# cld_8115.sys-cld_8246.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [CldPortUnlinkSyncRoot](#cldportunlinksyncroot) * [CldSyncGetSyncProviderProcessId](#cldsyncgetsyncproviderprocessid) * [Added](#added) * [Feature_1074201912__private_IsEnabledFallback](#feature_1074201912__private_isenabledfallback) * [WPP_SF_qL](#wpp_sf_ql) * [HsmiCldGetSyncRootInfoByFileObjectDeprecated](#hsmicldgetsyncrootinfobyfileobjectdeprecated) * [HsmiCldGetSyncRootInfoDeprecated](#hsmicldgetsyncrootinfodeprecated) * [Modified](#modified) * [CldPortInitialize](#cldportinitialize) * [DriverEntry](#driverentry) * [CldSyncConnectRoot](#cldsyncconnectroot) * [CldStreamQueryProgress](#cldstreamqueryprogress) * [CldiPortNotifyDisconnect](#cldiportnotifydisconnect) * [CldiPortProcessServiceCommands](#cldiportprocessservicecommands) * [HsmiCldGetSyncRootInfo](#hsmicldgetsyncrootinfo) * [HsmpCldGetSyncRootStandardInfo](#hsmpcldgetsyncrootstandardinfo) * [HsmiCldGetSyncRootInfoByFileObject](#hsmicldgetsyncrootinfobyfileobject) * [CldSyncCleanup](#cldsynccleanup) * [HsmpCldGetSyncRootProviderInfo](#hsmpcldgetsyncrootproviderinfo) * [CldSyncGetRootInfo](#cldsyncgetrootinfo) * [HsmDbgBreakOnStatus](#hsmdbgbreakonstatus) * [HsmiCldGetSyncRootInfo](#hsmicldgetsyncrootinfo) * [Modified (No Code Changes)](#modified-no-code-changes) * [FLTMGR.SYS::FltAcquirePushLockSharedEx](#fltmgrsysfltacquirepushlocksharedex) * [TlmWriteProviderCrashedEvent](#tlmwriteprovidercrashedevent) * [FLTMGR.SYS::FltInitializePushLock](#fltmgrsysfltinitializepushlock) * [WPP_SF_d](#wpp_sf_d) * [HsmpBitmapQueryRangeExCallout](#hsmpbitmapqueryrangeexcallout) * [FLTMGR.SYS::FltAcquirePushLockExclusiveEx](#fltmgrsysfltacquirepushlockexclusiveex) * [NTOSKRNL.EXE::RtlNumberGenericTableElementsAvl](#ntoskrnlexertlnumbergenerictableelementsavl) * [HsmpReleaseBitmapLock](#hsmpreleasebitmaplock) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [CldiSyncReferenceRoot](#cldisyncreferenceroot) * [HsmiQueryFileRange](#hsmiqueryfilerange) * [FLTMGR.SYS::FltReleasePushLockEx](#fltmgrsysfltreleasepushlockex) * [HsmExpandKernelStackAndCallout](#hsmexpandkernelstackandcallout) * [WPP_SF_id](#wpp_sf_id) * [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag) * [NTOSKRNL.EXE::ExReleaseRundownProtection](#ntoskrnlexeexreleaserundownprotection) * [TlmWriteZeroRangeQueryProgress](#tlmwritezerorangequeryprogress) * [HsmDbgBreakOnStatus](#hsmdbgbreakonstatus) * [NTOSKRNL.EXE::ExAllocatePool2](#ntoskrnlexeexallocatepool2) # Visual Chart Diff ```mermaid flowchart LR CldPortInitialize-0-old<--Match 93%-->CldPortInitialize-0-new DriverEntry-2-old<--Match 96%-->DriverEntry-2-new CldSyncConnectRoot-8-old<--Match 46%-->CldSyncConnectRoot-8-new CldStreamQueryProgress-4-old<--Match 47%-->CldStreamQueryProgress-4-new CldiPortNotifyDisconnect-1-old<--Match 74%-->CldiPortNotifyDisconnect-1-new CldiPortProcessServiceCommands-4-old<--Match 12%-->CldiPortProcessServiceCommands-4-new HsmiCldGetSyncRootInfo-5-old<--Match 62%-->HsmiCldGetSyncRootInfo-5-new HsmpCldGetSyncRootStandardInfo-6-old<--Match 21%-->HsmpCldGetSyncRootStandardInfo-6-new HsmiCldGetSyncRootInfoByFileObject-4-old<--Match 68%-->HsmiCldGetSyncRootInfoByFileObject-4-new CldSyncCleanup-1-old<--Match 67%-->CldSyncCleanup-1-new HsmpCldGetSyncRootProviderInfo-6-old<--Match 35%-->HsmpCldGetSyncRootProviderInfo-6-new CldSyncGetRootInfo-1-old<--Match 9%-->CldSyncGetRootInfo-1-new HsmDbgBreakOnStatus-1-old<--Match 27%-->Feature_1074201912__private_IsEnabledDeviceUsageNoInline-1-new HsmiCldGetSyncRootInfo-5-old<--Match 17%-->Feature_1074201912__private_IsEnabledDeviceUsageNoInline-5-new subgraph cld_8246.sys CldPortInitialize-0-new DriverEntry-2-new CldSyncConnectRoot-8-new CldStreamQueryProgress-4-new CldiPortNotifyDisconnect-1-new CldiPortProcessServiceCommands-4-new HsmiCldGetSyncRootInfo-5-new HsmpCldGetSyncRootStandardInfo-6-new HsmiCldGetSyncRootInfoByFileObject-4-new CldSyncCleanup-1-new HsmpCldGetSyncRootProviderInfo-6-new CldSyncGetRootInfo-1-new Feature_1074201912__private_IsEnabledDeviceUsageNoInline-1-new Feature_1074201912__private_IsEnabledDeviceUsageNoInline-5-new subgraph Added direction LR Feature_1074201912__private_IsEnabledFallback WPP_SF_qL HsmiCldGetSyncRootInfoByFileObjectDeprecated HsmiCldGetSyncRootInfoDeprecated end end subgraph cld_8115.sys CldPortInitialize-0-old DriverEntry-2-old CldSyncConnectRoot-8-old CldStreamQueryProgress-4-old CldiPortNotifyDisconnect-1-old CldiPortProcessServiceCommands-4-old HsmiCldGetSyncRootInfo-5-old HsmpCldGetSyncRootStandardInfo-6-old HsmiCldGetSyncRootInfoByFileObject-4-old CldSyncCleanup-1-old HsmpCldGetSyncRootProviderInfo-6-old CldSyncGetRootInfo-1-old HsmDbgBreakOnStatus-1-old HsmiCldGetSyncRootInfo-5-old subgraph Deleted direction LR CldPortUnlinkSyncRoot CldSyncGetSyncProviderProcessId end end ``` ```mermaid pie showData title Function Matches - 99.7904% "unmatched_funcs_len" : 6 "matched_funcs_len" : 2857 ``` ```mermaid pie showData title Matched Function Similarity - 98.6699% "matched_funcs_with_code_changes_len" : 14 "matched_funcs_with_non_code_changes_len" : 24 "matched_funcs_no_changes_len" : 2819 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 cld_8115.sys cld_8246.sys ``` #### Verbose Args
``` --old ['cld_8115.sys'] --new [['cld_8246.sys']] --engine VersionTrackingDiff --output-path cld_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/cldflt.sys/6B76C97691000/cldflt.sys -O cldflt.sys.x64.10.0.26100.8115 wget https://msdl.microsoft.com/download/symbols/cldflt.sys/6D082C1892000/cldflt.sys -O cldflt.sys.x64.10.0.26100.8246 ``` ## Binary Metadata Diff ```diff --- cld_8115.sys Meta +++ cld_8246.sys Meta @@ -1,44 +1,44 @@ -Program Name: cld_8115.sys +Program Name: cld_8246.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 598544 +# of Bytes: 602648 # of Memory Blocks: 14 -# of Instructions: 110811 -# of Defined Data: 3452 -# of Functions: 1430 -# of Symbols: 16020 +# of Instructions: 111244 +# of Defined Data: 3457 +# of Functions: 1433 +# of Symbols: 16050 # of Data Types: 181 # of Data Type Categories: 13 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 22 11:50:45 SGT 2026 +Date Created: Sat Aug 22 11:50:48 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/cld/cld_8115.sys -Executable MD5: 9f44cf7161e4e1fc66ab3616a5480558 -Executable SHA256: 482f523f80574231c057762c9579666d9d5377633f4a907ced5cde37899dc257 -FSRL: file:///tmp/cld/cld_8115.sys?MD5=9f44cf7161e4e1fc66ab3616a5480558 +Executable Location: /tmp/cld/cld_8246.sys +Executable MD5: b33867d5de0c342666ba77810ea6b2c5 +Executable SHA256: d8592078fe8ea56197e1af8fa8427b55038f83f3bd42c92e6002c4dee96946b6 +FSRL: file:///tmp/cld/cld_8246.sys?MD5=b33867d5de0c342666ba77810ea6b2c5 PDB Age: 1 PDB File: cldflt.pdb -PDB GUID: 97b4a064-9c6b-62d5-5bbf-8c9aea25bf7d +PDB GUID: 991ee629-557e-a9b4-aa14-5ac9040f371c PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Cloud Files Mini Filter Driver -PE Property[FileVersion]: 10.0.26100.8115 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8246 (WinBuild.160101.0800) PE Property[InternalName]: cldflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: cldflt.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8115 +PE Property[ProductVersion]: 10.0.26100.8246 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra cld_8115.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra cld_8115.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra cld_8115.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra cld_8246.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra cld_8246.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra cld_8246.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|4| |deleted_funcs_len|2| |modified_funcs_len|38| |added_symbols_len|11| |deleted_symbols_len|8| |diff_time|7.8745808601379395| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1411, 'ExternalsName': 340, 'ExactInstructionsFunctionHasher': 9, 'ExactBytesFunctionHasher': 4, 'Implied Match': 2})| |items_to_process|63| |diff_types|Counter({'refcount': 27, 'calling': 20, 'address': 20, 'code': 14, 'length': 14, 'called': 14, 'sig': 8, 'name': 5, 'fullname': 5})| |unmatched_funcs_len|6| |total_funcs_len|2863| |matched_funcs_len|2857| |matched_funcs_with_code_changes_len|14| |matched_funcs_with_non_code_changes_len|24| |matched_funcs_no_changes_len|2819| |match_func_similarity_percent|98.6699%| |func_match_overall_percent|99.7904%| |first_matches|Counter({'SymbolsHash': 1411, 'ExactInstructionsFunctionHasher': 9, 'ExactBytesFunctionHasher': 4, 'Implied Match': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 1411 "ExternalsName" : 340 "ExactBytesFunctionHasher" : 4 "ExactInstructionsFunctionHasher" : 9 "Implied-Match" : 2 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1411 "ExactBytesFunctionHasher" : 4 "ExactInstructionsFunctionHasher" : 9 "Implied-Match" : 2 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 4 "deleted_funcs_len" : 2 "modified_funcs_len" : 38 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 11 "deleted_symbols_len" : 8 ``` ## Strings *No string differences found* # Deleted ## CldPortUnlinkSyncRoot ### Function Meta |Key|cld_8115.sys| | :---: | :---: | |name|CldPortUnlinkSyncRoot| |fullname|CldPortUnlinkSyncRoot| |refcount|2| |length|94| |called|FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltReleasePushLockEx
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl| |calling|CldSyncCleanup| |paramcount|2| |address|140039480| |sig|undefined __fastcall CldPortUnlinkSyncRoot(longlong param_1, undefined8 param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- CldPortUnlinkSyncRoot +++ CldPortUnlinkSyncRoot @@ -1,13 +0,0 @@ - -void CldPortUnlinkSyncRoot(longlong param_1,undefined8 param_2) - -{ - undefined8 local_res10 [3]; - - local_res10[0] = param_2; - FltAcquirePushLockExclusiveEx(param_1 + 0x90,0); - RtlDeleteElementGenericTableAvl(param_1 + 0x98,local_res10); - FltReleasePushLockEx(param_1 + 0x90,0); - return; -} - ``` ## CldSyncGetSyncProviderProcessId ### Function Meta |Key|cld_8115.sys| | :---: | :---: | |name|CldSyncGetSyncProviderProcessId| |fullname|CldSyncGetSyncProviderProcessId| |refcount|2| |length|23| |called|| |calling|CldStreamQueryProgress| |paramcount|1| |address|14003d09c| |sig|undefined4 __fastcall CldSyncGetSyncProviderProcessId(longlong param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- CldSyncGetSyncProviderProcessId +++ CldSyncGetSyncProviderProcessId @@ -1,13 +0,0 @@ - -undefined4 CldSyncGetSyncProviderProcessId(longlong param_1) - -{ - undefined4 uVar1; - - uVar1 = 0; - if ((param_1 != 0) && (uVar1 = 0, *(longlong *)(param_1 + 0x60) != 0)) { - uVar1 = *(undefined4 *)(*(longlong *)(param_1 + 0x60) + 0x80); - } - return uVar1; -} - ``` # Added ## Feature_1074201912__private_IsEnabledFallback ### Function Meta |Key|cld_8246.sys| | :---: | :---: | |name|Feature_1074201912__private_IsEnabledFallback| |fullname|Feature_1074201912__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1074201912__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|14000e7ec| |sig|undefined __fastcall Feature_1074201912__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1074201912__private_IsEnabledFallback +++ Feature_1074201912__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1074201912__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1074201912__private_descriptor); + return; +} + ``` ## WPP_SF_qL ### Function Meta |Key|cld_8246.sys| | :---: | :---: | |name|WPP_SF_qL| |fullname|WPP_SF_qL| |refcount|2| |length|82| |called|_guard_dispatch_icall| |calling|CldSyncGetRootInfo| |paramcount|4| |address|140010850| |sig|undefined __fastcall WPP_SF_qL(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- WPP_SF_qL +++ WPP_SF_qL @@ -0,0 +1,15 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +void WPP_SF_qL(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4) + +{ + undefined8 local_res20; + + local_res20 = param_4; + (*pfnWppTraceMessage) + (param_1,0x2b,&WPP_c596341c543f384b9913e99e79325017_Traceguids,0x23,&local_res20,8, + &stack0x00000028,4,0); + return; +} + ``` ## HsmiCldGetSyncRootInfoByFileObjectDeprecated ### Function Meta |Key|cld_8246.sys| | :---: | :---: | |name|HsmiCldGetSyncRootInfoByFileObjectDeprecated| |fullname|HsmiCldGetSyncRootInfoByFileObjectDeprecated| |refcount|2| |length|359| |called|HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfoByPath
HsmiQueryFullFilePath
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_id
WPP_SF_qid
_guard_dispatch_icall| |calling|HsmiCldGetSyncRootInfoDeprecated| |paramcount|4| |address|1400420d4| |sig|uint __fastcall HsmiCldGetSyncRootInfoByFileObjectDeprecated(longlong param_1, undefined8 param_2, longlong * param_3, undefined1 * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- HsmiCldGetSyncRootInfoByFileObjectDeprecated +++ HsmiCldGetSyncRootInfoByFileObjectDeprecated @@ -0,0 +1,55 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +uint HsmiCldGetSyncRootInfoByFileObjectDeprecated + (longlong param_1,undefined8 param_2,longlong *param_3,undefined1 *param_4) + +{ + uint uVar1; + longlong lVar2; + ushort local_18 [4]; + longlong lStack_10; + + *param_3 = 0; + *param_4 = 0; + local_18[0] = 0; + local_18[1] = 0; + local_18[2] = 0; + local_18[3] = 0; + lStack_10 = 0; + uVar1 = HsmiQueryFullFilePath + (*(undefined8 *)(param_1 + 0x20),param_2,param_2,0x101,(undefined4 *)local_18); + HsmDbgBreakOnStatus(uVar1); + if ((int)uVar1 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) + { + WPP_SF_qid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1b, + &WPP_ba8b7613af1330e4e0a02aa60b8decc8_Traceguids,param_1); + } + } + else { + lVar2 = (*DAT_14002a740)(*(undefined8 *)(param_1 + 0x10),local_18); + *param_3 = lVar2; + if (lVar2 == 0) { + uVar1 = HsmiCldGetSyncRootInfoByPath(param_1,local_18,param_3); + HsmDbgBreakOnStatus(uVar1); + if ((int)uVar1 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && + (4 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1d, + &WPP_ba8b7613af1330e4e0a02aa60b8decc8_Traceguids,param_1); + } + } + else { + *param_4 = param_3 != (longlong *)0x0; + } + } + } + if (lStack_10 != 0) { + ExFreePoolWithTag(lStack_10,0x73557348); + } + return uVar1; +} + ``` ## HsmiCldGetSyncRootInfoDeprecated ### Function Meta |Key|cld_8246.sys| | :---: | :---: | |name|HsmiCldGetSyncRootInfoDeprecated| |fullname|HsmiCldGetSyncRootInfoDeprecated| |refcount|3| |length|273| |called|HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfoByFileObjectDeprecated
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_qqqd
_guard_dispatch_icall| |calling|HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo| |paramcount|5| |address|140042244| |sig|uint __fastcall HsmiCldGetSyncRootInfoDeprecated(longlong param_1, longlong param_2, undefined8 param_3, longlong * param_4, char * param_5)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- HsmiCldGetSyncRootInfoDeprecated +++ HsmiCldGetSyncRootInfoDeprecated @@ -0,0 +1,43 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +uint HsmiCldGetSyncRootInfoDeprecated + (longlong param_1,longlong param_2,undefined8 param_3,longlong *param_4,char *param_5 + ) + +{ + uint uVar1; + longlong lVar2; + char local_res10 [16]; + longlong local_res20; + + uVar1 = 0; + local_res20 = 0; + *param_4 = 0; + local_res10[0] = '\0'; + *param_5 = '\0'; + if ((param_2 == 0) || (local_res20 = (*DAT_14002a738)(), local_res20 == 0)) { + uVar1 = HsmiCldGetSyncRootInfoByFileObjectDeprecated(param_1,param_3,&local_res20,local_res10); + HsmDbgBreakOnStatus(uVar1); + if ((int)uVar1 < 0) { + lVar2 = local_res20; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x29]) + ) { + WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x23, + &WPP_ba8b7613af1330e4e0a02aa60b8decc8_Traceguids,param_1); + lVar2 = local_res20; + } + goto LAB_140042325; + } + } + *param_4 = local_res20; + *param_5 = local_res10[0]; + lVar2 = 0; +LAB_140042325: + if ((local_res10[0] != '\0') && (lVar2 != 0)) { + ExFreePoolWithTag(lVar2,0x69537348); + } + return uVar1; +} + ``` # Modified *Modified functions contain code changes* ## CldPortInitialize ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.87| |i_ratio|0.76| |m_ratio|0.98| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|CldPortInitialize|CldPortInitialize| |fullname|CldPortInitialize|CldPortInitialize| |refcount|2|2| |`length`|904|932| |`called`|
Expand for full list:
FLTMGR.SYS::FltCreateCommunicationPort
FLTMGR.SYS::FltInitializePushLock
HsmDbgBreakOnStatus
HsmpGetRegDword
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlInitUnicodeString
RtlStringCchPrintfW
SeSddlSecurityDescriptorFromSDDL
WPP_SF_d
WPP_SF_dd
|
Expand for full list:
FLTMGR.SYS::FltCreateCommunicationPort
FLTMGR.SYS::FltInitializePushLock
Feature_1074201912__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
HsmpGetRegDword
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlInitUnicodeString
RtlStringCchPrintfW
SeSddlSecurityDescriptorFromSDDL
WPP_SF_dWPP_SF_dd
| |calling|CldHsmInitialize|CldHsmInitialize| |paramcount|0|0| |address|140038364|140038364| |sig|ulonglong __fastcall CldPortInitialize(void)|ulonglong __fastcall CldPortInitialize(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldPortInitialize Called Diff ```diff --- CldPortInitialize called +++ CldPortInitialize called @@ -2,0 +3 @@ +Feature_1074201912__private_IsEnabledDeviceUsageNoInline ``` ### CldPortInitialize Diff ```diff --- CldPortInitialize +++ CldPortInitialize @@ -1,133 +1,137 @@ ulonglong CldPortInitialize(void) { uint uVar1; ulonglong uVar2; undefined2 uVar3; wchar_t *pwVar4; ulonglong uVar5; wchar_t *pwVar6; uint local_res8 [2]; longlong local_res10; ushort local_58 [4]; wchar_t *local_50; undefined8 local_48; undefined8 uStack_40; undefined8 local_38; undefined8 uStack_30; undefined8 *local_28; undefined8 uStack_20; longlong local_18; undefined8 uStack_10; wchar_t *pwVar7; local_res10 = 0; - local_50 = L"D:P(A;;GA;;;AU)"; - pwVar7 = (wchar_t *)0x0; - pwVar6 = (wchar_t *)0x0; local_58[0] = 0x1e; local_58[1] = 0x20; local_58[2] = 0; local_58[3] = 0; + pwVar7 = (wchar_t *)0x0; + pwVar6 = (wchar_t *)0x0; + local_50 = L"D:P(A;;GA;;;AU)"; local_res8[0] = 0; local_48 = 0; uStack_40 = 0; local_38 = 0; uStack_30 = 0; local_28 = (undefined8 *)0x0; uStack_20 = 0; local_18 = 0; uStack_10 = 0; FltInitializePushLock(&DAT_0); - pwVar4 = L"\\CLDMSGPORT"; DAT_1 = &DAT_140029718; DAT_2 = &DAT_2; + uVar2 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 != 0) { + FltInitializePushLock(&DAT_3); + } + pwVar4 = L"\\CLDMSGPORT"; RtlInitUnicodeString(&local_48); uVar2 = SeSddlSecurityDescriptorFromSDDL(local_58,pwVar4,&local_res10); uVar5 = uVar2 & 0xffffffff; HsmDbgBreakOnStatus((int)uVar2); if ((int)uVar2 < 0) { pwVar6 = pwVar7; if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_3; + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_4; uVar3 = 0x98; } else { local_28 = &local_48; uStack_30 = 0; uStack_10 = 0; local_18 = local_res10; local_38 = CONCAT44(local_38._4_4_,0x30); uStack_20 = CONCAT44(uStack_20._4_4_,0x240); uVar1 = FltCreateCommunicationPort - (Globals,&DAT_4,&local_38,0,CldiPortNotifyConnect, + (Globals,&DAT_5,&local_38,0,CldiPortNotifyConnect, CldiPortNotifyDisconnect,CldiPortNotifyMessage,0x7fffffff); uVar5 = (ulonglong)uVar1; HsmDbgBreakOnStatus(uVar1); if ((int)uVar1 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_3; + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_4; uVar3 = 0x99; pwVar6 = pwVar7; } else { pwVar6 = (wchar_t *)ExAllocatePool2(0x40,0x104,0x62546c43); if (pwVar6 == (wchar_t *)0x0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_3; + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_4; uVar3 = 0x9a; } else { uVar1 = RtlStringCchPrintfW(pwVar6,0x82, L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\%s\\Parameters" ,L"CldFlt"); uVar5 = (ulonglong)uVar1; if (-1 < (int)uVar1) { uVar1 = HsmpGetRegDword(pwVar6,L"USMsgTimeoutMillis",local_res8); uVar5 = (ulonglong)uVar1; HsmDbgBreakOnStatus(uVar1); if ((int)uVar1 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x9d, - &WPP_cc273c1883333330d0add2efd2d75ac1_Traceguids,uVar1); + &WPP_657987570b5032d9f4f56ca2aaff3274_Traceguids,uVar1); } uVar5 = 0; } else if (local_res8[0] < 1000) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (2 < (byte)WPP_GLOBAL_Control[0x29])) { WPP_SF_dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x9c, - &WPP_cc273c1883333330d0add2efd2d75ac1_Traceguids,local_res8[0]); + &WPP_657987570b5032d9f4f56ca2aaff3274_Traceguids,local_res8[0]); } } else { - DAT_5 = (ulonglong)local_res8[0] * -10000; + DAT_6 = (ulonglong)local_res8[0] * -10000; } - goto LAB_3; + goto LAB_4; } if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_3; + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_4; uVar3 = 0x9b; } } } WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar3, - &WPP_cc273c1883333330d0add2efd2d75ac1_Traceguids,(int)uVar5); -LAB_3: + &WPP_657987570b5032d9f4f56ca2aaff3274_Traceguids,(int)uVar5); +LAB_4: if (local_res10 != 0) { ExFreePoolWithTag(local_res10,0); } if (pwVar6 != (wchar_t *)0x0) { ExFreePoolWithTag(pwVar6,0x62546c43); } return uVar5; } ``` ## DriverEntry ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.93| |i_ratio|0.89| |m_ratio|1.0| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|DriverEntry|DriverEntry| |fullname|DriverEntry|DriverEntry| |refcount|2|2| |`length`|242|248| |called|HsmDriverEntry
WppInitKm
WppLoadTracingSupport
__security_check_cookie
memset|HsmDriverEntry
WppInitKm
WppLoadTracingSupport
__security_check_cookie
memset| |calling|entry|entry| |paramcount|2|2| |`address`|140089388|14008a388| |sig|undefined __fastcall DriverEntry(longlong param_1, ulonglong param_2)|undefined __fastcall DriverEntry(longlong param_1, ulonglong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DriverEntry Diff ```diff --- DriverEntry +++ DriverEntry @@ -1,33 +1,33 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void DriverEntry(longlong param_1,ulonglong param_2) { undefined1 auStack_48 [32]; undefined8 local_28; undefined8 local_20; undefined8 local_18; ulonglong local_10; local_10 = __security_cookie ^ (ulonglong)auStack_48; _DAT_0 = 1; _WPP_MAIN_CB = 0; DAT_1 = &WPP_ThisDir_CTLGUID_CldFltLogGuid; DAT_2 = 0; _DAT_3 = 0; WppLoadTracingSupport(); _DAT_3 = 0; WppInitKm(); local_28 = 7; memset(&Globals,0,0x5c0); - DAT_4 = &DAT_1400291c0; - DAT_5 = 600000000; + DAT_4 = 600000000; + DAT_5 = &DAT_1400291c0; DAT_6 = 0xffffffffff676980; local_18 = 0x7fffffffffffffff; local_20 = 36000000000; HsmDriverEntry(param_1,param_2,(undefined4 *)&local_28,&_CldFltRegistration); return; } ``` ## CldSyncConnectRoot ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.48| |i_ratio|0.53| |m_ratio|0.99| |b_ratio|0.46| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|CldSyncConnectRoot|CldSyncConnectRoot| |fullname|CldSyncConnectRoot|CldSyncConnectRoot| |refcount|2|2| |`length`|1000|1018| |`called`|
Expand for full list:
CldiSyncCreateRootNoLock
FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltReleasePushLockEx
HsmDbgBreakOnStatus
MicrosoftTelemetryAssertTriggeredArgsMsgKM
MicrosoftTelemetryAssertTriggeredMsgKM
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
TlmWriteSyncRootAlreadyConnected
WPP_SF_qDZZd
WPP_SF_qiliqqDZZqDiqqDZZqDd
WPP_SF_qqiqDZZd
|
Expand for full list:
CldiSyncCreateRootNoLock
FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltReleasePushLockEx
Feature_1074201912__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
MicrosoftTelemetryAssertTriggeredArgsMsgKM
MicrosoftTelemetryAssertTriggeredMsgKM
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
TlmWriteSyncRootAlreadyConnected
WPP_SF_qDZZd
WPP_SF_qiliqqDZZqDiqqDZZqDdWPP_SF_qqiqDZZd
| |calling|CldiPortProcessServiceCommands|CldiPortProcessServiceCommands| |paramcount|8|8| |`address`|14003ca34|14003ca54| |sig|uint __fastcall CldSyncConnectRoot(longlong * param_1, longlong param_2, ulonglong param_3, undefined2 * param_4, uint param_5, undefined4 param_6, longlong param_7, longlong * param_8)|uint __fastcall CldSyncConnectRoot(longlong * param_1, longlong param_2, ulonglong param_3, undefined2 * param_4, uint param_5, undefined4 param_6, longlong param_7, longlong * param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldSyncConnectRoot Called Diff ```diff --- CldSyncConnectRoot called +++ CldSyncConnectRoot called @@ -3,0 +4 @@ +Feature_1074201912__private_IsEnabledDeviceUsageNoInline ``` ### CldSyncConnectRoot Diff ```diff --- CldSyncConnectRoot +++ CldSyncConnectRoot @@ -1,103 +1,111 @@ uint CldSyncConnectRoot(longlong *param_1,longlong param_2,ulonglong param_3,undefined2 *param_4, uint param_5,undefined4 param_6,longlong param_7,longlong *param_8) { uint uVar1; longlong lVar2; - undefined *puVar3; - ulonglong *puVar4; - longlong *plVar5; + ulonglong uVar3; + undefined *puVar4; + ulonglong *puVar5; + longlong *plVar6; longlong *local_res8; ulonglong local_res18; undefined8 in_stack_ffffffffffffff38; - ulonglong uVar6; undefined8 uVar7; undefined4 uVar8; uVar8 = (undefined4)((ulonglong)in_stack_ffffffffffffff38 >> 0x20); local_res8 = (longlong *)0x0; local_res18 = param_3; FltAcquirePushLockExclusiveEx(param_1 + 1,0); - puVar4 = &local_res18; + puVar5 = &local_res18; lVar2 = RtlLookupElementGenericTableAvl(param_1 + 2); - if ((lVar2 != 0) && (plVar5 = *(longlong **)(lVar2 + 8), local_res8 = plVar5, plVar5[0xc] != 0)) { - if ((plVar5[0xc] != param_2) || (*plVar5 != param_7)) { + if ((lVar2 == 0) || (plVar6 = *(longlong **)(lVar2 + 8), local_res8 = plVar6, plVar6[0xc] == 0)) { +LAB_0: + uVar1 = CldiSyncCreateRootNoLock(param_1,local_res18,param_4,(longlong *)&local_res8); + HsmDbgBreakOnStatus(uVar1); + if (-1 < (int)uVar1) { + if ((param_5 & 4) != 0) { + *(uint *)(local_res8 + 5) = *(uint *)(local_res8 + 5) | 0x400000; + } + if ((param_5 & 2) != 0) { + *(uint *)(local_res8 + 5) = *(uint *)(local_res8 + 5) | 0x800000; + } + if ((param_5 & 8) != 0) { + *(uint *)(local_res8 + 5) = *(uint *)(local_res8 + 5) | 0x1000000; + } + local_res8[0xc] = param_2; + *(undefined4 *)((longlong)local_res8 + 0x2c) = param_6; + *local_res8 = param_7; + *(undefined4 *)(local_res8 + 6) = 1; + *param_8 = (longlong)local_res8; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qqiqDZZd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),local_res8,param_4,param_1); + } + } + } + else { + if ((plVar6[0xc] != param_2) || (*plVar6 != param_7)) { uVar1 = 0xc000cf09; HsmDbgBreakOnStatus(-0x3fff30f7); - puVar3 = WPP_GLOBAL_Control; + puVar4 = WPP_GLOBAL_Control; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - puVar4 = (ulonglong *)local_res8[0xc]; + puVar5 = (ulonglong *)local_res8[0xc]; param_3 = local_res8[0xc]; - puVar3 = *(undefined **)(WPP_GLOBAL_Control + 0x18); - uVar6 = local_res18; - WPP_SF_qiliqqDZZqDiqqDZZqDd(puVar3,puVar4,param_3,param_1); - uVar8 = (undefined4)(uVar6 >> 0x20); - plVar5 = local_res8; + puVar4 = *(undefined **)(WPP_GLOBAL_Control + 0x18); + uVar3 = local_res18; + WPP_SF_qiliqqDZZqDiqqDZZqDd(puVar4,puVar5,param_3,param_1); + uVar8 = (undefined4)(uVar3 >> 0x20); + plVar6 = local_res8; } - TlmWriteSyncRootAlreadyConnected(puVar3,puVar4,param_3); - if (*(longlong *)(local_res8[0xc] + 0x48) != *(longlong *)(plVar5[0xc] + 0x68)) { - puVar3 = WPP_GLOBAL_Control; + TlmWriteSyncRootAlreadyConnected(puVar4,puVar5,param_3); + if (*(longlong *)(local_res8[0xc] + 0x48) != *(longlong *)(plVar6[0xc] + 0x68)) { + puVar4 = WPP_GLOBAL_Control; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - puVar3 = *(undefined **)(WPP_GLOBAL_Control + 0x18); + puVar4 = *(undefined **)(WPP_GLOBAL_Control + 0x18); uVar7 = CONCAT44(uVar8,*(undefined4 *)(local_res8[0xc] + 0x80)); - WPP_SF_qDZZd(puVar3,0x24,local_res8[0xc],*(undefined8 *)(local_res8[0xc] + 0x68),uVar7, + WPP_SF_qDZZd(puVar4,0x26,local_res8[0xc],*(undefined8 *)(local_res8[0xc] + 0x68),uVar7, *(wchar_t **)(local_res8[0xc] + 0x70),*(wchar_t **)(local_res8[0xc] + 0x78)); uVar8 = (undefined4)((ulonglong)uVar7 >> 0x20); } param_3 = (ulonglong)*(uint *)(local_res8[0xc] + 0x80); MicrosoftTelemetryAssertTriggeredArgsMsgKM - (puVar3,*(undefined4 *)(local_res8[0xc] + 0x60),*(uint *)(local_res8[0xc] + 0x80), + (puVar4,*(undefined4 *)(local_res8[0xc] + 0x60),*(uint *)(local_res8[0xc] + 0x80), "OwningSyncProviderProcess doesn\'t match OwningClientProcess"); } if (*(longlong *)(param_2 + 0x68) != 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qDZZd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x25,param_3, + WPP_SF_qDZZd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x27,param_3, *(longlong *)(param_2 + 0x68),CONCAT44(uVar8,*(undefined4 *)(param_2 + 0x80)) ,*(wchar_t **)(param_2 + 0x70),*(wchar_t **)(param_2 + 0x78)); } MicrosoftTelemetryAssertTriggeredMsgKM ("ConnectingPortContext has valid SyncProviderProcess"); } - goto LAB_0; + goto LAB_1; } - if (0 < (int)plVar5[6]) { - uVar1 = 0; - *param_8 = (longlong)plVar5; - goto LAB_0; + uVar3 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 == 0) { + if ((int)plVar6[6] < 1) goto LAB_0; } + else if ((int)plVar6[6] < 1) { + uVar1 = 0xc000cf0b; + goto LAB_1; + } + uVar1 = 0; + *param_8 = (longlong)local_res8; } - uVar1 = CldiSyncCreateRootNoLock(param_1,local_res18,param_4,(longlong *)&local_res8); - HsmDbgBreakOnStatus(uVar1); - if (-1 < (int)uVar1) { - if ((param_5 & 4) != 0) { - *(uint *)(local_res8 + 5) = *(uint *)(local_res8 + 5) | 0x400000; - } - if ((param_5 & 2) != 0) { - *(uint *)(local_res8 + 5) = *(uint *)(local_res8 + 5) | 0x800000; - } - if ((param_5 & 8) != 0) { - *(uint *)(local_res8 + 5) = *(uint *)(local_res8 + 5) | 0x1000000; - } - local_res8[0xc] = param_2; - *(undefined4 *)((longlong)local_res8 + 0x2c) = param_6; - *local_res8 = param_7; - *(undefined4 *)(local_res8 + 6) = 1; - *param_8 = (longlong)local_res8; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqiqDZZd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),local_res8,param_4,param_1); - } - } -LAB_0: +LAB_1: FltReleasePushLockEx(param_1 + 1,0); return uVar1; } ``` ## CldStreamQueryProgress ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.06| |i_ratio|0.27| |m_ratio|0.96| |b_ratio|0.47| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|CldStreamQueryProgress|CldStreamQueryProgress| |fullname|CldStreamQueryProgress|CldStreamQueryProgress| |refcount|2|2| |`length`|5354|5860| |`called`|
Expand for full list:
CldSyncGetRootInfo
CldSyncGetSyncProviderProcess
CldSyncGetSyncProviderProcessId
CldSyncReferenceStream
CldiStreamRestartCountdownTimer
CldiStreamStopCountdownTimer
CldiSyncReleaseRundown
FLTMGR.SYS::FltAcquirePushLockSharedEx
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
HsmDbgBreakOnStatusHsmExpandKernelStackAndCallout
HsmOsGetProcessSessionIdFromEproccess
HsmOsIsInSameSession
HsmpGetStreamSize
HsmpReleaseBitmapLock
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::FsRtlAddBaseMcbEntry
NTOSKRNL.EXE::FsRtlInitializeBaseMcbEx
NTOSKRNL.EXE::FsRtlLookupBaseMcbEntry
NTOSKRNL.EXE::FsRtlRemoveBaseMcbEntry
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ProbeForWrite
TlmWriteZeroRangeQueryProgress
WPP_SF_d
WPP_SF_iid
WPP_SF_qiiiiiiiDiid
memcpy
memset
|
Expand for full list:
CldSyncGetRootInfo
CldSyncGetSyncProviderProcess
CldSyncReferenceStream
CldiStreamRestartCountdownTimer
CldiStreamStopCountdownTimer
CldiSyncReleaseRundown
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
Feature_1074201912__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
HsmOsGetProcessSessionIdFromEproccessHsmOsIsInSameSession
HsmiQueryFileRange
HsmpGetStreamSize
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::FsRtlAddBaseMcbEntry
NTOSKRNL.EXE::FsRtlInitializeBaseMcbEx
NTOSKRNL.EXE::FsRtlLookupBaseMcbEntry
NTOSKRNL.EXE::FsRtlRemoveBaseMcbEntry
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ProbeForWrite
TlmWriteZeroRangeQueryProgress
WPP_SF_d
WPP_SF_qid
WPP_SF_qiiiiiiiDiid
memmove
memset
| |calling|CldiPortProcessQueryProgress|CldiPortProcessQueryProgress| |paramcount|4|4| |`address`|14007a21c|14007c5c4| |sig|ulonglong __fastcall CldStreamQueryProgress(uint param_1, longlong param_2, uint param_3, uint * param_4)|ulonglong __fastcall CldStreamQueryProgress(uint param_1, longlong param_2, uint param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldStreamQueryProgress Called Diff ```diff --- CldStreamQueryProgress called +++ CldStreamQueryProgress called @@ -3 +2,0 @@ -CldSyncGetSyncProviderProcessId @@ -8 +6,0 @@ -FLTMGR.SYS::FltAcquirePushLockSharedEx @@ -10,0 +9 @@ +Feature_1074201912__private_IsEnabledDeviceUsageNoInline @@ -12 +10,0 @@ -HsmExpandKernelStackAndCallout @@ -14,0 +13 @@ +HsmiQueryFileRange @@ -16 +14,0 @@ -HsmpReleaseBitmapLock @@ -32 +30 @@ -WPP_SF_iid +WPP_SF_qid @@ -34 +32 @@ -memcpy +memmove ``` ### CldStreamQueryProgress Diff ```diff --- CldStreamQueryProgress +++ CldStreamQueryProgress @@ -1,667 +1,704 @@ /* WARNING: Type propagation algorithm not settling */ ulonglong CldStreamQueryProgress(uint param_1,longlong param_2,uint param_3,uint *param_4) { - longlong *******ppppppplVar1; + longlong ***ppplVar1; longlong *****ppppplVar2; - code *pcVar3; - undefined4 uVar4; + longlong *****ppppplVar3; + code *pcVar4; undefined4 uVar5; undefined4 uVar6; - longlong *******ppppppplVar7; + undefined4 uVar7; char cVar8; - byte bVar9; - uint uVar10; - int iVar11; - int iVar12; - uint uVar13; - longlong lVar14; - longlong ******pppppplVar15; - longlong *****ppppplVar16; + uint uVar9; + int iVar10; + longlong lVar11; + longlong *******ppppppplVar12; + longlong *****ppppplVar13; + longlong ****pppplVar14; + void *pvVar15; + longlong ******pppppplVar16; longlong ****pppplVar17; - longlong ****pppplVar18; - ulonglong uVar19; - longlong ******pppppplVar20; - longlong *****ppppplVar21; - longlong **pplVar22; - undefined2 uVar23; - ulonglong uVar24; - longlong *plVar25; + ulonglong uVar18; + longlong ******pppppplVar19; + longlong **pplVar20; + undefined2 uVar21; + ulonglong uVar22; + undefined8 *puVar23; + longlong *plVar24; + int iVar25; longlong ******pppppplVar26; - longlong ******pppppplVar27; - uint uVar28; - longlong ******pppppplVar29; - undefined8 uVar30; - byte local_198 [8]; - longlong ******local_190; - int local_188; - longlong ******local_180; - longlong local_178; - longlong ******local_170; - int local_168; - uint local_164; + uint uVar27; + undefined8 uVar28; + byte local_168 [8]; longlong local_160; - uint local_158; - longlong ****local_150; - longlong ****local_148; - longlong ******local_140; + int local_158; + longlong local_150; + longlong ******local_148; + int local_140; + uint local_13c; longlong ******local_138; - longlong ******local_130; - longlong local_128; - longlong ******local_120; - int local_118; - int local_114; - uint local_110; - longlong *****local_108; - undefined8 local_100; - undefined8 uStack_f8; - undefined8 local_f0; - undefined8 uStack_e8; - undefined8 local_e0; - longlong *******ppppppplStack_d8; - longlong *******local_d0; - longlong ****local_c8; - longlong ****local_c0; + longlong *****local_130; + uint local_128; + longlong *local_120; + longlong ******local_118; + longlong ******local_110; + longlong ******local_108; + longlong *****local_100; + longlong *local_f8; + longlong local_f0; + int local_e8; + uint local_e4; + uint local_e0; + undefined8 local_d8; + undefined8 uStack_d0; + undefined8 local_c8; + undefined8 uStack_c0; undefined8 local_b8; - undefined8 uStack_b0; - undefined8 local_a8; - undefined8 uStack_a0; - undefined8 local_98; - undefined8 *******pppppppuStack_90; - undefined8 *******local_88; - longlong ****local_80; - undefined8 local_78; - longlong ****local_70; - longlong *****local_68; - byte *local_60; + longlong *******ppppppplStack_b0; + longlong *******local_a8; + longlong ***local_a0; + longlong ****local_98; + undefined8 local_90; + undefined8 uStack_88; + undefined8 local_80; + undefined8 uStack_78; + undefined8 local_70; + undefined8 *******pppppppuStack_68; + undefined8 *******local_60; longlong ****local_58; - int local_50 [6]; + undefined8 local_50; + undefined8 uStack_48; pppppplVar26 = (longlong ******)0x0; - pppppplVar27 = (longlong ******)0x0; - local_190 = (longlong ******)0x0; - local_168 = 0; - local_188 = 0; - local_128 = 0; - lVar14 = IoGetCurrentProcess(); - local_118 = HsmOsGetProcessSessionIdFromEproccess(lVar14); + local_138 = (longlong ******)0x0; + local_140 = 0; + local_158 = 0; + local_f0 = 0; + lVar11 = IoGetCurrentProcess(); + local_e8 = HsmOsGetProcessSessionIdFromEproccess(lVar11); + local_90 = 0; + uStack_88 = 0; + local_80 = 0; + uStack_78 = 0; + local_70 = 0; + pppppppuStack_68 = (undefined8 *******)0x0; + local_60 = (undefined8 *******)0x0; + local_d8 = 0; + uStack_d0 = 0; + local_c8 = 0; + uStack_c0 = 0; local_b8 = 0; - uStack_b0 = 0; - local_a8 = 0; - uStack_a0 = 0; - local_98 = 0; - pppppppuStack_90 = (undefined8 *******)0x0; - local_88 = (undefined8 *******)0x0; - local_100 = 0; - uStack_f8 = 0; - local_f0 = 0; - uStack_e8 = 0; - local_e0 = 0; - ppppppplStack_d8 = (longlong *******)0x0; - local_d0 = (longlong *******)0x0; - local_178 = 0; + ppppppplStack_b0 = (longlong *******)0x0; + local_a8 = (longlong *******)0x0; local_160 = 0; - local_148 = (longlong ****)0x0; - local_150 = (longlong ****)0x0; - local_198[0] = 0; + local_150 = 0; + local_120 = (longlong *)0x0; + local_f8 = (longlong *)0x0; + local_168[0] = 0; KeEnterCriticalRegion(); - uVar10 = CldiStreamStopCountdownTimer(); - HsmDbgBreakOnStatus(uVar10); - if (-1 < (int)uVar10) { - local_88 = &pppppppuStack_90; - pppppppuStack_90 = &pppppppuStack_90; - local_d0 = (longlong *******)&ppppppplStack_d8; - ppppppplStack_d8 = (longlong *******)&ppppppplStack_d8; - KeEnterCriticalRegion(); - ExAcquireResourceExclusiveLite(&DAT_0,1); - if ((longlong ********)DAT_2[1] != &DAT_2) goto LAB_14007b74f; - ppppppplStack_d8 = DAT_2; - local_d0 = (longlong *******)&DAT_2; - DAT_2[1] = (longlong ******)&ppppppplStack_d8; - DAT_2 = (longlong *******)&ppppppplStack_d8; - if ((longlong ********)*DAT_3 != &DAT_140029790) goto LAB_14007b74f; - pppppppuStack_90 = &DAT_2; - local_88 = DAT_3; - *DAT_3 = &pppppppuStack_90; - DAT_3 = &pppppppuStack_90; - ppppppplVar1 = ppppppplStack_d8; -LAB_4: - do { - ppppppplStack_d8 = ppppppplVar1; - ppppppplVar7 = ppppppplStack_d8; - uVar13 = 0; - if ((undefined8 ********)ppppppplStack_d8 == &pppppppuStack_90) goto LAB_5; - local_138 = (longlong ******)0x0; - local_130 = (longlong ******)0x0; - (*ppppppplStack_d8)[1] = (longlong *****)&ppppppplStack_d8; - *local_d0 = (longlong ******)ppppppplStack_d8; - ppppppplVar1 = (longlong *******)*ppppppplStack_d8; - *ppppppplStack_d8 = (longlong ******)&ppppppplStack_d8; - ppppppplStack_d8[1] = (longlong ******)local_d0; - local_d0 = ppppppplStack_d8; - uVar28 = *(uint *)(ppppppplStack_d8 + -5); - local_170 = (longlong ******)CONCAT44(local_170._4_4_,uVar28); - } while (uVar28 == 0); - uVar28 = uVar28 & 0xffff; - local_158 = *(uint *)((longlong)ppppppplStack_d8 + 0x2c); - pppppplVar27 = ppppppplStack_d8[3]; - pppppplVar20 = ppppppplStack_d8[4]; - local_120 = ppppppplStack_d8[0xb]; - if (ppppppplStack_d8[7] == (longlong ******)0x0) { - local_140 = ppppppplStack_d8[0xc]; - } - else { - local_140 = (longlong ******)ppppppplStack_d8[7][5]; - } - pppppplVar29 = ppppppplStack_d8[10]; - local_180 = (longlong ******)*pppppplVar29; - local_108 = local_180[1]; - local_c8 = local_180[2][4]; - local_164 = uVar28; - ppppppplStack_d8 = ppppppplVar1; - lVar14 = CldSyncGetSyncProviderProcess((longlong)local_c8); - local_c0 = (longlong ****)(**pppppplVar29)[5]; - if (pppppplVar29[7] == (longlong *****)0x0) { - iVar12 = *(int *)(ppppppplVar7 + 5); - } - else { - iVar12 = *(int *)(pppppplVar29[7] + 10); - } - ppppppplVar1 = ppppppplStack_d8; - if ((lVar14 == 0) || ((param_1 >> (uVar28 - 1 & 0x1f) & 1) == 0)) goto LAB_4; - iVar11 = HsmOsGetProcessSessionIdFromEproccess(lVar14); - cVar8 = HsmOsIsInSameSession(iVar11,iVar12,local_118); - ppppppplVar1 = ppppppplStack_d8; - if (cVar8 == '\0') goto LAB_4; - if (local_164 == 1) { - local_138 = ppppppplVar7[0x27]; - local_130 = ppppppplVar7[0x28]; - } - ExReleaseResourceLite(&DAT_0); - KeLeaveCriticalRegion(); - local_128 = CldSyncReferenceStream((longlong)local_c8,local_c0,0); - if (local_128 == 0) goto LAB_6; - uVar19 = (ulonglong)(local_188 - 1U); - pppppplVar15 = pppppplVar26; - if (0 < (int)(local_188 - 1U)) { - do { - uVar24 = (longlong)(int)((int)uVar19 + (uint)pppppplVar15) / 2; - iVar12 = (int)uVar24; - uVar13 = iVar12 + 1; - if (pppppplVar29 <= local_190[(longlong)iVar12 * 2]) { - uVar19 = uVar24 & 0xffffffff; - uVar13 = (uint)pppppplVar15; - } - pppppplVar15 = (longlong ******)(ulonglong)uVar13; - } while ((int)uVar13 < (int)uVar19); - } - if (((int)uVar13 < local_188) && - ((longlong ******)local_190[(longlong)(int)uVar13 * 2] == pppppplVar29)) { - ppppplVar16 = local_190[(longlong)(int)uVar13 * 2 + 1]; - uVar13 = local_164; - } - else { - if (local_188 == local_168) { - local_114 = local_168 + 4; - pppppplVar15 = (longlong ******)ExAllocatePool2(0x100,(longlong)local_114 << 4,0x67706c43); - if (pppppplVar15 == (longlong ******)0x0) { - uVar10 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - pppppplVar26 = local_190; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_7; - uVar23 = 0x41; - pppppplVar20 = local_180; -LAB_8: - uVar10 = 0xc000009a; -LAB_9: - WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar23, - &WPP_2a9d30f0c12830c9146d15e3ad9e1517_Traceguids,pppppplVar20); - pppppplVar26 = local_190; - goto LAB_7; - } - if (local_190 != (longlong ******)0x0) { - memcpy(pppppplVar15,local_190,(longlong)local_168 << 4); - ExFreePoolWithTag(local_190); - } - memset(pppppplVar15 + (longlong)local_168 * 2,0,0x40); - local_168 = local_114; - local_190 = pppppplVar15; - } - if ((int)uVar13 < local_188) { - memcpy(local_190 + (longlong)(int)uVar13 * 2 + 2,local_190 + (longlong)(int)uVar13 * 2, - (longlong)(int)(local_188 - uVar13) << 4); - } - pppppplVar15 = local_190 + (longlong)(int)uVar13 * 2; - *pppppplVar15 = (longlong *****)0x0; - pppppplVar15[1] = (longlong *****)0x0; - FltReferenceContext(**pppppplVar29); - *pppppplVar15 = (longlong *****)pppppplVar29; - local_188 = local_188 + 1; - ppppplVar16 = (longlong *****)ExAllocatePool2(0x100,0xc0,0x67706c43); - if (ppppplVar16 == (longlong *****)0x0) { - uVar10 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - pppppplVar26 = local_190; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_7; - uVar23 = 0x42; - pppppplVar20 = local_180; - goto LAB_8; - } - pppppplVar15[1] = ppppplVar16; - uVar19 = (ulonglong)local_164; - uVar13 = 1 << ((char)local_164 - 1U & 0x1f); - *(uint *)((longlong)ppppplVar16 + 0x44) = uVar13; - if ((int)local_170 < 0) { - uVar13 = uVar13 | 0x80000000; - *(uint *)((longlong)ppppplVar16 + 0x44) = uVar13; - } - if (((ulonglong)local_170 & 0x40000000) != 0) { - *(uint *)((longlong)ppppplVar16 + 0x44) = uVar13 | 0x40000000; - } - pppplVar17 = local_c8; - uVar28 = CldSyncGetSyncProviderProcessId((longlong)local_c8); - uVar13 = (uint)uVar19; - ppppplVar16[0xd] = (longlong ****)(ulonglong)uVar28; - pppppplVar15 = pppppplVar26; - if (pppplVar17 != (longlong ****)0x0) { - pppppplVar15 = (longlong ******)*pppplVar17; - } - ppppplVar16[0xe] = (longlong ****)pppppplVar15; - ppppplVar16[0xf] = local_c0; - if (uVar13 - 1 < 2) { - pppplVar17 = *local_108; - uVar4 = *(undefined4 *)((longlong)pppplVar17 + 0x34); - uVar5 = *(undefined4 *)(pppplVar17 + 7); - uVar6 = *(undefined4 *)((longlong)pppplVar17 + 0x3c); - *(undefined4 *)(ppppplVar16 + 0x11) = *(undefined4 *)(pppplVar17 + 6); - *(undefined4 *)((longlong)ppppplVar16 + 0x8c) = uVar4; - *(undefined4 *)(ppppplVar16 + 0x12) = uVar5; - *(undefined4 *)((longlong)ppppplVar16 + 0x94) = uVar6; - ppppplVar16[0x13] = (longlong ****)(**pppppplVar29)[2][4]; - if (uVar13 == 1) { - cVar8 = FsRtlInitializeBaseMcbEx(ppppplVar16,uVar19 & 0xffffffff,0); - if (cVar8 == '\0') { - uVar10 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - pppppplVar26 = local_190; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_7; - uVar23 = 0x43; - pppppplVar20 = local_180; - goto LAB_8; - } - cVar8 = FsRtlInitializeBaseMcbEx(ppppplVar16 + 3,1); - if (cVar8 == '\0') { - uVar10 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - pppppplVar26 = local_190; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_7; - uVar23 = 0x44; - pppppplVar20 = local_180; - goto LAB_8; - } - pppplVar17 = (longlong ****)HsmpGetStreamSize((longlong)*local_180); - ppppplVar16[0x17] = pppplVar17; - uVar13 = local_164; - } - } - } - if ((ppppplVar16[9] == (longlong ****)0x0) || ((longlong)local_120 < (longlong)ppppplVar16[9])) - { - ppppplVar16[9] = (longlong ****)local_120; - } - if ((longlong)ppppplVar16[10] < (longlong)local_140) { - ppppplVar16[10] = (longlong ****)local_140; - } - if (*(int *)(ppppplVar16 + 6) == 0) { - *(uint *)(ppppplVar16 + 6) = local_158; - } - *(longlong *******)((longlong)ppppplVar16 + 0x34) = pppppplVar27; - *(longlong *******)((longlong)ppppplVar16 + 0x3c) = pppppplVar20; - if (uVar13 == 1) { - lVar14 = ((ulonglong)~*(uint *)((longlong)**pppppplVar29 + 0x1c) & 2) * 0x800; - uVar19 = ~(lVar14 - 1U); - uVar24 = uVar19 & (ulonglong)local_138; - lVar14 = ((longlong)local_130 + (longlong)local_138 + lVar14 + -1 & uVar19) - uVar24; - if ((0 < lVar14) && - (cVar8 = FsRtlAddBaseMcbEntry(ppppplVar16,uVar24,uVar24,lVar14), cVar8 == '\0')) { - HsmDbgBreakOnStatus(-0x3fffff66); - pppppplVar26 = local_190; - uVar10 = 0xc000009a; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((uVar10 = 0xc000009a, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || - ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_7; - uVar23 = 0x45; - pppppplVar20 = local_180; - goto LAB_8; - } - if (lVar14 == 0) { - lVar14 = CldSyncGetRootInfo((longlong)local_180[2][4]); - TlmWriteZeroRangeQueryProgress - ((**pppppplVar29)[2][4],ppppplVar16[0x17],ppppplVar16[0xb],ppppplVar16[0xc], - ppppplVar16[0x14],ppppplVar16[0x15],ppppplVar16[0x16],0,0,lVar14,0); - } - } - CldiSyncReleaseRundown(local_128); - local_128 = 0; -LAB_6: - KeEnterCriticalRegion(); - ExAcquireResourceExclusiveLite(&DAT_0,1); - ppppppplVar1 = ppppppplStack_d8; - goto LAB_4; - } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (pppppplVar26 = pppppplVar27, (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x40, - &WPP_2a9d30f0c12830c9146d15e3ad9e1517_Traceguids,uVar10); - } - goto LAB_7; -code_r0x00014007b01f: - if (local_178 != -1) { - ppppplVar2[0x14] = (longlong ****)((longlong)ppppplVar2[0x14] - local_160); - } - pppppplVar27 = (longlong ******)((longlong)pppppplVar27 + local_160); - goto LAB_10; -LAB_5: - ExReleaseResourceLite(&DAT_0,ppppppplStack_d8); - KeLeaveCriticalRegion(); - pppppplVar29 = (longlong ******)(longlong)local_188; - local_158 = local_188 * 0x90; - *param_4 = local_158; - pppppplVar27 = local_190; - pppppplVar20 = pppppplVar26; - pppppplVar15 = pppppplVar29; - if (param_3 < local_158) { - uVar10 = 0x801c0001; - HsmDbgBreakOnStatus(-0x7fe3ffff); - pppppplVar26 = local_190; + uVar9 = CldiStreamStopCountdownTimer(); + HsmDbgBreakOnStatus(uVar9); + if ((int)uVar9 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x46, - &WPP_2a9d30f0c12830c9146d15e3ad9e1517_Traceguids,0x801c0001); - pppppplVar26 = local_190; + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar21 = 0x40; +LAB_0: + WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar21, + &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,uVar9); } } else { - while (local_120 = pppppplVar15, local_140 = pppppplVar27, local_138 = pppppplVar20, - (longlong)pppppplVar20 < (longlong)pppppplVar29) { - ppppplVar16 = *pppppplVar27; - pppppplVar20 = (longlong ******)*ppppplVar16; - ppppplVar2 = pppppplVar27[1]; - ppppplVar2[0xb] = ppppplVar16[6]; - ppppplVar2[0xc] = ppppplVar16[5]; - local_170 = pppppplVar20; - if ((*(uint *)((longlong)ppppplVar2 + 0x44) & 2) == 0) { - local_148 = (longlong ****)0x0; - while (pppppplVar27 = pppppplVar26, (longlong)local_148 < (longlong)ppppplVar2[0x17]) { - local_130 = (longlong ******)*pppppplVar20; - if (local_130[0x14] != (longlong *****)0x0) { - FltAcquirePushLockSharedEx(local_130[0x14] + 5,0); - } - ppppplVar21 = ppppplVar2 + 0x17; - bVar9 = (byte)(*(uint *)((longlong)local_130 + 0x1c) >> 6) & 1; - if (local_130[0x14][7] == (longlong ****)0x0) { - uVar10 = uVar13; - local_198[0] = bVar9; - if (ppppplVar21 == (longlong *****)0x0) { - local_150 = (longlong ****)0x7fffffffffffffff; - } - else { - local_150 = *ppppplVar21; - } - } - else { - local_78 = 7; - local_50[0] = 0; - local_50[1] = 0; - local_70 = (longlong ****)&local_148; - local_60 = local_198; - local_58 = (longlong ****)&local_150; - local_80 = local_130[0x14][7]; - local_68 = ppppplVar21; - uVar10 = HsmExpandKernelStackAndCallout(HsmpBitmapQueryRangeExCallout,local_50); - HsmDbgBreakOnStatus(uVar10); - HsmDbgBreakOnStatus(uVar10); - } - HsmpReleaseBitmapLock((longlong)local_130); - HsmDbgBreakOnStatus(uVar10); - if ((int)uVar10 < 0) { - pppppplVar26 = local_190; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_7; - uVar23 = 0x47; - goto LAB_9; - } - if (local_198[0] != 0) { - local_108 = (longlong *****)((longlong)local_150 - (longlong)local_148); - if ((0 < (longlong)local_108) && - (cVar8 = FsRtlAddBaseMcbEntry(ppppplVar2 + 3,local_148,local_148,local_108), - cVar8 == '\0')) { - uVar10 = 0xc000009a; + local_60 = &pppppppuStack_68; + pppppppuStack_68 = &pppppppuStack_68; + local_a8 = (longlong *******)&ppppppplStack_b0; + ppppppplStack_b0 = (longlong *******)&ppppppplStack_b0; + KeEnterCriticalRegion(); + ExAcquireResourceExclusiveLite(&DAT_1,1); + ppppppplVar12 = DAT_2; + if ((longlong ********)DAT_2[1] != &DAT_2) goto LAB_14007dcea; + ppppppplStack_b0 = DAT_2; + local_a8 = (longlong *******)&DAT_2; + DAT_2[1] = (longlong ******)&ppppppplStack_b0; + DAT_2 = (longlong *******)&ppppppplStack_b0; + if ((longlong ********)*DAT_4 != &DAT_140029798) goto LAB_14007dcea; + pppppppuStack_68 = &DAT_2; + local_60 = DAT_4; + *DAT_4 = &pppppppuStack_68; + DAT_4 = &pppppppuStack_68; + pppppplVar16 = pppppplVar26; + iVar25 = 0; + if ((undefined8 ********)ppppppplVar12 != &pppppppuStack_68) { +LAB_5: + local_110 = (longlong ******)0x0; + local_108 = (longlong ******)0x0; + (*ppppppplVar12)[1] = (longlong *****)&ppppppplStack_b0; + *local_a8 = (longlong ******)ppppppplVar12; + ppppppplStack_b0 = (longlong *******)*ppppppplVar12; + *ppppppplVar12 = (longlong ******)&ppppppplStack_b0; + ppppppplVar12[1] = (longlong ******)local_a8; + local_e4 = *(uint *)(ppppppplVar12 + -5); + local_a8 = ppppppplVar12; + if (local_e4 == 0) goto LAB_6; + uVar27 = local_e4 & 0xffff; + local_128 = *(uint *)((longlong)ppppppplVar12 + 0x2c); + local_50 = ppppppplVar12[3]; + uStack_48 = ppppppplVar12[4]; + local_148 = ppppppplVar12[0xb]; + if (ppppppplVar12[7] == (longlong ******)0x0) { + local_118 = ppppppplVar12[0xc]; + } + else { + local_118 = (longlong ******)ppppppplVar12[7][5]; + } + pppppplVar16 = ppppppplVar12[10]; + local_130 = *pppppplVar16; + local_58 = local_130[1]; + local_a0 = local_130[2][4]; + local_13c = uVar27; + lVar11 = CldSyncGetSyncProviderProcess((longlong)local_a0); + local_98 = (longlong ****)(**pppppplVar16)[5]; + if (pppppplVar16[7] == (longlong *****)0x0) { + iVar25 = *(int *)(ppppppplVar12 + 5); + } + else { + iVar25 = *(int *)(pppppplVar16[7] + 10); + } + if ((lVar11 == 0) || ((param_1 >> (uVar27 - 1 & 0x1f) & 1) == 0)) goto LAB_6; + iVar10 = HsmOsGetProcessSessionIdFromEproccess(lVar11); + cVar8 = HsmOsIsInSameSession(iVar10,iVar25,local_e8); + if (cVar8 == '\0') goto LAB_6; + if (local_13c == 1) { + local_110 = ppppppplVar12[0x27]; + local_108 = ppppppplVar12[0x28]; + } + ExReleaseResourceLite(&DAT_1); + KeLeaveCriticalRegion(); + local_f0 = CldSyncReferenceStream((longlong)local_a0,local_98,0); + if (local_f0 == 0) { +LAB_7: + KeEnterCriticalRegion(); + ExAcquireResourceExclusiveLite(&DAT_1,1); + goto LAB_6; + } + iVar25 = local_158 + -1; + pppppplVar19 = pppppplVar26; + uVar27 = 0; + if (0 < iVar25) { + do { + iVar10 = (int)(iVar25 + (uint)pppppplVar19) / 2; + uVar27 = iVar10 + 1; + if (pppppplVar16 <= local_138[(longlong)iVar10 * 2]) { + uVar27 = (uint)pppppplVar19; + iVar25 = iVar10; + } + pppppplVar19 = (longlong ******)(ulonglong)uVar27; + } while ((int)uVar27 < iVar25); + } + if (((int)uVar27 < local_158) && + ((longlong ******)local_138[(longlong)(int)uVar27 * 2] == pppppplVar16)) { + ppppplVar13 = local_138[(longlong)(int)uVar27 * 2 + 1]; + goto LAB_8; + } + if (local_158 == local_140) { + local_100 = (longlong *****)CONCAT44(local_100._4_4_,local_140 + 4); + pppppplVar19 = (longlong ******) + ExAllocatePool2(0x100,(longlong)(local_140 + 4) << 4,0x67706c43); + if (pppppplVar19 != (longlong ******)0x0) { + if (local_138 != (longlong ******)0x0) { + memmove(pppppplVar19,local_138,(longlong)local_140 << 4); + ExFreePoolWithTag(local_138); + } + memset(pppppplVar19 + (longlong)local_140 * 2,0,0x40); + local_140 = (int)local_100; + local_138 = pppppplVar19; + goto LAB_9; + } + uVar9 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_10; + uVar21 = 0x41; + } + else { +LAB_9: + iVar25 = local_158; + if ((int)uVar27 < local_158) { + memmove(local_138 + (longlong)(int)uVar27 * 2 + 2,local_138 + (longlong)(int)uVar27 * 2, + (longlong)(int)(local_158 - uVar27) << 4); + } + pppppplVar19 = local_138 + (longlong)(int)uVar27 * 2; + *pppppplVar19 = (longlong *****)0x0; + pppppplVar19[1] = (longlong *****)0x0; + FltReferenceContext(**pppppplVar16); + *pppppplVar19 = (longlong *****)pppppplVar16; + local_158 = iVar25 + 1; + ppppplVar13 = (longlong *****)ExAllocatePool2(0x100,0xc0,0x67706c43); + local_100 = ppppplVar13; + if (ppppplVar13 != (longlong *****)0x0) { + pppppplVar19[1] = ppppplVar13; + uVar27 = 1 << ((char)local_13c - 1U & 0x1f); + *(uint *)((longlong)ppppplVar13 + 0x44) = uVar27; + if ((int)local_e4 < 0) { + uVar27 = uVar27 | 0x80000000; + *(uint *)((longlong)ppppplVar13 + 0x44) = uVar27; + } + if ((local_e4 & 0x40000000) != 0) { + *(uint *)((longlong)ppppplVar13 + 0x44) = uVar27 | 0x40000000; + } + pppppplVar19 = pppppplVar26; + if ((local_a0 != (longlong ***)0x0) && (local_a0[0xc] != (longlong **)0x0)) { + pppppplVar19 = (longlong ******)(ulonglong)*(uint *)(local_a0[0xc] + 0x10); + } + ppppplVar13[0xd] = (longlong ****)pppppplVar19; + pppppplVar19 = pppppplVar26; + if (local_a0 != (longlong ***)0x0) { + pppppplVar19 = (longlong ******)*local_a0; + } + ppppplVar13[0xe] = (longlong ****)pppppplVar19; + ppppplVar13[0xf] = local_98; + if (local_13c - 1 < 2) { + ppplVar1 = *local_58; + uVar5 = *(undefined4 *)((longlong)ppplVar1 + 0x34); + uVar6 = *(undefined4 *)(ppplVar1 + 7); + uVar7 = *(undefined4 *)((longlong)ppplVar1 + 0x3c); + *(undefined4 *)(ppppplVar13 + 0x11) = *(undefined4 *)(ppplVar1 + 6); + *(undefined4 *)((longlong)ppppplVar13 + 0x8c) = uVar5; + *(undefined4 *)(ppppplVar13 + 0x12) = uVar6; + *(undefined4 *)((longlong)ppppplVar13 + 0x94) = uVar7; + ppppplVar13[0x13] = (longlong ****)(**pppppplVar16)[2][4]; + if (local_13c == 1) { + cVar8 = FsRtlInitializeBaseMcbEx(ppppplVar13,1); + if (cVar8 != '\0') { + cVar8 = FsRtlInitializeBaseMcbEx(ppppplVar13 + 3,1); + if (cVar8 != '\0') { + pppplVar14 = (longlong ****)HsmpGetStreamSize((longlong)*local_130); + ppppplVar13[0x17] = pppplVar14; + goto LAB_8; + } + uVar9 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar21 = 0x44; + goto LAB_11; + } + goto LAB_10; + } + uVar9 = 0xc000009a; HsmDbgBreakOnStatus(-0x3fffff66); - pppppplVar26 = local_190; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || - ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_7; - uVar23 = 0x48; - uVar10 = 0xc000009a; - goto LAB_9; - } - if (local_108 == (longlong *****)0x0) { - lVar14 = CldSyncGetRootInfo((longlong)pppppplVar20[2][4]); - TlmWriteZeroRangeQueryProgress - ((**ppppplVar16)[2][4],ppppplVar2[0x17],ppppplVar2[0xb],ppppplVar2[0xc], - ppppplVar2[0x14],ppppplVar2[0x15],ppppplVar2[0x16],0,0,lVar14,1); - } - ppppplVar2[0x16] = - (longlong ****) - ((longlong)local_150 + ((longlong)ppppplVar2[0x16] - (longlong)local_148)); - } - local_148 = local_150; - } - while (local_180 = pppppplVar27, - cVar8 = FsRtlLookupBaseMcbEntry(ppppplVar2,pppppplVar27,&local_178,&local_160,0,0,0), - pppppplVar27 = pppppplVar26, cVar8 != '\0') { - if (local_160 == 0) { - HsmDbgBreakOnStatus(-0x3fff30ee); - pppppplVar27 = local_180; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x49,(**ppppplVar16)[2] - ,pppppplVar20); - } - lVar14 = CldSyncGetRootInfo((longlong)pppppplVar20[2][4]); - pplVar22 = (**ppppplVar16)[2]; - uVar30 = 2; - goto LAB_11; - } - if (local_178 != -1) { - ppppplVar2[0x15] = (longlong ****)((longlong)ppppplVar2[0x15] + local_160); - } - pppppplVar27 = (longlong ******)((longlong)local_180 + local_160); - } - while (cVar8 = FsRtlLookupBaseMcbEntry - (ppppplVar2 + 3,pppppplVar27,&local_178,&local_160,0,0,0), - cVar8 != '\0') { - if (local_160 == 0) { - HsmDbgBreakOnStatus(-0x3fff30ee); - pppppplVar26 = local_170; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4a,(**ppppplVar16)[2] - ,local_170); - } - lVar14 = CldSyncGetRootInfo((longlong)pppppplVar26[2][4]); - uVar30 = 3; - goto LAB_12; - } - if ((local_178 != -1) && - (cVar8 = FsRtlRemoveBaseMcbEntry(ppppplVar2,pppppplVar27), cVar8 == '\0')) { - uVar10 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - pppppplVar26 = local_190; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || - ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_7; - uVar23 = 0x4b; - pppppplVar20 = local_170; - goto LAB_8; - } - pppppplVar27 = (longlong ******)((longlong)pppppplVar27 + local_160); - } - ppppplVar2[0x14] = ppppplVar2[0x15]; - pppppplVar27 = pppppplVar26; -LAB_10: - cVar8 = FsRtlLookupBaseMcbEntry(ppppplVar2,pppppplVar27,&local_178,&local_160,0,0,0); - if (cVar8 != '\0') { - if (local_160 != 0) goto code_r0x00014007b01f; - HsmDbgBreakOnStatus(-0x3fff30ee); - pppppplVar26 = local_170; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4c,(**ppppplVar16)[2], - local_170); - } - lVar14 = CldSyncGetRootInfo((longlong)pppppplVar26[2][4]); - uVar30 = 4; -LAB_12: - pplVar22 = (**ppppplVar16)[2]; -LAB_11: - uVar10 = 0xc000cf12; - TlmWriteZeroRangeQueryProgress - (pplVar22[4],ppppplVar2[0x17],ppppplVar2[0xb],ppppplVar2[0xc],ppppplVar2[0x14], - ppppplVar2[0x15],ppppplVar2[0x16],local_178,pppppplVar27,lVar14,uVar30); - pppppplVar26 = local_190; + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_10; + uVar21 = 0x43; + goto LAB_11; + } + } +LAB_8: + if ((ppppplVar13[9] == (longlong ****)0x0) || + ((longlong)local_148 < (longlong)ppppplVar13[9])) { + ppppplVar13[9] = (longlong ****)local_148; + } + if ((longlong)ppppplVar13[10] < (longlong)local_118) { + ppppplVar13[10] = (longlong ****)local_118; + } + if (*(int *)(ppppplVar13 + 6) == 0) { + *(uint *)(ppppplVar13 + 6) = local_128; + } + *(undefined4 *)((longlong)ppppplVar13 + 0x34) = (undefined4)local_50; + *(undefined4 *)(ppppplVar13 + 7) = local_50._4_4_; + *(undefined4 *)((longlong)ppppplVar13 + 0x3c) = (undefined4)uStack_48; + *(undefined4 *)(ppppplVar13 + 8) = uStack_48._4_4_; + if (local_13c == 1) { + lVar11 = (ulonglong)(~*(uint *)((longlong)**pppppplVar16 + 0x1c) & 2) * 0x800; + uVar18 = ~(lVar11 - 1U); + uVar22 = uVar18 & (ulonglong)local_110; + lVar11 = ((longlong)local_108 + (longlong)local_110 + lVar11 + -1 & uVar18) - uVar22; + if ((0 < lVar11) && + (cVar8 = FsRtlAddBaseMcbEntry(ppppplVar13,uVar22,uVar22,lVar11), cVar8 == '\0')) { + uVar9 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0 && + (1 < (byte)WPP_GLOBAL_Control[0x29])))) { + uVar21 = 0x45; + goto LAB_11; + } + goto LAB_10; + } + if (lVar11 == 0) { + uVar18 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar18 == 0) { + pplVar20 = (**pppppplVar16)[2][4]; + pvVar15 = CldSyncGetRootInfo((longlong)local_130[2][4]); + TlmWriteZeroRangeQueryProgress + (pplVar20,ppppplVar13[0x17],ppppplVar13[0xb],ppppplVar13[0xc], + ppppplVar13[0x14],ppppplVar13[0x15],ppppplVar13[0x16],0,0, + (longlong)pvVar15,0); + } + else { + pvVar15 = CldSyncGetRootInfo((longlong)local_130[2][4]); + if (pvVar15 != (void *)0x0) { + TlmWriteZeroRangeQueryProgress + ((**pppppplVar16)[2][4],ppppplVar13[0x17],ppppplVar13[0xb], + ppppplVar13[0xc],ppppplVar13[0x14],ppppplVar13[0x15],ppppplVar13[0x16], + 0,0,(longlong)pvVar15,0); + ExFreePoolWithTag(pvVar15,0x69726943); + } + } + } + } + CldiSyncReleaseRundown(local_f0); + local_f0 = 0; goto LAB_7; } - pppplVar18 = (longlong ****)HsmpGetStreamSize((longlong)**ppppplVar16); - pppplVar17 = ppppplVar2[0x14]; - if ((longlong)pppplVar18 < (longlong)ppppplVar2[0x14]) { - pppplVar17 = pppplVar18; - } - ppppplVar2[0x14] = pppplVar17; - pppplVar18 = (longlong ****)HsmpGetStreamSize((longlong)**ppppplVar16); - pppplVar17 = ppppplVar2[0x15]; - pppppplVar29 = local_120; - if ((longlong)pppplVar18 < (longlong)ppppplVar2[0x15]) { - pppplVar17 = pppplVar18; - } - } - else { - ppppplVar2[0x14] = ppppplVar16[10]; - pppplVar17 = ppppplVar16[9]; - } - ppppplVar2[0x15] = pppplVar17; - pppppplVar27 = local_140 + 2; - pppppplVar15 = local_120; - pppppplVar20 = (longlong ******)((longlong)local_138 + 1); + uVar9 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_10; + uVar21 = 0x42; + } +LAB_11: + uVar9 = 0xc000009a; + ppppplVar13 = local_130; +LAB_12: + WPP_SF_qid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar21, + &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,ppppplVar13); + goto LAB_10; } - ProbeForWrite(param_2,local_158,1); - local_110 = 0; - while (iVar12 = (int)pppppplVar26, pppppplVar26 = local_190, iVar12 < local_188) { - ppppplVar16 = local_190[(longlong)iVar12 * 2 + 1]; - plVar25 = (longlong *)((longlong)iVar12 * 0x90 + param_2); - pppplVar17 = ppppplVar16[7]; - *plVar25 = (longlong)ppppplVar16[6]; - plVar25[1] = (longlong)pppplVar17; - pppplVar17 = ppppplVar16[9]; - plVar25[2] = (longlong)ppppplVar16[8]; - plVar25[3] = (longlong)pppplVar17; - pppplVar17 = ppppplVar16[0xb]; - plVar25[4] = (longlong)ppppplVar16[10]; - plVar25[5] = (longlong)pppplVar17; - pppplVar17 = ppppplVar16[0xd]; - plVar25[6] = (longlong)ppppplVar16[0xc]; - plVar25[7] = (longlong)pppplVar17; - pppplVar17 = ppppplVar16[0xf]; - plVar25[8] = (longlong)ppppplVar16[0xe]; - plVar25[9] = (longlong)pppplVar17; - pppplVar17 = ppppplVar16[0x11]; - plVar25[10] = (longlong)ppppplVar16[0x10]; - plVar25[0xb] = (longlong)pppplVar17; - pppplVar17 = ppppplVar16[0x13]; - plVar25[0xc] = (longlong)ppppplVar16[0x12]; - plVar25[0xd] = (longlong)pppplVar17; - pppplVar17 = ppppplVar16[0x15]; - plVar25[0xe] = (longlong)ppppplVar16[0x14]; - plVar25[0xf] = (longlong)pppplVar17; - uVar4 = *(undefined4 *)((longlong)ppppplVar16 + 0xb4); - uVar5 = *(undefined4 *)(ppppplVar16 + 0x17); - uVar6 = *(undefined4 *)((longlong)ppppplVar16 + 0xbc); - *(undefined4 *)(plVar25 + 0x10) = *(undefined4 *)(ppppplVar16 + 0x16); - *(undefined4 *)((longlong)plVar25 + 0x84) = uVar4; - *(undefined4 *)(plVar25 + 0x11) = uVar5; - *(undefined4 *)((longlong)plVar25 + 0x8c) = uVar6; - local_110 = iVar12 + 1; - pppppplVar26 = (longlong ******)(ulonglong)local_110; +LAB_13: + ExReleaseResourceLite(&DAT_1); + KeLeaveCriticalRegion(); + local_128 = iVar25 * 0x90; + *param_4 = local_128; + if (param_3 < local_128) { + uVar9 = 0x801c0001; + HsmDbgBreakOnStatus(-0x7fe3ffff); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar21 = 0x46; + goto LAB_0; + } + } + else { + pppppplVar19 = (longlong ******)(longlong)iVar25; + local_108 = pppppplVar19; + if (0 < iVar25) { + local_110 = (longlong ******)0x0; + do { + ppppplVar2 = *pppppplVar16; + ppppplVar13 = (longlong *****)*ppppplVar2; + ppppplVar3 = pppppplVar16[1]; + ppppplVar3[0xb] = ppppplVar2[6]; + ppppplVar3[0xc] = ppppplVar2[5]; + local_118 = pppppplVar16; + if ((*(uint *)((longlong)ppppplVar3 + 0x44) & 2) == 0) { + local_120 = (longlong *)0x0; + pppppplVar16 = pppppplVar26; + if (0 < (longlong)ppppplVar3[0x17]) { + do { + uVar9 = HsmiQueryFileRange((longlong)*ppppplVar13,0x4244,&local_120, + ppppplVar3 + 0x17,local_168,&local_f8); + HsmDbgBreakOnStatus(uVar9); + if ((int)uVar9 < 0) { + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_10; + uVar21 = 0x47; + goto LAB_12; + } + if (local_168[0] != 0) { + lVar11 = (longlong)local_f8 - (longlong)local_120; + if ((0 < lVar11) && + (cVar8 = FsRtlAddBaseMcbEntry(ppppplVar3 + 3,local_120,local_120,lVar11), + cVar8 == '\0')) { + uVar9 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || + ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_10; + uVar21 = 0x48; + goto LAB_14; + } + if (lVar11 == 0) { + uVar18 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar18 == 0) { + plVar24 = (**ppppplVar2)[2][4]; + pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); + TlmWriteZeroRangeQueryProgress + (plVar24,ppppplVar3[0x17],ppppplVar3[0xb],ppppplVar3[0xc], + ppppplVar3[0x14],ppppplVar3[0x15],ppppplVar3[0x16],0,0, + (longlong)pvVar15,1); + } + else { + pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); + if (pvVar15 != (void *)0x0) { + TlmWriteZeroRangeQueryProgress + ((**ppppplVar2)[2][4],ppppplVar3[0x17],ppppplVar3[0xb], + ppppplVar3[0xc],ppppplVar3[0x14],ppppplVar3[0x15], + ppppplVar3[0x16],0,0,(longlong)pvVar15,1); + ExFreePoolWithTag(pvVar15,0x69726943); + } + } + } + ppppplVar3[0x16] = + (longlong ****) + ((longlong)local_f8 + ((longlong)ppppplVar3[0x16] - (longlong)local_120)); + } + local_120 = local_f8; + } while ((longlong)local_f8 < (longlong)ppppplVar3[0x17]); + } + while (local_148 = pppppplVar16, + cVar8 = FsRtlLookupBaseMcbEntry + (ppppplVar3,pppppplVar16,&local_160,&local_150,0,0,0), + pppppplVar19 = pppppplVar26, cVar8 != '\0') { + if (local_150 == 0) { + uVar9 = 0xc000cf12; + HsmDbgBreakOnStatus(-0x3fff30ee); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x49, + (**ppppplVar2)[2],ppppplVar13); + } + uVar18 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar18 == 0) { + plVar24 = (**ppppplVar2)[2][4]; + pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); + uVar28 = 2; + goto LAB_15; + } + pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); + if (pvVar15 == (void *)0x0) goto LAB_10; + pplVar20 = (**ppppplVar2)[2]; + uVar28 = 2; + pppplVar14 = ppppplVar3[0x16]; + pppplVar17 = ppppplVar3[0x15]; + goto LAB_16; + } + if (local_160 != -1) { + ppppplVar3[0x15] = (longlong ****)((longlong)ppppplVar3[0x15] + local_150); + } + pppppplVar16 = (longlong ******)((longlong)pppppplVar16 + local_150); + } + while (local_148 = pppppplVar19, + cVar8 = FsRtlLookupBaseMcbEntry + (ppppplVar3 + 3,pppppplVar19,&local_160,&local_150,0,0,0), + cVar8 != '\0') { + if (local_150 == 0) { + uVar9 = 0xc000cf12; + HsmDbgBreakOnStatus(-0x3fff30ee); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4a, + (**ppppplVar2)[2],ppppplVar13); + } + uVar18 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar18 == 0) { + plVar24 = (**ppppplVar2)[2][4]; + pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); + uVar28 = 3; + goto LAB_15; + } + pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); + if (pvVar15 == (void *)0x0) goto LAB_10; + uVar28 = 3; + goto LAB_17; + } + if ((local_160 != -1) && + (cVar8 = FsRtlRemoveBaseMcbEntry(ppppplVar3,pppppplVar19), cVar8 == '\0')) { + uVar9 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0 && + (1 < (byte)WPP_GLOBAL_Control[0x29])))) { + uVar21 = 0x4b; +LAB_14: + uVar9 = 0xc000009a; + goto LAB_12; + } + goto LAB_10; + } + pppppplVar19 = (longlong ******)((longlong)pppppplVar19 + local_150); + } + ppppplVar3[0x14] = ppppplVar3[0x15]; + pppppplVar19 = pppppplVar26; + while (local_148 = pppppplVar19, + cVar8 = FsRtlLookupBaseMcbEntry + (ppppplVar3,pppppplVar19,&local_160,&local_150,0,0,0), + cVar8 != '\0') { + if (local_150 == 0) { + uVar9 = 0xc000cf12; + HsmDbgBreakOnStatus(-0x3fff30ee); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4c, + (**ppppplVar2)[2],ppppplVar13); + } + uVar18 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar18 == 0) { + plVar24 = (**ppppplVar2)[2][4]; + pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); + uVar28 = 4; +LAB_15: + uVar9 = 0xc000cf12; + TlmWriteZeroRangeQueryProgress + (plVar24,ppppplVar3[0x17],ppppplVar3[0xb],ppppplVar3[0xc], + ppppplVar3[0x14],ppppplVar3[0x15],ppppplVar3[0x16],local_160,local_148, + (longlong)pvVar15,uVar28); + } + else { + pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); + if (pvVar15 != (void *)0x0) { + uVar28 = 4; +LAB_17: + pplVar20 = (**ppppplVar2)[2]; + pppplVar14 = ppppplVar3[0x16]; + pppplVar17 = ppppplVar3[0x15]; + pppppplVar16 = pppppplVar19; +LAB_16: + uVar9 = 0xc000cf12; + TlmWriteZeroRangeQueryProgress + (pplVar20[4],ppppplVar3[0x17],ppppplVar3[0xb],ppppplVar3[0xc], + ppppplVar3[0x14],pppplVar17,pppplVar14,local_160,pppppplVar16, + (longlong)pvVar15,uVar28); + ExFreePoolWithTag(pvVar15,0x69726943); + } + } + goto LAB_10; + } + if (local_160 != -1) { + ppppplVar3[0x14] = (longlong ****)((longlong)ppppplVar3[0x14] - local_150); + } + pppppplVar19 = (longlong ******)((longlong)pppppplVar19 + local_150); + } + pppplVar17 = (longlong ****)HsmpGetStreamSize((longlong)**ppppplVar2); + pppplVar14 = ppppplVar3[0x14]; + if ((longlong)pppplVar17 < (longlong)ppppplVar3[0x14]) { + pppplVar14 = pppplVar17; + } + ppppplVar3[0x14] = pppplVar14; + pppplVar17 = (longlong ****)HsmpGetStreamSize((longlong)**ppppplVar2); + pppplVar14 = ppppplVar3[0x15]; + pppppplVar19 = local_108; + if ((longlong)pppplVar17 < (longlong)ppppplVar3[0x15]) { + pppplVar14 = pppplVar17; + } + } + else { + ppppplVar3[0x14] = ppppplVar2[10]; + pppplVar14 = ppppplVar2[9]; + } + ppppplVar3[0x15] = pppplVar14; + local_110 = (longlong ******)((longlong)local_110 + 1); + pppppplVar16 = local_118 + 2; + iVar25 = local_158; + local_118 = pppppplVar16; + } while ((longlong)local_110 < (longlong)pppppplVar19); + } + ProbeForWrite(param_2,local_128,1); + local_e0 = 0; + while (iVar10 = (int)pppppplVar26, iVar10 < iVar25) { + ppppplVar13 = local_138[(longlong)iVar10 * 2 + 1]; + puVar23 = (undefined8 *)((longlong)iVar10 * 0x90 + param_2); + pppplVar14 = ppppplVar13[7]; + *puVar23 = ppppplVar13[6]; + puVar23[1] = pppplVar14; + pppplVar14 = ppppplVar13[9]; + puVar23[2] = ppppplVar13[8]; + puVar23[3] = pppplVar14; + pppplVar14 = ppppplVar13[0xb]; + puVar23[4] = ppppplVar13[10]; + puVar23[5] = pppplVar14; + pppplVar14 = ppppplVar13[0xd]; + puVar23[6] = ppppplVar13[0xc]; + puVar23[7] = pppplVar14; + pppplVar14 = ppppplVar13[0xf]; + puVar23[8] = ppppplVar13[0xe]; + puVar23[9] = pppplVar14; + pppplVar14 = ppppplVar13[0x11]; + puVar23[10] = ppppplVar13[0x10]; + puVar23[0xb] = pppplVar14; + pppplVar14 = ppppplVar13[0x13]; + puVar23[0xc] = ppppplVar13[0x12]; + puVar23[0xd] = pppplVar14; + pppplVar14 = ppppplVar13[0x15]; + puVar23[0xe] = ppppplVar13[0x14]; + puVar23[0xf] = pppplVar14; + pppplVar14 = ppppplVar13[0x17]; + puVar23[0x10] = ppppplVar13[0x16]; + puVar23[0x11] = pppplVar14; + local_e0 = iVar10 + 1; + pppppplVar26 = (longlong ******)(ulonglong)local_e0; + } } } -LAB_7: - if (local_128 != 0) { - CldiSyncReleaseRundown(local_128); +LAB_10: + if (local_f0 != 0) { + CldiSyncReleaseRundown(local_f0); } KeEnterCriticalRegion(); - ExAcquireResourceExclusiveLite(&DAT_0,1); - if (((undefined8 ********)pppppppuStack_90[1] == &pppppppuStack_90) && - ((undefined8 ********)*local_88 == &pppppppuStack_90)) { - *local_88 = pppppppuStack_90; - pppppppuStack_90[1] = local_88; - if (((longlong ********)ppppppplStack_d8[1] == &ppppppplStack_d8) && - ((longlong ********)*local_d0 == &ppppppplStack_d8)) { - *local_d0 = (longlong ******)ppppppplStack_d8; - ppppppplStack_d8[1] = (longlong ******)local_d0; - ExReleaseResourceLite(&DAT_0); + ExAcquireResourceExclusiveLite(&DAT_1,1); + if (((undefined8 ********)pppppppuStack_68[1] == &pppppppuStack_68) && + ((undefined8 ********)*local_60 == &pppppppuStack_68)) { + *local_60 = pppppppuStack_68; + pppppppuStack_68[1] = local_60; + if (((longlong ********)ppppppplStack_b0[1] == &ppppppplStack_b0) && + ((longlong ********)*local_a8 == &ppppppplStack_b0)) { + *local_a8 = (longlong ******)ppppppplStack_b0; + ppppppplStack_b0[1] = (longlong ******)local_a8; + ExReleaseResourceLite(&DAT_1); KeLeaveCriticalRegion(); CldiStreamRestartCountdownTimer(); - if (pppppplVar26 != (longlong ******)0x0) { - lVar14 = (longlong)local_188; - pppppplVar27 = pppppplVar26; - if (0 < lVar14) { + pppppplVar26 = local_138; + if (local_138 != (longlong ******)0x0) { + lVar11 = (longlong)local_158; + pppppplVar16 = local_138; + if (0 < lVar11) { do { - if (*pppppplVar26 != (longlong *****)0x0) { - FltReleaseContext(***pppppplVar26); - } - ppppplVar16 = pppppplVar26[1]; - if (ppppplVar16 != (longlong *****)0x0) { - if (ppppplVar16[2] != (longlong ****)0x0) { - FsRtlUninitializeBaseMcb(ppppplVar16); - } - if (ppppplVar16[5] != (longlong ****)0x0) { - FsRtlUninitializeBaseMcb(ppppplVar16 + 3); - } - ExFreePoolWithTag(ppppplVar16,0x67706c43); - } - pppppplVar26 = pppppplVar26 + 2; - lVar14 = lVar14 + -1; - pppppplVar27 = local_190; - } while (lVar14 != 0); + if (*pppppplVar16 != (longlong *****)0x0) { + FltReleaseContext(***pppppplVar16); + } + ppppplVar13 = pppppplVar16[1]; + if (ppppplVar13 != (longlong *****)0x0) { + if (ppppplVar13[2] != (longlong ****)0x0) { + FsRtlUninitializeBaseMcb(ppppplVar13); + } + if (ppppplVar13[5] != (longlong ****)0x0) { + FsRtlUninitializeBaseMcb(ppppplVar13 + 3); + } + ExFreePoolWithTag(ppppplVar13,0x67706c43); + } + lVar11 = lVar11 + -1; + pppppplVar16 = pppppplVar16 + 2; + } while (lVar11 != 0); } - ExFreePoolWithTag(pppppplVar27,0x67706c43); + ExFreePoolWithTag(pppppplVar26,0x67706c43); } KeLeaveCriticalRegion(); - return (ulonglong)uVar10; + return (ulonglong)uVar9; } } -LAB_1: - pcVar3 = (code *)swi(0x29); - (*pcVar3)(3); - pcVar3 = (code *)swi(3); - uVar19 = (*pcVar3)(); - return uVar19; +LAB_3: + pcVar4 = (code *)swi(0x29); + (*pcVar4)(3); + pcVar4 = (code *)swi(3); + uVar18 = (*pcVar4)(); + return uVar18; +LAB_6: + ppppppplVar12 = ppppppplStack_b0; + pppppplVar16 = local_138; + iVar25 = local_158; + if ((undefined8 ********)ppppppplStack_b0 == &pppppppuStack_68) goto LAB_13; + goto LAB_5; } ``` ## CldiPortNotifyDisconnect ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.69| |i_ratio|0.5| |m_ratio|0.85| |b_ratio|0.74| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|CldiPortNotifyDisconnect|CldiPortNotifyDisconnect| |fullname|CldiPortNotifyDisconnect|CldiPortNotifyDisconnect| |refcount|4|4| |`length`|387|502| |`called`|
Expand for full list:
CldReleaseProcessInfo
CldSyncDisconnectRootByObject
CldSyncGetRootInfo
FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltCloseClientPort
FLTMGR.SYS::FltReleasePushLockEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlEnumerateGenericTableWithoutSplayingAvl
NTOSKRNL.EXE::RtlNumberGenericTableElementsAvl
TlmWriteProviderCrashedEvent
|
Expand for full list:
CldReleaseProcessInfo
CldSyncDisconnectRootByObject
CldSyncGetRootInfo
FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltCloseClientPort
FLTMGR.SYS::FltReleasePushLockEx
Feature_1074201912__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlEnumerateGenericTableWithoutSplayingAvl
NTOSKRNL.EXE::RtlNumberGenericTableElementsAvlTlmWriteProviderCrashedEvent
| |calling||| |paramcount|1|1| |`address`|140039ae0|140039a90| |sig|undefined __fastcall CldiPortNotifyDisconnect(longlong * param_1)|undefined __fastcall CldiPortNotifyDisconnect(longlong * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiPortNotifyDisconnect Called Diff ```diff --- CldiPortNotifyDisconnect called +++ CldiPortNotifyDisconnect called @@ -6,0 +7 @@ +Feature_1074201912__private_IsEnabledDeviceUsageNoInline ``` ### CldiPortNotifyDisconnect Diff ```diff --- CldiPortNotifyDisconnect +++ CldiPortNotifyDisconnect @@ -1,56 +1,75 @@ void CldiPortNotifyDisconnect(longlong *param_1) { longlong *plVar1; code *pcVar2; int iVar3; - longlong lVar4; + ulonglong uVar4; longlong lVar5; + void *pvVar6; undefined8 local_res8; FltAcquirePushLockExclusiveEx(&DAT_0,0); plVar1 = param_1 + 0x20; *(int *)plVar1 = (int)*plVar1 + -1; if ((int)*plVar1 == 0) { - lVar4 = *param_1; - if ((*(longlong **)(lVar4 + 8) != param_1) || + lVar5 = *param_1; + if ((*(longlong **)(lVar5 + 8) != param_1) || (plVar1 = (longlong *)param_1[1], (longlong *)*plVar1 != param_1)) { pcVar2 = (code *)swi(0x29); (*pcVar2)(3); pcVar2 = (code *)swi(3); (*pcVar2)(); return; } - *plVar1 = lVar4; - *(longlong **)(lVar4 + 8) = plVar1; + *plVar1 = lVar5; + *(longlong **)(lVar5 + 8) = plVar1; param_1[1] = (longlong)param_1; *param_1 = (longlong)param_1; } else { param_1 = (longlong *)0x0; } FltReleasePushLockEx(&DAT_0,0); if (param_1 != (longlong *)0x0) { + uVar4 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 != 0) { + FltAcquirePushLockExclusiveEx(&DAT_1,0); + } FltAcquirePushLockExclusiveEx(param_1 + 0x12,0); plVar1 = param_1 + 0x13; while( true ) { iVar3 = RtlNumberGenericTableElementsAvl(plVar1); if (iVar3 == 0) break; local_res8 = 0; - lVar4 = RtlEnumerateGenericTableWithoutSplayingAvl(plVar1,&local_res8); - lVar5 = CldSyncGetRootInfo(*(longlong *)(lVar4 + 8)); - TlmWriteProviderCrashedEvent(lVar5); - CldSyncDisconnectRootByObject(*(undefined8 **)(lVar4 + 8),0xc0000001); - RtlDeleteElementGenericTableAvl(plVar1,lVar4); + lVar5 = RtlEnumerateGenericTableWithoutSplayingAvl(plVar1,&local_res8); + uVar4 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + pvVar6 = CldSyncGetRootInfo(*(longlong *)(lVar5 + 8)); + TlmWriteProviderCrashedEvent((longlong)pvVar6); + } + else { + pvVar6 = CldSyncGetRootInfo(*(longlong *)(lVar5 + 8)); + if (pvVar6 != (void *)0x0) { + TlmWriteProviderCrashedEvent((longlong)pvVar6); + ExFreePoolWithTag(pvVar6,0x69726943); + } + } + CldSyncDisconnectRootByObject(*(undefined8 **)(lVar5 + 8),0xc0000001); + RtlDeleteElementGenericTableAvl(plVar1,lVar5); } CldReleaseProcessInfo(param_1 + 9); CldReleaseProcessInfo(param_1 + 0xd); FltReleasePushLockEx(param_1 + 0x12,0); + uVar4 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 != 0) { + FltReleasePushLockEx(&DAT_1,0); + } FltCloseClientPort(Globals,param_1 + 2); FltCloseClientPort(Globals,param_1 + 3); ExFreePoolWithTag(param_1,0x63706c43); } return; } ``` ## CldiPortProcessServiceCommands ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.58| |i_ratio|0.45| |m_ratio|0.99| |b_ratio|0.12| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|CldiPortProcessServiceCommands|CldiPortProcessServiceCommands| |fullname|CldiPortProcessServiceCommands|CldiPortProcessServiceCommands| |refcount|2|2| |`length`|5496|5627| |`called`|
Expand for full list:
CldCaptureProcessInfo
CldReleaseProcessInfo
CldSyncConnectRoot
CldSyncDisconnectRoot
CldSyncDisconnectRootByObject
CldSyncReportSyncStatusOnRoot
CldiPortInsertSyncRootNoLock
CldiPortLookupSyncRootNoLock
FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltAcquirePushLockSharedEx
FLTMGR.SYS::FltAttachVolumeAtAltitudeFLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltGetVolumeFromFileObject
FLTMGR.SYS::FltGetVolumeInstanceFromName
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleasePushLockEx
Feature_Cldflt_NPCheckingForSyncInfo__private_IsEnabledDeviceUsageNoInline
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmDbgBreakOnStatus
HsmOsClearProcessAsSyncProvider
HsmOsSetProcessAsSyncProvider
HsmiQueryFullFilePath
HsmpAccessCheck
HsmpCheckLegacyFilterAbsence
MicrosoftTelemetryAssertTriggeredArgsMsgKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::PsGetCurrentProcessId
NTOSKRNL.EXE::RtlComputeCrc32
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
TlmWriteFilterAttachEvent
WPP_SF_d
WPP_SF_dd
WPP_SF_id
WPP_SF_qiqDZd
memcpy
|
Expand for full list:
CldCaptureProcessInfo
CldReleaseProcessInfo
CldSyncConnectRoot
CldSyncDisconnectRoot
CldSyncDisconnectRootByObject
CldSyncReportSyncStatusOnRoot
CldiPortInsertSyncRootNoLock
CldiPortLookupSyncRootNoLock
FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltAcquirePushLockSharedEx
FLTMGR.SYS::FltAttachVolumeAtAltitudeFLTMGR.SYS::FltGetInstanceContext
FLTMGR.SYS::FltGetVolumeFromFileObject
FLTMGR.SYS::FltGetVolumeInstanceFromName
FLTMGR.SYS::FltObjectDereference
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleasePushLockEx
Feature_1074201912__private_IsEnabledDeviceUsageNoInline
Feature_Cldflt_NPCheckingForSyncInfo__private_IsEnabledDeviceUsageNoInline
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmDbgBreakOnStatus
HsmOsClearProcessAsSyncProvider
HsmOsSetProcessAsSyncProvider
HsmiQueryFullFilePath
HsmpAccessCheck
HsmpCheckLegacyFilterAbsence
MicrosoftTelemetryAssertTriggeredArgsMsgKM
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::PsGetCurrentProcessId
NTOSKRNL.EXE::RtlComputeCrc32
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
TlmWriteFilterAttachEvent
WPP_SF_d
WPP_SF_dd
WPP_SF_id
WPP_SF_qiqDZd
memmove
| |calling|CldiPortNotifyMessage|CldiPortNotifyMessage| |paramcount|4|4| |`address`|140083c60|14008373c| |sig|int * __fastcall CldiPortProcessServiceCommands(longlong param_1, short param_2, longlong param_3, uint param_4)|int * __fastcall CldiPortProcessServiceCommands(longlong param_1, short param_2, longlong param_3, uint param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiPortProcessServiceCommands Called Diff ```diff --- CldiPortProcessServiceCommands called +++ CldiPortProcessServiceCommands called @@ -17,0 +18 @@ +Feature_1074201912__private_IsEnabledDeviceUsageNoInline @@ -40 +41 @@ -memcpy +memmove ``` ### CldiPortProcessServiceCommands Diff ```diff --- CldiPortProcessServiceCommands +++ CldiPortProcessServiceCommands @@ -1,711 +1,710 @@ int * CldiPortProcessServiceCommands(longlong param_1,short param_2,longlong param_3,uint param_4) { longlong *plVar1; ushort uVar2; ushort uVar3; uint uVar4; uint uVar5; - int iVar6; - uint uVar7; + uint uVar6; + int iVar7; uint uVar8; undefined4 uVar9; longlong lVar10; ulonglong uVar11; - ulonglong uVar12; - longlong lVar13; - undefined8 uVar14; - undefined *puVar15; - undefined2 uVar16; - int *piVar17; + longlong lVar12; + undefined8 uVar13; + ulonglong uVar14; + uint uVar15; + undefined *puVar16; + undefined2 uVar17; int *piVar18; int *piVar19; - undefined8 *puVar20; - int iVar21; - int *piVar22; - undefined4 local_res10; - longlong local_b8; + int iVar20; + int *piVar21; + bool bVar22; + undefined8 local_c8; + undefined4 local_c0; longlong local_b0; ulonglong local_a8; - undefined8 *local_a0; - longlong local_98; - ulonglong local_90; - ulonglong local_88; + longlong local_a0; + undefined4 local_98; + longlong local_90; + undefined8 *local_88; longlong local_80; longlong *local_78; ulonglong local_70; ushort local_68 [4]; wchar_t *local_60; ushort local_58 [4]; wchar_t *local_50; undefined8 local_48; longlong lStack_40; - piVar17 = (int *)0x0; + piVar18 = (int *)0x0; local_68[0] = 0xc; local_68[1] = 0xe; local_68[2] = 0; local_68[3] = 0; - local_a0 = (undefined8 *)0x0; + local_c8 = 0; + local_78 = (longlong *)0x0; uVar9 = 0; - local_88 = 0; local_70 = 0; local_60 = L"CldFlt"; local_50 = L"180451"; - local_78 = (longlong *)0x0; local_a8 = 0; - local_98 = 0; + local_90 = 0; local_80 = 0; + local_a0 = 0; + local_88 = (undefined8 *)0x0; local_b0 = 0; - local_90 = 0; - local_b8 = 0; local_58[0] = 0xc; local_58[1] = 0xe; local_58[2] = 0; local_58[3] = 0; + bVar22 = false; local_48 = 0; lStack_40 = 0; if (param_2 == 6) { if ((((((param_4 < 0x18) || (*(ushort *)(param_3 + 0xe) < 5)) || (uVar5 = *(uint *)(param_3 + 8), uVar5 < 0x38)) || (0x11 < *(ushort *)(param_3 + 0x30))) - || (((uVar8 = *(uint *)(param_3 + 0x34), uVar8 != 0 && - ((uVar8 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar8)))) || + || (((uVar6 = *(uint *)(param_3 + 0x34), uVar6 != 0 && + ((uVar6 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar6)))) || (uVar5 < *(ushort *)(param_3 + 0x32))))) || - (((uVar4 = *(ushort *)(param_3 + 0x32) + uVar8, uVar4 < uVar8 || (uVar5 < uVar4)) || + (((uVar4 = *(ushort *)(param_3 + 0x32) + uVar6, uVar4 < uVar6 || (uVar5 < uVar4)) || ((*(ushort *)(param_3 + 0x30) != 6 || (*(short *)(param_3 + 0x32) != 8)))))) { - piVar17 = (int *)0xc0000225; + piVar18 = (int *)0xc0000225; } else { - local_b8 = *(longlong *)((ulonglong)*(uint *)(param_3 + 0x34) + param_3); - } - HsmDbgBreakOnStatus((int)piVar17); - if ((int)piVar17 < 0) { - piVar18 = piVar17; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0xb; + local_b0 = *(longlong *)((ulonglong)*(uint *)(param_3 + 0x34) + param_3); + } + HsmDbgBreakOnStatus((int)piVar18); + if ((int)piVar18 < 0) { + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; + uVar17 = 0xb; } else { if (((((param_4 < 0x18) || (*(ushort *)(param_3 + 0xe) < 0xe)) || ((uVar5 = *(uint *)(param_3 + 8), uVar5 < 0x80 || (0x11 < *(ushort *)(param_3 + 0x78))))) - || ((uVar8 = *(uint *)(param_3 + 0x7c), uVar8 != 0 && - ((uVar8 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar8)))))) || + || ((uVar6 = *(uint *)(param_3 + 0x7c), uVar6 != 0 && + ((uVar6 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar6)))))) || (((uVar5 < *(ushort *)(param_3 + 0x7a) || - (((uVar4 = *(ushort *)(param_3 + 0x7a) + uVar8, uVar4 < uVar8 || (uVar5 < uVar4)) || + (((uVar4 = *(ushort *)(param_3 + 0x7a) + uVar6, uVar4 < uVar6 || (uVar5 < uVar4)) || (*(ushort *)(param_3 + 0x78) != 10)))) || (*(short *)(param_3 + 0x7a) != 4)))) { - piVar17 = (int *)0xc0000225; + piVar18 = (int *)0xc0000225; } else { - piVar17 = (int *)0x0; + piVar18 = (int *)0x0; uVar9 = *(undefined4 *)((ulonglong)*(uint *)(param_3 + 0x7c) + param_3); } - HsmDbgBreakOnStatus((int)piVar17); - piVar18 = piVar17; - if (-1 < (int)piVar17) { - if (local_b8 == 0) { + HsmDbgBreakOnStatus((int)piVar18); + if (-1 < (int)piVar18) { + if (local_b0 == 0) { *(undefined4 *)(param_1 + 0x88) = uVar9; } else { FltAcquirePushLockSharedEx(param_1 + 0x90,0); - lVar10 = CldiPortLookupSyncRootNoLock(param_1,local_b8); + lVar10 = CldiPortLookupSyncRootNoLock(param_1,local_b0); FltReleasePushLockEx(param_1 + 0x90,0); if (lVar10 == 0) { piVar18 = (int *)0xc000cf0b; HsmDbgBreakOnStatus(-0x3fff30f5); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xd, - &WPP_cc273c1883333330d0add2efd2d75ac1_Traceguids,param_1); + &WPP_657987570b5032d9f4f56ca2aaff3274_Traceguids,param_1); piVar18 = (int *)0xc000cf0b; } } else { *(undefined4 *)(lVar10 + 0x30) = uVar9; } } goto LAB_0; } if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0xc; + uVar17 = 0xc; } LAB_1: - uVar9 = SUB84(piVar17,0); + uVar9 = SUB84(piVar18,0); + piVar19 = piVar18; } else { if (((((((param_4 < 0x18) || (*(ushort *)(param_3 + 0xe) < 3)) || (uVar5 = *(uint *)(param_3 + 8), uVar5 < 0x28)) || (0x11 < *(ushort *)(param_3 + 0x20))) - || ((uVar8 = *(uint *)(param_3 + 0x24), uVar8 != 0 && - ((uVar8 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar8)))))) || + || ((uVar6 = *(uint *)(param_3 + 0x24), uVar6 != 0 && + ((uVar6 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar6)))))) || (uVar5 < *(ushort *)(param_3 + 0x22))) || - (((uVar4 = *(ushort *)(param_3 + 0x22) + uVar8, uVar4 < uVar8 || (uVar5 < uVar4)) || + (((uVar4 = *(ushort *)(param_3 + 0x22) + uVar6, uVar4 < uVar6 || (uVar5 < uVar4)) || ((*(ushort *)(param_3 + 0x20) != 0xb || (*(short *)(param_3 + 0x22) != 8)))))) { - piVar17 = (int *)0xc0000225; + piVar18 = (int *)0xc0000225; } else { - local_a0 = *(undefined8 **)((ulonglong)*(uint *)(param_3 + 0x24) + param_3); - } - puVar20 = local_a0; - HsmDbgBreakOnStatus((int)piVar17); - if ((int)piVar17 < 0) { - piVar18 = piVar17; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0xe; + local_c8 = *(undefined8 *)((ulonglong)*(uint *)(param_3 + 0x24) + param_3); + } + HsmDbgBreakOnStatus((int)piVar18); + if ((int)piVar18 < 0) { + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; + uVar17 = 0xe; goto LAB_1; } - uVar5 = ObReferenceObjectByHandle(puVar20,0,*(undefined8 *)IoFileObjectType_exref,1,&local_a8,0) - ; - piVar17 = (int *)(ulonglong)uVar5; - HsmDbgBreakOnStatus(uVar5); - if ((int)uVar5 < 0) { - piVar18 = piVar17; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0xf; - goto LAB_1; - } - uVar5 = FltGetVolumeFromFileObject(Globals,local_a8,&local_98); + uVar5 = ObReferenceObjectByHandle + (local_c8,0,*(undefined8 *)IoFileObjectType_exref,1,&local_a8,0); piVar18 = (int *)(ulonglong)uVar5; HsmDbgBreakOnStatus(uVar5); if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x10; -LAB_2: - WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar16, - &WPP_cc273c1883333330d0add2efd2d75ac1_Traceguids,puVar20); - goto LAB_0; - } - uVar5 = FltAttachVolumeAtAltitude(Globals,local_98,local_58,local_68,&local_80); - HsmDbgBreakOnStatus(uVar5); - if (uVar5 == 0xc01c0012) { - uVar5 = FltGetVolumeInstanceFromName(Globals,local_98,local_68,&local_80); - HsmDbgBreakOnStatus(uVar5); - } - else { - TlmWriteFilterAttachEvent(uVar5,local_58,local_68,local_98); - } - piVar18 = (int *)(ulonglong)uVar5; - if ((int)uVar5 < 0) { - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x11; - goto LAB_2; - } - uVar5 = FltGetInstanceContext(local_80,&local_b0); + uVar17 = 0xf; + goto LAB_1; + } + uVar5 = FltGetVolumeFromFileObject(Globals,local_a8,&local_90); piVar18 = (int *)(ulonglong)uVar5; HsmDbgBreakOnStatus(uVar5); if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x12; + uVar17 = 0x10; +LAB_2: + WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar17, + &WPP_657987570b5032d9f4f56ca2aaff3274_Traceguids,local_c8); + goto LAB_0; + } + uVar5 = FltAttachVolumeAtAltitude(Globals,local_90,local_58,local_68,&local_80); + HsmDbgBreakOnStatus(uVar5); + if (uVar5 == 0xc01c0012) { + uVar5 = FltGetVolumeInstanceFromName(Globals,local_90,local_68,&local_80); + HsmDbgBreakOnStatus(uVar5); + } + else { + TlmWriteFilterAttachEvent(uVar5,local_58,local_68,local_90); + } + piVar18 = (int *)(ulonglong)uVar5; + if ((int)uVar5 < 0) { + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; + uVar17 = 0x11; goto LAB_2; } - uVar11 = local_a8; - uVar5 = HsmpAccessCheck(local_b0,local_a8,2); + uVar5 = FltGetInstanceContext(local_80,&local_a0); piVar18 = (int *)(ulonglong)uVar5; HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; + uVar17 = 0x12; + goto LAB_2; + } + uVar6 = HsmpAccessCheck(local_a0,local_a8,2); + piVar18 = (int *)(ulonglong)uVar6; + HsmDbgBreakOnStatus(uVar6); piVar19 = (int *)0x0; - if ((int)uVar5 < 0) { - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x13; + uVar5 = 0; + if ((int)uVar6 < 0) { + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; + uVar17 = 0x13; goto LAB_2; } - local_78 = *(longlong **)(local_b0 + 0x10); + uVar14 = 1; + local_78 = *(longlong **)(local_a0 + 0x10); if (param_2 == 1) goto LAB_0; - uVar5 = 0; + uVar6 = 0; + piVar18 = piVar19; if (param_2 != 2) { if (param_2 == 3) { - uVar5 = HsmCldDeleteSyncRootInfo(local_b0,local_a8); + uVar5 = HsmCldDeleteSyncRootInfo(local_a0,local_a8); piVar18 = (int *)(ulonglong)uVar5; HsmDbgBreakOnStatus(uVar5); if ((((-1 < (int)uVar5) || ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control)) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x19; + uVar17 = 0x19; } else if (param_2 == 7) { - piVar22 = (int *)0x0; - uVar8 = HsmiQueryFullFilePath - (*(undefined8 *)(local_b0 + 0x20),uVar11,local_a8,0x101, - (undefined4 *)&local_48); - piVar18 = (int *)(ulonglong)uVar8; - HsmDbgBreakOnStatus(uVar8); - piVar17 = (int *)0x0; - if ((int)uVar8 < 0) { + piVar21 = (int *)0x0; + uVar5 = HsmiQueryFullFilePath + (*(undefined8 *)(local_a0 + 0x20),1,local_a8,0x101,(undefined4 *)&local_48 + ); + piVar18 = (int *)(ulonglong)uVar5; + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x1a; + uVar17 = 0x1a; } else { if (((((param_4 < 0x18) || (*(ushort *)(param_3 + 0xe) < 0x17)) || - ((uVar8 = *(uint *)(param_3 + 8), uVar8 < 200 || (0x11 < *(ushort *)(param_3 + 0xc0)) + ((uVar5 = *(uint *)(param_3 + 8), uVar5 < 200 || (0x11 < *(ushort *)(param_3 + 0xc0)) ))) || ((uVar4 = *(uint *)(param_3 + 0xc4), uVar4 != 0 && - ((uVar4 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar8 < uVar4))))) - ) || (((uVar8 < *(ushort *)(param_3 + 0xc2) || - (((uVar7 = *(ushort *)(param_3 + 0xc2) + uVar4, uVar7 < uVar4 || - (uVar8 < uVar7)) || (*(ushort *)(param_3 + 0xc0) != 6)))) || + ((uVar4 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar4))))) + ) || (((uVar5 < *(ushort *)(param_3 + 0xc2) || + (((uVar8 = *(ushort *)(param_3 + 0xc2) + uVar4, uVar8 < uVar4 || + (uVar5 < uVar8)) || (*(ushort *)(param_3 + 0xc0) != 6)))) || (*(short *)(param_3 + 0xc2) != 8)))) { - piVar17 = (int *)0xc0000225; + piVar18 = (int *)0xc0000225; + uVar13 = 0; } else { - local_88 = *(ulonglong *)((ulonglong)*(uint *)(param_3 + 0xc4) + param_3); - } - HsmDbgBreakOnStatus((int)piVar17); - if ((int)piVar17 < 0) { - piVar18 = piVar17; + piVar18 = (int *)0x0; + uVar13 = *(undefined8 *)((ulonglong)*(uint *)(param_3 + 0xc4) + param_3); + } + HsmDbgBreakOnStatus((int)piVar18); + if ((int)piVar18 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x1b; + uVar17 = 0x1b; } else { - piVar17 = piVar19; + piVar18 = piVar19; if (((((0x17 < param_4) && (9 < *(ushort *)(param_3 + 0xe))) && - ((uVar8 = *(uint *)(param_3 + 8), piVar17 = piVar22, 0x5f < uVar8 && + ((uVar5 = *(uint *)(param_3 + 8), piVar18 = piVar21, 0x5f < uVar5 && (*(ushort *)(param_3 + 0x58) < 0x12)))) && ((uVar4 = *(uint *)(param_3 + 0x5c), uVar4 == 0 || - (((uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 <= uVar4 && (uVar4 <= uVar8)))))) && - ((*(ushort *)(param_3 + 0x5a) <= uVar8 && - (((uVar7 = *(ushort *)(param_3 + 0x5a) + uVar4, uVar4 <= uVar7 && (uVar7 <= uVar8)) + (((uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 <= uVar4 && (uVar4 <= uVar5)))))) && + ((*(ushort *)(param_3 + 0x5a) <= uVar5 && + (((uVar8 = *(ushort *)(param_3 + 0x5a) + uVar4, uVar4 <= uVar8 && (uVar8 <= uVar5)) && (*(ushort *)(param_3 + 0x58) == 0x11)))))) { if ((*(uint *)(param_3 + 0x5c) != 0) && (*(ushort *)(param_3 + 0x5a) != 0)) { piVar19 = (int *)(param_3 + (ulonglong)*(uint *)(param_3 + 0x5c)); } - uVar5 = (uint)*(ushort *)(param_3 + 0x5a); - piVar17 = piVar19; + uVar6 = (uint)*(ushort *)(param_3 + 0x5a); + piVar18 = piVar19; } uVar5 = CldSyncReportSyncStatusOnRoot - (local_78,local_88,(undefined2 *)&local_48,piVar17,uVar5); + (local_78,uVar13,(undefined2 *)&local_48,piVar18,uVar6); piVar18 = (int *)(ulonglong)uVar5; HsmDbgBreakOnStatus(uVar5); if (((-1 < (int)uVar5) || ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control)) || (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_0; - uVar16 = 0x1c; + uVar17 = 0x1c; } } } else { if (((param_4 < 0x18) || (*(ushort *)(param_3 + 0xe) < 5)) || ((uVar5 = *(uint *)(param_3 + 8), uVar5 < 0x38 || (0x11 < *(ushort *)(param_3 + 0x30))))) { LAB_3: - piVar19 = (int *)0xc0000225; + piVar18 = (int *)0xc0000225; } else { - uVar8 = *(uint *)(param_3 + 0x34); - uVar11 = (ulonglong)uVar8; - if (((uVar8 != 0) && - ((uVar11 < (ulonglong)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar8)))) || + uVar6 = *(uint *)(param_3 + 0x34); + uVar14 = (ulonglong)uVar6; + if (((uVar6 != 0) && + ((uVar14 < (ulonglong)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar6)))) || ((uVar5 < *(ushort *)(param_3 + 0x32) || - ((((uVar4 = *(ushort *)(param_3 + 0x32) + uVar8, uVar4 < uVar8 || (uVar5 < uVar4)) || + ((((uVar4 = *(ushort *)(param_3 + 0x32) + uVar6, uVar4 < uVar6 || (uVar5 < uVar4)) || (*(ushort *)(param_3 + 0x30) != 6)) || (*(short *)(param_3 + 0x32) != 8)))))) goto LAB_3; - local_b8 = *(longlong *)((ulonglong)*(uint *)(param_3 + 0x34) + param_3); - } - HsmDbgBreakOnStatus((int)piVar19); - if ((int)piVar19 < 0) { - piVar18 = piVar19; + local_b0 = *(longlong *)((ulonglong)*(uint *)(param_3 + 0x34) + param_3); + } + HsmDbgBreakOnStatus((int)piVar18); + if ((int)piVar18 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x1d; + uVar17 = 0x1d; } else if (param_2 == 4) { - local_a0 = (undefined8 *)0x0; + local_88 = (undefined8 *)0x0; local_70 = local_70 & 0xffffffff00000000; - local_res10 = 0; - local_90 = local_90 & 0xffffffff00000000; - uVar12 = HsmpCheckLegacyFilterAbsence(); - piVar18 = (int *)(uVar12 & 0xffffffff); - HsmDbgBreakOnStatus((int)uVar12); - if ((int)uVar12 < 0) { + local_98 = 0; + local_c0 = 0; + uVar11 = HsmpCheckLegacyFilterAbsence(); + piVar18 = (int *)(uVar11 & 0xffffffff); + HsmDbgBreakOnStatus((int)uVar11); + if ((int)uVar11 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x1e; + uVar17 = 0x1e; } else { uVar5 = HsmiQueryFullFilePath - (*(undefined8 *)(local_b0 + 0x20),uVar11,local_a8,0x101, + (*(undefined8 *)(local_a0 + 0x20),uVar14,local_a8,0x101, (undefined4 *)&local_48); piVar18 = (int *)(ulonglong)uVar5; HsmDbgBreakOnStatus(uVar5); - piVar17 = (int *)0x0; if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x1f; + uVar17 = 0x1f; } else { if ((((((((param_4 < 0x18) || (*(ushort *)(param_3 + 0xe) < 6)) || (uVar5 = *(uint *)(param_3 + 8), uVar5 < 0x40)) || (0x11 < *(ushort *)(param_3 + 0x38))) || - ((uVar8 = *(uint *)(param_3 + 0x3c), uVar8 != 0 && - ((uVar8 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar8)))))) + ((uVar6 = *(uint *)(param_3 + 0x3c), uVar6 != 0 && + ((uVar6 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar6)))))) || (uVar5 < *(ushort *)(param_3 + 0x3a))) || - ((uVar4 = *(ushort *)(param_3 + 0x3a) + uVar8, uVar4 < uVar8 || (uVar5 < uVar4)))) + ((uVar4 = *(ushort *)(param_3 + 0x3a) + uVar6, uVar4 < uVar6 || (uVar5 < uVar4)))) || ((*(ushort *)(param_3 + 0x38) != 10 || (*(short *)(param_3 + 0x3a) != 4)))) { - piVar17 = (int *)0xc0000225; + piVar18 = (int *)0xc0000225; } else { local_70 = CONCAT44(local_70._4_4_, *(undefined4 *)((ulonglong)*(uint *)(param_3 + 0x3c) + param_3)) ; + piVar18 = (int *)0x0; } - HsmDbgBreakOnStatus((int)piVar17); - piVar18 = (int *)0x0; - if ((int)piVar17 < 0) { - piVar18 = piVar17; + HsmDbgBreakOnStatus((int)piVar18); + if ((int)piVar18 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x20; + uVar17 = 0x20; } else { if ((((((param_4 < 0x18) || (*(ushort *)(param_3 + 0xe) < 0xf)) || (uVar5 = *(uint *)(param_3 + 8), uVar5 < 0x88)) || (0x11 < *(ushort *)(param_3 + 0x80))) || - ((uVar8 = *(uint *)(param_3 + 0x84), uVar8 != 0 && - ((uVar8 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar8)))))) + ((uVar6 = *(uint *)(param_3 + 0x84), uVar6 != 0 && + ((uVar6 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar6)))))) || ((uVar5 < *(ushort *)(param_3 + 0x82) || - (((uVar4 = *(ushort *)(param_3 + 0x82) + uVar8, uVar4 < uVar8 || + (((uVar4 = *(ushort *)(param_3 + 0x82) + uVar6, uVar4 < uVar6 || (uVar5 < uVar4)) || ((*(ushort *)(param_3 + 0x80) != 10 || (*(short *)(param_3 + 0x82) != 4))))) ))) { piVar18 = (int *)0xc0000225; } else { - local_90 = CONCAT44(local_90._4_4_, - *(undefined4 *) - ((ulonglong)*(uint *)(param_3 + 0x84) + param_3)); + local_c0 = *(undefined4 *)((ulonglong)*(uint *)(param_3 + 0x84) + param_3); + piVar18 = (int *)0x0; } HsmDbgBreakOnStatus((int)piVar18); if ((int)piVar18 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x21; + uVar17 = 0x21; } else { if (param_4 < 0x18) { - piVar17 = (int *)0xc0000225; + piVar18 = (int *)0xc0000225; } else if (((((*(ushort *)(param_3 + 0xe) < 0xe) || (uVar5 = *(uint *)(param_3 + 8), uVar5 < 0x80)) || (0x11 < *(ushort *)(param_3 + 0x78))) || - ((((uVar8 = *(uint *)(param_3 + 0x7c), uVar8 != 0 && - ((uVar8 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || - (uVar5 < uVar8)))) || (uVar5 < *(ushort *)(param_3 + 0x7a))) || - ((uVar4 = *(ushort *)(param_3 + 0x7a) + uVar8, uVar4 < uVar8 || + ((((uVar6 = *(uint *)(param_3 + 0x7c), uVar6 != 0 && + ((uVar6 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || + (uVar5 < uVar6)))) || (uVar5 < *(ushort *)(param_3 + 0x7a))) || + ((uVar4 = *(ushort *)(param_3 + 0x7a) + uVar6, uVar4 < uVar6 || (uVar5 < uVar4)))))) || ((*(ushort *)(param_3 + 0x78) != 10 || (*(short *)(param_3 + 0x7a) != 4))) ) { - piVar17 = (int *)0xc0000225; + piVar18 = (int *)0xc0000225; } else { - piVar17 = (int *)0x0; - local_res10 = *(undefined4 *)((ulonglong)*(uint *)(param_3 + 0x7c) + param_3); + local_98 = *(undefined4 *)((ulonglong)*(uint *)(param_3 + 0x7c) + param_3); + piVar18 = (int *)0x0; } - HsmDbgBreakOnStatus((int)piVar17); - piVar18 = (int *)0x0; - if ((int)piVar17 < 0) { - piVar18 = piVar17; + HsmDbgBreakOnStatus((int)piVar18); + if ((int)piVar18 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x22; + uVar17 = 0x22; } else { if (((((param_4 < 0x18) || (*(ushort *)(param_3 + 0xe) < 0x17)) || (uVar5 = *(uint *)(param_3 + 8), uVar5 < 200)) || ((0x11 < *(ushort *)(param_3 + 0xc0) || - ((uVar8 = *(uint *)(param_3 + 0xc4), uVar8 != 0 && - ((uVar8 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar8))) + ((uVar6 = *(uint *)(param_3 + 0xc4), uVar6 != 0 && + ((uVar6 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar6))) ))))) || ((uVar5 < *(ushort *)(param_3 + 0xc2) || - (((uVar4 = *(ushort *)(param_3 + 0xc2) + uVar8, uVar4 < uVar8 || + (((uVar4 = *(ushort *)(param_3 + 0xc2) + uVar6, uVar4 < uVar6 || (uVar5 < uVar4)) || ((*(ushort *)(param_3 + 0xc0) != 6 || (*(short *)(param_3 + 0xc2) != 8))))) ))) { piVar18 = (int *)0xc0000225; + uVar14 = 0; } else { - local_88 = *(ulonglong *)((ulonglong)*(uint *)(param_3 + 0xc4) + param_3); + piVar18 = (int *)0x0; + uVar14 = *(ulonglong *)((ulonglong)*(uint *)(param_3 + 0xc4) + param_3); } HsmDbgBreakOnStatus((int)piVar18); - uVar11 = local_88; if ((int)piVar18 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x23; + uVar17 = 0x23; } else { - uVar5 = CldSyncConnectRoot(local_78,param_1,local_88,(undefined2 *)&local_48, - (uint)local_70,local_res10,local_b8, - (longlong *)&local_a0); + uVar11 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + bVar22 = (int)uVar11 != 0; + if (bVar22) { + FltAcquirePushLockExclusiveEx(&DAT_4,0); + } + uVar5 = CldSyncConnectRoot(local_78,param_1,uVar14,(undefined2 *)&local_48, + (uint)local_70,local_98,local_b0, + (longlong *)&local_88); piVar18 = (int *)(ulonglong)uVar5; HsmDbgBreakOnStatus(uVar5); if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x25; + uVar17 = 0x25; } else { FltAcquirePushLockExclusiveEx(param_1 + 0x90,0); - lVar10 = local_b8; - uVar5 = CldiPortInsertSyncRootNoLock(param_1,local_a0,local_b8,uVar11); - uVar14 = 0; + lVar10 = local_b0; + uVar5 = CldiPortInsertSyncRootNoLock(param_1,local_88,local_b0,uVar14); + uVar13 = 0; piVar18 = (int *)(ulonglong)uVar5; FltReleasePushLockEx(param_1 + 0x90); if (-1 < (int)uVar5) { plVar1 = (longlong *)(param_1 + 0x68); - if ((*plVar1 == 0) || (lVar13 = IoGetCurrentProcess(), *plVar1 == lVar13)) + if ((*plVar1 == 0) || (lVar12 = IoGetCurrentProcess(), *plVar1 == lVar12)) { - uVar14 = IoGetCurrentProcess(); - CldCaptureProcessInfo(uVar14,plVar1); + uVar13 = IoGetCurrentProcess(); + CldCaptureProcessInfo(uVar13,plVar1); lVar10 = IoGetCurrentProcess(); HsmOsSetProcessAsSyncProvider(lVar10); *(int *)(param_1 + 0x8c) = *(int *)(param_1 + 0x8c) + 1; - *(undefined4 *)(param_1 + 0x104) = (undefined4)local_90; + *(undefined4 *)(param_1 + 0x104) = local_c0; } else { piVar18 = (int *)0xc000cf18; HsmDbgBreakOnStatus(-0x3fff30e8); - puVar15 = WPP_GLOBAL_Control; + puVar16 = WPP_GLOBAL_Control; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0 && (1 < (byte)WPP_GLOBAL_Control[0x29])))) { - puVar15 = *(undefined **)(WPP_GLOBAL_Control + 0x18); - WPP_SF_qiqDZd(puVar15,uVar14,lVar10,param_1); + puVar16 = *(undefined **)(WPP_GLOBAL_Control + 0x18); + WPP_SF_qiqDZd(puVar16,uVar13,lVar10,param_1); } uVar9 = PsGetCurrentProcessId(); MicrosoftTelemetryAssertTriggeredArgsMsgKM - (puVar15,*(undefined4 *)(param_1 + 0x80),uVar9, + (puVar16,*(undefined4 *)(param_1 + 0x80),uVar9, "ConnectingPortContext\'s SyncProvider is already set"); } goto LAB_0; } - CldSyncDisconnectRootByObject(local_a0,0xc0000002); + CldSyncDisconnectRootByObject(local_88,0xc0000002); if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x26; + uVar17 = 0x26; } } } } } } } } else { if (param_2 != 5) { piVar18 = (int *)0xc0000010; HsmDbgBreakOnStatus(-0x3ffffff0); goto LAB_0; } if (((((param_4 < 0x18) || (*(ushort *)(param_3 + 0xe) < 0x17)) || ((uVar5 = *(uint *)(param_3 + 8), uVar5 < 200 || (0x11 < *(ushort *)(param_3 + 0xc0)) - ))) || ((uVar8 = *(uint *)(param_3 + 0xc4), uVar8 != 0 && - ((uVar8 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar8))))) + ))) || ((uVar6 = *(uint *)(param_3 + 0xc4), uVar6 != 0 && + ((uVar6 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar6))))) ) || (((uVar5 < *(ushort *)(param_3 + 0xc2) || - (((uVar4 = *(ushort *)(param_3 + 0xc2) + uVar8, uVar4 < uVar8 || + (((uVar4 = *(ushort *)(param_3 + 0xc2) + uVar6, uVar4 < uVar6 || (uVar5 < uVar4)) || (*(ushort *)(param_3 + 0xc0) != 6)))) || (*(short *)(param_3 + 0xc2) != 8)))) { piVar18 = (int *)0xc0000225; if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x28; + uVar17 = 0x28; } else { - uVar5 = CldSyncDisconnectRoot - ((longlong)local_78, - *(undefined8 *)((ulonglong)*(uint *)(param_3 + 0xc4) + param_3), - local_b8,&local_90); + uVar13 = *(undefined8 *)((ulonglong)*(uint *)(param_3 + 0xc4) + param_3); + uVar14 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + bVar22 = (int)uVar14 != 0; + if (bVar22) { + FltAcquirePushLockExclusiveEx(&DAT_4,0); + } + uVar5 = CldSyncDisconnectRoot((longlong)local_78,uVar13,local_b0,&local_88); piVar18 = (int *)(ulonglong)uVar5; HsmDbgBreakOnStatus(uVar5); if (-1 < (int)uVar5) { FltAcquirePushLockExclusiveEx(param_1 + 0x90,0); - RtlDeleteElementGenericTableAvl(param_1 + 0x98,&local_b8); + RtlDeleteElementGenericTableAvl(param_1 + 0x98,&local_b0); FltReleasePushLockEx(param_1 + 0x90,0); - piVar17 = (int *)(param_1 + 0x8c); - *piVar17 = *piVar17 + -1; - if (*piVar17 == 0) { + piVar19 = (int *)(param_1 + 0x8c); + *piVar19 = *piVar19 + -1; + if (*piVar19 == 0) { lVar10 = IoGetCurrentProcess(); HsmOsClearProcessAsSyncProvider(lVar10); CldReleaseProcessInfo((undefined8 *)(param_1 + 0x68)); } goto LAB_0; } if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x29; + uVar17 = 0x29; } } } goto LAB_2; } if (param_4 < 0x18) { - piVar17 = (int *)0xc0000225; + piVar18 = (int *)0xc0000225; + uVar5 = uVar6; } else { - if (((((*(ushort *)(param_3 + 0xe) < 4) || (uVar5 = *(uint *)(param_3 + 8), uVar5 < 0x30)) || + if (((((*(ushort *)(param_3 + 0xe) < 4) || (uVar4 = *(uint *)(param_3 + 8), uVar4 < 0x30)) || (0x11 < *(ushort *)(param_3 + 0x28))) || ((uVar8 = *(uint *)(param_3 + 0x2c), uVar8 != 0 && - ((uVar8 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar5 < uVar8)))))) || - ((uVar5 < *(ushort *)(param_3 + 0x2a) || - (((uVar4 = *(ushort *)(param_3 + 0x2a) + uVar8, uVar4 < uVar8 || (uVar5 < uVar4)) || + ((uVar8 < (uint)*(ushort *)(param_3 + 0xe) * 8 + 0x10 || (uVar4 < uVar8)))))) || + ((uVar4 < *(ushort *)(param_3 + 0x2a) || + (((uVar15 = *(ushort *)(param_3 + 0x2a) + uVar8, uVar15 < uVar8 || (uVar4 < uVar15)) || (*(ushort *)(param_3 + 0x28) != 0x11)))))) { - piVar17 = (int *)0xc0000225; - uVar5 = 0; + piVar18 = (int *)0xc0000225; } else { - piVar18 = piVar19; if ((*(uint *)(param_3 + 0x2c) != 0) && (*(ushort *)(param_3 + 0x2a) != 0)) { - piVar18 = (int *)(param_3 + (ulonglong)*(uint *)(param_3 + 0x2c)); - } - piVar17 = piVar19; - piVar19 = piVar18; + piVar19 = (int *)(param_3 + (ulonglong)*(uint *)(param_3 + 0x2c)); + } uVar5 = (uint)*(ushort *)(param_3 + 0x2a); } - if ((int)piVar17 < 0) { - uVar5 = 0; - } - } - HsmDbgBreakOnStatus((int)piVar17); - if ((int)piVar17 < 0) { - piVar18 = piVar17; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x14; + if ((int)piVar18 < 0) { + uVar5 = uVar6; + } + } + HsmDbgBreakOnStatus((int)piVar18); + if ((int)piVar18 < 0) { + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; + uVar17 = 0x14; goto LAB_1; } - uVar11 = Feature_Cldflt_NPCheckingForSyncInfo__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar11 == 0) || (piVar19 != (int *)0x0)) { - iVar21 = 0; - if (((0x17 < uVar5) && (iVar21 = 1, *piVar19 == 0x6e497253)) && - (((*(byte *)(piVar19 + 3) & 2) == 0 || - (iVar6 = RtlComputeCrc32(0,piVar19 + 2,uVar5 - 8), iVar21 = 2, piVar19[1] == iVar6)))) { - uVar8 = piVar19[2]; - iVar21 = 3; - if (uVar8 <= uVar5) { + uVar14 = Feature_Cldflt_NPCheckingForSyncInfo__private_IsEnabledDeviceUsageNoInline(); + iVar20 = 0; + if (((int)uVar14 == 0) || (piVar19 != (int *)0x0)) { + if (((0x17 < uVar5) && (iVar20 = 1, *piVar19 == 0x6e497253)) && + ((iVar20 = 2, (*(byte *)(piVar19 + 3) & 2) == 0 || + (iVar7 = RtlComputeCrc32(0,piVar19 + 2,uVar5 - 8), piVar19[1] == iVar7)))) { + uVar14 = 0; + uVar6 = piVar19[2]; + iVar20 = 3; + if (uVar6 <= uVar5) { uVar2 = *(ushort *)((longlong)piVar19 + 0xe); - uVar11 = 0; - iVar21 = 4; - if ((uVar2 != 0) && (iVar21 = 5, (uint)uVar2 * 8 + 0x10 < uVar8)) { - iVar21 = 0x10000; + iVar20 = 4; + if ((uVar2 != 0) && (iVar20 = 5, (uint)uVar2 * 8 + 0x10 < uVar6)) { + iVar20 = 0x10000; while( true ) { uVar4 = (uint)uVar2; if (8 < uVar2) { uVar4 = 9; } - if (uVar4 <= (uint)uVar11) { - if (((((*(ushort *)((longlong)piVar19 + 0xe) < 8) || (uVar8 < 0x50)) || + if (uVar4 <= (uint)uVar14) { + if (((((*(ushort *)((longlong)piVar19 + 0xe) < 8) || (uVar6 < 0x50)) || (0x11 < *(ushort *)(piVar19 + 0x12))) || ((uVar4 = piVar19[0x13], uVar4 != 0 && ((uVar4 < (uint)*(ushort *)((longlong)piVar19 + 0xe) * 8 + 0x10 || - (uVar8 < uVar4)))))) || - ((uVar8 < *(ushort *)((longlong)piVar19 + 0x4a) || - (((uVar7 = *(ushort *)((longlong)piVar19 + 0x4a) + uVar4, uVar7 < uVar4 || - (uVar8 < uVar7)) || + (uVar6 < uVar4)))))) || + ((uVar6 < *(ushort *)((longlong)piVar19 + 0x4a) || + (((uVar8 = uVar4 + *(ushort *)((longlong)piVar19 + 0x4a), uVar8 < uVar4 || + (uVar6 < uVar8)) || ((*(ushort *)(piVar19 + 0x12) != 0x10 || (*(short *)((longlong)piVar19 + 0x4a) != 0x10)))))))) { - piVar17 = (int *)0xc0000225; + piVar18 = (int *)0xc0000225; } else { - memcpy((void *)(param_1 + 0x108), - (void *)((ulonglong)(uint)piVar19[0x13] + (longlong)piVar19),0x10); - piVar17 = (int *)0x0; + memmove((void *)(param_1 + 0x108), + (void *)((ulonglong)(uint)piVar19[0x13] + (longlong)piVar19),0x10); + piVar18 = (int *)0x0; } - HsmDbgBreakOnStatus((int)piVar17); - if ((int)piVar17 < 0) { - piVar18 = piVar17; + HsmDbgBreakOnStatus((int)piVar18); + if ((int)piVar18 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x17; + uVar17 = 0x17; goto LAB_1; } - uVar5 = HsmCldPersistSyncRootInfo(local_b0,local_a8,piVar19,uVar5); + uVar5 = HsmCldPersistSyncRootInfo(local_a0,local_a8,piVar19,uVar5); piVar18 = (int *)(ulonglong)uVar5; HsmDbgBreakOnStatus(uVar5); if (((-1 < (int)uVar5) || ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control)) || (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_0; - uVar16 = 0x18; - puVar20 = local_a0; + uVar17 = 0x18; goto LAB_2; } - if (((0x11 < *(ushort *)(piVar19 + uVar11 * 2 + 4)) || - ((uVar4 = piVar19[uVar11 * 2 + 5], uVar4 != 0 && (uVar4 < (uint)uVar2 * 8 + 0x10)) - )) || ((uVar8 < uVar4 || - (((uVar3 = *(ushort *)((longlong)piVar19 + uVar11 * 8 + 0x12), - uVar8 < uVar3 || (uVar7 = uVar3 + uVar4, uVar7 < uVar4)) || - (uVar8 < uVar7)))))) break; - iVar21 = iVar21 + 1; - uVar11 = (ulonglong)((uint)uVar11 + 1); + if (((0x11 < *(ushort *)(piVar19 + uVar14 * 2 + 4)) || + ((uVar4 = piVar19[uVar14 * 2 + 5], uVar4 != 0 && (uVar4 < (uint)uVar2 * 8 + 0x10)) + )) || ((uVar6 < uVar4 || + (((uVar3 = *(ushort *)((longlong)piVar19 + uVar14 * 8 + 0x12), + uVar6 < uVar3 || (uVar8 = uVar3 + uVar4, uVar8 < uVar4)) || + (uVar6 < uVar8)))))) break; + iVar20 = iVar20 + 1; + uVar14 = (ulonglong)((uint)uVar14 + 1); } } } } piVar18 = (int *)0xc000000d; HsmDbgBreakOnStatus(-0x3ffffff3); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { WPP_SF_dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x16, - &WPP_cc273c1883333330d0add2efd2d75ac1_Traceguids,iVar21); + &WPP_657987570b5032d9f4f56ca2aaff3274_Traceguids,iVar20); } goto LAB_0; } uVar9 = 0xc000cf0b; - piVar17 = (int *)0xc000cf0b; + piVar19 = (int *)0xc000cf0b; piVar18 = (int *)0xc000cf0b; if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar16 = 0x15; + uVar17 = 0x15; } - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar16, - &WPP_cc273c1883333330d0add2efd2d75ac1_Traceguids,uVar9); - piVar18 = piVar17; + WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar17, + &WPP_657987570b5032d9f4f56ca2aaff3274_Traceguids,uVar9); + piVar18 = piVar19; LAB_0: + uVar14 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar14 != 0) && (bVar22)) { + FltReleasePushLockEx(&DAT_4,0); + } if (lStack_40 != 0) { ExFreePoolWithTag(lStack_40,0x73557348); } - if (local_b0 != 0) { + if (local_a0 != 0) { FltReleaseContext(); } if (local_80 != 0) { FltObjectDereference(); } - if (local_98 != 0) { + if (local_90 != 0) { FltObjectDereference(); } if (local_a8 != 0) { ObfDereferenceObject(); } return piVar18; } ``` ## HsmiCldGetSyncRootInfo ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.62| |i_ratio|0.4| |m_ratio|0.9| |b_ratio|0.62| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|HsmiCldGetSyncRootInfo|HsmiCldGetSyncRootInfo| |fullname|HsmiCldGetSyncRootInfo|HsmiCldGetSyncRootInfo| |refcount|3|3| |`length`|285|228| |`called`|HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfoByFileObject
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_iiqd
_guard_dispatch_icall|HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfoByFileObject
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_qqqd
_guard_dispatch_icall| |calling|HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo|HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo| |paramcount|5|4| |`address`|140052390|14008626c| |`sig`|uint __fastcall HsmiCldGetSyncRootInfo(longlong param_1, longlong param_2, undefined8 param_3, longlong * param_4, char * param_5)|uint __fastcall HsmiCldGetSyncRootInfo(longlong param_1, longlong param_2, undefined8 param_3, longlong * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmiCldGetSyncRootInfo Called Diff ```diff --- HsmiCldGetSyncRootInfo called +++ HsmiCldGetSyncRootInfo called @@ -4 +4 @@ -WPP_SF_iiqd +WPP_SF_qqqd ``` ### HsmiCldGetSyncRootInfo Diff ```diff --- HsmiCldGetSyncRootInfo +++ HsmiCldGetSyncRootInfo @@ -1,43 +1,37 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -uint HsmiCldGetSyncRootInfo - (longlong param_1,longlong param_2,undefined8 param_3,longlong *param_4,char *param_5 - ) +uint HsmiCldGetSyncRootInfo(longlong param_1,longlong param_2,undefined8 param_3,longlong *param_4) { uint uVar1; longlong lVar2; - char local_res10 [16]; - longlong local_res20; + longlong local_res10; uVar1 = 0; - local_res20 = 0; + local_res10 = 0; *param_4 = 0; - local_res10[0] = '\0'; - *param_5 = '\0'; - if ((param_2 == 0) || (local_res20 = (*DAT_0)(), local_res20 == 0)) { - uVar1 = HsmiCldGetSyncRootInfoByFileObject(param_1,param_3,&local_res20,local_res10); + if ((param_2 == 0) || (local_res10 = (*DAT_0)(), local_res10 == 0)) { + uVar1 = HsmiCldGetSyncRootInfoByFileObject(param_1,param_3,&local_res10); HsmDbgBreakOnStatus(uVar1); if ((int)uVar1 < 0) { - lVar2 = local_res20; + lVar2 = local_res10; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x29]) ) { - WPP_SF_iiqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x20, - &WPP_4de51bc6694e318c100a6ed9dc947bcd_Traceguids,param_1); - lVar2 = local_res20; + WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x26, + &WPP_ba8b7613af1330e4e0a02aa60b8decc8_Traceguids,param_1); + lVar2 = local_res10; } goto LAB_1; } } - *param_4 = local_res20; - *param_5 = local_res10[0]; + *param_4 = local_res10; lVar2 = 0; LAB_1: - if ((local_res10[0] != '\0') && (lVar2 != 0)) { - ExFreePoolWithTag(lVar2,0x69537348); + if (lVar2 != 0) { + ExFreePoolWithTag(lVar2,0); } return uVar1; } ``` ## HsmpCldGetSyncRootStandardInfo ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.25| |i_ratio|0.17| |m_ratio|1.0| |b_ratio|0.21| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|HsmpCldGetSyncRootStandardInfo|HsmpCldGetSyncRootStandardInfo| |fullname|HsmpCldGetSyncRootStandardInfo|HsmpCldGetSyncRootStandardInfo| |refcount|3|3| |`length`|2150|2073| |`called`|HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfo
HsmpCldGetSyncRootFileIdEx
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_iiqd
_guard_dispatch_icall
memcpy|Feature_1074201912__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoDeprecated
HsmpCldGetSyncRootFileIdEx
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_qqqd
_guard_dispatch_icall
memmove| |calling|HsmFltProcessHSMControl
HsmiIsUnsupportedLogfilePlaceholder|HsmFltProcessHSMControl
HsmiIsUnsupportedLogfilePlaceholder| |paramcount|6|6| |`address`|1400782cc|1400864a8| |sig|uint __fastcall HsmpCldGetSyncRootStandardInfo(longlong param_1, longlong param_2, ulonglong param_3, ulonglong * param_4, uint param_5, uint * param_6)|uint __fastcall HsmpCldGetSyncRootStandardInfo(longlong param_1, longlong param_2, ulonglong param_3, ulonglong * param_4, uint param_5, uint * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmpCldGetSyncRootStandardInfo Called Diff ```diff --- HsmpCldGetSyncRootStandardInfo called +++ HsmpCldGetSyncRootStandardInfo called @@ -0,0 +1 @@ +Feature_1074201912__private_IsEnabledDeviceUsageNoInline @@ -2,0 +4 @@ +HsmiCldGetSyncRootInfoDeprecated @@ -5 +7 @@ -WPP_SF_iiqd +WPP_SF_qqqd @@ -7 +9 @@ -memcpy +memmove ``` ### HsmpCldGetSyncRootStandardInfo Diff ```diff --- HsmpCldGetSyncRootStandardInfo +++ HsmpCldGetSyncRootStandardInfo @@ -1,279 +1,298 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ uint HsmpCldGetSyncRootStandardInfo (longlong param_1,longlong param_2,ulonglong param_3,ulonglong *param_4,uint param_5, uint *param_6) { ushort uVar1; uint uVar2; - ulonglong uVar3; - uint uVar4; - undefined4 uVar5; - uint uVar6; + uint uVar3; + undefined4 uVar4; + uint uVar5; + ulonglong uVar6; uint uVar7; uint uVar8; - undefined2 uVar9; - void *pvVar10; - ulonglong uVar11; - uint uVar12; + uint uVar9; + uint uVar10; + void *pvVar11; + undefined2 uVar12; + undefined8 uVar13; size_t _Size; - void *pvVar13; + size_t _Size_00; void *pvVar14; - void *pvVar15; + ulonglong uVar15; void *pvVar16; uint local_98; uint local_94; void *local_90; char local_84 [4]; void *local_80; - uint local_78; - undefined4 local_74; + undefined4 local_78 [2]; ulonglong local_70; - void *local_68; - undefined4 local_60 [2]; + undefined4 local_68 [2]; + void *local_60; void *local_58; undefined4 local_50; undefined4 local_4c; ulonglong local_48 [2]; local_4c = 0xfffffff; - local_74 = 1; - pvVar10 = (void *)0x0; + pvVar11 = (void *)0x0; + uVar5 = 0; + local_78[0] = 1; local_70 = 0; - uVar12 = 0; local_84[0] = '\0'; - pvVar15 = (void *)0x0; local_48[0] = 0; - pvVar13 = (void *)0x0; + uVar10 = 0; + pvVar16 = (void *)0x0; local_90 = (void *)0x0; - local_60[0] = 3; - uVar8 = 0; + local_68[0] = 3; + uVar15 = 0; local_50 = 3; + pvVar14 = (void *)0x0; local_98 = 0; + uVar7 = 0; + uVar9 = 0; local_80 = (void *)0x0; local_94 = 0; - uVar4 = HsmiCldGetSyncRootInfo(param_1,param_2,param_3,(longlong *)&local_70,local_84); - HsmDbgBreakOnStatus(uVar4); - uVar3 = local_70; - if ((int)uVar4 < 0) { - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((byte)((byte)local_74 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 5)) goto LAB_0; - uVar9 = 0x34; + uVar6 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 == 0) { + uVar3 = HsmiCldGetSyncRootInfoDeprecated(param_1,param_2,param_3,(longlong *)&local_70,local_84) + ; } else { - uVar4 = HsmpCldGetSyncRootFileIdEx(param_1,param_2,param_3,local_48,(int *)0x0,(int *)0x0); - HsmDbgBreakOnStatus(uVar4); - if (-1 < (int)uVar4) { - pvVar14 = pvVar10; - if (uVar3 == 0) { -LAB_1: - local_94 = 0; - local_90 = (void *)0x0; + uVar3 = HsmiCldGetSyncRootInfo(param_1,param_2,param_3,(longlong *)&local_70); + } + HsmDbgBreakOnStatus(uVar3); + uVar6 = local_70; + if ((int)uVar3 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((byte)((byte)local_78[0] & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) && + (4 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar12 = 0x3a; +LAB_0: + WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar12, + &WPP_ba8b7613af1330e4e0a02aa60b8decc8_Traceguids,param_1); + } + } + else { + uVar3 = HsmpCldGetSyncRootFileIdEx(param_1,param_2,param_3,local_48,(int *)0x0,(int *)0x0); + HsmDbgBreakOnStatus(uVar3); + if ((int)uVar3 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((byte)((byte)local_78[0] & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar12 = 0x3b; + goto LAB_0; + } + } + else { + if (uVar6 == 0) { + pvVar16 = (void *)0x0; } else { - uVar2 = *(uint *)(uVar3 + 8); + uVar2 = *(uint *)(uVar6 + 8); if (uVar2 < 0x18) { local_80 = (void *)0x0; - goto LAB_1; - } - uVar1 = *(ushort *)(uVar3 + 0xe); - uVar7 = (uint)uVar1; - pvVar16 = pvVar15; - uVar12 = 0; - if (uVar1 != 0) { - uVar12 = 0; - if (((*(ushort *)(uVar3 + 0x10) < 0x12) && - (((uVar6 = *(uint *)(uVar3 + 0x14), pvVar14 = pvVar13, uVar12 = uVar8, uVar6 == 0 || - ((uVar7 * 8 + 0x10 <= uVar6 && (uVar6 <= uVar2)))) && - (*(ushort *)(uVar3 + 0x12) <= uVar2)))) && - (((uVar8 = *(ushort *)(uVar3 + 0x12) + uVar6, uVar8 <= uVar2 && - (*(ushort *)(uVar3 + 0x10) == 0x11)) && (uVar6 <= uVar8)))) { - pvVar14 = pvVar10; - if ((*(uint *)(uVar3 + 0x14) != 0) && (pvVar14 = pvVar13, *(short *)(uVar3 + 0x12) != 0) - ) { - pvVar14 = (void *)(uVar3 + *(uint *)(uVar3 + 0x14)); + local_94 = 0; + pvVar14 = pvVar11; + uVar9 = 0; + } + else { + uVar1 = *(ushort *)(uVar6 + 0xe); + uVar9 = (uint)uVar1; + pvVar16 = pvVar11; + if (uVar1 != 0) { + uVar5 = 0; + if (((*(ushort *)(uVar6 + 0x10) < 0x12) && + (((uVar8 = *(uint *)(uVar6 + 0x14), pvVar16 = pvVar14, uVar5 = uVar7, uVar8 == 0 || + ((uVar9 * 8 + 0x10 <= uVar8 && (uVar8 <= uVar2)))) && + (*(ushort *)(uVar6 + 0x12) <= uVar2)))) && + (((uVar7 = *(ushort *)(uVar6 + 0x12) + uVar8, uVar8 <= uVar7 && (uVar7 <= uVar2)) && + (*(ushort *)(uVar6 + 0x10) == 0x11)))) { + pvVar16 = pvVar11; + if ((*(uint *)(uVar6 + 0x14) != 0) && + (pvVar16 = pvVar14, *(short *)(uVar6 + 0x12) != 0)) { + pvVar16 = (void *)(uVar6 + *(uint *)(uVar6 + 0x14)); + } + uVar5 = (uint)*(ushort *)(uVar6 + 0x12); } - uVar12 = (uint)*(ushort *)(uVar3 + 0x12); - } - pvVar16 = pvVar10; - if ((ushort)local_74 < uVar1) { - if ((((0x1f < uVar2) && (pvVar10 = pvVar15, *(ushort *)(uVar3 + 0x18) < 0x12)) && - ((uVar8 = *(uint *)(uVar3 + 0x1c), uVar8 == 0 || - ((uVar7 * 8 + 0x10 <= uVar8 && (uVar8 <= uVar2)))))) && - ((*(ushort *)(uVar3 + 0x1a) <= uVar2 && - (((uVar6 = *(ushort *)(uVar3 + 0x1a) + uVar8, uVar6 <= uVar2 && - (*(ushort *)(uVar3 + 0x18) == 0x11)) && (uVar8 <= uVar6)))))) { - if ((*(uint *)(uVar3 + 0x1c) == 0) || (*(short *)(uVar3 + 0x1a) == 0)) { - local_90 = (void *)0x0; + if ((ushort)local_78[0] < uVar1) { + if ((((0x1f < uVar2) && (*(ushort *)(uVar6 + 0x18) < 0x12)) && + ((uVar7 = *(uint *)(uVar6 + 0x1c), uVar7 == 0 || + ((uVar9 * 8 + 0x10 <= uVar7 && (uVar7 <= uVar2)))))) && + ((*(ushort *)(uVar6 + 0x1a) <= uVar2 && + (((uVar8 = *(ushort *)(uVar6 + 0x1a) + uVar7, uVar7 <= uVar8 && (uVar8 <= uVar2)) + && (*(ushort *)(uVar6 + 0x18) == 0x11)))))) { + if ((*(uint *)(uVar6 + 0x1c) == 0) || (*(short *)(uVar6 + 0x1a) == 0)) { + local_90 = (void *)0x0; + } + else { + local_90 = (void *)(*(uint *)(uVar6 + 0x1c) + uVar6); + } + uVar10 = (uint)*(ushort *)(uVar6 + 0x1a); + local_98 = (uint)*(ushort *)(uVar6 + 0x1a); } - else { - local_90 = (void *)(*(uint *)(uVar3 + 0x1c) + uVar3); + if ((((2 < uVar1) && (0x27 < uVar2)) && (*(ushort *)(uVar6 + 0x20) < 0x12)) && + (((uVar7 = *(uint *)(uVar6 + 0x24), uVar7 == 0 || + ((uVar9 * 8 + 0x10 <= uVar7 && (uVar7 <= uVar2)))) && + ((*(ushort *)(uVar6 + 0x22) <= uVar2 && + (((uVar9 = *(ushort *)(uVar6 + 0x22) + uVar7, uVar7 <= uVar9 && (uVar9 <= uVar2)) + && (local_98 = uVar10, *(ushort *)(uVar6 + 0x20) == 0x11)))))))) { + if ((*(uint *)(uVar6 + 0x24) == 0) || (*(short *)(uVar6 + 0x22) == 0)) { + local_80 = (void *)0x0; + } + else { + local_80 = (void *)(*(uint *)(uVar6 + 0x24) + uVar6); + } + local_94 = (uint)*(ushort *)(uVar6 + 0x22); } - pvVar10 = (void *)(ulonglong)*(ushort *)(uVar3 + 0x1a); - local_98 = (uint)*(ushort *)(uVar3 + 0x1a); } - pvVar16 = pvVar10; - if ((((0x27 < uVar2) && (2 < uVar1)) && (*(ushort *)(uVar3 + 0x20) < 0x12)) && - (((uVar8 = *(uint *)(uVar3 + 0x24), uVar8 == 0 || - ((uVar7 * 8 + 0x10 <= uVar8 && (uVar8 <= uVar2)))) && - ((*(ushort *)(uVar3 + 0x22) <= uVar2 && - (((uVar7 = *(ushort *)(uVar3 + 0x22) + uVar8, uVar7 <= uVar2 && (uVar8 <= uVar7)) - && (local_98 = (uint)pvVar10, *(ushort *)(uVar3 + 0x20) == 0x11)))))))) { - if ((*(uint *)(uVar3 + 0x24) == 0) || (*(short *)(uVar3 + 0x22) == 0)) { - local_80 = (void *)0x0; - } - else { - local_80 = (void *)(*(uint *)(uVar3 + 0x24) + uVar3); - } - local_94 = (uint)*(ushort *)(uVar3 + 0x22); - } - } - } - local_70 = CONCAT44(local_70._4_4_,local_94); - local_58 = local_80; - uVar8 = (uint)pvVar16; - if ((((ushort)local_60[0] < *(ushort *)(uVar3 + 0xe)) && (0x2f < uVar2)) && - ((*(ushort *)(uVar3 + 0x28) < 0x12 && - ((((uVar7 = *(uint *)(uVar3 + 0x2c), uVar7 == 0 || - (((uint)*(ushort *)(uVar3 + 0xe) * 8 + 0x10 <= uVar7 && (uVar7 <= uVar2)))) && - (*(ushort *)(uVar3 + 0x2a) <= uVar2)) && - ((((uVar6 = uVar7 + *(ushort *)(uVar3 + 0x2a), uVar6 <= uVar2 && (uVar7 <= uVar6)) && - (local_98 = uVar8, *(ushort *)(uVar3 + 0x28) == 10)) && - (*(short *)(uVar3 + 0x2a) == 4)))))))) { - local_68 = local_90; - memcpy(local_60,(void *)(*(uint *)(uVar3 + 0x2c) + uVar3),4); - local_94 = (uint)local_70; - local_90 = local_68; - local_80 = local_58; - } - local_68 = local_90; - local_78 = local_94; - local_58 = local_80; - if (((((4 < *(ushort *)(uVar3 + 0xe)) && (0x37 < uVar2)) && - (*(ushort *)(uVar3 + 0x30) < 0x12)) && - ((uVar7 = *(uint *)(uVar3 + 0x34), uVar7 == 0 || - (((uint)*(ushort *)(uVar3 + 0xe) * 8 + 0x10 <= uVar7 && (uVar7 <= uVar2)))))) && - ((*(ushort *)(uVar3 + 0x32) <= uVar2 && - ((((uVar6 = *(ushort *)(uVar3 + 0x32) + uVar7, uVar6 <= uVar2 && (uVar7 <= uVar6)) && - (local_98 = uVar8, *(ushort *)(uVar3 + 0x30) == 10)) && - (*(short *)(uVar3 + 0x32) == 4)))))) { - memcpy(&local_50,(void *)(*(uint *)(uVar3 + 0x34) + uVar3),4); - local_90 = local_68; - local_80 = local_58; - } - local_70._0_4_ = local_78; - local_68 = local_80; - local_58 = local_90; - local_94 = local_78; - if (((5 < *(ushort *)(uVar3 + 0xe)) && (0x3f < uVar2)) && - ((((*(ushort *)(uVar3 + 0x38) < 0x12 && - ((uVar7 = *(uint *)(uVar3 + 0x3c), uVar7 == 0 || - (((uint)*(ushort *)(uVar3 + 0xe) * 8 + 0x10 <= uVar7 && (uVar7 <= uVar2)))))) && - (*(ushort *)(uVar3 + 0x3a) <= uVar2)) && - ((((uVar6 = *(ushort *)(uVar3 + 0x3a) + uVar7, uVar6 <= uVar2 && (uVar7 <= uVar6)) && - (local_98 = uVar8, *(ushort *)(uVar3 + 0x38) == 10)) && - (*(short *)(uVar3 + 0x3a) == 4)))))) { - memcpy(&local_4c,(void *)(*(uint *)(uVar3 + 0x3c) + uVar3),4); - local_80 = local_68; - local_94 = (uint)local_70; - local_90 = local_58; - } - local_68 = local_80; - local_58 = local_90; - local_70 = CONCAT44(local_70._4_4_,local_98); - if ((((*(ushort *)(uVar3 + 0xe) < 7) || (uVar2 < 0x48)) || - ((0x11 < *(ushort *)(uVar3 + 0x40) || - (((uVar8 = *(uint *)(uVar3 + 0x44), uVar8 != 0 && - ((uVar8 < (uint)*(ushort *)(uVar3 + 0xe) * 8 + 0x10 || (uVar2 < uVar8)))) || - (uVar2 < *(ushort *)(uVar3 + 0x42))))))) || - ((((uVar7 = *(ushort *)(uVar3 + 0x42) + uVar8, uVar2 < uVar7 || (uVar7 < uVar8)) || - (*(ushort *)(uVar3 + 0x40) != 10)) || (*(short *)(uVar3 + 0x42) != 4)))) { - pvVar10 = (void *)(ulonglong)local_98; - } - else { - memcpy(&local_74,(void *)(*(uint *)(uVar3 + 0x44) + uVar3),4); - local_80 = local_68; - pvVar10 = (void *)(local_70 & 0xffffffff); - local_90 = local_58; + } + local_58 = local_80; + local_70._0_4_ = local_98; + local_60 = local_90; + if ((((ushort)local_68[0] < *(ushort *)(uVar6 + 0xe)) && (0x2f < uVar2)) && + ((*(ushort *)(uVar6 + 0x28) < 0x12 && + ((((uVar9 = *(uint *)(uVar6 + 0x2c), uVar9 == 0 || + (((uint)*(ushort *)(uVar6 + 0xe) * 8 + 0x10 <= uVar9 && (uVar9 <= uVar2)))) && + (*(ushort *)(uVar6 + 0x2a) <= uVar2)) && + ((((uVar10 = *(ushort *)(uVar6 + 0x2a) + uVar9, uVar9 <= uVar10 && (uVar10 <= uVar2)) + && (*(ushort *)(uVar6 + 0x28) == 10)) && (*(short *)(uVar6 + 0x2a) == 4)))))))) { + memmove(local_68,(void *)(*(uint *)(uVar6 + 0x2c) + uVar6),4); + local_90 = local_60; + local_80 = local_58; + local_98 = (uint)local_70; + } + local_60 = local_80; + local_70._0_4_ = local_98; + local_58 = local_90; + if (((((4 < *(ushort *)(uVar6 + 0xe)) && (0x37 < uVar2)) && + (*(ushort *)(uVar6 + 0x30) < 0x12)) && + ((uVar9 = *(uint *)(uVar6 + 0x34), uVar9 == 0 || + (((uint)*(ushort *)(uVar6 + 0xe) * 8 + 0x10 <= uVar9 && (uVar9 <= uVar2)))))) && + ((*(ushort *)(uVar6 + 0x32) <= uVar2 && + ((((uVar10 = *(ushort *)(uVar6 + 0x32) + uVar9, uVar9 <= uVar10 && (uVar10 <= uVar2)) + && (*(ushort *)(uVar6 + 0x30) == 10)) && (*(short *)(uVar6 + 0x32) == 4)))))) { + memmove(&local_50,(void *)(*(uint *)(uVar6 + 0x34) + uVar6),4); + local_90 = local_58; + local_80 = local_60; + local_98 = (uint)local_70; + } + local_60 = local_80; + local_70._0_4_ = local_98; + local_58 = local_90; + if (((5 < *(ushort *)(uVar6 + 0xe)) && (0x3f < uVar2)) && + ((((*(ushort *)(uVar6 + 0x38) < 0x12 && + ((uVar9 = *(uint *)(uVar6 + 0x3c), uVar9 == 0 || + (((uint)*(ushort *)(uVar6 + 0xe) * 8 + 0x10 <= uVar9 && (uVar9 <= uVar2)))))) && + (*(ushort *)(uVar6 + 0x3a) <= uVar2)) && + ((((uVar10 = *(ushort *)(uVar6 + 0x3a) + uVar9, uVar9 <= uVar10 && (uVar10 <= uVar2)) + && (*(ushort *)(uVar6 + 0x38) == 10)) && (*(short *)(uVar6 + 0x3a) == 4)))))) { + memmove(&local_4c,(void *)(*(uint *)(uVar6 + 0x3c) + uVar6),4); + local_90 = local_58; + local_80 = local_60; + local_98 = (uint)local_70; + } + local_60 = local_80; + local_70 = CONCAT44(local_70._4_4_,local_98); + local_58 = local_90; + pvVar14 = pvVar16; + uVar9 = uVar5; + if ((((*(ushort *)(uVar6 + 0xe) < 7) || (uVar2 < 0x48)) || + ((0x11 < *(ushort *)(uVar6 + 0x40) || + (((uVar5 = *(uint *)(uVar6 + 0x44), uVar5 != 0 && + ((uVar5 < (uint)*(ushort *)(uVar6 + 0xe) * 8 + 0x10 || (uVar2 < uVar5)))) || + (uVar2 < *(ushort *)(uVar6 + 0x42))))))) || + ((((uVar10 = *(ushort *)(uVar6 + 0x42) + uVar5, uVar10 < uVar5 || (uVar2 < uVar10)) || + (*(ushort *)(uVar6 + 0x40) != 10)) || (*(short *)(uVar6 + 0x42) != 4)))) { + uVar15 = (ulonglong)local_98; + pvVar16 = local_90; + } + else { + memmove(local_78,(void *)(*(uint *)(uVar6 + 0x44) + uVar6),4); + uVar15 = local_70 & 0xffffffff; + local_80 = local_60; + pvVar16 = local_58; + } } } if (7 < param_5) { *param_4 = local_48[0]; } if (0xb < param_5) { - *(undefined4 *)(param_4 + 1) = local_60[0]; + *(undefined4 *)(param_4 + 1) = local_68[0]; } if (0xf < param_5) { *(undefined4 *)((longlong)param_4 + 0xc) = local_50; } if (0x13 < param_5) { *(undefined4 *)(param_4 + 2) = local_4c; } if (0x17 < param_5) { - *(undefined4 *)((longlong)param_4 + 0x14) = local_74; + *(undefined4 *)((longlong)param_4 + 0x14) = local_78[0]; } if ((0x1b < param_5) && (param_2 != 0)) { - uVar5 = (*DAT_2)(*(undefined8 *)(*(longlong *)(param_2 + 0x10) + 8)); - *(undefined4 *)(param_4 + 3) = uVar5; + uVar4 = (*DAT_1)(*(undefined8 *)(*(longlong *)(param_2 + 0x10) + 8)); + *(undefined4 *)(param_4 + 3) = uVar4; } _Size = 0x200; - if ((local_90 != (void *)0x0) && (0x21b < param_5)) { - pvVar13 = (void *)0x200; - if ((uint)pvVar10 < 0x201) { - pvVar13 = pvVar10; - } - memcpy((void *)((longlong)param_4 + 0x1c),local_90,(size_t)pvVar13); - if (0x1fe < (uint)pvVar10) { - pvVar10 = (void *)0x1fe; - } - *(undefined2 *)((longlong)param_4 + ((ulonglong)pvVar10 & 0xfffffffffffffffe) + 0x1c) = 0; + if ((pvVar16 != (void *)0x0) && (0x21b < param_5)) { + _Size_00 = 0x200; + if ((uint)uVar15 < 0x201) { + _Size_00 = uVar15; + } + memmove((void *)((longlong)param_4 + 0x1c),pvVar16,_Size_00); + if (0x1fe < (uint)uVar15) { + uVar15 = 0x1fe; + } + *(undefined2 *)((longlong)param_4 + (uVar15 & 0xfffffffffffffffe) + 0x1c) = 0; } if ((local_80 != (void *)0x0) && (0x41b < param_5)) { - uVar11 = (ulonglong)local_94; + uVar15 = (ulonglong)local_94; if (local_94 < 0x201) { _Size = (size_t)local_94; } - memcpy((void *)((longlong)param_4 + 0x21c),local_80,_Size); + memmove((void *)((longlong)param_4 + 0x21c),local_80,_Size); if (0x1fe < local_94) { - uVar11 = 0x1fe; - } - *(undefined2 *)((longlong)param_4 + (uVar11 & 0xfffffffffffffffe) + 0x21c) = 0; + uVar15 = 0x1fe; + } + *(undefined2 *)((longlong)param_4 + (uVar15 & 0xfffffffffffffffe) + 0x21c) = 0; } if (0x41f < param_5) { - *(uint *)((longlong)param_4 + 0x41c) = uVar12; + *(uint *)((longlong)param_4 + 0x41c) = uVar9; } if ((pvVar14 != (void *)0x0) && (0x420 < (int)param_5)) { - uVar8 = param_5 - 0x420; - if (uVar12 < param_5 - 0x420) { - uVar8 = uVar12; - } - memcpy(param_4 + 0x84,pvVar14,(ulonglong)uVar8); - } - uVar12 = uVar12 + 0x420; - goto LAB_0; - } - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((byte)((byte)local_74 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar9 = 0x35; - } - WPP_SF_iiqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar9, - &WPP_4de51bc6694e318c100a6ed9dc947bcd_Traceguids,param_1); -LAB_0: - if ((local_84[0] != '\0') && (uVar3 != 0)) { - ExFreePoolWithTag(uVar3,0x69537348); - } - if (-1 < (int)uVar4) { - if (param_5 < uVar12) { - uVar4 = 0x80000005; + uVar5 = param_5 - 0x420; + if (uVar9 < param_5 - 0x420) { + uVar5 = uVar9; + } + memmove(param_4 + 0x84,pvVar14,(ulonglong)uVar5); + } + uVar10 = uVar9 + 0x420; + } + } + uVar15 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar15 == 0) { + if ((local_84[0] == '\0') || (uVar6 == 0)) goto LAB_2; + uVar13 = 0x69537348; + } + else { + if (uVar6 == 0) goto LAB_2; + uVar13 = 0; + } + ExFreePoolWithTag(uVar6,uVar13); +LAB_2: + if (-1 < (int)uVar3) { + if (param_5 < uVar10) { + uVar3 = 0x80000005; } if (param_6 != (uint *)0x0) { - *param_6 = uVar12; - } - } - return uVar4; + *param_6 = uVar10; + } + } + return uVar3; } ``` ## HsmiCldGetSyncRootInfoByFileObject ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.78| |i_ratio|0.4| |m_ratio|0.95| |b_ratio|0.68| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|HsmiCldGetSyncRootInfoByFileObject|HsmiCldGetSyncRootInfoByFileObject| |fullname|HsmiCldGetSyncRootInfoByFileObject|HsmiCldGetSyncRootInfoByFileObject| |refcount|2|2| |`length`|371|327| |`called`|HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfoByPath
HsmiQueryFullFilePath
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_id
WPP_SF_iid
_guard_dispatch_icall|HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfoByPath
HsmiQueryFullFilePath
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_id
WPP_SF_qid
_guard_dispatch_icall| |calling|HsmiCldGetSyncRootInfo|HsmiCldGetSyncRootInfo| |paramcount|4|3| |`address`|14005b7d8|140086358| |`sig`|uint __fastcall HsmiCldGetSyncRootInfoByFileObject(longlong param_1, undefined8 param_2, longlong * param_3, undefined1 * param_4)|uint __fastcall HsmiCldGetSyncRootInfoByFileObject(longlong param_1, undefined8 param_2, longlong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmiCldGetSyncRootInfoByFileObject Called Diff ```diff --- HsmiCldGetSyncRootInfoByFileObject called +++ HsmiCldGetSyncRootInfoByFileObject called @@ -6 +6 @@ -WPP_SF_iid +WPP_SF_qid ``` ### HsmiCldGetSyncRootInfoByFileObject Diff ```diff --- HsmiCldGetSyncRootInfoByFileObject +++ HsmiCldGetSyncRootInfoByFileObject @@ -1,55 +1,48 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -uint HsmiCldGetSyncRootInfoByFileObject - (longlong param_1,undefined8 param_2,longlong *param_3,undefined1 *param_4) +uint HsmiCldGetSyncRootInfoByFileObject(longlong param_1,undefined8 param_2,longlong *param_3) { uint uVar1; longlong lVar2; ushort local_18 [4]; longlong lStack_10; *param_3 = 0; - *param_4 = 0; local_18[0] = 0; local_18[1] = 0; local_18[2] = 0; local_18[3] = 0; lStack_10 = 0; uVar1 = HsmiQueryFullFilePath (*(undefined8 *)(param_1 + 0x20),param_2,param_2,0x101,(undefined4 *)local_18); HsmDbgBreakOnStatus(uVar1); if ((int)uVar1 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_iid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1b, - &WPP_4de51bc6694e318c100a6ed9dc947bcd_Traceguids,param_1); + WPP_SF_qid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1e, + &WPP_ba8b7613af1330e4e0a02aa60b8decc8_Traceguids,param_1); } } else { lVar2 = (*DAT_0)(*(undefined8 *)(param_1 + 0x10),local_18); *param_3 = lVar2; if (lVar2 == 0) { uVar1 = HsmiCldGetSyncRootInfoByPath(param_1,local_18,param_3); HsmDbgBreakOnStatus(uVar1); - if ((int)uVar1 < 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && - (4 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1d, - &WPP_4de51bc6694e318c100a6ed9dc947bcd_Traceguids,param_1); - } - } - else { - *param_4 = param_3 != (longlong *)0x0; + if (((((int)uVar1 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x29]) + ) { + WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x20, + &WPP_ba8b7613af1330e4e0a02aa60b8decc8_Traceguids,param_1); } } } if (lStack_10 != 0) { ExFreePoolWithTag(lStack_10,0x73557348); } return uVar1; } ``` ## CldSyncCleanup ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.55| |i_ratio|0.28| |m_ratio|0.89| |b_ratio|0.67| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|CldSyncCleanup|CldSyncCleanup| |fullname|CldSyncCleanup|CldSyncCleanup| |refcount|2|2| |`length`|404|508| |`called`|CldPortUnlinkSyncRoot
CldSyncDisconnectRootByObject
FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltReleasePushLockEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlEnumerateGenericTableWithoutSplayingAvl
NTOSKRNL.EXE::RtlNextUnicodePrefix
NTOSKRNL.EXE::RtlNumberGenericTableElementsAvl
NTOSKRNL.EXE::RtlRemoveUnicodePrefix|CldSyncDisconnectRootByObject
FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltReleasePushLockEx
Feature_1074201912__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlEnumerateGenericTableWithoutSplayingAvl
NTOSKRNL.EXE::RtlNextUnicodePrefix
NTOSKRNL.EXE::RtlNumberGenericTableElementsAvl
NTOSKRNL.EXE::RtlRemoveUnicodePrefix| |calling|CldHsmDeleteInstanceContext|CldHsmDeleteInstanceContext| |paramcount|1|1| |`address`|14007fdf8|1400818b8| |sig|undefined __fastcall CldSyncCleanup(longlong param_1)|undefined __fastcall CldSyncCleanup(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldSyncCleanup Called Diff ```diff --- CldSyncCleanup called +++ CldSyncCleanup called @@ -1 +0,0 @@ -CldPortUnlinkSyncRoot @@ -4,0 +4 @@ +Feature_1074201912__private_IsEnabledDeviceUsageNoInline ``` ### CldSyncCleanup Diff ```diff --- CldSyncCleanup +++ CldSyncCleanup @@ -1,45 +1,63 @@ void CldSyncCleanup(longlong param_1) { undefined8 *puVar1; - int iVar2; - longlong lVar3; - longlong lVar4; + longlong lVar2; + int iVar3; + ulonglong uVar4; + longlong lVar5; + longlong lVar6; undefined8 local_res8; + undefined8 local_res10; + uVar4 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 != 0) { + FltAcquirePushLockExclusiveEx(&DAT_0,0); + } FltAcquirePushLockExclusiveEx(param_1 + 8,0); - while (lVar3 = RtlNextUnicodePrefix(param_1 + 0x78,1), lVar3 != 0) { - RtlRemoveUnicodePrefix(param_1 + 0x78,lVar3); - ExFreePoolWithTag(lVar3,0x65707343); + while( true ) { + lVar5 = RtlNextUnicodePrefix(param_1 + 0x78,1); + if (lVar5 == 0) break; + RtlRemoveUnicodePrefix(param_1 + 0x78,lVar5); + ExFreePoolWithTag(lVar5,0x65707343); } - lVar3 = param_1 + 0x10; - iVar2 = RtlNumberGenericTableElementsAvl(lVar3); - while (iVar2 != 0) { + lVar5 = param_1 + 0x10; + while( true ) { + iVar3 = RtlNumberGenericTableElementsAvl(lVar5); + if (iVar3 == 0) break; local_res8 = 0; - lVar4 = RtlEnumerateGenericTableWithoutSplayingAvl(lVar3,&local_res8); - puVar1 = *(undefined8 **)(lVar4 + 8); - RtlDeleteElementGenericTableAvl(lVar3,puVar1 + 3); + lVar6 = RtlEnumerateGenericTableWithoutSplayingAvl(lVar5,&local_res8); + puVar1 = *(undefined8 **)(lVar6 + 8); + RtlDeleteElementGenericTableAvl(lVar5,puVar1 + 3); if (puVar1[0xc] != 0) { - CldPortUnlinkSyncRoot(puVar1[0xc],*puVar1); + lVar2 = puVar1[0xc]; + local_res10 = *puVar1; + lVar6 = lVar2 + 0x90; + FltAcquirePushLockExclusiveEx(lVar6,0); + RtlDeleteElementGenericTableAvl(lVar2 + 0x98); + FltReleasePushLockEx(lVar6); CldSyncDisconnectRootByObject(puVar1,0); } if (puVar1[4] != 0) { ExFreePoolWithTag(puVar1[4],0x69537348); } if (puVar1[2] != 0) { ExFreePoolWithTag(puVar1[2],0x73557348); } if (puVar1[10] != 0) { ExFreePoolWithTag(puVar1[10],0x72736c43); } if (puVar1[8] != 0) { ExFreePoolWithTag(puVar1[8],0x53536c43); } ExFreePoolWithTag(puVar1,0x72736c43); - iVar2 = RtlNumberGenericTableElementsAvl(lVar3); } FltReleasePushLockEx(param_1 + 8,0); + uVar4 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 != 0) { + FltReleasePushLockEx(&DAT_0,0); + } return; } ``` ## HsmpCldGetSyncRootProviderInfo ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.31| |i_ratio|0.4| |m_ratio|0.97| |b_ratio|0.35| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|HsmpCldGetSyncRootProviderInfo|HsmpCldGetSyncRootProviderInfo| |fullname|HsmpCldGetSyncRootProviderInfo|HsmpCldGetSyncRootProviderInfo| |refcount|2|2| |`length`|732|706| |`called`|HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfo
NTOSKRNL.EXE::ExFreePoolWithTag
_guard_dispatch_icall
memcpy|Feature_1074201912__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoDeprecated
NTOSKRNL.EXE::ExFreePoolWithTag
_guard_dispatch_icall
memmove| |calling|HsmFltProcessHSMControl|HsmFltProcessHSMControl| |paramcount|6|6| |`address`|1400520ac|14005246c| |sig|uint __fastcall HsmpCldGetSyncRootProviderInfo(longlong param_1, longlong param_2, undefined8 param_3, undefined4 * param_4, uint param_5, uint * param_6)|uint __fastcall HsmpCldGetSyncRootProviderInfo(longlong param_1, longlong param_2, undefined8 param_3, undefined4 * param_4, uint param_5, uint * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmpCldGetSyncRootProviderInfo Called Diff ```diff --- HsmpCldGetSyncRootProviderInfo called +++ HsmpCldGetSyncRootProviderInfo called @@ -0,0 +1 @@ +Feature_1074201912__private_IsEnabledDeviceUsageNoInline @@ -2,0 +4 @@ +HsmiCldGetSyncRootInfoDeprecated @@ -5 +7 @@ -memcpy +memmove ``` ### HsmpCldGetSyncRootProviderInfo Diff ```diff --- HsmpCldGetSyncRootProviderInfo +++ HsmpCldGetSyncRootProviderInfo @@ -1,124 +1,141 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ uint HsmpCldGetSyncRootProviderInfo (longlong param_1,longlong param_2,undefined8 param_3,undefined4 *param_4, uint param_5,uint *param_6) { ushort uVar1; - uint uVar2; - longlong lVar3; + longlong lVar2; + uint uVar3; uint uVar4; - uint uVar5; - undefined4 uVar6; - void *pvVar7; + undefined4 uVar5; + void *pvVar6; + ulonglong uVar7; uint uVar8; - void *pvVar9; + undefined8 uVar9; void *pvVar10; + size_t _Size; + void *pvVar11; void *_Src; - void *pvVar11; - void *pvVar12; + uint uVar12; + uint uVar13; + void *pvVar14; void *_Src_00; - void *pvVar13; - void *pvVar14; + void *pvVar15; char local_48 [8]; longlong local_40; - pvVar7 = (void *)0x0; + pvVar6 = (void *)0x0; local_40 = 0; - uVar4 = 0; + uVar3 = 0; local_48[0] = '\0'; - pvVar9 = (void *)0x0; pvVar14 = (void *)0x0; - pvVar12 = (void *)0x0; - pvVar13 = (void *)0x0; - uVar5 = HsmiCldGetSyncRootInfo(param_1,param_2,param_3,&local_40,local_48); - HsmDbgBreakOnStatus(uVar5); - lVar3 = local_40; - if (-1 < (int)uVar5) { - _Src = pvVar7; - _Src_00 = pvVar7; - pvVar10 = pvVar7; - pvVar11 = pvVar7; + pvVar15 = (void *)0x0; + pvVar11 = (void *)0x0; + uVar12 = 0; + uVar7 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + uVar4 = HsmiCldGetSyncRootInfoDeprecated(param_1,param_2,param_3,&local_40,local_48); + } + else { + uVar4 = HsmiCldGetSyncRootInfo(param_1,param_2,param_3,&local_40); + } + HsmDbgBreakOnStatus(uVar4); + lVar2 = local_40; + if (-1 < (int)uVar4) { + _Src = pvVar6; + _Src_00 = pvVar6; + pvVar10 = pvVar6; + uVar13 = uVar3; if ((local_40 != 0) && - (uVar4 = *(uint *)(local_40 + 8), _Src = pvVar9, _Src_00 = pvVar12, pvVar10 = pvVar13, - pvVar11 = pvVar14, 0x17 < uVar4)) { + (uVar3 = *(uint *)(local_40 + 8), _Src = pvVar11, _Src_00 = pvVar14, pvVar10 = pvVar15, + uVar13 = 0, 0x17 < uVar3)) { uVar1 = *(ushort *)(local_40 + 0xe); if (1 < uVar1) { - _Src = pvVar7; - pvVar11 = pvVar7; - if ((((0x1f < uVar4) && - (_Src = pvVar9, pvVar11 = pvVar14, *(ushort *)(local_40 + 0x18) < 0x12)) && - ((uVar2 = *(uint *)(local_40 + 0x1c), uVar2 == 0 || - (((uint)uVar1 * 8 + 0x10 <= uVar2 && (uVar2 <= uVar4)))))) && - ((*(ushort *)(local_40 + 0x1a) <= uVar4 && - (((uVar8 = *(ushort *)(local_40 + 0x1a) + uVar2, uVar8 <= uVar4 && - (*(ushort *)(local_40 + 0x18) == 0x11)) && (uVar2 <= uVar8)))))) { - _Src = pvVar7; - if ((*(uint *)(local_40 + 0x1c) != 0) && (_Src = pvVar9, *(short *)(local_40 + 0x1a) != 0) - ) { - _Src = (void *)(local_40 + (ulonglong)*(uint *)(local_40 + 0x1c)); + _Src_00 = pvVar6; + pvVar10 = pvVar6; + if ((((0x1f < uVar3) && + (_Src_00 = pvVar14, pvVar10 = pvVar15, *(ushort *)(local_40 + 0x18) < 0x12)) && + ((uVar13 = *(uint *)(local_40 + 0x1c), uVar13 == 0 || + (((uint)uVar1 * 8 + 0x10 <= uVar13 && (uVar13 <= uVar3)))))) && + ((*(ushort *)(local_40 + 0x1a) <= uVar3 && + (((uVar8 = *(ushort *)(local_40 + 0x1a) + uVar13, uVar13 <= uVar8 && (uVar8 <= uVar3)) + && (*(ushort *)(local_40 + 0x18) == 0x11)))))) { + _Src_00 = pvVar6; + if ((*(uint *)(local_40 + 0x1c) != 0) && + (_Src_00 = pvVar14, *(short *)(local_40 + 0x1a) != 0)) { + _Src_00 = (void *)(local_40 + (ulonglong)*(uint *)(local_40 + 0x1c)); } - pvVar11 = (void *)(ulonglong)*(ushort *)(local_40 + 0x1a); + pvVar10 = (void *)(ulonglong)*(ushort *)(local_40 + 0x1a); } - _Src_00 = pvVar7; - pvVar10 = pvVar7; - if ((((0x27 < uVar4) && (_Src_00 = pvVar12, pvVar10 = pvVar13, 2 < uVar1)) && + _Src = pvVar6; + uVar13 = 0; + if ((((2 < uVar1) && (_Src = pvVar11, uVar13 = uVar12, 0x27 < uVar3)) && (*(ushort *)(local_40 + 0x20) < 0x12)) && - ((((uVar2 = *(uint *)(local_40 + 0x24), uVar2 == 0 || - (((uint)uVar1 * 8 + 0x10 <= uVar2 && (uVar2 <= uVar4)))) && - (*(ushort *)(local_40 + 0x22) <= uVar4)) && - (((uVar8 = *(ushort *)(local_40 + 0x22) + uVar2, uVar8 <= uVar4 && - (*(ushort *)(local_40 + 0x20) == 0x11)) && (uVar2 <= uVar8)))))) { - _Src_00 = pvVar7; + ((((uVar12 = *(uint *)(local_40 + 0x24), uVar12 == 0 || + (((uint)uVar1 * 8 + 0x10 <= uVar12 && (uVar12 <= uVar3)))) && + (*(ushort *)(local_40 + 0x22) <= uVar3)) && + (((uVar8 = *(ushort *)(local_40 + 0x22) + uVar12, uVar12 <= uVar8 && (uVar8 <= uVar3)) + && (*(ushort *)(local_40 + 0x20) == 0x11)))))) { + _Src = pvVar6; if ((*(uint *)(local_40 + 0x24) != 0) && - (_Src_00 = pvVar12, *(short *)(local_40 + 0x22) != 0)) { - _Src_00 = (void *)(local_40 + (ulonglong)*(uint *)(local_40 + 0x24)); + (_Src = pvVar11, *(short *)(local_40 + 0x22) != 0)) { + _Src = (void *)(local_40 + (ulonglong)*(uint *)(local_40 + 0x24)); } - pvVar10 = (void *)(ulonglong)*(ushort *)(local_40 + 0x22); + uVar13 = (uint)*(ushort *)(local_40 + 0x22); } } } if ((3 < param_5) && (param_2 != 0)) { - uVar6 = (*DAT_0)(*(undefined8 *)(*(longlong *)(param_2 + 0x10) + 8)); - *param_4 = uVar6; + uVar5 = (*DAT_0)(*(undefined8 *)(*(longlong *)(param_2 + 0x10) + 8)); + *param_4 = uVar5; } - if ((_Src != (void *)0x0) && (0x203 < param_5)) { - pvVar7 = (void *)0x200; - if ((uint)pvVar11 < 0x201) { - pvVar7 = pvVar11; + _Size = 0x200; + if ((_Src_00 != (void *)0x0) && (0x203 < param_5)) { + pvVar6 = (void *)0x200; + if ((uint)pvVar10 < 0x201) { + pvVar6 = pvVar10; } - memcpy(param_4 + 1,_Src,(size_t)pvVar7); - if (0x1fe < (uint)pvVar11) { - pvVar11 = (void *)0x1fe; - } - *(undefined2 *)((longlong)param_4 + ((ulonglong)pvVar11 & 0xfffffffffffffffe) + 4) = 0; - } - uVar4 = 0x404; - if ((_Src_00 != (void *)0x0) && (0x403 < param_5)) { - pvVar7 = (void *)0x200; - if ((uint)pvVar10 < 0x201) { - pvVar7 = pvVar10; - } - memcpy(param_4 + 0x81,_Src_00,(size_t)pvVar7); + memmove(param_4 + 1,_Src_00,(size_t)pvVar6); if (0x1fe < (uint)pvVar10) { pvVar10 = (void *)0x1fe; } - *(undefined2 *)((longlong)param_4 + ((ulonglong)pvVar10 & 0xfffffffffffffffe) + 0x204) = 0; + *(undefined2 *)((longlong)param_4 + ((ulonglong)pvVar10 & 0xfffffffffffffffe) + 4) = 0; + } + uVar3 = 0x404; + if ((_Src != (void *)0x0) && (0x403 < param_5)) { + uVar7 = (ulonglong)uVar13; + if (uVar13 < 0x201) { + _Size = (size_t)uVar13; + } + memmove(param_4 + 0x81,_Src,_Size); + if (0x1fe < uVar13) { + uVar7 = 0x1fe; + } + *(undefined2 *)((longlong)param_4 + (uVar7 & 0xfffffffffffffffe) + 0x204) = 0; } } - if ((local_48[0] != '\0') && (lVar3 != 0)) { - ExFreePoolWithTag(lVar3,0x69537348); + uVar7 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + if ((local_48[0] == '\0') || (lVar2 == 0)) goto LAB_1; + uVar9 = 0x69537348; } - if (-1 < (int)uVar5) { - if (param_5 < uVar4) { - uVar5 = 0x80000005; + else { + if (lVar2 == 0) goto LAB_1; + uVar9 = 0; + } + ExFreePoolWithTag(lVar2,uVar9); +LAB_1: + if (-1 < (int)uVar4) { + if (param_5 < uVar3) { + uVar4 = 0x80000005; } if (param_6 != (uint *)0x0) { - *param_6 = uVar4; + *param_6 = uVar3; } } - return uVar5; + return uVar4; } ``` ## CldSyncGetRootInfo ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,called| |ratio|0.16| |i_ratio|0.02| |m_ratio|0.11| |b_ratio|0.09| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|CldSyncGetRootInfo|CldSyncGetRootInfo| |fullname|CldSyncGetRootInfo|CldSyncGetRootInfo| |`refcount`|9|15| |`length`|12|323| |`called`||CldiSyncReferenceRoot
Feature_1074201912__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExReleaseRundownProtection
WPP_SF_id
WPP_SF_qL
memmove| |calling|CldHsmGetSyncRootInfo
CldHsmGetSyncRootInfoByPath
CldStreamQueryProgress
CldiPortNotifyDisconnect|CldHsmGetSyncRootInfo
CldHsmGetSyncRootInfoByPath
CldStreamQueryProgress
CldiPortNotifyDisconnect| |paramcount|1|1| |`address`|14004a564|14004a7f4| |`sig`|undefined8 __fastcall CldSyncGetRootInfo(longlong param_1)|void * __fastcall CldSyncGetRootInfo(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldSyncGetRootInfo Called Diff ```diff --- CldSyncGetRootInfo called +++ CldSyncGetRootInfo called @@ -0,0 +1,8 @@ +CldiSyncReferenceRoot +Feature_1074201912__private_IsEnabledDeviceUsageNoInline +HsmDbgBreakOnStatus +NTOSKRNL.EXE::ExAllocatePool2 +NTOSKRNL.EXE::ExReleaseRundownProtection +WPP_SF_id +WPP_SF_qL +memmove ``` ### CldSyncGetRootInfo Diff ```diff --- CldSyncGetRootInfo +++ CldSyncGetRootInfo @@ -1,13 +1,56 @@ -undefined8 CldSyncGetRootInfo(longlong param_1) +void * CldSyncGetRootInfo(longlong param_1) { - undefined8 uVar1; + uint uVar1; + ulonglong uVar2; + void *_Dst; + void *pvVar3; + undefined8 uVar4; - uVar1 = 0; - if (param_1 != 0) { - uVar1 = *(undefined8 *)(param_1 + 0x20); + uVar2 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + _Dst = (void *)0x0; + if ((int)uVar2 == 0) { + if (param_1 != 0) { + _Dst = *(void **)(param_1 + 0x20); + } } - return uVar1; + else { + pvVar3 = (void *)0x0; + if (param_1 != 0) { + uVar2 = CldiSyncReferenceRoot(param_1); + HsmDbgBreakOnStatus((int)uVar2); + if ((int)uVar2 < 0) { + _Dst = pvVar3; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x22, + &WPP_c596341c543f384b9913e99e79325017_Traceguids,param_1); + } + } + else { + pvVar3 = *(void **)(param_1 + 0x20); + if (pvVar3 != (void *)0x0) { + uVar1 = *(uint *)((longlong)pvVar3 + 8); + uVar4 = 0x69726943; + _Dst = (void *)ExAllocatePool2(0x100,(ulonglong)uVar1); + if (_Dst == (void *)0x0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qL(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),&WPP_GLOBAL_Control,uVar4,param_1 + ); + } + } + else { + memmove(_Dst,pvVar3,(ulonglong)uVar1); + } + } + ExReleaseRundownProtection(param_1 + 0x58); + } + } + } + return _Dst; } ``` ## HsmDbgBreakOnStatus ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.29| |i_ratio|0.04| |m_ratio|0.5| |b_ratio|0.27| |match_types|Implied Match| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |`name`|HsmDbgBreakOnStatus|Feature_1074201912__private_IsEnabledDeviceUsageNoInline| |`fullname`|HsmDbgBreakOnStatus|Feature_1074201912__private_IsEnabledDeviceUsageNoInline| |`refcount`|1468|21| |`length`|147|49| |`called`|HsmpGetRegDword
NTOSKRNL.EXE::IoGetCurrentProcess|Feature_1074201912__private_IsEnabledFallback| |`calling`|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldHsmGetSyncPolicy
CldHsmGetSyncPolicyByPath
CldHsmGetSyncProviderProcessByPath
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncRootInfoByPathCldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldHsmInitialize
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldLookupSyncRoot
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldPortSendUpstreamMessage
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamRestartHydration
CldStreamRetrieveData
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncAckDehydrate
CldSyncAckDelete
CldSyncAckRename
CldSyncConnectRoot
CldSyncGetPlaceholderRangeInfo
CldSyncGetPolicy
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncRegisterStream
CldSyncReportProgress
CldSyncReportSyncStatusOnRoot
CldSyncRestartHydration
CldSyncRetrieveData
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldSyncSetSyncStatusOnStream
CldSyncTransferPlaceholders
CldiPortAccessCheck
CldiPortAddCrossVmProgressEvent
CldiPortCheckAllSystemsGo
CldiPortInsertSyncRootNoLock
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessFilterControl
CldiPortProcessGetRangeInfo
CldiPortProcessGlobal
CldiPortProcessQueryProgress
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransfer
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamProcessPendingHydrationRequests
CldiStreamRestartCountdownTimer
CldiStreamServiceHydrationRequest
CldiStreamStopCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncReferenceRoot
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CldiSyncTransferOrAckData
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmDriverEntry
HsmExpandKernelStackAndCallout
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFileCacheMapData
HsmFltInstanceQueryTeardown
HsmFltPostLOCK_CONTROL
HsmFltPostSetRenameInformation
HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION
HsmFltPreCLEANUP
HsmFltPreDIRECTORY_CONTROL
HsmFltPreFILE_SYSTEM_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltPreREAD
HsmFltPreSET_EA
HsmFltPreSET_INFORMATION
HsmFltPreSET_PURGE_FAILURE_MODE
HsmFltPreSET_REPARSE_POINT
HsmFltPreSET_REPARSE_POINT_EX
HsmFltPreSET_ZERO_DATA
HsmFltPreSetBasicInformation
HsmFltPreSetDispositionInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltPreWRITE
HsmFltProcessClearInSync
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessGetCorrelationVector
HsmFltProcessGetLastSyncStatus
HsmFltProcessHSMControl
HsmFltProcessHydrate
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessQueryStreamKey
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetCorrelationVector
HsmFltProcessSetInSync
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmPreLockControlSynchronous
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapCheckVersion
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALLoadFromDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapNORMALVerifyBitmapPages
HsmiBitmapNormalDeleteStream
HsmiBitmapNormalOpenStream
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompleteLockCallbackDataRoutine
HsmiCompressBuffer
HsmiCreateAllocateECPTags
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiExpandBitmapNoLock
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiFileCacheWriteCompletion
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiInfoRecallForRenameCompletion
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiIsUnsupportedLogfilePlaceholder
HsmiMarkFileRangeNoLock
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpInheritPinStatePre
HsmiOpPrepareOperation
HsmiOpRevertCompletion
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOpenFile
HsmiPrepareBitmapCommit
HsmiProcessPropertyLockRequestList
HsmiPropertyLockWait
HsmiQueryFileRangeNoLock
HsmiQueryFileRangesTotalNoLock
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallAllocatePopulationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmiRecallWriteFileNoLock
HsmiRpInitializeTable
HsmiUpdateFileAttributes
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpAccessCheckByFileId
HsmpAcquireFileNameLock
HsmpAcquireSyncOpRundownProtection
HsmpAcquireUserRequestRundownProtection
HsmpBitmapCreateSnapshot
HsmpBitmapGetRangeState
HsmpBitmapIsReparseBufferSupported
HsmpBitmapQueryRange
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo
HsmpCldIsHydrationDisallowed
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpCtxGetOrCreateFileContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpFileCacheSetFileSize
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpLoadPropertyStream
HsmpMarkHandleUsnSourceInfo
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpProcessQueryRangeStateHelper
HsmpQueryLastEffectiveUsn
HsmpQueryModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpBuildBuffer
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpRpValidateBuffer
HsmpRpiDecompressBuffer
HsmpSetCompressionNoLock
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpSetupContexts
HsmpToggleFileAttributes
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
HsmpUpdateLastAccessTime
HsmpValidateAttributionEcp
HsmpValidateStreamContextNoLock
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
|CldPortInitialize
CldStreamQueryProgress
CldSyncCleanup
CldSyncConnectRoot
CldSyncGetRootInfo
CldiPortNotifyDisconnect
CldiPortProcessServiceCommands
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo| |paramcount|1|0| |`address`|140003da0|14000e7b4| |`sig`|undefined __fastcall HsmDbgBreakOnStatus(int param_1)|ulonglong __fastcall Feature_1074201912__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmDbgBreakOnStatus Called Diff ```diff --- HsmDbgBreakOnStatus called +++ Feature_1074201912__private_IsEnabledDeviceUsageNoInline called @@ -1,2 +1 @@ -HsmpGetRegDword -NTOSKRNL.EXE::IoGetCurrentProcess +Feature_1074201912__private_IsEnabledFallback ``` ### HsmDbgBreakOnStatus Calling Diff ```diff --- HsmDbgBreakOnStatus calling +++ Feature_1074201912__private_IsEnabledDeviceUsageNoInline calling @@ -1,18 +0,0 @@ -CldCaptureProcessInfo -CldHsmAddCrossContainerNotificationEvent -CldHsmCreateFileContext -CldHsmCreateInstanceContext -CldHsmCreateStreamContext -CldHsmCreateStreamHandleContext -CldHsmGetSyncPolicy -CldHsmGetSyncPolicyByPath -CldHsmGetSyncProviderProcessByPath -CldHsmGetSyncRootFileIdByPath -CldHsmGetSyncRootInfoByPath -CldHsmGetSyncStatus -CldHsmHydratePlaceholder -CldHsmInitialize -CldHsmNotifyPreOperation -CldHsmPopulatePlaceholders -CldHsmTerminateProgressiveHydration -CldLookupSyncRoot @@ -20,12 +1,0 @@ -CldPortSendCancelHydrationMessage -CldPortSendCancelNotificationMessage -CldPortSendCancelPopulationMessage -CldPortSendHydrationMessage -CldPortSendPopulationMessage -CldPortSendPostOpMessage -CldPortSendPreOpMessage -CldPortSendUpstreamMessage -CldStreamAckData -CldStreamGetPlaceholderRangeInfo -CldStreamInitialize -CldStreamOpen @@ -33,8 +3 @@ -CldStreamRestartHydration -CldStreamRetrieveData -CldStreamSetSyncStatus -CldStreamTransferData -CldStreamTransferPlaceholders -CldSyncAckDehydrate -CldSyncAckDelete -CldSyncAckRename +CldSyncCleanup @@ -42,34 +5,2 @@ -CldSyncGetPlaceholderRangeInfo -CldSyncGetPolicy -CldSyncGetSyncStatusOnRoot -CldSyncLookupRootByName -CldSyncRegisterStream -CldSyncReportProgress -CldSyncReportSyncStatusOnRoot -CldSyncRestartHydration -CldSyncRetrieveData -CldSyncSendCancelHydrationRequest -CldSyncSendCancelNotificationRequest -CldSyncSendCancelPopulationRequest -CldSyncSendHydrationRequest -CldSyncSendPopulationRequest -CldSyncSendPostNotification -CldSyncSendPreNotification -CldSyncSetSyncStatusOnStream -CldSyncTransferPlaceholders -CldiPortAccessCheck -CldiPortAddCrossVmProgressEvent -CldiPortCheckAllSystemsGo -CldiPortInsertSyncRootNoLock -CldiPortNotifyConnect -CldiPortNotifyMessage -CldiPortProcessAbortHydration -CldiPortProcessAckData -CldiPortProcessAckNotification -CldiPortProcessFilterControl -CldiPortProcessGetRangeInfo -CldiPortProcessGlobal -CldiPortProcessQueryProgress -CldiPortProcessReportProgress -CldiPortProcessRestartHydration -CldiPortProcessRetrieveData +CldSyncGetRootInfo +CldiPortNotifyDisconnect @@ -77,172 +7,0 @@ -CldiPortProcessTransfer -CldiPortProcessTransferData -CldiPortProcessTransferPlaceholders -CldiPortSetSyncStatus -CldiStreamAckNotification -CldiStreamBuildProviderRequest -CldiStreamCompleteRequest -CldiStreamInsertIntoCancelSafeQueue -CldiStreamProcessPendingHydrationRequests -CldiStreamRestartCountdownTimer -CldiStreamServiceHydrationRequest -CldiStreamStopCountdownTimer -CldiSyncCreateRootNoLock -CldiSyncEnsurePendingRanges -CldiSyncInitializeRootNoLock -CldiSyncInsertPendingRange -CldiSyncReferenceRoot -CldiSyncSetSyncStatusOnRoot -CldiSyncSplitPendingRange -CldiSyncTransferOrAckData -CldiSyncTransferOrAckDataByObject -CldiSyncTransferPlaceholdersByObject -HsmCldDeleteSyncRootInfo -HsmCldPersistSyncRootInfo -HsmCreateOrOpenNamedEvent -HsmDriverEntry -HsmExpandKernelStackAndCallout -HsmFileCacheCreateFileObject -HsmFileCacheInitialize -HsmFileCacheMapData -HsmFltInstanceQueryTeardown -HsmFltPostLOCK_CONTROL -HsmFltPostSetRenameInformation -HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION -HsmFltPreCLEANUP -HsmFltPreDIRECTORY_CONTROL -HsmFltPreFILE_SYSTEM_CONTROL -HsmFltPreLOCK_CONTROL -HsmFltPreQUERY_ALLOCATED_RANGES -HsmFltPreREAD -HsmFltPreSET_EA -HsmFltPreSET_INFORMATION -HsmFltPreSET_PURGE_FAILURE_MODE -HsmFltPreSET_REPARSE_POINT -HsmFltPreSET_REPARSE_POINT_EX -HsmFltPreSET_ZERO_DATA -HsmFltPreSetBasicInformation -HsmFltPreSetDispositionInformation -HsmFltPreSetLinkInformation -HsmFltPreSetRenameInformation -HsmFltPreWRITE -HsmFltProcessClearInSync -HsmFltProcessConvertPlaceholder -HsmFltProcessCreatePlaceholders -HsmFltProcessDehydrate -HsmFltProcessGetCorrelationVector -HsmFltProcessGetLastSyncStatus -HsmFltProcessHSMControl -HsmFltProcessHydrate -HsmFltProcessLockProperties -HsmFltProcessQueryPlaceholder -HsmFltProcessQueryStreamKey -HsmFltProcessRetrieveProperties -HsmFltProcessRevert -HsmFltProcessSetCorrelationVector -HsmFltProcessSetInSync -HsmFltProcessSetPinState -HsmFltProcessStoreProperties -HsmFltProcessUpdatePlaceholder -HsmIBitmapNORMALCreate -HsmIBitmapNORMALMarkRangeEx -HsmIBitmapNORMALMayContainDirtyRange -HsmIBitmapNORMALOpen -HsmIBitmapNORMALPrepareCommit -HsmIBitmapNORMALQueryRangeEx -HsmIBitmapVOLATILEMarkRangeEx -HsmPreLockControlSynchronous -HsmProcessGetPlaceholderRangeInfo -HsmRecallAckData -HsmRecallRetrieveData -HsmRecallTransferData -HsmRecallTransferPlaceholders -HsmRecallUpdatePlaceholderFile -HsmiBitmapCheckVersion -HsmiBitmapNORMALDeleteOnDisk -HsmiBitmapNORMALEnsureOpened -HsmiBitmapNORMALFlushBitmapOnDisk -HsmiBitmapNORMALLoadFromDisk -HsmiBitmapNORMALMapBlock -HsmiBitmapNORMALMarkBitmapOnDisk -HsmiBitmapNORMALOpenOnDisk -HsmiBitmapNORMALPrepareBlockForWrite -HsmiBitmapNORMALPrepareMcbsForCommit -HsmiBitmapNORMALVerifyBitmapPages -HsmiBitmapNormalDeleteStream -HsmiBitmapNormalOpenStream -HsmiCldGetSyncProviderProcess -HsmiCldGetSyncRootFileIdByFileObject -HsmiCldGetSyncRootFileIdByPath -HsmiCldGetSyncRootInfo -HsmiCldGetSyncRootInfoByFileObject -HsmiCldGetSyncRootInfoByPath -HsmiCldLoadSyncRootInfoByFileId -HsmiCldLoadSyncRootInfoByFileObject -HsmiCldOpenSyncRoot -HsmiCompleteLockCallbackDataRoutine -HsmiCompressBuffer -HsmiCreateAllocateECPTags -HsmiCreateEnsureDirectoryFullyPopulated -HsmiCtxCreateFileContext -HsmiCtxGetOrCreateFileContext -HsmiExpandBitmapNoLock -HsmiFileCacheAllocateStreamControlBlock -HsmiFileCacheIrpClose -HsmiFileCacheIrpQueryInformation -HsmiFileCacheIrpRead -HsmiFileCacheIrpWrite -HsmiFileCacheValidateFileObject -HsmiFileCacheWriteCompletion -HsmiFltPostECPCREATE -HsmiFltPreECPCREATE -HsmiGrantLockRequest -HsmiInfoHydratePlaceholderOnRename -HsmiInfoPopulatePlaceholderOnRename -HsmiInfoPrepareForPostRename -HsmiInfoPrepareForPostSetDispostionInformation -HsmiInfoRecallForRenameCompletion -HsmiInfoUpdatePlaceholderStatesOnRenamePre -HsmiIsFileAttributeChangeRequired -HsmiIsUnsupportedLogfilePlaceholder -HsmiMarkFileRangeNoLock -HsmiMungeQueryDirectory -HsmiOOBECompleteWnfCallback -HsmiOpDehydrateNotificationCallback -HsmiOpInheritPinStatePre -HsmiOpPrepareOperation -HsmiOpRevertCompletion -HsmiOpSetPinStateInternal -HsmiOpUpdateInSyncState -HsmiOpUpdatePlaceholderDirectory -HsmiOpUpdatePlaceholderFile -HsmiOpenFile -HsmiPrepareBitmapCommit -HsmiProcessPropertyLockRequestList -HsmiPropertyLockWait -HsmiQueryFileRangeNoLock -HsmiQueryFileRangesTotalNoLock -HsmiQueryFullFilePath -HsmiRecallAllocateHydrationContext -HsmiRecallAllocatePopulationContext -HsmiRecallInitiateHydration -HsmiRecallPostProcessUserHydrationRequest -HsmiRecallWriteFileNoLock -HsmiRpInitializeTable -HsmiUpdateFileAttributes -HsmiValidateAndAttachAttributionEcpToStreamHandleContext -HsmpAccessCheck -HsmpAccessCheckByFileId -HsmpAcquireFileNameLock -HsmpAcquireSyncOpRundownProtection -HsmpAcquireUserRequestRundownProtection -HsmpBitmapCreateSnapshot -HsmpBitmapGetRangeState -HsmpBitmapIsReparseBufferSupported -HsmpBitmapQueryRange -HsmpBuildFullLinkPath -HsmpCheckLegacyFilterAbsence -HsmpCldCheckSyncProviderAccess -HsmpCldGetSyncPolicy -HsmpCldGetSyncPolicyByPath -HsmpCldGetSyncRootBasicInfo -HsmpCldGetSyncRootFileIdEx @@ -251,55 +9,0 @@ -HsmpCldIsHydrationDisallowed -HsmpCldNotifyPostOperation -HsmpCldNotifyPreOperation -HsmpCtxCreateInstanceContext -HsmpCtxCreateStreamContext -HsmpCtxCreateStreamHandleContext -HsmpCtxGetOrCreateFileContext -HsmpDeleteAlternateStream -HsmpDeleteAlternateStreamById -HsmpDeletePropertyStream -HsmpFileCacheFlush -HsmpFileCachePreparePinWrite -HsmpFileCacheSetFileSize -HsmpFillOutAttributionInformation -HsmpGetAttributionInformation -HsmpLoadPropertyStream -HsmpMarkHandleUsnSourceInfo -HsmpNotifyDataChange -HsmpOpCreatePlaceholders -HsmpOpenFileById -HsmpOpenFileByIdEx -HsmpOpenFileByPath -HsmpPrepareForMgmtOperation -HsmpProcessQueryRangeStateHelper -HsmpQueryLastEffectiveUsn -HsmpQueryModifiedRangeNoLock -HsmpQueryValidatedNonModifiedRangeNoLock -HsmpQueryValidatedNonModifiedRangesTotalNoLock -HsmpQueueDehydrationRequest -HsmpRecallInitiateHydrationEx -HsmpRecallInitiatePopulationEx -HsmpRecurseDirectory -HsmpRelativeStreamOpen -HsmpRelativeStreamOpenById -HsmpRpBuildBuffer -HsmpRpCommitNoLock -HsmpRpCreate -HsmpRpReadBuffer -HsmpRpRemove -HsmpRpValidateBuffer -HsmpRpiDecompressBuffer -HsmpSetCompressionNoLock -HsmpSetFileDisposition -HsmpSetFileVDL -HsmpSetupContexts -HsmpToggleFileAttributes -HsmpToggleFileAttributesNoNotify -HsmpToggleFileAttributesNotify -HsmpToggleFileSparseAttribute -HsmpUpdateLastAccessTime -HsmpValidateAttributionEcp -HsmpValidateStreamContextNoLock -QueryIfEAExists -TlmInitializeCorrelationVector -TlmWriteFilterAttachEvent ``` ### HsmDbgBreakOnStatus Diff ```diff --- HsmDbgBreakOnStatus +++ Feature_1074201912__private_IsEnabledDeviceUsageNoInline @@ -1,30 +1,17 @@ -void HsmDbgBreakOnStatus(int param_1) +ulonglong Feature_1074201912__private_IsEnabledDeviceUsageNoInline(void) { - code *pcVar1; - int iVar2; - longlong lVar3; - int iVar4; - int local_res8 [8]; + ulonglong uVar1; + undefined8 local_res8; - if (param_1 == 0) { - return; + local_res8 = (ulonglong)Feature_1074201912__private_featureState; + if ((Feature_1074201912__private_featureState & 0x10) == 0) { + uVar1 = Feature_1074201912__private_IsEnabledFallback(local_res8,3); } - local_res8[0] = 0; - iVar4 = 0; - if (((DAT_0 & 2) != 0) && - (iVar2 = HsmpGetRegDword(&__DEBUG,L"BreakOnStatus",local_res8), iVar4 = local_res8[0], - iVar2 < 0)) { - iVar4 = DAT_1; + else { + uVar1 = (ulonglong)(Feature_1074201912__private_featureState & 1); } - if (((((DAT_0 & 2) != 0) && (param_1 == iVar4)) && - ((DAT_2 == (void *)0x0 || (DAT_2 == SystemReserved1[0xf])))) && - ((DAT_3 == 0 || (lVar3 = IoGetCurrentProcess(), DAT_3 == lVar3)))) { - pcVar1 = (code *)swi(3); - (*pcVar1)(); - return; - } - return; + return uVar1; } ``` ## HsmiCldGetSyncRootInfo ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.28| |i_ratio|0.02| |m_ratio|0.28| |b_ratio|0.17| |match_types|Implied Match| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |`name`|HsmiCldGetSyncRootInfo|Feature_1074201912__private_IsEnabledDeviceUsageNoInline| |`fullname`|HsmiCldGetSyncRootInfo|Feature_1074201912__private_IsEnabledDeviceUsageNoInline| |`refcount`|3|21| |`length`|285|49| |`called`|HsmDbgBreakOnStatus
HsmiCldGetSyncRootInfoByFileObject
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_iiqd
_guard_dispatch_icall|Feature_1074201912__private_IsEnabledFallback| |`calling`|HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo|CldPortInitialize
CldStreamQueryProgress
CldSyncCleanup
CldSyncConnectRoot
CldSyncGetRootInfo
CldiPortNotifyDisconnect
CldiPortProcessServiceCommands
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo| |paramcount|5|0| |`address`|140052390|14000e7b4| |`sig`|uint __fastcall HsmiCldGetSyncRootInfo(longlong param_1, longlong param_2, undefined8 param_3, longlong * param_4, char * param_5)|ulonglong __fastcall Feature_1074201912__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmiCldGetSyncRootInfo Called Diff ```diff --- HsmiCldGetSyncRootInfo called +++ Feature_1074201912__private_IsEnabledDeviceUsageNoInline called @@ -1,5 +1 @@ -HsmDbgBreakOnStatus -HsmiCldGetSyncRootInfoByFileObject -NTOSKRNL.EXE::ExFreePoolWithTag -WPP_SF_iiqd -_guard_dispatch_icall +Feature_1074201912__private_IsEnabledFallback ``` ### HsmiCldGetSyncRootInfo Calling Diff ```diff --- HsmiCldGetSyncRootInfo calling +++ Feature_1074201912__private_IsEnabledDeviceUsageNoInline calling @@ -0,0 +1,7 @@ +CldPortInitialize +CldStreamQueryProgress +CldSyncCleanup +CldSyncConnectRoot +CldSyncGetRootInfo +CldiPortNotifyDisconnect +CldiPortProcessServiceCommands ``` ### HsmiCldGetSyncRootInfo Diff ```diff --- HsmiCldGetSyncRootInfo +++ Feature_1074201912__private_IsEnabledDeviceUsageNoInline @@ -1,43 +1,17 @@ -/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ - -uint HsmiCldGetSyncRootInfo - (longlong param_1,longlong param_2,undefined8 param_3,longlong *param_4,char *param_5 - ) +ulonglong Feature_1074201912__private_IsEnabledDeviceUsageNoInline(void) { - uint uVar1; - longlong lVar2; - char local_res10 [16]; - longlong local_res20; + ulonglong uVar1; + undefined8 local_res8; - uVar1 = 0; - local_res20 = 0; - *param_4 = 0; - local_res10[0] = '\0'; - *param_5 = '\0'; - if ((param_2 == 0) || (local_res20 = (*DAT_0)(), local_res20 == 0)) { - uVar1 = HsmiCldGetSyncRootInfoByFileObject(param_1,param_3,&local_res20,local_res10); - HsmDbgBreakOnStatus(uVar1); - if ((int)uVar1 < 0) { - lVar2 = local_res20; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x29]) - ) { - WPP_SF_iiqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x20, - &WPP_4de51bc6694e318c100a6ed9dc947bcd_Traceguids,param_1); - lVar2 = local_res20; - } - goto LAB_1; - } + local_res8 = (ulonglong)Feature_1074201912__private_featureState; + if ((Feature_1074201912__private_featureState & 0x10) == 0) { + uVar1 = Feature_1074201912__private_IsEnabledFallback(local_res8,3); } - *param_4 = local_res20; - *param_5 = local_res10[0]; - lVar2 = 0; -LAB_1: - if ((local_res10[0] != '\0') && (lVar2 != 0)) { - ExFreePoolWithTag(lVar2,0x69537348); + else { + uVar1 = (ulonglong)(Feature_1074201912__private_featureState & 1); } return uVar1; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## FLTMGR.SYS::FltAcquirePushLockSharedEx ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|FltAcquirePushLockSharedEx|FltAcquirePushLockSharedEx| |fullname|FLTMGR.SYS::FltAcquirePushLockSharedEx|FLTMGR.SYS::FltAcquirePushLockSharedEx| |`refcount`|37|36| |length|0|0| |called||| |`calling`|
Expand for full list:
CldHsmCreateStreamHandleContext
CldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldLookupSyncRoot
CldStreamQueryProgress
CldSyncAbortOperation
CldSyncGetSyncStatusOnRoot
CldSyncReferenceStream
CldiPortAccessCheck
CldiPortProcessAbortHydration
CldiPortProcessAckDataCldiPortProcessAckNotification
CldiPortProcessGetRangeInfo
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
HsmFltPreSetBasicInformation
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmRecallRetrieveData
HsmiQueryFileRange
HsmiRecallInitiateHydration
HsmpAcquireBitmapLock
HsmpAcquireReparseUpdateLock
HsmpCtxCreateStreamHandleContext
HsmpFillOutAttributionInformation
|
Expand for full list:
CldHsmCreateStreamHandleContext
CldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldLookupSyncRoot
CldSyncAbortOperation
CldSyncGetSyncStatusOnRoot
CldSyncReferenceStream
CldiPortAccessCheck
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotificationCldiPortProcessGetRangeInfo
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
HsmFltPreSetBasicInformation
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmRecallRetrieveData
HsmiQueryFileRange
HsmiRecallInitiateHydration
HsmpAcquireBitmapLock
HsmpAcquireReparseUpdateLock
HsmpCtxCreateStreamHandleContext
HsmpFillOutAttributionInformation
| |paramcount|0|0| |address|EXTERNAL:00000149|EXTERNAL:00000149| |sig|undefined FltAcquirePushLockSharedEx(void)|undefined FltAcquirePushLockSharedEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### FLTMGR.SYS::FltAcquirePushLockSharedEx Calling Diff ```diff --- FLTMGR.SYS::FltAcquirePushLockSharedEx calling +++ FLTMGR.SYS::FltAcquirePushLockSharedEx calling @@ -5 +4,0 @@ -CldStreamQueryProgress ``` ## TlmWriteProviderCrashedEvent ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.9| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|TlmWriteProviderCrashedEvent|TlmWriteProviderCrashedEvent| |fullname|TlmWriteProviderCrashedEvent|TlmWriteProviderCrashedEvent| |`refcount`|2|3| |length|270|270| |called|TlmpGetProviderNameFromMetaTable
__security_check_cookie
_tlgKeywordOn
_tlgWriteTransfer_EtwWriteTransfer|TlmpGetProviderNameFromMetaTable
__security_check_cookie
_tlgKeywordOn
_tlgWriteTransfer_EtwWriteTransfer| |calling|CldiPortNotifyDisconnect|CldiPortNotifyDisconnect| |paramcount|1|1| |`address`|140016b8c|140016c3c| |sig|undefined __fastcall TlmWriteProviderCrashedEvent(longlong param_1)|undefined __fastcall TlmWriteProviderCrashedEvent(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## FLTMGR.SYS::FltInitializePushLock ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|FltInitializePushLock|FltInitializePushLock| |fullname|FLTMGR.SYS::FltInitializePushLock|FLTMGR.SYS::FltInitializePushLock| |`refcount`|22|23| |length|0|0| |called||| |calling|
Expand for full list:
CldHsmCreateFileContext
CldHsmCreateStreamContext
CldPortInitialize
CldStreamInitialize
CldStreamOpen
CldSyncRegisterStream
CldiPortNotifyConnect
CldiSyncCreateRootNoLock
HsmFltProcessLockProperties
HsmIBitmapNORMALCreate
HsmIBitmapNORMALOpenHsmiCtxCreateFileContext
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
|
Expand for full list:
CldHsmCreateFileContext
CldHsmCreateStreamContext
CldPortInitialize
CldStreamInitialize
CldStreamOpen
CldSyncRegisterStream
CldiPortNotifyConnect
CldiSyncCreateRootNoLock
HsmFltProcessLockProperties
HsmIBitmapNORMALCreate
HsmIBitmapNORMALOpenHsmiCtxCreateFileContext
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
| |paramcount|0|0| |address|EXTERNAL:00000148|EXTERNAL:00000148| |sig|undefined FltInitializePushLock(void)|undefined FltInitializePushLock(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## WPP_SF_d ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.92| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|WPP_SF_d|WPP_SF_d| |fullname|WPP_SF_d|WPP_SF_d| |`refcount`|49|48| |length|58|58| |called|_guard_dispatch_icall|_guard_dispatch_icall| |calling|
Expand for full list:
CldHsmAddCrossContainerNotificationEvent
CldHsmInitialize
CldPortInitialize
CldStreamInitialize
CldStreamQueryProgress
CldiPortAddCrossVmProgressEvent
CldiPortCheckAllSystemsGo
CldiPortNotifyConnect
CldiPortProcessGetRangeInfo
CldiPortProcessServiceCommands
HsmDriverEntryHsmFileCacheCreateFileObject
HsmFltProcessHSMControl
HsmIBitmapNORMALPrepareCommit
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiFileCacheIrpClose
HsmiFileCacheIrpNotImplemented
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiRpInitializeTable
HsmpBitmapCreateSnapshot
HsmpBitmapIsReparseBufferSupported
HsmpFileCacheFlush
HsmpFileCacheSetAddressRangeModified
HsmpRecurseDirectory
HsmpRpBuildBuffer
HsmpRpValidateBuffer
|
Expand for full list:
CldHsmAddCrossContainerNotificationEvent
CldHsmInitialize
CldPortInitialize
CldStreamInitialize
CldStreamQueryProgress
CldiPortAddCrossVmProgressEvent
CldiPortCheckAllSystemsGo
CldiPortNotifyConnect
CldiPortProcessGetRangeInfo
CldiPortProcessServiceCommands
HsmDriverEntryHsmFileCacheCreateFileObject
HsmFltProcessHSMControl
HsmIBitmapNORMALPrepareCommit
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiFileCacheIrpClose
HsmiFileCacheIrpNotImplemented
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiRpInitializeTable
HsmpBitmapCreateSnapshot
HsmpBitmapIsReparseBufferSupported
HsmpFileCacheFlush
HsmpFileCacheSetAddressRangeModified
HsmpRecurseDirectory
HsmpRpBuildBuffer
HsmpRpValidateBuffer
| |paramcount|4|4| |address|14000e558|14000e558| |sig|undefined __fastcall WPP_SF_d(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_d(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## HsmpBitmapQueryRangeExCallout ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.94| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|HsmpBitmapQueryRangeExCallout|HsmpBitmapQueryRangeExCallout| |fullname|HsmpBitmapQueryRangeExCallout|HsmpBitmapQueryRangeExCallout| |`refcount`|11|10| |length|61|61| |called|HsmpBitmapQueryRangeEx|HsmpBitmapQueryRangeEx| |calling||| |paramcount|1|1| |address|14000a5d0|14000a5d0| |sig|undefined __fastcall HsmpBitmapQueryRangeExCallout(undefined4 * param_1)|undefined __fastcall HsmpBitmapQueryRangeExCallout(undefined4 * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## FLTMGR.SYS::FltAcquirePushLockExclusiveEx ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|FltAcquirePushLockExclusiveEx|FltAcquirePushLockExclusiveEx| |fullname|FLTMGR.SYS::FltAcquirePushLockExclusiveEx|FLTMGR.SYS::FltAcquirePushLockExclusiveEx| |`refcount`|92|96| |length|0|0| |called||| |`calling`|
Expand for full list:
CldHsmCreateStreamHandleContext
CldHsmGetSyncRootFileIdByPath
CldHsmHydratePlaceholder
CldLookupSyncRoot
CldPortUnlinkSyncRoot
CldStreamClose
CldStreamOpen
CldStreamPurgeCache
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholdersCldSyncCleanup
CldSyncConnectRoot
CldSyncDisconnectRoot
CldSyncDisconnectRootByObject
CldSyncLookupRootByName
CldSyncRegisterStream
CldSyncRemoveInFlightRanges
CldSyncReportSyncStatusOnRoot
CldSyncSendCancelHydrationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPreNotification
CldiPortNotifyConnect
CldiPortNotifyDisconnect
CldiPortProcessServiceCommands
CldiSyncSetSyncStatusOnRoot
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmFltDeleteSTREAMHANDLE_CONTEXT
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALCompleteCommit
HsmIBitmapNORMALIsCommitPending
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALLookupMcbGroupMapping
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapVOLATILELookupMcbMapping
HsmiOpCompleteOperation
HsmiOpPrepareOperation
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmpAcquireBitmapLock
HsmpAcquireFileNameLock
HsmpAcquireReparseUpdateLock
HsmpCloseExternalBitmaps
HsmpCtxCreateStreamHandleContext
HsmpPersistEssentialPropPresent
HsmpPersistInSync
HsmpReInitializeUserRequestRundownProtection
HsmpReleaseFileNameLock
HsmpRpCommitNoLock
HsmpRpRemove
HsmpSetupContexts
HsmpWaitForUserRequestRundownRelease
|
Expand for full list:
CldHsmCreateStreamHandleContext
CldHsmGetSyncRootFileIdByPath
CldHsmHydratePlaceholder
CldLookupSyncRoot
CldStreamClose
CldStreamOpen
CldStreamPurgeCache
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncCleanupCldSyncConnectRoot
CldSyncDisconnectRoot
CldSyncDisconnectRootByObject
CldSyncLookupRootByName
CldSyncRegisterStream
CldSyncRemoveInFlightRanges
CldSyncReportSyncStatusOnRoot
CldSyncSendCancelHydrationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPreNotification
CldiPortNotifyConnect
CldiPortNotifyDisconnect
CldiPortProcessServiceCommands
CldiSyncSetSyncStatusOnRoot
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmFltDeleteSTREAMHANDLE_CONTEXT
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALCompleteCommit
HsmIBitmapNORMALIsCommitPending
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALLookupMcbGroupMapping
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapVOLATILELookupMcbMapping
HsmiOpCompleteOperation
HsmiOpPrepareOperation
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmpAcquireBitmapLock
HsmpAcquireFileNameLock
HsmpAcquireReparseUpdateLock
HsmpCloseExternalBitmaps
HsmpCtxCreateStreamHandleContext
HsmpPersistEssentialPropPresent
HsmpPersistInSync
HsmpReInitializeUserRequestRundownProtection
HsmpReleaseFileNameLock
HsmpRpCommitNoLock
HsmpRpRemove
HsmpSetupContexts
HsmpWaitForUserRequestRundownRelease
| |paramcount|0|0| |address|EXTERNAL:0000014b|EXTERNAL:0000014b| |sig|undefined FltAcquirePushLockExclusiveEx(void)|undefined FltAcquirePushLockExclusiveEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### FLTMGR.SYS::FltAcquirePushLockExclusiveEx Calling Diff ```diff --- FLTMGR.SYS::FltAcquirePushLockExclusiveEx calling +++ FLTMGR.SYS::FltAcquirePushLockExclusiveEx calling @@ -5 +4,0 @@ -CldPortUnlinkSyncRoot ``` ## NTOSKRNL.EXE::RtlNumberGenericTableElementsAvl ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|RtlNumberGenericTableElementsAvl|RtlNumberGenericTableElementsAvl| |fullname|NTOSKRNL.EXE::RtlNumberGenericTableElementsAvl|NTOSKRNL.EXE::RtlNumberGenericTableElementsAvl| |`refcount`|7|6| |length|0|0| |called||| |calling|CldSyncCleanup
CldiPortNotifyDisconnect
HsmFltDeleteINSTANCE_CONTEXT|CldSyncCleanup
CldiPortNotifyDisconnect
HsmFltDeleteINSTANCE_CONTEXT| |paramcount|0|0| |address|EXTERNAL:000000b8|EXTERNAL:000000b8| |sig|undefined RtlNumberGenericTableElementsAvl(void)|undefined RtlNumberGenericTableElementsAvl(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## HsmpReleaseBitmapLock ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.9| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|HsmpReleaseBitmapLock|HsmpReleaseBitmapLock| |fullname|HsmpReleaseBitmapLock|HsmpReleaseBitmapLock| |`refcount`|28|27| |length|39|39| |called|FLTMGR.SYS::FltReleasePushLockEx|FLTMGR.SYS::FltReleasePushLockEx| |`calling`|
Expand for full list:
CldStreamQueryProgress
HsmFltPreSetBasicInformation
HsmFltProcessQueryPlaceholder
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmiOpDehydrateNotificationCallback
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFileHsmiQueryFileRange
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmpCloseExternalBitmaps
HsmpPersistEssentialPropPresent
HsmpPersistInSync
HsmpProcessQueryRangeStateHelper
HsmpRecallInitiateHydrationEx
HsmpRpRemove
HsmpSetupContexts
|
Expand for full list:
HsmFltPreSetBasicInformation
HsmFltProcessQueryPlaceholder
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmiOpDehydrateNotificationCallback
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiQueryFileRangeHsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmpCloseExternalBitmaps
HsmpPersistEssentialPropPresent
HsmpPersistInSync
HsmpProcessQueryRangeStateHelper
HsmpRecallInitiateHydrationEx
HsmpRpRemove
HsmpSetupContexts
| |paramcount|1|1| |`address`|140056024|1400562a4| |sig|undefined __fastcall HsmpReleaseBitmapLock(longlong param_1)|undefined __fastcall HsmpReleaseBitmapLock(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmpReleaseBitmapLock Calling Diff ```diff --- HsmpReleaseBitmapLock calling +++ HsmpReleaseBitmapLock calling @@ -1 +0,0 @@ -CldStreamQueryProgress ``` ## wil_details_IsEnabledFallback ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.93| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|6|7| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_CLFS_Signing__private_IsEnabledFallback
Feature_Cldflt_BitmapNullValueCheck__private_IsEnabledFallback
Feature_Cldflt_NPCheckingForSyncInfo__private_IsEnabledFallback
Feature_RtlCrc32_UserModeAccessIssues__private_IsEnabledFallback
Feature_Servicing_PostRelOutlookHangIssue__private_IsEnabledFallback|Feature_1074201912__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallback
Feature_Cldflt_BitmapNullValueCheck__private_IsEnabledFallback
Feature_Cldflt_NPCheckingForSyncInfo__private_IsEnabledFallback
Feature_RtlCrc32_UserModeAccessIssues__private_IsEnabledFallback
Feature_Servicing_PostRelOutlookHangIssue__private_IsEnabledFallback| |paramcount|3|3| |address|14000c17c|14000c17c| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_1074201912__private_IsEnabledFallback ``` ## CldiSyncReferenceRoot ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|CldiSyncReferenceRoot|CldiSyncReferenceRoot| |fullname|CldiSyncReferenceRoot|CldiSyncReferenceRoot| |`refcount`|8|9| |length|115|115| |called|CldiSyncCheckProviderStatus
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection|CldiSyncCheckProviderStatus
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection| |`calling`|CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification|CldSyncGetRootInfo
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification| |paramcount|1|1| |`address`|14004caa0|14004ce60| |sig|ulonglong __fastcall CldiSyncReferenceRoot(longlong param_1)|ulonglong __fastcall CldiSyncReferenceRoot(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiSyncReferenceRoot Calling Diff ```diff --- CldiSyncReferenceRoot calling +++ CldiSyncReferenceRoot calling @@ -0,0 +1 @@ +CldSyncGetRootInfo ``` ## HsmiQueryFileRange ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.91| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|HsmiQueryFileRange|HsmiQueryFileRange| |fullname|HsmiQueryFileRange|HsmiQueryFileRange| |`refcount`|2|3| |length|130|130| |called|FLTMGR.SYS::FltAcquirePushLockSharedEx
HsmiQueryFileRangeNoLock
HsmpReleaseBitmapLock|FLTMGR.SYS::FltAcquirePushLockSharedEx
HsmiQueryFileRangeNoLock
HsmpReleaseBitmapLock| |`calling`|HsmFltPreQUERY_ALLOCATED_RANGES|CldStreamQueryProgress
HsmFltPreQUERY_ALLOCATED_RANGES| |paramcount|6|6| |`address`|140074a40|140074b40| |sig|int __fastcall HsmiQueryFileRange(longlong param_1, int param_2, undefined8 param_3, undefined8 * param_4, byte * param_5, undefined8 * param_6)|int __fastcall HsmiQueryFileRange(longlong param_1, int param_2, undefined8 param_3, undefined8 * param_4, byte * param_5, undefined8 * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmiQueryFileRange Calling Diff ```diff --- HsmiQueryFileRange calling +++ HsmiQueryFileRange calling @@ -0,0 +1 @@ +CldStreamQueryProgress ``` ## FLTMGR.SYS::FltReleasePushLockEx ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|FltReleasePushLockEx|FltReleasePushLockEx| |fullname|FLTMGR.SYS::FltReleasePushLockEx|FLTMGR.SYS::FltReleasePushLockEx| |`refcount`|135|138| |length|0|0| |called||| |`calling`|
Expand for full list:
CldHsmCreateStreamHandleContext
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldLookupSyncRoot
CldPortUnlinkSyncRoot
CldStreamClose
CldStreamOpen
CldStreamPurgeCache
CldStreamSetSyncStatus
CldStreamTransferDataCldStreamTransferPlaceholders
CldSyncAbortOperation
CldSyncCleanup
CldSyncConnectRoot
CldSyncDisconnectRoot
CldSyncDisconnectRootByObject
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncReferenceStream
CldSyncRegisterStream
CldSyncRemoveInFlightRanges
CldSyncReportSyncStatusOnRoot
CldSyncSendCancelHydrationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPreNotification
CldiPortAccessCheck
CldiPortNotifyConnect
CldiPortNotifyDisconnect
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessGetRangeInfo
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiSyncSetSyncStatusOnRoot
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmFltDeleteSTREAMHANDLE_CONTEXT
HsmFltPreCLEANUP
HsmFltPreSetBasicInformation
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALCompleteCommit
HsmIBitmapNORMALIsCommitPending
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALLookupMcbGroupMapping
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapVOLATILELookupMcbMapping
HsmiOpCompleteOperation
HsmiOpDehydrateNotificationCallback
HsmiOpPrepareOperation
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmpAcquireFileNameLock
HsmpCtxCreateStreamHandleContext
HsmpEnableSyncOp
HsmpFillOutAttributionInformation
HsmpPersistEssentialPropPresent
HsmpPersistInSync
HsmpProcessQueryRangeStateHelper
HsmpReInitializeUserRequestRundownProtection
HsmpReleaseBitmapLock
HsmpReleaseFileNameLock
HsmpReleaseReparseUpdateLock
HsmpRpCommitNoLock
HsmpRpRemove
HsmpSetupContexts
HsmpWaitForUserRequestRundownRelease
|
Expand for full list:
CldHsmCreateStreamHandleContext
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldLookupSyncRoot
CldStreamClose
CldStreamOpen
CldStreamPurgeCache
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholdersCldSyncAbortOperation
CldSyncCleanup
CldSyncConnectRoot
CldSyncDisconnectRoot
CldSyncDisconnectRootByObject
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncReferenceStream
CldSyncRegisterStream
CldSyncRemoveInFlightRanges
CldSyncReportSyncStatusOnRoot
CldSyncSendCancelHydrationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPreNotification
CldiPortAccessCheck
CldiPortNotifyConnect
CldiPortNotifyDisconnect
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessGetRangeInfo
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiSyncSetSyncStatusOnRoot
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmFltDeleteSTREAMHANDLE_CONTEXT
HsmFltPreCLEANUP
HsmFltPreSetBasicInformation
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALCompleteCommit
HsmIBitmapNORMALIsCommitPending
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALLookupMcbGroupMapping
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapVOLATILELookupMcbMapping
HsmiOpCompleteOperation
HsmiOpDehydrateNotificationCallback
HsmiOpPrepareOperation
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmpAcquireFileNameLock
HsmpCtxCreateStreamHandleContext
HsmpEnableSyncOp
HsmpFillOutAttributionInformation
HsmpPersistEssentialPropPresent
HsmpPersistInSync
HsmpProcessQueryRangeStateHelper
HsmpReInitializeUserRequestRundownProtection
HsmpReleaseBitmapLock
HsmpReleaseFileNameLock
HsmpReleaseReparseUpdateLock
HsmpRpCommitNoLock
HsmpRpRemove
HsmpSetupContexts
HsmpWaitForUserRequestRundownRelease
| |paramcount|0|0| |address|EXTERNAL:00000146|EXTERNAL:00000146| |sig|undefined FltReleasePushLockEx(void)|undefined FltReleasePushLockEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### FLTMGR.SYS::FltReleasePushLockEx Calling Diff ```diff --- FLTMGR.SYS::FltReleasePushLockEx calling +++ FLTMGR.SYS::FltReleasePushLockEx calling @@ -6 +5,0 @@ -CldPortUnlinkSyncRoot ``` ## HsmExpandKernelStackAndCallout ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.98| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|HsmExpandKernelStackAndCallout|HsmExpandKernelStackAndCallout| |fullname|HsmExpandKernelStackAndCallout|HsmExpandKernelStackAndCallout| |`refcount`|20|19| |length|160|160| |called|HsmDbgBreakOnStatus
NTOSKRNL.EXE::IoGetStackLimits
NTOSKRNL.EXE::KeExpandKernelStackAndCalloutEx
_guard_dispatch_icall|HsmDbgBreakOnStatus
NTOSKRNL.EXE::IoGetStackLimits
NTOSKRNL.EXE::KeExpandKernelStackAndCalloutEx
_guard_dispatch_icall| |`calling`|
Expand for full list:
CldStreamQueryProgress
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiFltPreECPCREATE
HsmiQueryFileRangesTotalNoLock
HsmiRecallInitiateHydrationHsmpBitmapGetRangeState
HsmpBitmapQueryRange
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpRecurseDirectory
|
Expand for full list:
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiFltPreECPCREATE
HsmiQueryFileRangesTotalNoLock
HsmiRecallInitiateHydration
HsmpBitmapGetRangeStateHsmpBitmapQueryRange
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpRecurseDirectory
| |paramcount|2|2| |address|14000a064|14000a064| |sig|int __fastcall HsmExpandKernelStackAndCallout(undefined * param_1, int * param_2)|int __fastcall HsmExpandKernelStackAndCallout(undefined * param_1, int * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmExpandKernelStackAndCallout Calling Diff ```diff --- HsmExpandKernelStackAndCallout calling +++ HsmExpandKernelStackAndCallout calling @@ -1 +0,0 @@ -CldStreamQueryProgress ``` ## WPP_SF_id ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.94| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|WPP_SF_id|WPP_SF_id| |fullname|WPP_SF_id|WPP_SF_id| |`refcount`|79|81| |length|74|74| |called|_guard_dispatch_icall|_guard_dispatch_icall| |`calling`|
Expand for full list:
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessageCldStreamRestartHydration
CldSyncDisconnectRoot
CldSyncRetrieveData
CldSyncSendCancelPopulationRequest
CldSyncSetSyncStatusOnStream
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessGetRangeInfo
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiSyncCreateRootNoLock
CldiSyncInitializeRootNoLock
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFltProcessHSMControl
HsmFltProcessSetPinState
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiOpenFile
HsmpBitmapCreateSnapshot
HsmpCldGetSyncPolicyByPath
HsmpCtxCreateInstanceContext
HsmpFileCacheSetFileSize
HsmpOpCreatePlaceholders
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpSetCompressionNoLock
|
Expand for full list:
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessageCldStreamRestartHydration
CldSyncDisconnectRoot
CldSyncGetRootInfo
CldSyncRetrieveData
CldSyncSendCancelPopulationRequest
CldSyncSetSyncStatusOnStream
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessGetRangeInfo
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiSyncCreateRootNoLock
CldiSyncInitializeRootNoLock
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFltProcessHSMControl
HsmFltProcessSetPinState
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByFileObjectDeprecated
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiOpenFile
HsmpBitmapCreateSnapshot
HsmpCldGetSyncPolicyByPath
HsmpCtxCreateInstanceContext
HsmpFileCacheSetFileSize
HsmpOpCreatePlaceholders
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpSetCompressionNoLock
| |paramcount|4|4| |address|14000c358|14000c358| |sig|undefined __fastcall WPP_SF_id(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_id(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_id Calling Diff ```diff --- WPP_SF_id calling +++ WPP_SF_id calling @@ -13,0 +14 @@ +CldSyncGetRootInfo @@ -39,0 +41 @@ +HsmiCldGetSyncRootInfoByFileObjectDeprecated ``` ## NTOSKRNL.EXE::ExFreePoolWithTag ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|ExFreePoolWithTag|ExFreePoolWithTag| |fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag| |`refcount`|255|261| |length|0|0| |called||| |`calling`|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateStreamHandleContext
CldHsmDeleteFileContext
CldHsmDeleteInstanceContext
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessageCldPortSendPostOpMessage
CldPortSendPreOpMessage
CldReleaseProcessInfo
CldStreamClose
CldStreamOpen
CldStreamPurgeCache
CldStreamQueryProgress
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamUninitialize
CldSyncCleanup
CldSyncSendCancelPopulationRequest
CldSyncSendPopulationRequest
CldiPortNotifyDisconnect
CldiPortNotifyMessage
CldiPortProcessServiceCommands
CldiPortRootTableFree
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncRootTableFree
CldiSyncSetSyncStatusOnRoot
CldiSyncStreamTableFree
CldiSyncTransferPlaceholdersByObject
DestroyAggregateSession
DestroyEventEntry
HsmCreateOrOpenNamedEvent
HsmFltDeleteINSTANCE_CONTEXT
HsmFltDeleteSTREAMHANDLE_CONTEXT
HsmFltDeleteSTREAM_CONTEXT
HsmFltPostSetLinkInformation
HsmFltPostSetRenameInformation
HsmFltPreDIRECTORY_CONTROL
HsmFltPreSetRenameInformation
HsmFltProcessDehydrate
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltUnload
HsmIBitmapNORMALCompleteCommit
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALRelease
HsmIBitmapNORMALUnpinBlock
HsmIBitmapVOLATILERelease
HsmOsBlockPlaceholderAccess
HsmOsStartWppTracing
HsmRecallRetrieveData
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiCbdTableFree
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCldPreOpCompletionCallback
HsmiCompleteBitmapCommit
HsmiCompressBuffer
HsmiCreateEnsureDirectoryFullyPopulated
HsmiDbgLoadProcessDWordFlag
HsmiDehydrationCsqCOMPLETE_CANCELED_IO
HsmiFileCacheFreeStreamControlBlock
HsmiFltPreECPCREATE
HsmiFreePropertyBlob
HsmiFreePropertyLock
HsmiGrantLockRequest
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiIsUnsupportedLogfilePlaceholder
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpPrepareOperation
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOsBuildAppPolicyKeyAcl
HsmiOsComputeAppIdentity
HsmiOsConstructLogFilesFolder
HsmiOsGetAppIdentity
HsmiOsGetProcessFlags
HsmiOsOpenAppPolicyKey
HsmiPrepareBitmapCommit
HsmiPropertyLockWait
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallFreeHydrationContext
HsmiRecallFreePopulationContext
HsmiRecallInitiateHydration
HsmiRecallWriteFileNoLock
HsmiRpCompressBuffer
HsmiUnloadPropertyStream
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpBuildFullLinkPath
HsmpCaptureProcessInfo
HsmpCheckLegacyFilterAbsence
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCleanupAttributionInformation
HsmpCompletePendedDehydrationRequests
HsmpCreateProcessInfo
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpDbgBreakOnOpen
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpQueryLastEffectiveUsn
HsmpQueueDehydrationRequest
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpiDecompressBuffer
HsmpSetupContexts
HsmpUninitializePropertyContext
InitializeTelemetryAssertsKMByDriverObject
QueryIfEAExists
SeSddlSecurityDescriptorFromSDDL
SepSddlAddAceToAcl
SepSddlDaclFromSDDLString
SepSddlGetAclForString
SepSddlSecurityDescriptorFromSDDLString
TlmInitializeCorrelationVector
TlmWriteAccessDeniedForAddSubDirectory
TlmWriteDisallowPurgeableKernelEA
TlmWriteFilterAttachEvent
TlmWriteSyncRootAlreadyConnected
TlmpWriteRequestorProcessName
UninitializeTelemetryAssertsKM
|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateStreamHandleContext
CldHsmDeleteFileContext
CldHsmDeleteInstanceContext
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessageCldPortSendPostOpMessage
CldPortSendPreOpMessage
CldReleaseProcessInfo
CldStreamClose
CldStreamOpen
CldStreamPurgeCache
CldStreamQueryProgress
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamUninitialize
CldSyncCleanup
CldSyncSendCancelPopulationRequest
CldSyncSendPopulationRequest
CldiPortNotifyDisconnect
CldiPortNotifyMessage
CldiPortProcessServiceCommands
CldiPortRootTableFree
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncRootTableFree
CldiSyncSetSyncStatusOnRoot
CldiSyncStreamTableFree
CldiSyncTransferPlaceholdersByObject
DestroyAggregateSession
DestroyEventEntry
HsmCreateOrOpenNamedEvent
HsmFltDeleteINSTANCE_CONTEXT
HsmFltDeleteSTREAMHANDLE_CONTEXT
HsmFltDeleteSTREAM_CONTEXT
HsmFltPostSetLinkInformation
HsmFltPostSetRenameInformation
HsmFltPreDIRECTORY_CONTROL
HsmFltPreSetRenameInformation
HsmFltProcessDehydrate
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltUnload
HsmIBitmapNORMALCompleteCommit
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALRelease
HsmIBitmapNORMALUnpinBlock
HsmIBitmapVOLATILERelease
HsmOsBlockPlaceholderAccess
HsmOsStartWppTracing
HsmRecallRetrieveData
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByFileObjectDeprecated
HsmiCldGetSyncRootInfoByPath
HsmiCldGetSyncRootInfoDeprecated
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCldPreOpCompletionCallback
HsmiCompleteBitmapCommit
HsmiCompressBuffer
HsmiCreateEnsureDirectoryFullyPopulated
HsmiDbgLoadProcessDWordFlag
HsmiDehydrationCsqCOMPLETE_CANCELED_IO
HsmiFileCacheFreeStreamControlBlock
HsmiFileIdTableFree
HsmiFltPreECPCREATE
HsmiFreePropertyBlob
HsmiFreePropertyLock
HsmiGrantLockRequest
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiIsUnsupportedLogfilePlaceholder
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpPrepareOperation
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOsBuildAppPolicyKeyAcl
HsmiOsComputeAppIdentity
HsmiOsConstructLogFilesFolder
HsmiOsGetAppIdentity
HsmiOsGetProcessFlags
HsmiOsOpenAppPolicyKey
HsmiPrepareBitmapCommit
HsmiPropertyLockWait
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallFreeHydrationContext
HsmiRecallFreePopulationContext
HsmiRecallInitiateHydration
HsmiRecallWriteFileNoLock
HsmiRpCompressBuffer
HsmiUnloadPropertyStream
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpBuildFullLinkPath
HsmpCaptureProcessInfo
HsmpCheckLegacyFilterAbsence
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCleanupAttributionInformation
HsmpCompletePendedDehydrationRequests
HsmpCreateProcessInfo
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpDbgBreakOnOpen
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpQueryLastEffectiveUsn
HsmpQueueDehydrationRequest
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpiDecompressBuffer
HsmpSetupContexts
HsmpUninitializePropertyContext
InitializeTelemetryAssertsKMByDriverObject
QueryIfEAExists
SeSddlSecurityDescriptorFromSDDL
SepSddlAddAceToAcl
SepSddlDaclFromSDDLString
SepSddlGetAclForString
SepSddlSecurityDescriptorFromSDDLString
TlmInitializeCorrelationVector
TlmWriteAccessDeniedForAddSubDirectory
TlmWriteDisallowPurgeableKernelEA
TlmWriteFilterAttachEvent
TlmWriteSyncRootAlreadyConnected
TlmpWriteRequestorProcessName
UninitializeTelemetryAssertsKM
| |paramcount|0|0| |address|EXTERNAL:000000ce|EXTERNAL:000000ce| |sig|undefined ExFreePoolWithTag(void)|undefined ExFreePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExFreePoolWithTag Calling Diff ```diff --- NTOSKRNL.EXE::ExFreePoolWithTag calling +++ NTOSKRNL.EXE::ExFreePoolWithTag calling @@ -63 +62,0 @@ -HsmiCbdTableFree @@ -67,0 +67 @@ +HsmiCldGetSyncRootInfoByFileObjectDeprecated @@ -68,0 +69 @@ +HsmiCldGetSyncRootInfoDeprecated @@ -78,0 +80 @@ +HsmiFileIdTableFree ``` ## NTOSKRNL.EXE::ExReleaseRundownProtection ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|ExReleaseRundownProtection|ExReleaseRundownProtection| |fullname|NTOSKRNL.EXE::ExReleaseRundownProtection|NTOSKRNL.EXE::ExReleaseRundownProtection| |`refcount`|21|22| |length|0|0| |called||| |`calling`|
Expand for full list:
CldHsmHydratePlaceholder
CldStreamUninitialize
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldiStreamStartCountdownTimer
CldiStreamStopCountdownTimerCldiStreamTimeoutDpc
CldiStreamTimeoutWorker
CldiSyncReferenceRoot
CldiSyncReleaseRundown
HsmFltPreWRITE
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmpReleaseSyncOpRundownProtection
HsmpReleaseUserRequestRundownProtection
|
Expand for full list:
CldHsmHydratePlaceholder
CldStreamUninitialize
CldSyncGetRootInfo
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldiStreamStartCountdownTimerCldiStreamStopCountdownTimer
CldiStreamTimeoutDpc
CldiStreamTimeoutWorker
CldiSyncReferenceRoot
CldiSyncReleaseRundown
HsmFltPreWRITE
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmpReleaseSyncOpRundownProtection
HsmpReleaseUserRequestRundownProtection
| |paramcount|0|0| |address|EXTERNAL:0000009d|EXTERNAL:0000009d| |sig|undefined ExReleaseRundownProtection(void)|undefined ExReleaseRundownProtection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExReleaseRundownProtection Calling Diff ```diff --- NTOSKRNL.EXE::ExReleaseRundownProtection calling +++ NTOSKRNL.EXE::ExReleaseRundownProtection calling @@ -2,0 +3 @@ +CldSyncGetRootInfo ``` ## TlmWriteZeroRangeQueryProgress ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.95| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|TlmWriteZeroRangeQueryProgress|TlmWriteZeroRangeQueryProgress| |fullname|TlmWriteZeroRangeQueryProgress|TlmWriteZeroRangeQueryProgress| |`refcount`|4|7| |length|420|420| |called|NTOSKRNL.EXE::KeQueryUnbiasedInterruptTime
TlmWriteZeroRangeQueryProgressAgg
TlmWriteZeroRangeQueryProgressStd
TlmpGetProviderNameFromMetaTable
TlmpResetEventCounters|NTOSKRNL.EXE::KeQueryUnbiasedInterruptTime
TlmWriteZeroRangeQueryProgressAgg
TlmWriteZeroRangeQueryProgressStd
TlmpGetProviderNameFromMetaTable
TlmpResetEventCounters| |calling|CldStreamQueryProgress|CldStreamQueryProgress| |paramcount|11|11| |address|14000e214|14000e214| |sig|undefined __fastcall TlmWriteZeroRangeQueryProgress(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, undefined8 param_6, undefined8 param_7, undefined8 param_8, undefined8 param_9, longlong param_10, undefined8 param_11)|undefined __fastcall TlmWriteZeroRangeQueryProgress(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, undefined8 param_6, undefined8 param_7, undefined8 param_8, undefined8 param_9, longlong param_10, undefined8 param_11)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## HsmDbgBreakOnStatus ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.97| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|HsmDbgBreakOnStatus|HsmDbgBreakOnStatus| |fullname|HsmDbgBreakOnStatus|HsmDbgBreakOnStatus| |`refcount`|1468|1470| |length|147|147| |called|HsmpGetRegDword
NTOSKRNL.EXE::IoGetCurrentProcess|HsmpGetRegDword
NTOSKRNL.EXE::IoGetCurrentProcess| |`calling`|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldHsmGetSyncPolicy
CldHsmGetSyncPolicyByPath
CldHsmGetSyncProviderProcessByPath
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncRootInfoByPathCldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldHsmInitialize
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldLookupSyncRoot
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldPortSendUpstreamMessage
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamRestartHydration
CldStreamRetrieveData
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncAckDehydrate
CldSyncAckDelete
CldSyncAckRename
CldSyncConnectRoot
CldSyncGetPlaceholderRangeInfo
CldSyncGetPolicy
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncRegisterStream
CldSyncReportProgress
CldSyncReportSyncStatusOnRoot
CldSyncRestartHydration
CldSyncRetrieveData
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldSyncSetSyncStatusOnStream
CldSyncTransferPlaceholders
CldiPortAccessCheck
CldiPortAddCrossVmProgressEvent
CldiPortCheckAllSystemsGo
CldiPortInsertSyncRootNoLock
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessFilterControl
CldiPortProcessGetRangeInfo
CldiPortProcessGlobal
CldiPortProcessQueryProgress
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransfer
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamProcessPendingHydrationRequests
CldiStreamRestartCountdownTimer
CldiStreamServiceHydrationRequest
CldiStreamStopCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncReferenceRoot
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CldiSyncTransferOrAckData
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmDriverEntry
HsmExpandKernelStackAndCallout
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFileCacheMapData
HsmFltInstanceQueryTeardown
HsmFltPostLOCK_CONTROL
HsmFltPostSetRenameInformation
HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION
HsmFltPreCLEANUP
HsmFltPreDIRECTORY_CONTROL
HsmFltPreFILE_SYSTEM_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltPreREAD
HsmFltPreSET_EA
HsmFltPreSET_INFORMATION
HsmFltPreSET_PURGE_FAILURE_MODE
HsmFltPreSET_REPARSE_POINT
HsmFltPreSET_REPARSE_POINT_EX
HsmFltPreSET_ZERO_DATA
HsmFltPreSetBasicInformation
HsmFltPreSetDispositionInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltPreWRITE
HsmFltProcessClearInSync
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessGetCorrelationVector
HsmFltProcessGetLastSyncStatus
HsmFltProcessHSMControl
HsmFltProcessHydrate
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessQueryStreamKey
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetCorrelationVector
HsmFltProcessSetInSync
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmPreLockControlSynchronous
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapCheckVersion
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALLoadFromDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapNORMALVerifyBitmapPages
HsmiBitmapNormalDeleteStream
HsmiBitmapNormalOpenStream
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompleteLockCallbackDataRoutine
HsmiCompressBuffer
HsmiCreateAllocateECPTags
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiExpandBitmapNoLock
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiFileCacheWriteCompletion
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiInfoRecallForRenameCompletion
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiIsUnsupportedLogfilePlaceholder
HsmiMarkFileRangeNoLock
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpInheritPinStatePre
HsmiOpPrepareOperation
HsmiOpRevertCompletion
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOpenFile
HsmiPrepareBitmapCommit
HsmiProcessPropertyLockRequestList
HsmiPropertyLockWait
HsmiQueryFileRangeNoLock
HsmiQueryFileRangesTotalNoLock
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallAllocatePopulationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmiRecallWriteFileNoLock
HsmiRpInitializeTable
HsmiUpdateFileAttributes
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpAccessCheckByFileId
HsmpAcquireFileNameLock
HsmpAcquireSyncOpRundownProtection
HsmpAcquireUserRequestRundownProtection
HsmpBitmapCreateSnapshot
HsmpBitmapGetRangeState
HsmpBitmapIsReparseBufferSupported
HsmpBitmapQueryRange
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo
HsmpCldIsHydrationDisallowed
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpCtxGetOrCreateFileContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpFileCacheSetFileSize
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpLoadPropertyStream
HsmpMarkHandleUsnSourceInfo
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpProcessQueryRangeStateHelper
HsmpQueryLastEffectiveUsn
HsmpQueryModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpBuildBuffer
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpRpValidateBuffer
HsmpRpiDecompressBuffer
HsmpSetCompressionNoLock
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpSetupContexts
HsmpToggleFileAttributes
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
HsmpUpdateLastAccessTime
HsmpValidateAttributionEcp
HsmpValidateStreamContextNoLock
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldHsmGetSyncPolicy
CldHsmGetSyncPolicyByPath
CldHsmGetSyncProviderProcessByPath
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncRootInfoByPathCldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldHsmInitialize
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldLookupSyncRoot
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldPortSendUpstreamMessage
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamRestartHydration
CldStreamRetrieveData
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncAckDehydrate
CldSyncAckDelete
CldSyncAckRename
CldSyncConnectRoot
CldSyncGetPlaceholderRangeInfo
CldSyncGetPolicy
CldSyncGetRootInfo
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncRegisterStream
CldSyncReportProgress
CldSyncReportSyncStatusOnRoot
CldSyncRestartHydration
CldSyncRetrieveData
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldSyncSetSyncStatusOnStream
CldSyncTransferPlaceholders
CldiPortAccessCheck
CldiPortAddCrossVmProgressEvent
CldiPortCheckAllSystemsGo
CldiPortInsertSyncRootNoLock
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessFilterControl
CldiPortProcessGetRangeInfo
CldiPortProcessGlobal
CldiPortProcessQueryProgress
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransfer
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamProcessPendingHydrationRequests
CldiStreamRestartCountdownTimer
CldiStreamServiceHydrationRequest
CldiStreamStopCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncReferenceRoot
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CldiSyncTransferOrAckData
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmDriverEntry
HsmExpandKernelStackAndCallout
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFileCacheMapData
HsmFltInstanceQueryTeardown
HsmFltPostLOCK_CONTROL
HsmFltPostSetRenameInformation
HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION
HsmFltPreCLEANUP
HsmFltPreDIRECTORY_CONTROL
HsmFltPreFILE_SYSTEM_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltPreREAD
HsmFltPreSET_EA
HsmFltPreSET_INFORMATION
HsmFltPreSET_PURGE_FAILURE_MODE
HsmFltPreSET_REPARSE_POINT
HsmFltPreSET_REPARSE_POINT_EX
HsmFltPreSET_ZERO_DATA
HsmFltPreSetBasicInformation
HsmFltPreSetDispositionInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltPreWRITE
HsmFltProcessClearInSync
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessGetCorrelationVector
HsmFltProcessGetLastSyncStatus
HsmFltProcessHSMControl
HsmFltProcessHydrate
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessQueryStreamKey
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetCorrelationVector
HsmFltProcessSetInSync
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmPreLockControlSynchronous
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapCheckVersion
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALLoadFromDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapNORMALVerifyBitmapPages
HsmiBitmapNormalDeleteStream
HsmiBitmapNormalOpenStream
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByFileObjectDeprecated
HsmiCldGetSyncRootInfoByPath
HsmiCldGetSyncRootInfoDeprecated
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompleteLockCallbackDataRoutine
HsmiCompressBuffer
HsmiCreateAllocateECPTags
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiExpandBitmapNoLock
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiFileCacheWriteCompletion
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiInfoRecallForRenameCompletion
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiIsUnsupportedLogfilePlaceholder
HsmiMarkFileRangeNoLock
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpInheritPinStatePre
HsmiOpPrepareOperation
HsmiOpRevertCompletion
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOpenFile
HsmiPrepareBitmapCommit
HsmiProcessPropertyLockRequestList
HsmiPropertyLockWait
HsmiQueryFileRangeNoLock
HsmiQueryFileRangesTotalNoLock
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallAllocatePopulationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmiRecallWriteFileNoLock
HsmiRpInitializeTable
HsmiUpdateFileAttributes
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpAccessCheckByFileId
HsmpAcquireFileNameLock
HsmpAcquireSyncOpRundownProtection
HsmpAcquireUserRequestRundownProtection
HsmpBitmapCreateSnapshot
HsmpBitmapGetRangeState
HsmpBitmapIsReparseBufferSupported
HsmpBitmapQueryRange
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo
HsmpCldIsHydrationDisallowed
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpCtxGetOrCreateFileContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpFileCacheSetFileSize
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpLoadPropertyStream
HsmpMarkHandleUsnSourceInfo
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpProcessQueryRangeStateHelper
HsmpQueryLastEffectiveUsn
HsmpQueryModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpBuildBuffer
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpRpValidateBuffer
HsmpRpiDecompressBuffer
HsmpSetCompressionNoLock
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpSetupContexts
HsmpToggleFileAttributes
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
HsmpUpdateLastAccessTime
HsmpValidateAttributionEcp
HsmpValidateStreamContextNoLock
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
| |paramcount|1|1| |address|140003da0|140003da0| |sig|undefined __fastcall HsmDbgBreakOnStatus(int param_1)|undefined __fastcall HsmDbgBreakOnStatus(int param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmDbgBreakOnStatus Calling Diff ```diff --- HsmDbgBreakOnStatus calling +++ HsmDbgBreakOnStatus calling @@ -43,0 +44 @@ +CldSyncGetRootInfo @@ -177,0 +179 @@ +HsmiCldGetSyncRootInfoByFileObjectDeprecated @@ -178,0 +181 @@ +HsmiCldGetSyncRootInfoDeprecated ``` ## NTOSKRNL.EXE::ExAllocatePool2 ### Match Info |Key|cld_8115.sys - cld_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cld_8115.sys|cld_8246.sys| | :---: | :---: | :---: | |name|ExAllocatePool2|ExAllocatePool2| |fullname|NTOSKRNL.EXE::ExAllocatePool2|NTOSKRNL.EXE::ExAllocatePool2| |`refcount`|144|145| |length|0|0| |called||| |`calling`|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateInstanceContext
CldHsmCreateStreamHandleContext
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessageCldPortSendPreOpMessage
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamSetSyncStatus
CldStreamTransferData
CldSyncSendPopulationRequest
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortRootTableAllocate
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncRootTableAllocate
CldiSyncSetSyncStatusOnRoot
CldiSyncStreamTableAllocate
HsmFltPostSetRenameInformation
HsmFltPreDIRECTORY_CONTROL
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmOsLocateProcessImageName
HsmRecallRetrieveData
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiCbdTableAllocate
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompressBuffer
HsmiCreateEnsureDirectoryFullyPopulated
HsmiDbgLoadProcessDWordFlag
HsmiFileCacheAllocateStreamControlBlock
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoPrepareForPostRename
HsmiIsUnsupportedLogfilePlaceholder
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOsBuildAppPolicyKeyAcl
HsmiOsComputeAppIdentity
HsmiOsConstructLogFilesFolder
HsmiOsOpenAppPolicyKey
HsmiPrepareBitmapCommit
HsmiQueryFullFilePath
HsmiRecallAllocatePopulationContext
HsmiRecallWriteFileNoLock
HsmiRpCompressBuffer
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpBitmapCreateSnapshot
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldNotifyPreOperation
HsmpCreateProcessInfo
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpDbgBreakOnOpen
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpQueryLastEffectiveUsn
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpiDecompressBuffer
HsmpSetupContexts
InitializeTelemetryAssertsKMWorkerInternal
MicrosoftTelemetryAssertTriggeredWorker
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateInstanceContext
CldHsmCreateStreamHandleContext
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessageCldPortSendPreOpMessage
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamSetSyncStatus
CldStreamTransferData
CldSyncGetRootInfo
CldSyncSendPopulationRequest
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortRootTableAllocate
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncRootTableAllocate
CldiSyncSetSyncStatusOnRoot
CldiSyncStreamTableAllocate
HsmFltPostSetRenameInformation
HsmFltPreDIRECTORY_CONTROL
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmOsLocateProcessImageName
HsmRecallRetrieveData
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompressBuffer
HsmiCreateEnsureDirectoryFullyPopulated
HsmiDbgLoadProcessDWordFlag
HsmiFileCacheAllocateStreamControlBlock
HsmiFileIdTableAllocate
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoPrepareForPostRename
HsmiIsUnsupportedLogfilePlaceholder
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOsBuildAppPolicyKeyAcl
HsmiOsComputeAppIdentity
HsmiOsConstructLogFilesFolder
HsmiOsOpenAppPolicyKey
HsmiPrepareBitmapCommit
HsmiQueryFullFilePath
HsmiRecallAllocatePopulationContext
HsmiRecallWriteFileNoLock
HsmiRpCompressBuffer
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpBitmapCreateSnapshot
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldNotifyPreOperation
HsmpCreateProcessInfo
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpDbgBreakOnOpen
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpQueryLastEffectiveUsn
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpiDecompressBuffer
HsmpSetupContexts
InitializeTelemetryAssertsKMWorkerInternal
MicrosoftTelemetryAssertTriggeredWorker
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
| |paramcount|0|0| |address|EXTERNAL:000000cf|EXTERNAL:000000cf| |sig|undefined ExAllocatePool2(void)|undefined ExAllocatePool2(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAllocatePool2 Calling Diff ```diff --- NTOSKRNL.EXE::ExAllocatePool2 calling +++ NTOSKRNL.EXE::ExAllocatePool2 calling @@ -17,0 +18 @@ +CldSyncGetRootInfo @@ -48 +48,0 @@ -HsmiCbdTableAllocate @@ -55,0 +56 @@ +HsmiFileIdTableAllocate ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-22T11:51:47