# cldflt_8328.sys-cldflt_8457.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [CldiCanDoNonCdqCompletion](#cldicandononcdqcompletion) * [Feature_2089223483__private_IsEnabledFallback](#feature_2089223483__private_isenabledfallback) * [Feature_2092950840__private_IsEnabledFallback](#feature_2092950840__private_isenabledfallback) * [Feature_955245880__private_IsEnabledDeviceUsageNoInline](#feature_955245880__private_isenableddeviceusagenoinline) * [Feature_955245880__private_IsEnabledFallback](#feature_955245880__private_isenabledfallback) * [CldiStreamCdqREMOVE_IO](#cldistreamcdqremove_io) * [HsmpRecallTerminateProgressiveHydration](#hsmprecallterminateprogressivehydration) * [CldiStreamGetCdq](#cldistreamgetcdq) * [FLTMGR.SYS::FltIsIoCanceled](#fltmgrsysfltisiocanceled) * [Modified](#modified) * [WPP_SF_iqii](#wpp_sf_iqii) * [HsmFltPreCLEANUP](#hsmfltprecleanup) * [CldHsmPopulatePlaceholders](#cldhsmpopulateplaceholders) * [CldHsmTerminateProgressiveHydration](#cldhsmterminateprogressivehydration) * [CldHsmHydratePlaceholder](#cldhsmhydrateplaceholder) * [CldiStreamProcessPendingPopulationRequests](#cldistreamprocesspendingpopulationrequests) * [CldHsmCancelSynchronousCbd](#cldhsmcancelsynchronouscbd) * [CldHsmCancelAllRequests](#cldhsmcancelallrequests) * [HsmiRecallHydrationCompletionCallback](#hsmirecallhydrationcompletioncallback) * [CldHsmNotifyPreOperation](#cldhsmnotifypreoperation) * [CldStreamQueryProgress](#cldstreamqueryprogress) * [CldiStreamPrepareRequestForNonCdqCompletion](#cldistreampreparerequestfornoncdqcompletion) * [CldStreamCdqREMOVE_IO](#cldstreamcdqremove_io) * [HsmiRecallInitiateHydration](#hsmirecallinitiatehydration) * [CldiStreamCdqCOMPLETE_CANCELED_IO](#cldistreamcdqcomplete_canceled_io) * [CldiStreamProcessPendingHydrationRequests](#cldistreamprocesspendinghydrationrequests) * [CldiStreamCancelSynchronousRequest](#cldistreamcancelsynchronousrequest) * [CldiStreamBuildProviderRequest](#cldistreambuildproviderrequest) * [HsmiRecallPostProcessHydration](#hsmirecallpostprocesshydration) * [CldiStreamProcessPendingNotificationRequests](#cldistreamprocesspendingnotificationrequests) * [CldiStreamCompleteRequest](#cldistreamcompleterequest) * [CldiStreamCompleteCanceledRequest](#cldistreamcompletecanceledrequest) * [CldiStreamInsertIntoCancelSafeQueue](#cldistreaminsertintocancelsafequeue) * [CldStreamAbortOperation](#cldstreamabortoperation) * [HsmDbgBreakOnStatus](#hsmdbgbreakonstatus) * [CldiStreamCdqRELEASE](#cldistreamcdqrelease) * [Modified (No Code Changes)](#modified-no-code-changes) * [FLTMGR.SYS::FltAcquirePushLockSharedEx](#fltmgrsysfltacquirepushlocksharedex) * [NTOSKRNL.EXE::FsRtlGetNextBaseMcbEntry](#ntoskrnlexefsrtlgetnextbasemcbentry) * [WPP_SF_qqqd](#wpp_sf_qqqd) * [WPP_SF_qqqiqd](#wpp_sf_qqqiqd) * [CldiStreamDeleteRequest](#cldistreamdeleterequest) * [HsmiQueryFileRangeNoLock](#hsmiqueryfilerangenolock) * [HsmpBitmapQueryRangeExCallout](#hsmpbitmapqueryrangeexcallout) * [FLTMGR.SYS::FltCbdqRemoveIo](#fltmgrsysfltcbdqremoveio) * [HsmpAcquireBitmapLock](#hsmpacquirebitmaplock) * [HsmpAcquireReparseUpdateLock](#hsmpacquirereparseupdatelock) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [CldiStreamCdqRELEASE](#cldistreamcdqrelease) * [FLTMGR.SYS::FltReleasePushLockEx](#fltmgrsysfltreleasepushlockex) * [TlmWriteCvForPopulatePlaceholders](#tlmwritecvforpopulateplaceholders) * [HsmExpandKernelStackAndCallout](#hsmexpandkernelstackandcallout) * [CldiStreamCdqACQUIRE](#cldistreamcdqacquire) * [TlmWriteCvForHydrateData](#tlmwritecvforhydratedata) * [HsmDbgBreakOnStatus](#hsmdbgbreakonstatus) # Visual Chart Diff ```mermaid flowchart LR WPP_SF_iqii-4-old<--Match 96%-->WPP_SF_iqii-4-new HsmFltPreCLEANUP-4-old<--Match 97%-->HsmFltPreCLEANUP-4-new CldHsmPopulatePlaceholders-9-old<--Match 28%-->CldHsmPopulatePlaceholders-9-new CldHsmTerminateProgressiveHydration-2-old<--Match 92%-->CldHsmTerminateProgressiveHydration-2-new CldHsmHydratePlaceholder-20-old<--Match 5%-->CldHsmHydratePlaceholder-20-new CldiStreamProcessPendingPopulationRequests-4-old<--Match 95%-->CldiStreamProcessPendingPopulationRequests-4-new CldHsmCancelSynchronousCbd-1-old<--Match 77%-->CldHsmCancelSynchronousCbd-1-new CldHsmCancelAllRequests-1-old<--Match 87%-->CldHsmCancelAllRequests-1-new HsmiRecallHydrationCompletionCallback-2-old<--Match 66%-->HsmiRecallHydrationCompletionCallback-2-new CldHsmNotifyPreOperation-10-old<--Match 28%-->CldHsmNotifyPreOperation-10-new CldStreamQueryProgress-4-old<--Match 77%-->CldStreamQueryProgress-4-new CldiStreamPrepareRequestForNonCdqCompletion-1-old<--Match 89%-->CldiStreamPrepareRequestForNonCdqCompletion-1-new CldStreamCdqREMOVE_IO-2-old<--Match 11%-->CldStreamCdqREMOVE_IO-2-new HsmiRecallInitiateHydration-3-old<--Match 53%-->HsmiRecallInitiateHydration-3-new CldiStreamCdqCOMPLETE_CANCELED_IO-3-old<--Match 68%-->CldiStreamCdqCOMPLETE_CANCELED_IO-3-new CldiStreamProcessPendingHydrationRequests-7-old<--Match 50%-->CldiStreamProcessPendingHydrationRequests-7-new CldiStreamCancelSynchronousRequest-1-old<--Match 70%-->CldiStreamCancelSynchronousRequest-1-new CldiStreamBuildProviderRequest-4-old<--Match 84%-->CldiStreamBuildProviderRequest-4-new HsmiRecallPostProcessHydration-2-old<--Match 99%-->HsmiRecallPostProcessHydration-2-new CldiStreamProcessPendingNotificationRequests-6-old<--Match 93%-->CldiStreamProcessPendingNotificationRequests-6-new CldiStreamCompleteRequest-4-old<--Match 91%-->CldiStreamCompleteRequest-4-new CldiStreamCompleteCanceledRequest-2-old<--Match 92%-->CldiStreamCompleteCanceledRequest-2-new CldiStreamInsertIntoCancelSafeQueue-4-old<--Match 91%-->CldiStreamInsertIntoCancelSafeQueue-4-new CldStreamAbortOperation-3-old<--Match 93%-->CldStreamAbortOperation-3-new HsmDbgBreakOnStatus-1-old<--Match 27%-->Feature_2092950840__private_IsEnabledDeviceUsageNoInline-1-new CldiStreamCdqRELEASE-1-old<--Match 19%-->Feature_2089223483__private_IsEnabledDeviceUsageNoInline-1-new subgraph cldflt_8457.sys WPP_SF_iqii-4-new HsmFltPreCLEANUP-4-new CldHsmPopulatePlaceholders-9-new CldHsmTerminateProgressiveHydration-2-new CldHsmHydratePlaceholder-20-new CldiStreamProcessPendingPopulationRequests-4-new CldHsmCancelSynchronousCbd-1-new CldHsmCancelAllRequests-1-new HsmiRecallHydrationCompletionCallback-2-new CldHsmNotifyPreOperation-10-new CldStreamQueryProgress-4-new CldiStreamPrepareRequestForNonCdqCompletion-1-new CldStreamCdqREMOVE_IO-2-new HsmiRecallInitiateHydration-3-new CldiStreamCdqCOMPLETE_CANCELED_IO-3-new CldiStreamProcessPendingHydrationRequests-7-new CldiStreamCancelSynchronousRequest-1-new CldiStreamBuildProviderRequest-4-new HsmiRecallPostProcessHydration-2-new CldiStreamProcessPendingNotificationRequests-6-new CldiStreamCompleteRequest-4-new CldiStreamCompleteCanceledRequest-2-new CldiStreamInsertIntoCancelSafeQueue-4-new CldStreamAbortOperation-3-new Feature_2092950840__private_IsEnabledDeviceUsageNoInline-1-new Feature_2089223483__private_IsEnabledDeviceUsageNoInline-1-new subgraph Added direction LR CldiCanDoNonCdqCompletion Feature_2089223483__private_IsEnabledFallback Feature_2092950840__private_IsEnabledFallback Feature_955245880__private_IsEnabledDeviceUsageNoInline Feature_955245880__private_IsEnabledFallback CldiStreamCdqREMOVE_IO HsmpRecallTerminateProgressiveHydration CldiStreamGetCdq FLTMGRSYS-FltIsIoCanceled end end subgraph cldflt_8328.sys WPP_SF_iqii-4-old HsmFltPreCLEANUP-4-old CldHsmPopulatePlaceholders-9-old CldHsmTerminateProgressiveHydration-2-old CldHsmHydratePlaceholder-20-old CldiStreamProcessPendingPopulationRequests-4-old CldHsmCancelSynchronousCbd-1-old CldHsmCancelAllRequests-1-old HsmiRecallHydrationCompletionCallback-2-old CldHsmNotifyPreOperation-10-old CldStreamQueryProgress-4-old CldiStreamPrepareRequestForNonCdqCompletion-1-old CldStreamCdqREMOVE_IO-2-old HsmiRecallInitiateHydration-3-old CldiStreamCdqCOMPLETE_CANCELED_IO-3-old CldiStreamProcessPendingHydrationRequests-7-old CldiStreamCancelSynchronousRequest-1-old CldiStreamBuildProviderRequest-4-old HsmiRecallPostProcessHydration-2-old CldiStreamProcessPendingNotificationRequests-6-old CldiStreamCompleteRequest-4-old CldiStreamCompleteCanceledRequest-2-old CldiStreamInsertIntoCancelSafeQueue-4-old CldStreamAbortOperation-3-old HsmDbgBreakOnStatus-1-old CldiStreamCdqRELEASE-1-old end ``` ```mermaid pie showData title Function Matches - 99.6880% "unmatched_funcs_len" : 9 "matched_funcs_len" : 2876 ``` ```mermaid pie showData title Matched Function Similarity - 98.4701% "matched_funcs_with_code_changes_len" : 26 "matched_funcs_with_non_code_changes_len" : 18 "matched_funcs_no_changes_len" : 2832 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 cldflt_8328.sys cldflt_8457.sys ``` #### Verbose Args
``` --old ['cldflt_8328.sys'] --new [['cldflt_8457.sys']] --engine VersionTrackingDiff --output-path ghidriff_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/cldflt.sys/BED9C0AB92000/cldflt.sys -O cldflt.sys.x64.10.0.26100.8328 wget https://msdl.microsoft.com/download/symbols/cldflt.sys/2532D7A992000/cldflt.sys -O cldflt.sys.x64.10.0.26100.8457 ``` ## Binary Metadata Diff ```diff --- cldflt_8328.sys Meta +++ cldflt_8457.sys Meta @@ -1,44 +1,44 @@ -Program Name: cldflt_8328.sys +Program Name: cldflt_8457.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 602728 +# of Bytes: 602784 # of Memory Blocks: 14 -# of Instructions: 111351 -# of Defined Data: 3470 -# of Functions: 1437 -# of Symbols: 16074 +# of Instructions: 111822 +# of Defined Data: 3501 +# of Functions: 1448 +# of Symbols: 16115 # of Data Types: 181 # of Data Type Categories: 13 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 21:11:23 SGT 2026 +Date Created: Sun Aug 16 21:11:27 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/cld/cldflt_8328.sys -Executable MD5: 3e8236bd7a001d4548f05079baca7230 -Executable SHA256: e190794e8e236f986e73f682f64b13d8ee5f044a7f8065765104471981016c6a -FSRL: file:///tmp/cld/cldflt_8328.sys?MD5=3e8236bd7a001d4548f05079baca7230 +Executable Location: /tmp/cld/cldflt_8457.sys +Executable MD5: 4e85844c17a460824de2023d279ff63b +Executable SHA256: e818bc587f00e60ce73af8cfc98544b18a3763cb290bf85cb8548a498446f2c2 +FSRL: file:///tmp/cld/cldflt_8457.sys?MD5=4e85844c17a460824de2023d279ff63b PDB Age: 1 PDB File: cldflt.pdb -PDB GUID: 41fe111e-600a-ec56-1d95-2f4a104a78cf +PDB GUID: e530adf3-5cc9-a9e7-ecca-a4c79e570777 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Cloud Files Mini Filter Driver -PE Property[FileVersion]: 10.0.26100.8328 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8457 (WinBuild.160101.0800) PE Property[InternalName]: cldflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: cldflt.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8328 +PE Property[ProductVersion]: 10.0.26100.8457 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra cldflt_8328.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra cldflt_8328.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra cldflt_8328.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra cldflt_8457.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra cldflt_8457.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra cldflt_8457.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|9| |deleted_funcs_len|0| |modified_funcs_len|44| |added_symbols_len|13| |deleted_symbols_len|3| |diff_time|6.763727188110352| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1436, 'ExternalsName': 340, 'Implied Match': 2})| |items_to_process|69| |diff_types|Counter({'address': 32, 'code': 26, 'length': 26, 'called': 24, 'refcount': 22, 'calling': 12, 'sig': 7, 'name': 2, 'fullname': 2})| |unmatched_funcs_len|9| |total_funcs_len|2885| |matched_funcs_len|2876| |matched_funcs_with_code_changes_len|26| |matched_funcs_with_non_code_changes_len|18| |matched_funcs_no_changes_len|2832| |match_func_similarity_percent|98.4701%| |func_match_overall_percent|99.6880%| |first_matches|Counter({'SymbolsHash': 1436, 'Implied Match': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 1436 "ExternalsName" : 340 "Implied-Match" : 2 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1436 "Implied-Match" : 2 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 9 "deleted_funcs_len" : 0 "modified_funcs_len" : 44 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 13 "deleted_symbols_len" : 3 ``` ## Strings *No string differences found* # Deleted # Added ## CldiCanDoNonCdqCompletion ### Function Meta |Key|cldflt_8457.sys| | :---: | :---: | |name|CldiCanDoNonCdqCompletion| |fullname|CldiCanDoNonCdqCompletion| |refcount|9| |length|131| |called|CldiStreamGetCdq
FLTMGR.SYS::FltCbdqRemoveIo| |calling|CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests| |paramcount|1| |address|140010fd8| |sig|undefined8 __fastcall CldiCanDoNonCdqCompletion(longlong param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- CldiCanDoNonCdqCompletion +++ CldiCanDoNonCdqCompletion @@ -0,0 +1,37 @@ + +undefined8 CldiCanDoNonCdqCompletion(longlong param_1) + +{ + longlong *plVar1; + longlong *plVar2; + code *pcVar3; + longlong lVar4; + undefined8 uVar5; + + if ((((*(longlong **)(param_1 + 0x60) != (longlong *)0x0) && + (lVar4 = **(longlong **)(param_1 + 0x60), lVar4 != 0)) && + (plVar1 = *(longlong **)(lVar4 + 0x30), plVar1 != (longlong *)(lVar4 + 0x30))) && + (plVar1 == (longlong *)*(longlong *)(lVar4 + 0x38))) { + lVar4 = CldiStreamGetCdq(*(longlong **)(param_1 + 0x78)); + lVar4 = FltCbdqRemoveIo(lVar4); + if (lVar4 == 0) { + return 0; + } + } + plVar1 = (longlong *)(param_1 + 0x18); + lVar4 = *plVar1; + if ((*(longlong **)(lVar4 + 8) == plVar1) && + (plVar2 = *(longlong **)(param_1 + 0x20), (longlong *)*plVar2 == plVar1)) { + *plVar2 = lVar4; + *(longlong **)(lVar4 + 8) = plVar2; + *(longlong **)(param_1 + 0x20) = plVar1; + *plVar1 = (longlong)plVar1; + return CONCAT71((int7)((ulonglong)plVar1 >> 8),1); + } + pcVar3 = (code *)swi(0x29); + (*pcVar3)(3); + pcVar3 = (code *)swi(3); + uVar5 = (*pcVar3)(); + return uVar5; +} + ``` ## Feature_2089223483__private_IsEnabledFallback ### Function Meta |Key|cldflt_8457.sys| | :---: | :---: | |name|Feature_2089223483__private_IsEnabledFallback| |fullname|Feature_2089223483__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_2089223483__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400111dc| |sig|undefined __fastcall Feature_2089223483__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2089223483__private_IsEnabledFallback +++ Feature_2089223483__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_2089223483__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_2089223483__private_descriptor); + return; +} + ``` ## Feature_2092950840__private_IsEnabledFallback ### Function Meta |Key|cldflt_8457.sys| | :---: | :---: | |name|Feature_2092950840__private_IsEnabledFallback| |fullname|Feature_2092950840__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_2092950840__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140017ce4| |sig|undefined __fastcall Feature_2092950840__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2092950840__private_IsEnabledFallback +++ Feature_2092950840__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_2092950840__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_2092950840__private_descriptor); + return; +} + ``` ## Feature_955245880__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|cldflt_8457.sys| | :---: | :---: | |name|Feature_955245880__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_955245880__private_IsEnabledDeviceUsageNoInline| |refcount|4| |length|49| |called|Feature_955245880__private_IsEnabledFallback| |calling|HsmiRecallPostProcessHydration
HsmpRecallTerminateProgressiveHydration| |paramcount|0| |address|140017d00| |sig|ulonglong __fastcall Feature_955245880__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_955245880__private_IsEnabledDeviceUsageNoInline +++ Feature_955245880__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_955245880__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_955245880__private_featureState; + if ((Feature_955245880__private_featureState & 0x10) == 0) { + uVar1 = Feature_955245880__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_955245880__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_955245880__private_IsEnabledFallback ### Function Meta |Key|cldflt_8457.sys| | :---: | :---: | |name|Feature_955245880__private_IsEnabledFallback| |fullname|Feature_955245880__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_955245880__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140017d38| |sig|undefined __fastcall Feature_955245880__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_955245880__private_IsEnabledFallback +++ Feature_955245880__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_955245880__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_955245880__private_descriptor); + return; +} + ``` ## CldiStreamCdqREMOVE_IO ### Function Meta |Key|cldflt_8457.sys| | :---: | :---: | |name|CldiStreamCdqREMOVE_IO| |fullname|CldiStreamCdqREMOVE_IO| |refcount|2| |length|73| |called|CldiStreamPrepareRequestForCdqCompletion
CldiStreamPrepareRequestForNonCdqCompletion
Feature_2089223483__private_IsEnabledDeviceUsageNoInline| |calling|CldStreamCdqREMOVE_IO| |paramcount|2| |address|140040c08| |sig|undefined __fastcall CldiStreamCdqREMOVE_IO(undefined8 param_1, longlong param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- CldiStreamCdqREMOVE_IO +++ CldiStreamCdqREMOVE_IO @@ -0,0 +1,20 @@ + +void CldiStreamCdqREMOVE_IO(undefined8 param_1,longlong param_2) + +{ + ulonglong uVar1; + undefined8 *puVar2; + + for (puVar2 = *(undefined8 **)(param_2 + 0x30); puVar2 != (undefined8 *)(param_2 + 0x30); + puVar2 = (undefined8 *)*puVar2) { + uVar1 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar1 == 0) { + CldiStreamPrepareRequestForCdqCompletion((uint *)(puVar2 + -3)); + } + else { + CldiStreamPrepareRequestForNonCdqCompletion((uint *)(puVar2 + -3)); + } + } + return; +} + ``` ## HsmpRecallTerminateProgressiveHydration ### Function Meta |Key|cldflt_8457.sys| | :---: | :---: | |name|HsmpRecallTerminateProgressiveHydration| |fullname|HsmpRecallTerminateProgressiveHydration| |refcount|2| |length|224| |called|Feature_955245880__private_IsEnabledDeviceUsageNoInline
HsmpGetStreamSize
WPP_SF_iqLi
_guard_dispatch_icall| |calling|HsmFltPreCLEANUP| |paramcount|2| |address|140061ee8| |sig|undefined __fastcall HsmpRecallTerminateProgressiveHydration(longlong param_1, ulonglong param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- HsmpRecallTerminateProgressiveHydration +++ HsmpRecallTerminateProgressiveHydration @@ -0,0 +1,59 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +void HsmpRecallTerminateProgressiveHydration(longlong param_1,ulonglong param_2) + +{ + ulonglong uVar1; + ulonglong uVar2; + longlong lVar3; + undefined *puVar4; + + uVar1 = Feature_955245880__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar1 == 0) { + LOCK(); + uVar1 = *(ulonglong *)(param_1 + 0x38); + *(ulonglong *)(param_1 + 0x38) = 0; + UNLOCK(); + } + else { + LOCK(); + uVar1 = *(ulonglong *)(param_1 + 0x38); + if (uVar1 == 0) { + *(ulonglong *)(param_1 + 0x38) = 0; + uVar1 = 0; + } + UNLOCK(); + do { + param_2 = uVar1; + if ((param_2 & 1) != 0) { + return; + } + LOCK(); + uVar1 = *(ulonglong *)(param_1 + 0x38); + if (param_2 == uVar1) { + *(ulonglong *)(param_1 + 0x38) = param_2 | 1; + uVar1 = param_2; + } + UNLOCK(); + } while (uVar1 != param_2); + } + if (uVar1 != 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) + { + lVar3 = *(longlong *)(param_1 + 0x10); + puVar4 = WPP_GLOBAL_Control; + HsmpGetStreamSize(lVar3); + WPP_SF_iqLi(*(undefined8 *)(puVar4 + 0x18),param_2,puVar4, + *(undefined8 *)(*(longlong *)(lVar3 + 0x10) + 0x20)); + } + uVar2 = Feature_955245880__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { + *(uint *)(uVar1 + 0x30) = *(uint *)(uVar1 + 0x30) | 0x800; + } + (*DAT_14002a800)(*(undefined8 *)(*(longlong *)(param_1 + 0x10) + 8),uVar1); + } + return; +} + ``` ## CldiStreamGetCdq ### Function Meta |Key|cldflt_8457.sys| | :---: | :---: | |name|CldiStreamGetCdq| |fullname|CldiStreamGetCdq| |refcount|2| |length|14| |called|| |calling|CldiCanDoNonCdqCompletion| |paramcount|1| |address|140077a08| |sig|longlong __fastcall CldiStreamGetCdq(longlong * param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- CldiStreamGetCdq +++ CldiStreamGetCdq @@ -0,0 +1,7 @@ + +longlong CldiStreamGetCdq(longlong *param_1) + +{ + return *(longlong *)(*param_1 + 8) + 0x90; +} + ``` ## FLTMGR.SYS::FltIsIoCanceled ### Function Meta |Key|cldflt_8457.sys| | :---: | :---: | |name|FltIsIoCanceled| |fullname|FLTMGR.SYS::FltIsIoCanceled| |refcount|2| |length|0| |called|| |calling|CldiStreamInsertIntoCancelSafeQueue| |paramcount|0| |address|EXTERNAL:00000141| |sig|undefined FltIsIoCanceled(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for FLTMGR.SYS::FltIsIoCanceled* # Modified *Modified functions contain code changes* ## WPP_SF_iqii ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.9| |i_ratio|0.33| |m_ratio|1.0| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|WPP_SF_iqii|WPP_SF_iqii| |fullname|WPP_SF_iqii|WPP_SF_iqii| |refcount|2|2| |`length`|100|102| |called|_guard_dispatch_icall|_guard_dispatch_icall| |calling|CldStreamTransferData|CldStreamTransferData| |paramcount|4|4| |`address`|140011550|140011644| |sig|undefined __fastcall WPP_SF_iqii(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_iqii(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_iqii Diff ```diff --- WPP_SF_iqii +++ WPP_SF_iqii @@ -1,15 +1,15 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void WPP_SF_iqii(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4) { undefined8 local_res20; local_res20 = param_4; (*pfnWppTraceMessage) - (param_1,0x2b,&WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,0x2b,&local_res20,8, + (param_1,0x2b,&WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,0x2c,&local_res20,8, &stack0x00000028,8,&stack0x00000030,8,&stack0x00000038,8,0); return; } ``` ## HsmFltPreCLEANUP ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.37| |i_ratio|0.76| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|HsmFltPreCLEANUP|HsmFltPreCLEANUP| |fullname|HsmFltPreCLEANUP|HsmFltPreCLEANUP| |refcount|3|3| |`length`|3136|2999| |`called`|
Expand for full list:
FLTMGR.SYS::FltCancelIo
FLTMGR.SYS::FltCancellableWaitForSingleObject
FLTMGR.SYS::FltDeleteContext
FLTMGR.SYS::FltFlushBuffers2
FLTMGR.SYS::FltGetFileContext
FLTMGR.SYS::FltGetRequestorProcess
FLTMGR.SYS::FltGetStreamHandleContext
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleasePushLockEx
FLTMGR.SYS::FltSetInformationFileHsmDbgBreakOnStatus
HsmOsIsPassThroughModeEnabled
HsmiCldGetSyncRootFileIdByFileObject
HsmiCompareLockOwners
HsmiFreePropertyLock
HsmiProcessPropertyLockRequestList
HsmpAcquireFileNameLock
HsmpAcquireReparseUpdateLock
HsmpCldNotifyPreOperation
HsmpCloseExternalBitmaps
HsmpGetFileLock
HsmpGetStreamSize
HsmpReleaseFileNameLock
HsmpRpRemove
HsmpTracePreCallbackEnter
HsmpTracePreCallbackExit
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReInitializeRundownProtection
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::FsRtlFastUnlockAll
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
WPP_SF_iqLi
WPP_SF_qqiqLiqd
WPP_SF_qqiqLiqdd
WPP_SF_qqqd
WPP_SF_qqqiqd
_guard_dispatch_icall
memmove
|
Expand for full list:
FLTMGR.SYS::FltCancelIo
FLTMGR.SYS::FltCancellableWaitForSingleObject
FLTMGR.SYS::FltDeleteContext
FLTMGR.SYS::FltFlushBuffers2
FLTMGR.SYS::FltGetFileContext
FLTMGR.SYS::FltGetRequestorProcess
FLTMGR.SYS::FltGetStreamHandleContext
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
FLTMGR.SYS::FltReleasePushLockEx
FLTMGR.SYS::FltSetInformationFileHsmDbgBreakOnStatus
HsmOsIsPassThroughModeEnabled
HsmiCldGetSyncRootFileIdByFileObject
HsmiCompareLockOwners
HsmiFreePropertyLock
HsmiProcessPropertyLockRequestList
HsmpAcquireFileNameLock
HsmpAcquireReparseUpdateLock
HsmpCldNotifyPreOperation
HsmpCloseExternalBitmaps
HsmpGetFileLock
HsmpGetStreamSize
HsmpRecallTerminateProgressiveHydration
HsmpReleaseFileNameLock
HsmpRpRemove
HsmpTracePreCallbackEnter
HsmpTracePreCallbackExit
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReInitializeRundownProtection
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::FsRtlFastUnlockAll
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::KeWaitForSingleObject
WPP_SF_qqiqLiqd
WPP_SF_qqiqLiqdd
WPP_SF_qqqd
WPP_SF_qqqiqd
_guard_dispatch_icall
memmove
| |calling||| |paramcount|4|4| |`address`|140062b10|140061320| |sig|uint __fastcall HsmFltPreCLEANUP(longlong param_1, longlong param_2, longlong * param_3, longlong * param_4)|uint __fastcall HsmFltPreCLEANUP(longlong param_1, longlong param_2, longlong * param_3, longlong * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmFltPreCLEANUP Called Diff ```diff --- HsmFltPreCLEANUP called +++ HsmFltPreCLEANUP called @@ -23,0 +24 @@ +HsmpRecallTerminateProgressiveHydration @@ -37 +37,0 @@ -WPP_SF_iqLi ``` ### HsmFltPreCLEANUP Diff ```diff --- HsmFltPreCLEANUP +++ HsmFltPreCLEANUP @@ -1,593 +1,570 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ uint HsmFltPreCLEANUP(longlong param_1,longlong param_2,longlong *param_3,longlong *param_4) { - ulonglong *_Src; - int *piVar1; - undefined4 uVar2; - ulonglong *puVar3; + ulonglong *puVar1; + int *piVar2; + undefined4 uVar3; longlong lVar4; - code *pcVar5; - undefined1 *puVar6; - char cVar7; - uint uVar8; - uint uVar9; - int iVar10; - longlong lVar11; - undefined8 uVar12; + undefined8 uVar5; + code *pcVar6; + longlong lVar7; + undefined1 *puVar8; + char cVar9; + uint uVar10; + uint uVar11; + int iVar12; longlong lVar13; - int *piVar14; - ulonglong uVar15; - ulonglong uVar16; - undefined8 uVar17; - undefined8 uVar18; - longlong *plVar19; - longlong lVar20; + undefined8 uVar14; + longlong lVar15; + int *piVar16; + ulonglong uVar17; + ulonglong uVar18; + undefined8 uVar19; + longlong *plVar20; undefined2 uVar21; longlong *plVar22; - undefined1 *puVar23; - longlong lVar24; - longlong *plVar25; - undefined *puVar26; + ulonglong *puVar23; + undefined1 *puVar24; + longlong lVar25; + longlong *plVar26; uint uVar27; longlong *in_R10; ulonglong uVar28; + undefined *puVar29; longlong *in_R11; - uint uVar29; + uint uVar30; longlong *local_res10; longlong *local_res18; uint local_res20 [2]; undefined8 uStack_120; undefined1 auStack_118 [32]; char local_f8 [64]; longlong local_b8; longlong local_b0; longlong local_a8; ulonglong local_a0; ulonglong *local_98; longlong *local_90; longlong *local_88; int *local_80; ulonglong local_78; longlong *local_70; ulonglong local_68; undefined8 local_60; undefined8 uStack_58; undefined8 local_50; - uint uVar30; + uint uVar31; - lVar13 = 0; + lVar15 = 0; *param_3 = 0; - lVar11 = *(longlong *)(param_2 + 0x18); + lVar13 = *(longlong *)(param_2 + 0x18); local_b8 = 0; - uVar29 = 1; uVar30 = 1; + uVar31 = 1; local_80 = (int *)0x0; local_b0 = 0; - FltGetStreamHandleContext(lVar11,*(undefined8 *)(param_2 + 0x20),&local_b0); + FltGetStreamHandleContext(lVar13,*(undefined8 *)(param_2 + 0x20),&local_b0); if (local_b0 != 0) { if ((*(uint *)(*(longlong *)(local_b0 + 0x10) + 0x1c) & 1) == 0) { if (local_b0 != 0) { FltDeleteContext(local_b0); goto LAB_0; } goto LAB_1; } if (local_b0 == 0) goto LAB_1; if (*(longlong *) (*(longlong *)(*(longlong *)(*(longlong *)(local_b0 + 0x10) + 0x10) + 0x10) + 0x20) == - lVar11) { + lVar13) { if (param_1 != 0) { - lVar11 = FltGetRequestorProcess(param_1); - cVar7 = HsmOsIsPassThroughModeEnabled(lVar11); - if (cVar7 != '\0') goto LAB_0; + lVar13 = FltGetRequestorProcess(param_1); + cVar9 = HsmOsIsPassThroughModeEnabled(lVar13); + if (cVar9 != '\0') goto LAB_0; } } else { LAB_0: FltReleaseContext(local_b0); local_b0 = 0; } - lVar11 = local_b0; + lVar13 = local_b0; if (local_b0 == 0) goto LAB_1; - lVar13 = *(longlong *)(local_b0 + 0x10); - lVar24 = *(longlong *)(lVar13 + 0x10); - local_b8 = *(longlong *)(lVar24 + 0x10); - FltReferenceContext(lVar24); + lVar15 = *(longlong *)(local_b0 + 0x10); + lVar25 = *(longlong *)(lVar15 + 0x10); + local_b8 = *(longlong *)(lVar25 + 0x10); + FltReferenceContext(lVar25); goto LAB_2; } LAB_1: - lVar11 = local_b0; - lVar20 = *(longlong *)(param_2 + 0x18); + lVar13 = local_b0; + lVar4 = *(longlong *)(param_2 + 0x18); local_a8 = 0; - FltGetFileContext(lVar20,*(undefined8 *)(param_2 + 0x20),&local_a8); - puVar23 = auStack_118; - lVar24 = local_a8; + FltGetFileContext(lVar4,*(undefined8 *)(param_2 + 0x20),&local_a8); + puVar24 = auStack_118; + lVar25 = local_a8; if (local_a8 != 0) { - if (*(longlong *)(*(longlong *)(local_a8 + 0x10) + 0x20) == lVar20) { + if (*(longlong *)(*(longlong *)(local_a8 + 0x10) + 0x20) == lVar4) { if (param_1 != 0) { - lVar13 = FltGetRequestorProcess(param_1); - cVar7 = HsmOsIsPassThroughModeEnabled(lVar13); - lVar24 = local_a8; - lVar13 = 0; - if (cVar7 != '\0') goto LAB_3; + lVar15 = FltGetRequestorProcess(param_1); + cVar9 = HsmOsIsPassThroughModeEnabled(lVar15); + lVar25 = local_a8; + lVar15 = 0; + if (cVar9 != '\0') goto LAB_3; } } else { LAB_3: FltReleaseContext(local_a8); local_a8 = 0; - lVar24 = 0; - lVar13 = 0; + lVar25 = 0; + lVar15 = 0; } LAB_2: - puVar23 = auStack_118; - if (lVar24 != 0) { - uVar15 = *(ulonglong *)(param_2 + 0x20); - local_78 = uVar15; - local_68 = uVar15; + puVar24 = auStack_118; + if (lVar25 != 0) { + uVar17 = *(ulonglong *)(param_2 + 0x20); + local_78 = uVar17; + local_68 = uVar17; KeEnterCriticalRegion(); - ExAcquireResourceExclusiveLite(lVar24 + 0x78); - local_a0 = *(ulonglong *)(lVar24 + 0xe0); - puVar23 = auStack_118; + ExAcquireResourceExclusiveLite(lVar25 + 0x78); + local_a0 = *(ulonglong *)(lVar25 + 0xe0); + puVar24 = auStack_118; if (local_a0 != 0) { plVar22 = *(longlong **)(local_a0 + 0x60); - plVar19 = (longlong *)(local_a0 + 0x60); - local_res10 = plVar19; - local_res18 = plVar19; - if (plVar22 != plVar19) { + plVar20 = (longlong *)(local_a0 + 0x60); + local_res10 = plVar20; + local_res18 = plVar20; + if (plVar22 != plVar20) { do { - plVar25 = plVar22; - if ((uVar15 <= (ulonglong)plVar22[-8]) && ((ulonglong)plVar22[-8] <= uVar15)) { - puVar23 = auStack_118; + plVar26 = plVar22; + if ((uVar17 <= (ulonglong)plVar22[-8]) && ((ulonglong)plVar22[-8] <= uVar17)) { + puVar24 = auStack_118; if ((longlong *)plVar22[1] != local_res10) goto LAB_4; - lVar20 = *plVar22; - puVar23 = auStack_118; - if (*(longlong **)(lVar20 + 8) != plVar22) goto LAB_4; - *local_res10 = lVar20; - *(longlong **)(lVar20 + 8) = local_res10; + lVar4 = *plVar22; + puVar24 = auStack_118; + if (*(longlong **)(lVar4 + 8) != plVar22) goto LAB_4; + *local_res10 = lVar4; + *(longlong **)(lVar4 + 8) = local_res10; plVar22[1] = (longlong)plVar22; *plVar22 = (longlong)plVar22; *(undefined4 *)(plVar22 + -2) = 0xc0000008; KeSetEvent(plVar22 + -5,0,0); - plVar19 = local_res18; - plVar25 = *(longlong **)local_res10[1]; + plVar20 = local_res18; + plVar26 = *(longlong **)local_res10[1]; } - plVar22 = (longlong *)*plVar25; - local_res10 = plVar25; - } while (plVar22 != plVar19); + plVar22 = (longlong *)*plVar26; + local_res10 = plVar26; + } while (plVar22 != plVar20); } in_R10 = *(longlong **)(local_a0 + 0x50); param_4 = (longlong *)(local_a0 + 0x50); local_res10 = (longlong *)((ulonglong)local_res10 & 0xffffffffffffff00); - puVar23 = auStack_118; - puVar6 = auStack_118; + puVar24 = auStack_118; + puVar8 = auStack_118; in_R11 = param_4; local_90 = param_4; local_88 = param_4; local_70 = in_R10; if (in_R10 != param_4) { do { - puVar23 = puVar6; + puVar24 = puVar8; local_98 = (ulonglong *)(in_R10 + 3); local_90 = param_4; local_70 = in_R10; if ((int)in_R10[4] == 0) { - uVar8 = uVar29; - if (*local_98 <= uVar15) { - if (*local_98 < uVar15) { - uVar8 = 0xffffffff; + uVar10 = uVar30; + if (*local_98 <= uVar17) { + if (*local_98 < uVar17) { + uVar10 = 0xffffffff; } else { local_res10 = (longlong *)CONCAT71(local_res10._1_7_,1); - uVar8 = 0; + uVar10 = 0; } } - while (uVar8 == 0) { + while (uVar10 == 0) { LAB_5: - plVar19 = (longlong *)*param_4; - if (((longlong *)plVar19[1] == param_4) && - (lVar20 = *plVar19, *(longlong **)(lVar20 + 8) == plVar19)) { - *param_4 = lVar20; - *(longlong **)(lVar20 + 8) = param_4; - *(undefined8 *)(puVar23 + -8) = 0x140062ec2; + plVar20 = (longlong *)*param_4; + if (((longlong *)plVar20[1] == param_4) && + (lVar4 = *plVar20, *(longlong **)(lVar4 + 8) == plVar20)) { + *param_4 = lVar4; + *(longlong **)(lVar4 + 8) = param_4; + *(undefined8 *)(puVar24 + -8) = 0x1400616c0; HsmiFreePropertyLock((longlong)in_R10); param_4 = (longlong *)local_90[1]; in_R11 = local_88; break; } LAB_4: - pcVar5 = (code *)swi(0x29); - (*pcVar5)(); - puVar23 = puVar23 + 8; - uVar8 = uVar29; + pcVar6 = (code *)swi(0x29); + (*pcVar6)(); + puVar24 = puVar24 + 8; + uVar10 = uVar30; } LAB_6: - cVar7 = (char)local_res10; + cVar9 = (char)local_res10; } else { - uVar16 = 0; + uVar18 = 0; local_res18 = (longlong *)((ulonglong)local_res18 & 0xffffffff00000000); if (*(uint *)((longlong)in_R10 + 0x14) != 0) { - uVar15 = *local_98; + uVar17 = *local_98; uVar28 = (ulonglong)*(uint *)((longlong)in_R10 + 0x14); do { - uVar8 = (uint)uVar16; - uVar27 = (int)uVar28 + uVar8 >> 1; - *(undefined8 *)(puVar23 + -8) = 0x140063399; - uVar16 = HsmiCompareLockOwners - ((ulonglong *)(uVar15 + (ulonglong)uVar27 * 8),&local_78); + uVar10 = (uint)uVar18; + uVar27 = (int)uVar28 + uVar10 >> 1; + *(undefined8 *)(puVar24 + -8) = 0x140061b99; + uVar18 = HsmiCompareLockOwners + ((ulonglong *)(uVar17 + (ulonglong)uVar27 * 8),&local_78); uVar28 = uVar28 & 0xffffffff; - uVar9 = uVar27 + 1; - if (-1 < (int)uVar16) { + uVar11 = uVar27 + 1; + if (-1 < (int)uVar18) { uVar28 = (ulonglong)uVar27; - uVar9 = uVar8; + uVar11 = uVar10; } - uVar16 = (ulonglong)uVar9; - } while (uVar9 < (uint)uVar28); - uVar16 = (ulonglong)uVar9; - local_res18 = (longlong *)CONCAT44(local_res18._4_4_,uVar9); - uVar15 = local_68; + uVar18 = (ulonglong)uVar11; + } while (uVar11 < (uint)uVar28); + uVar18 = (ulonglong)uVar11; + local_res18 = (longlong *)CONCAT44(local_res18._4_4_,uVar11); + uVar17 = local_68; in_R11 = local_88; } in_R10 = local_70; param_4 = local_90; local_res20[0] = *(uint *)((longlong)local_70 + 0x14); - if (local_res20[0] <= (uint)uVar16) goto LAB_6; - puVar3 = (ulonglong *)(*local_98 + uVar16 * 8); - local_98 = puVar3; - *(undefined8 *)(puVar23 + -8) = 0x1400633f2; - uVar16 = HsmiCompareLockOwners(puVar3,&local_78); - puVar3 = local_98; - if ((int)uVar16 != 0) goto LAB_6; + if (local_res20[0] <= (uint)uVar18) goto LAB_6; + puVar23 = (ulonglong *)(*local_98 + uVar18 * 8); + local_98 = puVar23; + *(undefined8 *)(puVar24 + -8) = 0x140061bf2; + uVar18 = HsmiCompareLockOwners(puVar23,&local_78); + puVar23 = local_98; + if ((int)uVar18 != 0) goto LAB_6; local_res10 = (longlong *)CONCAT71(local_res10._1_7_,1); if (local_res20[0] < 2) goto LAB_5; - uVar8 = local_res20[0] - 1; - *(uint *)((longlong)in_R10 + 0x14) = uVar8; - cVar7 = '\x01'; - if ((uint)local_res18 < uVar8) { - _Src = local_98 + 1; - *(undefined8 *)(puVar23 + -8) = 0x140063435; - memmove(puVar3,_Src,(ulonglong)(uVar8 - (uint)local_res18) << 3); + uVar10 = local_res20[0] - 1; + *(uint *)((longlong)in_R10 + 0x14) = uVar10; + cVar9 = '\x01'; + if ((uint)local_res18 < uVar10) { + puVar1 = local_98 + 1; + *(undefined8 *)(puVar24 + -8) = 0x140061c35; + memmove(puVar23,puVar1,(ulonglong)(uVar10 - (uint)local_res18) << 3); param_4 = local_90; in_R11 = local_88; } } - uVar16 = local_a0; + uVar18 = local_a0; param_4 = (longlong *)*param_4; in_R10 = (longlong *)*param_4; - puVar6 = puVar23; + puVar8 = puVar24; } while (in_R10 != in_R11); local_90 = param_4; local_70 = in_R10; - if (cVar7 != '\0') { - *(undefined8 *)(puVar23 + -8) = 0x140062ef6; - HsmiProcessPropertyLockRequestList(uVar16); + if (cVar9 != '\0') { + *(undefined8 *)(puVar24 + -8) = 0x1400616f4; + HsmiProcessPropertyLockRequestList(uVar18); } } } - *(undefined8 *)(puVar23 + -8) = 0x140062cbf; - ExReleaseResourceLite(lVar24 + 0x78); - *(undefined8 *)(puVar23 + -8) = 0x140062ccb; + *(undefined8 *)(puVar24 + -8) = 0x1400614cf; + ExReleaseResourceLite(lVar25 + 0x78); + *(undefined8 *)(puVar24 + -8) = 0x1400614db; KeLeaveCriticalRegion(); } } - if (lVar11 == 0) goto LAB_7; - *(longlong *)(puVar23 + 0x20) = lVar13; - *(undefined8 *)(puVar23 + -8) = 0x140062ceb; - HsmpTracePreCallbackEnter(param_1,'\0',1,lVar11,*(longlong *)(puVar23 + 0x20)); - piVar14 = local_80; - if (((*(uint *)(lVar11 + 0x28) >> 0xc & 1) == 0) || ((*(uint *)(lVar11 + 0x28) >> 0xb & 1) != 0)) + if (lVar13 == 0) goto LAB_7; + *(longlong *)(puVar24 + 0x20) = lVar15; + puVar23 = (ulonglong *)0x0; + *(undefined8 *)(puVar24 + -8) = 0x1400614fb; + HsmpTracePreCallbackEnter(param_1,'\0',1,lVar13,*(longlong *)(puVar24 + 0x20)); + piVar16 = local_80; + if (((*(uint *)(lVar13 + 0x28) >> 0xc & 1) == 0) || ((*(uint *)(lVar13 + 0x28) >> 0xb & 1) != 0)) goto LAB_8; local_50 = 0; local_a0 = 0; local_res20[0] = 0; local_60 = 0; uStack_58 = 0; local_res18 = (longlong *)((ulonglong)local_res18 & 0xffffffff00000000); - *(undefined8 *)(puVar23 + -8) = 0x140062fa1; + *(undefined8 *)(puVar24 + -8) = 0x1400617a1; KeInitializeEvent(&local_60,1,0); - *(longlong *)(puVar23 + 0x28) = param_1; + *(longlong *)(puVar24 + 0x28) = param_1; *(undefined8 **)(param_1 + 0x40) = &local_60; - uVar8 = *(uint *)(lVar13 + 0x1c); - *(code **)(puVar23 + 0x20) = HsmiInfoRenameNotificationCallback; - *(undefined8 *)(puVar23 + -8) = 0x140062fda; + uVar10 = *(uint *)(lVar15 + 0x1c); + *(code **)(puVar24 + 0x20) = HsmiInfoRenameNotificationCallback; + *(undefined8 *)(puVar24 + -8) = 0x1400617da; HsmpCldNotifyPreOperation - (4,param_1,(uVar8 & 2) << 3,0,*(undefined **)(puVar23 + 0x20), - *(undefined8 *)(puVar23 + 0x28)); - *(undefined8 *)(puVar23 + -8) = 0x140062fea; - iVar10 = FltCancellableWaitForSingleObject(&local_60,0,param_1); - local_res10 = (longlong *)CONCAT44(local_res10._4_4_,iVar10); - *(undefined8 *)(puVar23 + -8) = 0x140062ff9; - HsmDbgBreakOnStatus(iVar10); + (4,param_1,(uVar10 & 2) << 3,0,*(undefined **)(puVar24 + 0x20), + *(undefined8 *)(puVar24 + 0x28)); + *(undefined8 *)(puVar24 + -8) = 0x1400617ea; + iVar12 = FltCancellableWaitForSingleObject(&local_60,0,param_1); + local_res10 = (longlong *)CONCAT44(local_res10._4_4_,iVar12); + *(undefined8 *)(puVar24 + -8) = 0x1400617f9; + HsmDbgBreakOnStatus(iVar12); if (((int)local_res10 == -0x3fffffb5) || - (iVar10 = (int)local_res10, (int)local_res10 == -0x3ffffee0)) { - *(undefined8 *)(puVar23 + -8) = 0x140063450; + (iVar12 = (int)local_res10, (int)local_res10 == -0x3ffffee0)) { + *(undefined8 *)(puVar24 + -8) = 0x140061c50; FltCancelIo(param_1); - *(undefined8 *)(puVar23 + 0x20) = 0; - *(undefined8 *)(puVar23 + -8) = 0x140063471; + *(undefined8 *)(puVar24 + 0x20) = 0; + *(undefined8 *)(puVar24 + -8) = 0x140061c71; KeWaitForSingleObject(&local_60,0,0,0); - iVar10 = (int)local_res10; + iVar12 = (int)local_res10; } *(undefined8 *)(param_1 + 0x40) = 0; - if (iVar10 < 0) { + if (iVar12 < 0) { LAB_9: if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - *(undefined8 *)(puVar23 + -8) = 0x140063053; - puVar26 = WPP_GLOBAL_Control; - uVar12 = HsmpGetStreamSize(lVar13); - lVar20 = *(longlong *)(lVar13 + 0x10); - uVar18 = *(undefined8 *)(puVar26 + 0x18); - *(int *)(puVar23 + 0x50) = iVar10; - lVar4 = local_b8; - *(longlong *)(puVar23 + 0x48) = lVar11; - *(undefined8 *)(puVar23 + 0x40) = uVar12; - *(undefined4 *)(puVar23 + 0x38) = *(undefined4 *)(lVar13 + 0x1c); - uVar12 = *(undefined8 *)(lVar20 + 0x20); - *(longlong *)(puVar23 + 0x30) = lVar13; - *(undefined8 *)(puVar23 + 0x28) = uVar12; - *(undefined8 *)(puVar23 + 0x20) = *(undefined8 *)(param_2 + 0x20); - *(undefined8 *)(puVar23 + -8) = 0x14006309e; - WPP_SF_qqiqLiqd(uVar18,0xb,&WPP_e3630ce7b3b33dbc51129e886b811c0d_Traceguids,lVar4); - } - uVar18 = *(undefined8 *)(param_2 + 0x20); - uVar12 = *(undefined8 *)(param_2 + 0x18); + *(undefined8 *)(puVar24 + -8) = 0x140061853; + puVar29 = WPP_GLOBAL_Control; + uVar14 = HsmpGetStreamSize(lVar15); + lVar4 = *(longlong *)(lVar15 + 0x10); + uVar5 = *(undefined8 *)(puVar29 + 0x18); + *(int *)(puVar24 + 0x50) = iVar12; + lVar7 = local_b8; + *(longlong *)(puVar24 + 0x48) = lVar13; + *(undefined8 *)(puVar24 + 0x40) = uVar14; + *(undefined4 *)(puVar24 + 0x38) = *(undefined4 *)(lVar15 + 0x1c); + uVar14 = *(undefined8 *)(lVar4 + 0x20); + *(longlong *)(puVar24 + 0x30) = lVar15; + *(undefined8 *)(puVar24 + 0x28) = uVar14; + *(undefined8 *)(puVar24 + 0x20) = *(undefined8 *)(param_2 + 0x20); + *(undefined8 *)(puVar24 + -8) = 0x14006189e; + WPP_SF_qqiqLiqd(uVar5,0xb,&WPP_e3630ce7b3b33dbc51129e886b811c0d_Traceguids,lVar7); + } + uVar5 = *(undefined8 *)(param_2 + 0x20); + uVar14 = *(undefined8 *)(param_2 + 0x18); local_res10 = (longlong *)CONCAT44(local_res10._4_4_,8); - *(undefined4 *)(puVar23 + 0x20) = 0x40; - *(undefined8 *)(puVar23 + -8) = 0x1400630c6; - iVar10 = FltSetInformationFile(uVar12,uVar18,&local_res10); - local_res18 = (longlong *)CONCAT44(local_res18._4_4_,iVar10); - *(undefined8 *)(puVar23 + -8) = 0x1400630d5; - HsmDbgBreakOnStatus(iVar10); - piVar14 = local_80; + *(undefined4 *)(puVar24 + 0x20) = 0x40; + *(undefined8 *)(puVar24 + -8) = 0x1400618c6; + iVar12 = FltSetInformationFile(uVar14,uVar5,&local_res10); + local_res18 = (longlong *)CONCAT44(local_res18._4_4_,iVar12); + *(undefined8 *)(puVar24 + -8) = 0x1400618d5; + HsmDbgBreakOnStatus(iVar12); + piVar16 = local_80; if ((int)(uint)local_res18 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29]) ) { - lVar20 = *(longlong *)(lVar13 + 0x10); - uVar18 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(uint *)(puVar23 + 0x40) = (uint)local_res18; - *(longlong *)(puVar23 + 0x38) = param_1; - uVar12 = *(undefined8 *)(lVar20 + 0x10); - *(undefined8 *)(puVar23 + 0x30) = *(undefined8 *)(lVar20 + 0x20); - *(undefined8 *)(puVar23 + 0x28) = *(undefined8 *)(param_2 + 0x20); - *(longlong *)(puVar23 + 0x20) = lVar13; - *(undefined8 *)(puVar23 + -8) = 0x14006314d; - WPP_SF_qqqiqd(uVar18,0xc,&WPP_e3630ce7b3b33dbc51129e886b811c0d_Traceguids,uVar12); + lVar4 = *(longlong *)(lVar15 + 0x10); + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(uint *)(puVar24 + 0x40) = (uint)local_res18; + *(longlong *)(puVar24 + 0x38) = param_1; + uVar14 = *(undefined8 *)(lVar4 + 0x10); + *(undefined8 *)(puVar24 + 0x30) = *(undefined8 *)(lVar4 + 0x20); + *(undefined8 *)(puVar24 + 0x28) = *(undefined8 *)(param_2 + 0x20); + *(longlong *)(puVar24 + 0x20) = lVar15; + *(undefined8 *)(puVar24 + -8) = 0x14006194d; + WPP_SF_qqqiqd(uVar5,0xc,&WPP_e3630ce7b3b33dbc51129e886b811c0d_Traceguids,uVar14); } goto LAB_7; } LAB_10: - *param_3 = lVar11; - uVar29 = 0; - lVar11 = 0; - uVar30 = uVar29; - if (piVar14 == (int *)0x0) goto LAB_7; + *param_3 = lVar13; + uVar30 = 0; + lVar13 = 0; + uVar31 = uVar30; + if (piVar16 == (int *)0x0) goto LAB_7; } else { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - *(undefined8 *)(puVar23 + -8) = 0x1400634ae; - puVar26 = WPP_GLOBAL_Control; - uVar17 = HsmpGetStreamSize(lVar13); - lVar20 = *(longlong *)(lVar13 + 0x10); - uVar18 = *(undefined8 *)(puVar26 + 0x18); - *(undefined4 *)(puVar23 + 0x58) = *(undefined4 *)(param_1 + 0x18); - uVar2 = *(undefined4 *)(lVar13 + 0x1c); - *(int *)(puVar23 + 0x50) = iVar10; - lVar4 = local_b8; - *(longlong *)(puVar23 + 0x48) = lVar11; - *(undefined8 *)(puVar23 + 0x40) = uVar17; - *(undefined4 *)(puVar23 + 0x38) = uVar2; - uVar12 = *(undefined8 *)(lVar20 + 0x20); - *(longlong *)(puVar23 + 0x30) = lVar13; - *(undefined8 *)(puVar23 + 0x28) = uVar12; - *(undefined8 *)(puVar23 + 0x20) = *(undefined8 *)(param_2 + 0x20); - *(undefined8 *)(puVar23 + -8) = 0x1400634f7; - WPP_SF_qqiqLiqdd(uVar18,lVar20,uVar17,lVar4); - } - lVar20 = local_b8; - iVar10 = *(int *)(param_1 + 0x18); - if (iVar10 < 0) goto LAB_9; - *(undefined8 *)(puVar23 + -8) = 0x14006319a; - piVar14 = (int *)HsmpAcquireFileNameLock(lVar20,lVar13,param_1); - if (piVar14 == (int *)0x0) goto LAB_7; - puVar3 = *(ulonglong **)(param_2 + 0x20); - *(longlong ***)(puVar23 + 0x20) = &local_res18; - lVar20 = local_b8; - local_98 = puVar3; - *(undefined8 *)(puVar23 + -8) = 0x1400631cb; - uVar8 = HsmiCldGetSyncRootFileIdByFileObject - (lVar20,(ulonglong)puVar3,&local_a0,(int *)local_res20, - *(int **)(puVar23 + 0x20)); - local_res10 = (longlong *)CONCAT44(local_res10._4_4_,uVar8); - *(undefined8 *)(puVar23 + -8) = 0x1400631d5; - HsmDbgBreakOnStatus(uVar8); - puVar3 = local_98; - lVar20 = local_b8; - if (((((int)local_res10 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (2 < (byte)WPP_GLOBAL_Control[0x29])) + *(undefined8 *)(puVar24 + -8) = 0x140061cae; + puVar29 = WPP_GLOBAL_Control; + uVar19 = HsmpGetStreamSize(lVar15); + lVar4 = *(longlong *)(lVar15 + 0x10); + uVar5 = *(undefined8 *)(puVar29 + 0x18); + *(undefined4 *)(puVar24 + 0x58) = *(undefined4 *)(param_1 + 0x18); + uVar3 = *(undefined4 *)(lVar15 + 0x1c); + *(int *)(puVar24 + 0x50) = iVar12; + lVar7 = local_b8; + *(longlong *)(puVar24 + 0x48) = lVar13; + *(undefined8 *)(puVar24 + 0x40) = uVar19; + *(undefined4 *)(puVar24 + 0x38) = uVar3; + uVar14 = *(undefined8 *)(lVar4 + 0x20); + *(longlong *)(puVar24 + 0x30) = lVar15; + *(undefined8 *)(puVar24 + 0x28) = uVar14; + *(undefined8 *)(puVar24 + 0x20) = *(undefined8 *)(param_2 + 0x20); + *(undefined8 *)(puVar24 + -8) = 0x140061cf7; + WPP_SF_qqiqLiqdd(uVar5,lVar4,uVar19,lVar7); + } + lVar4 = local_b8; + iVar12 = *(int *)(param_1 + 0x18); + if (iVar12 < 0) goto LAB_9; + *(undefined8 *)(puVar24 + -8) = 0x14006199a; + piVar16 = (int *)HsmpAcquireFileNameLock(lVar4,lVar15,param_1); + if (piVar16 == (int *)0x0) goto LAB_7; + puVar23 = *(ulonglong **)(param_2 + 0x20); + *(longlong ***)(puVar24 + 0x20) = &local_res18; + lVar4 = local_b8; + local_98 = puVar23; + *(undefined8 *)(puVar24 + -8) = 0x1400619cb; + uVar10 = HsmiCldGetSyncRootFileIdByFileObject + (lVar4,(ulonglong)puVar23,&local_a0,(int *)local_res20, + *(int **)(puVar24 + 0x20)); + local_res10 = (longlong *)CONCAT44(local_res10._4_4_,uVar10); + *(undefined8 *)(puVar24 + -8) = 0x1400619d5; + HsmDbgBreakOnStatus(uVar10); + puVar1 = local_98; + lVar4 = local_b8; + if ((((int)local_res10 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0 && (2 < (byte)WPP_GLOBAL_Control[0x29])))) { - *(int *)(puVar23 + 0x30) = (int)local_res10; - uVar18 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(ulonglong **)(puVar23 + 0x28) = puVar3; - *(longlong *)(puVar23 + 0x20) = lVar13; - *(undefined8 *)(puVar23 + -8) = 0x1400632d7; - WPP_SF_qqqd(uVar18,0x37,&WPP_ba8b7613af1330e4e0a02aa60b8decc8_Traceguids,lVar20); - } - *(undefined8 *)(puVar23 + -8) = 0x1400631e5; + puVar23 = (ulonglong *)0x37; + *(int *)(puVar24 + 0x30) = (int)local_res10; + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(ulonglong **)(puVar24 + 0x28) = puVar1; + *(longlong *)(puVar24 + 0x20) = lVar15; + *(undefined8 *)(puVar24 + -8) = 0x140061ad7; + WPP_SF_qqqd(uVar5,0x37,&WPP_ba8b7613af1330e4e0a02aa60b8decc8_Traceguids,lVar4); + } + *(undefined8 *)(puVar24 + -8) = 0x1400619e5; HsmDbgBreakOnStatus((int)local_res10); - iVar10 = 0; + iVar12 = 0; if ((int)local_res10 != -0x3fff30ed) { - iVar10 = (int)local_res10; - } - if (-1 < iVar10) { + iVar12 = (int)local_res10; + } + if (-1 < iVar12) { if (((uint)local_res18 != 0) && (local_res20[0] == 1)) { - uVar18 = *(undefined8 *)(lVar13 + 8); - *(undefined8 *)(puVar23 + -8) = 0x14006321e; - uVar15 = (*DAT_11)(uVar18); - if (uVar15 == local_a0) { - if ((*(uint *)(lVar13 + 0x1c) & 2) == 0) { - *(undefined8 *)(puVar23 + -8) = 0x140063587; - HsmpCloseExternalBitmaps(lVar13); + uVar5 = *(undefined8 *)(lVar15 + 8); + *(undefined8 *)(puVar24 + -8) = 0x140061a1e; + uVar17 = (*DAT_11)(uVar5); + if (uVar17 == local_a0) { + if ((*(uint *)(lVar15 + 0x1c) & 2) == 0) { + *(undefined8 *)(puVar24 + -8) = 0x140061d87; + HsmpCloseExternalBitmaps(lVar15); } - lVar20 = *(longlong *)(param_2 + 0x20); - *(undefined8 *)(puVar23 + -8) = 0x140063244; - iVar10 = HsmpRpRemove(lVar13,lVar20,'\x01'); - local_res10 = (longlong *)CONCAT44(local_res10._4_4_,iVar10); - *(undefined8 *)(puVar23 + -8) = 0x14006324e; - HsmDbgBreakOnStatus(iVar10); + puVar23 = *(ulonglong **)(param_2 + 0x20); + *(undefined8 *)(puVar24 + -8) = 0x140061a44; + iVar12 = HsmpRpRemove(lVar15,(longlong)puVar23,'\x01'); + local_res10 = (longlong *)CONCAT44(local_res10._4_4_,iVar12); + *(undefined8 *)(puVar24 + -8) = 0x140061a4e; + HsmDbgBreakOnStatus(iVar12); if ((int)local_res10 < 0) { - uVar30 = uVar29; + uVar31 = uVar30; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { uVar21 = 0xe; - iVar10 = (int)local_res10; + iVar12 = (int)local_res10; goto LAB_12; } goto LAB_13; } } } LAB_8: - LOCK(); - plVar19 = *(longlong **)(lVar11 + 0x38); - *(longlong *)(lVar11 + 0x38) = 0; - UNLOCK(); - local_res10 = plVar19; - if (plVar19 != (longlong *)0x0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - lVar20 = *(longlong *)(lVar11 + 0x10); - *(undefined8 *)(puVar23 + -8) = 0x1400635d7; - puVar26 = WPP_GLOBAL_Control; - uVar18 = HsmpGetStreamSize(lVar20); - lVar4 = *(longlong *)(lVar20 + 0x10); - *(undefined8 *)(puVar23 + 0x30) = uVar18; - *(undefined4 *)(puVar23 + 0x28) = *(undefined4 *)(lVar20 + 0x1c); - uVar18 = *(undefined8 *)(lVar4 + 0x20); - *(longlong *)(puVar23 + 0x20) = lVar20; - uVar12 = *(undefined8 *)(puVar26 + 0x18); - *(undefined8 *)(puVar23 + -8) = 0x1400635f9; - WPP_SF_iqLi(uVar12,plVar19,puVar26,uVar18); - } - *(uint *)(local_res10 + 6) = *(uint *)(local_res10 + 6) | 0x800; - uVar18 = *(undefined8 *)(*(longlong *)(lVar11 + 0x10) + 8); - *(undefined8 *)(puVar23 + -8) = 0x140063618; - (*DAT_14)(uVar18); - } - if ((*(longlong *)(lVar13 + 0xa0) != 0) && - (*(longlong *)(*(longlong *)(lVar13 + 0xa0) + 0x20) != 0)) { + *(undefined8 *)(puVar24 + -8) = 0x140061514; + HsmpRecallTerminateProgressiveHydration(lVar13,(ulonglong)puVar23); + if ((*(longlong *)(lVar15 + 0xa0) != 0) && + (*(longlong *)(*(longlong *)(lVar15 + 0xa0) + 0x20) != 0)) { if (param_1 != 0) { - *(undefined8 *)(puVar23 + -8) = 0x140062d76; + *(undefined8 *)(puVar24 + -8) = 0x140061574; FltGetRequestorProcess(param_1); } - *(undefined8 *)(puVar23 + -8) = 0x140062d86; - uVar12 = HsmpGetFileLock(lVar13); - uVar18 = *(undefined8 *)(param_2 + 0x20); - *(undefined8 *)(puVar23 + -8) = 0x140062d97; - iVar10 = FsRtlFastUnlockAll(uVar12,uVar18); - lVar20 = local_b8; - if ((((iVar10 + 0x80000000U & 0x80000000) == 0) && (iVar10 != -0x3fffff82)) && + *(undefined8 *)(puVar24 + -8) = 0x140061584; + uVar14 = HsmpGetFileLock(lVar15); + uVar5 = *(undefined8 *)(param_2 + 0x20); + *(undefined8 *)(puVar24 + -8) = 0x140061595; + iVar12 = FsRtlFastUnlockAll(uVar14,uVar5); + lVar4 = local_b8; + if ((((iVar12 + 0x80000000U & 0x80000000) == 0) && (iVar12 != -0x3fffff82)) && (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control && (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0 && (1 < (byte)WPP_GLOBAL_Control[0x29])))))) { - uVar18 = *(undefined8 *)(lVar24 + 0x20); - *(int *)(puVar23 + 0x40) = iVar10; - *(longlong *)(puVar23 + 0x38) = param_1; - uVar12 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(undefined8 *)(puVar23 + 0x30) = uVar18; - *(undefined8 *)(puVar23 + 0x28) = *(undefined8 *)(param_2 + 0x20); - *(longlong *)(puVar23 + 0x20) = lVar13; - *(undefined8 *)(puVar23 + -8) = 0x140062e28; - WPP_SF_qqqiqd(uVar12,0xf,&WPP_e3630ce7b3b33dbc51129e886b811c0d_Traceguids,lVar20); - } - } - if (*(char *)(lVar11 + 0x2d) != '\0') { - uVar18 = *(undefined8 *)(param_2 + 0x20); - uVar12 = *(undefined8 *)(param_2 + 0x18); - *(undefined8 *)(puVar23 + -8) = 0x140063632; - iVar10 = FltFlushBuffers2(uVar12,uVar18,1); - lVar20 = local_b8; - if ((((iVar10 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + uVar5 = *(undefined8 *)(lVar25 + 0x20); + *(int *)(puVar24 + 0x40) = iVar12; + *(longlong *)(puVar24 + 0x38) = param_1; + uVar14 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(undefined8 *)(puVar24 + 0x30) = uVar5; + *(undefined8 *)(puVar24 + 0x28) = *(undefined8 *)(param_2 + 0x20); + *(longlong *)(puVar24 + 0x20) = lVar15; + *(undefined8 *)(puVar24 + -8) = 0x140061626; + WPP_SF_qqqiqd(uVar14,0xf,&WPP_e3630ce7b3b33dbc51129e886b811c0d_Traceguids,lVar4); + } + } + if (*(char *)(lVar13 + 0x2d) != '\0') { + uVar5 = *(undefined8 *)(param_2 + 0x20); + uVar14 = *(undefined8 *)(param_2 + 0x18); + *(undefined8 *)(puVar24 + -8) = 0x140061dbb; + iVar12 = FltFlushBuffers2(uVar14,uVar5,1); + lVar4 = local_b8; + if ((((iVar12 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar18 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(int *)(puVar23 + 0x40) = iVar10; - *(longlong *)(puVar23 + 0x38) = param_1; - *(undefined8 *)(puVar23 + 0x30) = *(undefined8 *)(lVar24 + 0x20); - *(undefined8 *)(puVar23 + 0x28) = *(undefined8 *)(param_2 + 0x20); - *(longlong *)(puVar23 + 0x20) = lVar13; - *(undefined8 *)(puVar23 + -8) = 0x1400636ad; - WPP_SF_qqqiqd(uVar18,0x10,&WPP_e3630ce7b3b33dbc51129e886b811c0d_Traceguids,lVar20); - } - } - lVar13 = *(longlong *)(lVar11 + 0x10); - if ((*(uint *)(lVar11 + 0x28) & 0x10) != 0) { - *(undefined8 *)(puVar23 + -8) = 0x1400636be; - HsmpAcquireReparseUpdateLock(lVar13,'\x01'); - if ((*(uint *)(lVar11 + 0x28) & 0x10) != 0) { - piVar1 = (int *)(lVar13 + 0x70); - *piVar1 = *piVar1 + -1; - if (*piVar1 == 0) { - *(undefined8 *)(puVar23 + -8) = 0x1400636d7; - ExReInitializeRundownProtection(lVar13 + 0x78); - *(undefined8 *)(puVar23 + -8) = 0x1400636ef; - KeSetEvent(lVar13 + 0x80,0,0); + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(int *)(puVar24 + 0x40) = iVar12; + *(longlong *)(puVar24 + 0x38) = param_1; + *(undefined8 *)(puVar24 + 0x30) = *(undefined8 *)(lVar25 + 0x20); + *(undefined8 *)(puVar24 + 0x28) = *(undefined8 *)(param_2 + 0x20); + *(longlong *)(puVar24 + 0x20) = lVar15; + *(undefined8 *)(puVar24 + -8) = 0x140061e36; + WPP_SF_qqqiqd(uVar5,0x10,&WPP_e3630ce7b3b33dbc51129e886b811c0d_Traceguids,lVar4); + } + } + lVar15 = *(longlong *)(lVar13 + 0x10); + if ((*(uint *)(lVar13 + 0x28) & 0x10) != 0) { + *(undefined8 *)(puVar24 + -8) = 0x140061e47; + HsmpAcquireReparseUpdateLock(lVar15,'\x01'); + if ((*(uint *)(lVar13 + 0x28) & 0x10) != 0) { + piVar2 = (int *)(lVar15 + 0x70); + *piVar2 = *piVar2 + -1; + if (*piVar2 == 0) { + *(undefined8 *)(puVar24 + -8) = 0x140061e60; + ExReInitializeRundownProtection(lVar15 + 0x78); + *(undefined8 *)(puVar24 + -8) = 0x140061e78; + KeSetEvent(lVar15 + 0x80,0,0); } - *(uint *)(lVar11 + 0x28) = *(uint *)(lVar11 + 0x28) & 0xffffffef; - } - lVar13 = *(longlong *)(lVar13 + 0x10); - *(undefined8 *)(puVar23 + -8) = 0x140063709; - FltReleasePushLockEx(lVar13 + 0x18,0); + *(uint *)(lVar13 + 0x28) = *(uint *)(lVar13 + 0x28) & 0xffffffef; + } + lVar15 = *(longlong *)(lVar15 + 0x10); + *(undefined8 *)(puVar24 + -8) = 0x140061e92; + FltReleasePushLockEx(lVar15 + 0x18,0); } goto LAB_10; } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { uVar21 = 0xd; LAB_12: - lVar4 = local_b8; - lVar20 = *(longlong *)(lVar13 + 0x10); - *(int *)(puVar23 + 0x40) = iVar10; - uVar18 = *(undefined8 *)(lVar20 + 0x20); - *(longlong *)(puVar23 + 0x38) = param_1; - uVar12 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(undefined8 *)(puVar23 + 0x30) = uVar18; - *(undefined8 *)(puVar23 + 0x28) = *(undefined8 *)(param_2 + 0x20); - *(longlong *)(puVar23 + 0x20) = lVar13; - *(undefined8 *)(puVar23 + -8) = 0x14006357a; - WPP_SF_qqqiqd(uVar12,uVar21,&WPP_e3630ce7b3b33dbc51129e886b811c0d_Traceguids,lVar4); - uVar30 = uVar29; + lVar7 = local_b8; + lVar4 = *(longlong *)(lVar15 + 0x10); + *(int *)(puVar24 + 0x40) = iVar12; + uVar5 = *(undefined8 *)(lVar4 + 0x20); + *(longlong *)(puVar24 + 0x38) = param_1; + uVar14 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(undefined8 *)(puVar24 + 0x30) = uVar5; + *(undefined8 *)(puVar24 + 0x28) = *(undefined8 *)(param_2 + 0x20); + *(longlong *)(puVar24 + 0x20) = lVar15; + *(undefined8 *)(puVar24 + -8) = 0x140061d7a; + WPP_SF_qqqiqd(uVar14,uVar21,&WPP_e3630ce7b3b33dbc51129e886b811c0d_Traceguids,lVar7); + uVar31 = uVar30; } } LAB_13: - uVar29 = uVar30; - *(undefined8 *)(puVar23 + -8) = 0x140063278; - HsmpReleaseFileNameLock(piVar14); + uVar30 = uVar31; + *(undefined8 *)(puVar24 + -8) = 0x140061a78; + HsmpReleaseFileNameLock(piVar16); LAB_7: - if (lVar24 != 0) { - *(undefined8 *)(puVar23 + -8) = 0x140062bf0; - FltReleaseContext(lVar24); - } - if (lVar11 != 0) { - *(undefined8 *)(puVar23 + -8) = 0x140063726; - FltDeleteContext(lVar11); - *(undefined8 *)(puVar23 + -8) = 0x140063735; - FltReleaseContext(lVar11); - lVar11 = *param_3; - puVar23[0x20] = 1; - *(undefined8 *)(puVar23 + -8) = 0x140063751; - HsmpTracePreCallbackExit((ulonglong)uVar29,param_1,lVar11,'\0',puVar23[0x20]); - } - return uVar29; + if (lVar25 != 0) { + *(undefined8 *)(puVar24 + -8) = 0x140061400; + FltReleaseContext(lVar25); + } + if (lVar13 != 0) { + *(undefined8 *)(puVar24 + -8) = 0x140061eaf; + FltDeleteContext(lVar13); + *(undefined8 *)(puVar24 + -8) = 0x140061ebe; + FltReleaseContext(lVar13); + lVar13 = *param_3; + puVar24[0x20] = 1; + *(undefined8 *)(puVar24 + -8) = 0x140061eda; + HsmpTracePreCallbackExit((ulonglong)uVar30,param_1,lVar13,'\0',puVar24[0x20]); + } + return uVar30; } ``` ## CldHsmPopulatePlaceholders ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.48| |i_ratio|0.42| |m_ratio|0.93| |b_ratio|0.29| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldHsmPopulatePlaceholders|CldHsmPopulatePlaceholders| |fullname|CldHsmPopulatePlaceholders|CldHsmPopulatePlaceholders| |refcount|3|3| |`length`|1085|1235| |`called`|
Expand for full list:
CldLookupSyncRoot
CldStreamOpen
CldSyncSendPopulationRequest
CldiStreamAllocateRequest
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamStartCountdownTimer
FLTMGR.SYS::FltGetIoPriorityHint
HsmDbgBreakOnStatusHsmOsGetProcessId
HsmOsGetProcessSessionId
HsmOsGetVmGuid
HsmOsIsSyncProviderProcessFromAttributionInfo
TlmWriteCvForPopulatePlaceholders
WPP_SF_qqqd
WPP_SF_qqqi
WPP_SF_qqqid
_guard_dispatch_icall
|
Expand for full list:
CldLookupSyncRoot
CldStreamOpen
CldSyncSendPopulationRequest
CldiStreamAllocateRequest
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamStartCountdownTimer
FLTMGR.SYS::FltGetIoPriorityHint
Feature_2089223483__private_IsEnabledDeviceUsageNoInlineHsmDbgBreakOnStatus
HsmOsGetProcessId
HsmOsGetProcessSessionId
HsmOsGetVmGuid
HsmOsIsSyncProviderProcessFromAttributionInfo
TlmWriteCvForPopulatePlaceholders
WPP_SF_qqqd
WPP_SF_qqqi
WPP_SF_qqqid
_guard_dispatch_icall
| |calling||| |paramcount|9|9| |`address`|14003f1c0|14003f090| |sig|undefined __fastcall CldHsmPopulatePlaceholders(longlong param_1, uint * param_2, longlong * param_3, undefined8 param_4, wchar_t * param_5, undefined * param_6, undefined8 param_7, void * param_8, undefined8 * param_9)|undefined __fastcall CldHsmPopulatePlaceholders(longlong param_1, uint * param_2, longlong * param_3, undefined8 param_4, wchar_t * param_5, undefined * param_6, undefined8 param_7, void * param_8, undefined8 * param_9)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldHsmPopulatePlaceholders Called Diff ```diff --- CldHsmPopulatePlaceholders called +++ CldHsmPopulatePlaceholders called @@ -10,0 +11 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldHsmPopulatePlaceholders Diff ```diff --- CldHsmPopulatePlaceholders +++ CldHsmPopulatePlaceholders @@ -1,148 +1,181 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void CldHsmPopulatePlaceholders (longlong param_1,uint *param_2,longlong *param_3,undefined8 param_4,wchar_t *param_5 ,undefined *param_6,undefined8 param_7,void *param_8,undefined8 *param_9) { - longlong *plVar1; - longlong lVar2; + longlong lVar1; + bool bVar2; char cVar3; int iVar4; undefined8 *puVar5; ulonglong uVar6; - ulonglong uVar7; - undefined8 *puVar8; - uint *puVar9; - undefined8 uVar10; - undefined2 uVar11; - uint uVar12; - uint *puVar13; - undefined8 uVar14; + undefined8 *puVar7; + ulonglong uVar8; + undefined2 uVar9; + uint uVar10; + uint *puVar11; + uint *puVar12; + undefined8 uVar13; + longlong *plVar14; + undefined8 uVar16; + longlong *plVar15; - puVar9 = (uint *)0x0; - puVar13 = (uint *)0x0; + plVar15 = (longlong *)0x0; + plVar14 = (longlong *)0x0; + puVar11 = (uint *)0x0; + puVar12 = (uint *)0x0; + bVar2 = false; if (DAT_0 == '\0') { iVar4 = -0x3fff30ee; HsmDbgBreakOnStatus(-0x3fff30ee); + puVar12 = puVar11; + plVar14 = plVar15; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar11 = 100; + uVar9 = 0x65; LAB_1: - WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar11, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); - puVar9 = puVar13; + WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar9, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_2); } } else { puVar5 = (undefined8 *)CldLookupSyncRoot(param_3[2]); if (puVar5 == (undefined8 *)0x0) { iVar4 = -0x3fff30ff; HsmDbgBreakOnStatus(-0x3fff30ff); - puVar9 = puVar13; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar11 = 0x65; + uVar9 = 0x66; + puVar12 = puVar11; + plVar14 = plVar15; goto LAB_1; } } else { if (param_3[4] == 0) { iVar4 = CldStreamOpen(param_3); HsmDbgBreakOnStatus(iVar4); if (iVar4 < 0) { - puVar9 = puVar13; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar11 = 0x67; + uVar9 = 0x68; + puVar12 = puVar11; + plVar14 = plVar15; goto LAB_1; } goto LAB_2; } } - plVar1 = (longlong *)param_3[4]; + plVar14 = (longlong *)param_3[4]; if (param_2 != (uint *)0x0) { FltGetIoPriorityHint(param_2); } cVar3 = HsmOsIsSyncProviderProcessFromAttributionInfo(param_1); - uVar6 = HsmOsGetProcessId(param_1); - uVar7 = HsmOsGetProcessSessionId(param_1); - uVar12 = (uint)uVar7; - puVar8 = (undefined8 *)HsmOsGetVmGuid(param_1); - uVar10 = param_7; - puVar9 = CldiStreamAllocateRequest - (puVar8,uVar12,(uint)uVar6,plVar1,(-(uint)(cVar3 != '\0') & 0x40000000) + 2 - ,param_4,param_6,param_7,0,param_9); - if (puVar9 == (uint *)0x0) { + uVar8 = HsmOsGetProcessId(param_1); + uVar6 = HsmOsGetProcessSessionId(param_1); + uVar10 = (uint)uVar6; + puVar7 = (undefined8 *)HsmOsGetVmGuid(param_1); + uVar16 = param_7; + puVar12 = CldiStreamAllocateRequest + (puVar7,uVar10,(uint)uVar8,plVar14, + (-(uint)(cVar3 != '\0') & 0x40000000) + 2,param_4,param_6,param_7,0, + param_9); + if (puVar12 == (uint *)0x0) { iVar4 = -0x3fffff66; HsmDbgBreakOnStatus(-0x3fffff66); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x68, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); + uVar9 = 0x69; + goto LAB_1; } } else { - CldiStreamCdqACQUIRE(*(longlong *)(*plVar1 + 8) + 0x90); - lVar2 = *(longlong *)*plVar1; - uVar14 = *(undefined8 *)(*(longlong *)(lVar2 + 0x10) + 0x20); - uVar6 = CldSyncSendPopulationRequest - (puVar5,5,uVar14,*(longlong *)(puVar9 + 0x1c), - *(undefined8 *)(lVar2 + 0x28),*(void **)(lVar2 + 0x30), - *(int *)(lVar2 + 0x38),uVar10,param_5,param_8, - (undefined8 *)(puVar9 + 0x2a)); - iVar4 = (int)uVar6; + CldiStreamCdqACQUIRE(*(longlong *)(*plVar14 + 8) + 0x90); + bVar2 = true; + lVar1 = *(longlong *)*plVar14; + uVar13 = *(undefined8 *)(*(longlong *)(lVar1 + 0x10) + 0x20); + uVar8 = CldSyncSendPopulationRequest + (puVar5,5,uVar13,*(longlong *)(puVar12 + 0x1c), + *(undefined8 *)(lVar1 + 0x28),*(void **)(lVar1 + 0x30), + *(int *)(lVar1 + 0x38),uVar16,param_5,param_8, + (undefined8 *)(puVar12 + 0x2a)); + iVar4 = (int)uVar8; HsmDbgBreakOnStatus(iVar4); if (iVar4 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqqid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x69, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); + WPP_SF_qqqid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x6a, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_2); } } else { - puVar13 = param_2; - uVar10 = CldiStreamInsertIntoCancelSafeQueue(plVar1,param_2,uVar14,puVar9); - iVar4 = (int)uVar10; + puVar11 = param_2; + iVar4 = CldiStreamInsertIntoCancelSafeQueue(plVar14,param_2,uVar13,puVar12); HsmDbgBreakOnStatus(iVar4); - if (-1 < iVar4) { - CldiStreamCdqRELEASE(*(longlong *)(*plVar1 + 8) + 0x90); + if (iVar4 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qqqi(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x6b,uVar13,param_2); + } + } + else { + CldiStreamCdqRELEASE(*(longlong *)(*plVar14 + 8) + 0x90); + bVar2 = false; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - puVar13 = (uint *)0x6b; - WPP_SF_qqqi(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x6b,uVar14,param_2); + puVar11 = (uint *)0x6c; + WPP_SF_qqqi(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x6c,uVar13,param_2); } - CldiStreamStartCountdownTimer('\0',puVar13,uVar14); - return; - } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqqi(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x6a,uVar14,param_2); + puVar12 = (uint *)0x0; + CldiStreamStartCountdownTimer('\0',puVar11,uVar13); } } - CldiStreamCdqRELEASE(*(longlong *)(*plVar1 + 8) + 0x90); - TlmWriteCvForPopulatePlaceholders((longlong)(puVar9 + 0x2a),iVar4); - if (-1 < iVar4) goto LAB_3; } } } LAB_2: - if (param_6 != (undefined *)0x0) { + uVar8 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 == 0) { + if (bVar2) { + CldiStreamCdqRELEASE(*(longlong *)(*plVar14 + 8) + 0x90); + } + if (puVar12 != (uint *)0x0) { + TlmWriteCvForPopulatePlaceholders((longlong)(puVar12 + 0x2a),iVar4); + } + if ((iVar4 < 0) && (param_6 != (undefined *)0x0)) { + (*(code *)param_6)(param_7,iVar4,0); + } + if (puVar12 == (uint *)0x0) { + return; + } + CldiStreamDeleteRequest(puVar12); + return; + } + if (puVar12 == (uint *)0x0) { + if (!bVar2) goto LAB_3; + } + else { + TlmWriteCvForPopulatePlaceholders((longlong)(puVar12 + 0x2a),iVar4); + if (!bVar2) { + CldiStreamCdqACQUIRE(*(longlong *)(*plVar14 + 8) + 0x90); + } + CldiStreamDeleteRequest(puVar12); + } + CldiStreamCdqRELEASE(*(longlong *)(*plVar14 + 8) + 0x90); +LAB_3: + if ((iVar4 < 0) && (param_6 != (undefined *)0x0)) { (*(code *)param_6)(param_7,iVar4,0); } - if (puVar9 == (uint *)0x0) { - return; - } -LAB_3: - CldiStreamDeleteRequest(puVar9); return; } ``` ## CldHsmTerminateProgressiveHydration ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.48| |i_ratio|0.69| |m_ratio|0.92| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldHsmTerminateProgressiveHydration|CldHsmTerminateProgressiveHydration| |fullname|CldHsmTerminateProgressiveHydration|CldHsmTerminateProgressiveHydration| |refcount|3|3| |`length`|300|351| |`called`|CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion
HsmDbgBreakOnStatus
WPP_SF_qqqd|CldiCanDoNonCdqCompletion
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
WPP_SF_qqqd| |calling||| |paramcount|2|2| |`address`|14003f610|14003f570| |sig|undefined __fastcall CldHsmTerminateProgressiveHydration(longlong param_1, longlong param_2)|undefined __fastcall CldHsmTerminateProgressiveHydration(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldHsmTerminateProgressiveHydration Called Diff ```diff --- CldHsmTerminateProgressiveHydration called +++ CldHsmTerminateProgressiveHydration called @@ -0,0 +1 @@ +CldiCanDoNonCdqCompletion @@ -4,0 +6 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldHsmTerminateProgressiveHydration Diff ```diff --- CldHsmTerminateProgressiveHydration +++ CldHsmTerminateProgressiveHydration @@ -1,42 +1,52 @@ void CldHsmTerminateProgressiveHydration(longlong param_1,longlong param_2) { uint *puVar1; longlong *plVar2; - undefined8 uVar3; - longlong *plVar4; + char cVar3; + ulonglong uVar4; + undefined8 uVar5; + longlong *plVar6; plVar2 = *(longlong **)(param_1 + 0x20); if (*(longlong *)(*(longlong *)(param_1 + 0x10) + 0x20) == 0) { HsmDbgBreakOnStatus(-0x3fff30ff); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x6c, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_1); + WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x6d, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_1); } return; } do { - CldiStreamCdqACQUIRE(*(longlong *)(*plVar2 + 8) + 0x90); - plVar4 = (longlong *)plVar2[2]; while( true ) { - if (plVar4 == plVar2 + 2) { - CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); - return; + CldiStreamCdqACQUIRE(*(longlong *)(*plVar2 + 8) + 0x90); + plVar6 = (longlong *)plVar2[2]; + while( true ) { + if (plVar6 == plVar2 + 2) { + CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); + return; + } + puVar1 = (uint *)(plVar6 + -1); + if (((short)*puVar1 == 1) && (plVar6[0x13] == param_2)) break; + plVar6 = (longlong *)*plVar6; } - puVar1 = (uint *)(plVar4 + -1); - if (((short)*puVar1 == 1) && (plVar4[0x13] == param_2)) break; - plVar4 = (longlong *)*plVar4; - } - uVar3 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); - if ((char)uVar3 == '\0') { + uVar4 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 != 0) break; + cVar3 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if (cVar3 != '\0') goto LAB_0; +LAB_1: CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); } - else { - CldiStreamCompleteCanceledRequest(puVar1,0xc000cf16); - } + cVar3 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if ((cVar3 == '\0') || + (uVar5 = CldiCanDoNonCdqCompletion((longlong)puVar1), (char)uVar5 == '\0')) + goto LAB_1; + CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); +LAB_0: + CldiStreamCompleteCanceledRequest(puVar1,0xc000cf16); } while( true ); } ``` ## CldHsmHydratePlaceholder ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.09| |i_ratio|0.48| |m_ratio|0.98| |b_ratio|0.05| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldHsmHydratePlaceholder|CldHsmHydratePlaceholder| |fullname|CldHsmHydratePlaceholder|CldHsmHydratePlaceholder| |refcount|3|3| |`length`|3740|3828| |`called`|
Expand for full list:
CldLookupSyncRoot
CldStreamOpen
CldSyncSendHydrationRequest
CldiStreamAllocateRequest
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamServiceHydrationRequest
CldiStreamStartCountdownTimer
FLTMGR.SYS::FltAcquirePushLockExclusiveExFLTMGR.SYS::FltAcquirePushLockSharedEx
FLTMGR.SYS::FltGetIoPriorityHint
FLTMGR.SYS::FltReleasePushLockEx
HsmDbgBreakOnStatus
HsmOsGetProcessId
HsmOsGetProcessSessionId
HsmOsGetVmGuid
HsmOsIsSyncProviderProcessFromAttributionInfo
HsmpGetStreamSize
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::FsRtlGetNextBaseMcbEntry
NTOSKRNL.EXE::FsRtlInitializeBaseMcbEx
NTOSKRNL.EXE::KeClearEvent
TlmWriteCvForHydrateData
WPP_SF_iqqiid
WPP_SF_iqqqiid
WPP_SF_qqqd
WPP_SF_qqqiii
WPP_SF_qqqiiid
WPP_SF_qqqiqd
WPP_SF_sqqqqiii
WPP_SF_ssqqqiii
_guard_dispatch_icall
|
Expand for full list:
CldLookupSyncRoot
CldStreamOpen
CldSyncSendHydrationRequest
CldiStreamAllocateRequest
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamServiceHydrationRequest
CldiStreamStartCountdownTimer
FLTMGR.SYS::FltAcquirePushLockExclusiveExFLTMGR.SYS::FltAcquirePushLockSharedEx
FLTMGR.SYS::FltGetIoPriorityHint
FLTMGR.SYS::FltReleasePushLockEx
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
HsmOsGetProcessId
HsmOsGetProcessSessionId
HsmOsGetVmGuid
HsmOsIsSyncProviderProcessFromAttributionInfo
HsmpGetStreamSize
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::FsRtlGetNextBaseMcbEntry
NTOSKRNL.EXE::FsRtlInitializeBaseMcbEx
NTOSKRNL.EXE::KeClearEvent
TlmWriteCvForHydrateData
WPP_SF_iqqiid
WPP_SF_iqqqiid
WPP_SF_qqqd
WPP_SF_qqqiii
WPP_SF_qqqiiid
WPP_SF_qqqiqd
WPP_SF_sqqqqiii
WPP_SF_ssqqqiii
_guard_dispatch_icall
| |calling||| |paramcount|20|20| |`address`|1400802d0|140083330| |`sig`|undefined __fastcall CldHsmHydratePlaceholder(longlong param_1, uint * param_2, longlong * param_3, undefined8 param_4, undefined4 param_5, ulonglong param_6, ulonglong param_7, undefined8 param_8, undefined8 param_9, uint param_10, longlong param_11, undefined8 param_12, uint param_13, undefined * param_14, undefined8 param_15, undefined4 param_16, undefined8 param_17, longlong * param_18, undefined8 param_19, undefined8 * param_20)|undefined __fastcall CldHsmHydratePlaceholder(longlong param_1, uint * param_2, longlong * param_3, undefined8 param_4, undefined4 param_5, ulonglong param_6, longlong param_7, undefined8 param_8, undefined8 param_9, uint param_10, longlong param_11, undefined8 param_12, uint param_13, undefined * param_14, undefined8 param_15, undefined4 param_16, undefined8 param_17, longlong * param_18, undefined8 param_19, undefined8 * param_20)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldHsmHydratePlaceholder Called Diff ```diff --- CldHsmHydratePlaceholder called +++ CldHsmHydratePlaceholder called @@ -14,0 +15 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldHsmHydratePlaceholder Diff ```diff --- CldHsmHydratePlaceholder +++ CldHsmHydratePlaceholder @@ -1,578 +1,640 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Type propagation algorithm not settling */ void CldHsmHydratePlaceholder (longlong param_1,uint *param_2,longlong *param_3,undefined8 param_4, - undefined4 param_5,ulonglong param_6,ulonglong param_7,undefined8 param_8, + undefined4 param_5,ulonglong param_6,longlong param_7,undefined8 param_8, undefined8 param_9,uint param_10,longlong param_11,undefined8 param_12,uint param_13, undefined *param_14,undefined8 param_15,undefined4 param_16,undefined8 param_17, longlong *param_18,undefined8 param_19,undefined8 *param_20) { - undefined4 uVar1; - longlong *plVar2; - longlong *plVar3; + longlong *plVar1; + undefined4 uVar2; + undefined8 uVar3; longlong *plVar4; - undefined8 uVar5; + undefined *puVar5; undefined8 uVar6; - code *pcVar7; - char cVar8; - uint uVar9; - uint uVar10; - uint uVar11; - ulonglong uVar12; - ulonglong uVar13; - undefined8 *puVar14; - uint *puVar15; - char *pcVar16; - longlong lVar17; - longlong lVar18; - undefined8 uVar19; - undefined8 uVar20; - undefined2 uVar21; - uint *puVar22; - undefined1 *puVar23; - uint *puVar24; - uint uVar25; + undefined8 uVar7; + code *pcVar8; + bool bVar9; + bool bVar10; + bool bVar11; + char cVar12; + char cVar13; + uint uVar14; + ulonglong uVar15; + undefined8 *puVar16; + uint *puVar17; + longlong *plVar18; + char *pcVar19; + ulonglong uVar20; + uint uVar21; + undefined2 uVar22; + uint *puVar23; + undefined1 *puVar24; + undefined1 *puVar25; uint uVar26; longlong lVar27; longlong *plVar28; char *pcVar29; - uint uVar30; - longlong *local_res18; - undefined8 local_res20; + longlong *plVar30; undefined1 auStackY_158 [8]; undefined1 auStackY_150 [24]; - longlong *local_80; + char local_b8; + char local_b7 [7]; + undefined8 local_b0; + uint local_a8; + longlong local_a0; + longlong *local_98; + longlong *local_90; + uint local_88; + longlong local_80; longlong local_78; longlong local_70; - longlong local_68; + int local_68; longlong local_60; - undefined8 *local_58; + longlong local_58; + undefined8 *local_50; - uVar30 = param_10; - puVar15 = (uint *)0x0; - puVar24 = (uint *)0x0; - uVar10 = 0; - param_10 = param_10 & 0xffffff00; - uVar20 = *(undefined8 *)(*(longlong *)(*param_3 + 0x10) + 0x20); - uVar9 = uVar30 & 0x40; - puVar22 = puVar24; - local_res20 = param_4; + puVar24 = auStackY_158; + puVar17 = (uint *)0x0; + uVar14 = 0; + plVar30 = (longlong *)0x0; + bVar9 = false; + local_b8 = '\0'; + local_b0 = *(undefined8 *)(*(longlong *)(*param_3 + 0x10) + 0x20); + local_88 = param_10 & 0x40; + bVar10 = false; + bVar11 = false; if (DAT_0 == '\0') { - uVar10 = 0xc000cf12; + uVar14 = 0xc000cf12; HsmDbgBreakOnStatus(-0x3fff30ee); - puVar23 = auStackY_158; - puVar22 = puVar15; - uVar19 = param_17; + puVar25 = auStackY_158; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (puVar23 = auStackY_158, (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (puVar23 = auStackY_158, 1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar21 = 0x53; + (puVar25 = auStackY_158, (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (puVar25 = auStackY_158, 1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar22 = 0x54; LAB_1: - WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar21, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); - puVar23 = auStackY_158; - puVar22 = puVar24; - uVar19 = param_17; + WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar22, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_2); + puVar25 = auStackY_158; } } else { - local_58 = (undefined8 *)CldLookupSyncRoot(param_3[2]); - if (local_58 == (undefined8 *)0x0) { - uVar10 = 0xc000cf01; + plVar28 = param_3; + local_50 = (undefined8 *)CldLookupSyncRoot(param_3[2]); + if (local_50 == (undefined8 *)0x0) { + uVar14 = 0xc000cf01; HsmDbgBreakOnStatus(-0x3fff30ff); - puVar23 = auStackY_158; - uVar19 = param_17; + puVar25 = auStackY_158; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (puVar23 = auStackY_158, (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (puVar23 = auStackY_158, 1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar21 = 0x54; + (puVar25 = auStackY_158, (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (puVar25 = auStackY_158, 1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar22 = 0x55; goto LAB_1; } } - else if (param_3[4] == 0) { - uVar10 = CldStreamOpen(param_3); - HsmDbgBreakOnStatus(uVar10); - if (-1 < (int)uVar10) goto LAB_2; - puVar23 = auStackY_158; - uVar19 = param_17; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - (puVar23 = auStackY_158, (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) == 0)) || - (puVar23 = auStackY_158, (byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_3; - uVar21 = 0x56; - uVar20 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); -LAB_4: - WPP_SF_qqqiqd(uVar20,uVar21,&WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); - puVar23 = auStackY_158; - puVar22 = puVar15; - uVar19 = param_17; - } else { -LAB_2: - plVar2 = (longlong *)param_3[4]; - uVar11 = ~(*(int *)(*(longlong *)*plVar2 + 0x1c) << 0xb) & 0x1000; - plVar28 = plVar2; - local_60 = HsmpGetStreamSize(*param_3); - if (local_60 < (longlong)(param_6 + param_7)) { - param_7 = local_60 - param_6; + if (param_3[4] == 0) { + uVar14 = CldStreamOpen(param_3); + HsmDbgBreakOnStatus(uVar14); + if ((int)uVar14 < 0) { + puVar25 = auStackY_158; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar25 = auStackY_158, (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (puVar25 = auStackY_158, 1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qqqiqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x57, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_2); + puVar25 = auStackY_158; + } + goto LAB_2; + } } - puVar23 = auStackY_158; - if (param_7 == 0) goto LAB_5; - if (param_2 != (uint *)0x0) { - FltGetIoPriorityHint(param_2); + plVar30 = (longlong *)param_3[4]; + local_a8 = ~(*(int *)(*(longlong *)*plVar30 + 0x1c) << 0xb) & 0x1000; + local_58 = HsmpGetStreamSize(*param_3); + if (local_58 < (longlong)(param_6 + param_7)) { + param_7 = local_58 - param_6; } - uVar25 = (-(uint)((uVar30 & 0x80) != 0) & 0x80000000) + 1; - cVar8 = HsmOsIsSyncProviderProcessFromAttributionInfo(param_1); - uVar26 = uVar25 | 0x40000000; - if (cVar8 == '\0') { - uVar26 = uVar25; - } - uVar12 = HsmOsGetProcessId(param_1); - uVar13 = HsmOsGetProcessSessionId(param_1); - uVar25 = (uint)uVar13; - puVar14 = (undefined8 *)HsmOsGetVmGuid(param_1); - puVar15 = CldiStreamAllocateRequest - (puVar14,uVar25,(uint)uVar12,plVar2,uVar26,local_res20,param_14,param_17,0 - ,param_20); - if (puVar15 == (uint *)0x0) { - uVar10 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - puVar23 = auStackY_158; - puVar22 = puVar15; - uVar19 = param_17; - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - (puVar23 = auStackY_158, (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) == 0)) || - (puVar23 = auStackY_158, (byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_3; - uVar21 = 0x57; - uVar20 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - goto LAB_4; - } - cVar8 = FsRtlInitializeBaseMcbEx(puVar15 + 0x4c,1); - if (cVar8 == '\0') { - uVar30 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - puVar23 = auStackY_158; - uVar19 = param_17; - uVar10 = 0xc000009a; + puVar25 = auStackY_158; + local_a0 = param_7; + if (param_7 == 0) { +LAB_3: + uVar3 = local_b0; + bVar9 = false; + uVar20 = param_6; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (puVar23 = auStackY_158, uVar10 = uVar30, - (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (puVar23 = auStackY_158, 1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqqiqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x58, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); - puVar23 = auStackY_158; - uVar19 = param_17; - } -LAB_6: - *(undefined8 *)(puVar23 + -8) = 0x1400806ac; - TlmWriteCvForHydrateData((longlong)(puVar15 + 0x2a),uVar10); + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + lVar27 = *plVar30; + uVar6 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(uint *)(puVar25 + 0x48) = uVar14; + *(longlong *)(puVar25 + 0x40) = param_7; + *(ulonglong *)(puVar25 + 0x38) = param_6; + *(uint **)(puVar25 + 0x30) = param_2; + *(uint **)(puVar25 + 0x28) = puVar17; + *(longlong *)(puVar25 + 0x20) = lVar27; + *(undefined8 *)(puVar25 + -8) = 0x1400840c0; + WPP_SF_iqqqiid(uVar6,param_6,plVar28,local_b0); + } + if (param_14 != (undefined *)0x0) { + plVar28 = (longlong *)0x0; + uVar20 = (ulonglong)uVar14; + *(undefined8 *)(puVar25 + -8) = 0x1400840e8; + (*(code *)param_14)(param_17); + } + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar6 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(uint *)(puVar25 + 0x40) = uVar14; + *(longlong *)(puVar25 + 0x38) = local_a0; + *(ulonglong *)(puVar25 + 0x30) = param_6; + *(uint **)(puVar25 + 0x28) = param_2; + *(uint **)(puVar25 + 0x20) = puVar17; + *(undefined8 *)(puVar25 + -8) = 0x14008412e; + WPP_SF_iqqiid(uVar6,uVar20,plVar28,uVar3); + } } else { - uVar26 = -(uint)(uVar9 != 0) & 4 | puVar15[0x5c] & 0xfffffffb; - uVar26 = (uVar26 ^ uVar30 >> 3) & 1 ^ uVar26; - puVar15[0x5c] = (uVar26 ^ uVar30 >> 3) & 2 ^ uVar26; - *(ulonglong *)(puVar15 + 0x58) = param_6; - *(ulonglong *)(puVar15 + 0x5a) = param_7; - *(longlong *)(puVar15 + 0x52) = param_11; - *(undefined8 *)(puVar15 + 0x54) = param_12; - puVar15[0x56] = param_13; - if (uVar9 == 0) { - FltAcquirePushLockSharedEx(plVar2 + 4,0); - for (local_res18 = (longlong *)plVar2[9]; local_res18 != plVar2 + 9; - local_res18 = (longlong *)*local_res18) { - uVar13 = (ulonglong)*(uint *)(local_res18 + 4); - uVar12 = CldiStreamServiceHydrationRequest - (plVar2,local_res18[3],uVar13,(void *)local_res18[2], - (longlong)puVar15,(undefined1 *)¶m_10,(undefined1 *)0x0); - uVar10 = (uint)uVar12; - HsmDbgBreakOnStatus(uVar10); - if ((-1 < (int)uVar10) && ((char)param_10 != '\0')) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0 && - (3 < (byte)WPP_GLOBAL_Control[0x29])))) { - WPP_SF_qqqiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x59,uVar13,param_2); + if (param_2 != (uint *)0x0) { + FltGetIoPriorityHint(param_2); + } + uVar26 = (-(uint)((param_10 & 0x80) != 0) & 0x80000000) + 1; + cVar12 = HsmOsIsSyncProviderProcessFromAttributionInfo(param_1); + uVar21 = uVar26 | 0x40000000; + if (cVar12 == '\0') { + uVar21 = uVar26; + } + uVar20 = HsmOsGetProcessId(param_1); + uVar15 = HsmOsGetProcessSessionId(param_1); + uVar26 = (uint)uVar15; + puVar16 = (undefined8 *)HsmOsGetVmGuid(param_1); + puVar17 = CldiStreamAllocateRequest + (puVar16,uVar26,(uint)uVar20,plVar30,uVar21,param_4,param_14,param_17,0, + param_20); + bVar9 = bVar11; + if (puVar17 == (uint *)0x0) { + HsmDbgBreakOnStatus(-0x3fffff66); + puVar25 = auStackY_158; + uVar14 = 0xc000009a; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar25 = auStackY_158, uVar14 = 0xc000009a, + (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (puVar25 = auStackY_158, 1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar22 = 0x58; +LAB_4: + uVar14 = 0xc000009a; +LAB_5: + uVar3 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(longlong **)(puVar24 + 0x20) = param_3; + *(undefined8 *)(puVar24 + -8) = 0x140083645; + WPP_SF_qqqiqd(uVar3,uVar22,&WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_2); + puVar25 = puVar24; + bVar9 = bVar10; + } + } + else { + cVar12 = FsRtlInitializeBaseMcbEx(puVar17 + 0x4c,1); + param_7 = local_a0; + if (cVar12 == '\0') { + uVar14 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + puVar25 = auStackY_158; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (puVar25 = auStackY_158, (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (puVar25 = auStackY_158, 1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar22 = 0x59; + goto LAB_4; + } + } + else { + plVar28 = (longlong *)(ulonglong)local_88; + *(longlong *)(puVar17 + 0x5a) = local_a0; + uVar21 = -(uint)(local_88 != 0) & 4 | puVar17[0x5c] & 0xfffffffb; + uVar21 = (param_10 >> 3 ^ uVar21) & 1 ^ uVar21; + *(ulonglong *)(puVar17 + 0x58) = param_6; + *(longlong *)(puVar17 + 0x52) = param_11; + *(undefined8 *)(puVar17 + 0x54) = param_12; + puVar17[0x56] = param_13; + puVar17[0x5c] = (param_10 >> 3 ^ uVar21) & 2 ^ uVar21; + if (local_88 == 0) { + FltAcquirePushLockSharedEx(plVar30 + 4,0); + for (local_90 = (longlong *)plVar30[9]; local_90 != plVar30 + 9; + local_90 = (longlong *)*local_90) { + plVar28 = (longlong *)(ulonglong)*(uint *)(local_90 + 4); + uVar20 = CldiStreamServiceHydrationRequest + (plVar30,local_90[3],(size_t)plVar28,(void *)local_90[2], + (longlong)puVar17,&local_b8,(undefined1 *)0x0); + uVar14 = (uint)uVar20; + HsmDbgBreakOnStatus(uVar14); + if ((-1 < (int)uVar14) && (local_b8 != '\0')) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0 && + (3 < (byte)WPP_GLOBAL_Control[0x29])))) { + WPP_SF_qqqiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x5a,plVar28,param_2); + } + break; + } } - break; - } - } - FltReleasePushLockEx(plVar2 + 4,0); - } - if (param_11 != 0) { -LAB_7: - FltAcquirePushLockSharedEx(plVar2 + 0xb,0); - plVar28 = (longlong *)plVar2[0xc]; - do { - local_80 = plVar2 + 0xb; - if (((char)param_10 != '\0') || (plVar28 == plVar2 + 0xc)) { + FltReleasePushLockEx(plVar30 + 4,0); + } + puVar24 = auStackY_158; + if (param_11 != 0) { + do { + FltAcquirePushLockSharedEx(plVar30 + 0xb,0); + plVar18 = (longlong *)plVar30[0xc]; + while( true ) { + puVar24 = auStackY_158; + param_7 = local_a0; + local_98 = plVar18; + if ((local_b8 != '\0') || (puVar24 = auStackY_158, plVar18 == plVar30 + 0xc)) + goto LAB_6; + plVar1 = plVar18 + -2; + local_b7[0] = '\0'; + cVar12 = ExAcquireRundownProtection(plVar18 + 3); + if (cVar12 == '\0') break; + plVar28 = (longlong *)(ulonglong)*(uint *)(plVar18 + 6); + uVar20 = CldiStreamServiceHydrationRequest + (plVar30,plVar18[5],(size_t)plVar28, + (void *)((longlong)plVar18 + 0x34),(longlong)puVar17,&local_b8 + ,local_b7); + uVar14 = (uint)uVar20; + HsmDbgBreakOnStatus(uVar14); + if (local_b7[0] != '\0') { + FltAcquirePushLockExclusiveEx(&DAT_7); + plVar4 = (longlong *)*plVar1; + if (plVar4 == plVar1) goto LAB_8; + if (((longlong *)plVar4[1] == plVar1) && + (puVar16 = (undefined8 *)plVar18[-1], (longlong *)*puVar16 == plVar1)) { + *puVar16 = plVar4; + plVar4[1] = (longlong)puVar16; + plVar18[-1] = (longlong)plVar1; + *plVar1 = (longlong)plVar1; + if ((param_10 & 0x10) == 0) { + if ((undefined8 *)*DAT_9 == &DAT_1400298f0) { + *plVar1 = (longlong)&DAT_10; + plVar18[-1] = (longlong)DAT_9; + *DAT_9 = (longlong)plVar1; + DAT_9 = plVar1; + goto LAB_8; + } + } + else if ((undefined8 *)*DAT_11 == &DAT_140029900) { + *plVar1 = (longlong)&DAT_12; + plVar18[-1] = (longlong)DAT_11; + *DAT_11 = (longlong)plVar1; + DAT_11 = plVar1; LAB_8: - FltReleasePushLockEx(plVar2 + 0xb,0); - break; - } - plVar4 = plVar28 + -2; - local_res18 = (longlong *)((ulonglong)local_res18 & 0xffffffffffffff00); - cVar8 = ExAcquireRundownProtection(plVar28 + 3); - if (cVar8 == '\0') { - lVar27 = *plVar28; - if ((*(longlong **)(lVar27 + 8) != plVar28) || - (plVar4 = (longlong *)plVar28[1], (longlong *)*plVar4 != plVar28)) - goto LAB_9; - *plVar4 = lVar27; - *(longlong **)(lVar27 + 8) = plVar4; - plVar28[1] = (longlong)plVar28; - *plVar28 = (longlong)plVar28; - FltReleasePushLockEx(local_80); - goto LAB_7; - } - uVar13 = (ulonglong)*(uint *)(plVar28 + 6); - uVar12 = CldiStreamServiceHydrationRequest - (plVar2,plVar28[5],uVar13,(void *)((longlong)plVar28 + 0x34), - (longlong)puVar15,(undefined1 *)¶m_10,(undefined1 *)&local_res18 - ); - uVar10 = (uint)uVar12; - HsmDbgBreakOnStatus(uVar10); - if ((char)local_res18 != '\0') { - FltAcquirePushLockExclusiveEx(&DAT_10); - plVar3 = (longlong *)*plVar4; - if (plVar3 == plVar4) goto LAB_11; - if (((longlong *)plVar3[1] != plVar4) || - (puVar14 = (undefined8 *)plVar28[-1], (longlong *)*puVar14 != plVar4)) { -LAB_9: - pcVar7 = (code *)swi(0x29); - (*pcVar7)(3); - puVar23 = auStackY_150; - goto LAB_12; - } - *puVar14 = plVar3; - plVar3[1] = (longlong)puVar14; - plVar28[-1] = (longlong)plVar4; - *plVar4 = (longlong)plVar4; - if ((uVar30 & 0x10) == 0) { - if ((undefined8 *)*DAT_13 != &DAT_1400298f0) goto LAB_140080b31; - *plVar4 = (longlong)&DAT_14; - plVar28[-1] = (longlong)DAT_13; - *DAT_13 = (longlong)plVar4; - DAT_13 = plVar4; - } - else { - if ((undefined8 *)*DAT_15 != &DAT_140029900) goto LAB_140080b31; - *plVar4 = (longlong)&DAT_16; - plVar28[-1] = (longlong)DAT_15; - *DAT_15 = (longlong)plVar4; - DAT_15 = plVar4; - } -LAB_11: - FltReleasePushLockEx(&DAT_10); - } - ExReleaseRundownProtection(plVar28 + 3); - if ((-1 < (int)uVar10) && ((char)param_10 != '\0')) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0 && - (3 < (byte)WPP_GLOBAL_Control[0x29])))) { - WPP_SF_qqqiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x5a,uVar13,param_2); - } - goto LAB_8; - } - if ((int)plVar2[0xe] != 0) goto LAB_17; - plVar28 = (longlong *)*plVar28; - } while( true ); - } - if (param_18 != (longlong *)0x0) { - KeClearEvent(plVar2[8]); - *param_18 = plVar2[8]; - } - puVar23 = auStackY_158; - plVar28 = plVar2; - if ((char)param_10 == '\0') { - puVar23 = auStackY_158; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (puVar23 = auStackY_158, (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (puVar23 = auStackY_158, 3 < (byte)WPP_GLOBAL_Control[0x29])) { - pcVar16 = "HYDRATE"; - pcVar29 = "background"; - if (uVar9 != 0) { - pcVar16 = "VALIDATE"; - } - if (param_2 != (uint *)0x0) { - pcVar29 = "foreground"; - } - WPP_SF_ssqqqiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),"foreground",uVar20,pcVar29, - pcVar16); - puVar23 = auStackY_158; - } -LAB_12: - uVar13 = (ulonglong)uVar11; - local_res18 = (longlong *)((ulonglong)local_res18 & 0xffffffff00000000); - local_80 = (longlong *)0x0; - uVar12 = ~(uVar13 - 1) & param_6; - lVar17 = (longlong)uVar12 / (longlong)uVar13; - lVar18 = (longlong)(((param_7 - 1) + param_6 + uVar13 & ~(uVar13 - 1)) - uVar12) / - (longlong)uVar13; - lVar27 = *(longlong *)(*plVar2 + 8); - *(undefined8 *)(puVar23 + -8) = 0x140080b9a; - CldiStreamCdqACQUIRE(lVar27 + 0x90); - param_10 = CONCAT31(param_10._1_3_,1); - local_70 = 0; - local_68 = 0; - local_78 = 0; - while( true ) { - *(longlong **)(puVar23 + 0x20) = &local_78; - plVar28 = &local_70; - *(undefined8 *)(puVar23 + -8) = 0x140080bd4; - cVar8 = FsRtlGetNextBaseMcbEntry - (puVar15 + 0x4c,(ulonglong)local_res18 & 0xffffffff,plVar28,&local_68) - ; - if (cVar8 == '\0') break; - if (local_68 == -1) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar19 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(ulonglong *)(puVar23 + 0x40) = (ulonglong)uVar11 * local_78; - lVar27 = (lVar17 + local_70) * (ulonglong)uVar11; - *(longlong *)(puVar23 + 0x38) = lVar27; - *(undefined8 *)(puVar23 + 0x30) = uVar20; - *(longlong **)(puVar23 + 0x28) = param_3; - *(uint **)(puVar23 + 0x20) = puVar15; - *(undefined8 *)(puVar23 + -8) = 0x140080c4a; - WPP_SF_qqqiii(uVar19,0x5c,lVar27,param_2); - } - plVar28 = (longlong *)*plVar2; - *(uint **)(puVar23 + 0x90) = puVar15 + 0x2a; - lVar27 = *plVar28; - uVar1 = *(undefined4 *)(lVar27 + 0x38); - uVar19 = *(undefined8 *)(lVar27 + 0x30); - uVar5 = *(undefined8 *)(lVar27 + 0x28); - param_10 = param_10 & 0xffffff00; - uVar6 = *(undefined8 *)(*(longlong *)(lVar27 + 0x10) + 0x20); - *(undefined8 *)(puVar23 + 0x88) = param_19; - *(undefined4 *)(puVar23 + 0x80) = param_16; - *(undefined8 *)(puVar23 + 0x78) = param_15; - *(undefined8 *)(puVar23 + 0x70) = param_9; - *(undefined8 *)(puVar23 + 0x68) = param_8; - *(ulonglong *)(puVar23 + 0x60) = (ulonglong)uVar11 * local_78; - lVar27 = *(longlong *)(puVar15 + 0x1c); - *(ulonglong *)(puVar23 + 0x58) = (lVar17 + local_70) * (ulonglong)uVar11; - *(uint *)(puVar23 + 0x50) = uVar30; - *(uint *)(puVar23 + 0x48) = uVar11; - *(longlong *)(puVar23 + 0x40) = local_60; - *(undefined4 *)(puVar23 + 0x38) = param_5; - *(undefined4 *)(puVar23 + 0x30) = uVar1; - *(undefined8 *)(puVar23 + 0x28) = uVar19; - *(undefined8 *)(puVar23 + 0x20) = uVar5; - *(undefined8 *)(puVar23 + -8) = 0x140080d16; - uVar12 = CldSyncSendHydrationRequest - (local_58,5,uVar6,lVar27,*(undefined8 *)(puVar23 + 0x20), - *(void **)(puVar23 + 0x28),*(int *)(puVar23 + 0x30), - *(undefined4 *)(puVar23 + 0x38),*(longlong *)(puVar23 + 0x40), - *(uint *)(puVar23 + 0x48),*(uint *)(puVar23 + 0x50), - *(ulonglong *)(puVar23 + 0x58),*(longlong *)(puVar23 + 0x60), - *(undefined8 *)(puVar23 + 0x68),*(undefined8 *)(puVar23 + 0x70), - *(undefined8 *)(puVar23 + 0x78),puVar23[0x80], - *(void **)(puVar23 + 0x88),*(undefined8 **)(puVar23 + 0x90)); - uVar10 = (uint)uVar12; - *(undefined8 *)(puVar23 + -8) = 0x140080d20; - HsmDbgBreakOnStatus(uVar10); - if ((int)uVar10 < 0) { - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_18; - plVar28 = (longlong *)((lVar17 + local_70) * (ulonglong)uVar11); - *(uint *)(puVar23 + 0x48) = uVar10; - uVar21 = 0x5d; - *(ulonglong *)(puVar23 + 0x40) = (ulonglong)uVar11 * local_78; - *(longlong **)(puVar23 + 0x38) = plVar28; - goto LAB_19; - } - } - local_res18 = (longlong *)CONCAT44(local_res18._4_4_,(int)local_res18 + 1); - local_80 = (longlong *)(local_78 + local_70); - } - if ((longlong)local_80 < lVar18) { + FltReleasePushLockEx(&DAT_7); + goto LAB_13; + } + } +LAB_14: + pcVar8 = (code *)swi(0x29); + (*pcVar8)(3); + puVar24 = auStackY_150; + param_7 = local_a0; +LAB_6: + *(undefined8 *)(puVar24 + -8) = 0x140083a26; + FltReleasePushLockEx(plVar30 + 0xb,0); + goto LAB_15; + } +LAB_13: + ExReleaseRundownProtection(plVar18 + 3); + param_7 = local_a0; + if ((-1 < (int)uVar14) && (local_b8 != '\0')) { + puVar24 = auStackY_158; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((puVar24 = auStackY_158, + (*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0 && + (puVar24 = auStackY_158, 3 < (byte)WPP_GLOBAL_Control[0x29])))) { + WPP_SF_qqqiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x5b,plVar28,param_2) + ; + puVar24 = auStackY_158; + } + goto LAB_6; + } + if ((int)plVar30[0xe] != 0) goto LAB_16; + plVar18 = (longlong *)*local_98; + } + lVar27 = *local_98; + if ((*(longlong **)(lVar27 + 8) != local_98) || + (plVar18 = (longlong *)local_98[1], (longlong *)*plVar18 != local_98)) + goto LAB_14; + *plVar18 = lVar27; + *(longlong **)(lVar27 + 8) = plVar18; + local_98[1] = (longlong)local_98; + *local_98 = (longlong)local_98; +LAB_16: + FltReleasePushLockEx(plVar30 + 0xb); + } while( true ); + } +LAB_15: + if (param_18 != (longlong *)0x0) { + lVar27 = plVar30[8]; + *(undefined8 *)(puVar24 + -8) = 0x140083a40; + KeClearEvent(lVar27); + *param_18 = plVar30[8]; + } + puVar25 = puVar24; + if (local_b8 != '\0') goto LAB_3; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar19 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - lVar27 = (lVar17 + (longlong)local_80) * (ulonglong)uVar11; - *(ulonglong *)(puVar23 + 0x40) = (lVar18 - (longlong)local_80) * (ulonglong)uVar11; - *(longlong *)(puVar23 + 0x38) = lVar27; - *(undefined8 *)(puVar23 + 0x30) = uVar20; - *(longlong **)(puVar23 + 0x28) = param_3; - *(uint **)(puVar23 + 0x20) = puVar15; - *(undefined8 *)(puVar23 + -8) = 0x140080e22; - WPP_SF_qqqiii(uVar19,0x5e,lVar27,param_2); - } - lVar18 = (lVar18 - (longlong)local_80) * (ulonglong)uVar11; - local_res18 = (longlong *)(((longlong)local_80 + lVar17) * (ulonglong)uVar11); - lVar27 = *(longlong *)*plVar2; - uVar1 = *(undefined4 *)(lVar27 + 0x38); - uVar19 = *(undefined8 *)(lVar27 + 0x30); - uVar5 = *(undefined8 *)(lVar27 + 0x28); - plVar28 = *(longlong **)(*(longlong *)(lVar27 + 0x10) + 0x20); - *(uint **)(puVar23 + 0x90) = puVar15 + 0x2a; - *(undefined8 *)(puVar23 + 0x88) = param_19; - *(undefined4 *)(puVar23 + 0x80) = param_16; - *(undefined8 *)(puVar23 + 0x78) = param_15; - *(undefined8 *)(puVar23 + 0x70) = param_9; - *(undefined8 *)(puVar23 + 0x68) = param_8; - *(longlong *)(puVar23 + 0x60) = lVar18; - *(longlong **)(puVar23 + 0x58) = local_res18; - *(uint *)(puVar23 + 0x50) = uVar30; - *(uint *)(puVar23 + 0x48) = uVar11; - *(longlong *)(puVar23 + 0x40) = local_60; - *(undefined4 *)(puVar23 + 0x38) = param_5; - *(undefined4 *)(puVar23 + 0x30) = uVar1; - *(undefined8 *)(puVar23 + 0x28) = uVar19; - lVar27 = *(longlong *)(puVar15 + 0x1c); - *(undefined8 *)(puVar23 + 0x20) = uVar5; - *(undefined8 *)(puVar23 + -8) = 0x140080ef4; - uVar12 = CldSyncSendHydrationRequest - (local_58,5,plVar28,lVar27,*(undefined8 *)(puVar23 + 0x20), - *(void **)(puVar23 + 0x28),*(int *)(puVar23 + 0x30), - *(undefined4 *)(puVar23 + 0x38),*(longlong *)(puVar23 + 0x40), - *(uint *)(puVar23 + 0x48),*(uint *)(puVar23 + 0x50), - *(ulonglong *)(puVar23 + 0x58),*(longlong *)(puVar23 + 0x60), - *(undefined8 *)(puVar23 + 0x68),*(undefined8 *)(puVar23 + 0x70), - *(undefined8 *)(puVar23 + 0x78),puVar23[0x80], - *(void **)(puVar23 + 0x88),*(undefined8 **)(puVar23 + 0x90)); - uVar10 = (uint)uVar12; - *(undefined8 *)(puVar23 + -8) = 0x140080efe; - HsmDbgBreakOnStatus(uVar10); - if ((int)uVar10 < 0) { + *(longlong *)(puVar24 + 0x50) = param_7; + pcVar19 = "HYDRATE"; + pcVar29 = "background"; + if (local_88 != 0) { + pcVar19 = "VALIDATE"; + } + if (param_2 != (uint *)0x0) { + pcVar29 = "foreground"; + } + *(ulonglong *)(puVar24 + 0x48) = param_6; + *(undefined8 *)(puVar24 + 0x40) = local_b0; + *(longlong **)(puVar24 + 0x38) = param_3; + *(uint **)(puVar24 + 0x30) = puVar17; + *(uint **)(puVar24 + 0x28) = param_2; + uVar3 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(char **)(puVar24 + 0x20) = pcVar19; + *(undefined8 *)(puVar24 + -8) = 0x140083add; + WPP_SF_ssqqqiii(uVar3,WPP_GLOBAL_Control,local_b0,pcVar29,*(char **)(puVar24 + 0x20)); + } + uVar15 = (ulonglong)local_a8; + local_68 = 0; + local_90 = (longlong *)0x0; + uVar20 = ~(uVar15 - 1) & param_6; + local_98 = (longlong *)((longlong)uVar20 / (longlong)uVar15); + lVar27 = *(longlong *)(*plVar30 + 8); + local_70 = (longlong)((local_a0 + -1 + param_6 + uVar15 & ~(uVar15 - 1)) - uVar20) / + (longlong)uVar15; + *(undefined8 *)(puVar24 + -8) = 0x140083b3e; + CldiStreamCdqACQUIRE(lVar27 + 0x90); + bVar10 = true; + bVar9 = true; + local_78 = 0; + local_60 = 0; + local_80 = 0; + plVar28 = &local_78; + local_b7[0] = '\x01'; + *(longlong **)(puVar24 + 0x20) = &local_80; + *(undefined8 *)(puVar24 + -8) = 0x140083b78; + cVar13 = FsRtlGetNextBaseMcbEntry(puVar17 + 0x4c,0,plVar28,&local_60); + cVar12 = local_b7[0]; + while (local_b7[0] = cVar12, cVar13 != '\0') { + if (local_60 == -1) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { + puVar5 = *(undefined **)((longlong)WPP_GLOBAL_Control + 0x18); + *(ulonglong *)(puVar24 + 0x40) = (ulonglong)local_a8 * local_80; + lVar27 = ((longlong)local_98 + local_78) * (ulonglong)local_a8; + *(longlong *)(puVar24 + 0x38) = lVar27; + *(undefined8 *)(puVar24 + 0x30) = local_b0; + *(longlong **)(puVar24 + 0x28) = param_3; + *(uint **)(puVar24 + 0x20) = puVar17; + *(undefined8 *)(puVar24 + -8) = 0x140083bef; + WPP_SF_qqqiii(puVar5,0x5d,lVar27,param_2); + } + lVar27 = *(longlong *)*plVar30; + uVar2 = *(undefined4 *)(lVar27 + 0x38); + uVar3 = *(undefined8 *)(lVar27 + 0x30); + uVar6 = *(undefined8 *)(lVar27 + 0x28); + lVar27 = *(longlong *)(lVar27 + 0x10); + *(uint **)(puVar24 + 0x90) = puVar17 + 0x2a; + local_b7[0] = '\0'; + uVar7 = *(undefined8 *)(lVar27 + 0x20); + *(undefined8 *)(puVar24 + 0x88) = param_19; + *(undefined4 *)(puVar24 + 0x80) = param_16; + *(undefined8 *)(puVar24 + 0x78) = param_15; + *(undefined8 *)(puVar24 + 0x70) = param_9; + *(undefined8 *)(puVar24 + 0x68) = param_8; + *(ulonglong *)(puVar24 + 0x60) = (ulonglong)local_a8 * local_80; + lVar27 = *(longlong *)(puVar17 + 0x1c); + *(ulonglong *)(puVar24 + 0x58) = + ((longlong)local_98 + local_78) * (ulonglong)local_a8; + *(uint *)(puVar24 + 0x50) = param_10; + *(uint *)(puVar24 + 0x48) = local_a8; + *(longlong *)(puVar24 + 0x40) = local_58; + *(undefined4 *)(puVar24 + 0x38) = param_5; + *(undefined4 *)(puVar24 + 0x30) = uVar2; + *(undefined8 *)(puVar24 + 0x28) = uVar3; + *(undefined8 *)(puVar24 + 0x20) = uVar6; + *(undefined8 *)(puVar24 + -8) = 0x140083cb5; + uVar20 = CldSyncSendHydrationRequest + (local_50,5,uVar7,lVar27,*(undefined8 *)(puVar24 + 0x20), + *(void **)(puVar24 + 0x28),*(int *)(puVar24 + 0x30), + *(undefined4 *)(puVar24 + 0x38),*(longlong *)(puVar24 + 0x40), + *(uint *)(puVar24 + 0x48),*(uint *)(puVar24 + 0x50), + *(ulonglong *)(puVar24 + 0x58),*(longlong *)(puVar24 + 0x60), + *(undefined8 *)(puVar24 + 0x68),*(undefined8 *)(puVar24 + 0x70), + *(undefined8 *)(puVar24 + 0x78),puVar24[0x80], + *(void **)(puVar24 + 0x88),*(undefined8 **)(puVar24 + 0x90)); + uVar14 = (uint)uVar20; + *(undefined8 *)(puVar24 + -8) = 0x140083cbf; + HsmDbgBreakOnStatus(uVar14); + if ((int)uVar14 < 0) { + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_2; + *(uint *)(puVar24 + 0x48) = uVar14; + *(ulonglong *)(puVar24 + 0x40) = (ulonglong)local_a8 * local_80; + plVar28 = (longlong *)(((longlong)local_98 + local_78) * (ulonglong)local_a8); + uVar22 = 0x5e; + *(longlong **)(puVar24 + 0x38) = plVar28; + *(undefined8 *)(puVar24 + 0x30) = local_b0; + *(longlong **)(puVar24 + 0x28) = param_3; + goto LAB_17; + } + } + local_90 = (longlong *)(local_80 + local_78); + plVar28 = &local_78; + local_68 = local_68 + 1; + *(longlong **)(puVar24 + 0x20) = &local_80; + *(undefined8 *)(puVar24 + -8) = 0x140083cf7; + cVar13 = FsRtlGetNextBaseMcbEntry(puVar17 + 0x4c,local_68,plVar28,&local_60); + cVar12 = local_b7[0]; + } + if ((longlong)local_90 < local_70) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar21 = 0x5f; - *(uint *)(puVar23 + 0x48) = uVar10; - *(longlong *)(puVar23 + 0x40) = lVar18; - *(longlong **)(puVar23 + 0x38) = local_res18; -LAB_19: - uVar19 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(undefined8 *)(puVar23 + 0x30) = uVar20; - *(longlong **)(puVar23 + 0x28) = param_3; - *(uint **)(puVar23 + 0x20) = puVar15; - *(undefined8 *)(puVar23 + -8) = 0x140080dad; - WPP_SF_qqqiiid(uVar19,uVar21,plVar28,param_2); + ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x29))) { + *(ulonglong *)(puVar24 + 0x40) = + (local_70 - (longlong)local_90) * (ulonglong)local_a8; + lVar27 = ((longlong)local_98 + (longlong)local_90) * (ulonglong)local_a8; + puVar5 = *(undefined **)((longlong)WPP_GLOBAL_Control + 0x18); + *(longlong *)(puVar24 + 0x38) = lVar27; + *(undefined8 *)(puVar24 + 0x30) = local_b0; + *(longlong **)(puVar24 + 0x28) = param_3; + *(uint **)(puVar24 + 0x20) = puVar17; + *(undefined8 *)(puVar24 + -8) = 0x140083dfd; + WPP_SF_qqqiii(puVar5,0x5f,lVar27,param_2); } - } - else { -LAB_20: - *(undefined8 *)(puVar23 + -8) = 0x140080f69; - puVar22 = param_2; - uVar19 = CldiStreamInsertIntoCancelSafeQueue(plVar2,param_2,plVar28,puVar15); - uVar10 = (uint)uVar19; - *(undefined8 *)(puVar23 + -8) = 0x140080f73; - HsmDbgBreakOnStatus(uVar10); - if (-1 < (int)uVar10) { + lVar27 = *(longlong *)*plVar30; + local_70 = (local_70 - (longlong)local_90) * (ulonglong)local_a8; + local_90 = (longlong *) + (((longlong)local_90 + (longlong)local_98) * (ulonglong)local_a8); + uVar2 = *(undefined4 *)(lVar27 + 0x38); + uVar3 = *(undefined8 *)(lVar27 + 0x30); + uVar6 = *(undefined8 *)(lVar27 + 0x28); + plVar28 = *(longlong **)(*(longlong *)(lVar27 + 0x10) + 0x20); + *(uint **)(puVar24 + 0x90) = puVar17 + 0x2a; + *(undefined8 *)(puVar24 + 0x88) = param_19; + *(undefined4 *)(puVar24 + 0x80) = param_16; + *(undefined8 *)(puVar24 + 0x78) = param_15; + *(undefined8 *)(puVar24 + 0x70) = param_9; + *(undefined8 *)(puVar24 + 0x68) = param_8; + *(longlong *)(puVar24 + 0x60) = local_70; + *(longlong **)(puVar24 + 0x58) = local_90; + *(uint *)(puVar24 + 0x50) = param_10; + *(uint *)(puVar24 + 0x48) = local_a8; + *(longlong *)(puVar24 + 0x40) = local_58; + *(undefined4 *)(puVar24 + 0x38) = param_5; + *(undefined4 *)(puVar24 + 0x30) = uVar2; + *(undefined8 *)(puVar24 + 0x28) = uVar3; + lVar27 = *(longlong *)(puVar17 + 0x1c); + *(undefined8 *)(puVar24 + 0x20) = uVar6; + *(undefined8 *)(puVar24 + -8) = 0x140083ed2; + uVar20 = CldSyncSendHydrationRequest + (local_50,5,plVar28,lVar27,*(undefined8 *)(puVar24 + 0x20), + *(void **)(puVar24 + 0x28),*(int *)(puVar24 + 0x30), + *(undefined4 *)(puVar24 + 0x38),*(longlong *)(puVar24 + 0x40), + *(uint *)(puVar24 + 0x48),*(uint *)(puVar24 + 0x50), + *(ulonglong *)(puVar24 + 0x58),*(longlong *)(puVar24 + 0x60), + *(undefined8 *)(puVar24 + 0x68),*(undefined8 *)(puVar24 + 0x70), + *(undefined8 *)(puVar24 + 0x78),puVar24[0x80], + *(void **)(puVar24 + 0x88),*(undefined8 **)(puVar24 + 0x90)); + uVar14 = (uint)uVar20; + *(undefined8 *)(puVar24 + -8) = 0x140083edc; + HsmDbgBreakOnStatus(uVar14); + if ((int)uVar14 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar19 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - pcVar16 = "HYDRATE"; - if (uVar9 != 0) { - pcVar16 = "VALIDATE"; + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar22 = 0x60; + *(uint *)(puVar24 + 0x48) = uVar14; + *(longlong *)(puVar24 + 0x40) = local_70; + *(longlong **)(puVar24 + 0x38) = local_90; + *(undefined8 *)(puVar24 + 0x30) = local_b0; + *(longlong **)(puVar24 + 0x28) = param_3; +LAB_17: + uVar3 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(uint **)(puVar24 + 0x20) = puVar17; + *(undefined8 *)(puVar24 + -8) = 0x140083d81; + WPP_SF_qqqiiid(uVar3,uVar22,plVar28,param_2); + } + } + else { +LAB_18: + *(undefined8 *)(puVar24 + -8) = 0x140083f52; + puVar23 = param_2; + uVar14 = CldiStreamInsertIntoCancelSafeQueue(plVar30,param_2,plVar28,puVar17); + *(undefined8 *)(puVar24 + -8) = 0x140083f5c; + HsmDbgBreakOnStatus(uVar14); + if ((int)uVar14 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar22 = 0x61; + *(uint *)(puVar24 + 0x40) = uVar14; + *(longlong *)(puVar24 + 0x38) = local_a0; + *(ulonglong *)(puVar24 + 0x30) = param_6; + *(undefined8 *)(puVar24 + 0x28) = local_b0; + goto LAB_5; } - *(ulonglong *)(puVar23 + 0x50) = param_7; - *(ulonglong *)(puVar23 + 0x48) = param_6; - *(undefined8 *)(puVar23 + 0x40) = uVar20; - *(longlong **)(puVar23 + 0x38) = plVar2; - *(longlong **)(puVar23 + 0x30) = param_3; - *(uint **)(puVar23 + 0x28) = puVar15; - *(uint **)(puVar23 + 0x20) = param_2; - *(undefined8 *)(puVar23 + -8) = 0x140081055; - WPP_SF_sqqqqiii(uVar19,puVar22,plVar28,pcVar16); } - lVar27 = *(longlong *)(*plVar2 + 8); - *(undefined8 *)(puVar23 + -8) = 0x14008106c; - CldiStreamCdqRELEASE(lVar27 + 0x90); - *(undefined8 *)(puVar23 + -8) = 0x140081073; - CldiStreamStartCountdownTimer('\0',puVar22,plVar28); - return; + else { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar3 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + pcVar19 = "HYDRATE"; + if (local_88 != 0) { + pcVar19 = "VALIDATE"; + } + *(longlong *)(puVar24 + 0x50) = local_a0; + *(ulonglong *)(puVar24 + 0x48) = param_6; + *(undefined8 *)(puVar24 + 0x40) = local_b0; + *(longlong **)(puVar24 + 0x38) = plVar30; + *(longlong **)(puVar24 + 0x30) = param_3; + *(uint **)(puVar24 + 0x28) = puVar17; + *(uint **)(puVar24 + 0x20) = param_2; + *(undefined8 *)(puVar24 + -8) = 0x14008401e; + WPP_SF_sqqqqiii(uVar3,puVar23,plVar28,pcVar19); + } + lVar27 = *(longlong *)(*plVar30 + 8); + *(undefined8 *)(puVar24 + -8) = 0x140084032; + CldiStreamCdqRELEASE(lVar27 + 0x90); + puVar17 = (uint *)0x0; + *(undefined8 *)(puVar24 + -8) = 0x14008403e; + CldiStreamStartCountdownTimer('\0',puVar23,plVar28); + bVar9 = false; + } } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar19 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(uint *)(puVar23 + 0x40) = uVar10; - *(ulonglong *)(puVar23 + 0x38) = param_7; - *(ulonglong *)(puVar23 + 0x30) = param_6; - *(undefined8 *)(puVar23 + 0x28) = uVar20; - *(longlong **)(puVar23 + 0x20) = param_3; - *(undefined8 *)(puVar23 + -8) = 0x140080fce; - WPP_SF_qqqiqd(uVar19,0x60,&WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); - } - } -LAB_18: - lVar27 = *(longlong *)(*plVar2 + 8); - *(undefined8 *)(puVar23 + -8) = 0x140080fe5; - CldiStreamCdqRELEASE(lVar27 + 0x90); - uVar19 = param_17; - goto LAB_6; + } + else { + if (cVar12 == '\0') goto LAB_18; + lVar27 = *(longlong *)(*plVar30 + 8); + *(undefined8 *)(puVar24 + -8) = 0x140084057; + CldiStreamCdqRELEASE(lVar27 + 0x90); + param_7 = local_a0; + bVar9 = false; + if (cVar12 != '\0') goto LAB_3; + } } - cVar8 = (char)param_10; - if ((char)param_10 == '\0') goto LAB_20; - lVar27 = *(longlong *)(*plVar2 + 8); - *(undefined8 *)(puVar23 + -8) = 0x14008108f; - CldiStreamCdqRELEASE(lVar27 + 0x90); - plVar28 = plVar2; - uVar19 = param_17; - if (cVar8 == '\0') goto LAB_6; - } -LAB_5: - uVar12 = param_7; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - lVar27 = *plVar28; - uVar19 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(uint *)(puVar23 + 0x48) = uVar10; - *(ulonglong *)(puVar23 + 0x40) = param_7; - *(ulonglong *)(puVar23 + 0x38) = param_6; - *(uint **)(puVar23 + 0x30) = param_2; - *(uint **)(puVar23 + 0x28) = puVar15; - *(longlong *)(puVar23 + 0x20) = lVar27; - *(undefined8 *)(puVar23 + -8) = 0x1400810f2; - WPP_SF_iqqqiid(uVar19,param_7,plVar28,uVar20); - } - uVar19 = param_17; - if (param_14 != (undefined *)0x0) { - plVar28 = (longlong *)0x0; - uVar12 = (ulonglong)uVar10; - *(undefined8 *)(puVar23 + -8) = 0x140081119; - (*(code *)param_14)(param_17); - } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(uint *)(puVar23 + 0x40) = uVar10; - *(ulonglong *)(puVar23 + 0x38) = param_7; - *(ulonglong *)(puVar23 + 0x30) = param_6; - *(uint **)(puVar23 + 0x28) = param_2; - *(uint **)(puVar23 + 0x20) = puVar15; - *(undefined8 *)(puVar23 + -8) = 0x14008115f; - WPP_SF_iqqiid(uVar5,uVar12,plVar28,uVar20); - } - if (puVar15 != (uint *)0x0) goto LAB_6; + } } - puVar22 = puVar15; - if (-1 < (int)uVar10) goto LAB_21; } } -LAB_3: - puVar15 = puVar22; - if (param_14 != (undefined *)0x0) { - *(undefined8 *)(puVar23 + -8) = 0x1400803af; - (*(code *)param_14)(uVar19,uVar10,0); +LAB_2: + *(undefined8 *)(puVar25 + -8) = 0x14008413a; + uVar20 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar20 == 0) { + if (bVar9) { + lVar27 = *(longlong *)(*plVar30 + 8); + *(undefined8 *)(puVar25 + -8) = 0x140084157; + CldiStreamCdqRELEASE(lVar27 + 0x90); + } + if (puVar17 != (uint *)0x0) { + *(undefined8 *)(puVar25 + -8) = 0x14008416b; + TlmWriteCvForHydrateData((longlong)(puVar17 + 0x2a),uVar14); + } + if (((int)uVar14 < 0) && (param_14 != (undefined *)0x0)) { + *(undefined8 *)(puVar25 + -8) = 0x14008418e; + (*(code *)param_14)(param_17,uVar14,0); + } + if (puVar17 == (uint *)0x0) { + return; + } + *(undefined8 *)(puVar25 + -8) = 0x14008419b; + CldiStreamDeleteRequest(puVar17); + return; } -LAB_21: - if (puVar15 != (uint *)0x0) { - *(undefined8 *)(puVar23 + -8) = 0x1400803bc; - CldiStreamDeleteRequest(puVar15); + if (puVar17 == (uint *)0x0) { + if (!bVar9) goto LAB_19; + } + else { + *(undefined8 *)(puVar25 + -8) = 0x1400841b1; + TlmWriteCvForHydrateData((longlong)(puVar17 + 0x2a),uVar14); + if (!bVar9) { + lVar27 = *(longlong *)(*plVar30 + 8); + *(undefined8 *)(puVar25 + -8) = 0x1400841ca; + CldiStreamCdqACQUIRE(lVar27 + 0x90); + } + *(undefined8 *)(puVar25 + -8) = 0x1400841d2; + CldiStreamDeleteRequest(puVar17); + } + lVar27 = *(longlong *)(*plVar30 + 8); + *(undefined8 *)(puVar25 + -8) = 0x1400841ed; + CldiStreamCdqRELEASE(lVar27 + 0x90); +LAB_19: + if (((int)uVar14 < 0) && (param_14 != (undefined *)0x0)) { + *(undefined8 *)(puVar25 + -8) = 0x140084210; + (*(code *)param_14)(param_17,uVar14,0); } return; -LAB_17: - FltReleasePushLockEx(plVar2 + 0xb); - goto LAB_7; } ``` ## CldiStreamProcessPendingPopulationRequests ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.58| |i_ratio|0.58| |m_ratio|0.96| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamProcessPendingPopulationRequests|CldiStreamProcessPendingPopulationRequests| |fullname|CldiStreamProcessPendingPopulationRequests|CldiStreamProcessPendingPopulationRequests| |refcount|2|2| |`length`|296|324| |`called`|CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamPrepareRequestForNonCdqCompletion
CldiStreamScheduleRequestForMoreProcessing
WPP_SF_iqq|CldiCanDoNonCdqCompletion
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamPrepareRequestForNonCdqCompletion
CldiStreamScheduleRequestForMoreProcessing
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
WPP_SF_iqq| |calling|CldStreamTransferPlaceholders|CldStreamTransferPlaceholders| |paramcount|4|4| |`address`|140040f60|1400412d0| |sig|undefined __fastcall CldiStreamProcessPendingPopulationRequests(longlong * param_1, undefined8 param_2, ulonglong param_3, char param_4)|undefined __fastcall CldiStreamProcessPendingPopulationRequests(longlong * param_1, undefined8 param_2, ulonglong param_3, char param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamProcessPendingPopulationRequests Called Diff ```diff --- CldiStreamProcessPendingPopulationRequests called +++ CldiStreamProcessPendingPopulationRequests called @@ -0,0 +1 @@ +CldiCanDoNonCdqCompletion @@ -6,0 +8 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamProcessPendingPopulationRequests Diff ```diff --- CldiStreamProcessPendingPopulationRequests +++ CldiStreamProcessPendingPopulationRequests @@ -1,42 +1,49 @@ void CldiStreamProcessPendingPopulationRequests (longlong *param_1,undefined8 param_2,ulonglong param_3,char param_4) { uint *puVar1; bool bVar2; - longlong *plVar3; - ulonglong uVar4; + ulonglong uVar3; + undefined8 uVar4; + longlong *plVar5; + ulonglong uVar6; - uVar4 = param_3 & 0xffffffff; + uVar6 = param_3 & 0xffffffff; LAB_0: CldiStreamCdqACQUIRE(*(longlong *)(*param_1 + 8) + 0x90); - plVar3 = (longlong *)param_1[2]; + plVar5 = (longlong *)param_1[2]; do { - if (plVar3 == param_1 + 2) { + if (plVar5 == param_1 + 2) { CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); return; } - puVar1 = (uint *)(plVar3 + -1); + puVar1 = (uint *)(plVar5 + -1); if ((short)*puVar1 == 2) { bVar2 = CldiStreamPrepareRequestForMoreProcessing(puVar1); - if (!bVar2) { - CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); - goto LAB_0; - } + if (!bVar2) goto LAB_1; if (param_4 != '\0') break; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_iqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1d,param_3,param_2); + WPP_SF_iqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1e,param_3,param_2); } CldiStreamScheduleRequestForMoreProcessing(puVar1); } - plVar3 = (longlong *)*plVar3; + plVar5 = (longlong *)*plVar5; } while( true ); CldiStreamPrepareRequestForNonCdqCompletion(puVar1); - param_3 = uVar4; - CldiStreamCompleteRequest(param_1,puVar1,uVar4,0); + uVar3 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar3 == 0) || + (uVar4 = CldiCanDoNonCdqCompletion((longlong)puVar1), (char)uVar4 != '\0')) { + param_3 = uVar6; + CldiStreamCompleteRequest(param_1,puVar1,uVar6,0); + } + else { +LAB_1: + CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); + } goto LAB_0; } ``` ## CldHsmCancelSynchronousCbd ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.62| |i_ratio|0.53| |m_ratio|0.87| |b_ratio|0.77| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldHsmCancelSynchronousCbd|CldHsmCancelSynchronousCbd| |fullname|CldHsmCancelSynchronousCbd|CldHsmCancelSynchronousCbd| |refcount|3|3| |`length`|163|208| |`called`|CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion|CldiCanDoNonCdqCompletion
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion
Feature_2089223483__private_IsEnabledDeviceUsageNoInline| |calling||| |paramcount|1|1| |`address`|14003ecf0|14003eb10| |sig|undefined __fastcall CldHsmCancelSynchronousCbd(longlong param_1)|undefined __fastcall CldHsmCancelSynchronousCbd(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldHsmCancelSynchronousCbd Called Diff ```diff --- CldHsmCancelSynchronousCbd called +++ CldHsmCancelSynchronousCbd called @@ -0,0 +1 @@ +CldiCanDoNonCdqCompletion @@ -4,0 +6 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldHsmCancelSynchronousCbd Diff ```diff --- CldHsmCancelSynchronousCbd +++ CldHsmCancelSynchronousCbd @@ -1,28 +1,42 @@ void CldHsmCancelSynchronousCbd(longlong param_1) { uint *puVar1; longlong *plVar2; longlong *plVar3; - undefined8 uVar4; + char cVar4; + ulonglong uVar5; + undefined8 uVar6; plVar2 = *(longlong **)(param_1 + 0x48); if (plVar2 != (longlong *)0x0) { CldiStreamCdqACQUIRE(*(longlong *)(*plVar2 + 8) + 0x90); while (plVar3 = *(longlong **)(param_1 + 0x30), plVar3 != (longlong *)(param_1 + 0x30)) { puVar1 = (uint *)(plVar3 + -3); - uVar4 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); - if ((char)uVar4 == '\0') { - CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); + uVar5 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 == 0) { + cVar4 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if (cVar4 == '\0') goto LAB_0; +LAB_1: + CldiStreamCompleteCanceledRequest(puVar1,0xc0000120); } else { - CldiStreamCompleteCanceledRequest(puVar1,0xc0000120); + cVar4 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if (cVar4 != '\0') { + uVar6 = CldiCanDoNonCdqCompletion((longlong)puVar1); + if ((char)uVar6 != '\0') { + CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); + goto LAB_1; + } + } +LAB_0: + CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); } CldiStreamCdqACQUIRE(*(longlong *)(*plVar2 + 8) + 0x90); } CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); } return; } ``` ## CldHsmCancelAllRequests ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.43| |i_ratio|0.64| |m_ratio|0.87| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldHsmCancelAllRequests|CldHsmCancelAllRequests| |fullname|CldHsmCancelAllRequests|CldHsmCancelAllRequests| |refcount|3|3| |`length`|162|214| |`called`|CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion|CldiCanDoNonCdqCompletion
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion
Feature_2089223483__private_IsEnabledDeviceUsageNoInline| |calling||| |paramcount|1|1| |`address`|14004ad40|140083250| |sig|undefined __fastcall CldHsmCancelAllRequests(longlong param_1)|undefined __fastcall CldHsmCancelAllRequests(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldHsmCancelAllRequests Called Diff ```diff --- CldHsmCancelAllRequests called +++ CldHsmCancelAllRequests called @@ -0,0 +1 @@ +CldiCanDoNonCdqCompletion @@ -4,0 +6 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldHsmCancelAllRequests Diff ```diff --- CldHsmCancelAllRequests +++ CldHsmCancelAllRequests @@ -1,35 +1,45 @@ void CldHsmCancelAllRequests(longlong param_1) { uint *puVar1; longlong *plVar2; - undefined8 uVar3; - longlong *plVar4; + char cVar3; + ulonglong uVar4; + undefined8 uVar5; + longlong *plVar6; plVar2 = *(longlong **)(param_1 + 0x20); if (plVar2 == (longlong *)0x0) { return; } do { - CldiStreamCdqACQUIRE(*(longlong *)(*plVar2 + 8) + 0x90); - plVar4 = (longlong *)plVar2[2]; while( true ) { - if (plVar4 == plVar2 + 2) { - CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); - return; + CldiStreamCdqACQUIRE(*(longlong *)(*plVar2 + 8) + 0x90); + plVar6 = (longlong *)plVar2[2]; + while( true ) { + if (plVar6 == plVar2 + 2) { + CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); + return; + } + puVar1 = (uint *)(plVar6 + -1); + if ((*puVar1 & 0xffff) - 1 < 2) break; + plVar6 = (longlong *)*plVar6; } - puVar1 = (uint *)(plVar4 + -1); - if ((*puVar1 & 0xffff) - 1 < 2) break; - plVar4 = (longlong *)*plVar4; - } - uVar3 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); - if ((char)uVar3 == '\0') { + uVar4 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 != 0) break; + cVar3 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if (cVar3 != '\0') goto LAB_0; +LAB_1: CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); } - else { - CldiStreamCompleteCanceledRequest(puVar1,0xc000cf16); - } + cVar3 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if ((cVar3 == '\0') || + (uVar5 = CldiCanDoNonCdqCompletion((longlong)puVar1), (char)uVar5 == '\0')) + goto LAB_1; + CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); +LAB_0: + CldiStreamCompleteCanceledRequest(puVar1,0xc000cf16); } while( true ); } ``` ## HsmiRecallHydrationCompletionCallback ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.44| |i_ratio|0.05| |m_ratio|0.71| |b_ratio|0.66| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|HsmiRecallHydrationCompletionCallback|HsmiRecallHydrationCompletionCallback| |fullname|HsmiRecallHydrationCompletionCallback|HsmiRecallHydrationCompletionCallback| |refcount|5|5| |`length`|94|163| |`called`|HsmiRecallPostProcessHydration|Feature_2092950840__private_IsEnabledDeviceUsageNoInline
HsmiRecallPostProcessHydration| |calling|HsmiRecallInitiateHydration|HsmiRecallInitiateHydration| |paramcount|2|2| |`address`|140077c10|140086300| |sig|undefined __fastcall HsmiRecallHydrationCompletionCallback(longlong param_1, uint param_2)|undefined __fastcall HsmiRecallHydrationCompletionCallback(longlong param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmiRecallHydrationCompletionCallback Called Diff ```diff --- HsmiRecallHydrationCompletionCallback called +++ HsmiRecallHydrationCompletionCallback called @@ -0,0 +1 @@ +Feature_2092950840__private_IsEnabledDeviceUsageNoInline ``` ### HsmiRecallHydrationCompletionCallback Diff ```diff --- HsmiRecallHydrationCompletionCallback +++ HsmiRecallHydrationCompletionCallback @@ -1,34 +1,54 @@ void HsmiRecallHydrationCompletionCallback(longlong param_1,uint param_2) { int *piVar1; - int iVar2; + ulonglong uVar2; longlong lVar3; - uint uVar4; + int iVar4; + uint uVar5; if ((*(uint *)(param_1 + 0x30) & 0x200) == 0) { lVar3 = *(longlong *)(param_1 + 0x18); } else { lVar3 = 0; } - LOCK(); - piVar1 = (int *)(param_1 + 0x34); - iVar2 = *piVar1; - *piVar1 = *piVar1 + -1; - UNLOCK(); - uVar4 = param_2; + iVar4 = 0; + uVar2 = Feature_2092950840__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { + LOCK(); + piVar1 = (int *)(param_1 + 0x34); + iVar4 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + iVar4 = iVar4 + -1; + } + uVar5 = param_2; if (((lVar3 != 0) && (param_2 != 0xc000022d)) && - ((uVar4 = *(uint *)(lVar3 + 0x18), uVar4 == 0xffffffff || - ((-1 < (int)uVar4 && ((int)param_2 < 0)))))) { + ((uVar5 = *(uint *)(lVar3 + 0x18), uVar5 == 0xffffffff || + ((-1 < (int)uVar5 && ((int)param_2 < 0)))))) { *(undefined8 *)(lVar3 + 0x20) = 0; *(uint *)(lVar3 + 0x18) = param_2; - uVar4 = param_2; + uVar5 = param_2; } - if (iVar2 + -1 < 1) { - HsmiRecallPostProcessHydration(param_1,uVar4); + uVar2 = Feature_2092950840__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { + if (0 < iVar4) { + return; + } } + else { + LOCK(); + piVar1 = (int *)(param_1 + 0x34); + iVar4 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar4 != 1) { + return; + } + } + HsmiRecallPostProcessHydration(param_1,uVar5); return; } ``` ## CldHsmNotifyPreOperation ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.24| |i_ratio|0.47| |m_ratio|0.94| |b_ratio|0.28| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldHsmNotifyPreOperation|CldHsmNotifyPreOperation| |fullname|CldHsmNotifyPreOperation|CldHsmNotifyPreOperation| |refcount|3|3| |`length`|1046|1172| |`called`|
Expand for full list:
CldStreamOpen
CldSyncSendPreNotification
CldiStreamAllocateRequest
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamStartCountdownTimer
FLTMGR.SYS::FltGetIoPriorityHint
HsmDbgBreakOnStatus
HsmOsGetProcessIdHsmOsGetProcessSessionId
HsmOsGetVmGuid
HsmpGetStreamSize
WPP_SF_qqqd
WPP_SF_qqqi
WPP_SF_qqqid
_guard_dispatch_icall
|
Expand for full list:
CldStreamOpen
CldSyncSendPreNotification
CldiStreamAllocateRequest
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamStartCountdownTimer
FLTMGR.SYS::FltGetIoPriorityHint
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatusHsmOsGetProcessId
HsmOsGetProcessSessionId
HsmOsGetVmGuid
HsmpGetStreamSize
WPP_SF_qqqd
WPP_SF_qqqi
WPP_SF_qqqid
_guard_dispatch_icall
| |calling||| |paramcount|10|10| |`address`|14003eda0|14003ebf0| |sig|undefined __fastcall CldHsmNotifyPreOperation(longlong param_1, uint param_2, uint * param_3, longlong * param_4, undefined8 param_5, undefined4 param_6, void * param_7, undefined * param_8, undefined8 param_9, void * param_10)|undefined __fastcall CldHsmNotifyPreOperation(longlong param_1, uint param_2, uint * param_3, longlong * param_4, undefined8 param_5, undefined4 param_6, void * param_7, undefined * param_8, undefined8 param_9, void * param_10)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldHsmNotifyPreOperation Called Diff ```diff --- CldHsmNotifyPreOperation called +++ CldHsmNotifyPreOperation called @@ -9,0 +10 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldHsmNotifyPreOperation Diff ```diff --- CldHsmNotifyPreOperation +++ CldHsmNotifyPreOperation @@ -1,135 +1,176 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void CldHsmNotifyPreOperation (longlong param_1,uint param_2,uint *param_3,longlong *param_4,undefined8 param_5, undefined4 param_6,void *param_7,undefined *param_8,undefined8 param_9,void *param_10 ) { undefined8 *puVar1; - longlong *plVar2; - longlong lVar3; - uint uVar4; + longlong lVar2; + bool bVar3; + int iVar4; ulonglong uVar5; undefined8 *puVar6; uint *puVar7; undefined8 uVar8; - undefined2 uVar9; - uint *puVar10; - ulonglong uVar11; - undefined8 uVar12; + ulonglong uVar9; + undefined2 uVar10; + uint uVar11; + uint *puVar12; + undefined8 uVar14; + longlong *plVar15; + longlong *plVar17; + uint *puVar13; + longlong *plVar16; - puVar7 = (uint *)0x0; + plVar16 = (longlong *)0x0; + plVar15 = (longlong *)0x0; + puVar13 = (uint *)0x0; + puVar12 = (uint *)0x0; + bVar3 = false; puVar1 = *(undefined8 **)(param_4[2] + 0x20); if (DAT_0 == '\0') { - uVar11 = 0xc000cf12; + iVar4 = -0x3fff30ee; HsmDbgBreakOnStatus(-0x3fff30ee); - } - else if (puVar1 == (undefined8 *)0x0) { - uVar11 = 0xc000cf01; - HsmDbgBreakOnStatus(-0x3fff30ff); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar9 = 0x6d; -LAB_1: - WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar9, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_3); - } + puVar7 = puVar13; + plVar17 = plVar16; } else { - if (param_4[4] == 0) { - uVar4 = CldStreamOpen(param_4); - uVar11 = (ulonglong)uVar4; - HsmDbgBreakOnStatus(uVar4); - if ((int)uVar4 < 0) { + puVar7 = puVar12; + plVar17 = plVar15; + if (puVar1 == (undefined8 *)0x0) { + iVar4 = -0x3fff30ff; + HsmDbgBreakOnStatus(-0x3fff30ff); + puVar7 = puVar13; + plVar17 = plVar16; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (puVar7 = puVar12, plVar17 = plVar15, 1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar10 = 0x6e; + puVar7 = puVar13; + plVar17 = plVar16; +LAB_1: + WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar10, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_3); + } + } + else { + if (param_4[4] == 0) { + iVar4 = CldStreamOpen(param_4); + HsmDbgBreakOnStatus(iVar4); + if (iVar4 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar10 = 0x6f; + puVar7 = puVar13; + plVar17 = plVar16; + goto LAB_1; + } + goto LAB_2; + } + } + plVar17 = (longlong *)param_4[4]; + if (param_3 != (uint *)0x0) { + FltGetIoPriorityHint(param_3); + } + uVar9 = HsmOsGetProcessId(param_1); + uVar5 = HsmOsGetProcessSessionId(param_1); + uVar11 = (uint)uVar5; + puVar6 = (undefined8 *)HsmOsGetVmGuid(param_1); + puVar7 = CldiStreamAllocateRequest + (puVar6,uVar11,(uint)uVar9,plVar17,3,param_5,param_8,param_9,0, + (undefined8 *)0x0); + if (puVar7 == (uint *)0x0) { + iVar4 = -0x3fffff66; + HsmDbgBreakOnStatus(-0x3fffff66); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar9 = 0x6e; + uVar10 = 0x70; goto LAB_1; - } - goto LAB_2; - } - } - plVar2 = (longlong *)param_4[4]; - if (param_3 != (uint *)0x0) { - FltGetIoPriorityHint(param_3); - } - uVar11 = HsmOsGetProcessId(param_1); - uVar5 = HsmOsGetProcessSessionId(param_1); - uVar4 = (uint)uVar5; - puVar6 = (undefined8 *)HsmOsGetVmGuid(param_1); - puVar7 = CldiStreamAllocateRequest - (puVar6,uVar4,(uint)uVar11,plVar2,3,param_5,param_8,param_9,0, - (undefined8 *)0x0); - if (puVar7 == (uint *)0x0) { - uVar11 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x6f, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_3); - } - } - else { - puVar7[0x4c] = param_2; - CldiStreamCdqACQUIRE(*(longlong *)(*plVar2 + 8) + 0x90); - uVar8 = HsmpGetStreamSize(*param_4); - lVar3 = *(longlong *)*plVar2; - uVar12 = *(undefined8 *)(*(longlong *)(lVar3 + 0x10) + 0x20); - uVar5 = CldSyncSendPreNotification - (puVar1,5,uVar12,*(longlong *)(puVar7 + 0x1c),puVar7[0x4c], - *(undefined8 *)(puVar7 + 0xe),*(undefined8 *)(lVar3 + 0x28), - *(void **)(lVar3 + 0x30),*(int *)(lVar3 + 0x38),param_6,uVar8,param_7, - param_10); - uVar11 = uVar5 & 0xffffffff; - HsmDbgBreakOnStatus((int)uVar5); - if ((int)uVar5 < 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqqid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x70, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_3); } } else { - puVar10 = param_3; - uVar5 = CldiStreamInsertIntoCancelSafeQueue(plVar2,param_3,uVar12,puVar7); - uVar11 = uVar5 & 0xffffffff; - HsmDbgBreakOnStatus((int)uVar5); - if (-1 < (int)uVar5) { - CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); + puVar7[0x4c] = param_2; + CldiStreamCdqACQUIRE(*(longlong *)(*plVar17 + 8) + 0x90); + bVar3 = true; + uVar8 = HsmpGetStreamSize(*param_4); + lVar2 = *(longlong *)*plVar17; + uVar14 = *(undefined8 *)(*(longlong *)(lVar2 + 0x10) + 0x20); + uVar9 = CldSyncSendPreNotification + (puVar1,5,uVar14,*(longlong *)(puVar7 + 0x1c),puVar7[0x4c], + *(undefined8 *)(puVar7 + 0xe),*(undefined8 *)(lVar2 + 0x28), + *(void **)(lVar2 + 0x30),*(int *)(lVar2 + 0x38),param_6,uVar8,param_7, + param_10); + iVar4 = (int)uVar9; + HsmDbgBreakOnStatus(iVar4); + if (iVar4 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - puVar10 = (uint *)0x72; - WPP_SF_qqqi(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x72,uVar12,param_3); + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qqqid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x71, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_3); } - CldiStreamStartCountdownTimer('\0',puVar10,uVar12); - return; } - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqqi(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x71,uVar12,param_3); + else { + puVar12 = param_3; + iVar4 = CldiStreamInsertIntoCancelSafeQueue(plVar17,param_3,uVar14,puVar7); + HsmDbgBreakOnStatus(iVar4); + if (iVar4 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qqqi(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x72,uVar14,param_3); + } + } + else { + CldiStreamCdqRELEASE(*(longlong *)(*plVar17 + 8) + 0x90); + bVar3 = false; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + puVar12 = (uint *)0x73; + WPP_SF_qqqi(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x73,uVar14,param_3); + } + puVar7 = (uint *)0x0; + CldiStreamStartCountdownTimer('\0',puVar12,uVar14); + } } } - CldiStreamCdqRELEASE(*(longlong *)(*plVar2 + 8) + 0x90); - if (-1 < (int)uVar11) goto LAB_3; } } LAB_2: - if (param_8 != (undefined *)0x0) { - (*(code *)param_8)(param_9,uVar11,0); + uVar9 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 == 0) { + if (bVar3) { + CldiStreamCdqRELEASE(*(longlong *)(*plVar17 + 8) + 0x90); + } + if ((iVar4 < 0) && (param_8 != (undefined *)0x0)) { + (*(code *)param_8)(param_9,iVar4,0); + } + if (puVar7 == (uint *)0x0) { + return; + } + CldiStreamDeleteRequest(puVar7); + return; } if (puVar7 == (uint *)0x0) { - return; + if (!bVar3) goto LAB_3; } + else { + if (!bVar3) { + CldiStreamCdqACQUIRE(*(longlong *)(*plVar17 + 8) + 0x90); + } + CldiStreamDeleteRequest(puVar7); + } + CldiStreamCdqRELEASE(*(longlong *)(*plVar17 + 8) + 0x90); LAB_3: - CldiStreamDeleteRequest(puVar7); + if ((iVar4 < 0) && (param_8 != (undefined *)0x0)) { + (*(code *)param_8)(param_9,iVar4,0); + } return; } ``` ## CldStreamQueryProgress ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.18| |i_ratio|0.59| |m_ratio|0.99| |b_ratio|0.77| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldStreamQueryProgress|CldStreamQueryProgress| |fullname|CldStreamQueryProgress|CldStreamQueryProgress| |refcount|2|2| |`length`|5860|5901| |called|
Expand for full list:
CldSyncGetRootInfo
CldSyncGetSyncProviderProcess
CldSyncReferenceStream
CldiStreamRestartCountdownTimer
CldiStreamStopCountdownTimer
CldiSyncReleaseRundown
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
Feature_1074201912__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
HsmOsGetProcessSessionIdFromEproccessHsmOsIsInSameSession
HsmiQueryFileRange
HsmpGetStreamSize
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::FsRtlAddBaseMcbEntry
NTOSKRNL.EXE::FsRtlInitializeBaseMcbEx
NTOSKRNL.EXE::FsRtlLookupBaseMcbEntry
NTOSKRNL.EXE::FsRtlRemoveBaseMcbEntry
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ProbeForWrite
TlmWriteZeroRangeQueryProgress
WPP_SF_d
WPP_SF_qid
WPP_SF_qiiiiiiiDiid
memmove
memset
|
Expand for full list:
CldSyncGetRootInfo
CldSyncGetSyncProviderProcess
CldSyncReferenceStream
CldiStreamRestartCountdownTimer
CldiStreamStopCountdownTimer
CldiSyncReleaseRundown
FLTMGR.SYS::FltReferenceContext
FLTMGR.SYS::FltReleaseContext
Feature_1074201912__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
HsmOsGetProcessSessionIdFromEproccessHsmOsIsInSameSession
HsmiQueryFileRange
HsmpGetStreamSize
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::FsRtlAddBaseMcbEntry
NTOSKRNL.EXE::FsRtlInitializeBaseMcbEx
NTOSKRNL.EXE::FsRtlLookupBaseMcbEntry
NTOSKRNL.EXE::FsRtlRemoveBaseMcbEntry
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::ProbeForWrite
TlmWriteZeroRangeQueryProgress
WPP_SF_d
WPP_SF_qid
WPP_SF_qiiiiiiiDiid
memmove
memset
| |calling|CldiPortProcessQueryProgress|CldiPortProcessQueryProgress| |paramcount|4|4| |`address`|14007c5b4|14007b584| |sig|ulonglong __fastcall CldStreamQueryProgress(uint param_1, longlong param_2, uint param_3, uint * param_4)|ulonglong __fastcall CldStreamQueryProgress(uint param_1, longlong param_2, uint param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldStreamQueryProgress Diff ```diff --- CldStreamQueryProgress +++ CldStreamQueryProgress @@ -1,704 +1,688 @@ /* WARNING: Type propagation algorithm not settling */ ulonglong CldStreamQueryProgress(uint param_1,longlong param_2,uint param_3,uint *param_4) { longlong ***ppplVar1; longlong *****ppppplVar2; - longlong *****ppppplVar3; - code *pcVar4; + code *pcVar3; + undefined4 uVar4; undefined4 uVar5; undefined4 uVar6; - undefined4 uVar7; - char cVar8; - uint uVar9; - int iVar10; - longlong lVar11; - longlong *******ppppppplVar12; - longlong *****ppppplVar13; + char cVar7; + int iVar8; + longlong lVar9; + longlong *******ppppppplVar10; + longlong *****ppppplVar11; + longlong ****pppplVar12; + void *pvVar13; longlong ****pppplVar14; - void *pvVar15; + ulonglong uVar15; longlong ******pppppplVar16; - longlong ****pppplVar17; - ulonglong uVar18; - longlong ******pppppplVar19; - longlong **pplVar20; - undefined2 uVar21; - ulonglong uVar22; - undefined8 *puVar23; - longlong *plVar24; - int iVar25; - longlong ******pppppplVar26; - uint uVar27; - undefined8 uVar28; - byte local_168 [8]; - longlong local_160; - int local_158; - longlong local_150; - longlong ******local_148; + longlong **pplVar17; + undefined2 uVar18; + ulonglong uVar19; + undefined8 *puVar20; + longlong ******pppppplVar21; + longlong *plVar22; + int iVar23; + longlong ******pppppplVar24; + uint uVar25; + longlong *****ppppplVar26; + undefined8 uVar27; + uint local_158; + byte local_154 [4]; + longlong ******local_150; + longlong local_148; int local_140; - uint local_13c; - longlong ******local_138; - longlong *****local_130; - uint local_128; - longlong *local_120; - longlong ******local_118; + longlong local_138; + int local_130; + uint local_12c; + longlong ******local_128; + uint local_120; + longlong *local_118; longlong ******local_110; longlong ******local_108; - longlong *****local_100; - longlong *local_f8; - longlong local_f0; - int local_e8; - uint local_e4; - uint local_e0; + longlong ******local_100; + longlong *****local_f8; + longlong *local_f0; + longlong local_e8; + int local_e0; + uint local_dc; undefined8 local_d8; undefined8 uStack_d0; undefined8 local_c8; undefined8 uStack_c0; undefined8 local_b8; longlong *******ppppppplStack_b0; longlong *******local_a8; longlong ***local_a0; longlong ****local_98; - undefined8 local_90; - undefined8 uStack_88; - undefined8 local_80; - undefined8 uStack_78; - undefined8 local_70; - undefined8 *******pppppppuStack_68; - undefined8 *******local_60; - longlong ****local_58; - undefined8 local_50; - undefined8 uStack_48; + longlong ******local_90; + undefined8 local_88; + undefined8 uStack_80; + undefined8 local_78; + undefined8 uStack_70; + undefined8 local_68; + undefined8 *******pppppppuStack_60; + undefined8 *******local_58; + longlong ****local_50; + undefined8 local_48; + undefined8 uStack_40; - pppppplVar26 = (longlong ******)0x0; - local_138 = (longlong ******)0x0; + pppppplVar24 = (longlong ******)0x0; + local_128 = (longlong ******)0x0; + local_130 = 0; local_140 = 0; - local_158 = 0; - local_f0 = 0; - lVar11 = IoGetCurrentProcess(); - local_e8 = HsmOsGetProcessSessionIdFromEproccess(lVar11); - local_90 = 0; - uStack_88 = 0; - local_80 = 0; - uStack_78 = 0; - local_70 = 0; - pppppppuStack_68 = (undefined8 *******)0x0; - local_60 = (undefined8 *******)0x0; + local_e8 = 0; + lVar9 = IoGetCurrentProcess(); + local_e0 = HsmOsGetProcessSessionIdFromEproccess(lVar9); + local_88 = 0; + uStack_80 = 0; + local_78 = 0; + uStack_70 = 0; + local_68 = 0; + pppppppuStack_60 = (undefined8 *******)0x0; + local_58 = (undefined8 *******)0x0; local_d8 = 0; uStack_d0 = 0; local_c8 = 0; uStack_c0 = 0; local_b8 = 0; ppppppplStack_b0 = (longlong *******)0x0; local_a8 = (longlong *******)0x0; - local_160 = 0; - local_150 = 0; - local_120 = (longlong *)0x0; - local_f8 = (longlong *)0x0; - local_168[0] = 0; + local_148 = 0; + local_138 = 0; + local_118 = (longlong *)0x0; + local_f0 = (longlong *)0x0; + local_154[0] = 0; KeEnterCriticalRegion(); - uVar9 = CldiStreamStopCountdownTimer(); - HsmDbgBreakOnStatus(uVar9); - if ((int)uVar9 < 0) { + local_158 = CldiStreamStopCountdownTimer(); + HsmDbgBreakOnStatus(local_158); + if ((int)local_158 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 8 & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar21 = 0x40; + uVar18 = 0x41; LAB_0: - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar21, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,uVar9); + WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar18, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,local_158); } } else { - local_60 = &pppppppuStack_68; - pppppppuStack_68 = &pppppppuStack_68; + local_58 = &pppppppuStack_60; + pppppppuStack_60 = &pppppppuStack_60; local_a8 = (longlong *******)&ppppppplStack_b0; ppppppplStack_b0 = (longlong *******)&ppppppplStack_b0; KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite(&DAT_1,1); - ppppppplVar12 = DAT_2; - if ((longlong ********)DAT_2[1] != &DAT_2) goto LAB_14007dcda; + ppppppplVar10 = DAT_2; + if ((longlong ********)DAT_2[1] != &DAT_2) goto LAB_14007ccd2; ppppppplStack_b0 = DAT_2; local_a8 = (longlong *******)&DAT_2; DAT_2[1] = (longlong ******)&ppppppplStack_b0; DAT_2 = (longlong *******)&ppppppplStack_b0; - if ((longlong ********)*DAT_4 != &DAT_1400297d8) goto LAB_14007dcda; - pppppppuStack_68 = &DAT_2; - local_60 = DAT_4; - *DAT_4 = &pppppppuStack_68; - DAT_4 = &pppppppuStack_68; - pppppplVar16 = pppppplVar26; - iVar25 = 0; - if ((undefined8 ********)ppppppplVar12 != &pppppppuStack_68) { + if ((longlong ********)*DAT_4 != &DAT_1400297d8) goto LAB_14007ccd2; + pppppppuStack_60 = &DAT_2; + local_58 = DAT_4; + *DAT_4 = &pppppppuStack_60; + DAT_4 = &pppppppuStack_60; + pppppplVar21 = pppppplVar24; + iVar23 = 0; + if ((undefined8 ********)ppppppplVar10 != &pppppppuStack_60) { LAB_5: - local_110 = (longlong ******)0x0; local_108 = (longlong ******)0x0; - (*ppppppplVar12)[1] = (longlong *****)&ppppppplStack_b0; - *local_a8 = (longlong ******)ppppppplVar12; - ppppppplStack_b0 = (longlong *******)*ppppppplVar12; - *ppppppplVar12 = (longlong ******)&ppppppplStack_b0; - ppppppplVar12[1] = (longlong ******)local_a8; - local_e4 = *(uint *)(ppppppplVar12 + -5); - local_a8 = ppppppplVar12; - if (local_e4 == 0) goto LAB_6; - uVar27 = local_e4 & 0xffff; - local_128 = *(uint *)((longlong)ppppppplVar12 + 0x2c); - local_50 = ppppppplVar12[3]; - uStack_48 = ppppppplVar12[4]; - local_148 = ppppppplVar12[0xb]; - if (ppppppplVar12[7] == (longlong ******)0x0) { - local_118 = ppppppplVar12[0xc]; + local_100 = (longlong ******)0x0; + (*ppppppplVar10)[1] = (longlong *****)&ppppppplStack_b0; + *local_a8 = (longlong ******)ppppppplVar10; + ppppppplStack_b0 = (longlong *******)*ppppppplVar10; + *ppppppplVar10 = (longlong ******)&ppppppplStack_b0; + ppppppplVar10[1] = (longlong ******)local_a8; + uVar25 = *(uint *)(ppppppplVar10 + -5); + local_150 = (longlong ******)CONCAT44(local_150._4_4_,uVar25); + local_a8 = ppppppplVar10; + if (uVar25 == 0) goto LAB_6; + uVar25 = uVar25 & 0xffff; + local_120 = *(uint *)((longlong)ppppppplVar10 + 0x2c); + local_48 = ppppppplVar10[3]; + uStack_40 = ppppppplVar10[4]; + local_90 = ppppppplVar10[0xb]; + if (ppppppplVar10[7] == (longlong ******)0x0) { + local_110 = ppppppplVar10[0xc]; } else { - local_118 = (longlong ******)ppppppplVar12[7][5]; - } - pppppplVar16 = ppppppplVar12[10]; - local_130 = *pppppplVar16; - local_58 = local_130[1]; - local_a0 = local_130[2][4]; - local_13c = uVar27; - lVar11 = CldSyncGetSyncProviderProcess((longlong)local_a0); - local_98 = (longlong ****)(**pppppplVar16)[5]; - if (pppppplVar16[7] == (longlong *****)0x0) { - iVar25 = *(int *)(ppppppplVar12 + 5); + local_110 = (longlong ******)ppppppplVar10[7][5]; + } + pppppplVar21 = ppppppplVar10[10]; + ppppplVar26 = *pppppplVar21; + local_50 = ppppplVar26[1]; + local_a0 = ppppplVar26[2][4]; + local_12c = uVar25; + lVar9 = CldSyncGetSyncProviderProcess((longlong)local_a0); + local_98 = (longlong ****)(**pppppplVar21)[5]; + if (pppppplVar21[7] == (longlong *****)0x0) { + iVar23 = *(int *)(ppppppplVar10 + 5); } else { - iVar25 = *(int *)(pppppplVar16[7] + 10); - } - if ((lVar11 == 0) || ((param_1 >> (uVar27 - 1 & 0x1f) & 1) == 0)) goto LAB_6; - iVar10 = HsmOsGetProcessSessionIdFromEproccess(lVar11); - cVar8 = HsmOsIsInSameSession(iVar10,iVar25,local_e8); - if (cVar8 == '\0') goto LAB_6; - if (local_13c == 1) { - local_110 = ppppppplVar12[0x27]; - local_108 = ppppppplVar12[0x28]; + iVar23 = *(int *)(pppppplVar21[7] + 10); + } + if ((lVar9 == 0) || ((param_1 >> (uVar25 - 1 & 0x1f) & 1) == 0)) goto LAB_6; + iVar8 = HsmOsGetProcessSessionIdFromEproccess(lVar9); + cVar7 = HsmOsIsInSameSession(iVar8,iVar23,local_e0); + if (cVar7 == '\0') goto LAB_6; + if (local_12c == 1) { + local_108 = ppppppplVar10[0x27]; + local_100 = ppppppplVar10[0x28]; } ExReleaseResourceLite(&DAT_1); KeLeaveCriticalRegion(); - local_f0 = CldSyncReferenceStream((longlong)local_a0,local_98,0); - if (local_f0 == 0) { -LAB_7: - KeEnterCriticalRegion(); - ExAcquireResourceExclusiveLite(&DAT_1,1); - goto LAB_6; - } - iVar25 = local_158 + -1; - pppppplVar19 = pppppplVar26; - uVar27 = 0; - if (0 < iVar25) { - do { - iVar10 = (int)(iVar25 + (uint)pppppplVar19) / 2; - uVar27 = iVar10 + 1; - if (pppppplVar16 <= local_138[(longlong)iVar10 * 2]) { - uVar27 = (uint)pppppplVar19; - iVar25 = iVar10; - } - pppppplVar19 = (longlong ******)(ulonglong)uVar27; - } while ((int)uVar27 < iVar25); - } - if (((int)uVar27 < local_158) && - ((longlong ******)local_138[(longlong)(int)uVar27 * 2] == pppppplVar16)) { - ppppplVar13 = local_138[(longlong)(int)uVar27 * 2 + 1]; - goto LAB_8; - } - if (local_158 == local_140) { - local_100 = (longlong *****)CONCAT44(local_100._4_4_,local_140 + 4); - pppppplVar19 = (longlong ******) - ExAllocatePool2(0x100,(longlong)(local_140 + 4) << 4,0x67706c43); - if (pppppplVar19 != (longlong ******)0x0) { - if (local_138 != (longlong ******)0x0) { - memmove(pppppplVar19,local_138,(longlong)local_140 << 4); - ExFreePoolWithTag(local_138); - } - memset(pppppplVar19 + (longlong)local_140 * 2,0,0x40); - local_140 = (int)local_100; - local_138 = pppppplVar19; - goto LAB_9; - } - uVar9 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_10; - uVar21 = 0x41; - } - else { -LAB_9: - iVar25 = local_158; - if ((int)uVar27 < local_158) { - memmove(local_138 + (longlong)(int)uVar27 * 2 + 2,local_138 + (longlong)(int)uVar27 * 2, - (longlong)(int)(local_158 - uVar27) << 4); - } - pppppplVar19 = local_138 + (longlong)(int)uVar27 * 2; - *pppppplVar19 = (longlong *****)0x0; - pppppplVar19[1] = (longlong *****)0x0; - FltReferenceContext(**pppppplVar16); - *pppppplVar19 = (longlong *****)pppppplVar16; - local_158 = iVar25 + 1; - ppppplVar13 = (longlong *****)ExAllocatePool2(0x100,0xc0,0x67706c43); - local_100 = ppppplVar13; - if (ppppplVar13 != (longlong *****)0x0) { - pppppplVar19[1] = ppppplVar13; - uVar27 = 1 << ((char)local_13c - 1U & 0x1f); - *(uint *)((longlong)ppppplVar13 + 0x44) = uVar27; - if ((int)local_e4 < 0) { - uVar27 = uVar27 | 0x80000000; - *(uint *)((longlong)ppppplVar13 + 0x44) = uVar27; - } - if ((local_e4 & 0x40000000) != 0) { - *(uint *)((longlong)ppppplVar13 + 0x44) = uVar27 | 0x40000000; - } - pppppplVar19 = pppppplVar26; - if ((local_a0 != (longlong ***)0x0) && (local_a0[0xc] != (longlong **)0x0)) { - pppppplVar19 = (longlong ******)(ulonglong)*(uint *)(local_a0[0xc] + 0x10); - } - ppppplVar13[0xd] = (longlong ****)pppppplVar19; - pppppplVar19 = pppppplVar26; - if (local_a0 != (longlong ***)0x0) { - pppppplVar19 = (longlong ******)*local_a0; - } - ppppplVar13[0xe] = (longlong ****)pppppplVar19; - ppppplVar13[0xf] = local_98; - if (local_13c - 1 < 2) { - ppplVar1 = *local_58; - uVar5 = *(undefined4 *)((longlong)ppplVar1 + 0x34); - uVar6 = *(undefined4 *)(ppplVar1 + 7); - uVar7 = *(undefined4 *)((longlong)ppplVar1 + 0x3c); - *(undefined4 *)(ppppplVar13 + 0x11) = *(undefined4 *)(ppplVar1 + 6); - *(undefined4 *)((longlong)ppppplVar13 + 0x8c) = uVar5; - *(undefined4 *)(ppppplVar13 + 0x12) = uVar6; - *(undefined4 *)((longlong)ppppplVar13 + 0x94) = uVar7; - ppppplVar13[0x13] = (longlong ****)(**pppppplVar16)[2][4]; - if (local_13c == 1) { - cVar8 = FsRtlInitializeBaseMcbEx(ppppplVar13,1); - if (cVar8 != '\0') { - cVar8 = FsRtlInitializeBaseMcbEx(ppppplVar13 + 3,1); - if (cVar8 != '\0') { - pppplVar14 = (longlong ****)HsmpGetStreamSize((longlong)*local_130); - ppppplVar13[0x17] = pppplVar14; - goto LAB_8; - } - uVar9 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar21 = 0x44; - goto LAB_11; - } - goto LAB_10; - } - uVar9 = 0xc000009a; + local_e8 = CldSyncReferenceStream((longlong)local_a0,local_98,0); + if (local_e8 != 0) { + iVar23 = local_140 + -1; + pppppplVar16 = pppppplVar24; + uVar25 = 0; + if (0 < iVar23) { + do { + iVar8 = (int)(iVar23 + (uint)pppppplVar16) / 2; + uVar25 = iVar8 + 1; + if (pppppplVar21 <= local_128[(longlong)iVar8 * 2]) { + uVar25 = (uint)pppppplVar16; + iVar23 = iVar8; + } + pppppplVar16 = (longlong ******)(ulonglong)uVar25; + } while ((int)uVar25 < iVar23); + } + if (((int)uVar25 < local_140) && + ((longlong ******)local_128[(longlong)(int)uVar25 * 2] == pppppplVar21)) { + ppppplVar11 = local_128[(longlong)(int)uVar25 * 2 + 1]; + } + else { + if (local_140 == local_130) { + local_f8 = (longlong *****)CONCAT44(local_f8._4_4_,local_130 + 4); + pppppplVar16 = (longlong ******) + ExAllocatePool2(0x100,(longlong)(local_130 + 4) << 4,0x67706c43); + if (pppppplVar16 == (longlong ******)0x0) { + local_158 = 0xc000009a; HsmDbgBreakOnStatus(-0x3fffff66); if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_10; - uVar21 = 0x43; - goto LAB_11; - } - } + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_7; + uVar18 = 0x42; LAB_8: - if ((ppppplVar13[9] == (longlong ****)0x0) || - ((longlong)local_148 < (longlong)ppppplVar13[9])) { - ppppplVar13[9] = (longlong ****)local_148; - } - if ((longlong)ppppplVar13[10] < (longlong)local_118) { - ppppplVar13[10] = (longlong ****)local_118; - } - if (*(int *)(ppppplVar13 + 6) == 0) { - *(uint *)(ppppplVar13 + 6) = local_128; - } - *(undefined4 *)((longlong)ppppplVar13 + 0x34) = (undefined4)local_50; - *(undefined4 *)(ppppplVar13 + 7) = local_50._4_4_; - *(undefined4 *)((longlong)ppppplVar13 + 0x3c) = (undefined4)uStack_48; - *(undefined4 *)(ppppplVar13 + 8) = uStack_48._4_4_; - if (local_13c == 1) { - lVar11 = (ulonglong)(~*(uint *)((longlong)**pppppplVar16 + 0x1c) & 2) * 0x800; - uVar18 = ~(lVar11 - 1U); - uVar22 = uVar18 & (ulonglong)local_110; - lVar11 = ((longlong)local_108 + (longlong)local_110 + lVar11 + -1 & uVar18) - uVar22; - if ((0 < lVar11) && - (cVar8 = FsRtlAddBaseMcbEntry(ppppplVar13,uVar22,uVar22,lVar11), cVar8 == '\0')) { - uVar9 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0 && - (1 < (byte)WPP_GLOBAL_Control[0x29])))) { - uVar21 = 0x45; - goto LAB_11; - } - goto LAB_10; - } - if (lVar11 == 0) { - uVar18 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar18 == 0) { - pplVar20 = (**pppppplVar16)[2][4]; - pvVar15 = CldSyncGetRootInfo((longlong)local_130[2][4]); + local_158 = 0xc000009a; +LAB_9: + WPP_SF_qid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar18, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,ppppplVar26); + goto LAB_7; + } + if (local_128 != (longlong ******)0x0) { + memmove(pppppplVar16,local_128,(longlong)local_130 << 4); + ExFreePoolWithTag(local_128); + } + memset(pppppplVar16 + (longlong)local_130 * 2,0,0x40); + local_130 = (int)local_f8; + local_128 = pppppplVar16; + } + iVar23 = local_140; + if ((int)uVar25 < local_140) { + memmove(local_128 + (longlong)(int)uVar25 * 2 + 2,local_128 + (longlong)(int)uVar25 * 2, + (longlong)(int)(local_140 - uVar25) << 4); + } + pppppplVar16 = local_128 + (longlong)(int)uVar25 * 2; + *pppppplVar16 = (longlong *****)0x0; + pppppplVar16[1] = (longlong *****)0x0; + FltReferenceContext(**pppppplVar21); + *pppppplVar16 = (longlong *****)pppppplVar21; + local_140 = iVar23 + 1; + ppppplVar11 = (longlong *****)ExAllocatePool2(0x100,0xc0,0x67706c43); + local_f8 = ppppplVar11; + if (ppppplVar11 == (longlong *****)0x0) { + local_158 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_7; + uVar18 = 0x43; + goto LAB_8; + } + pppppplVar16[1] = ppppplVar11; + uVar25 = 1 << ((char)local_12c - 1U & 0x1f); + *(uint *)((longlong)ppppplVar11 + 0x44) = uVar25; + if ((char)((ulonglong)local_150 >> 0x18) < '\0') { + uVar25 = uVar25 | 0x80000000; + *(uint *)((longlong)ppppplVar11 + 0x44) = uVar25; + } + if (((ulonglong)local_150 & 0x40000000) != 0) { + *(uint *)((longlong)ppppplVar11 + 0x44) = uVar25 | 0x40000000; + } + pppppplVar16 = pppppplVar24; + if ((local_a0 != (longlong ***)0x0) && (local_a0[0xc] != (longlong **)0x0)) { + pppppplVar16 = (longlong ******)(ulonglong)*(uint *)(local_a0[0xc] + 0x10); + } + ppppplVar11[0xd] = (longlong ****)pppppplVar16; + pppppplVar16 = pppppplVar24; + if (local_a0 != (longlong ***)0x0) { + pppppplVar16 = (longlong ******)*local_a0; + } + ppppplVar11[0xe] = (longlong ****)pppppplVar16; + ppppplVar11[0xf] = local_98; + if (local_12c - 1 < 2) { + ppplVar1 = *local_50; + uVar4 = *(undefined4 *)((longlong)ppplVar1 + 0x34); + uVar5 = *(undefined4 *)(ppplVar1 + 7); + uVar6 = *(undefined4 *)((longlong)ppplVar1 + 0x3c); + *(undefined4 *)(ppppplVar11 + 0x11) = *(undefined4 *)(ppplVar1 + 6); + *(undefined4 *)((longlong)ppppplVar11 + 0x8c) = uVar4; + *(undefined4 *)(ppppplVar11 + 0x12) = uVar5; + *(undefined4 *)((longlong)ppppplVar11 + 0x94) = uVar6; + ppppplVar11[0x13] = (longlong ****)(**pppppplVar21)[2][4]; + if (local_12c == 1) { + cVar7 = FsRtlInitializeBaseMcbEx(ppppplVar11,1); + if (cVar7 == '\0') { + local_158 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_7; + uVar18 = 0x44; + goto LAB_8; + } + cVar7 = FsRtlInitializeBaseMcbEx(ppppplVar11 + 3,1); + if (cVar7 == '\0') { + local_158 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_7; + uVar18 = 0x45; + goto LAB_8; + } + pppplVar12 = (longlong ****)HsmpGetStreamSize((longlong)*ppppplVar26); + ppppplVar11[0x17] = pppplVar12; + } + } + } + if ((ppppplVar11[9] == (longlong ****)0x0) || + ((longlong)local_90 < (longlong)ppppplVar11[9])) { + ppppplVar11[9] = (longlong ****)local_90; + } + if ((longlong)ppppplVar11[10] < (longlong)local_110) { + ppppplVar11[10] = (longlong ****)local_110; + } + if (*(int *)(ppppplVar11 + 6) == 0) { + *(uint *)(ppppplVar11 + 6) = local_120; + } + *(undefined4 *)((longlong)ppppplVar11 + 0x34) = (undefined4)local_48; + *(undefined4 *)(ppppplVar11 + 7) = local_48._4_4_; + *(undefined4 *)((longlong)ppppplVar11 + 0x3c) = (undefined4)uStack_40; + *(undefined4 *)(ppppplVar11 + 8) = uStack_40._4_4_; + if (local_12c == 1) { + lVar9 = ((ulonglong)~*(uint *)((longlong)**pppppplVar21 + 0x1c) & 2) * 0x800; + uVar15 = ~(lVar9 - 1U); + uVar19 = uVar15 & (ulonglong)local_108; + lVar9 = ((longlong)local_100 + (longlong)local_108 + lVar9 + -1 & uVar15) - uVar19; + if ((0 < lVar9) && + (cVar7 = FsRtlAddBaseMcbEntry(ppppplVar11,uVar19,uVar19,lVar9), cVar7 == '\0')) { + local_158 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || + ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_7; + uVar18 = 0x46; + goto LAB_8; + } + if (lVar9 == 0) { + uVar15 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar15 == 0) { + pplVar17 = (**pppppplVar21)[2][4]; + pvVar13 = CldSyncGetRootInfo((longlong)ppppplVar26[2][4]); + TlmWriteZeroRangeQueryProgress + (pplVar17,ppppplVar11[0x17],ppppplVar11[0xb],ppppplVar11[0xc], + ppppplVar11[0x14],ppppplVar11[0x15],ppppplVar11[0x16],0,0,(longlong)pvVar13 + ,0); + } + else { + pvVar13 = CldSyncGetRootInfo((longlong)ppppplVar26[2][4]); + if (pvVar13 != (void *)0x0) { TlmWriteZeroRangeQueryProgress - (pplVar20,ppppplVar13[0x17],ppppplVar13[0xb],ppppplVar13[0xc], - ppppplVar13[0x14],ppppplVar13[0x15],ppppplVar13[0x16],0,0, - (longlong)pvVar15,0); - } - else { - pvVar15 = CldSyncGetRootInfo((longlong)local_130[2][4]); - if (pvVar15 != (void *)0x0) { - TlmWriteZeroRangeQueryProgress - ((**pppppplVar16)[2][4],ppppplVar13[0x17],ppppplVar13[0xb], - ppppplVar13[0xc],ppppplVar13[0x14],ppppplVar13[0x15],ppppplVar13[0x16], - 0,0,(longlong)pvVar15,0); - ExFreePoolWithTag(pvVar15,0x69726943); - } - } - } - } - CldiSyncReleaseRundown(local_f0); - local_f0 = 0; - goto LAB_7; - } - uVar9 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_10; - uVar21 = 0x42; - } -LAB_11: - uVar9 = 0xc000009a; - ppppplVar13 = local_130; -LAB_12: - WPP_SF_qid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar21, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,ppppplVar13); - goto LAB_10; + ((**pppppplVar21)[2][4],ppppplVar11[0x17],ppppplVar11[0xb], + ppppplVar11[0xc],ppppplVar11[0x14],ppppplVar11[0x15],ppppplVar11[0x16],0, + 0,(longlong)pvVar13,0); + ExFreePoolWithTag(pvVar13,0x69726943); + } + } + } + } + CldiSyncReleaseRundown(local_e8); + local_e8 = 0; + } + KeEnterCriticalRegion(); + ExAcquireResourceExclusiveLite(&DAT_1,1); +LAB_6: + ppppppplVar10 = ppppppplStack_b0; + pppppplVar21 = local_128; + iVar23 = local_140; + if ((undefined8 ********)ppppppplStack_b0 == &pppppppuStack_60) goto LAB_10; + goto LAB_5; } -LAB_13: +LAB_10: ExReleaseResourceLite(&DAT_1); KeLeaveCriticalRegion(); - local_128 = iVar25 * 0x90; - *param_4 = local_128; - if (param_3 < local_128) { - uVar9 = 0x801c0001; + local_120 = iVar23 * 0x90; + *param_4 = local_120; + if (param_3 < local_120) { + local_158 = 0x801c0001; HsmDbgBreakOnStatus(-0x7fe3ffff); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar21 = 0x46; + uVar18 = 0x47; goto LAB_0; } } else { - pppppplVar19 = (longlong ******)(longlong)iVar25; - local_108 = pppppplVar19; - if (0 < iVar25) { - local_110 = (longlong ******)0x0; + pppppplVar16 = (longlong ******)(longlong)iVar23; + local_100 = pppppplVar16; + if (0 < iVar23) { + local_108 = (longlong ******)0x0; do { - ppppplVar2 = *pppppplVar16; - ppppplVar13 = (longlong *****)*ppppplVar2; - ppppplVar3 = pppppplVar16[1]; - ppppplVar3[0xb] = ppppplVar2[6]; - ppppplVar3[0xc] = ppppplVar2[5]; - local_118 = pppppplVar16; - if ((*(uint *)((longlong)ppppplVar3 + 0x44) & 2) == 0) { - local_120 = (longlong *)0x0; - pppppplVar16 = pppppplVar26; - if (0 < (longlong)ppppplVar3[0x17]) { + ppppplVar11 = *pppppplVar21; + ppppplVar26 = (longlong *****)*ppppplVar11; + ppppplVar2 = pppppplVar21[1]; + ppppplVar2[0xb] = ppppplVar11[6]; + ppppplVar2[0xc] = ppppplVar11[5]; + local_110 = pppppplVar21; + if ((*(uint *)((longlong)ppppplVar2 + 0x44) & 2) == 0) { + local_118 = (longlong *)0x0; + pppppplVar21 = pppppplVar24; + if (0 < (longlong)ppppplVar2[0x17]) { do { - uVar9 = HsmiQueryFileRange((longlong)*ppppplVar13,0x4244,&local_120, - ppppplVar3 + 0x17,local_168,&local_f8); - HsmDbgBreakOnStatus(uVar9); - if ((int)uVar9 < 0) { + local_158 = HsmiQueryFileRange((longlong)*ppppplVar26,0x4244,&local_118, + ppppplVar2 + 0x17,local_154,&local_f0); + HsmDbgBreakOnStatus(local_158); + if ((int)local_158 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_10; - uVar21 = 0x47; - goto LAB_12; + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_7; + uVar18 = 0x48; + goto LAB_9; } - if (local_168[0] != 0) { - lVar11 = (longlong)local_f8 - (longlong)local_120; - if ((0 < lVar11) && - (cVar8 = FsRtlAddBaseMcbEntry(ppppplVar3 + 3,local_120,local_120,lVar11), - cVar8 == '\0')) { - uVar9 = 0xc000009a; + if (local_154[0] != 0) { + lVar9 = (longlong)local_f0 - (longlong)local_118; + if ((0 < lVar9) && + (cVar7 = FsRtlAddBaseMcbEntry(ppppplVar2 + 3,local_118,local_118,lVar9), + cVar7 == '\0')) { + local_158 = 0xc000009a; HsmDbgBreakOnStatus(-0x3fffff66); if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || - ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_10; - uVar21 = 0x48; - goto LAB_14; + ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_7; + uVar18 = 0x49; + goto LAB_8; } - if (lVar11 == 0) { - uVar18 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar18 == 0) { - plVar24 = (**ppppplVar2)[2][4]; - pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); + if (lVar9 == 0) { + uVar15 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar15 == 0) { + plVar22 = (**ppppplVar11)[2][4]; + pvVar13 = CldSyncGetRootInfo((longlong)ppppplVar26[2][4]); TlmWriteZeroRangeQueryProgress - (plVar24,ppppplVar3[0x17],ppppplVar3[0xb],ppppplVar3[0xc], - ppppplVar3[0x14],ppppplVar3[0x15],ppppplVar3[0x16],0,0, - (longlong)pvVar15,1); + (plVar22,ppppplVar2[0x17],ppppplVar2[0xb],ppppplVar2[0xc], + ppppplVar2[0x14],ppppplVar2[0x15],ppppplVar2[0x16],0,0, + (longlong)pvVar13,1); } else { - pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); - if (pvVar15 != (void *)0x0) { + pvVar13 = CldSyncGetRootInfo((longlong)ppppplVar26[2][4]); + if (pvVar13 != (void *)0x0) { TlmWriteZeroRangeQueryProgress - ((**ppppplVar2)[2][4],ppppplVar3[0x17],ppppplVar3[0xb], - ppppplVar3[0xc],ppppplVar3[0x14],ppppplVar3[0x15], - ppppplVar3[0x16],0,0,(longlong)pvVar15,1); - ExFreePoolWithTag(pvVar15,0x69726943); + ((**ppppplVar11)[2][4],ppppplVar2[0x17],ppppplVar2[0xb], + ppppplVar2[0xc],ppppplVar2[0x14],ppppplVar2[0x15], + ppppplVar2[0x16],0,0,(longlong)pvVar13,1); + ExFreePoolWithTag(pvVar13,0x69726943); } } } - ppppplVar3[0x16] = + ppppplVar2[0x16] = (longlong ****) - ((longlong)local_f8 + ((longlong)ppppplVar3[0x16] - (longlong)local_120)); + ((longlong)local_f0 + ((longlong)ppppplVar2[0x16] - (longlong)local_118)); } - local_120 = local_f8; - } while ((longlong)local_f8 < (longlong)ppppplVar3[0x17]); - } - while (local_148 = pppppplVar16, - cVar8 = FsRtlLookupBaseMcbEntry - (ppppplVar3,pppppplVar16,&local_160,&local_150,0,0,0), - pppppplVar19 = pppppplVar26, cVar8 != '\0') { - if (local_150 == 0) { - uVar9 = 0xc000cf12; + local_118 = local_f0; + } while ((longlong)local_f0 < (longlong)ppppplVar2[0x17]); + } + while (local_150 = pppppplVar21, + cVar7 = FsRtlLookupBaseMcbEntry + (ppppplVar2,pppppplVar21,&local_148,&local_138,0,0,0), + pppppplVar16 = pppppplVar24, cVar7 != '\0') { + if (local_138 == 0) { HsmDbgBreakOnStatus(-0x3fff30ee); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x49, - (**ppppplVar2)[2],ppppplVar13); - } - uVar18 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar18 == 0) { - plVar24 = (**ppppplVar2)[2][4]; - pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); - uVar28 = 2; - goto LAB_15; - } - pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); - if (pvVar15 == (void *)0x0) goto LAB_10; - pplVar20 = (**ppppplVar2)[2]; - uVar28 = 2; - pppplVar14 = ppppplVar3[0x16]; - pppplVar17 = ppppplVar3[0x15]; - goto LAB_16; - } - if (local_160 != -1) { - ppppplVar3[0x15] = (longlong ****)((longlong)ppppplVar3[0x15] + local_150); - } - pppppplVar16 = (longlong ******)((longlong)pppppplVar16 + local_150); - } - while (local_148 = pppppplVar19, - cVar8 = FsRtlLookupBaseMcbEntry - (ppppplVar3 + 3,pppppplVar19,&local_160,&local_150,0,0,0), - cVar8 != '\0') { - if (local_150 == 0) { - uVar9 = 0xc000cf12; - HsmDbgBreakOnStatus(-0x3fff30ee); + pppppplVar24 = local_150; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4a, - (**ppppplVar2)[2],ppppplVar13); + (**ppppplVar11)[2],ppppplVar26); } - uVar18 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar18 == 0) { - plVar24 = (**ppppplVar2)[2][4]; - pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); - uVar28 = 3; - goto LAB_15; + uVar15 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar15 == 0) { + plVar22 = (**ppppplVar11)[2][4]; + pvVar13 = CldSyncGetRootInfo((longlong)ppppplVar26[2][4]); + uVar27 = 2; + goto LAB_11; } - pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); - if (pvVar15 == (void *)0x0) goto LAB_10; - uVar28 = 3; - goto LAB_17; - } - if ((local_160 != -1) && - (cVar8 = FsRtlRemoveBaseMcbEntry(ppppplVar3,pppppplVar19), cVar8 == '\0')) { - uVar9 = 0xc000009a; - HsmDbgBreakOnStatus(-0x3fffff66); - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0 && - (1 < (byte)WPP_GLOBAL_Control[0x29])))) { - uVar21 = 0x4b; -LAB_14: - uVar9 = 0xc000009a; - goto LAB_12; - } - goto LAB_10; - } - pppppplVar19 = (longlong ******)((longlong)pppppplVar19 + local_150); - } - ppppplVar3[0x14] = ppppplVar3[0x15]; - pppppplVar19 = pppppplVar26; - while (local_148 = pppppplVar19, - cVar8 = FsRtlLookupBaseMcbEntry - (ppppplVar3,pppppplVar19,&local_160,&local_150,0,0,0), - cVar8 != '\0') { - if (local_150 == 0) { - uVar9 = 0xc000cf12; + pvVar13 = CldSyncGetRootInfo((longlong)ppppplVar26[2][4]); + if (pvVar13 == (void *)0x0) goto LAB_12; + pplVar17 = (**ppppplVar11)[2]; + uVar27 = 2; + pppplVar12 = ppppplVar2[0x16]; + pppplVar14 = ppppplVar2[0x15]; + goto LAB_13; + } + if (local_148 != -1) { + ppppplVar2[0x15] = (longlong ****)((longlong)ppppplVar2[0x15] + local_138); + } + pppppplVar21 = (longlong ******)((longlong)pppppplVar21 + local_138); + } + while (local_150 = pppppplVar16, + cVar7 = FsRtlLookupBaseMcbEntry + (ppppplVar2 + 3,pppppplVar16,&local_148,&local_138,0,0,0), + cVar7 != '\0') { + if (local_138 == 0) { HsmDbgBreakOnStatus(-0x3fff30ee); + pppppplVar24 = local_150; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4c, - (**ppppplVar2)[2],ppppplVar13); + WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4b, + (**ppppplVar11)[2],ppppplVar26); } - uVar18 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar18 == 0) { - plVar24 = (**ppppplVar2)[2][4]; - pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); - uVar28 = 4; + uVar15 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar15 == 0) { + plVar22 = (**ppppplVar11)[2][4]; + pvVar13 = CldSyncGetRootInfo((longlong)ppppplVar26[2][4]); + uVar27 = 3; + goto LAB_11; + } + pvVar13 = CldSyncGetRootInfo((longlong)ppppplVar26[2][4]); + if (pvVar13 == (void *)0x0) goto LAB_12; + uVar27 = 3; + goto LAB_14; + } + if ((local_148 != -1) && + (cVar7 = FsRtlRemoveBaseMcbEntry(ppppplVar2,pppppplVar16), cVar7 == '\0')) { + local_158 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0 || + ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_7; + uVar18 = 0x4c; + goto LAB_8; + } + pppppplVar16 = (longlong ******)((longlong)pppppplVar16 + local_138); + } + ppppplVar2[0x14] = ppppplVar2[0x15]; + pppppplVar21 = pppppplVar24; LAB_15: - uVar9 = 0xc000cf12; + local_150 = pppppplVar21; + cVar7 = FsRtlLookupBaseMcbEntry(ppppplVar2,pppppplVar21,&local_148,&local_138,0,0,0); + if (cVar7 != '\0') { + if (local_138 != 0) goto code_r0x00014007c3f7; + HsmDbgBreakOnStatus(-0x3fff30ee); + pppppplVar24 = local_150; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qiiiiiiiDiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4d, + (**ppppplVar11)[2],ppppplVar26); + } + uVar15 = Feature_1074201912__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar15 == 0) { + plVar22 = (**ppppplVar11)[2][4]; + pvVar13 = CldSyncGetRootInfo((longlong)ppppplVar26[2][4]); + uVar27 = 4; +LAB_11: + TlmWriteZeroRangeQueryProgress + (plVar22,ppppplVar2[0x17],ppppplVar2[0xb],ppppplVar2[0xc],ppppplVar2[0x14] + ,ppppplVar2[0x15],ppppplVar2[0x16],local_148,pppppplVar24, + (longlong)pvVar13,uVar27); + } + else { + pvVar13 = CldSyncGetRootInfo((longlong)ppppplVar26[2][4]); + if (pvVar13 != (void *)0x0) { + uVar27 = 4; +LAB_14: + pplVar17 = (**ppppplVar11)[2]; + pppplVar12 = ppppplVar2[0x16]; + pppplVar14 = ppppplVar2[0x15]; +LAB_13: TlmWriteZeroRangeQueryProgress - (plVar24,ppppplVar3[0x17],ppppplVar3[0xb],ppppplVar3[0xc], - ppppplVar3[0x14],ppppplVar3[0x15],ppppplVar3[0x16],local_160,local_148, - (longlong)pvVar15,uVar28); + (pplVar17[4],ppppplVar2[0x17],ppppplVar2[0xb],ppppplVar2[0xc], + ppppplVar2[0x14],pppplVar14,pppplVar12,local_148,pppppplVar24, + (longlong)pvVar13,uVar27); + ExFreePoolWithTag(pvVar13,0x69726943); } - else { - pvVar15 = CldSyncGetRootInfo((longlong)ppppplVar13[2][4]); - if (pvVar15 != (void *)0x0) { - uVar28 = 4; -LAB_17: - pplVar20 = (**ppppplVar2)[2]; - pppplVar14 = ppppplVar3[0x16]; - pppplVar17 = ppppplVar3[0x15]; - pppppplVar16 = pppppplVar19; -LAB_16: - uVar9 = 0xc000cf12; - TlmWriteZeroRangeQueryProgress - (pplVar20[4],ppppplVar3[0x17],ppppplVar3[0xb],ppppplVar3[0xc], - ppppplVar3[0x14],pppplVar17,pppplVar14,local_160,pppppplVar16, - (longlong)pvVar15,uVar28); - ExFreePoolWithTag(pvVar15,0x69726943); - } - } - goto LAB_10; - } - if (local_160 != -1) { - ppppplVar3[0x14] = (longlong ****)((longlong)ppppplVar3[0x14] - local_150); - } - pppppplVar19 = (longlong ******)((longlong)pppppplVar19 + local_150); - } - pppplVar17 = (longlong ****)HsmpGetStreamSize((longlong)**ppppplVar2); - pppplVar14 = ppppplVar3[0x14]; - if ((longlong)pppplVar17 < (longlong)ppppplVar3[0x14]) { - pppplVar14 = pppplVar17; - } - ppppplVar3[0x14] = pppplVar14; - pppplVar17 = (longlong ****)HsmpGetStreamSize((longlong)**ppppplVar2); - pppplVar14 = ppppplVar3[0x15]; - pppppplVar19 = local_108; - if ((longlong)pppplVar17 < (longlong)ppppplVar3[0x15]) { - pppplVar14 = pppplVar17; + } +LAB_12: + local_158 = 0xc000cf12; + goto LAB_7; + } + pppplVar14 = (longlong ****)HsmpGetStreamSize((longlong)**ppppplVar11); + pppplVar12 = ppppplVar2[0x14]; + if ((longlong)pppplVar14 < (longlong)ppppplVar2[0x14]) { + pppplVar12 = pppplVar14; + } + ppppplVar2[0x14] = pppplVar12; + pppplVar14 = (longlong ****)HsmpGetStreamSize((longlong)**ppppplVar11); + pppplVar12 = ppppplVar2[0x15]; + pppppplVar16 = local_100; + if ((longlong)pppplVar14 < (longlong)ppppplVar2[0x15]) { + pppplVar12 = pppplVar14; } } else { - ppppplVar3[0x14] = ppppplVar2[10]; - pppplVar14 = ppppplVar2[9]; - } - ppppplVar3[0x15] = pppplVar14; - local_110 = (longlong ******)((longlong)local_110 + 1); - pppppplVar16 = local_118 + 2; - iVar25 = local_158; - local_118 = pppppplVar16; - } while ((longlong)local_110 < (longlong)pppppplVar19); - } - ProbeForWrite(param_2,local_128,1); - local_e0 = 0; - while (iVar10 = (int)pppppplVar26, iVar10 < iVar25) { - ppppplVar13 = local_138[(longlong)iVar10 * 2 + 1]; - puVar23 = (undefined8 *)((longlong)iVar10 * 0x90 + param_2); - pppplVar14 = ppppplVar13[7]; - *puVar23 = ppppplVar13[6]; - puVar23[1] = pppplVar14; - pppplVar14 = ppppplVar13[9]; - puVar23[2] = ppppplVar13[8]; - puVar23[3] = pppplVar14; - pppplVar14 = ppppplVar13[0xb]; - puVar23[4] = ppppplVar13[10]; - puVar23[5] = pppplVar14; - pppplVar14 = ppppplVar13[0xd]; - puVar23[6] = ppppplVar13[0xc]; - puVar23[7] = pppplVar14; - pppplVar14 = ppppplVar13[0xf]; - puVar23[8] = ppppplVar13[0xe]; - puVar23[9] = pppplVar14; - pppplVar14 = ppppplVar13[0x11]; - puVar23[10] = ppppplVar13[0x10]; - puVar23[0xb] = pppplVar14; - pppplVar14 = ppppplVar13[0x13]; - puVar23[0xc] = ppppplVar13[0x12]; - puVar23[0xd] = pppplVar14; - pppplVar14 = ppppplVar13[0x15]; - puVar23[0xe] = ppppplVar13[0x14]; - puVar23[0xf] = pppplVar14; - pppplVar14 = ppppplVar13[0x17]; - puVar23[0x10] = ppppplVar13[0x16]; - puVar23[0x11] = pppplVar14; - local_e0 = iVar10 + 1; - pppppplVar26 = (longlong ******)(ulonglong)local_e0; + ppppplVar2[0x14] = ppppplVar11[10]; + pppplVar12 = ppppplVar11[9]; + } + ppppplVar2[0x15] = pppplVar12; + local_108 = (longlong ******)((longlong)local_108 + 1); + pppppplVar21 = local_110 + 2; + iVar23 = local_140; + local_110 = pppppplVar21; + } while ((longlong)local_108 < (longlong)pppppplVar16); + } + ProbeForWrite(param_2,local_120,1); + local_dc = 0; + while (iVar8 = (int)pppppplVar24, iVar8 < iVar23) { + ppppplVar26 = local_128[(longlong)iVar8 * 2 + 1]; + puVar20 = (undefined8 *)((longlong)iVar8 * 0x90 + param_2); + pppplVar12 = ppppplVar26[7]; + *puVar20 = ppppplVar26[6]; + puVar20[1] = pppplVar12; + pppplVar12 = ppppplVar26[9]; + puVar20[2] = ppppplVar26[8]; + puVar20[3] = pppplVar12; + pppplVar12 = ppppplVar26[0xb]; + puVar20[4] = ppppplVar26[10]; + puVar20[5] = pppplVar12; + pppplVar12 = ppppplVar26[0xd]; + puVar20[6] = ppppplVar26[0xc]; + puVar20[7] = pppplVar12; + pppplVar12 = ppppplVar26[0xf]; + puVar20[8] = ppppplVar26[0xe]; + puVar20[9] = pppplVar12; + pppplVar12 = ppppplVar26[0x11]; + puVar20[10] = ppppplVar26[0x10]; + puVar20[0xb] = pppplVar12; + pppplVar12 = ppppplVar26[0x13]; + puVar20[0xc] = ppppplVar26[0x12]; + puVar20[0xd] = pppplVar12; + pppplVar12 = ppppplVar26[0x15]; + puVar20[0xe] = ppppplVar26[0x14]; + puVar20[0xf] = pppplVar12; + pppplVar12 = ppppplVar26[0x17]; + puVar20[0x10] = ppppplVar26[0x16]; + puVar20[0x11] = pppplVar12; + local_dc = iVar8 + 1; + pppppplVar24 = (longlong ******)(ulonglong)local_dc; } } } -LAB_10: - if (local_f0 != 0) { - CldiSyncReleaseRundown(local_f0); +LAB_7: + if (local_e8 != 0) { + CldiSyncReleaseRundown(local_e8); } KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite(&DAT_1,1); - if (((undefined8 ********)pppppppuStack_68[1] == &pppppppuStack_68) && - ((undefined8 ********)*local_60 == &pppppppuStack_68)) { - *local_60 = pppppppuStack_68; - pppppppuStack_68[1] = local_60; + if (((undefined8 ********)pppppppuStack_60[1] == &pppppppuStack_60) && + ((undefined8 ********)*local_58 == &pppppppuStack_60)) { + *local_58 = pppppppuStack_60; + pppppppuStack_60[1] = local_58; if (((longlong ********)ppppppplStack_b0[1] == &ppppppplStack_b0) && ((longlong ********)*local_a8 == &ppppppplStack_b0)) { *local_a8 = (longlong ******)ppppppplStack_b0; ppppppplStack_b0[1] = (longlong ******)local_a8; ExReleaseResourceLite(&DAT_1); KeLeaveCriticalRegion(); CldiStreamRestartCountdownTimer(); - pppppplVar26 = local_138; - if (local_138 != (longlong ******)0x0) { - lVar11 = (longlong)local_158; - pppppplVar16 = local_138; - if (0 < lVar11) { + pppppplVar24 = local_128; + if (local_128 != (longlong ******)0x0) { + lVar9 = (longlong)local_140; + pppppplVar21 = local_128; + if (0 < lVar9) { do { - if (*pppppplVar16 != (longlong *****)0x0) { - FltReleaseContext(***pppppplVar16); - } - ppppplVar13 = pppppplVar16[1]; - if (ppppplVar13 != (longlong *****)0x0) { - if (ppppplVar13[2] != (longlong ****)0x0) { - FsRtlUninitializeBaseMcb(ppppplVar13); - } - if (ppppplVar13[5] != (longlong ****)0x0) { - FsRtlUninitializeBaseMcb(ppppplVar13 + 3); - } - ExFreePoolWithTag(ppppplVar13,0x67706c43); - } - lVar11 = lVar11 + -1; - pppppplVar16 = pppppplVar16 + 2; - } while (lVar11 != 0); - } - ExFreePoolWithTag(pppppplVar26,0x67706c43); + if (*pppppplVar21 != (longlong *****)0x0) { + FltReleaseContext(***pppppplVar21); + } + ppppplVar26 = pppppplVar21[1]; + if (ppppplVar26 != (longlong *****)0x0) { + if (ppppplVar26[2] != (longlong ****)0x0) { + FsRtlUninitializeBaseMcb(ppppplVar26); + } + if (ppppplVar26[5] != (longlong ****)0x0) { + FsRtlUninitializeBaseMcb(ppppplVar26 + 3); + } + ExFreePoolWithTag(ppppplVar26,0x67706c43); + } + lVar9 = lVar9 + -1; + pppppplVar21 = pppppplVar21 + 2; + } while (lVar9 != 0); + } + ExFreePoolWithTag(pppppplVar24,0x67706c43); } KeLeaveCriticalRegion(); - return (ulonglong)uVar9; + return (ulonglong)local_158; } } LAB_3: - pcVar4 = (code *)swi(0x29); - (*pcVar4)(3); - pcVar4 = (code *)swi(3); - uVar18 = (*pcVar4)(); - return uVar18; -LAB_6: - ppppppplVar12 = ppppppplStack_b0; - pppppplVar16 = local_138; - iVar25 = local_158; - if ((undefined8 ********)ppppppplStack_b0 == &pppppppuStack_68) goto LAB_13; - goto LAB_5; + pcVar3 = (code *)swi(0x29); + (*pcVar3)(3); + pcVar3 = (code *)swi(3); + uVar15 = (*pcVar3)(); + return uVar15; +code_r0x00014007c3f7: + if (local_148 != -1) { + ppppplVar2[0x14] = (longlong ****)((longlong)ppppplVar2[0x14] - local_138); + } + pppppplVar21 = (longlong ******)((longlong)pppppplVar21 + local_138); + goto LAB_15; } ``` ## CldiStreamPrepareRequestForNonCdqCompletion ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling,called| |ratio|0.59| |i_ratio|0.43| |m_ratio|0.94| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamPrepareRequestForNonCdqCompletion|CldiStreamPrepareRequestForNonCdqCompletion| |fullname|CldiStreamPrepareRequestForNonCdqCompletion|CldiStreamPrepareRequestForNonCdqCompletion| |`refcount`|10|18| |`length`|119|133| |`called`|CldiStreamPrepareRequestForMoreProcessing|CldiStreamPrepareRequestForMoreProcessing
Feature_2089223483__private_IsEnabledDeviceUsageNoInline| |`calling`|CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamCdqREMOVE_IO
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
| |paramcount|1|1| |`address`|14001102c|1400110b8| |`sig`|undefined8 __fastcall CldiStreamPrepareRequestForNonCdqCompletion(uint * param_1)|char __fastcall CldiStreamPrepareRequestForNonCdqCompletion(uint * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamPrepareRequestForNonCdqCompletion Called Diff ```diff --- CldiStreamPrepareRequestForNonCdqCompletion called +++ CldiStreamPrepareRequestForNonCdqCompletion called @@ -1,0 +2 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamPrepareRequestForNonCdqCompletion Calling Diff ```diff --- CldiStreamPrepareRequestForNonCdqCompletion calling +++ CldiStreamPrepareRequestForNonCdqCompletion calling @@ -5,0 +6,2 @@ +CldiStreamCdqCOMPLETE_CANCELED_IO +CldiStreamCdqREMOVE_IO ``` ### CldiStreamPrepareRequestForNonCdqCompletion Diff ```diff --- CldiStreamPrepareRequestForNonCdqCompletion +++ CldiStreamPrepareRequestForNonCdqCompletion @@ -1,46 +1,45 @@ -undefined8 CldiStreamPrepareRequestForNonCdqCompletion(uint *param_1) +char CldiStreamPrepareRequestForNonCdqCompletion(uint *param_1) { uint *puVar1; longlong lVar2; longlong *plVar3; code *pcVar4; char cVar5; - undefined7 extraout_var; - undefined8 uVar7; - uint *puVar6; + ulonglong uVar6; cVar5 = (char)param_1[0x1a]; - if (cVar5 == '\0') { - cVar5 = CldiStreamPrepareRequestForMoreProcessing(param_1); - puVar6 = (uint *)CONCAT71(extraout_var,cVar5); - if (!(bool)cVar5) goto LAB_0; + if ((cVar5 == '\0') && (cVar5 = CldiStreamPrepareRequestForMoreProcessing(param_1), !(bool)cVar5)) + { + return (bool)cVar5; } puVar1 = param_1 + 2; lVar2 = *(longlong *)puVar1; if ((*(uint **)(lVar2 + 8) == puVar1) && (plVar3 = *(longlong **)(param_1 + 4), (uint *)*plVar3 == puVar1)) { *plVar3 = lVar2; *(longlong **)(lVar2 + 8) = plVar3; - puVar6 = param_1 + 6; *(uint **)(param_1 + 4) = puVar1; *(uint **)puVar1 = puVar1; - lVar2 = *(longlong *)puVar6; - if ((*(uint **)(lVar2 + 8) == puVar6) && - (plVar3 = *(longlong **)(param_1 + 8), (uint *)*plVar3 == puVar6)) { + uVar6 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 == 0) { + puVar1 = param_1 + 6; + lVar2 = *(longlong *)puVar1; + if ((*(uint **)(lVar2 + 8) != puVar1) || + (plVar3 = *(longlong **)(param_1 + 8), (uint *)*plVar3 != puVar1)) goto LAB_0; *plVar3 = lVar2; *(longlong **)(lVar2 + 8) = plVar3; - *(uint **)(param_1 + 8) = puVar6; - *(uint **)puVar6 = puVar6; + *(uint **)(param_1 + 8) = puVar1; + *(uint **)puVar1 = puVar1; + } + return cVar5; + } LAB_0: - return CONCAT71((int7)((ulonglong)puVar6 >> 8),cVar5); - } - } pcVar4 = (code *)swi(0x29); (*pcVar4)(3); pcVar4 = (code *)swi(3); - uVar7 = (*pcVar4)(); - return uVar7; + cVar5 = (*pcVar4)(); + return cVar5; } ``` ## CldStreamCdqREMOVE_IO ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.53| |i_ratio|0.11| |m_ratio|0.42| |b_ratio|0.11| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldStreamCdqREMOVE_IO|CldStreamCdqREMOVE_IO| |fullname|CldStreamCdqREMOVE_IO|CldStreamCdqREMOVE_IO| |refcount|3|3| |`length`|47|14| |`called`|CldiStreamPrepareRequestForCdqCompletion|CldiStreamCdqREMOVE_IO| |calling||| |paramcount|2|2| |`address`|14003fb70|14003fb30| |sig|undefined __fastcall CldStreamCdqREMOVE_IO(undefined8 param_1, longlong param_2)|undefined __fastcall CldStreamCdqREMOVE_IO(undefined8 param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldStreamCdqREMOVE_IO Called Diff ```diff --- CldStreamCdqREMOVE_IO called +++ CldStreamCdqREMOVE_IO called @@ -1 +1 @@ -CldiStreamPrepareRequestForCdqCompletion +CldiStreamCdqREMOVE_IO ``` ### CldStreamCdqREMOVE_IO Diff ```diff --- CldStreamCdqREMOVE_IO +++ CldStreamCdqREMOVE_IO @@ -1,13 +1,8 @@ void CldStreamCdqREMOVE_IO(undefined8 param_1,longlong param_2) { - undefined8 *puVar1; - - for (puVar1 = *(undefined8 **)(param_2 + 0x30); puVar1 != (undefined8 *)(param_2 + 0x30); - puVar1 = (undefined8 *)*puVar1) { - CldiStreamPrepareRequestForCdqCompletion((uint *)(puVar1 + -3)); - } + CldiStreamCdqREMOVE_IO(param_1,param_2); return; } ``` ## HsmiRecallInitiateHydration ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.16| |i_ratio|0.34| |m_ratio|0.99| |b_ratio|0.53| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|HsmiRecallInitiateHydration|HsmiRecallInitiateHydration| |fullname|HsmiRecallInitiateHydration|HsmiRecallInitiateHydration| |refcount|3|3| |`length`|3025|2821| |`called`|
Expand for full list:
FLTMGR.SYS::FltAcquirePushLockSharedEx
FLTMGR.SYS::FltLockUserBuffer
FLTMGR.SYS::FltReleasePushLockEx
HsmDbgBreakOnStatus
HsmExpandKernelStackAndCallout
HsmiGetBitmap
HsmiRecallHydrationCompletionCallback
HsmpBitmapCreateSnapshot
HsmpCreateProcessInfo
HsmpGetStreamSize
HsmpReleaseBitmapLockNTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
TlmInitializeCorrelationVector
WPP_SF_qqLiqiqd
WPP_SF_qqllcclqqLiqiii
WPP_SF_qqqqLiqid
_guard_dispatch_icall
|
Expand for full list:
FLTMGR.SYS::FltLockUserBuffer
FLTMGR.SYS::FltReleasePushLockEx
Feature_2092950840__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
HsmiGetBitmap
HsmiQueryFileRangeNoLock
HsmiRecallHydrationCompletionCallback
HsmpAcquireBitmapLock
HsmpAcquireReparseUpdateLock
HsmpBitmapCreateSnapshot
HsmpCreateProcessInfoHsmpGetStreamSize
HsmpReleaseBitmapLock
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::KeSetEvent
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
TlmInitializeCorrelationVector
WPP_SF_qqLiqiqd
WPP_SF_qqllcclqqLiqiii
WPP_SF_qqqqLiqid
_guard_dispatch_icall
| |calling|HsmiRecallPostProcessHydration
HsmpRecallInitiateHydrationEx|HsmiRecallPostProcessHydration
HsmpRecallInitiateHydrationEx| |paramcount|3|3| |`address`|14007702c|1400863ac| |`sig`|undefined1 __fastcall HsmiRecallInitiateHydration(longlong param_1, undefined8 param_2, undefined * param_3)|undefined1 __fastcall HsmiRecallInitiateHydration(longlong param_1, undefined8 param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmiRecallInitiateHydration Called Diff ```diff --- HsmiRecallInitiateHydration called +++ HsmiRecallInitiateHydration called @@ -1 +0,0 @@ -FLTMGR.SYS::FltAcquirePushLockSharedEx @@ -3,0 +3 @@ +Feature_2092950840__private_IsEnabledDeviceUsageNoInline @@ -5 +4,0 @@ -HsmExpandKernelStackAndCallout @@ -6,0 +6 @@ +HsmiQueryFileRangeNoLock @@ -7,0 +8,2 @@ +HsmpAcquireBitmapLock +HsmpAcquireReparseUpdateLock ``` ### HsmiRecallInitiateHydration Diff ```diff --- HsmiRecallInitiateHydration +++ HsmiRecallInitiateHydration @@ -1,418 +1,391 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -undefined1 HsmiRecallInitiateHydration(longlong param_1,undefined8 param_2,undefined *param_3) +undefined1 HsmiRecallInitiateHydration(longlong param_1,undefined8 param_2,undefined8 param_3) { uint *puVar1; char cVar2; - uint uVar3; - longlong lVar4; - byte bVar5; + longlong lVar3; + undefined1 uVar4; + uint uVar5; uint uVar6; ulonglong uVar7; - longlong lVar8; - ulonglong uVar9; + ulonglong uVar8; + undefined *puVar9; longlong lVar10; - undefined2 uVar11; - int iVar12; - int *piVar13; - undefined *puVar14; - longlong *plVar15; - undefined *puVar16; - ulonglong *puVar17; + int iVar11; + longlong lVar12; + undefined2 uVar13; + longlong *plVar14; + ulonglong *puVar15; + ulonglong *puVar16; + undefined1 uVar17; undefined *puVar18; - undefined *puVar19; - ulonglong *puVar20; - undefined1 uVar21; + longlong *plVar19; byte local_res8 [8]; char local_res10; char local_res18; char local_res20; - ulonglong in_stack_fffffffffffffe08; - undefined8 in_stack_fffffffffffffe10; - undefined4 uVar22; - undefined *local_168; - uint local_160; - uint local_15c; - ulonglong local_158; - undefined *local_150; - ulonglong *local_148; - uint local_140; - undefined8 local_138; - undefined8 local_130; - longlong local_128; - undefined *local_120; - longlong local_118; - ulonglong *local_110; - ulonglong local_108; + ulonglong in_stack_fffffffffffffe68; + undefined8 in_stack_fffffffffffffe70; + undefined4 uVar20; longlong local_100; - ulonglong local_f8; - longlong local_f0; + uint local_f8; + undefined8 local_f0; ulonglong local_e8; - longlong local_e0; - ulonglong *local_d8; + ulonglong *local_e0; + uint local_d8; longlong local_d0; - undefined *local_c8; - longlong local_c0; - undefined8 local_b8; - ulonglong *local_b0; - undefined **local_a8; - byte *local_a0; - undefined **local_98; - int local_90 [2]; - longlong local_88; - undefined8 local_80; - ulonglong *local_78; - undefined **local_70; - byte *local_68; - undefined **local_60; - int local_58 [6]; + undefined8 local_c8; + longlong *local_c0; + longlong local_b8; + longlong *local_b0; + ulonglong *local_a8; + ulonglong local_a0; + longlong *local_98; + longlong local_90; + ulonglong local_88; + longlong local_80; + ulonglong local_78; + longlong local_70; + ulonglong *local_68; + longlong local_60; + longlong *local_58; - uVar22 = (undefined4)((ulonglong)in_stack_fffffffffffffe10 >> 0x20); - puVar20 = (ulonglong *)0x0; - local_d8 = (ulonglong *)0x0; - local_128 = 0; - local_f8 = 0; - local_140 = 0; + uVar20 = (undefined4)((ulonglong)in_stack_fffffffffffffe70 >> 0x20); + puVar15 = (ulonglong *)0x0; + local_68 = (ulonglong *)0x0; + local_d0 = 0; + local_88 = 0; + local_d8 = 0; local_res10 = '\0'; local_res18 = '\0'; local_res20 = '\0'; - local_160 = 0; - local_e0 = 0; - puVar17 = puVar20; + local_f8 = 0; + local_70 = 0; + puVar16 = puVar15; if ((*(uint *)(param_1 + 0x30) & 0x200) == 0) { - puVar17 = *(ulonglong **)(param_1 + 0x18); - } - local_118 = *(longlong *)(param_1 + 0x70); - lVar4 = *(longlong *)(param_1 + 0x78); - lVar10 = *(longlong *)(lVar4 + 0x10); - local_130 = *(undefined8 *)(lVar10 + 0x20); - local_138 = *(undefined8 *)(lVar10 + 0x10); - local_110 = puVar20; - if (local_118 != 0) { - local_110 = *(ulonglong **)(local_118 + 0x48); - } - local_d0 = *(longlong *)(param_1 + 0x68); - local_148 = puVar17; - local_100 = lVar10; - if ((local_110 == (ulonglong *)0x0) && (puVar17 != (ulonglong *)0x0)) { - local_110 = HsmpCreateProcessInfo(local_d0); - lVar10 = *(longlong *)(lVar4 + 0x10); - local_d8 = local_110; - } - FltAcquirePushLockSharedEx(lVar10 + 0x18,0); - if (*(longlong *)(lVar4 + 0xa0) != 0) { - FltAcquirePushLockSharedEx(*(longlong *)(lVar4 + 0xa0) + 0x28,0); - } - local_168 = (undefined *)HsmpGetStreamSize(lVar4); - *(int *)(param_1 + 0x34) = *(int *)(param_1 + 0x34) + 1; - puVar16 = param_3; - if ((longlong)local_168 <= *(longlong *)(param_1 + 0x48)) goto LAB_0; - if (((puVar17 != (ulonglong *)0x0) && - (cVar2 = *(char *)(puVar17[2] + 4), puVar20 = (ulonglong *)0x0, - cVar2 == '\x03' || cVar2 == '\x04')) && (*(char *)(puVar17[2] + 5) != '\x02')) { - uVar6 = FltLockUserBuffer(puVar17); - puVar20 = (ulonglong *)(ulonglong)uVar6; - HsmDbgBreakOnStatus(uVar6); - if ((int)uVar6 < 0) { - param_3 = WPP_GLOBAL_Control; + puVar16 = *(ulonglong **)(param_1 + 0x18); + } + local_b8 = *(longlong *)(param_1 + 0x70); + lVar3 = *(longlong *)(param_1 + 0x78); + local_90 = *(longlong *)(lVar3 + 0x10); + local_f0 = *(undefined8 *)(local_90 + 0x20); + local_c8 = *(undefined8 *)(local_90 + 0x10); + local_a8 = puVar15; + if (local_b8 != 0) { + local_a8 = *(ulonglong **)(local_b8 + 0x48); + } + local_60 = *(longlong *)(param_1 + 0x68); + local_e0 = puVar16; + if ((local_a8 == (ulonglong *)0x0) && (puVar16 != (ulonglong *)0x0)) { + local_a8 = HsmpCreateProcessInfo(local_60); + local_68 = local_a8; + } + HsmpAcquireReparseUpdateLock(lVar3,'\0'); + HsmpAcquireBitmapLock(lVar3,'\0'); + local_100 = HsmpGetStreamSize(lVar3); + uVar7 = Feature_2092950840__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + *(int *)(param_1 + 0x34) = *(int *)(param_1 + 0x34) + 1; + } + else { + LOCK(); + *(int *)(param_1 + 0x34) = *(int *)(param_1 + 0x34) + 1; + UNLOCK(); + } + if (local_100 <= *(longlong *)(param_1 + 0x48)) goto LAB_0; + if (((puVar16 != (ulonglong *)0x0) && + (cVar2 = *(char *)(puVar16[2] + 4), puVar15 = (ulonglong *)0x0, + cVar2 == '\x03' || cVar2 == '\x04')) && (*(char *)(puVar16[2] + 5) != '\x02')) { + uVar5 = FltLockUserBuffer(puVar16); + puVar15 = (ulonglong *)(ulonglong)uVar5; + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29]) ) { WPP_SF_qqqqLiqid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x20,WPP_GLOBAL_Control,param_1) ; } } else { - uVar9 = puVar17[2]; - if (((*(char *)(uVar9 + 4) == '\x03') && (*(char *)(uVar9 + 5) != '\x02')) && + uVar7 = puVar16[2]; + if (((*(char *)(uVar7 + 4) == '\x03') && (*(char *)(uVar7 + 5) != '\x02')) && (((*(uint *)(param_1 + 0x28) >> 8 & 1) == 0 && (((byte)*(uint *)(param_1 + 0x28) & 0xf) < 3)))) { - local_f8 = *(ulonglong *)(uVar9 + 0x28); - lVar10 = *(longlong *)(uVar9 + 0x38); + local_88 = *(ulonglong *)(uVar7 + 0x28); + lVar10 = *(longlong *)(uVar7 + 0x38); local_res10 = '\x01'; if ((*(byte *)(lVar10 + 10) & 5) == 0) { - param_3 = (undefined *)0x1; - local_128 = MmMapLockedPagesSpecifyCache - (lVar10,0,1,0,in_stack_fffffffffffffe08 & 0xffffffff00000000, - CONCAT44(uVar22,0x40000010)); + param_3 = 1; + local_d0 = MmMapLockedPagesSpecifyCache + (lVar10,0,1,0,in_stack_fffffffffffffe68 & 0xffffffff00000000, + CONCAT44(uVar20,0x40000010)); } else { - local_128 = *(longlong *)(lVar10 + 0x18); - } - if (local_128 == 0) { - puVar20 = (ulonglong *)0xc000009a; + local_d0 = *(longlong *)(lVar10 + 0x18); + } + if (local_d0 == 0) { + puVar15 = (ulonglong *)0xc000009a; HsmDbgBreakOnStatus(-0x3fffff66); - puVar16 = param_3; if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) goto LAB_0; if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0) goto LAB_0; if ((byte)WPP_GLOBAL_Control[0x29] < 2) goto LAB_0; WPP_SF_qqqqLiqid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x21,param_3,param_1); - puVar16 = param_3; goto LAB_0; } - local_140 = *(uint *)(*(longlong *)(puVar17[2] + 0x38) + 0x28); + local_d8 = *(uint *)(*(longlong *)(puVar16[2] + 0x38) + 0x28); } } } do { - uVar6 = *(uint *)(param_1 + 0x30) >> 6 & 7; - puVar16 = param_3; - local_15c = uVar6; + uVar5 = *(uint *)(param_1 + 0x30) >> 6 & 7; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - puVar16 = *(undefined **)(param_1 + 0x48); - WPP_SF_qqllcclqqLiqiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x22,puVar16,param_1); - } - uVar3 = *(uint *)(lVar4 + 0x1c); - uVar9 = (ulonglong)(~uVar3 & 2); - puVar18 = (undefined *) - ((*(ulonglong *)(param_1 + 0x48) - 1) + *(longlong *)(param_1 + 0x50) + uVar9 * 0x800 - & uVar9 * -0x800); + WPP_SF_qqllcclqqLiqiii + (*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x22,*(undefined8 *)(param_1 + 0x48), + param_1); + } + uVar6 = *(uint *)(lVar3 + 0x1c); *(uint *)(param_1 + 0x30) = *(uint *)(param_1 + 0x30) & 0xffffffdf; - local_158 = ~-(ulonglong)((uVar3 & 2) != 0) & 0xfffffffffffff000 & - *(ulonglong *)(param_1 + 0x48); - local_e8 = local_158; - local_c8 = puVar18; - while (((longlong)local_158 < (longlong)puVar18 && ((longlong)local_158 < (longlong)local_168))) - { - puVar20 = (ulonglong *)0x0; - uVar21 = 0; - local_res8[0] = 0; - local_f0 = 0; - local_108 = 0; - local_120 = (undefined *)0x0; - local_150 = (undefined *)0x0; - if (uVar6 == 1) { - lVar10 = *(longlong *)(*(longlong *)(lVar4 + 0xa0) + 0x38); - bVar5 = (byte)(*(uint *)(lVar4 + 0x1c) >> 6); - if (lVar10 == 0) goto LAB_1; - local_b0 = &local_158; - local_b8 = 7; - piVar13 = local_90; - local_a8 = &local_168; - local_90[0] = 0; - local_90[1] = 0; - local_a0 = local_res8; - local_98 = &local_150; - local_c0 = lVar10; -LAB_2: - uVar6 = HsmExpandKernelStackAndCallout(HsmpBitmapQueryRangeExCallout,piVar13); - puVar20 = (ulonglong *)(ulonglong)uVar6; + uVar7 = (ulonglong)(~uVar6 & 2); + local_e8 = ~-(ulonglong)((uVar6 & 2) != 0) & 0xfffffffffffff000 & *(ulonglong *)(param_1 + 0x48) + ; + plVar19 = (longlong *) + ((*(ulonglong *)(param_1 + 0x48) - 1) + *(longlong *)(param_1 + 0x50) + uVar7 * 0x800 + & uVar7 * -0x800); + local_78 = local_e8; + local_58 = plVar19; + if ((longlong)local_e8 < (longlong)plVar19) { + do { + if (local_100 <= (longlong)local_e8) break; + puVar16 = &local_e8; + local_res8[0] = 0; + local_80 = 0; + local_a0 = 0; + local_c0 = (longlong *)0x0; + local_b0 = (longlong *)0x0; + iVar11 = 0x4244; + if (uVar5 != 1) { + iVar11 = 0x4256; + } + uVar6 = HsmiQueryFileRangeNoLock(lVar3,iVar11,puVar16,&local_100,local_res8,&local_b0); + puVar15 = (ulonglong *)(ulonglong)uVar6; HsmDbgBreakOnStatus(uVar6); - HsmDbgBreakOnStatus(uVar6); - } - else { - lVar10 = *(longlong *)(*(longlong *)(lVar4 + 0xa0) + 0x40); - bVar5 = (byte)((uint)*(undefined4 *)(lVar4 + 0x1c) >> 8); - if (lVar10 != 0) { - local_78 = &local_158; - local_80 = 7; - piVar13 = local_58; - local_70 = &local_168; - local_58[0] = 0; - local_58[1] = 0; - local_68 = local_res8; - local_60 = &local_150; - local_88 = lVar10; + if ((int)uVar6 < 0) { + if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || + ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_1; + uVar13 = 0x23; goto LAB_2; } + local_98 = local_b0; + if ((longlong)plVar19 < (longlong)local_b0) { + local_98 = plVar19; + } + if (local_res8[0] == 0) { + local_res20 = '\x01'; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qqllcclqqLiqiii + (*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x24, + *(undefined8 *)(param_1 + 0x48),param_1); + } + plVar19 = local_98; + puVar16 = local_e0; + if (local_d0 != 0) { + uVar7 = *(ulonglong *)(local_e0[2] + 0x28); + uVar8 = uVar7; + if ((longlong)uVar7 < (longlong)local_e8) { + uVar8 = local_e8; + } + local_80 = uVar8 - uVar7; + } + if ((((*(uint *)(param_1 + 0x28) & 0x100) != 0) && + (lVar10 = IoGetTopLevelIrp(), lVar10 != 0)) && (*(char *)(puVar16[2] + 4) != -1)) { + puVar15 = (ulonglong *)0xc00000e5; + HsmDbgBreakOnStatus(-0x3fffff1b); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qqLiqiqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x25, + &WPP_9955b50884a13cf5060ea108913d3ae4_Traceguids,local_c8); + } + goto LAB_1; + } + LOCK(); + *(int *)(param_1 + 0x34) = *(int *)(param_1 + 0x34) + 1; + UNLOCK(); + if (local_d0 != 0) { + local_a0 = local_88; + if ((longlong)local_88 < (longlong)local_e8) { + local_a0 = local_e8; + } + local_c0 = plVar19; + if ((longlong)(local_88 + local_d8) < (longlong)plVar19) { + local_c0 = (longlong *)(local_88 + local_d8); + } + } + if (local_b8 != 0) { + TlmInitializeCorrelationVector(local_b8,(undefined8 *)0x0); + } + puVar1 = (uint *)(param_1 + 0x2c); + uVar6 = *puVar1; + if (uVar5 == 1) { + local_f8 = 0; + *puVar1 = uVar6 | 0x20; + uVar6 = uVar6 & 0xffffffbf | 0x20; + } + else { + if ((uVar6 & 0x20) == 0) { + local_f8 = 1; + } + uVar6 = uVar6 | 0x40; + } + *puVar1 = uVar6; + if (((byte)*(undefined4 *)(param_1 + 0x30) & 0x1f) == 4) { +LAB_3: + local_f8 = local_f8 | 2; + if (local_b8 != 0) goto LAB_4; +LAB_5: + puVar9 = *(undefined **)(lVar3 + 0x68); + } + else { + if (local_b8 == 0) goto LAB_5; + if ((*(uint *)(local_b8 + 0x28) & 0x400) != 0) goto LAB_3; +LAB_4: + puVar9 = *(undefined **)(local_b8 + 0x60); + } + puVar18 = &DAT_6; + if (puVar9 != (undefined *)0x0) { + puVar18 = puVar9; + } + plVar19 = &local_70; + if (((byte)*(undefined4 *)(param_1 + 0x28) & 0xf) < 3) { + plVar19 = (longlong *)0x0; + } + plVar14 = (longlong *)0x0; + if ((longlong)local_98 < (longlong)local_b0) { + plVar14 = local_98; + } + iVar11 = (int)local_c0 - (int)local_a0; + local_c0 = (longlong *)CONCAT44(local_c0._4_4_,iVar11); + (*DAT_7)(local_60,local_e0,*(undefined8 *)(lVar3 + 8),param_1 + 0x58,local_f8, + local_e8,(longlong)local_98 - local_e8,plVar14, + (longlong)local_b0 - (longlong)local_98,*(undefined4 *)(param_1 + 0x2c), + local_d0 + local_80,local_a0,iVar11,HsmiRecallHydrationCompletionCallback + ,*(undefined8 *)(param_1 + 0xa0),*(undefined4 *)(param_1 + 0xa8),param_1, + plVar19,local_a8,puVar18); + *(uint *)(param_1 + 0x30) = *(uint *)(param_1 + 0x30) | 0x20; + plVar19 = local_58; + } + else { + local_res18 = '\x01'; + } + uVar7 = (ulonglong)(~*(uint *)(lVar3 + 0x1c) & 2); + local_e8 = uVar7 * 0x800 + -1 + (longlong)local_98 & uVar7 * -0x800; + } while ((longlong)local_e8 < (longlong)plVar19); + } + uVar7 = local_78; + if (((local_res10 == '\0') || (local_res18 == '\0')) || (local_res20 == '\0')) { +LAB_0: + if (-1 < (int)puVar15) goto LAB_8; LAB_1: - local_res8[0] = bVar5 & 1; - local_150 = local_168; - } - HsmDbgBreakOnStatus((int)puVar20); - if ((int)puVar20 < 0) { - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_3; - uVar11 = 0x23; - goto LAB_4; - } - puVar19 = local_150; - if ((longlong)puVar18 < (longlong)local_150) { - puVar19 = puVar18; - } - if (local_res8[0] == 0) { - local_res20 = '\x01'; + uVar7 = Feature_2092950840__private_IsEnabledDeviceUsageNoInline(); + iVar11 = (int)uVar7; + uVar17 = 0; + uVar5 = (uint)puVar15; + uVar4 = 0; + if ((int)uVar5 < 0) break; + } + else { + puVar16 = (ulonglong *)0x0; + plVar14 = (longlong *)(param_1 + 0x80); + iVar11 = 0x4244; + if (uVar5 != 1) { + iVar11 = 0x4256; + } + lVar10 = HsmiGetBitmap(lVar3,iVar11,(byte *)0x0); + uVar5 = HsmpBitmapCreateSnapshot(uVar7,(longlong)plVar19,puVar16,lVar10,plVar14); + puVar15 = (ulonglong *)(ulonglong)uVar5; + HsmDbgBreakOnStatus(uVar5); + if ((int)uVar5 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - puVar16 = *(undefined **)(param_1 + 0x48); - WPP_SF_qqllcclqqLiqiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x24,puVar16,param_1); - } - lVar10 = local_128; - puVar17 = local_148; - uVar21 = 0; - if (local_128 != 0) { - uVar9 = *(ulonglong *)(local_148[2] + 0x28); - uVar7 = uVar9; - if ((longlong)uVar9 < (longlong)local_158) { - uVar7 = local_158; - } - local_f0 = uVar7 - uVar9; - } - if ((((*(uint *)(param_1 + 0x28) & 0x100) != 0) && (lVar8 = IoGetTopLevelIrp(), lVar8 != 0)) - && (*(char *)(puVar17[2] + 4) != -1)) { - puVar20 = (ulonglong *)0xc00000e5; - HsmDbgBreakOnStatus(-0x3fffff1b); - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_3; - puVar16 = &WPP_90d90319080d37dc59c5c10476ea6a33_Traceguids; - WPP_SF_qqLiqiqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x25, - &WPP_90d90319080d37dc59c5c10476ea6a33_Traceguids,local_138); - goto LAB_5; - } - LOCK(); - *(int *)(param_1 + 0x34) = *(int *)(param_1 + 0x34) + 1; - UNLOCK(); - if (lVar10 != 0) { - local_108 = local_f8; - if ((longlong)local_f8 < (longlong)local_158) { - local_108 = local_158; - } - local_120 = puVar19; - if ((longlong)(local_f8 + local_140) < (longlong)puVar19) { - local_120 = (undefined *)(local_f8 + local_140); - } - } - if (local_118 != 0) { - TlmInitializeCorrelationVector(local_118,(undefined8 *)0x0); - } - puVar1 = (uint *)(param_1 + 0x2c); - uVar6 = *puVar1; - if (local_15c == 1) { - local_160 = 0; - *puVar1 = uVar6 | 0x20; - uVar6 = uVar6 & 0xffffffbf | 0x20; - } - else { - if ((uVar6 & 0x20) == 0) { - local_160 = 1; - } - uVar6 = uVar6 | 0x40; - } - *puVar1 = uVar6; - if (((byte)*(undefined4 *)(param_1 + 0x30) & 0x1f) == 4) { -LAB_6: - local_160 = local_160 | 2; - if (local_118 != 0) goto LAB_7; + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + uVar13 = 0x26; +LAB_2: + WPP_SF_qqqqLiqid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar13,puVar16,local_f0); + } + goto LAB_1; + } LAB_8: - puVar16 = *(undefined **)(lVar4 + 0x68); - } - else { - if (local_118 == 0) goto LAB_8; - if ((*(uint *)(local_118 + 0x28) & 0x400) != 0) goto LAB_6; -LAB_7: - puVar16 = *(undefined **)(local_118 + 0x60); - } - plVar15 = &local_e0; - puVar18 = &DAT_9; - if (puVar16 != (undefined *)0x0) { - puVar18 = puVar16; - } - if (((byte)*(undefined4 *)(param_1 + 0x28) & 0xf) < 3) { - plVar15 = (longlong *)0x0; - } - puVar14 = (undefined *)0x0; - if ((longlong)puVar19 < (longlong)local_150) { - puVar14 = puVar19; - } - iVar12 = (int)local_120 - (int)local_108; - local_120 = (undefined *)CONCAT44(local_120._4_4_,iVar12); - puVar16 = *(undefined **)(lVar4 + 8); - (*DAT_10)(local_d0,local_148,puVar16,param_1 + 0x58,local_160,local_158, - (longlong)puVar19 - local_158,puVar14, - (longlong)local_150 - (longlong)puVar19,*(undefined4 *)(param_1 + 0x2c), - local_128 + local_f0,local_108,iVar12,HsmiRecallHydrationCompletionCallback - ,*(undefined8 *)(param_1 + 0xa0),*(undefined4 *)(param_1 + 0xa8),param_1, - plVar15,local_110,puVar18); - *(uint *)(param_1 + 0x30) = *(uint *)(param_1 + 0x30) | 0x20; - puVar18 = local_c8; - } - else { - local_res18 = '\x01'; - } - uVar9 = (ulonglong)(~*(uint *)(lVar4 + 0x1c) & 2); - uVar6 = local_15c; - local_158 = (ulonglong)(puVar19 + uVar9 * 0x800 + -1) & uVar9 * -0x800; - } - uVar21 = 0; - if (((local_res10 == '\0') || (local_res18 == '\0')) || (local_res20 == '\0')) { -LAB_0: - uVar21 = 0; - if (-1 < (int)puVar20) goto LAB_11; + if ((*(uint *)(param_1 + 0x30) & 0x20) == 0) goto LAB_1; + uVar7 = Feature_2092950840__private_IsEnabledDeviceUsageNoInline(); + iVar11 = (int)uVar7; + uVar4 = 1; + } + uVar17 = uVar4; + uVar5 = (uint)puVar15; + if (((byte)*(undefined4 *)(param_1 + 0x28) & 0xf) != 2) break; + if (iVar11 == 0) { + if (((*(uint *)(param_1 + 0x30) & 0x200) == 0) || (*(int *)(param_1 + 0x34) != 1)) break; + uVar6 = *(uint *)(param_1 + 0x30); + if (((uVar6 & 0x1c0) != 0x40) || ((*(uint *)(param_1 + 0x28) & 0x100) == 0)) { + lVar10 = *(longlong *)(param_1 + 0x48); + if ((local_100 <= lVar10) && ((uVar6 & 0x400) == 0)) goto LAB_9; +LAB_10: + lVar10 = *(longlong *)(param_1 + 0x50) + lVar10; + goto LAB_11; + } +LAB_12: + *(uint *)(param_1 + 0x30) = (uVar6 + 0x40 ^ uVar6) & 0x1c0 ^ uVar6; } else { - puVar16 = (undefined *)0x0; - plVar15 = (longlong *)(param_1 + 0x80); - iVar12 = 0x4244; - if (uVar6 != 1) { - iVar12 = 0x4256; - } - lVar10 = HsmiGetBitmap(lVar4,iVar12,(byte *)0x0); - uVar6 = HsmpBitmapCreateSnapshot(local_e8,(longlong)puVar18,puVar16,lVar10,plVar15); - puVar20 = (ulonglong *)(ulonglong)uVar6; - HsmDbgBreakOnStatus(uVar6); - if ((int)uVar6 < 0) { - if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || - ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_3; - uVar11 = 0x26; -LAB_4: - WPP_SF_qqqqLiqid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar11,puVar16,local_130); - } - else { + if ((*(uint *)(param_1 + 0x30) & 0x200) == 0) break; + LOCK(); + iVar11 = *(int *)(param_1 + 0x34); + if (iVar11 == 0) { + *(int *)(param_1 + 0x34) = 0; + iVar11 = 0; + } + UNLOCK(); + if (iVar11 != 1) break; + uVar6 = *(uint *)(param_1 + 0x30); + if (((uVar6 & 0x1c0) == 0x40) && ((*(uint *)(param_1 + 0x28) & 0x100) != 0)) + goto LAB_12; + lVar10 = *(longlong *)(param_1 + 0x48); + if ((lVar10 < local_100) || ((uVar6 & 0x400) != 0)) goto LAB_10; +LAB_9: + uVar6 = uVar6 | 0x400; + *(uint *)(param_1 + 0x30) = uVar6; + lVar10 = 0; LAB_11: - if ((*(uint *)(param_1 + 0x30) & 0x20) != 0) { - uVar21 = 1; - goto LAB_3; - } - } -LAB_5: - uVar21 = 0; - } -LAB_3: - param_3 = (undefined *)0x0; - if ((((int)(uint)puVar20 < 0) || (((byte)*(undefined4 *)(param_1 + 0x28) & 0xf) != 2)) || - (((*(uint *)(param_1 + 0x30) & 0x200) == 0 || (*(int *)(param_1 + 0x34) != 1)))) break; - uVar6 = *(uint *)(param_1 + 0x30); - if (((uVar6 & 0x1c0) == 0x40) && ((*(uint *)(param_1 + 0x28) & 0x100) != 0)) { - *(uint *)(param_1 + 0x30) = (uVar6 + 0x40 ^ uVar6) & 0x1c0 ^ uVar6; - param_3 = puVar16; - } - else { - if ((*(longlong *)(param_1 + 0x48) < (longlong)local_168) || ((uVar6 >> 10 & 1) != 0)) { - param_3 = (undefined *)(*(longlong *)(param_1 + 0x50) + *(longlong *)(param_1 + 0x48)); - } - else { - uVar6 = uVar6 | 0x400; - *(uint *)(param_1 + 0x30) = uVar6; - } - *(undefined **)(param_1 + 0x48) = param_3; - puVar16 = local_168; - if ((longlong)(param_3 + 0x1000) < (longlong)local_168) { - puVar16 = param_3 + 0x1000; - } - *(longlong *)(param_1 + 0x50) = (longlong)puVar16 - (longlong)param_3; - if ((longlong)param_3 < (longlong)local_168) { + *(longlong *)(param_1 + 0x48) = lVar10; + lVar12 = local_100; + if (lVar10 + 0x1000 < local_100) { + lVar12 = lVar10 + 0x1000; + } + *(longlong *)(param_1 + 0x50) = lVar12 - lVar10; + if (lVar10 < local_100) { *(uint *)(param_1 + 0x2c) = *(uint *)(param_1 + 0x2c) & 0xffffffdf; *(uint *)(param_1 + 0x30) = uVar6 & 0xfffffe7f | 0x40; } } - } while (*(longlong *)(param_1 + 0x48) < (longlong)local_168); - HsmpReleaseBitmapLock(lVar4); - FltReleasePushLockEx(*(longlong *)(lVar4 + 0x10) + 0x18,0); - HsmiRecallHydrationCompletionCallback(param_1,(uint)puVar20); - if (local_e0 != 0) { - KeSetEvent(local_e0,0,0); - } - if (local_d8 != (ulonglong *)0x0) { - ExFreePoolWithTag(local_d8,0x69507348); - } - return uVar21; + } while (*(longlong *)(param_1 + 0x48) < local_100); + HsmpReleaseBitmapLock(lVar3); + FltReleasePushLockEx(*(longlong *)(lVar3 + 0x10) + 0x18,0); + HsmiRecallHydrationCompletionCallback(param_1,uVar5); + if (local_70 != 0) { + KeSetEvent(local_70,0,0); + } + if (local_68 != (ulonglong *)0x0) { + ExFreePoolWithTag(local_68,0x69507348); + } + return uVar17; } ``` ## CldiStreamCdqCOMPLETE_CANCELED_IO ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.3| |i_ratio|0.4| |m_ratio|0.75| |b_ratio|0.68| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamCdqCOMPLETE_CANCELED_IO|CldiStreamCdqCOMPLETE_CANCELED_IO| |fullname|CldiStreamCdqCOMPLETE_CANCELED_IO|CldiStreamCdqCOMPLETE_CANCELED_IO| |refcount|2|2| |`length`|237|388| |`called`|CldiStreamCompleteCanceledRequest
WPP_SF_qqiq|CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
WPP_SF_qqiq| |calling|CldStreamCdqCOMPLETE_CANCELED_IO|CldStreamCdqCOMPLETE_CANCELED_IO| |paramcount|3|3| |`address`|140040874|140040a7c| |`sig`|undefined __fastcall CldiStreamCdqCOMPLETE_CANCELED_IO(undefined8 param_1, longlong param_2, undefined8 param_3)|undefined __fastcall CldiStreamCdqCOMPLETE_CANCELED_IO(longlong * param_1, longlong param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCdqCOMPLETE_CANCELED_IO Called Diff ```diff --- CldiStreamCdqCOMPLETE_CANCELED_IO called +++ CldiStreamCdqCOMPLETE_CANCELED_IO called @@ -0,0 +1,2 @@ +CldiStreamCdqACQUIRE +CldiStreamCdqRELEASE @@ -1,0 +4,2 @@ +CldiStreamPrepareRequestForNonCdqCompletion +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamCdqCOMPLETE_CANCELED_IO Diff ```diff --- CldiStreamCdqCOMPLETE_CANCELED_IO +++ CldiStreamCdqCOMPLETE_CANCELED_IO @@ -1,45 +1,103 @@ -void CldiStreamCdqCOMPLETE_CANCELED_IO(undefined8 param_1,longlong param_2,undefined8 param_3) +void CldiStreamCdqCOMPLETE_CANCELED_IO(longlong *param_1,longlong param_2,undefined8 param_3) { longlong *plVar1; undefined8 *puVar2; longlong *plVar3; - longlong *plVar4; - code *pcVar5; - longlong lVar6; + undefined8 *puVar4; + undefined8 uVar5; + code *pcVar6; + ulonglong uVar7; + longlong lVar8; + undefined8 *puVar9; + undefined1 *puVar10; + undefined1 *puVar11; + undefined1 *puVar12; + longlong *plVar13; + undefined8 uVar14; + undefined1 auStack_68 [8]; + undefined1 auStack_60 [56]; - lVar6 = 0; + puVar11 = auStack_68; + puVar10 = auStack_68; + puVar9 = (undefined8 *)0x0; + plVar13 = (longlong *)0x0; + uVar14 = 0; plVar1 = (longlong *)(param_2 + 0x30); - if ((longlong *)*plVar1 != plVar1) { + lVar8 = param_2; + uVar7 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) { + puVar12 = auStack_68; + if ((longlong *)*plVar1 == plVar1) goto LAB_0; do { puVar2 = (undefined8 *)*plVar1; - plVar3 = (longlong *)*puVar2; - plVar4 = (longlong *)puVar2[1]; - if (((undefined8 *)plVar3[1] != puVar2) || ((undefined8 *)*plVar4 != puVar2)) { - pcVar5 = (code *)swi(0x29); - (*pcVar5)(3); - pcVar5 = (code *)swi(3); - (*pcVar5)(); - return; - } - *plVar4 = (longlong)plVar3; - plVar3[1] = (longlong)plVar4; + param_1 = (longlong *)*puVar2; + plVar3 = (longlong *)puVar2[1]; + if (((undefined8 *)param_1[1] != puVar2) || ((undefined8 *)*plVar3 != puVar2)) + goto LAB_1; + *plVar3 = (longlong)param_1; + param_1[1] = (longlong)plVar3; puVar2[1] = puVar2; *puVar2 = puVar2; *(undefined1 *)((longlong)puVar2 + 0x51) = 1; - if (lVar6 == 0) { - lVar6 = puVar2[0xc]; + if (puVar9 == (undefined8 *)0x0) { + puVar9 = (undefined8 *)puVar2[0xc]; + plVar13 = (longlong *)*puVar9; + uVar14 = *(undefined8 *)(*(longlong *)(*plVar13 + 0x10) + 0x20); } - param_2 = 0xc0000120; + lVar8 = 0xc0000120; CldiStreamCompleteCanceledRequest((uint *)(puVar2 + -3),0xc0000120); - } while (plVar4 != plVar3); + } while (plVar3 != param_1); } + else { + do { + CldiStreamCdqACQUIRE((longlong)param_1); + plVar3 = (longlong *)*plVar1; + if (plVar3 == plVar1) goto LAB_2; + puVar2 = (undefined8 *)*plVar3; + puVar4 = (undefined8 *)plVar3[1]; + if (((longlong *)puVar2[1] != plVar3) || ((longlong *)*puVar4 != plVar3)) goto LAB_1; + *puVar4 = puVar2; + puVar2[1] = puVar4; + plVar3[1] = (longlong)plVar3; + *plVar3 = (longlong)plVar3; + *(undefined1 *)((longlong)plVar3 + 0x51) = 1; + CldiStreamPrepareRequestForNonCdqCompletion((uint *)(plVar3 + -3)); + CldiStreamCdqRELEASE((longlong)param_1); + if (puVar9 == (undefined8 *)0x0) { + puVar9 = (undefined8 *)plVar3[0xc]; + plVar13 = (longlong *)*puVar9; + uVar14 = *(undefined8 *)(*(longlong *)(*plVar13 + 0x10) + 0x20); + } + lVar8 = 0xc0000120; + CldiStreamCompleteCanceledRequest((uint *)(plVar3 + -3),0xc0000120); + puVar11 = auStack_68; + } while (puVar4 != puVar2); + } + goto LAB_3; +LAB_1: + pcVar6 = (code *)swi(0x29); + (*pcVar6)(3); + puVar10 = auStack_60; +LAB_2: + *(undefined8 *)(puVar10 + -8) = 0x140040ba0; + CldiStreamCdqRELEASE((longlong)param_1); + puVar11 = puVar10; +LAB_3: + param_2 = *(longlong *)(puVar11 + 0x78); + puVar12 = puVar11; +LAB_0: if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]) ) { - WPP_SF_qqiq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),param_2,param_3,lVar6); + uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + *(longlong *)(puVar12 + 0x30) = param_2; + *(undefined8 *)(puVar12 + 0x28) = uVar14; + *(longlong **)(puVar12 + 0x20) = plVar13; + *(undefined8 *)(puVar12 + -8) = 0x140040be2; + WPP_SF_qqiq(uVar5,lVar8,param_3,puVar9); } return; } ``` ## CldiStreamProcessPendingHydrationRequests ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.22| |i_ratio|0.49| |m_ratio|0.99| |b_ratio|0.5| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamProcessPendingHydrationRequests|CldiStreamProcessPendingHydrationRequests| |fullname|CldiStreamProcessPendingHydrationRequests|CldiStreamProcessPendingHydrationRequests| |refcount|6|6| |`length`|861|837| |`called`|CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamPrepareRequestForNonCdqCompletion
CldiStreamScheduleRequestForMoreProcessing
CldiStreamServiceHydrationRequest
HsmDbgBreakOnStatus
WPP_SF_iqq
WPP_SF_iqqqiiiid|
Expand for full list:
CldiCanDoNonCdqCompletion
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamPrepareRequestForNonCdqCompletion
CldiStreamScheduleRequestForMoreProcessing
CldiStreamServiceHydrationRequest
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
WPP_SF_iqqWPP_SF_iqqqiiiid
| |calling|CldStreamAckData
CldStreamRestartHydration
CldStreamTransferData|CldStreamAckData
CldStreamRestartHydration
CldStreamTransferData| |paramcount|7|7| |`address`|14004b2cc|140072c08| |sig|undefined __fastcall CldiStreamProcessPendingHydrationRequests(longlong * param_1, undefined8 param_2, undefined * param_3, uint param_4, longlong param_5, undefined * param_6, void * param_7)|undefined __fastcall CldiStreamProcessPendingHydrationRequests(longlong * param_1, undefined8 param_2, undefined * param_3, uint param_4, longlong param_5, undefined * param_6, void * param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamProcessPendingHydrationRequests Called Diff ```diff --- CldiStreamProcessPendingHydrationRequests called +++ CldiStreamProcessPendingHydrationRequests called @@ -0,0 +1 @@ +CldiCanDoNonCdqCompletion @@ -7,0 +9 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamProcessPendingHydrationRequests Diff ```diff --- CldiStreamProcessPendingHydrationRequests +++ CldiStreamProcessPendingHydrationRequests @@ -1,198 +1,159 @@ void CldiStreamProcessPendingHydrationRequests (longlong *param_1,undefined8 param_2,undefined *param_3,uint param_4, longlong param_5,undefined *param_6,void *param_7) { longlong ****pppplVar1; - longlong lVar2; - longlong ****pppplVar3; - undefined8 uVar4; - code *pcVar5; - char cVar6; - uint uVar7; - ulonglong uVar8; - longlong ****pppplVar9; - undefined1 *puVar10; - char cVar11; - longlong ****unaff_R12; - longlong **pplVar12; - bool bVar13; + longlong ****pppplVar2; + code *pcVar3; + char cVar4; + uint uVar5; + ulonglong uVar6; + undefined8 uVar7; + char cVar8; + int iVar9; + longlong ****pppplVar10; + bool bVar11; char local_res8 [8]; undefined8 local_res10; uint local_res18; uint local_res20; - undefined8 uStack_f0; - undefined1 auStack_e8 [96]; char local_88 [4]; uint local_84; undefined8 local_80; longlong ***ppplStack_78; longlong ***local_70; undefined8 uStack_68; undefined8 local_60; undefined8 uStack_58; undefined8 local_50; local_res18 = (uint)param_3; - puVar10 = auStack_e8; pppplVar1 = (longlong ****)(param_1 + 2); local_50 = 0; local_70 = (longlong ***)&ppplStack_78; uStack_68 = 0; - uVar8 = (ulonglong)param_3 & 0xffffffff; + uVar6 = (ulonglong)param_3 & 0xffffffff; ppplStack_78 = (longlong ***)&ppplStack_78; local_80 = 0; local_60 = 0; uStack_58 = 0; local_res10 = param_2; local_res20 = param_4; LAB_0: - pppplVar9 = (longlong ****)(ulonglong)local_res20; - lVar2 = *(longlong *)(*param_1 + 8); - *(undefined8 *)(puVar10 + -8) = 0x14004b337; - CldiStreamCdqACQUIRE(lVar2 + 0x90); + uVar5 = local_res20; + CldiStreamCdqACQUIRE(*(longlong *)(*param_1 + 8) + 0x90); if ((longlong ****)ppplStack_78 == &ppplStack_78) { - pppplVar3 = (longlong ****)param_1[3]; - if ((longlong ****)*pppplVar3 != pppplVar1) goto LAB_1; - local_70 = (longlong ***)pppplVar3; + pppplVar10 = (longlong ****)param_1[3]; + if ((longlong ****)*pppplVar10 != pppplVar1) { +LAB_1: + pcVar3 = (code *)swi(0x29); + (*pcVar3)(3); + pcVar3 = (code *)swi(3); + (*pcVar3)(); + return; + } + *pppplVar10 = (longlong ***)&ppplStack_78; + param_1[3] = (longlong)&ppplStack_78; ppplStack_78 = (longlong ***)pppplVar1; - *pppplVar3 = (longlong ***)&ppplStack_78; - param_1[3] = (longlong)&ppplStack_78; + local_70 = (longlong ***)pppplVar10; } - unaff_R12 = (longlong ****)*pppplVar1; + pppplVar10 = (longlong ****)*pppplVar1; do { - if (unaff_R12 == pppplVar1) goto LAB_2; - if (unaff_R12 == &ppplStack_78) goto LAB_2; - local_84 = (uint)pppplVar9; - pppplVar9 = unaff_R12 + -1; - if (((short)*(uint *)pppplVar9 == 1) && (pppplVar9 != (longlong ****)param_1[7])) { - if ((int)uVar8 == 4) goto LAB_3; - if (((ulonglong)unaff_R12[0x2d] & 4) != 0) goto LAB_4; - if ((int)uVar8 != 3) { - do { - if (pppplVar9[0x29] == (longlong ***)0x0) { - bVar13 = (int)uVar8 == 1; + if ((pppplVar10 == pppplVar1) || (pppplVar10 == &ppplStack_78)) { +LAB_2: + if ((longlong ****)ppplStack_78 != &ppplStack_78) { + if (((longlong ****)ppplStack_78[1] != &ppplStack_78) || + ((longlong ****)*local_70 != &ppplStack_78)) goto LAB_1; + *local_70 = (longlong **)ppplStack_78; + ppplStack_78[1] = (longlong **)local_70; + local_70 = (longlong ***)&ppplStack_78; + ppplStack_78 = (longlong ***)&ppplStack_78; + } + CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); + return; + } + pppplVar2 = pppplVar10 + -1; + local_84 = uVar5; + if (((short)*(uint *)pppplVar2 != 1) || (pppplVar2 == (longlong ****)param_1[7])) + goto LAB_3; + iVar9 = (int)uVar6; + if (iVar9 == 4) { +LAB_4: + local_88[0] = '\0'; + local_res8[0] = '\0'; + if ((longlong)pppplVar10[0x2c] + (longlong)pppplVar10[0x2b] < (longlong)pppplVar10[0x2b]) + goto LAB_2; + if ((int)local_res20 < 0) { +LAB_5: + cVar8 = '\x01'; + } + else { + param_3 = param_6; + uVar6 = CldiStreamServiceHydrationRequest + (param_1,param_5,(size_t)param_6,param_7,(longlong)pppplVar2,local_88, + local_res8); + uVar5 = (uint)uVar6; + local_84 = uVar5; + HsmDbgBreakOnStatus(uVar5); + cVar8 = local_88[0]; + if ((int)uVar5 < 0) { + param_3 = WPP_GLOBAL_Control; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_iqqqiiiid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1c,WPP_GLOBAL_Control, + local_res10); } - else { - bVar13 = (int)uVar8 == 2; + goto LAB_5; + } + } + cVar4 = local_res8[0]; + if ((local_res8[0] != '\0') || (cVar8 != '\0')) { + bVar11 = CldiStreamPrepareRequestForMoreProcessing((uint *)pppplVar2); + if (!bVar11) goto LAB_6; + if (cVar8 != '\0') break; + if (cVar4 != '\0') { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_iqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x1d,param_3,local_res10); } - if (bVar13) break; + CldiStreamScheduleRequestForMoreProcessing((uint *)pppplVar2); + } + } + uVar6 = (ulonglong)local_res18; + } + else if (((ulonglong)pppplVar10[0x2d] & 4) == 0) { + if (iVar9 != 3) goto LAB_7; + } + else if (iVar9 == 3) { +LAB_7: + if (pppplVar10[0x28] == (longlong ***)0x0) { + bVar11 = iVar9 == 1; + } + else { + bVar11 = iVar9 == 2; + } + if (!bVar11) goto LAB_4; + } LAB_3: - if (pppplVar9[0xc] == (longlong ***)0x0) { - pplVar12 = (longlong **)0x0; - } - else { - pplVar12 = *pppplVar9[0xc]; - } - local_88[0] = '\0'; - local_res8[0] = '\0'; - if ((longlong)pppplVar9[0x2c] <= (longlong)pppplVar9[0x2d] + (longlong)pppplVar9[0x2c]) { - if ((int)local_res20 < 0) { -LAB_5: - cVar11 = '\x01'; - } - else { - *(char **)(puVar10 + 0x30) = local_res8; - *(char **)(puVar10 + 0x28) = local_88; - *(longlong *****)(puVar10 + 0x20) = pppplVar9; - *(undefined8 *)(puVar10 + -8) = 0x14004b43c; - param_3 = param_6; - uVar8 = CldiStreamServiceHydrationRequest - (param_1,param_5,(size_t)param_6,param_7, - *(longlong *)(puVar10 + 0x20),*(undefined1 **)(puVar10 + 0x28), - *(undefined1 **)(puVar10 + 0x30)); - uVar7 = (uint)uVar8; - local_84 = uVar7; - *(undefined8 *)(puVar10 + -8) = 0x14004b448; - HsmDbgBreakOnStatus(uVar7); - cVar11 = local_88[0]; - if ((int)uVar7 < 0) { - param_3 = WPP_GLOBAL_Control; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(uint *)(puVar10 + 0x58) = uVar7; - *(undefined **)(puVar10 + 0x50) = param_6; - *(longlong *)(puVar10 + 0x48) = param_5; - *(longlong ****)(puVar10 + 0x40) = pppplVar9[0x2d]; - *(longlong ****)(puVar10 + 0x38) = pppplVar9[0x2c]; - lVar2 = *param_1; - *(longlong ***)(puVar10 + 0x30) = pplVar12; - *(longlong *****)(puVar10 + 0x28) = pppplVar9; - *(longlong *)(puVar10 + 0x20) = lVar2; - *(undefined8 *)(puVar10 + -8) = 0x14004b5a6; - WPP_SF_iqqqiiiid(uVar4,0x1b,WPP_GLOBAL_Control,local_res10); - } - goto LAB_5; - } - } - cVar6 = local_res8[0]; - if ((local_res8[0] != '\0') || (cVar11 != '\0')) { - *(undefined8 *)(puVar10 + -8) = 0x14004b469; - bVar13 = CldiStreamPrepareRequestForMoreProcessing((uint *)pppplVar9); - if (bVar13) { - if (cVar11 == '\0') { - if (cVar6 != '\0') { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); - *(longlong ***)(puVar10 + 0x28) = pplVar12; - *(longlong *****)(puVar10 + 0x20) = pppplVar9; - *(undefined8 *)(puVar10 + -8) = 0x14004b5fe; - WPP_SF_iqq(uVar4,0x1c,param_3,local_res10); - } - *(undefined8 *)(puVar10 + -8) = 0x14004b606; - CldiStreamScheduleRequestForMoreProcessing((uint *)pppplVar9); - } - goto LAB_6; - } - *(undefined8 *)(puVar10 + -8) = 0x14004b613; - CldiStreamPrepareRequestForNonCdqCompletion((uint *)pppplVar9); - param_3 = (undefined *)(ulonglong)local_84; - *(undefined8 *)(puVar10 + -8) = 0x14004b625; - CldiStreamCompleteRequest(param_1,(uint *)pppplVar9,(ulonglong)param_3,0); - } - else { - lVar2 = *(longlong *)(*param_1 + 8); - *(undefined8 *)(puVar10 + -8) = 0x14004b484; - CldiStreamCdqRELEASE(lVar2 + 0x90); - } - uVar8 = (ulonglong)local_res18; - goto LAB_0; - } + pppplVar10 = (longlong ****)*pppplVar10; + uVar5 = local_res20; + } while( true ); + CldiStreamPrepareRequestForNonCdqCompletion((uint *)pppplVar2); + uVar6 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar6 == 0) || + (uVar7 = CldiCanDoNonCdqCompletion((longlong)pppplVar2), (char)uVar7 != '\0')) { + param_3 = (undefined *)(ulonglong)local_84; + CldiStreamCompleteRequest(param_1,(uint *)pppplVar2,(ulonglong)param_3,0); + } + else { LAB_6: - uVar8 = (ulonglong)local_res18; - break; - } -LAB_2: - if ((longlong ****)ppplStack_78 == &ppplStack_78) { -LAB_7: - lVar2 = *(longlong *)(*param_1 + 8); - *(undefined8 *)(puVar10 + -8) = 0x14004b4dd; - CldiStreamCdqRELEASE(lVar2 + 0x90); - return; - } - if (((longlong ****)ppplStack_78[1] == &ppplStack_78) && - ((longlong ****)*local_70 == &ppplStack_78)) { - *local_70 = (longlong **)ppplStack_78; - ppplStack_78[1] = (longlong **)local_70; - local_70 = (longlong ***)&ppplStack_78; - ppplStack_78 = (longlong ***)&ppplStack_78; - goto LAB_7; - } -LAB_1: - pcVar5 = (code *)swi(0x29); - (*pcVar5)(3); - puVar10 = puVar10 + 8; -LAB_4: - } while ((int)uVar8 == 3); - } - } - unaff_R12 = (longlong ****)*unaff_R12; - pppplVar9 = (longlong ****)(ulonglong)local_res20; - } while( true ); + CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); + } + uVar6 = (ulonglong)local_res18; + goto LAB_0; } ``` ## CldiStreamCancelSynchronousRequest ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.37| |i_ratio|0.43| |m_ratio|0.77| |b_ratio|0.7| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamCancelSynchronousRequest|CldiStreamCancelSynchronousRequest| |fullname|CldiStreamCancelSynchronousRequest|CldiStreamCancelSynchronousRequest| |refcount|2|2| |`length`|86|125| |`called`|CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion|CldiCanDoNonCdqCompletion
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion
Feature_2089223483__private_IsEnabledDeviceUsageNoInline| |calling|CldiStreamStartCountdownTimer|CldiStreamStartCountdownTimer| |paramcount|1|1| |`address`|140040814|1400409f8| |sig|undefined __fastcall CldiStreamCancelSynchronousRequest(uint * param_1)|undefined __fastcall CldiStreamCancelSynchronousRequest(uint * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCancelSynchronousRequest Called Diff ```diff --- CldiStreamCancelSynchronousRequest called +++ CldiStreamCancelSynchronousRequest called @@ -0,0 +1 @@ +CldiCanDoNonCdqCompletion @@ -4,0 +6 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamCancelSynchronousRequest Diff ```diff --- CldiStreamCancelSynchronousRequest +++ CldiStreamCancelSynchronousRequest @@ -1,19 +1,30 @@ void CldiStreamCancelSynchronousRequest(uint *param_1) { - longlong lVar1; - undefined8 uVar2; + char cVar1; + ulonglong uVar2; + undefined8 uVar3; + longlong lVar4; - lVar1 = *(longlong *)(**(longlong **)(param_1 + 0x1e) + 8); - CldiStreamCdqACQUIRE(lVar1 + 0x90); - uVar2 = CldiStreamPrepareRequestForNonCdqCompletion(param_1); - if ((char)uVar2 == '\0') { - CldiStreamCdqRELEASE(lVar1 + 0x90); + lVar4 = *(longlong *)(**(longlong **)(param_1 + 0x1e) + 8) + 0x90; + CldiStreamCdqACQUIRE(lVar4); + uVar2 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { + cVar1 = CldiStreamPrepareRequestForNonCdqCompletion(param_1); + if (cVar1 != '\0') goto LAB_0; } else { - CldiStreamCompleteCanceledRequest(param_1,0xc0000120); + cVar1 = CldiStreamPrepareRequestForNonCdqCompletion(param_1); + if ((cVar1 != '\0') && + (uVar3 = CldiCanDoNonCdqCompletion((longlong)param_1), (char)uVar3 != '\0')) { + CldiStreamCdqRELEASE(lVar4); +LAB_0: + CldiStreamCompleteCanceledRequest(param_1,0xc0000120); + return; + } } + CldiStreamCdqRELEASE(lVar4); return; } ``` ## CldiStreamBuildProviderRequest ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.29| |i_ratio|0.4| |m_ratio|0.9| |b_ratio|0.84| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamBuildProviderRequest|CldiStreamBuildProviderRequest| |fullname|CldiStreamBuildProviderRequest|CldiStreamBuildProviderRequest| |refcount|2|2| |`length`|475|571| |`called`|
Expand for full list:
CldiStreamAllocateRequest
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoGlobalRequestListNoLock
HsmDbgBreakOnStatus
HsmpGetStreamSize
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeEnterCriticalRegionNTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::PsGetProcessId
WPP_SF_qiiiLd
|
Expand for full list:
CldiStreamAllocateRequest
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoGlobalRequestListNoLock
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
HsmpGetStreamSize
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::IoGetCurrentProcessNTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::PsGetProcessId
WPP_SF_qiiiLd
| |calling|CldStreamReportProgress|CldStreamReportProgress| |paramcount|4|4| |`address`|140035718|1400407b4| |sig|undefined8 __fastcall CldiStreamBuildProviderRequest(longlong * param_1, undefined8 param_2, undefined8 param_3, uint param_4)|undefined8 __fastcall CldiStreamBuildProviderRequest(longlong * param_1, undefined8 param_2, undefined8 param_3, uint param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamBuildProviderRequest Called Diff ```diff --- CldiStreamBuildProviderRequest called +++ CldiStreamBuildProviderRequest called @@ -5,0 +6 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamBuildProviderRequest Diff ```diff --- CldiStreamBuildProviderRequest +++ CldiStreamBuildProviderRequest @@ -1,82 +1,112 @@ undefined8 CldiStreamBuildProviderRequest(longlong *param_1,undefined8 param_2,undefined8 param_3,uint param_4) { longlong lVar1; code *pcVar2; - uint uVar3; - uint *puVar4; - longlong *plVar5; - undefined8 uVar6; - longlong *plVar7; - uint *puVar8; - undefined8 uVar9; - undefined1 *puVar10; + bool bVar3; + uint uVar4; + uint *puVar5; + longlong *plVar6; + undefined8 uVar7; + ulonglong uVar8; + longlong *plVar9; + uint *puVar10; + undefined1 *puVar11; + undefined8 uVar12; undefined1 auStackY_68 [8]; undefined1 auStackY_60 [24]; - puVar10 = auStackY_68; - uVar9 = 0; + puVar11 = auStackY_68; + uVar12 = 0; + bVar3 = false; IoGetCurrentProcess(); - uVar3 = PsGetProcessId(); - puVar4 = CldiStreamAllocateRequest - ((undefined8 *)0x0,param_4,uVar3,param_1,0x40000001,0,0,0,1,(undefined8 *)0x0); - if (puVar4 == (uint *)0x0) { - uVar9 = 0xc000009a; + uVar4 = PsGetProcessId(); + puVar5 = CldiStreamAllocateRequest + ((undefined8 *)0x0,param_4,uVar4,param_1,0x40000001,0,0,0,1,(undefined8 *)0x0); + if (puVar5 == (uint *)0x0) { + uVar12 = 0xc000009a; HsmDbgBreakOnStatus(-0x3fffff66); + puVar11 = auStackY_68; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (1 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qiiiLd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x3b, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_1); - uVar9 = 0xc000009a; + (puVar11 = auStackY_68, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (puVar11 = auStackY_68, 1 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qiiiLd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x3c, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_1); + puVar11 = auStackY_68; } } else { CldiStreamCdqACQUIRE(*(longlong *)(*param_1 + 8) + 0x90); + bVar3 = true; if (param_1[7] == 0) { - plVar5 = param_1 + 2; - param_1[7] = (longlong)puVar4; - plVar7 = (longlong *)param_1[3]; - puVar8 = puVar4 + 2; - puVar10 = auStackY_68; - if ((longlong *)*plVar7 != plVar5) { - plVar7 = (longlong *)0x3; + plVar6 = param_1 + 2; + param_1[7] = (longlong)puVar5; + plVar9 = (longlong *)param_1[3]; + puVar10 = puVar5 + 2; + puVar11 = auStackY_68; + if ((longlong *)*plVar9 != plVar6) { + plVar9 = (longlong *)0x3; pcVar2 = (code *)swi(0x29); - plVar5 = (longlong *)(*pcVar2)(); - puVar10 = auStackY_60; + plVar6 = (longlong *)(*pcVar2)(); + puVar11 = auStackY_60; } - *(longlong **)puVar8 = plVar5; - *(longlong **)(puVar8 + 2) = plVar7; - *plVar7 = (longlong)puVar8; - plVar5[1] = (longlong)puVar8; - puVar4[0x58] = 0; - puVar4[0x59] = 0; + *(longlong **)puVar10 = plVar6; + *(longlong **)(puVar10 + 2) = plVar9; + *plVar9 = (longlong)puVar10; + plVar6[1] = (longlong)puVar10; + puVar5[0x58] = 0; + puVar5[0x59] = 0; lVar1 = *(longlong *)*param_1; - *(undefined8 *)(puVar10 + -8) = 0x140035869; - uVar6 = HsmpGetStreamSize(lVar1); - *(undefined8 *)(puVar4 + 0x5a) = uVar6; - *(undefined8 *)(puVar10 + -8) = 0x140035877; + *(undefined8 *)(puVar11 + -8) = 0x14004090d; + uVar7 = HsmpGetStreamSize(lVar1); + *(undefined8 *)(puVar5 + 0x5a) = uVar7; + *(undefined8 *)(puVar11 + -8) = 0x14004091b; KeEnterCriticalRegion(); - *(undefined8 *)(puVar10 + -8) = 0x14003588c; + *(undefined8 *)(puVar11 + -8) = 0x140040931; ExAcquireResourceExclusiveLite(&DAT_0,1); - *(undefined8 *)(puVar10 + -8) = 0x140035899; - CldiStreamInsertIntoGlobalRequestListNoLock(puVar4); - *(undefined8 *)(puVar10 + -8) = 0x1400358a7; + *(undefined8 *)(puVar11 + -8) = 0x14004093e; + CldiStreamInsertIntoGlobalRequestListNoLock(puVar5); + *(undefined8 *)(puVar11 + -8) = 0x14004094c; ExReleaseResourceLite(&DAT_0); - *(undefined8 *)(puVar10 + -8) = 0x1400358b3; + *(undefined8 *)(puVar11 + -8) = 0x140040958; KeLeaveCriticalRegion(); - puVar4 = (uint *)0x0; + puVar5 = (uint *)0x0; + } + } + *(undefined8 *)(puVar11 + -8) = 0x140040964; + uVar8 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 == 0) { + if (bVar3) { + lVar1 = *(longlong *)(*param_1 + 8); + *(undefined8 *)(puVar11 + -8) = 0x1400409c1; + CldiStreamCdqRELEASE(lVar1 + 0x90); + } + if (puVar5 != (uint *)0x0) { + *(undefined8 *)(puVar11 + -8) = 0x1400409ce; + CldiStreamDeleteRequest(puVar5); + } + } + else { + if (puVar5 == (uint *)0x0) { + if (!bVar3) { + return uVar12; + } + } + else { + if (!bVar3) { + lVar1 = *(longlong *)(*param_1 + 8); + *(undefined8 *)(puVar11 + -8) = 0x140040985; + CldiStreamCdqACQUIRE(lVar1 + 0x90); + } + *(undefined8 *)(puVar11 + -8) = 0x14004098d; + CldiStreamDeleteRequest(puVar5); } lVar1 = *(longlong *)(*param_1 + 8); - *(undefined8 *)(puVar10 + -8) = 0x1400358ca; + *(undefined8 *)(puVar11 + -8) = 0x1400409a7; CldiStreamCdqRELEASE(lVar1 + 0x90); - if (puVar4 != (uint *)0x0) { - *(undefined8 *)(puVar10 + -8) = 0x1400358d7; - CldiStreamDeleteRequest(puVar4); - } } - return uVar9; + return uVar12; } ``` ## HsmiRecallPostProcessHydration ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.42| |i_ratio|0.73| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|HsmiRecallPostProcessHydration|HsmiRecallPostProcessHydration| |fullname|HsmiRecallPostProcessHydration|HsmiRecallPostProcessHydration| |refcount|2|2| |`length`|694|707| |`called`|HsmiRecallFreeHydrationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmpGetStreamSize
TlmWriteHydrationCompletion
WPP_SF_qliiqqLiid|Feature_955245880__private_IsEnabledDeviceUsageNoInline
HsmiRecallFreeHydrationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmpGetStreamSize
TlmWriteHydrationCompletion
WPP_SF_qliiqqLiid| |calling|HsmiRecallHydrationCompletionCallback|HsmiRecallHydrationCompletionCallback| |paramcount|2|2| |`address`|140078424|140086eb8| |sig|undefined __fastcall HsmiRecallPostProcessHydration(longlong param_1, uint param_2)|undefined __fastcall HsmiRecallPostProcessHydration(longlong param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmiRecallPostProcessHydration Called Diff ```diff --- HsmiRecallPostProcessHydration called +++ HsmiRecallPostProcessHydration called @@ -0,0 +1 @@ +Feature_955245880__private_IsEnabledDeviceUsageNoInline ``` ### HsmiRecallPostProcessHydration Diff ```diff --- HsmiRecallPostProcessHydration +++ HsmiRecallPostProcessHydration @@ -1,139 +1,141 @@ void HsmiRecallPostProcessHydration(longlong param_1,uint param_2) { longlong lVar1; undefined8 uVar2; - longlong lVar3; + ulonglong uVar3; longlong lVar4; longlong lVar5; longlong lVar6; - longlong lVar7; - undefined *puVar8; + undefined *puVar7; + longlong lVar8; + undefined *puVar9; undefined4 in_register_00000014; - longlong lVar9; - ulonglong uVar10; - uint uVar11; + longlong *plVar10; + ulonglong uVar11; uint uVar12; - undefined *puVar13; + uint uVar13; longlong lVar14; - bool bVar15; + longlong *plVar15; + bool bVar16; - lVar9 = CONCAT44(in_register_00000014,param_2); - uVar10 = (ulonglong)param_2; + plVar10 = (longlong *)CONCAT44(in_register_00000014,param_2); + uVar11 = (ulonglong)param_2; if ((*(uint *)(param_1 + 0x30) >> 9 & 1) == 0) { - lVar3 = *(longlong *)(param_1 + 0x18); + lVar4 = *(longlong *)(param_1 + 0x18); } else { - lVar3 = 0; + lVar4 = 0; } - lVar5 = *(longlong *)(param_1 + 0x70); + lVar6 = *(longlong *)(param_1 + 0x70); lVar1 = *(longlong *)(param_1 + 0x78); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - lVar6 = *(longlong *)(lVar1 + 0x10); - puVar13 = WPP_GLOBAL_Control; + lVar14 = *(longlong *)(lVar1 + 0x10); + puVar7 = WPP_GLOBAL_Control; HsmpGetStreamSize(lVar1); - lVar9 = 0x1f; - WPP_SF_qliiqqLiid(*(undefined8 *)(puVar13 + 0x18),0x1f,*(undefined8 *)(lVar6 + 0x20),param_1); + plVar10 = (longlong *)0x1f; + WPP_SF_qliiqqLiid(*(undefined8 *)(puVar7 + 0x18),0x1f,*(undefined8 *)(lVar14 + 0x20),param_1); } - uVar12 = 0x1c0; + uVar13 = 0x1c0; if (param_2 == 0xc000022d) { - uVar10 = 0; - uVar11 = *(uint *)(param_1 + 0x30) & 0xfffffe7f | 0x40; - *(uint *)(param_1 + 0x30) = uVar11; + uVar11 = 0; + uVar12 = *(uint *)(param_1 + 0x30) & 0xfffffe7f | 0x40; + *(uint *)(param_1 + 0x30) = uVar12; if (2 < ((byte)*(undefined4 *)(param_1 + 0x28) & 0xf)) { *(undefined8 *)(param_1 + 0x48) = 0; - uVar12 = 0x1c0; + uVar13 = 0x1c0; uVar2 = HsmpGetStreamSize(lVar1); *(undefined8 *)(param_1 + 0x50) = uVar2; } LAB_0: - puVar13 = (undefined *)(ulonglong)(uVar11 & uVar12); - if (0xbf < (uVar11 & uVar12)) goto LAB_1; + uVar3 = (ulonglong)(uVar12 & uVar13); + if (0xbf < (uVar12 & uVar13)) goto LAB_1; LAB_2: - HsmiRecallInitiateHydration(param_1,lVar9,puVar13); + HsmiRecallInitiateHydration(param_1,plVar10,uVar3); } else { - if ((param_2 == 0xc000cf16) && (lVar5 != 0)) { - *(undefined1 *)(lVar5 + 0x2c) = 1; + if ((param_2 == 0xc000cf16) && (lVar6 != 0)) { + *(undefined1 *)(lVar6 + 0x2c) = 1; *(uint *)(param_1 + 0x30) = *(uint *)(param_1 + 0x30) & 0xfffffeff | 0xc0; } else { - uVar11 = *(uint *)(param_1 + 0x30); - uVar11 = (uVar11 + 0x40 ^ uVar11) & 0x1c0 ^ uVar11; - uVar11 = ((~(*(uint *)(param_1 + 0x28) >> 2) & 0x40) + uVar11 ^ uVar11) & 0x1c0 ^ uVar11; - *(uint *)(param_1 + 0x30) = uVar11; + uVar12 = *(uint *)(param_1 + 0x30); + uVar12 = (uVar12 + 0x40 ^ uVar12) & 0x1c0 ^ uVar12; + uVar12 = ((~(*(uint *)(param_1 + 0x28) >> 2) & 0x40) + uVar12 ^ uVar12) & 0x1c0 ^ uVar12; + *(uint *)(param_1 + 0x30) = uVar12; if (-1 < (int)param_2) goto LAB_0; } LAB_1: - if (lVar3 != 0) { - HsmiRecallPostProcessUserHydrationRequest(param_1,lVar3,uVar10); - lVar9 = lVar3; + if (lVar4 != 0) { + HsmiRecallPostProcessUserHydrationRequest(param_1,lVar4,uVar11); } - if (((-1 < (int)uVar10) && ((*(uint *)(param_1 + 0x30) & 0x800) == 0)) && - (((*(uint *)(lVar1 + 0x1c) & 0x100) == 0 && - ((((byte)*(undefined4 *)(param_1 + 0x28) & 0xf) == 2 && (*(longlong *)(param_1 + 0x70) != 0) - ))))) { + if ((((-1 < (int)uVar11) && + ((uVar3 = Feature_955245880__private_IsEnabledDeviceUsageNoInline(), (int)uVar3 != 0 || + ((*(uint *)(param_1 + 0x30) & 0x800) == 0)))) && ((*(uint *)(lVar1 + 0x1c) & 0x100) == 0)) + && ((((byte)*(undefined4 *)(param_1 + 0x28) & 0xf) == 2 && + (*(longlong *)(param_1 + 0x70) != 0)))) { LOCK(); - lVar3 = *(longlong *)(lVar5 + 0x38); - bVar15 = lVar3 == 0; - if (bVar15) { - *(longlong *)(lVar5 + 0x38) = param_1; - lVar3 = 0; + lVar4 = *(longlong *)(lVar6 + 0x38); + bVar16 = lVar4 == 0; + if (bVar16) { + *(longlong *)(lVar6 + 0x38) = param_1; + lVar4 = 0; } UNLOCK(); - if ((bVar15) || (lVar3 == param_1)) { - uVar12 = *(uint *)(param_1 + 0x30); - lVar14 = 0x1000; - lVar3 = *(longlong *)(param_1 + 0x50); - lVar6 = lVar3; - if ((uVar12 >> 9 & 1) == 0) { + if ((bVar16) || (lVar4 == param_1)) { + uVar13 = *(uint *)(param_1 + 0x30); + plVar10 = (longlong *)(param_1 + 0x48); + lVar4 = *(longlong *)(param_1 + 0x50); + lVar14 = lVar4; + if ((uVar13 >> 9 & 1) == 0) { *(undefined8 *)(param_1 + 0x50) = 0x1000; - uVar12 = uVar12 | 0x200; - lVar6 = 0x1000; + uVar13 = uVar13 | 0x200; + lVar14 = 0x1000; } - lVar3 = *(longlong *)(param_1 + 0x48) + lVar3; - *(longlong *)(param_1 + 0x48) = lVar3; - uVar12 = uVar12 & 0xfffffe7f | 0x40; - *(uint *)(param_1 + 0x30) = uVar12; - lVar7 = lVar1; - lVar4 = HsmpGetStreamSize(lVar1); - if ((lVar4 <= lVar3) && ((uVar12 & 0x400) == 0)) { - *(undefined8 *)(param_1 + 0x48) = 0; - *(uint *)(param_1 + 0x30) = uVar12 | 0x400; - lVar3 = 0; - *(longlong *)(param_1 + 0x50) = lVar14; - lVar6 = lVar14; + lVar4 = lVar4 + *plVar10; + *plVar10 = lVar4; + uVar13 = uVar13 & 0xfffffe7f | 0x40; + *(uint *)(param_1 + 0x30) = uVar13; + lVar8 = lVar1; + plVar15 = plVar10; + lVar5 = HsmpGetStreamSize(lVar1); + if ((lVar5 <= lVar4) && ((uVar13 & 0x400) == 0)) { + *plVar15 = 0; + *(uint *)(param_1 + 0x30) = uVar13 | 0x400; + lVar4 = 0; + *(undefined8 *)(param_1 + 0x50) = 0x1000; + lVar14 = 0x1000; } - lVar14 = HsmpGetStreamSize(lVar7); - if (lVar3 < lVar14) { - lVar6 = lVar6 + lVar3; - lVar5 = HsmpGetStreamSize(lVar7); - if (lVar5 <= lVar6) { - lVar6 = HsmpGetStreamSize(lVar7); + lVar5 = HsmpGetStreamSize(lVar8); + if (lVar4 < lVar5) { + lVar14 = lVar14 + lVar4; + lVar6 = HsmpGetStreamSize(lVar8); + if (lVar6 <= lVar14) { + lVar14 = HsmpGetStreamSize(lVar8); } - puVar13 = (undefined *)(lVar6 - lVar3); - *(undefined **)(param_1 + 0x50) = puVar13; + uVar3 = lVar14 - lVar4; + *(ulonglong *)(param_1 + 0x50) = uVar3; goto LAB_2; } } } - if (lVar5 == 0) { - puVar13 = *(undefined **)(lVar1 + 0x68); + if (lVar6 == 0) { + puVar7 = *(undefined **)(lVar1 + 0x68); } else { - puVar13 = *(undefined **)(lVar5 + 0x60); + puVar7 = *(undefined **)(lVar6 + 0x60); } - puVar8 = &DAT_3; - if (puVar13 != (undefined *)0x0) { - puVar8 = puVar13; + puVar9 = &DAT_3; + if (puVar7 != (undefined *)0x0) { + puVar9 = puVar7; } TlmWriteHydrationCompletion - ((longlong)puVar8,*(longlong *)(param_1 + 0x98),(ushort *)(param_1 + 0x58), - *(ulonglong *)(param_1 + 0x50),(int)uVar10); + ((longlong)puVar9,*(longlong *)(param_1 + 0x98),(ushort *)(param_1 + 0x58), + *(ulonglong *)(param_1 + 0x50),(int)uVar11); HsmiRecallFreeHydrationContext(param_1); } return; } ``` ## CldiStreamProcessPendingNotificationRequests ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.46| |i_ratio|0.69| |m_ratio|0.93| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamProcessPendingNotificationRequests|CldiStreamProcessPendingNotificationRequests| |fullname|CldiStreamProcessPendingNotificationRequests|CldiStreamProcessPendingNotificationRequests| |refcount|2|2| |`length`|194|225| |`called`|CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteRequest
CldiStreamPrepareRequestForNonCdqCompletion|CldiCanDoNonCdqCompletion
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteRequest
CldiStreamPrepareRequestForNonCdqCompletion
Feature_2089223483__private_IsEnabledDeviceUsageNoInline| |calling|CldiStreamAckNotification|CldiStreamAckNotification| |paramcount|6|6| |`address`|140040e94|1400411e8| |sig|undefined __fastcall CldiStreamProcessPendingNotificationRequests(longlong * param_1, undefined8 param_2, int param_3, longlong param_4, uint param_5, uint param_6)|undefined __fastcall CldiStreamProcessPendingNotificationRequests(longlong * param_1, undefined8 param_2, int param_3, longlong param_4, uint param_5, uint param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamProcessPendingNotificationRequests Called Diff ```diff --- CldiStreamProcessPendingNotificationRequests called +++ CldiStreamProcessPendingNotificationRequests called @@ -0,0 +1 @@ +CldiCanDoNonCdqCompletion @@ -4,0 +6 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamProcessPendingNotificationRequests Diff ```diff --- CldiStreamProcessPendingNotificationRequests +++ CldiStreamProcessPendingNotificationRequests @@ -1,33 +1,47 @@ void CldiStreamProcessPendingNotificationRequests (longlong *param_1,undefined8 param_2,int param_3,longlong param_4,uint param_5, uint param_6) { uint *puVar1; - undefined8 uVar2; - longlong *plVar3; + char cVar2; + ulonglong uVar3; + undefined8 uVar4; + longlong *plVar5; +LAB_0: do { CldiStreamCdqACQUIRE(*(longlong *)(*param_1 + 8) + 0x90); - plVar3 = (longlong *)param_1[2]; + plVar5 = (longlong *)param_1[2]; while( true ) { - if (plVar3 == param_1 + 2) { + if (plVar5 == param_1 + 2) { CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); return; } - puVar1 = (uint *)(plVar3 + -1); - if ((((short)*puVar1 == 3) && ((int)plVar3[0x25] == param_3)) && - ((param_4 == 0 || (plVar3[6] == param_4)))) break; - plVar3 = (longlong *)*plVar3; + puVar1 = (uint *)(plVar5 + -1); + if ((((short)*puVar1 == 3) && ((int)plVar5[0x25] == param_3)) && + ((param_4 == 0 || (plVar5[6] == param_4)))) break; + plVar5 = (longlong *)*plVar5; } - uVar2 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); - if ((char)uVar2 == '\0') { - CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); + uVar3 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar3 == 0) { + cVar2 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); +LAB_1: + if (cVar2 != '\0') { + CldiStreamCompleteRequest(param_1,puVar1,(ulonglong)param_5,param_6); + goto LAB_0; + } } else { - CldiStreamCompleteRequest(param_1,puVar1,(ulonglong)param_5,param_6); + cVar2 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if (cVar2 != '\0') { + uVar4 = CldiCanDoNonCdqCompletion((longlong)puVar1); + cVar2 = (char)uVar4; + goto LAB_1; + } } + CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); } while( true ); } ``` ## CldiStreamCompleteRequest ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.59| |i_ratio|0.64| |m_ratio|0.96| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamCompleteRequest|CldiStreamCompleteRequest| |fullname|CldiStreamCompleteRequest|CldiStreamCompleteRequest| |refcount|6|6| |`length`|596|653| |`called`|
Expand for full list:
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoGlobalRequestListNoLock
CldiStreamRemoveFromGlobalRequestListNoLock
FLTMGR.SYS::FltCbdqRemoveIo
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
WPP_SF_iqqWPP_SF_iqqd
_guard_dispatch_icall
|
Expand for full list:
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoGlobalRequestListNoLock
CldiStreamRemoveFromGlobalRequestListNoLock
FLTMGR.SYS::FltCbdqRemoveIo
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegionWPP_SF_iqq
WPP_SF_iqqd
_guard_dispatch_icall
| |calling|CldiStreamCompleteCanceledRequest
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests|CldiStreamCompleteCanceledRequest
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests| |paramcount|4|4| |`address`|140083520|14008422c| |sig|undefined __fastcall CldiStreamCompleteRequest(longlong * param_1, uint * param_2, ulonglong param_3, uint param_4)|undefined __fastcall CldiStreamCompleteRequest(longlong * param_1, uint * param_2, ulonglong param_3, uint param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCompleteRequest Called Diff ```diff --- CldiStreamCompleteRequest called +++ CldiStreamCompleteRequest called @@ -5,0 +6 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamCompleteRequest Diff ```diff --- CldiStreamCompleteRequest +++ CldiStreamCompleteRequest @@ -1,70 +1,80 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void CldiStreamCompleteRequest(longlong *param_1,uint *param_2,ulonglong param_3,uint param_4) { longlong *plVar1; undefined8 uVar2; code *pcVar3; undefined8 uVar4; - longlong lVar5; - ulonglong uVar6; - longlong *plVar7; + ulonglong uVar5; + longlong lVar6; + ulonglong uVar7; + longlong *plVar8; uVar2 = *(undefined8 *)(param_2 + 0x28); - uVar6 = param_3 & 0xffffffff; + uVar7 = param_3 & 0xffffffff; pcVar3 = *(code **)(param_2 + 0x26); uVar4 = *(undefined8 *)(*(longlong *)(*(longlong *)*param_1 + 0x10) + 0x20); if (((*(longlong **)(param_2 + 0x18) != (longlong *)0x0) && (*(char *)((longlong)param_2 + 0x69) == '\0')) && - (lVar5 = **(longlong **)(param_2 + 0x18), lVar5 != 0)) { - plVar1 = (longlong *)(lVar5 + 0x30); + (lVar6 = **(longlong **)(param_2 + 0x18), lVar6 != 0)) { + plVar1 = (longlong *)(lVar6 + 0x30); if ((longlong *)*plVar1 == plVar1) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_iqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x11,param_3,uVar4); + WPP_SF_iqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x12,param_3,uVar4); } - lVar5 = FltCbdqRemoveIo(*(longlong *)(*param_1 + 8) + 0x90,*(longlong *)(param_2 + 0x18) + 8); - if (lVar5 == 0) { - uVar6 = 0xc0000120; + uVar5 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar5 == 0) && + (lVar6 = FltCbdqRemoveIo(*(longlong *)(*param_1 + 8) + 0x90, + *(longlong *)(param_2 + 0x18) + 8), lVar6 == 0)) { + uVar7 = 0xc0000120; HsmDbgBreakOnStatus(-0x3ffffee0); } } else { KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite(&DAT_0,1); - for (plVar7 = (longlong *)*plVar1; plVar7 != plVar1; plVar7 = (longlong *)*plVar7) { - CldiStreamRemoveFromGlobalRequestListNoLock((uint *)(plVar7 + -3)); - CldiStreamInsertIntoGlobalRequestListNoLock((uint *)(plVar7 + -3)); + for (plVar8 = (longlong *)*plVar1; plVar8 != plVar1; plVar8 = (longlong *)*plVar8) { + CldiStreamRemoveFromGlobalRequestListNoLock((uint *)(plVar8 + -3)); + CldiStreamInsertIntoGlobalRequestListNoLock((uint *)(plVar8 + -3)); } ExReleaseResourceLite(&DAT_0); KeLeaveCriticalRegion(); } } if ((longlong *)param_1[2] == param_1 + 2) { param_1[6] = 0; param_1[5] = 0; } - if (*(char *)((longlong)param_2 + 0x69) == '\0') { + uVar5 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 == 0) { + if (*(char *)((longlong)param_2 + 0x69) == '\0') { + CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); + } + CldiStreamDeleteRequest(param_2); + } + else { + CldiStreamDeleteRequest(param_2); CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); - } - CldiStreamDeleteRequest(param_2); - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]) - ) { - WPP_SF_iqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x12,param_3,uVar4); - } - if (pcVar3 != (code *)0x0) { - param_3 = (ulonglong)param_4; - (*pcVar3)(uVar2,uVar6); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]) ) { WPP_SF_iqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x13,param_3,uVar4); } + if (pcVar3 != (code *)0x0) { + param_3 = (ulonglong)param_4; + (*pcVar3)(uVar2,uVar7); + } + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]) + ) { + WPP_SF_iqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x14,param_3,uVar4); + } return; } ``` ## CldiStreamCompleteCanceledRequest ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.39| |i_ratio|0.52| |m_ratio|0.98| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamCompleteCanceledRequest|CldiStreamCompleteCanceledRequest| |fullname|CldiStreamCompleteCanceledRequest|CldiStreamCompleteCanceledRequest| |`refcount`|7|8| |`length`|651|657| |`called`|CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldiStreamCompleteRequest
HsmpGetStreamSize
TlmWriteCvForCldStreamCancelIO
WPP_SF_iqLd
WPP_SF_qqiqdd|CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldiStreamCdqACQUIRE
CldiStreamCompleteRequest
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmpGetStreamSize
TlmWriteCvForCldStreamCancelIO
WPP_SF_iqLd
WPP_SF_qqiqdd| |calling|CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamCdqCOMPLETE_CANCELED_IO|CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamCdqCOMPLETE_CANCELED_IO| |paramcount|2|2| |`address`|140040968|140040c58| |sig|undefined __fastcall CldiStreamCompleteCanceledRequest(uint * param_1, uint param_2)|undefined __fastcall CldiStreamCompleteCanceledRequest(uint * param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCompleteCanceledRequest Called Diff ```diff --- CldiStreamCompleteCanceledRequest called +++ CldiStreamCompleteCanceledRequest called @@ -3,0 +4 @@ +CldiStreamCdqACQUIRE @@ -4,0 +6 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamCompleteCanceledRequest Diff ```diff --- CldiStreamCompleteCanceledRequest +++ CldiStreamCompleteCanceledRequest @@ -1,74 +1,86 @@ void CldiStreamCompleteCanceledRequest(uint *param_1,uint param_2) { - longlong *plVar1; + uint *puVar1; longlong *plVar2; - undefined *puVar3; + longlong *plVar3; longlong lVar4; - undefined8 uVar5; - ulonglong uVar6; - uint uVar7; - uint uVar8; - longlong lVar9; + undefined *puVar5; + longlong lVar6; + undefined8 uVar7; + ulonglong uVar8; + uint uVar9; uint uVar10; + longlong lVar11; + uint uVar12; - plVar1 = *(longlong **)(param_1 + 0x1e); - uVar7 = *param_1 & 0xffff; - plVar2 = (longlong *)*plVar1; - lVar9 = *(longlong *)(*plVar2 + 0x10); - puVar3 = *(undefined **)(lVar9 + 0x20); + plVar2 = *(longlong **)(param_1 + 0x1e); + uVar9 = *param_1 & 0xffff; + plVar3 = (longlong *)*plVar2; + lVar11 = *(longlong *)(*plVar3 + 0x10); + lVar4 = plVar3[1]; + puVar5 = *(undefined **)(lVar11 + 0x20); if (param_2 == 0xc0000120) { - uVar10 = (uint)(*(longlong *)(param_1 + 0x24) == 0); - uVar8 = 0xc000cf1f; + uVar12 = (uint)(*(longlong *)(param_1 + 0x24) == 0); + uVar10 = 0xc000cf1f; if (*(longlong *)(param_1 + 0x24) != 0) { - uVar8 = param_2; + uVar10 = param_2; } } else { - uVar10 = 2; - uVar8 = param_2; + uVar12 = 2; + uVar10 = param_2; } - lVar4 = *(longlong *)(param_1 + 0x1c); - uVar6 = (ulonglong)uVar8; - TlmWriteCvForCldStreamCancelIO((longlong)(param_1 + 0x2a),uVar8); - if (uVar7 == 1) { + lVar6 = *(longlong *)(param_1 + 0x1c); + puVar1 = param_1 + 0x2a; + TlmWriteCvForCldStreamCancelIO((longlong)puVar1,uVar10); + if (uVar9 == 1) { if (*(char *)((longlong)param_1 + 0x6a) == '\0') { - lVar9 = *(longlong *)*plVar1; - uVar5 = HsmpGetStreamSize(*plVar2); + lVar11 = *(longlong *)*plVar2; + uVar7 = HsmpGetStreamSize(*plVar3); CldSyncSendCancelHydrationRequest - (*(ulonglong **)(plVar2[2] + 0x20),puVar3,lVar4,*(undefined8 *)(lVar9 + 0x28), - *(void **)(lVar9 + 0x30),*(int *)(lVar9 + 0x38),uVar10,uVar5, - ~(*(int *)(lVar9 + 0x1c) << 0xb) & 0x1000,*(ulonglong *)(param_1 + 0x58), - *(longlong *)(param_1 + 0x5a),(undefined8 *)(param_1 + 0x2a)); + (*(ulonglong **)(plVar3[2] + 0x20),puVar5,lVar6,*(undefined8 *)(lVar11 + 0x28), + *(void **)(lVar11 + 0x30),*(int *)(lVar11 + 0x38),uVar12,uVar7, + ~(*(int *)(lVar11 + 0x1c) << 0xb) & 0x1000,*(ulonglong *)(param_1 + 0x58), + *(longlong *)(param_1 + 0x5a),(undefined8 *)puVar1); } else if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_iqLd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar6,lVar9,puVar3); + if (*plVar3 == 0) { + uVar8 = 0; + } + else { + uVar8 = (ulonglong)*(uint *)(*plVar3 + 0x1c); + } + WPP_SF_iqLd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar8,lVar11,puVar5); } } - else if (uVar7 == 2) { - lVar9 = *(longlong *)*plVar1; + else if (uVar9 == 2) { + lVar11 = *(longlong *)*plVar2; CldSyncSendCancelPopulationRequest - (*(undefined8 **)(plVar2[2] + 0x20),puVar3,lVar4,*(undefined8 *)(lVar9 + 0x28), - *(void **)(lVar9 + 0x30),*(int *)(lVar9 + 0x38),uVar10,(undefined8 *)(param_1 + 0x2a) - ); + (*(undefined8 **)(plVar3[2] + 0x20),puVar5,lVar6,*(undefined8 *)(lVar11 + 0x28), + *(void **)(lVar11 + 0x30),*(int *)(lVar11 + 0x38),uVar12,(undefined8 *)puVar1); } - else if (uVar7 == 3) { - lVar9 = *(longlong *)*plVar1; + else if (uVar9 == 3) { + lVar11 = *(longlong *)*plVar2; CldSyncSendCancelNotificationRequest - (*(undefined8 **)(plVar2[2] + 0x20),puVar3,lVar4,param_1[0x4c], - *(undefined8 *)(param_1 + 0xe),*(undefined8 *)(lVar9 + 0x28),*(void **)(lVar9 + 0x30) - ,*(int *)(lVar9 + 0x38),uVar10,(undefined8 *)(param_1 + 0x2a)); + (*(undefined8 **)(plVar3[2] + 0x20),puVar5,lVar6,param_1[0x4c], + *(undefined8 *)(param_1 + 0xe),*(undefined8 *)(lVar11 + 0x28), + *(void **)(lVar11 + 0x30),*(int *)(lVar11 + 0x38),uVar12,(undefined8 *)puVar1); } - uVar6 = (ulonglong)uVar8; - CldiStreamCompleteRequest(plVar1,param_1,uVar6,0); + uVar8 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar8 != 0) { + CldiStreamCdqACQUIRE(lVar4 + 0x90); + } + uVar8 = (ulonglong)uVar10; + CldiStreamCompleteRequest(plVar2,param_1,uVar8,0); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]) ) { - WPP_SF_qqiqdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),param_1,uVar6,plVar1); + WPP_SF_qqiqdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),param_1,uVar8,plVar2); } return; } ``` ## CldiStreamInsertIntoCancelSafeQueue ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.21| |i_ratio|0.59| |m_ratio|0.93| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamInsertIntoCancelSafeQueue|CldiStreamInsertIntoCancelSafeQueue| |fullname|CldiStreamInsertIntoCancelSafeQueue|CldiStreamInsertIntoCancelSafeQueue| |refcount|4|4| |`length`|567|664| |`called`|CldiStreamCdqINSERT_IO
FLTMGR.SYS::FltCbdqInsertIo
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
WPP_SF_qqq
WPP_SF_qqqd|CldiStreamCdqINSERT_IO
FLTMGR.SYS::FltCbdqInsertIo
FLTMGR.SYS::FltIsIoCanceled
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
WPP_SF_qqq
WPP_SF_qqqd| |calling|CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders|CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders| |paramcount|4|4| |`address`|140040bfc|140040ef0| |`sig`|undefined8 __fastcall CldiStreamInsertIntoCancelSafeQueue(longlong * param_1, uint * param_2, undefined8 param_3, uint * param_4)|undefined4 __fastcall CldiStreamInsertIntoCancelSafeQueue(longlong * param_1, uint * param_2, undefined8 param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamInsertIntoCancelSafeQueue Called Diff ```diff --- CldiStreamInsertIntoCancelSafeQueue called +++ CldiStreamInsertIntoCancelSafeQueue called @@ -2,0 +3,2 @@ +FLTMGR.SYS::FltIsIoCanceled +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamInsertIntoCancelSafeQueue Diff ```diff --- CldiStreamInsertIntoCancelSafeQueue +++ CldiStreamInsertIntoCancelSafeQueue @@ -1,88 +1,112 @@ -undefined8 +undefined4 CldiStreamInsertIntoCancelSafeQueue (longlong *param_1,uint *param_2,undefined8 param_3,uint *param_4) { int *piVar1; longlong lVar2; - undefined8 *puVar3; - uint *puVar4; + char cVar3; + undefined8 *puVar4; + ulonglong uVar5; + uint *puVar6; + undefined2 uVar7; + undefined4 uVar8; if ((param_2 == (uint *)0x0) || ((*param_2 & 1) == 0)) { - puVar4 = (uint *)WPP_GLOBAL_Control; + puVar6 = (uint *)WPP_GLOBAL_Control; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0 && (3 < (byte)WPP_GLOBAL_Control[0x29]) ))) { - puVar4 = *(uint **)(WPP_GLOBAL_Control + 0x18); - WPP_SF_qqq(puVar4,0x10,&WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); + puVar6 = *(uint **)(WPP_GLOBAL_Control + 0x18); + WPP_SF_qqq(puVar6,0x11,&WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_2); } if ((param_2 != (uint *)0x0) && (*(longlong *)(param_2 + 0x12) == 0)) { - puVar4 = param_2 + 0xc; - *(uint **)(param_2 + 0xe) = puVar4; - *(uint **)puVar4 = puVar4; + puVar6 = param_2 + 0xc; *(longlong **)(param_2 + 0x12) = param_1; + *(uint **)(param_2 + 0xe) = puVar6; + *(uint **)puVar6 = puVar6; } +LAB_0: + CldiStreamCdqINSERT_IO(puVar6,(longlong *)param_2,param_4); + return 0; + } + if (*(longlong *)(param_2 + 0x12) == 0) { + puVar4 = (undefined8 *)ExAllocateFromPagedLookasideList(&DAT_1); + if (puVar4 != (undefined8 *)0x0) { + *puVar4 = 0; + puVar4[1] = 0; + puVar4[2] = 0; + puVar4[3] = 0; + puVar4[4] = 0; + puVar4[5] = 0; + *(undefined8 **)(param_2 + 0x12) = puVar4; + *puVar4 = param_2; + puVar6 = param_2 + 0xc; + *(uint **)(param_2 + 0xe) = puVar6; + *(uint **)puVar6 = puVar6; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + WPP_SF_qqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xe, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_2); + } + lVar2 = *(longlong *)(param_2 + 0x12); + *(longlong *)(param_4 + 0x18) = lVar2; + LOCK(); + piVar1 = (int *)(lVar2 + 0x20); + *piVar1 = *piVar1 + 1; + UNLOCK(); + FltCbdqInsertIo(*(longlong *)(*param_1 + 8) + 0x90,param_2,*(longlong *)(param_4 + 0x18) + 8, + param_4); + return 0; + } + uVar8 = 0xc000009a; + HsmDbgBreakOnStatus(-0x3fffff66); + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return 0xc000009a; + } + if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0) { + return 0xc000009a; + } + if ((byte)WPP_GLOBAL_Control[0x29] < 2) { + return 0xc000009a; + } + uVar7 = 0xd; } else { - lVar2 = *(longlong *)(param_2 + 0x12); - if (lVar2 == 0) { - puVar3 = (undefined8 *)ExAllocateFromPagedLookasideList(&DAT_0); - if (puVar3 != (undefined8 *)0x0) { - *puVar3 = 0; - puVar3[1] = 0; - puVar3[2] = 0; - puVar3[3] = 0; - puVar3[4] = 0; - puVar3[5] = 0; - *(undefined8 **)(param_2 + 0x12) = puVar3; - *puVar3 = param_2; - puVar4 = param_2 + 0xc; - *(uint **)(param_2 + 0xe) = puVar4; - *(uint **)puVar4 = puVar4; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xe, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); - } - lVar2 = *(longlong *)(param_2 + 0x12); - *(longlong *)(param_4 + 0x18) = lVar2; - LOCK(); - piVar1 = (int *)(lVar2 + 0x20); - *piVar1 = *piVar1 + 1; - UNLOCK(); - FltCbdqInsertIo(*(longlong *)(*param_1 + 8) + 0x90,param_2,*(longlong *)(param_4 + 0x18) + 8 - ,param_4); - return 0; + uVar5 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar5 == 0) || (cVar3 = FltIsIoCanceled(param_2), cVar3 == '\0')) { + lVar2 = *(longlong *)(param_2 + 0x12); + *(longlong *)(param_4 + 0x18) = lVar2; + LOCK(); + piVar1 = (int *)(lVar2 + 0x20); + *piVar1 = *piVar1 + 1; + UNLOCK(); + puVar6 = (uint *)WPP_GLOBAL_Control; + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + puVar6 = *(uint **)(WPP_GLOBAL_Control + 0x18); + WPP_SF_qqq(puVar6,0x10,&WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_2); } - HsmDbgBreakOnStatus(-0x3fffff66); - if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { - return 0xc000009a; - } - if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0) { - return 0xc000009a; - } - if ((byte)WPP_GLOBAL_Control[0x29] < 2) { - return 0xc000009a; - } - WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0xd, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); - return 0xc000009a; + goto LAB_0; } - *(longlong *)(param_4 + 0x18) = lVar2; - LOCK(); - *(int *)(lVar2 + 0x20) = *(int *)(lVar2 + 0x20) + 1; - UNLOCK(); - puVar4 = (uint *)WPP_GLOBAL_Control; - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && - (3 < (byte)WPP_GLOBAL_Control[0x29])) { - puVar4 = *(uint **)(WPP_GLOBAL_Control + 0x18); - WPP_SF_qqq(puVar4,0xf,&WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,param_2); + uVar8 = 0xc0000120; + HsmDbgBreakOnStatus(-0x3ffffee0); + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return 0xc0000120; } + if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) == 0) { + return 0xc0000120; + } + if ((byte)WPP_GLOBAL_Control[0x29] < 2) { + return 0xc0000120; + } + uVar7 = 0xf; } - CldiStreamCdqINSERT_IO(puVar4,(longlong *)param_2,param_4); - return 0; + WPP_SF_qqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar7, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,param_2); + return uVar8; } ``` ## CldStreamAbortOperation ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.3| |i_ratio|0.71| |m_ratio|0.93| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldStreamAbortOperation|CldStreamAbortOperation| |fullname|CldStreamAbortOperation|CldStreamAbortOperation| |refcount|3|3| |`length`|332|384| |`called`|CldSyncGetSyncProviderProcess
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion
HsmOsGetProcessSessionIdFromEproccess
HsmOsIsInSameSession
NTOSKRNL.EXE::IoGetCurrentProcess
WPP_SF_i|
Expand for full list:
CldSyncGetSyncProviderProcess
CldiCanDoNonCdqCompletion
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmOsGetProcessSessionIdFromEproccess
HsmOsIsInSameSession
NTOSKRNL.EXE::IoGetCurrentProcess
WPP_SF_i
| |calling|CldSyncAbortOperation|CldSyncAbortOperation| |paramcount|3|3| |`address`|14003f744|14003f6d8| |sig|undefined __fastcall CldStreamAbortOperation(int param_1, longlong * param_2, longlong param_3)|undefined __fastcall CldStreamAbortOperation(int param_1, longlong * param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldStreamAbortOperation Called Diff ```diff --- CldStreamAbortOperation called +++ CldStreamAbortOperation called @@ -1,0 +2 @@ +CldiCanDoNonCdqCompletion @@ -5,0 +7 @@ +Feature_2089223483__private_IsEnabledDeviceUsageNoInline ``` ### CldStreamAbortOperation Diff ```diff --- CldStreamAbortOperation +++ CldStreamAbortOperation @@ -1,50 +1,61 @@ void CldStreamAbortOperation(int param_1,longlong *param_2,longlong param_3) { - char cVar1; - int iVar2; + uint *puVar1; + char cVar2; int iVar3; - longlong lVar4; - undefined8 uVar5; - longlong *plVar6; - longlong *plVar7; + int iVar4; + longlong lVar5; + ulonglong uVar6; + undefined8 uVar7; + longlong *plVar8; + longlong *plVar9; - uVar5 = *(undefined8 *)(*(longlong *)(*(longlong *)*param_2 + 0x10) + 0x20); - lVar4 = IoGetCurrentProcess(); - iVar2 = HsmOsGetProcessSessionIdFromEproccess(lVar4); - lVar4 = CldSyncGetSyncProviderProcess(*(longlong *)(*(longlong *)(*param_2 + 0x10) + 0x20)); - iVar3 = iVar2; - if (lVar4 != 0) { - iVar3 = HsmOsGetProcessSessionIdFromEproccess(lVar4); + uVar7 = *(undefined8 *)(*(longlong *)(*(longlong *)*param_2 + 0x10) + 0x20); + lVar5 = IoGetCurrentProcess(); + iVar3 = HsmOsGetProcessSessionIdFromEproccess(lVar5); + lVar5 = CldSyncGetSyncProviderProcess(*(longlong *)(*(longlong *)(*param_2 + 0x10) + 0x20)); + iVar4 = iVar3; + if (lVar5 != 0) { + iVar4 = HsmOsGetProcessSessionIdFromEproccess(lVar5); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]) ) { - WPP_SF_i(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x38, - &WPP_822ff5ffb3aa3a041acfac4c4baf38f5_Traceguids,uVar5); + WPP_SF_i(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x39, + &WPP_378eb09511c23ce09a87d22bbd212376_Traceguids,uVar7); } do { - CldiStreamCdqACQUIRE(*(longlong *)(*param_2 + 8) + 0x90); - plVar6 = (longlong *)param_2[2]; while( true ) { - if (plVar6 == param_2 + 2) { - CldiStreamCdqRELEASE(*(longlong *)(*param_2 + 8) + 0x90); - return; + CldiStreamCdqACQUIRE(*(longlong *)(*param_2 + 8) + 0x90); + plVar8 = (longlong *)param_2[2]; + while( true ) { + if (plVar8 == param_2 + 2) { + CldiStreamCdqRELEASE(*(longlong *)(*param_2 + 8) + 0x90); + return; + } + puVar1 = (uint *)(plVar8 + -1); + plVar9 = plVar8; + cVar2 = HsmOsIsInSameSession(iVar4,(int)plVar8[9],iVar3); + if (((cVar2 != '\0') && (*(int *)((longlong)plVar8 + 0x4c) == param_1)) && + ((param_3 == 0 || (param_3 == plVar8[6])))) break; + plVar8 = (longlong *)*plVar9; } - plVar7 = plVar6; - cVar1 = HsmOsIsInSameSession(iVar3,(int)plVar6[9],iVar2); - if (((cVar1 != '\0') && (*(int *)((longlong)plVar6 + 0x4c) == param_1)) && - ((param_3 == 0 || (param_3 == plVar6[6])))) break; - plVar6 = (longlong *)*plVar7; - } - uVar5 = CldiStreamPrepareRequestForNonCdqCompletion((uint *)(plVar6 + -1)); - if ((char)uVar5 == '\0') { + uVar6 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 != 0) break; + cVar2 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if (cVar2 != '\0') goto LAB_0; +LAB_1: CldiStreamCdqRELEASE(*(longlong *)(*param_2 + 8) + 0x90); } - else { - CldiStreamCompleteCanceledRequest((uint *)(plVar6 + -1),0xc000cf16); - } + cVar2 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if ((cVar2 == '\0') || + (uVar7 = CldiCanDoNonCdqCompletion((longlong)puVar1), (char)uVar7 == '\0')) + goto LAB_1; + CldiStreamCdqRELEASE(*(longlong *)(*param_2 + 8) + 0x90); +LAB_0: + CldiStreamCompleteCanceledRequest(puVar1,0xc000cf16); } while( true ); } ``` ## HsmDbgBreakOnStatus ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.29| |i_ratio|0.04| |m_ratio|0.5| |b_ratio|0.27| |match_types|Implied Match| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |`name`|HsmDbgBreakOnStatus|Feature_2092950840__private_IsEnabledDeviceUsageNoInline| |`fullname`|HsmDbgBreakOnStatus|Feature_2092950840__private_IsEnabledDeviceUsageNoInline| |`refcount`|1470|6| |`length`|147|49| |`called`|HsmpGetRegDword
NTOSKRNL.EXE::IoGetCurrentProcess|Feature_2092950840__private_IsEnabledFallback| |`calling`|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldHsmGetSyncPolicy
CldHsmGetSyncPolicyByPath
CldHsmGetSyncProviderProcessByPath
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncRootInfoByPathCldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldHsmInitialize
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldLookupSyncRoot
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldPortSendUpstreamMessage
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamRestartHydration
CldStreamRetrieveData
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncAckDehydrate
CldSyncAckDelete
CldSyncAckRename
CldSyncConnectRoot
CldSyncGetPlaceholderRangeInfo
CldSyncGetPolicy
CldSyncGetRootInfo
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncRegisterStream
CldSyncReportProgress
CldSyncReportSyncStatusOnRoot
CldSyncRestartHydration
CldSyncRetrieveData
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldSyncSetSyncStatusOnStream
CldSyncTransferPlaceholders
CldiPortAccessCheck
CldiPortAddCrossVmProgressEvent
CldiPortCheckAllSystemsGo
CldiPortInsertSyncRootNoLock
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessFilterControl
CldiPortProcessGetRangeInfo
CldiPortProcessGlobal
CldiPortProcessQueryProgress
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransfer
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamProcessPendingHydrationRequests
CldiStreamRestartCountdownTimer
CldiStreamServiceHydrationRequest
CldiStreamStopCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncReferenceRoot
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CldiSyncTransferOrAckData
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmDriverEntry
HsmExpandKernelStackAndCallout
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFileCacheMapData
HsmFltInstanceQueryTeardown
HsmFltPostLOCK_CONTROL
HsmFltPostSetRenameInformation
HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION
HsmFltPreCLEANUP
HsmFltPreDIRECTORY_CONTROL
HsmFltPreFILE_SYSTEM_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltPreREAD
HsmFltPreSET_EA
HsmFltPreSET_INFORMATION
HsmFltPreSET_PURGE_FAILURE_MODE
HsmFltPreSET_REPARSE_POINT
HsmFltPreSET_REPARSE_POINT_EX
HsmFltPreSET_ZERO_DATA
HsmFltPreSetBasicInformation
HsmFltPreSetDispositionInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltPreWRITE
HsmFltProcessClearInSync
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessGetCorrelationVector
HsmFltProcessGetLastSyncStatus
HsmFltProcessHSMControl
HsmFltProcessHydrate
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessQueryStreamKey
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetCorrelationVector
HsmFltProcessSetInSync
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmPreLockControlSynchronous
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapCheckVersion
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALLoadFromDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapNORMALVerifyBitmapPages
HsmiBitmapNormalDeleteStream
HsmiBitmapNormalOpenStream
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByFileObjectDeprecated
HsmiCldGetSyncRootInfoByPath
HsmiCldGetSyncRootInfoDeprecated
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompleteLockCallbackDataRoutine
HsmiCompressBuffer
HsmiCreateAllocateECPTags
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiExpandBitmapNoLock
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiFileCacheWriteCompletion
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiInfoRecallForRenameCompletion
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiIsUnsupportedLogfilePlaceholder
HsmiMarkFileRangeNoLock
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpInheritPinStatePre
HsmiOpPrepareOperation
HsmiOpRevertCompletion
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOpenFile
HsmiPrepareBitmapCommit
HsmiProcessPropertyLockRequestList
HsmiPropertyLockWait
HsmiQueryFileRangeNoLock
HsmiQueryFileRangesTotalNoLock
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallAllocatePopulationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmiRecallWriteFileNoLock
HsmiRpInitializeTable
HsmiUpdateFileAttributes
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpAccessCheckByFileId
HsmpAcquireFileNameLock
HsmpAcquireSyncOpRundownProtection
HsmpAcquireUserRequestRundownProtection
HsmpBitmapCreateSnapshot
HsmpBitmapGetRangeState
HsmpBitmapIsReparseBufferSupported
HsmpBitmapQueryRange
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo
HsmpCldIsHydrationDisallowed
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpCtxGetOrCreateFileContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpFileCacheSetFileSize
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpLoadPropertyStream
HsmpMarkHandleUsnSourceInfo
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpProcessQueryRangeStateHelper
HsmpQueryLastEffectiveUsn
HsmpQueryModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpBuildBuffer
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpRpValidateBuffer
HsmpRpiDecompressBuffer
HsmpSetCompressionNoLock
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpSetupContexts
HsmpToggleFileAttributes
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
HsmpUpdateLastAccessTime
HsmpValidateAttributionEcp
HsmpValidateStreamContextNoLock
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
|HsmiRecallHydrationCompletionCallback
HsmiRecallInitiateHydration| |paramcount|1|0| |`address`|140003da0|140017cac| |`sig`|undefined __fastcall HsmDbgBreakOnStatus(int param_1)|ulonglong __fastcall Feature_2092950840__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmDbgBreakOnStatus Called Diff ```diff --- HsmDbgBreakOnStatus called +++ Feature_2092950840__private_IsEnabledDeviceUsageNoInline called @@ -1,2 +1 @@ -HsmpGetRegDword -NTOSKRNL.EXE::IoGetCurrentProcess +Feature_2092950840__private_IsEnabledFallback ``` ### HsmDbgBreakOnStatus Calling Diff ```diff --- HsmDbgBreakOnStatus calling +++ Feature_2092950840__private_IsEnabledDeviceUsageNoInline calling @@ -1,229 +1 @@ -CldCaptureProcessInfo -CldHsmAddCrossContainerNotificationEvent -CldHsmCreateFileContext -CldHsmCreateInstanceContext -CldHsmCreateStreamContext -CldHsmCreateStreamHandleContext -CldHsmGetSyncPolicy -CldHsmGetSyncPolicyByPath -CldHsmGetSyncProviderProcessByPath -CldHsmGetSyncRootFileIdByPath -CldHsmGetSyncRootInfoByPath -CldHsmGetSyncStatus -CldHsmHydratePlaceholder -CldHsmInitialize -CldHsmNotifyPreOperation -CldHsmPopulatePlaceholders -CldHsmTerminateProgressiveHydration -CldLookupSyncRoot -CldPortInitialize -CldPortSendCancelHydrationMessage -CldPortSendCancelNotificationMessage -CldPortSendCancelPopulationMessage -CldPortSendHydrationMessage -CldPortSendPopulationMessage -CldPortSendPostOpMessage -CldPortSendPreOpMessage -CldPortSendUpstreamMessage -CldStreamAckData -CldStreamGetPlaceholderRangeInfo -CldStreamInitialize -CldStreamOpen -CldStreamQueryProgress -CldStreamRestartHydration -CldStreamRetrieveData -CldStreamSetSyncStatus -CldStreamTransferData -CldStreamTransferPlaceholders -CldSyncAckDehydrate -CldSyncAckDelete -CldSyncAckRename -CldSyncConnectRoot -CldSyncGetPlaceholderRangeInfo -CldSyncGetPolicy -CldSyncGetRootInfo -CldSyncGetSyncStatusOnRoot -CldSyncLookupRootByName -CldSyncRegisterStream -CldSyncReportProgress -CldSyncReportSyncStatusOnRoot -CldSyncRestartHydration -CldSyncRetrieveData -CldSyncSendCancelHydrationRequest -CldSyncSendCancelNotificationRequest -CldSyncSendCancelPopulationRequest -CldSyncSendHydrationRequest -CldSyncSendPopulationRequest -CldSyncSendPostNotification -CldSyncSendPreNotification -CldSyncSetSyncStatusOnStream -CldSyncTransferPlaceholders -CldiPortAccessCheck -CldiPortAddCrossVmProgressEvent -CldiPortCheckAllSystemsGo -CldiPortInsertSyncRootNoLock -CldiPortNotifyConnect -CldiPortNotifyMessage -CldiPortProcessAbortHydration -CldiPortProcessAckData -CldiPortProcessAckNotification -CldiPortProcessFilterControl -CldiPortProcessGetRangeInfo -CldiPortProcessGlobal -CldiPortProcessQueryProgress -CldiPortProcessReportProgress -CldiPortProcessRestartHydration -CldiPortProcessRetrieveData -CldiPortProcessServiceCommands -CldiPortProcessTransfer -CldiPortProcessTransferData -CldiPortProcessTransferPlaceholders -CldiPortSetSyncStatus -CldiStreamAckNotification -CldiStreamBuildProviderRequest -CldiStreamCompleteRequest -CldiStreamInsertIntoCancelSafeQueue -CldiStreamProcessPendingHydrationRequests -CldiStreamRestartCountdownTimer -CldiStreamServiceHydrationRequest -CldiStreamStopCountdownTimer -CldiSyncCreateRootNoLock -CldiSyncEnsurePendingRanges -CldiSyncInitializeRootNoLock -CldiSyncInsertPendingRange -CldiSyncReferenceRoot -CldiSyncSetSyncStatusOnRoot -CldiSyncSplitPendingRange -CldiSyncTransferOrAckData -CldiSyncTransferOrAckDataByObject -CldiSyncTransferPlaceholdersByObject -HsmCldDeleteSyncRootInfo -HsmCldPersistSyncRootInfo -HsmCreateOrOpenNamedEvent -HsmDriverEntry -HsmExpandKernelStackAndCallout -HsmFileCacheCreateFileObject -HsmFileCacheInitialize -HsmFileCacheMapData -HsmFltInstanceQueryTeardown -HsmFltPostLOCK_CONTROL -HsmFltPostSetRenameInformation -HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION -HsmFltPreCLEANUP -HsmFltPreDIRECTORY_CONTROL -HsmFltPreFILE_SYSTEM_CONTROL -HsmFltPreLOCK_CONTROL -HsmFltPreQUERY_ALLOCATED_RANGES -HsmFltPreREAD -HsmFltPreSET_EA -HsmFltPreSET_INFORMATION -HsmFltPreSET_PURGE_FAILURE_MODE -HsmFltPreSET_REPARSE_POINT -HsmFltPreSET_REPARSE_POINT_EX -HsmFltPreSET_ZERO_DATA -HsmFltPreSetBasicInformation -HsmFltPreSetDispositionInformation -HsmFltPreSetLinkInformation -HsmFltPreSetRenameInformation -HsmFltPreWRITE -HsmFltProcessClearInSync -HsmFltProcessConvertPlaceholder -HsmFltProcessCreatePlaceholders -HsmFltProcessDehydrate -HsmFltProcessGetCorrelationVector -HsmFltProcessGetLastSyncStatus -HsmFltProcessHSMControl -HsmFltProcessHydrate -HsmFltProcessLockProperties -HsmFltProcessQueryPlaceholder -HsmFltProcessQueryStreamKey -HsmFltProcessRetrieveProperties -HsmFltProcessRevert -HsmFltProcessSetCorrelationVector -HsmFltProcessSetInSync -HsmFltProcessSetPinState -HsmFltProcessStoreProperties -HsmFltProcessUpdatePlaceholder -HsmIBitmapNORMALCreate -HsmIBitmapNORMALMarkRangeEx -HsmIBitmapNORMALMayContainDirtyRange -HsmIBitmapNORMALOpen -HsmIBitmapNORMALPrepareCommit -HsmIBitmapNORMALQueryRangeEx -HsmIBitmapVOLATILEMarkRangeEx -HsmPreLockControlSynchronous -HsmProcessGetPlaceholderRangeInfo -HsmRecallAckData -HsmRecallRetrieveData -HsmRecallTransferData -HsmRecallTransferPlaceholders -HsmRecallUpdatePlaceholderFile -HsmiBitmapCheckVersion -HsmiBitmapNORMALDeleteOnDisk -HsmiBitmapNORMALEnsureOpened -HsmiBitmapNORMALFlushBitmapOnDisk -HsmiBitmapNORMALLoadFromDisk -HsmiBitmapNORMALMapBlock -HsmiBitmapNORMALMarkBitmapOnDisk -HsmiBitmapNORMALOpenOnDisk -HsmiBitmapNORMALPrepareBlockForWrite -HsmiBitmapNORMALPrepareMcbsForCommit -HsmiBitmapNORMALVerifyBitmapPages -HsmiBitmapNormalDeleteStream -HsmiBitmapNormalOpenStream -HsmiCldGetSyncProviderProcess -HsmiCldGetSyncRootFileIdByFileObject -HsmiCldGetSyncRootFileIdByPath -HsmiCldGetSyncRootInfo -HsmiCldGetSyncRootInfoByFileObject -HsmiCldGetSyncRootInfoByFileObjectDeprecated -HsmiCldGetSyncRootInfoByPath -HsmiCldGetSyncRootInfoDeprecated -HsmiCldLoadSyncRootInfoByFileId -HsmiCldLoadSyncRootInfoByFileObject -HsmiCldOpenSyncRoot -HsmiCompleteLockCallbackDataRoutine -HsmiCompressBuffer -HsmiCreateAllocateECPTags -HsmiCreateEnsureDirectoryFullyPopulated -HsmiCtxCreateFileContext -HsmiCtxGetOrCreateFileContext -HsmiExpandBitmapNoLock -HsmiFileCacheAllocateStreamControlBlock -HsmiFileCacheIrpClose -HsmiFileCacheIrpQueryInformation -HsmiFileCacheIrpRead -HsmiFileCacheIrpWrite -HsmiFileCacheValidateFileObject -HsmiFileCacheWriteCompletion -HsmiFltPostECPCREATE -HsmiFltPreECPCREATE -HsmiGrantLockRequest -HsmiInfoHydratePlaceholderOnRename -HsmiInfoPopulatePlaceholderOnRename -HsmiInfoPrepareForPostRename -HsmiInfoPrepareForPostSetDispostionInformation -HsmiInfoRecallForRenameCompletion -HsmiInfoUpdatePlaceholderStatesOnRenamePre -HsmiIsFileAttributeChangeRequired -HsmiIsUnsupportedLogfilePlaceholder -HsmiMarkFileRangeNoLock -HsmiMungeQueryDirectory -HsmiOOBECompleteWnfCallback -HsmiOpDehydrateNotificationCallback -HsmiOpInheritPinStatePre -HsmiOpPrepareOperation -HsmiOpRevertCompletion -HsmiOpSetPinStateInternal -HsmiOpUpdateInSyncState -HsmiOpUpdatePlaceholderDirectory -HsmiOpUpdatePlaceholderFile -HsmiOpenFile -HsmiPrepareBitmapCommit -HsmiProcessPropertyLockRequestList -HsmiPropertyLockWait -HsmiQueryFileRangeNoLock -HsmiQueryFileRangesTotalNoLock -HsmiQueryFullFilePath -HsmiRecallAllocateHydrationContext -HsmiRecallAllocatePopulationContext +HsmiRecallHydrationCompletionCallback @@ -231,78 +2,0 @@ -HsmiRecallPostProcessUserHydrationRequest -HsmiRecallWriteFileNoLock -HsmiRpInitializeTable -HsmiUpdateFileAttributes -HsmiValidateAndAttachAttributionEcpToStreamHandleContext -HsmpAccessCheck -HsmpAccessCheckByFileId -HsmpAcquireFileNameLock -HsmpAcquireSyncOpRundownProtection -HsmpAcquireUserRequestRundownProtection -HsmpBitmapCreateSnapshot -HsmpBitmapGetRangeState -HsmpBitmapIsReparseBufferSupported -HsmpBitmapQueryRange -HsmpBuildFullLinkPath -HsmpCheckLegacyFilterAbsence -HsmpCldCheckSyncProviderAccess -HsmpCldGetSyncPolicy -HsmpCldGetSyncPolicyByPath -HsmpCldGetSyncRootBasicInfo -HsmpCldGetSyncRootFileIdEx -HsmpCldGetSyncRootProviderInfo -HsmpCldGetSyncRootStandardInfo -HsmpCldIsHydrationDisallowed -HsmpCldNotifyPostOperation -HsmpCldNotifyPreOperation -HsmpCtxCreateInstanceContext -HsmpCtxCreateStreamContext -HsmpCtxCreateStreamHandleContext -HsmpCtxGetOrCreateFileContext -HsmpDeleteAlternateStream -HsmpDeleteAlternateStreamById -HsmpDeletePropertyStream -HsmpFileCacheFlush -HsmpFileCachePreparePinWrite -HsmpFileCacheSetFileSize -HsmpFillOutAttributionInformation -HsmpGetAttributionInformation -HsmpLoadPropertyStream -HsmpMarkHandleUsnSourceInfo -HsmpNotifyDataChange -HsmpOpCreatePlaceholders -HsmpOpenFileById -HsmpOpenFileByIdEx -HsmpOpenFileByPath -HsmpPrepareForMgmtOperation -HsmpProcessQueryRangeStateHelper -HsmpQueryLastEffectiveUsn -HsmpQueryModifiedRangeNoLock -HsmpQueryValidatedNonModifiedRangeNoLock -HsmpQueryValidatedNonModifiedRangesTotalNoLock -HsmpQueueDehydrationRequest -HsmpRecallInitiateHydrationEx -HsmpRecallInitiatePopulationEx -HsmpRecurseDirectory -HsmpRelativeStreamOpen -HsmpRelativeStreamOpenById -HsmpRpBuildBuffer -HsmpRpCommitNoLock -HsmpRpCreate -HsmpRpReadBuffer -HsmpRpRemove -HsmpRpValidateBuffer -HsmpRpiDecompressBuffer -HsmpSetCompressionNoLock -HsmpSetFileDisposition -HsmpSetFileVDL -HsmpSetupContexts -HsmpToggleFileAttributes -HsmpToggleFileAttributesNoNotify -HsmpToggleFileAttributesNotify -HsmpToggleFileSparseAttribute -HsmpUpdateLastAccessTime -HsmpValidateAttributionEcp -HsmpValidateStreamContextNoLock -QueryIfEAExists -TlmInitializeCorrelationVector -TlmWriteFilterAttachEvent ``` ### HsmDbgBreakOnStatus Diff ```diff --- HsmDbgBreakOnStatus +++ Feature_2092950840__private_IsEnabledDeviceUsageNoInline @@ -1,30 +1,17 @@ -void HsmDbgBreakOnStatus(int param_1) +ulonglong Feature_2092950840__private_IsEnabledDeviceUsageNoInline(void) { - code *pcVar1; - int iVar2; - longlong lVar3; - int iVar4; - int local_res8 [8]; + ulonglong uVar1; + undefined8 local_res8; - if (param_1 == 0) { - return; + local_res8 = (ulonglong)Feature_2092950840__private_featureState; + if ((Feature_2092950840__private_featureState & 0x10) == 0) { + uVar1 = Feature_2092950840__private_IsEnabledFallback(local_res8,3); } - local_res8[0] = 0; - iVar4 = 0; - if (((DAT_0 & 2) != 0) && - (iVar2 = HsmpGetRegDword(&__DEBUG,L"BreakOnStatus",local_res8), iVar4 = local_res8[0], - iVar2 < 0)) { - iVar4 = DAT_1; + else { + uVar1 = (ulonglong)(Feature_2092950840__private_featureState & 1); } - if (((((DAT_0 & 2) != 0) && (param_1 == iVar4)) && - ((DAT_2 == (void *)0x0 || (DAT_2 == SystemReserved1[0xf])))) && - ((DAT_3 == 0 || (lVar3 = IoGetCurrentProcess(), DAT_3 == lVar3)))) { - pcVar1 = (code *)swi(3); - (*pcVar1)(); - return; - } - return; + return uVar1; } ``` ## CldiStreamCdqRELEASE ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.3| |i_ratio|0.29| |m_ratio|0.76| |b_ratio|0.19| |match_types|Implied Match| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |`name`|CldiStreamCdqRELEASE|Feature_2089223483__private_IsEnabledDeviceUsageNoInline| |`fullname`|CldiStreamCdqRELEASE|Feature_2089223483__private_IsEnabledDeviceUsageNoInline| |`refcount`|34|20| |`length`|37|49| |`called`|NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeLeaveCriticalRegion|Feature_2089223483__private_IsEnabledFallback| |`calling`|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldStreamCdqRELEASE
CldStreamReportProgress
CldiStreamBuildProviderRequest
CldiStreamCancelSynchronousRequestCldiStreamCompleteProviderRequest
CldiStreamCompleteRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
HsmpCompletePendedDehydrationRequests
HsmpQueueDehydrationRequest
|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamBuildProviderRequest
CldiStreamCancelSynchronousRequest
CldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamCdqREMOVE_IOCldiStreamCompleteCanceledRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamPrepareRequestForNonCdqCompletion
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
| |paramcount|1|0| |`address`|14004b870|1400111a4| |`sig`|undefined __fastcall CldiStreamCdqRELEASE(longlong param_1)|ulonglong __fastcall Feature_2089223483__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCdqRELEASE Called Diff ```diff --- CldiStreamCdqRELEASE called +++ Feature_2089223483__private_IsEnabledDeviceUsageNoInline called @@ -1,2 +1 @@ -NTOSKRNL.EXE::ExReleaseResourceLite -NTOSKRNL.EXE::KeLeaveCriticalRegion +Feature_2089223483__private_IsEnabledFallback ``` ### CldiStreamCdqRELEASE Calling Diff ```diff --- CldiStreamCdqRELEASE calling +++ Feature_2089223483__private_IsEnabledDeviceUsageNoInline calling @@ -8,2 +7,0 @@ -CldStreamCdqRELEASE -CldStreamReportProgress @@ -12 +10,3 @@ -CldiStreamCompleteProviderRequest +CldiStreamCdqCOMPLETE_CANCELED_IO +CldiStreamCdqREMOVE_IO +CldiStreamCompleteCanceledRequest @@ -13,0 +14,2 @@ +CldiStreamInsertIntoCancelSafeQueue +CldiStreamPrepareRequestForNonCdqCompletion @@ -17,2 +18,0 @@ -HsmpCompletePendedDehydrationRequests -HsmpQueueDehydrationRequest ``` ### CldiStreamCdqRELEASE Diff ```diff --- CldiStreamCdqRELEASE +++ Feature_2089223483__private_IsEnabledDeviceUsageNoInline @@ -1,9 +1,17 @@ -void CldiStreamCdqRELEASE(longlong param_1) +ulonglong Feature_2089223483__private_IsEnabledDeviceUsageNoInline(void) { - ExReleaseResourceLite(param_1 + 0x80); - KeLeaveCriticalRegion(); - return; + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_2089223483__private_featureState; + if ((Feature_2089223483__private_featureState & 0x10) == 0) { + uVar1 = Feature_2089223483__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_2089223483__private_featureState & 1); + } + return uVar1; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## FLTMGR.SYS::FltAcquirePushLockSharedEx ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|FltAcquirePushLockSharedEx|FltAcquirePushLockSharedEx| |fullname|FLTMGR.SYS::FltAcquirePushLockSharedEx|FLTMGR.SYS::FltAcquirePushLockSharedEx| |`refcount`|36|34| |length|0|0| |called||| |`calling`|
Expand for full list:
CldHsmCreateStreamHandleContext
CldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldLookupSyncRoot
CldSyncAbortOperation
CldSyncGetSyncStatusOnRoot
CldSyncReferenceStream
CldiPortAccessCheck
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotificationCldiPortProcessGetRangeInfo
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
HsmFltPreSetBasicInformation
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmRecallRetrieveData
HsmiQueryFileRange
HsmiRecallInitiateHydration
HsmpAcquireBitmapLock
HsmpAcquireReparseUpdateLock
HsmpCtxCreateStreamHandleContext
HsmpFillOutAttributionInformation
|
Expand for full list:
CldHsmCreateStreamHandleContext
CldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldLookupSyncRoot
CldSyncAbortOperation
CldSyncGetSyncStatusOnRoot
CldSyncReferenceStream
CldiPortAccessCheck
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotificationCldiPortProcessGetRangeInfo
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
HsmFltPreSetBasicInformation
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmRecallRetrieveData
HsmiQueryFileRange
HsmpAcquireBitmapLock
HsmpAcquireReparseUpdateLock
HsmpCtxCreateStreamHandleContext
HsmpFillOutAttributionInformation
| |paramcount|0|0| |address|EXTERNAL:00000149|EXTERNAL:00000149| |sig|undefined FltAcquirePushLockSharedEx(void)|undefined FltAcquirePushLockSharedEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### FLTMGR.SYS::FltAcquirePushLockSharedEx Calling Diff ```diff --- FLTMGR.SYS::FltAcquirePushLockSharedEx calling +++ FLTMGR.SYS::FltAcquirePushLockSharedEx calling @@ -26 +25,0 @@ -HsmiRecallInitiateHydration ``` ## NTOSKRNL.EXE::FsRtlGetNextBaseMcbEntry ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|FsRtlGetNextBaseMcbEntry|FsRtlGetNextBaseMcbEntry| |fullname|NTOSKRNL.EXE::FsRtlGetNextBaseMcbEntry|NTOSKRNL.EXE::FsRtlGetNextBaseMcbEntry| |`refcount`|3|4| |length|0|0| |called||| |calling|CldHsmHydratePlaceholder
HsmIBitmapNORMALPrepareCommit|CldHsmHydratePlaceholder
HsmIBitmapNORMALPrepareCommit| |paramcount|0|0| |address|EXTERNAL:00000091|EXTERNAL:00000091| |sig|undefined FsRtlGetNextBaseMcbEntry(void)|undefined FsRtlGetNextBaseMcbEntry(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## WPP_SF_qqqd ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.96| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|WPP_SF_qqqd|WPP_SF_qqqd| |fullname|WPP_SF_qqqd|WPP_SF_qqqd| |`refcount`|99|97| |length|99|99| |called|_guard_dispatch_icall|_guard_dispatch_icall| |calling|
Expand for full list:
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamRetrieveData
CldStreamTransferData
CldSyncDisconnectRoot
CldSyncRetrieveData
CldSyncSendCancelNotificationRequestCldSyncSendPreNotification
CldiPortAccessCheck
CldiPortInsertSyncRootNoLock
CldiStreamInsertIntoCancelSafeQueue
HsmFltPostQUERY_OPEN
HsmFltPreCLEANUP
HsmFltPreSET_EA
HsmFltPreSET_REPARSE_POINT
HsmFltPreSET_REPARSE_POINT_EX
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessQueryPlaceholder
HsmFltProcessRetrieveProperties
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmPreLockControlSynchronous
HsmRecallAckData
HsmRecallTransferData
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoDeprecated
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiFileCacheValidateFileObject
HsmiFltPostECPCREATE
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiOpDehydrateNotificationCallback
HsmiOpPrepareOperation
HsmiOpUpdatePlaceholderFile
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootStandardInfo
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpDeletePropertyStream
HsmpLoadPropertyStream
HsmpRpCommitNoLock
HsmpSetCompressionNoLock
HsmpSetupContexts
HsmpUpdateLastAccessTime
|
Expand for full list:
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamRetrieveData
CldStreamTransferData
CldSyncDisconnectRoot
CldSyncRetrieveData
CldSyncSendCancelNotificationRequestCldSyncSendPreNotification
CldiPortAccessCheck
CldiPortInsertSyncRootNoLock
CldiStreamInsertIntoCancelSafeQueue
HsmFltPostQUERY_OPEN
HsmFltPreCLEANUP
HsmFltPreSET_EA
HsmFltPreSET_REPARSE_POINT
HsmFltPreSET_REPARSE_POINT_EX
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessQueryPlaceholder
HsmFltProcessRetrieveProperties
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmPreLockControlSynchronous
HsmRecallAckData
HsmRecallTransferData
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoDeprecated
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiFileCacheValidateFileObject
HsmiFltPostECPCREATE
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiOpDehydrateNotificationCallback
HsmiOpPrepareOperation
HsmiOpUpdatePlaceholderFile
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootStandardInfo
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpDeletePropertyStream
HsmpLoadPropertyStream
HsmpRpCommitNoLock
HsmpSetCompressionNoLock
HsmpSetupContexts
HsmpUpdateLastAccessTime
| |paramcount|4|4| |address|14000be30|14000be30| |sig|undefined __fastcall WPP_SF_qqqd(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_qqqd(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## WPP_SF_qqqiqd ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.97| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|WPP_SF_qqqiqd|WPP_SF_qqqiqd| |fullname|WPP_SF_qqqiqd|WPP_SF_qqqiqd| |`refcount`|19|18| |length|129|129| |called|_guard_dispatch_icall|_guard_dispatch_icall| |calling|CldHsmHydratePlaceholder
HsmFltPreCLEANUP
HsmFltPreSET_ZERO_DATA
HsmFltPreSetBasicInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiOpUpdatePlaceholderFile
HsmpProcessQueryRangeStateHelper|CldHsmHydratePlaceholder
HsmFltPreCLEANUP
HsmFltPreSET_ZERO_DATA
HsmFltPreSetBasicInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiOpUpdatePlaceholderFile
HsmpProcessQueryRangeStateHelper| |paramcount|4|4| |address|14000df78|14000df78| |sig|undefined __fastcall WPP_SF_qqqiqd(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_qqqiqd(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## CldiStreamDeleteRequest ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.94| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamDeleteRequest|CldiStreamDeleteRequest| |fullname|CldiStreamDeleteRequest|CldiStreamDeleteRequest| |`refcount`|6|11| |length|213|213| |called|FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb|FLTMGR.SYS::FltReleaseContext
NTOSKRNL.EXE::ExFreeToPagedLookasideList
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb| |calling|CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest|CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest| |paramcount|1|1| |address|140034c1c|140034c1c| |sig|undefined __fastcall CldiStreamDeleteRequest(uint * param_1)|undefined __fastcall CldiStreamDeleteRequest(uint * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## HsmiQueryFileRangeNoLock ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|HsmiQueryFileRangeNoLock|HsmiQueryFileRangeNoLock| |fullname|HsmiQueryFileRangeNoLock|HsmiQueryFileRangeNoLock| |`refcount`|6|7| |length|208|208| |called|HsmDbgBreakOnStatus
HsmpBitmapQueryRange|HsmDbgBreakOnStatus
HsmpBitmapQueryRange| |`calling`|HsmRecallAckData
HsmiQueryFileRange
HsmpProcessQueryRangeStateHelper
HsmpQueryValidatedNonModifiedRangeNoLock|HsmRecallAckData
HsmiQueryFileRange
HsmiRecallInitiateHydration
HsmpProcessQueryRangeStateHelper
HsmpQueryValidatedNonModifiedRangeNoLock| |paramcount|6|6| |`address`|140074c0c|1400753ec| |sig|int __fastcall HsmiQueryFileRangeNoLock(longlong param_1, int param_2, undefined8 param_3, undefined8 * param_4, byte * param_5, undefined8 * param_6)|int __fastcall HsmiQueryFileRangeNoLock(longlong param_1, int param_2, undefined8 param_3, undefined8 * param_4, byte * param_5, undefined8 * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmiQueryFileRangeNoLock Calling Diff ```diff --- HsmiQueryFileRangeNoLock calling +++ HsmiQueryFileRangeNoLock calling @@ -2,0 +3 @@ +HsmiRecallInitiateHydration ``` ## HsmpBitmapQueryRangeExCallout ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.94| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|HsmpBitmapQueryRangeExCallout|HsmpBitmapQueryRangeExCallout| |fullname|HsmpBitmapQueryRangeExCallout|HsmpBitmapQueryRangeExCallout| |`refcount`|10|9| |length|61|61| |called|HsmpBitmapQueryRangeEx|HsmpBitmapQueryRangeEx| |calling||| |paramcount|1|1| |address|14000a5d0|14000a5d0| |sig|undefined __fastcall HsmpBitmapQueryRangeExCallout(undefined4 * param_1)|undefined __fastcall HsmpBitmapQueryRangeExCallout(undefined4 * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## FLTMGR.SYS::FltCbdqRemoveIo ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|FltCbdqRemoveIo|FltCbdqRemoveIo| |fullname|FLTMGR.SYS::FltCbdqRemoveIo|FLTMGR.SYS::FltCbdqRemoveIo| |`refcount`|3|4| |length|0|0| |called||| |`calling`|CldiStreamCompleteRequest
HsmpCompletePendedDehydrationRequests|CldiCanDoNonCdqCompletion
CldiStreamCompleteRequest
HsmpCompletePendedDehydrationRequests| |paramcount|0|0| |address|EXTERNAL:0000013f|EXTERNAL:0000013f| |sig|undefined FltCbdqRemoveIo(void)|undefined FltCbdqRemoveIo(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### FLTMGR.SYS::FltCbdqRemoveIo Calling Diff ```diff --- FLTMGR.SYS::FltCbdqRemoveIo calling +++ FLTMGR.SYS::FltCbdqRemoveIo calling @@ -0,0 +1 @@ +CldiCanDoNonCdqCompletion ``` ## HsmpAcquireBitmapLock ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.81| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|HsmpAcquireBitmapLock|HsmpAcquireBitmapLock| |fullname|HsmpAcquireBitmapLock|HsmpAcquireBitmapLock| |`refcount`|11|12| |length|59|59| |called|FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltAcquirePushLockSharedEx|FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltAcquirePushLockSharedEx| |`calling`|HsmFltPreSetBasicInformation
HsmRecallAckData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmiOpDehydrateNotificationCallback
HsmiOpUpdatePlaceholderFile
HsmiRecallPostProcessUserHydrationRequest
HsmpProcessQueryRangeStateHelper
HsmpRecallInitiateHydrationEx|HsmFltPreSetBasicInformation
HsmRecallAckData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmiOpDehydrateNotificationCallback
HsmiOpUpdatePlaceholderFile
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmpProcessQueryRangeStateHelper
HsmpRecallInitiateHydrationEx| |paramcount|2|2| |`address`|1400762ec|140076acc| |sig|undefined __fastcall HsmpAcquireBitmapLock(longlong param_1, char param_2)|undefined __fastcall HsmpAcquireBitmapLock(longlong param_1, char param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmpAcquireBitmapLock Calling Diff ```diff --- HsmpAcquireBitmapLock calling +++ HsmpAcquireBitmapLock calling @@ -6,0 +7 @@ +HsmiRecallInitiateHydration ``` ## HsmpAcquireReparseUpdateLock ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|HsmpAcquireReparseUpdateLock|HsmpAcquireReparseUpdateLock| |fullname|HsmpAcquireReparseUpdateLock|HsmpAcquireReparseUpdateLock| |`refcount`|13|14| |length|51|51| |called|FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltAcquirePushLockSharedEx|FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltAcquirePushLockSharedEx| |`calling`|
Expand for full list:
HsmFltPreCLEANUP
HsmFltProcessHSMControl
HsmRecallAckData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmiOpDehydrateNotificationCallback
HsmiOpUpdatePlaceholderFile
HsmiRecallPostProcessUserHydrationRequest
HsmpEnableSyncOp
HsmpProcessQueryRangeStateHelper
HsmpRecallInitiateHydrationExHsmpRecallInitiatePopulationEx
|
Expand for full list:
HsmFltPreCLEANUP
HsmFltProcessHSMControl
HsmRecallAckData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmiOpDehydrateNotificationCallback
HsmiOpUpdatePlaceholderFile
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmpEnableSyncOp
HsmpProcessQueryRangeStateHelperHsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
| |paramcount|2|2| |`address`|140073b04|1400742e4| |sig|undefined __fastcall HsmpAcquireReparseUpdateLock(longlong param_1, char param_2)|undefined __fastcall HsmpAcquireReparseUpdateLock(longlong param_1, char param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmpAcquireReparseUpdateLock Calling Diff ```diff --- HsmpAcquireReparseUpdateLock calling +++ HsmpAcquireReparseUpdateLock calling @@ -7,0 +8 @@ +HsmiRecallInitiateHydration ``` ## wil_details_IsEnabledFallback ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|8|11| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_1074201912__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallback
Feature_Cldflt_BitmapNullValueCheck__private_IsEnabledFallback
Feature_CloudFilesCrashInLogFailStreamContextAllocation__private_IsEnabledFallback
Feature_CloudFilesCrashReadingProcessImageName__private_IsEnabledFallback
Feature_RtlCrc32_UserModeAccessIssues__private_IsEnabledFallback
Feature_Servicing_PostRelOutlookHangIssue__private_IsEnabledFallback|Feature_1074201912__private_IsEnabledFallback
Feature_2089223483__private_IsEnabledFallback
Feature_2092950840__private_IsEnabledFallback
Feature_955245880__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallback
Feature_Cldflt_BitmapNullValueCheck__private_IsEnabledFallback
Feature_CloudFilesCrashInLogFailStreamContextAllocation__private_IsEnabledFallback
Feature_CloudFilesCrashReadingProcessImageName__private_IsEnabledFallback
Feature_RtlCrc32_UserModeAccessIssues__private_IsEnabledFallback
Feature_Servicing_PostRelOutlookHangIssue__private_IsEnabledFallback| |paramcount|3|3| |address|14000c17c|14000c17c| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1,0 +2,3 @@ +Feature_2089223483__private_IsEnabledFallback +Feature_2092950840__private_IsEnabledFallback +Feature_955245880__private_IsEnabledFallback ``` ## CldiStreamCdqRELEASE ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamCdqRELEASE|CldiStreamCdqRELEASE| |fullname|CldiStreamCdqRELEASE|CldiStreamCdqRELEASE| |`refcount`|34|46| |length|37|37| |called|NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeLeaveCriticalRegion|NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeLeaveCriticalRegion| |`calling`|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldStreamCdqRELEASE
CldStreamReportProgress
CldiStreamBuildProviderRequest
CldiStreamCancelSynchronousRequestCldiStreamCompleteProviderRequest
CldiStreamCompleteRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
HsmpCompletePendedDehydrationRequests
HsmpQueueDehydrationRequest
|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldStreamCdqRELEASE
CldStreamReportProgress
CldiStreamBuildProviderRequest
CldiStreamCancelSynchronousRequestCldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamCompleteProviderRequest
CldiStreamCompleteRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
HsmpCompletePendedDehydrationRequests
HsmpQueueDehydrationRequest
| |paramcount|1|1| |`address`|14004b870|14004a080| |sig|undefined __fastcall CldiStreamCdqRELEASE(longlong param_1)|undefined __fastcall CldiStreamCdqRELEASE(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCdqRELEASE Calling Diff ```diff --- CldiStreamCdqRELEASE calling +++ CldiStreamCdqRELEASE calling @@ -11,0 +12 @@ +CldiStreamCdqCOMPLETE_CANCELED_IO ``` ## FLTMGR.SYS::FltReleasePushLockEx ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|FltReleasePushLockEx|FltReleasePushLockEx| |fullname|FLTMGR.SYS::FltReleasePushLockEx|FLTMGR.SYS::FltReleasePushLockEx| |`refcount`|138|137| |length|0|0| |called||| |calling|
Expand for full list:
CldHsmCreateStreamHandleContext
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldLookupSyncRoot
CldStreamClose
CldStreamOpen
CldStreamPurgeCache
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholdersCldSyncAbortOperation
CldSyncCleanup
CldSyncConnectRoot
CldSyncDisconnectRoot
CldSyncDisconnectRootByObject
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncReferenceStream
CldSyncRegisterStream
CldSyncRemoveInFlightRanges
CldSyncReportSyncStatusOnRoot
CldSyncSendCancelHydrationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPreNotification
CldiPortAccessCheck
CldiPortNotifyConnect
CldiPortNotifyDisconnect
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessGetRangeInfo
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiSyncSetSyncStatusOnRoot
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmFltDeleteSTREAMHANDLE_CONTEXT
HsmFltPreCLEANUP
HsmFltPreSetBasicInformation
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALCompleteCommit
HsmIBitmapNORMALIsCommitPending
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALLookupMcbGroupMapping
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapVOLATILELookupMcbMapping
HsmiOpCompleteOperation
HsmiOpDehydrateNotificationCallback
HsmiOpPrepareOperation
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmpAcquireFileNameLock
HsmpCtxCreateStreamHandleContext
HsmpEnableSyncOp
HsmpFillOutAttributionInformation
HsmpPersistEssentialPropPresent
HsmpPersistInSync
HsmpProcessQueryRangeStateHelper
HsmpReInitializeUserRequestRundownProtection
HsmpReleaseBitmapLock
HsmpReleaseFileNameLock
HsmpReleaseReparseUpdateLock
HsmpRpCommitNoLock
HsmpRpRemove
HsmpSetupContexts
HsmpWaitForUserRequestRundownRelease
|
Expand for full list:
CldHsmCreateStreamHandleContext
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldLookupSyncRoot
CldStreamClose
CldStreamOpen
CldStreamPurgeCache
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholdersCldSyncAbortOperation
CldSyncCleanup
CldSyncConnectRoot
CldSyncDisconnectRoot
CldSyncDisconnectRootByObject
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncReferenceStream
CldSyncRegisterStream
CldSyncRemoveInFlightRanges
CldSyncReportSyncStatusOnRoot
CldSyncSendCancelHydrationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPreNotification
CldiPortAccessCheck
CldiPortNotifyConnect
CldiPortNotifyDisconnect
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessGetRangeInfo
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiSyncSetSyncStatusOnRoot
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmFltDeleteSTREAMHANDLE_CONTEXT
HsmFltPreCLEANUP
HsmFltPreSetBasicInformation
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessHSMControl
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALCompleteCommit
HsmIBitmapNORMALIsCommitPending
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALLookupMcbGroupMapping
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapVOLATILELookupMcbMapping
HsmiOpCompleteOperation
HsmiOpDehydrateNotificationCallback
HsmiOpPrepareOperation
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmpAcquireFileNameLock
HsmpCtxCreateStreamHandleContext
HsmpEnableSyncOp
HsmpFillOutAttributionInformation
HsmpPersistEssentialPropPresent
HsmpPersistInSync
HsmpProcessQueryRangeStateHelper
HsmpReInitializeUserRequestRundownProtection
HsmpReleaseBitmapLock
HsmpReleaseFileNameLock
HsmpReleaseReparseUpdateLock
HsmpRpCommitNoLock
HsmpRpRemove
HsmpSetupContexts
HsmpWaitForUserRequestRundownRelease
| |paramcount|0|0| |address|EXTERNAL:00000146|EXTERNAL:00000146| |sig|undefined FltReleasePushLockEx(void)|undefined FltReleasePushLockEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## TlmWriteCvForPopulatePlaceholders ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|TlmWriteCvForPopulatePlaceholders|TlmWriteCvForPopulatePlaceholders| |fullname|TlmWriteCvForPopulatePlaceholders|TlmWriteCvForPopulatePlaceholders| |`refcount`|2|3| |length|27|27| |called|TlmpWriteCv|TlmpWriteCv| |calling|CldHsmPopulatePlaceholders|CldHsmPopulatePlaceholders| |paramcount|2|2| |`address`|1400162b8|1400163b8| |sig|undefined __fastcall TlmWriteCvForPopulatePlaceholders(longlong param_1, undefined4 param_2)|undefined __fastcall TlmWriteCvForPopulatePlaceholders(longlong param_1, undefined4 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## HsmExpandKernelStackAndCallout ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.93| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|HsmExpandKernelStackAndCallout|HsmExpandKernelStackAndCallout| |fullname|HsmExpandKernelStackAndCallout|HsmExpandKernelStackAndCallout| |`refcount`|19|18| |length|160|160| |called|HsmDbgBreakOnStatus
NTOSKRNL.EXE::IoGetStackLimits
NTOSKRNL.EXE::KeExpandKernelStackAndCalloutEx
_guard_dispatch_icall|HsmDbgBreakOnStatus
NTOSKRNL.EXE::IoGetStackLimits
NTOSKRNL.EXE::KeExpandKernelStackAndCalloutEx
_guard_dispatch_icall| |`calling`|
Expand for full list:
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiFltPreECPCREATE
HsmiQueryFileRangesTotalNoLock
HsmiRecallInitiateHydration
HsmpBitmapGetRangeStateHsmpBitmapQueryRange
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpRecurseDirectory
|
Expand for full list:
HsmFltProcessQueryPlaceholder
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiFltPreECPCREATE
HsmiQueryFileRangesTotalNoLock
HsmpBitmapGetRangeState
HsmpBitmapQueryRangeHsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpRecurseDirectory
| |paramcount|2|2| |address|14000a064|14000a064| |sig|int __fastcall HsmExpandKernelStackAndCallout(undefined * param_1, int * param_2)|int __fastcall HsmExpandKernelStackAndCallout(undefined * param_1, int * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmExpandKernelStackAndCallout Calling Diff ```diff --- HsmExpandKernelStackAndCallout calling +++ HsmExpandKernelStackAndCallout calling @@ -10 +9,0 @@ -HsmiRecallInitiateHydration ``` ## CldiStreamCdqACQUIRE ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|CldiStreamCdqACQUIRE|CldiStreamCdqACQUIRE| |fullname|CldiStreamCdqACQUIRE|CldiStreamCdqACQUIRE| |`refcount`|22|28| |length|48|48| |called|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::KeEnterCriticalRegion|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::KeEnterCriticalRegion| |`calling`|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldStreamCdqACQUIRE
CldStreamReportProgress
CldiStreamBuildProviderRequest
CldiStreamCancelSynchronousRequestCldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
HsmpCompletePendedDehydrationRequests
HsmpQueueDehydrationRequest
|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldStreamCdqACQUIRE
CldStreamReportProgress
CldiStreamBuildProviderRequest
CldiStreamCancelSynchronousRequestCldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamCompleteCanceledRequest
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
HsmpCompletePendedDehydrationRequests
HsmpQueueDehydrationRequest
| |paramcount|1|1| |`address`|14004b830|14004a040| |sig|undefined __fastcall CldiStreamCdqACQUIRE(longlong param_1)|undefined __fastcall CldiStreamCdqACQUIRE(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCdqACQUIRE Calling Diff ```diff --- CldiStreamCdqACQUIRE calling +++ CldiStreamCdqACQUIRE calling @@ -11,0 +12,2 @@ +CldiStreamCdqCOMPLETE_CANCELED_IO +CldiStreamCompleteCanceledRequest ``` ## TlmWriteCvForHydrateData ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|TlmWriteCvForHydrateData|TlmWriteCvForHydrateData| |fullname|TlmWriteCvForHydrateData|TlmWriteCvForHydrateData| |`refcount`|2|3| |length|27|27| |called|TlmpWriteCv|TlmpWriteCv| |calling|CldHsmHydratePlaceholder|CldHsmHydratePlaceholder| |paramcount|2|2| |address|14000cc1c|14000cc1c| |sig|undefined __fastcall TlmWriteCvForHydrateData(longlong param_1, undefined4 param_2)|undefined __fastcall TlmWriteCvForHydrateData(longlong param_1, undefined4 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## HsmDbgBreakOnStatus ### Match Info |Key|cldflt_8328.sys - cldflt_8457.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.74| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt_8328.sys|cldflt_8457.sys| | :---: | :---: | :---: | |name|HsmDbgBreakOnStatus|HsmDbgBreakOnStatus| |fullname|HsmDbgBreakOnStatus|HsmDbgBreakOnStatus| |`refcount`|1470|1469| |length|147|147| |called|HsmpGetRegDword
NTOSKRNL.EXE::IoGetCurrentProcess|HsmpGetRegDword
NTOSKRNL.EXE::IoGetCurrentProcess| |calling|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldHsmGetSyncPolicy
CldHsmGetSyncPolicyByPath
CldHsmGetSyncProviderProcessByPath
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncRootInfoByPathCldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldHsmInitialize
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldLookupSyncRoot
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldPortSendUpstreamMessage
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamRestartHydration
CldStreamRetrieveData
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncAckDehydrate
CldSyncAckDelete
CldSyncAckRename
CldSyncConnectRoot
CldSyncGetPlaceholderRangeInfo
CldSyncGetPolicy
CldSyncGetRootInfo
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncRegisterStream
CldSyncReportProgress
CldSyncReportSyncStatusOnRoot
CldSyncRestartHydration
CldSyncRetrieveData
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldSyncSetSyncStatusOnStream
CldSyncTransferPlaceholders
CldiPortAccessCheck
CldiPortAddCrossVmProgressEvent
CldiPortCheckAllSystemsGo
CldiPortInsertSyncRootNoLock
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessFilterControl
CldiPortProcessGetRangeInfo
CldiPortProcessGlobal
CldiPortProcessQueryProgress
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransfer
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamProcessPendingHydrationRequests
CldiStreamRestartCountdownTimer
CldiStreamServiceHydrationRequest
CldiStreamStopCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncReferenceRoot
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CldiSyncTransferOrAckData
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmDriverEntry
HsmExpandKernelStackAndCallout
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFileCacheMapData
HsmFltInstanceQueryTeardown
HsmFltPostLOCK_CONTROL
HsmFltPostSetRenameInformation
HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION
HsmFltPreCLEANUP
HsmFltPreDIRECTORY_CONTROL
HsmFltPreFILE_SYSTEM_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltPreREAD
HsmFltPreSET_EA
HsmFltPreSET_INFORMATION
HsmFltPreSET_PURGE_FAILURE_MODE
HsmFltPreSET_REPARSE_POINT
HsmFltPreSET_REPARSE_POINT_EX
HsmFltPreSET_ZERO_DATA
HsmFltPreSetBasicInformation
HsmFltPreSetDispositionInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltPreWRITE
HsmFltProcessClearInSync
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessGetCorrelationVector
HsmFltProcessGetLastSyncStatus
HsmFltProcessHSMControl
HsmFltProcessHydrate
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessQueryStreamKey
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetCorrelationVector
HsmFltProcessSetInSync
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmPreLockControlSynchronous
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapCheckVersion
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALLoadFromDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapNORMALVerifyBitmapPages
HsmiBitmapNormalDeleteStream
HsmiBitmapNormalOpenStream
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByFileObjectDeprecated
HsmiCldGetSyncRootInfoByPath
HsmiCldGetSyncRootInfoDeprecated
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompleteLockCallbackDataRoutine
HsmiCompressBuffer
HsmiCreateAllocateECPTags
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiExpandBitmapNoLock
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiFileCacheWriteCompletion
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiInfoRecallForRenameCompletion
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiIsUnsupportedLogfilePlaceholder
HsmiMarkFileRangeNoLock
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpInheritPinStatePre
HsmiOpPrepareOperation
HsmiOpRevertCompletion
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOpenFile
HsmiPrepareBitmapCommit
HsmiProcessPropertyLockRequestList
HsmiPropertyLockWait
HsmiQueryFileRangeNoLock
HsmiQueryFileRangesTotalNoLock
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallAllocatePopulationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmiRecallWriteFileNoLock
HsmiRpInitializeTable
HsmiUpdateFileAttributes
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpAccessCheckByFileId
HsmpAcquireFileNameLock
HsmpAcquireSyncOpRundownProtection
HsmpAcquireUserRequestRundownProtection
HsmpBitmapCreateSnapshot
HsmpBitmapGetRangeState
HsmpBitmapIsReparseBufferSupported
HsmpBitmapQueryRange
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo
HsmpCldIsHydrationDisallowed
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpCtxGetOrCreateFileContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpFileCacheSetFileSize
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpLoadPropertyStream
HsmpMarkHandleUsnSourceInfo
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpProcessQueryRangeStateHelper
HsmpQueryLastEffectiveUsn
HsmpQueryModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpBuildBuffer
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpRpValidateBuffer
HsmpRpiDecompressBuffer
HsmpSetCompressionNoLock
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpSetupContexts
HsmpToggleFileAttributes
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
HsmpUpdateLastAccessTime
HsmpValidateAttributionEcp
HsmpValidateStreamContextNoLock
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldHsmGetSyncPolicy
CldHsmGetSyncPolicyByPath
CldHsmGetSyncProviderProcessByPath
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncRootInfoByPathCldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldHsmInitialize
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldLookupSyncRoot
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldPortSendUpstreamMessage
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamRestartHydration
CldStreamRetrieveData
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncAckDehydrate
CldSyncAckDelete
CldSyncAckRename
CldSyncConnectRoot
CldSyncGetPlaceholderRangeInfo
CldSyncGetPolicy
CldSyncGetRootInfo
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncRegisterStream
CldSyncReportProgress
CldSyncReportSyncStatusOnRoot
CldSyncRestartHydration
CldSyncRetrieveData
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldSyncSetSyncStatusOnStream
CldSyncTransferPlaceholders
CldiPortAccessCheck
CldiPortAddCrossVmProgressEvent
CldiPortCheckAllSystemsGo
CldiPortInsertSyncRootNoLock
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessFilterControl
CldiPortProcessGetRangeInfo
CldiPortProcessGlobal
CldiPortProcessQueryProgress
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransfer
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamProcessPendingHydrationRequests
CldiStreamRestartCountdownTimer
CldiStreamServiceHydrationRequest
CldiStreamStopCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncReferenceRoot
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CldiSyncTransferOrAckData
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmDriverEntry
HsmExpandKernelStackAndCallout
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFileCacheMapData
HsmFltInstanceQueryTeardown
HsmFltPostLOCK_CONTROL
HsmFltPostSetRenameInformation
HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION
HsmFltPreCLEANUP
HsmFltPreDIRECTORY_CONTROL
HsmFltPreFILE_SYSTEM_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltPreREAD
HsmFltPreSET_EA
HsmFltPreSET_INFORMATION
HsmFltPreSET_PURGE_FAILURE_MODE
HsmFltPreSET_REPARSE_POINT
HsmFltPreSET_REPARSE_POINT_EX
HsmFltPreSET_ZERO_DATA
HsmFltPreSetBasicInformation
HsmFltPreSetDispositionInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltPreWRITE
HsmFltProcessClearInSync
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessGetCorrelationVector
HsmFltProcessGetLastSyncStatus
HsmFltProcessHSMControl
HsmFltProcessHydrate
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessQueryStreamKey
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetCorrelationVector
HsmFltProcessSetInSync
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmPreLockControlSynchronous
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapCheckVersion
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALLoadFromDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapNORMALVerifyBitmapPages
HsmiBitmapNormalDeleteStream
HsmiBitmapNormalOpenStream
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByFileObjectDeprecated
HsmiCldGetSyncRootInfoByPath
HsmiCldGetSyncRootInfoDeprecated
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompleteLockCallbackDataRoutine
HsmiCompressBuffer
HsmiCreateAllocateECPTags
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiExpandBitmapNoLock
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiFileCacheWriteCompletion
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiInfoRecallForRenameCompletion
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiIsUnsupportedLogfilePlaceholder
HsmiMarkFileRangeNoLock
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpInheritPinStatePre
HsmiOpPrepareOperation
HsmiOpRevertCompletion
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOpenFile
HsmiPrepareBitmapCommit
HsmiProcessPropertyLockRequestList
HsmiPropertyLockWait
HsmiQueryFileRangeNoLock
HsmiQueryFileRangesTotalNoLock
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallAllocatePopulationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmiRecallWriteFileNoLock
HsmiRpInitializeTable
HsmiUpdateFileAttributes
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpAccessCheckByFileId
HsmpAcquireFileNameLock
HsmpAcquireSyncOpRundownProtection
HsmpAcquireUserRequestRundownProtection
HsmpBitmapCreateSnapshot
HsmpBitmapGetRangeState
HsmpBitmapIsReparseBufferSupported
HsmpBitmapQueryRange
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo
HsmpCldIsHydrationDisallowed
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpCtxGetOrCreateFileContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpFileCacheSetFileSize
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpLoadPropertyStream
HsmpMarkHandleUsnSourceInfo
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpProcessQueryRangeStateHelper
HsmpQueryLastEffectiveUsn
HsmpQueryModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpBuildBuffer
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpRpValidateBuffer
HsmpRpiDecompressBuffer
HsmpSetCompressionNoLock
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpSetupContexts
HsmpToggleFileAttributes
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
HsmpUpdateLastAccessTime
HsmpValidateAttributionEcp
HsmpValidateStreamContextNoLock
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
| |paramcount|1|1| |address|140003da0|140003da0| |sig|undefined __fastcall HsmDbgBreakOnStatus(int param_1)|undefined __fastcall HsmDbgBreakOnStatus(int param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| Generated with `ghidriff` version: 1.0.0 on 2026-08-16T21:12:28