) <= uVar2)) && (((uVar4 = *(ushort *)(param_2 + 0x32) + uVar3, uVar3 <= uVar4 && (uVar4 <= uVar2)) && ((*(ushort *)(param_2 + 0x30) == 6 && (*(short *)(param_2 + 0x32) == 8)))))))))) { - local_58 = *(longlong *)((ulonglong)*(uint *)(param_2 + 0x34) + param_2); + local_48 = *(longlong *)((ulonglong)*(uint *)(param_2 + 0x34) + param_2); iVar10 = 0; } HsmDbgBreakOnStatus(iVar10); if (iVar10 < 0) { if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return iVar10; } if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0) { return iVar10; } if ((byte)WPP_GLOBAL_Control[0x29] < 2) { return iVar10; } uVar9 = 0x4d; } else { iVar10 = iVar5; if (((((0x17 < param_3) && (7 < *puVar1)) && (uVar2 = *(uint *)(param_2 + 8), 0x4f < uVar2)) && (*(ushort *)(param_2 + 0x48) < 0x12)) && ((((uVar3 = *(uint *)(param_2 + 0x4c), uVar3 == 0 || (((uint)*puVar1 * 8 + 0x10 <= uVar3 && (uVar3 <= uVar2)))) && ((*(ushort *)(param_2 + 0x4a) <= uVar2 && ((uVar4 = *(ushort *)(param_2 + 0x4a) + uVar3, uVar3 <= uVar4 && (uVar4 <= uVar2)))))) && ((*(ushort *)(param_2 + 0x48) == 6 && (*(short *)(param_2 + 0x4a) == 8)))))) { - local_48 = *(longlong *)((ulonglong)*(uint *)(param_2 + 0x4c) + param_2); + local_50 = *(longlong *)((ulonglong)*(uint *)(param_2 + 0x4c) + param_2); iVar10 = 0; } HsmDbgBreakOnStatus(iVar10); if (iVar10 < 0) { if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return iVar10; } if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0) { return iVar10; } if ((byte)WPP_GLOBAL_Control[0x29] < 2) { return iVar10; } uVar9 = 0x4e; } else { iVar10 = iVar5; if (((((0x17 < param_3) && (0xc < *puVar1)) && (uVar2 = *(uint *)(param_2 + 8), 0x77 < uVar2)) && ((*(ushort *)(param_2 + 0x70) < 0x12 && (((uVar3 = *(uint *)(param_2 + 0x74), uVar3 == 0 || (((uint)*puVar1 * 8 + 0x10 <= uVar3 && (uVar3 <= uVar2)))) && (*(ushort *)(param_2 + 0x72) <= uVar2)))))) && (((uVar4 = *(ushort *)(param_2 + 0x72) + uVar3, uVar3 <= uVar4 && (uVar4 <= uVar2)) && ((*(ushort *)(param_2 + 0x70) == 6 && (*(short *)(param_2 + 0x72) == 8)))))) { - local_50 = *(longlong *)((ulonglong)*(uint *)(param_2 + 0x74) + param_2); + local_58 = *(longlong *)((ulonglong)*(uint *)(param_2 + 0x74) + param_2); iVar10 = 0; } HsmDbgBreakOnStatus(iVar10); if (iVar10 < 0) { if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return iVar10; } if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0) { return iVar10; } if ((byte)WPP_GLOBAL_Control[0x29] < 2) { return iVar10; } uVar9 = 0x4f; } else { iVar10 = iVar5; if ((((((0x17 < param_3) && (5 < *puVar1)) && (uVar2 = *(uint *)(param_2 + 8), 0x3f < uVar2)) && (*(ushort *)(param_2 + 0x38) < 0x12)) && (((uVar3 = *(uint *)(param_2 + 0x3c), uVar3 == 0 || (((uint)*puVar1 * 8 + 0x10 <= uVar3 && (uVar3 <= uVar2)))) && ((*(ushort *)(param_2 + 0x3a) <= uVar2 && ((uVar4 = *(ushort *)(param_2 + 0x3a) + uVar3, uVar3 <= uVar4 && (uVar4 <= uVar2)) )))))) && ((*(ushort *)(param_2 + 0x38) == 10 && (*(short *)(param_2 + 0x3a) == 4)))) { uVar12 = *(uint *)((ulonglong)*(uint *)(param_2 + 0x3c) + param_2); iVar10 = 0; } HsmDbgBreakOnStatus(iVar10); if (-1 < iVar10) { FltAcquirePushLockSharedEx(&DAT_0); puVar11 = DAT_1; if ((undefined8 **)DAT_1 != &DAT_1) { do { - if ((local_res20 == 0) || (puVar11[0xd] == local_res20)) { + uVar6 = Feature_899985722__private_IsEnabledDeviceUsage(); + if ((int)uVar6 == 0) { + if (local_res20 == 0) goto LAB_2; + uVar6 = puVar11[0xd]; +LAB_3: + if (uVar6 == local_res20) goto LAB_2; + } + else { + if (local_res20 != 0) { + uVar6 = (ulonglong)*(uint *)(puVar11 + 0x10); + goto LAB_3; + } +LAB_2: FltAcquirePushLockSharedEx(puVar11 + 0x12,0); - if (local_58 == 0) { - while (lVar6 = RtlEnumerateGenericTableWithoutSplayingAvl(puVar11 + 0x13), - lVar6 != 0) { - CldSyncAbortOperation(iVar13,*(longlong *)(lVar6 + 8),local_48,local_50); + if (local_48 == 0) { + while (lVar7 = RtlEnumerateGenericTableWithoutSplayingAvl(puVar11 + 0x13), + lVar7 != 0) { + CldSyncAbortOperation(iVar13,*(longlong *)(lVar7 + 8),local_50,local_58); } } else { - lVar6 = CldiPortLookupSyncRootNoLock((longlong)puVar11,local_58); - if (lVar6 != 0) { - CldSyncAbortOperation(iVar13,lVar6,local_48,local_50); + lVar7 = CldiPortLookupSyncRootNoLock((longlong)puVar11,local_48); + if (lVar7 != 0) { + CldSyncAbortOperation(iVar13,lVar7,local_50,local_58); } } FltReleasePushLockEx(puVar11 + 0x12); } puVar11 = (undefined8 *)*puVar11; } while ((undefined8 **)puVar11 != &DAT_1); } FltReleasePushLockEx(&DAT_0); if (uVar12 == 0) { return iVar10; } if ((uVar12 & 2) == 0) { if ((uVar12 & 1) == 0) { return iVar10; } cVar8 = '\0'; } else { cVar8 = '\x01'; } - uVar7 = HsmOsBlockPlaceholderAccessByProcessId(iVar13,cVar8); - iVar5 = (int)uVar7; + uVar6 = HsmOsBlockPlaceholderAccessByProcessId(iVar13,cVar8); + iVar5 = (int)uVar6; HsmDbgBreakOnStatus(iVar5); if (-1 < iVar5) { return iVar5; } if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return iVar5; } if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0) { return iVar5; } if ((byte)WPP_GLOBAL_Control[0x29] < 2) { return iVar5; } WPP_SF_dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x51, - &WPP_d162b1eaccd83c3f44dea46afe8a8b10_Traceguids,iVar13); + &WPP_6eb63e95d7c2356771b7852b9e224098_Traceguids,iVar13); return iVar5; } if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return iVar10; } if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0) { return iVar10; } if ((byte)WPP_GLOBAL_Control[0x29] < 2) { return iVar10; } uVar9 = 0x50; } } } } } WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar9, - &WPP_d162b1eaccd83c3f44dea46afe8a8b10_Traceguids,param_1); + &WPP_6eb63e95d7c2356771b7852b9e224098_Traceguids,param_1); return iVar10; } ``` ## HsmpOpCreatePlaceholders ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.36| |i_ratio|0.36| |m_ratio|0.96| |b_ratio|0.78| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|HsmpOpCreatePlaceholders|HsmpOpCreatePlaceholders| |fullname|HsmpOpCreatePlaceholders|HsmpOpCreatePlaceholders| |refcount|3|3| |`length`|4920|5309| |`called`|
Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltSetInformationFile
Feature_2930036027__private_IsEnabledDeviceUsage
HsmDbgBreakOnStatusHsmpAccessCheck
HsmpMarkHandleUsnSourceInfo
HsmpQueryLastEffectiveUsn
HsmpRpBuildBuffer
HsmpRpCreate
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpToggleFileSparseAttribute
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ProbeForRead
TlmWriteAccessDeniedForAddSubDirectory
WPP_SF_id
WPP_SF_iid
WPP_SF_qqdd
__security_check_cookie
memset
|
Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltSetInformationFile
Feature_2930036027__private_IsEnabledDeviceUsage
Feature_29931835__private_IsEnabledDeviceUsageHsmDbgBreakOnStatus
HsmpAccessCheck
HsmpMarkHandleUsnSourceInfo
HsmpQueryLastEffectiveUsn
HsmpRpBuildBuffer
HsmpRpCreate
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpToggleFileSparseAttribute
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::ProbeForWrite
TlmWriteAccessDeniedForAddSubDirectory
WPP_SF_id
WPP_SF_iid
WPP_SF_qqdd
__security_check_cookie
memcpy
memset
| |calling|HsmFltProcessCreatePlaceholders
HsmRecallTransferPlaceholders|HsmFltProcessCreatePlaceholders
HsmRecallTransferPlaceholders| |paramcount|6|6| |`address`|1c0063f00|1c0066710| |`sig`|uint __fastcall HsmpOpCreatePlaceholders(longlong param_1, undefined8 param_2, uint param_3, undefined8 param_4, int param_5, int * param_6)|uint __fastcall HsmpOpCreatePlaceholders(longlong param_1, undefined8 param_2, uint param_3, void * param_4, uint param_5, int * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmpOpCreatePlaceholders Called Diff ```diff --- HsmpOpCreatePlaceholders called +++ HsmpOpCreatePlaceholders called @@ -10,0 +11 @@ +Feature_29931835__private_IsEnabledDeviceUsage @@ -29,0 +31 @@ +NTOSKRNL.EXE::ProbeForWrite @@ -34,0 +37 @@ +memcpy ``` ### HsmpOpCreatePlaceholders Diff ```diff --- HsmpOpCreatePlaceholders +++ HsmpOpCreatePlaceholders @@ -1,607 +1,637 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Removing unreachable block (ram,0x0001c0064f81) */ -/* WARNING: Removing unreachable block (ram,0x0001c0064f85) */ -/* WARNING: Removing unreachable block (ram,0x0001c0064f99) */ +/* WARNING: Removing unreachable block (ram,0x0001c006793b) */ +/* WARNING: Removing unreachable block (ram,0x0001c006793f) */ +/* WARNING: Removing unreachable block (ram,0x0001c0067953) */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ uint HsmpOpCreatePlaceholders - (longlong param_1,undefined8 param_2,uint param_3,undefined8 param_4,int param_5, + (longlong param_1,undefined8 param_2,uint param_3,void *param_4,uint param_5, int *param_6) { undefined1 (*pauVar1) [16]; - undefined1 (*pauVar2) [16]; - ushort uVar3; + ushort uVar2; + ulonglong uVar3; ulonglong uVar4; - ulonglong uVar5; - ulonglong uVar6; - uint uVar7; - uint uVar8; - longlong lVar9; - ulonglong uVar10; - uint *puVar11; - ushort uVar12; - ushort uVar13; - uint uVar14; - undefined2 uVar15; - undefined1 (*pauVar16) [16]; - uint uVar17; - longlong ****pppplVar18; + uint uVar5; + uint uVar6; + ulonglong uVar7; + uint *puVar8; + undefined1 (*pauVar9) [16]; + ushort uVar10; + ushort uVar11; + uint uVar12; + undefined8 uVar13; + undefined2 uVar14; + undefined1 (*pauVar15) [16]; + uint uVar16; + longlong ****pppplVar17; + ulonglong uVar18; bool bVar19; - undefined1 auStackY_248 [32]; - undefined1 (*local_1c8) [16]; - uint *local_1c0; - uint local_1a0; - int local_19c; - uint local_18c; - uint local_170; - longlong **local_160; + undefined1 auStackY_268 [32]; + uint *local_1e0; + undefined1 (*local_1d8) [16]; + uint local_1b8; + uint local_1a8; + int local_1a4; + uint local_194; + void *local_178; + longlong **local_170; + longlong local_168; + undefined8 local_160; longlong local_158; - int local_150; - undefined1 (*local_148) [16]; + undefined1 (*local_150) [16]; + undefined8 local_148; undefined8 local_140; - undefined8 local_138; - undefined1 *puStack_130; - int *local_128; - undefined8 local_120; - longlong lStack_118; - undefined8 local_110; - undefined8 uStack_108; - ulonglong local_100; - undefined8 local_f8; - undefined8 uStack_f0; - undefined8 *local_e8; - undefined8 uStack_e0; - undefined8 local_d8; - ulonglong uStack_d0; - undefined8 local_c8; - undefined8 uStack_c0; + undefined1 *puStack_138; + int *local_130; + undefined8 local_128; + longlong lStack_120; + undefined8 local_118; + undefined8 uStack_110; + ulonglong local_108; + undefined8 local_100; + undefined8 uStack_f8; + undefined8 *local_f0; + undefined8 uStack_e8; + undefined8 local_e0; + ulonglong uStack_d8; + undefined8 local_d0; + undefined8 uStack_c8; undefined1 local_b8 [16]; longlong **local_a8; undefined8 uStack_a0; undefined8 local_98; undefined8 uStack_90; ulonglong local_88; longlong ***ppplStack_80; undefined8 local_78; undefined8 uStack_70; longlong **local_68; undefined8 uStack_60; undefined8 local_58; undefined8 uStack_50; undefined8 local_48; ulonglong local_40; - local_40 = __security_cookie ^ (ulonglong)auStackY_248; - local_150 = param_5; - local_128 = param_6; - pauVar2 = *(undefined1 (**) [16])(param_1 + 0x20); - puVar11 = (uint *)0x0; - local_140 = 0; - local_1c0 = (uint *)0x0; - local_19c = 0; - local_160 = (longlong **)0x0; - local_18c = 0; - local_148 = (undefined1 (*) [16])0x0; - local_120 = 0; - lStack_118 = 0; - local_110 = 0; - uStack_108 = 0; - local_100 = local_100 & 0xffffffffffff0000; - local_158 = 0; - lVar9 = IoAllocateMdl(param_4,param_5,0,0); - uVar17 = 0; - if (lVar9 == 0) { - HsmDbgBreakOnStatus(-0x3fffff66); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) - { - WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x5f, - &WPP_82523a333133377590fb434d691aa7f9_Traceguids,param_1); - local_1c0 = puVar11; - uVar7 = 0xc000009a; - goto LAB_0; + local_40 = __security_cookie ^ (ulonglong)auStackY_268; + uVar18 = (ulonglong)param_5; + local_130 = param_6; + pauVar1 = *(undefined1 (**) [16])(param_1 + 0x20); + puVar8 = (uint *)0x0; + local_1e0 = (uint *)0x0; + local_148 = 0; + local_178 = (void *)0x0; + local_1a4 = 0; + local_170 = (longlong **)0x0; + local_194 = 0; + local_150 = (undefined1 (*) [16])0x0; + local_128 = 0; + lStack_120 = 0; + local_118 = 0; + uStack_110 = 0; + local_108 = local_108 & 0xffffffffffff0000; + local_168 = 0; + local_160 = param_2; + local_158 = param_1; + uVar7 = Feature_29931835__private_IsEnabledDeviceUsage(); + if ((int)uVar7 == 0) { + local_1e0 = (uint *)IoAllocateMdl(param_4,param_5,0,0); + if (local_1e0 == (uint *)0x0) { + HsmDbgBreakOnStatus(-0x3fffff66); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29]) + ) { + WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x61, + &WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids,param_1); + } + } + else { + ProbeForRead(param_4,uVar18,4); + uVar7 = Feature_2930036027__private_IsEnabledDeviceUsage(); + MmProbeAndLockPages(local_1e0,1,(int)uVar7 != 0); + if ((*(byte *)((longlong)local_1e0 + 10) & 5) == 0) { + local_178 = (void *)MmMapLockedPagesSpecifyCache(local_1e0,0,1,0); + } + else { + local_178 = *(void **)(local_1e0 + 6); + } + if (local_178 != (void *)0x0) goto LAB_0; + HsmDbgBreakOnStatus(-0x3fffff66); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29]) + ) { + WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),99, + &WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids,param_1); + uVar5 = 0xc000009a; + goto LAB_1; + } } } else { - ProbeForRead(param_4,param_5,4); - uVar10 = Feature_2930036027__private_IsEnabledDeviceUsage(); - MmProbeAndLockPages(lVar9,1,(int)uVar10 != 0); - if ((*(byte *)(lVar9 + 10) & 5) == 0) { - local_1c0 = (uint *)MmMapLockedPagesSpecifyCache(lVar9,0,1,0); - } - else { - local_1c0 = *(uint **)(lVar9 + 0x18); - } - if (local_1c0 != (uint *)0x0) { - puVar11 = (uint *)ExAllocatePool2(0x100,0x4000,0x70527348); - if (puVar11 == (uint *)0x0) { + local_178 = (void *)ExAllocatePool2(0x102,param_5,0x70537348); + if (local_178 != (void *)0x0) { + ProbeForWrite(param_4,uVar18,4); + memcpy(local_178,param_4,uVar18); +LAB_0: + puVar8 = (uint *)ExAllocatePool2(0x100,0x4000,0x70527348); + if (puVar8 == (uint *)0x0) { HsmDbgBreakOnStatus(-0x3fffff66); - uVar7 = 0xc000009a; + uVar5 = 0xc000009a; if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - (uVar7 = 0xc000009a, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar15 = 0x62; - uVar7 = 0xc000009a; + (uVar5 = 0xc000009a, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_1; + uVar14 = 100; + uVar5 = 0xc000009a; +LAB_2: + uVar13 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); } else { - uVar7 = FltAllocateExtraCreateParameterList(DAT_1,0,&local_158); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar15 = 99; - } - else { - uVar7 = FltAllocateExtraCreateParameterFromLookasideList - (DAT_1,&GUID_ECP_ATOMIC_CREATE,0x58); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + uVar5 = FltAllocateExtraCreateParameterList(DAT_3,0,&local_168); + HsmDbgBreakOnStatus(uVar5); + if (-1 < (int)uVar5) { + uVar5 = FltAllocateExtraCreateParameterFromLookasideList + (DAT_3,&GUID_ECP_ATOMIC_CREATE,0x58); + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar15 = 100; + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_1; + uVar14 = 0x66; } else { - FltInsertExtraCreateParameter(DAT_1,local_158,0); - uVar7 = ObReferenceObjectByHandle(param_2,0,*(undefined8 *)IoFileObjectType_exref,0); - HsmDbgBreakOnStatus(uVar7); - if (-1 < (int)uVar7) { + FltInsertExtraCreateParameter(DAT_3,local_168,0); + uVar5 = ObReferenceObjectByHandle(param_2,0,*(undefined8 *)IoFileObjectType_exref,0); + HsmDbgBreakOnStatus(uVar5); + if (-1 < (int)uVar5) { + uVar16 = 0; do { - local_1c8 = (undefined1 (*) [16])0x0; - pppplVar18 = (longlong ****)0x50; + local_1d8 = (undefined1 (*) [16])0x0; + pppplVar17 = (longlong ****)0x50; memset(local_b8,0,0x50); - pauVar1 = (undefined1 (*) [16])((longlong)local_1c0 + (ulonglong)local_18c); - local_138 = 0; - puStack_130 = (undefined1 *)0x0; - local_f8 = 0; - uStack_f0 = 0; - local_e8 = (undefined8 *)0x0; - uStack_e0 = 0; - local_d8 = 0; - uStack_d0 = uStack_d0 & 0xffffffff00000000; - local_c8 = 0; - uStack_c0 = 0; + pauVar9 = (undefined1 (*) [16])((ulonglong)local_194 + (longlong)local_178); + local_140 = 0; + puStack_138 = (undefined1 *)0x0; + local_100 = 0; + uStack_f8 = 0; + local_f0 = (undefined8 *)0x0; + uStack_e8 = 0; + local_e0 = 0; + uStack_d8 = uStack_d8 & 0xffffffff00000000; + local_d0 = 0; + uStack_c8 = 0; local_68 = (longlong **)0x0; uStack_60 = 0; local_58 = 0; uStack_50 = 0; local_48 = 0; bVar19 = true; - uVar7 = local_150 - local_18c; - pauVar16 = (undefined1 (*) [16])(ulonglong)uVar7; - if (uVar7 < 0x50) { - uVar7 = 0xc000cf0b; + uVar5 = param_5 - local_194; + pauVar15 = (undefined1 (*) [16])(ulonglong)uVar5; + if (uVar5 < 0x50) { + uVar5 = 0xc000cf0b; HsmDbgBreakOnStatus(-0x3fff30f5); - uVar14 = ~-(uint)(local_19c != 0) & 0xc000cf0b; + uVar12 = ~-(uint)(local_1a4 != 0) & 0xc000cf0b; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x66; -LAB_2: - uVar7 = 0xc000cf0b; - pppplVar18 = (longlong ****)&WPP_82523a333133377590fb434d691aa7f9_Traceguids; - WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(short)pauVar16, - &WPP_82523a333133377590fb434d691aa7f9_Traceguids,param_1); + pauVar15 = (undefined1 (*) [16])0x68; +LAB_4: + uVar5 = 0xc000cf0b; + pppplVar17 = (longlong ****)&WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids; + WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(short)pauVar15, + &WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids,param_1); } break; } - local_b8 = *pauVar1; - local_a8 = *(longlong ***)pauVar1[1]; - uStack_a0 = *(undefined8 *)(pauVar1[1] + 8); - local_98 = *(undefined8 *)pauVar1[2]; - uStack_90 = *(undefined8 *)(pauVar1[2] + 8); - local_88 = *(ulonglong *)pauVar1[3]; - ppplStack_80 = *(longlong ****)(pauVar1[3] + 8); - local_78 = *(undefined8 *)pauVar1[4]; - uStack_70 = *(undefined8 *)(pauVar1[4] + 8); - pppplVar18 = (longlong ****)(local_b8._8_8_ >> 0x20 & 0xffff); - uVar14 = (uint)pppplVar18; - uVar3 = local_b8._14_2_; - uVar12 = local_b8._10_2_; - uVar13 = local_b8._8_2_; - uVar8 = uVar14 + uVar3; - if (uVar14 + uVar3 < (uint)uVar13 + (uint)uVar12) { - uVar8 = (uint)uVar13 + (uint)uVar12; - } - if (((uVar7 < uVar13) || (uVar7 - uVar13 < (uint)uVar12)) || - ((uVar7 < uVar14 || ((uVar7 - uVar14 < (uint)uVar3 || (0x1000 < uVar3)))))) { -LAB_3: - uVar7 = 0xc000cf0b; + local_b8 = *pauVar9; + local_a8 = *(longlong ***)pauVar9[1]; + uStack_a0 = *(undefined8 *)(pauVar9[1] + 8); + local_98 = *(undefined8 *)pauVar9[2]; + uStack_90 = *(undefined8 *)(pauVar9[2] + 8); + local_88 = *(ulonglong *)pauVar9[3]; + ppplStack_80 = *(longlong ****)(pauVar9[3] + 8); + local_78 = *(undefined8 *)pauVar9[4]; + uStack_70 = *(undefined8 *)(pauVar9[4] + 8); + pppplVar17 = (longlong ****)(local_b8._8_8_ >> 0x20 & 0xffff); + uVar12 = (uint)pppplVar17; + uVar2 = local_b8._14_2_; + uVar10 = local_b8._10_2_; + uVar11 = local_b8._8_2_; + uVar6 = uVar12 + uVar2; + if (uVar12 + uVar2 < (uint)uVar11 + (uint)uVar10) { + uVar6 = (uint)uVar11 + (uint)uVar10; + } + if ((((uVar5 < uVar11) || (uVar5 - uVar11 < (uint)uVar10)) || (uVar5 < uVar12)) || + ((uVar5 - uVar12 < (uint)uVar2 || (0x1000 < uVar2)))) { +LAB_5: + uVar5 = 0xc000cf0b; HsmDbgBreakOnStatus(-0x3fff30f5); - uVar14 = ~-(uint)(local_19c != 0) & 0xc000cf0b; + uVar12 = ~-(uint)(local_1a4 != 0) & 0xc000cf0b; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0 && (1 < (byte)WPP_GLOBAL_Control[0x29])))) { - pauVar16 = (undefined1 (*) [16])0x67; - pppplVar18 = (longlong ****)&WPP_82523a333133377590fb434d691aa7f9_Traceguids; - WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x67, - &WPP_82523a333133377590fb434d691aa7f9_Traceguids,param_1); + pauVar15 = (undefined1 (*) [16])0x69; + pppplVar17 = (longlong ****)&WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids; + WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x69, + &WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids,param_1); } break; } - pppplVar18 = (longlong ****)(ulonglong)(uint)local_b8._0_4_; + pppplVar17 = (longlong ****)(ulonglong)(uint)local_b8._0_4_; if ((local_b8._0_4_ != 0) && - (((uint)local_b8._0_4_ < uVar8 || (uVar7 < (uint)local_b8._0_4_)))) - goto LAB_3; - pauVar16 = (undefined1 (*) [16])(*pauVar1 + uVar13); - uVar13 = 0; - uVar14 = uVar17; - if (uVar12 >> 1 != 0) { + (((uint)local_b8._0_4_ < uVar6 || (uVar5 < (uint)local_b8._0_4_)))) + goto LAB_5; + pauVar15 = (undefined1 (*) [16])(*pauVar9 + uVar11); + uVar11 = 0; + uVar12 = uVar16; + if (uVar10 >> 1 != 0) { do { - if ((*(short *)(*pauVar16 + (ulonglong)uVar13 * 2) == 0x5c) || - (*(short *)(*pauVar16 + (ulonglong)uVar13 * 2) == 0x3a)) { - uVar7 = 0xc000cf0b; + if ((*(short *)(*pauVar15 + (ulonglong)uVar11 * 2) == 0x5c) || + (*(short *)(*pauVar15 + (ulonglong)uVar11 * 2) == 0x3a)) { + uVar5 = 0xc000cf0b; HsmDbgBreakOnStatus(-0x3fff30f5); if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0 || - ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_4; - pauVar16 = (undefined1 (*) [16])0x68; - goto LAB_5; - } - uVar13 = uVar13 + 1; - } while (uVar13 < uVar12 >> 1); + ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x6a; + goto LAB_7; + } + uVar11 = uVar11 + 1; + } while (uVar11 < uVar10 >> 1); } if ((local_b8._0_4_ & 3) != 0) { HsmDbgBreakOnStatus(-0x3fff30f5); - uVar7 = 0xc000cf0b; + uVar5 = 0xc000cf0b; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (uVar14 = 0, uVar7 = 0xc000cf0b, - (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && + (uVar5 = 0xc000cf0b, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x69; - uVar14 = uVar17; - goto LAB_2; + pauVar15 = (undefined1 (*) [16])0x6b; + uVar12 = 0; + goto LAB_4; } break; } - uVar10 = local_88 & 0x10; - uVar4 = local_88 & 0x10; - uVar5 = local_88 & 0x10; + uVar7 = local_88 & 0x10; + uVar18 = local_88 & 0x10; + uVar3 = local_88 & 0x10; if (((((local_88 & 0x10) == 0) && ((param_3 & 2) == 0)) && ((longlong ****)ppplStack_80 != (longlong ****)0x0)) || ((((local_88 & 0x10) != 0 && ((param_3 & 4) == 0)) && ((local_b8[4] & 0x40) == 0) ))) { HsmDbgBreakOnStatus(-0x3fff30f5); - uVar7 = 0xc000cf0b; + uVar5 = 0xc000cf0b; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (uVar7 = 0xc000cf0b, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && + (uVar5 = 0xc000cf0b, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x6a; -LAB_5: - uVar7 = 0xc000cf0b; -LAB_6: - pppplVar18 = (longlong ****)&WPP_82523a333133377590fb434d691aa7f9_Traceguids; - WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(short)pauVar16, - &WPP_82523a333133377590fb434d691aa7f9_Traceguids,param_1); - } - } - else if (uVar3 == 0) { - uVar7 = 0xc000cf0b; + pauVar15 = (undefined1 (*) [16])0x6c; +LAB_7: + uVar5 = 0xc000cf0b; +LAB_8: + pppplVar17 = (longlong ****)&WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids; + WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(short)pauVar15, + &WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids,param_1); + } + } + else if (uVar2 == 0) { + uVar5 = 0xc000cf0b; HsmDbgBreakOnStatus(-0x3fff30f5); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x6b; - goto LAB_5; + pauVar15 = (undefined1 (*) [16])0x6d; + goto LAB_7; } } else { - local_19c = local_19c + 1; - uVar6 = (ulonglong)local_78 >> 0x20; - local_78 = CONCAT44((int)uVar6,0xc000cf07); + local_1a4 = local_1a4 + 1; + uVar4 = (ulonglong)local_78 >> 0x20; + local_78 = CONCAT44((int)uVar4,0xc000cf07); uStack_70 = 0; if ((local_88 & 0x10) != 0) { - pppplVar18 = (longlong ****)0x4; - pauVar16 = local_148; - uVar7 = HsmpAccessCheck(param_1,(ulonglong)local_148,4); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + pppplVar17 = (longlong ****)0x4; + pauVar15 = local_150; + uVar5 = HsmpAccessCheck(param_1,(ulonglong)local_150,4); + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (pauVar16 = (undefined1 (*) [16]) - (ulonglong)*(uint *)(WPP_GLOBAL_Control + 0x2c), - (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x6c; - pppplVar18 = (longlong ****)&WPP_82523a333133377590fb434d691aa7f9_Traceguids + pauVar15 = (undefined1 (*) [16])0x6e; + pppplVar17 = (longlong ****)&WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids ; - WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x6c, - &WPP_82523a333133377590fb434d691aa7f9_Traceguids,param_1); + WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x6e, + &WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids,param_1); } TlmWriteAccessDeniedForAddSubDirectory(); - goto LAB_4; - } - } - local_170 = (uint)local_88 | 0x401000; - if (uVar10 == 0) { - local_1a0 = (uint)local_88 >> 9 & 1; + goto LAB_6; + } + } + local_1b8 = (uint)local_88 | 0x401000; + if (uVar7 == 0) { + local_1a8 = (uint)local_88 >> 9 & 1; } else { - local_1a0 = 0x10; + local_1a8 = 0x10; if ((local_b8[4] & 0x40) != 0) { - local_1a0 = 0x16; - local_170 = (uint)local_88 & 0xffbfefff; + local_1a8 = 0x16; + local_1b8 = (uint)local_88 & 0xffbfefff; } } if ((local_b8[4] & 1) != 0) { - local_1a0 = local_1a0 | 0x40; + local_1a8 = local_1a8 | 0x40; } if ((local_b8._4_4_ & 0x400) != 0) { - local_1a0 = local_1a0 | 0x100; - } - pppplVar18 = (longlong ****)(*pauVar1 + (ushort)local_b8._12_2_); - pauVar16 = (undefined1 (*) [16])(ulonglong)local_1a0; - uVar7 = HsmpRpBuildBuffer(ppplStack_80,local_1a0,pppplVar18,local_b8._14_2_, - puVar11); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + local_1a8 = local_1a8 | 0x100; + } + pppplVar17 = (longlong ****)(*pauVar9 + (ushort)local_b8._12_2_); + pauVar15 = (undefined1 (*) [16])(ulonglong)local_1a8; + uVar5 = HsmpRpBuildBuffer(ppplStack_80,local_1a8,pppplVar17,local_b8._14_2_,puVar8 + ); + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x6d; - goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x6f; + goto LAB_8; } } else { uRam0000000000000000 = 0x58; uRam0000000000000002 = 0x1e32; uRam0000000000000004 = 0; - sRam0000000000000006 = (short)puVar11[1] + 8; - _DAT_7 = &local_a8; - uRam0000000000000028 = local_170; - if (uVar4 == 0) { + sRam0000000000000006 = (short)puVar8[1] + 8; + _DAT_9 = &local_a8; + uRam0000000000000028 = local_1b8; + if (uVar18 == 0) { if (0 < (longlong)ppplStack_80) { uRam0000000000000002 = 0x1e33; } pppplRam0000000000000010 = (longlong ****)ppplStack_80; pppplRam0000000000000018 = (longlong ****)ppplStack_80; uRam0000000000000002 = uRam0000000000000002 | 0xc; } uRam000000000000002c = 8; - local_110 = 0; - uStack_108 = 0; - local_120 = 0x28; - local_100 = 1; - lStack_118 = local_158; - puStack_130 = *pauVar1 + (ushort)local_b8._8_2_; - local_138._0_4_ = CONCAT22(local_b8._10_2_,local_b8._10_2_); - local_f8 = CONCAT44(local_f8._4_4_,0x30); - uStack_e0 = CONCAT44(uStack_e0._4_4_,0x240); - local_e8 = &local_138; - local_d8 = 0; - uStack_d0 = 0; - pppplVar18 = (longlong ****)&local_160; - pauVar16 = pauVar2; - uStack_f0 = param_2; - puRam0000000000000008 = puVar11; - uVar7 = FltCreateFileEx2(DAT_1); - HsmDbgBreakOnStatus(uVar7); - if ((uVar7 == 0xc0000035) || (uVar7 == 0xc0000279)) { + local_118 = 0; + uStack_110 = 0; + local_128 = 0x28; + local_108 = 1; + lStack_120 = local_168; + puStack_138 = *pauVar9 + (ushort)local_b8._8_2_; + local_140._0_4_ = CONCAT22(local_b8._10_2_,local_b8._10_2_); + local_100 = CONCAT44(local_100._4_4_,0x30); + uStack_e8 = CONCAT44(uStack_e8._4_4_,0x240); + local_f0 = &local_140; + local_e0 = 0; + uStack_d8 = 0; + pppplVar17 = (longlong ****)&local_170; + pauVar15 = pauVar1; + uStack_f8 = param_2; + puRam0000000000000008 = puVar8; + uVar5 = FltCreateFileEx2(DAT_3); + HsmDbgBreakOnStatus(uVar5); + if ((uVar5 == 0xc0000035) || (uVar5 == 0xc0000279)) { bVar19 = (local_b8._4_4_ & 0x4000) == 0; } if (!bVar19) { - pppplVar18 = (longlong ****)&local_160; - pauVar16 = pauVar2; - uVar7 = FltCreateFileEx(DAT_1); - HsmDbgBreakOnStatus(uVar7); - } - if ((int)uVar7 < 0) { + pppplVar17 = (longlong ****)&local_170; + pauVar15 = pauVar1; + uVar5 = FltCreateFileEx(DAT_3); + HsmDbgBreakOnStatus(uVar5); + } + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x6e; - goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x70; + goto LAB_8; } } else if (bVar19) { - *(longlong ***)pauVar1[1] = local_a8; - *(undefined8 *)(pauVar1[1] + 8) = uStack_a0; - *(undefined8 *)pauVar1[2] = local_98; - *(undefined8 *)(pauVar1[2] + 8) = uStack_90; - *(uint *)pauVar1[3] = uRam0000000000000028; - *(undefined8 *)(pauVar1[4] + 8) = uRam0000000000000030; - local_1c8 = pauVar1; -LAB_8: - pauVar16 = local_1c8; + *(longlong ***)pauVar9[1] = local_a8; + *(undefined8 *)(pauVar9[1] + 8) = uStack_a0; + *(undefined8 *)pauVar9[2] = local_98; + *(undefined8 *)(pauVar9[2] + 8) = uStack_90; + *(uint *)pauVar9[3] = uRam0000000000000028; + *(undefined8 *)(pauVar9[4] + 8) = uRam0000000000000030; + local_1d8 = pauVar9; +LAB_10: + pauVar15 = local_1d8; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x77; - pppplVar18 = (longlong ****)&WPP_82523a333133377590fb434d691aa7f9_Traceguids + pauVar15 = (undefined1 (*) [16])0x79; + pppplVar17 = (longlong ****)&WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids ; - WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x77, - &WPP_82523a333133377590fb434d691aa7f9_Traceguids,param_1); + WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x79, + &WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids,param_1); } } else { - pppplVar18 = (longlong ****)0x8; - pauVar16 = local_1c8; - uVar7 = HsmpMarkHandleUsnSourceInfo(param_1,0,8,0); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + pppplVar17 = (longlong ****)0x8; + pauVar15 = local_1d8; + uVar5 = HsmpMarkHandleUsnSourceInfo(param_1,0,8,0); + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x6f; - goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x71; + goto LAB_8; } } else { - pauVar16 = local_1c8; - pppplVar18 = (longlong ****)ppplStack_80; - uVar7 = HsmpRpCreate(param_1,0,(longlong)ppplStack_80,local_1a0, - *pauVar1 + (ushort)local_b8._12_2_,local_b8._14_2_,'\0' + pauVar15 = local_1d8; + pppplVar17 = (longlong ****)ppplStack_80; + uVar5 = HsmpRpCreate(param_1,0,(longlong)ppplStack_80,local_1a8, + *pauVar9 + (ushort)local_b8._12_2_,local_b8._14_2_,'\0' ); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x70; - goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x72; + goto LAB_8; } } - else if ((uVar5 == 0) && ((longlong ****)ppplStack_80 != (longlong ****)0x0) + else if ((uVar3 == 0) && ((longlong ****)ppplStack_80 != (longlong ****)0x0) ) { - pppplVar18 = (longlong ****)CONCAT71((int7)((ulonglong)pppplVar18 >> 8),1) + pppplVar17 = (longlong ****)CONCAT71((int7)((ulonglong)pppplVar17 >> 8),1) ; - pauVar16 = local_1c8; - uVar7 = HsmpToggleFileSparseAttribute(param_1,0,'\x01'); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + pauVar15 = local_1d8; + uVar5 = HsmpToggleFileSparseAttribute(param_1,0,'\x01'); + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x71; - goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x73; + goto LAB_8; } } else { - pppplVar18 = &ppplStack_80; - pauVar16 = local_1c8; - uVar7 = FltSetInformationFile(pauVar2,0,pppplVar18,8); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + pppplVar17 = &ppplStack_80; + pauVar15 = local_1d8; + uVar5 = FltSetInformationFile(pauVar1,0,pppplVar17,8); + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x72; - goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x74; + goto LAB_8; } } else { - pauVar16 = local_1c8; - pppplVar18 = (longlong ****)ppplStack_80; - uVar7 = HsmpSetFileVDL(pauVar2,0,ppplStack_80); - HsmDbgBreakOnStatus(uVar7); - if (-1 < (int)uVar7) goto LAB_9; + pauVar15 = local_1d8; + pppplVar17 = (longlong ****)ppplStack_80; + uVar5 = HsmpSetFileVDL(pauVar1,0,ppplStack_80); + HsmDbgBreakOnStatus(uVar5); + if (-1 < (int)uVar5) goto LAB_11; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x73; - goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x75; + goto LAB_8; } } } } else { -LAB_9: +LAB_11: local_68 = local_a8; uStack_60 = uStack_a0; local_58 = local_98; uStack_50 = uStack_90; - local_48 = CONCAT44((int)(local_88 >> 0x20),local_170); - pppplVar18 = (longlong ****)&local_68; - pauVar16 = local_1c8; - uVar7 = FltSetInformationFile(pauVar2,0,pppplVar18,0x28); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + local_48 = CONCAT44((int)(local_88 >> 0x20),local_1b8); + pppplVar17 = (longlong ****)&local_68; + pauVar15 = local_1d8; + uVar5 = FltSetInformationFile(pauVar1,0,pppplVar17,0x28); + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x74; - goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x76; + goto LAB_8; } } else { - pppplVar18 = (longlong ****)(pauVar1[4] + 8); - pauVar16 = local_1c8; - uVar7 = HsmpQueryLastEffectiveUsn(pauVar2,0,(longlong *)pppplVar18); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + pppplVar17 = (longlong ****)(pauVar9[4] + 8); + pauVar15 = local_1d8; + uVar5 = HsmpQueryLastEffectiveUsn(pauVar1,0,(longlong *)pppplVar17); + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x75; - goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x77; + goto LAB_8; } } else { - pppplVar18 = (longlong ****)&local_68; - uVar7 = FltQueryInformationFile(pauVar2,0,pppplVar18,0x28); - HsmDbgBreakOnStatus(uVar7); - if (-1 < (int)uVar7) { - *(longlong ***)pauVar1[1] = local_68; - *(undefined8 *)(pauVar1[1] + 8) = uStack_60; - *(undefined8 *)pauVar1[2] = local_58; - *(undefined8 *)(pauVar1[2] + 8) = uStack_50; - *(undefined8 *)pauVar1[3] = local_48; - goto LAB_8; + pppplVar17 = (longlong ****)&local_68; + uVar5 = FltQueryInformationFile(pauVar1,0,pppplVar17,0x28); + HsmDbgBreakOnStatus(uVar5); + if (-1 < (int)uVar5) { + *(longlong ***)pauVar9[1] = local_68; + *(undefined8 *)(pauVar9[1] + 8) = uStack_60; + *(undefined8 *)pauVar9[2] = local_58; + *(undefined8 *)(pauVar9[2] + 8) = uStack_50; + *(undefined8 *)pauVar9[3] = local_48; + goto LAB_10; } - pauVar16 = local_1c8; + pauVar15 = local_1d8; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar16 = (undefined1 (*) [16])0x76; - goto LAB_6; + pauVar15 = (undefined1 (*) [16])0x78; + goto LAB_8; } } } } } } } } -LAB_4: - *(uint *)pauVar1[4] = uVar7; - if ((longlong ***)local_160 != (longlong ***)0x0) { +LAB_6: + *(uint *)pauVar9[4] = uVar5; + if ((longlong ***)local_170 != (longlong ***)0x0) { FltClose(); - local_160 = (longlong **)0x0; - } - if (((int)uVar7 < 0) && ((param_3 & 1) != 0)) break; - uVar8 = uVar17; + local_170 = (longlong **)0x0; + } + if (((int)uVar5 < 0) && (uVar12 = 0, (param_3 & 1) != 0)) break; + uVar6 = 0; if (local_b8._0_4_ != 0) { - uVar8 = local_18c + local_b8._0_4_; - } - local_18c = uVar8; - } while (uVar8 != 0); - if ((((local_19c != 0) && - (uVar7 = uVar14, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + uVar6 = local_194 + local_b8._0_4_; + } + uVar12 = uVar16; + local_194 = uVar6; + } while (uVar6 != 0); + if ((((local_1a4 != 0) && + (uVar5 = uVar12, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),pauVar16,pppplVar18,param_1); + WPP_SF_qqdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),pauVar15,pppplVar17,param_1); } - *local_128 = local_19c; - goto LAB_0; + *local_130 = local_1a4; + goto LAB_1; } if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar15 = 0x65; + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_1; + uVar14 = 0x67; } + goto LAB_2; } + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_1; + uVar14 = 0x65; + uVar13 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); } - WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar15, - &WPP_82523a333133377590fb434d691aa7f9_Traceguids,param_1); - goto LAB_0; + WPP_SF_iid(uVar13,uVar14,&WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids,param_1); + goto LAB_1; } HsmDbgBreakOnStatus(-0x3fffff66); + local_1e0 = puVar8; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x61, - &WPP_82523a333133377590fb434d691aa7f9_Traceguids,param_1); + WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x5f, + &WPP_bb9e46e8e4f33b30481970d570d4e581_Traceguids,param_1); } } - uVar7 = 0xc000009a; -LAB_0: - if (puVar11 != (uint *)0x0) { - ExFreePoolWithTag(puVar11,0x70527348); + uVar5 = 0xc000009a; +LAB_1: + if (puVar8 != (uint *)0x0) { + ExFreePoolWithTag(puVar8,0x70527348); } - if (local_158 != 0) { - FltFreeExtraCreateParameterList(DAT_1); + if (local_168 != 0) { + FltFreeExtraCreateParameterList(DAT_3); } - if (local_1c0 != (uint *)0x0) { - MmUnlockPages(lVar9); + uVar7 = Feature_29931835__private_IsEnabledDeviceUsage(); + if ((int)uVar7 == 0) { + if (local_178 != (void *)0x0) { + MmUnlockPages(local_1e0); + } + if (local_1e0 != (uint *)0x0) { + IoFreeMdl(local_1e0); + } } - if (lVar9 != 0) { - IoFreeMdl(lVar9); + else if (local_178 != (void *)0x0) { + if (-1 < (int)uVar5) { + memcpy(param_4,local_178,(ulonglong)param_5); + } + ExFreePoolWithTag(local_178,0x70537348); } - if (local_148 != (undefined1 (*) [16])0x0) { + if (local_150 != (undefined1 (*) [16])0x0) { ObfDereferenceObject(); } - return uVar7; + return uVar5; } ``` ## CldSyncGetSyncProviderProcess ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.38| |i_ratio|0.09| |m_ratio|0.82| |b_ratio|0.45| |match_types|Implied Match| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |`name`|CldSyncGetSyncProviderProcess|Feature_899985722__private_IsEnabledDeviceUsage| |`fullname`|CldSyncGetSyncProviderProcess|Feature_899985722__private_IsEnabledDeviceUsage| |`refcount`|6|3| |`length`|22|49| |`called`||Feature_899985722__private_IsEnabledFallback| |`calling`|CldHsmGetSyncProviderProcess
CldHsmGetSyncProviderProcessByPath
CldStreamAbortOperation
CldStreamQueryProgress|CldStreamQueryProgress
CldiPortProcessAbortHydration| |paramcount|1|0| |`address`|1c006fe70|1c000c104| |`sig`|undefined8 __fastcall CldSyncGetSyncProviderProcess(longlong param_1)|ulonglong __fastcall Feature_899985722__private_IsEnabledDeviceUsage(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldSyncGetSyncProviderProcess Called Diff ```diff --- CldSyncGetSyncProviderProcess called +++ Feature_899985722__private_IsEnabledDeviceUsage called @@ -0,0 +1 @@ +Feature_899985722__private_IsEnabledFallback ``` ### CldSyncGetSyncProviderProcess Calling Diff ```diff --- CldSyncGetSyncProviderProcess calling +++ Feature_899985722__private_IsEnabledDeviceUsage calling @@ -1,3 +0,0 @@ -CldHsmGetSyncProviderProcess -CldHsmGetSyncProviderProcessByPath -CldStreamAbortOperation @@ -4,0 +2 @@ +CldiPortProcessAbortHydration ``` ### CldSyncGetSyncProviderProcess Diff ```diff --- CldSyncGetSyncProviderProcess +++ Feature_899985722__private_IsEnabledDeviceUsage @@ -1,10 +1,17 @@ -undefined8 CldSyncGetSyncProviderProcess(longlong param_1) +ulonglong Feature_899985722__private_IsEnabledDeviceUsage(void) { - if ((param_1 != 0) && (*(longlong *)(param_1 + 0x60) != 0)) { - return *(undefined8 *)(*(longlong *)(param_1 + 0x60) + 0x68); + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_899985722__private_featureState; + if ((Feature_899985722__private_featureState & 0x10) == 0) { + uVar1 = Feature_899985722__private_IsEnabledFallback(local_res8,3); } - return 0; + else { + uVar1 = (ulonglong)(Feature_899985722__private_featureState & 1); + } + return uVar1; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## memcpy ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|memcpy|memcpy| |fullname|memcpy|memcpy| |`refcount`|103|105| |length|537|537| |called||| |`calling`|
Expand for full list:
CldCaptureProcessInfo
CldHsmGetSyncStatus
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldStreamQueryProgress
CldStreamSetSyncStatus
CldStreamTransferData
CldSyncGetSyncStatusOnRoot
CldSyncSendPopulationRequest
CldiBuildCommonMessageCldiPortNotifyMessage
CldiPortProcessGetRangeInfo
CldiPortProcessServiceCommands
CldiStreamServiceHydrationRequest
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncRemovePendingRange
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CreateNewEventEntry
HsmFltPostQUERY_INFORMATION
HsmFltPostSetRenameInformation
HsmFltPreSetRenameInformation
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessRetrieveProperties
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmOsGetProcessCommandLineByAttributionInfo
HsmOsLocateProcessImageName
HsmOsQueryPackageIdentity
HsmRecallRetrieveData
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiCldOpenSyncRoot
HsmiCreateEnsureDirectoryFullyPopulated
HsmiGrantLockRequest
HsmiMungeQueryDirectoryBufferWithShortname
HsmiMungeQueryDirectoryBufferWithoutShortname
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiQueryFullFilePath
HsmiRecallAllocatePopulationContext
HsmiRecallWriteFileNoLock
HsmiRpCompressBuffer
HsmiRpInitializeTable
HsmiUnlockPropertiesForOwner
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpBitmapIsReparseBufferSupported
HsmpCldGetSyncRootStandardInfo
HsmpCleanupPropertyLocksForFileObject
HsmpCreateProcessInfo
HsmpCtxCreateStreamContext
HsmpFillOutAttributionInformation
HsmpLoadPropertyStream
HsmpRpCommitNoLock
HsmpRpValidateBuffer
InitializeTelemetryAssertsKMWorkerInternal
SeSddlSecurityDescriptorFromSDDL
SepSddlAddAceToAcl
WppTraceCallback
|
Expand for full list:
CldCaptureProcessInfo
CldHsmGetSyncStatus
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldStreamQueryProgress
CldStreamSetSyncStatus
CldStreamTransferData
CldSyncGetSyncStatusOnRoot
CldSyncSendPopulationRequest
CldiBuildCommonMessageCldiPortNotifyMessage
CldiPortProcessGetRangeInfo
CldiPortProcessServiceCommands
CldiStreamServiceHydrationRequest
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncRemovePendingRange
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CreateNewEventEntry
HsmFltPostQUERY_INFORMATION
HsmFltPostSetRenameInformation
HsmFltPreSetRenameInformation
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessRetrieveProperties
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmOsGetProcessCommandLineByAttributionInfo
HsmOsLocateProcessImageName
HsmOsQueryPackageIdentity
HsmRecallRetrieveData
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiCldOpenSyncRoot
HsmiCreateEnsureDirectoryFullyPopulated
HsmiGrantLockRequest
HsmiMungeQueryDirectoryBufferWithShortname
HsmiMungeQueryDirectoryBufferWithoutShortname
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiQueryFullFilePath
HsmiRecallAllocatePopulationContext
HsmiRecallWriteFileNoLock
HsmiRpCompressBuffer
HsmiRpInitializeTable
HsmiUnlockPropertiesForOwner
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpBitmapIsReparseBufferSupported
HsmpCldGetSyncRootStandardInfo
HsmpCleanupPropertyLocksForFileObject
HsmpCreateProcessInfo
HsmpCtxCreateStreamContext
HsmpFillOutAttributionInformation
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpRpCommitNoLock
HsmpRpValidateBuffer
InitializeTelemetryAssertsKMWorkerInternal
SeSddlSecurityDescriptorFromSDDL
SepSddlAddAceToAcl
WppTraceCallback
| |paramcount|3|3| |`address`|1c001cf00|1c001cf80| |sig|void * __cdecl memcpy(void * _Dst, void * _Src, size_t _Size)|void * __cdecl memcpy(void * _Dst, void * _Src, size_t _Size)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### memcpy Calling Diff ```diff --- memcpy calling +++ memcpy calling @@ -60,0 +61 @@ +HsmpOpCreatePlaceholders ``` ## NTOSKRNL.EXE::ProbeForWrite ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|ProbeForWrite|ProbeForWrite| |fullname|NTOSKRNL.EXE::ProbeForWrite|NTOSKRNL.EXE::ProbeForWrite| |`refcount`|5|6| |length|0|0| |called||| |`calling`|CldStreamQueryProgress
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltProcessRetrieveProperties
HsmiMungeQueryDirectory|CldStreamQueryProgress
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltProcessRetrieveProperties
HsmiMungeQueryDirectory
HsmpOpCreatePlaceholders| |paramcount|0|0| |`address`|EXTERNAL:0000008c|EXTERNAL:0000008a| |sig|undefined ProbeForWrite(void)|undefined ProbeForWrite(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ProbeForWrite Calling Diff ```diff --- NTOSKRNL.EXE::ProbeForWrite calling +++ NTOSKRNL.EXE::ProbeForWrite calling @@ -4,0 +5 @@ +HsmpOpCreatePlaceholders ``` ## NTOSKRNL.EXE::FsRtlLookupBaseMcbEntry ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|FsRtlLookupBaseMcbEntry|FsRtlLookupBaseMcbEntry| |fullname|NTOSKRNL.EXE::FsRtlLookupBaseMcbEntry|NTOSKRNL.EXE::FsRtlLookupBaseMcbEntry| |`refcount`|8|9| |length|0|0| |called||| |calling|CldStreamQueryProgress
CldSyncSendHydrationRequest
CldiStreamServiceHydrationRequest
HsmiBitmapNORMALLookupMcbGroupMapping
HsmiBitmapVOLATILELookupMcbMapping|CldStreamQueryProgress
CldSyncSendHydrationRequest
CldiStreamServiceHydrationRequest
HsmiBitmapNORMALLookupMcbGroupMapping
HsmiBitmapVOLATILELookupMcbMapping| |paramcount|0|0| |`address`|EXTERNAL:0000009e|EXTERNAL:0000009c| |sig|undefined FsRtlLookupBaseMcbEntry(void)|undefined FsRtlLookupBaseMcbEntry(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## wil_details_IsEnabledFallback ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.85| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|2|4| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_2930036027__private_IsEnabledFallback|Feature_2930036027__private_IsEnabledFallback
Feature_29931835__private_IsEnabledFallback
Feature_899985722__private_IsEnabledFallback| |paramcount|3|3| |`address`|1c00132a4|1c000d13c| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1,0 +2,2 @@ +Feature_29931835__private_IsEnabledFallback +Feature_899985722__private_IsEnabledFallback ``` ## WPP_SF_iid ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|WPP_SF_iid|WPP_SF_iid| |fullname|WPP_SF_iid|WPP_SF_iid| |`refcount`|110|111| |length|88|88| |called|_guard_dispatch_icall|_guard_dispatch_icall| |calling|
Expand for full list:
CldHsmCreateStreamHandleContext
CldStreamOpen
CldStreamQueryProgress
CldSyncDisconnectRootByObject
CldSyncReportSyncStatusOnRoot
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldiPortProcessRetrieveDataCldiPortProcessTransferData
CldiSyncCreateRootNoLock
CldiSyncInitializeRootNoLock
HsmFileCacheCreateFileObject
HsmFileCacheMapData
HsmFltPreLOCK_CONTROL
HsmFltProcessConvertPlaceholder
HsmFltProcessQueryPlaceholder
HsmFltProcessSetPinState
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootInfoByFileObject
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFltPreECPCREATE
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiOpInheritPinStatePre
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiPrepareBitmapCommit
HsmiQueryFullFilePath
HsmiUpdateFileAttributes
HsmpAccessCheck
HsmpBuildFullLinkPath
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpFileCacheFlush
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpQueryLastEffectiveUsn
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpSetCompressionNoLock
HsmpSetupContexts
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
|
Expand for full list:
CldHsmCreateStreamHandleContext
CldStreamOpen
CldStreamQueryProgress
CldSyncDisconnectRootByObject
CldSyncReportSyncStatusOnRoot
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldiPortProcessRetrieveDataCldiPortProcessTransferData
CldiSyncCreateRootNoLock
CldiSyncInitializeRootNoLock
HsmFileCacheCreateFileObject
HsmFileCacheMapData
HsmFltPreLOCK_CONTROL
HsmFltProcessConvertPlaceholder
HsmFltProcessQueryPlaceholder
HsmFltProcessSetPinState
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootInfoByFileObject
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFltPreECPCREATE
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiOpInheritPinStatePre
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiPrepareBitmapCommit
HsmiQueryFullFilePath
HsmiUpdateFileAttributes
HsmpAccessCheck
HsmpBuildFullLinkPath
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpFileCacheFlush
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpQueryLastEffectiveUsn
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpSetCompressionNoLock
HsmpSetupContexts
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
| |paramcount|4|4| |address|1c000930c|1c000930c| |sig|undefined __fastcall WPP_SF_iid(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_iid(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::ExFreePoolWithTag ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|ExFreePoolWithTag|ExFreePoolWithTag| |fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag| |`refcount`|244|245| |length|0|0| |called||| |calling|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateStreamHandleContext
CldHsmDeleteFileContext
CldHsmDeleteInstanceContext
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessageCldPortSendPostOpMessage
CldPortSendPreOpMessage
CldReleaseProcessInfo
CldStreamClose
CldStreamOpen
CldStreamPurgeCache
CldStreamQueryProgress
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamUninitialize
CldSyncCleanup
CldSyncSendCancelPopulationRequest
CldSyncSendPopulationRequest
CldiPortNotifyDisconnect
CldiPortNotifyMessage
CldiPortProcessServiceCommands
CldiPortRootTableFree
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncRootTableFree
CldiSyncSetSyncStatusOnRoot
CldiSyncStreamTableFree
CldiSyncTransferPlaceholdersByObject
DestroyAggregateSession
DestroyEventEntry
HsmCreateOrOpenNamedEvent
HsmFltDeleteINSTANCE_CONTEXT
HsmFltDeleteSTREAMHANDLE_CONTEXT
HsmFltDeleteSTREAM_CONTEXT
HsmFltPostSetLinkInformation
HsmFltPostSetRenameInformation
HsmFltPreDIRECTORY_CONTROL
HsmFltPreSetRenameInformation
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltUnload
HsmIBitmapNORMALCompleteCommit
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALRelease
HsmIBitmapNORMALUnpinBlock
HsmIBitmapVOLATILERelease
HsmOsBlockPlaceholderAccess
HsmOsStartWppTracing
HsmRecallRetrieveData
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiCbdTableFree
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCldPreOpCompletionCallback
HsmiCompleteBitmapCommit
HsmiCompressBuffer
HsmiCreateEnsureDirectoryFullyPopulated
HsmiDbgLoadProcessDWordFlag
HsmiDecompressBuffer
HsmiDehydrationCsqCOMPLETE_CANCELED_IO
HsmiFileCacheFreeStreamControlBlock
HsmiFltPreECPCREATE
HsmiFreePropertyBlob
HsmiFreePropertyLock
HsmiGrantLockRequest
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpPrepareOperation
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOsBuildAppPolicyKeyAcl
HsmiOsComputeAppIdentity
HsmiOsConstructLogFilesFolder
HsmiOsGetAppIdentity
HsmiOsGetProcessFlags
HsmiOsOpenAppPolicyKey
HsmiPrepareBitmapCommit
HsmiPropertyLockWait
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallFreeHydrationContext
HsmiRecallFreePopulationContext
HsmiRecallInitiateHydration
HsmiRecallWriteFileNoLock
HsmiRpCompressBuffer
HsmiUnloadPropertyStream
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpBuildFullLinkPath
HsmpCaptureProcessInfo
HsmpCheckLegacyFilterAbsence
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootStandardInfo
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCleanupAttributionInformation
HsmpCompletePendedDehydrationRequests
HsmpCreateProcessInfo
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpDbgBreakOnOpen
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpQueryLastEffectiveUsn
HsmpQueueDehydrationRequest
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpiDecompressBuffer
HsmpSetupContexts
HsmpUninitializePropertyContext
InitializeTelemetryAssertsKMByDriverObject
QueryIfEAExists
SeSddlSecurityDescriptorFromSDDL
SepSddlAddAceToAcl
SepSddlDaclFromSDDLString
SepSddlGetAclForString
SepSddlSecurityDescriptorFromSDDLString
TlmInitializeCorrelationVector
TlmWriteAccessDeniedForAddSubDirectory
TlmWriteDisallowPurgeableKernelEA
TlmWriteFilterAttachEvent
TlmpWriteRequestorProcessName
UninitializeTelemetryAssertsKM
|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateStreamHandleContext
CldHsmDeleteFileContext
CldHsmDeleteInstanceContext
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessageCldPortSendPostOpMessage
CldPortSendPreOpMessage
CldReleaseProcessInfo
CldStreamClose
CldStreamOpen
CldStreamPurgeCache
CldStreamQueryProgress
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamUninitialize
CldSyncCleanup
CldSyncSendCancelPopulationRequest
CldSyncSendPopulationRequest
CldiPortNotifyDisconnect
CldiPortNotifyMessage
CldiPortProcessServiceCommands
CldiPortRootTableFree
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncRootTableFree
CldiSyncSetSyncStatusOnRoot
CldiSyncStreamTableFree
CldiSyncTransferPlaceholdersByObject
DestroyAggregateSession
DestroyEventEntry
HsmCreateOrOpenNamedEvent
HsmFltDeleteINSTANCE_CONTEXT
HsmFltDeleteSTREAMHANDLE_CONTEXT
HsmFltDeleteSTREAM_CONTEXT
HsmFltPostSetLinkInformation
HsmFltPostSetRenameInformation
HsmFltPreDIRECTORY_CONTROL
HsmFltPreSetRenameInformation
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltUnload
HsmIBitmapNORMALCompleteCommit
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALRelease
HsmIBitmapNORMALUnpinBlock
HsmIBitmapVOLATILERelease
HsmOsBlockPlaceholderAccess
HsmOsStartWppTracing
HsmRecallRetrieveData
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiCbdTableFree
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCldPreOpCompletionCallback
HsmiCompleteBitmapCommit
HsmiCompressBuffer
HsmiCreateEnsureDirectoryFullyPopulated
HsmiDbgLoadProcessDWordFlag
HsmiDecompressBuffer
HsmiDehydrationCsqCOMPLETE_CANCELED_IO
HsmiFileCacheFreeStreamControlBlock
HsmiFltPreECPCREATE
HsmiFreePropertyBlob
HsmiFreePropertyLock
HsmiGrantLockRequest
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpPrepareOperation
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOsBuildAppPolicyKeyAcl
HsmiOsComputeAppIdentity
HsmiOsConstructLogFilesFolder
HsmiOsGetAppIdentity
HsmiOsGetProcessFlags
HsmiOsOpenAppPolicyKey
HsmiPrepareBitmapCommit
HsmiPropertyLockWait
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallFreeHydrationContext
HsmiRecallFreePopulationContext
HsmiRecallInitiateHydration
HsmiRecallWriteFileNoLock
HsmiRpCompressBuffer
HsmiUnloadPropertyStream
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpBuildFullLinkPath
HsmpCaptureProcessInfo
HsmpCheckLegacyFilterAbsence
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootStandardInfo
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCleanupAttributionInformation
HsmpCompletePendedDehydrationRequests
HsmpCreateProcessInfo
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpDbgBreakOnOpen
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpQueryLastEffectiveUsn
HsmpQueueDehydrationRequest
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpiDecompressBuffer
HsmpSetupContexts
HsmpUninitializePropertyContext
InitializeTelemetryAssertsKMByDriverObject
QueryIfEAExists
SeSddlSecurityDescriptorFromSDDL
SepSddlAddAceToAcl
SepSddlDaclFromSDDLString
SepSddlGetAclForString
SepSddlSecurityDescriptorFromSDDLString
TlmInitializeCorrelationVector
TlmWriteAccessDeniedForAddSubDirectory
TlmWriteDisallowPurgeableKernelEA
TlmWriteFilterAttachEvent
TlmpWriteRequestorProcessName
UninitializeTelemetryAssertsKM
| |paramcount|0|0| |address|EXTERNAL:000000c6|EXTERNAL:000000c6| |sig|undefined ExFreePoolWithTag(void)|undefined ExFreePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## HsmDbgBreakOnStatus ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.74| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|HsmDbgBreakOnStatus|HsmDbgBreakOnStatus| |fullname|HsmDbgBreakOnStatus|HsmDbgBreakOnStatus| |`refcount`|1452|1453| |length|147|147| |called|HsmpGetRegDword
NTOSKRNL.EXE::IoGetCurrentProcess|HsmpGetRegDword
NTOSKRNL.EXE::IoGetCurrentProcess| |calling|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldHsmGetSyncPolicy
CldHsmGetSyncPolicyByPath
CldHsmGetSyncProviderProcessByPath
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncRootInfoByPathCldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldHsmInitialize
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldLookupSyncRoot
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldPortSendUpstreamMessage
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamRestartHydration
CldStreamRetrieveData
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncAccessCheck
CldSyncAckDehydrate
CldSyncAckDelete
CldSyncAckRename
CldSyncConnectRoot
CldSyncGetPlaceholderRangeInfo
CldSyncGetPolicy
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncReportProgress
CldSyncReportSyncStatusOnRoot
CldSyncRestartHydration
CldSyncRetrieveData
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldSyncSetSyncStatusOnStream
CldSyncTransferPlaceholders
CldiPortAccessCheck
CldiPortAddCrossVmProgressEvent
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessFilterControl
CldiPortProcessGetRangeInfo
CldiPortProcessGlobal
CldiPortProcessQueryProgress
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransfer
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamProcessPendingHydrationRequests
CldiStreamRestartCountdownTimer
CldiStreamServiceHydrationRequest
CldiStreamStopCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncReferenceRoot
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CldiSyncTransferOrAckData
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmDriverEntry
HsmExpandKernelStackAndCallout
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFileCacheMapData
HsmFltInstanceQueryTeardown
HsmFltPostLOCK_CONTROL
HsmFltPostSetRenameInformation
HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION
HsmFltPreCLEANUP
HsmFltPreDIRECTORY_CONTROL
HsmFltPreFILE_SYSTEM_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltPreREAD
HsmFltPreSET_EA
HsmFltPreSetBasicInformation
HsmFltPreSetDispositionInformation
HsmFltPreSetEndOfFileInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltPreWRITE
HsmFltProcessClearInSync
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessGetCorrelationVector
HsmFltProcessGetLastSyncStatus
HsmFltProcessHSMControl
HsmFltProcessHydrate
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessQueryStreamKey
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetCorrelationVector
HsmFltProcessSetInSync
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmPreLockControlSynchronous
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapCheckVersion
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALLoadFromDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapNORMALVerifyBitmapPages
HsmiBitmapNormalDeleteStream
HsmiBitmapNormalOpenStream
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompactBitmapNoLock
HsmiCompleteLockCallbackDataRoutine
HsmiCompressBuffer
HsmiCreateAllocateECPTags
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiDecompressBuffer
HsmiExpandBitmapNoLock
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiFileCacheWriteCompletion
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiInfoRecallForRenameCompletion
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiMarkFileRangeNoLock
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpInheritPinStatePre
HsmiOpPrepareOperation
HsmiOpRevertCompletion
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOpenFile
HsmiPrepareBitmapCommit
HsmiProcessPropertyLockRequestList
HsmiPropertyLockWait
HsmiQueryFileRangeNoLock
HsmiQueryFileRangesTotalNoLock
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallAllocatePopulationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmiRecallWriteFileNoLock
HsmiRpInitializeTable
HsmiUpdateFileAttributes
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpAccessCheckByFileId
HsmpAcquireFileNameLock
HsmpAcquireSyncOpRundownProtection
HsmpAcquireUserRequestRundownProtection
HsmpBitmapCreateSnapshot
HsmpBitmapGetRangeState
HsmpBitmapIsReparseBufferSupported
HsmpBitmapQueryRange
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootStandardInfo
HsmpCldIsHydrationDisallowed
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpCtxGetOrCreateFileContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpFileCacheSetFileSize
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpMarkHandleUsnSourceInfo
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpProcessQueryRangeStateHelper
HsmpQueryLastEffectiveUsn
HsmpQueryModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpBuildBuffer
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpRpValidateBuffer
HsmpRpiDecompressBuffer
HsmpSetCompressionNoLock
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpSetupContexts
HsmpToggleFileAttributes
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
HsmpUpdateLastAccessTime
HsmpValidateAttributionEcp
HsmpValidateStreamContextNoLock
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldHsmGetSyncPolicy
CldHsmGetSyncPolicyByPath
CldHsmGetSyncProviderProcessByPath
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncRootInfoByPathCldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldHsmInitialize
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldLookupSyncRoot
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldPortSendUpstreamMessage
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamRestartHydration
CldStreamRetrieveData
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncAccessCheck
CldSyncAckDehydrate
CldSyncAckDelete
CldSyncAckRename
CldSyncConnectRoot
CldSyncGetPlaceholderRangeInfo
CldSyncGetPolicy
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncReportProgress
CldSyncReportSyncStatusOnRoot
CldSyncRestartHydration
CldSyncRetrieveData
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldSyncSetSyncStatusOnStream
CldSyncTransferPlaceholders
CldiPortAccessCheck
CldiPortAddCrossVmProgressEvent
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessFilterControl
CldiPortProcessGetRangeInfo
CldiPortProcessGlobal
CldiPortProcessQueryProgress
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransfer
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamProcessPendingHydrationRequests
CldiStreamRestartCountdownTimer
CldiStreamServiceHydrationRequest
CldiStreamStopCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncReferenceRoot
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CldiSyncTransferOrAckData
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmDriverEntry
HsmExpandKernelStackAndCallout
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFileCacheMapData
HsmFltInstanceQueryTeardown
HsmFltPostLOCK_CONTROL
HsmFltPostSetRenameInformation
HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION
HsmFltPreCLEANUP
HsmFltPreDIRECTORY_CONTROL
HsmFltPreFILE_SYSTEM_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltPreREAD
HsmFltPreSET_EA
HsmFltPreSetBasicInformation
HsmFltPreSetDispositionInformation
HsmFltPreSetEndOfFileInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltPreWRITE
HsmFltProcessClearInSync
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessGetCorrelationVector
HsmFltProcessGetLastSyncStatus
HsmFltProcessHSMControl
HsmFltProcessHydrate
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessQueryStreamKey
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetCorrelationVector
HsmFltProcessSetInSync
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmPreLockControlSynchronous
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapCheckVersion
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALLoadFromDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapNORMALVerifyBitmapPages
HsmiBitmapNormalDeleteStream
HsmiBitmapNormalOpenStream
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompactBitmapNoLock
HsmiCompleteLockCallbackDataRoutine
HsmiCompressBuffer
HsmiCreateAllocateECPTags
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiDecompressBuffer
HsmiExpandBitmapNoLock
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiFileCacheWriteCompletion
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiInfoRecallForRenameCompletion
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiMarkFileRangeNoLock
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpInheritPinStatePre
HsmiOpPrepareOperation
HsmiOpRevertCompletion
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOpenFile
HsmiPrepareBitmapCommit
HsmiProcessPropertyLockRequestList
HsmiPropertyLockWait
HsmiQueryFileRangeNoLock
HsmiQueryFileRangesTotalNoLock
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallAllocatePopulationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmiRecallWriteFileNoLock
HsmiRpInitializeTable
HsmiUpdateFileAttributes
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpAccessCheckByFileId
HsmpAcquireFileNameLock
HsmpAcquireSyncOpRundownProtection
HsmpAcquireUserRequestRundownProtection
HsmpBitmapCreateSnapshot
HsmpBitmapGetRangeState
HsmpBitmapIsReparseBufferSupported
HsmpBitmapQueryRange
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootStandardInfo
HsmpCldIsHydrationDisallowed
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpCtxGetOrCreateFileContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpFileCacheSetFileSize
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpMarkHandleUsnSourceInfo
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpProcessQueryRangeStateHelper
HsmpQueryLastEffectiveUsn
HsmpQueryModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpBuildBuffer
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpRpValidateBuffer
HsmpRpiDecompressBuffer
HsmpSetCompressionNoLock
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpSetupContexts
HsmpToggleFileAttributes
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
HsmpUpdateLastAccessTime
HsmpValidateAttributionEcp
HsmpValidateStreamContextNoLock
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
| |paramcount|1|1| |address|1c0004140|1c0004140| |sig|undefined __fastcall HsmDbgBreakOnStatus(int param_1)|undefined __fastcall HsmDbgBreakOnStatus(int param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::ExAllocatePool2 ### Match Info |Key|cldflt-09.sys - cldflt-10.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-09.sys|cldflt-10.sys| | :---: | :---: | :---: | |name|ExAllocatePool2|ExAllocatePool2| |fullname|NTOSKRNL.EXE::ExAllocatePool2|NTOSKRNL.EXE::ExAllocatePool2| |`refcount`|140|141| |length|0|0| |called||| |calling|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateInstanceContext
CldHsmCreateStreamHandleContext
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessageCldPortSendPreOpMessage
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamSetSyncStatus
CldStreamTransferData
CldSyncSendPopulationRequest
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortRootTableAllocate
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncRootTableAllocate
CldiSyncSetSyncStatusOnRoot
CldiSyncStreamTableAllocate
HsmFltPostSetRenameInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmOsLocateProcessImageName
HsmRecallRetrieveData
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiCbdTableAllocate
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompressBuffer
HsmiCreateEnsureDirectoryFullyPopulated
HsmiDbgLoadProcessDWordFlag
HsmiDecompressBuffer
HsmiFileCacheAllocateStreamControlBlock
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoPrepareForPostRename
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOsBuildAppPolicyKeyAcl
HsmiOsComputeAppIdentity
HsmiOsConstructLogFilesFolder
HsmiOsOpenAppPolicyKey
HsmiPrepareBitmapCommit
HsmiQueryFullFilePath
HsmiRecallAllocatePopulationContext
HsmiRecallWriteFileNoLock
HsmiRpCompressBuffer
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpBitmapCreateSnapshot
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldNotifyPreOperation
HsmpCreateProcessInfo
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpDbgBreakOnOpen
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpQueryLastEffectiveUsn
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpiDecompressBuffer
HsmpSetupContexts
InitializeTelemetryAssertsKMWorkerInternal
MicrosoftTelemetryAssertTriggeredWorker
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateInstanceContext
CldHsmCreateStreamHandleContext
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessageCldPortSendPreOpMessage
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamSetSyncStatus
CldStreamTransferData
CldSyncSendPopulationRequest
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortRootTableAllocate
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncRootTableAllocate
CldiSyncSetSyncStatusOnRoot
CldiSyncStreamTableAllocate
HsmFltPostSetRenameInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmOsLocateProcessImageName
HsmRecallRetrieveData
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiCbdTableAllocate
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompressBuffer
HsmiCreateEnsureDirectoryFullyPopulated
HsmiDbgLoadProcessDWordFlag
HsmiDecompressBuffer
HsmiFileCacheAllocateStreamControlBlock
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoPrepareForPostRename
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOsBuildAppPolicyKeyAcl
HsmiOsComputeAppIdentity
HsmiOsConstructLogFilesFolder
HsmiOsOpenAppPolicyKey
HsmiPrepareBitmapCommit
HsmiQueryFullFilePath
HsmiRecallAllocatePopulationContext
HsmiRecallWriteFileNoLock
HsmiRpCompressBuffer
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpBitmapCreateSnapshot
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldNotifyPreOperation
HsmpCreateProcessInfo
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpDbgBreakOnOpen
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpQueryLastEffectiveUsn
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpiDecompressBuffer
HsmpSetupContexts
InitializeTelemetryAssertsKMWorkerInternal
MicrosoftTelemetryAssertTriggeredWorker
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
| |paramcount|0|0| |address|EXTERNAL:000000c7|EXTERNAL:000000c7| |sig|undefined ExAllocatePool2(void)|undefined ExAllocatePool2(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| Generated with `ghidriff` version: 1.0.0 on 2026-08-27T23:27:14