# cldflt-2026-08.sys-cldflt-2026-09.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [CldiIsStreamListEmpty](#cldiisstreamlistempty) * [Feature_3750208824__private_IsEnabledDeviceUsageNoInline](#feature_3750208824__private_isenableddeviceusagenoinline) * [Feature_3750208824__private_IsEnabledFallback](#feature_3750208824__private_isenabledfallback) * [Feature_544180536__private_IsEnabledDeviceUsageNoInline](#feature_544180536__private_isenableddeviceusagenoinline) * [Feature_544180536__private_IsEnabledFallback](#feature_544180536__private_isenabledfallback) * [Feature_1245077819__private_IsEnabledDeviceUsageNoInline](#feature_1245077819__private_isenableddeviceusagenoinline) * [Feature_1245077819__private_IsEnabledFallback](#feature_1245077819__private_isenabledfallback) * [CldSyncUnregisterStream](#cldsyncunregisterstream) * [Modified](#modified) * [WPP_SF_qqsDd](#wpp_sf_qqsdd) * [HsmpOpCreatePlaceholders](#hsmpopcreateplaceholders) * [CldStreamReportProgress](#cldstreamreportprogress) * [CldiStreamStartCountdownTimer](#cldistreamstartcountdowntimer) * [WPP_SF_iqiiqd](#wpp_sf_iqiiqd) * [CldStreamHasPendingRequests](#cldstreamhaspendingrequests) * [CldiStreamCompleteRequest](#cldistreamcompleterequest) * [CldStreamClose](#cldstreamclose) * [CldStreamAbortOperation](#cldstreamabortoperation) * [Modified (No Code Changes)](#modified-no-code-changes) * [TlmWriteFltTimeout](#tlmwriteflttimeout) * [NTOSKRNL.EXE::KeEnterCriticalRegion](#ntoskrnlexekeentercriticalregion) * [CldiStreamPrepareRequestForNonCdqCompletion](#cldistreampreparerequestfornoncdqcompletion) * [NTOSKRNL.EXE::ObfDereferenceObject](#ntoskrnlexeobfdereferenceobject) * [NTOSKRNL.EXE::ExReleaseResourceLite](#ntoskrnlexeexreleaseresourcelite) * [HsmDbgBreakOnTimeOut](#hsmdbgbreakontimeout) * [FLTMGR.SYS::FltCancelIo](#fltmgrsysfltcancelio) * [NTOSKRNL.EXE::KeLeaveCriticalRegion](#ntoskrnlexekeleavecriticalregion) * [NTOSKRNL.EXE::ExAcquireResourceExclusiveLite](#ntoskrnlexeexacquireresourceexclusivelite) * [FLTMGR.SYS::FltClose](#fltmgrsysfltclose) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [HsmpAccessCheck](#hsmpaccesscheck) * [FLTMGR.SYS::FltCreateFileEx](#fltmgrsysfltcreatefileex) * [CldiStreamCdqRELEASE](#cldistreamcdqrelease) * [CldiStreamCdqACQUIRE](#cldistreamcdqacquire) * [CldiStreamInsertIntoGlobalRequestListNoLock](#cldistreaminsertintoglobalrequestlistnolock) * [WPP_SF_qid](#wpp_sf_qid) * [CldiCanDoNonCdqCompletion](#cldicandononcdqcompletion) * [CldiStreamCompleteCanceledRequest](#cldistreamcompletecanceledrequest) * [CldiStreamRemoveFromGlobalRequestListNoLock](#cldistreamremovefromglobalrequestlistnolock) * [HsmDbgBreakOnStatus](#hsmdbgbreakonstatus) * [CldiStreamIsRequestExpired](#cldistreamisrequestexpired) # Visual Chart Diff ```mermaid flowchart LR WPP_SF_qqsDd-6-old<--Match 97%-->WPP_SF_qqsDd-6-new HsmpOpCreatePlaceholders-6-old<--Match 96%-->HsmpOpCreatePlaceholders-6-new CldStreamReportProgress-6-old<--Match 57%-->CldStreamReportProgress-6-new CldiStreamStartCountdownTimer-3-old<--Match 47%-->CldiStreamStartCountdownTimer-3-new WPP_SF_iqiiqd-4-old<--Match 95%-->WPP_SF_iqiiqd-4-new CldStreamHasPendingRequests-1-old<--Match 63%-->CldStreamHasPendingRequests-1-new CldiStreamCompleteRequest-4-old<--Match 91%-->CldiStreamCompleteRequest-4-new CldStreamClose-1-old<--Match 39%-->CldStreamClose-1-new CldStreamAbortOperation-3-old<--Match 96%-->CldStreamAbortOperation-3-new subgraph cldflt-2026-09.sys WPP_SF_qqsDd-6-new HsmpOpCreatePlaceholders-6-new CldStreamReportProgress-6-new CldiStreamStartCountdownTimer-3-new WPP_SF_iqiiqd-4-new CldStreamHasPendingRequests-1-new CldiStreamCompleteRequest-4-new CldStreamClose-1-new CldStreamAbortOperation-3-new subgraph Added direction LR CldiIsStreamListEmpty Feature_3750208824__private_IsEnabledDeviceUsageNoInline Feature_3750208824__private_IsEnabledFallback Feature_544180536__private_IsEnabledDeviceUsageNoInline Feature_544180536__private_IsEnabledFallback Feature_1245077819__private_IsEnabledDeviceUsageNoInline Feature_1245077819__private_IsEnabledFallback CldSyncUnregisterStream end end subgraph cldflt-2026-08.sys WPP_SF_qqsDd-6-old HsmpOpCreatePlaceholders-6-old CldStreamReportProgress-6-old CldiStreamStartCountdownTimer-3-old WPP_SF_iqiiqd-4-old CldStreamHasPendingRequests-1-old CldiStreamCompleteRequest-4-old CldStreamClose-1-old CldStreamAbortOperation-3-old end ``` ```mermaid pie showData title Function Matches - 99.7268% "unmatched_funcs_len" : 8 "matched_funcs_len" : 2920 ``` ```mermaid pie showData title Matched Function Similarity - 98.9384% "matched_funcs_with_code_changes_len" : 9 "matched_funcs_with_non_code_changes_len" : 22 "matched_funcs_no_changes_len" : 2889 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 cldflt-2026-08.sys cldflt-2026-09.sys ``` #### Verbose Args
``` --old ['cldflt-2026-08.sys'] --new [['cldflt-2026-09.sys']] --engine VersionTrackingDiff --output-path ghidriffs --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/cldflt.sys/4DAC1EB794000/cldflt.sys -O cldflt.sys.x64.10.0.26100.9278 wget https://msdl.microsoft.com/download/symbols/cldflt.sys/CD2CECD294000/cldflt.sys -O cldflt.sys.x64.10.0.26100.9444 ``` ## Binary Metadata Diff ```diff --- cldflt-2026-08.sys Meta +++ cldflt-2026-09.sys Meta @@ -1,44 +1,44 @@ -Program Name: cldflt-2026-08.sys +Program Name: cldflt-2026-09.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 611040 +# of Bytes: 611064 # of Memory Blocks: 14 -# of Instructions: 112416 -# of Defined Data: 7925 -# of Functions: 1460 -# of Symbols: 16213 +# of Instructions: 112688 +# of Defined Data: 7969 +# of Functions: 1468 +# of Symbols: 16252 # of Data Types: 201 # of Data Type Categories: 13 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Wed Sep 09 18:13:57 SGT 2026 +Date Created: Wed Sep 09 18:14:04 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/cldflt-2026-08.sys -Executable MD5: 0d0ec28c794e1de0148adcb774032c89 -Executable SHA256: 6084c66824fd2bc5fb0b1601affdd5e8119a5d76df181d0c12f97e2033ad8862 -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/cldflt-2026-08.sys?MD5=0d0ec28c794e1de0148adcb774032c89 +Executable Location: /C:/Users/Jacob/Downloads/pdbs/cldflt-2026-09.sys +Executable MD5: 5ea4161782ac33adde4f868c40c2ca21 +Executable SHA256: d108428a0541913751507f5f91da3f5837217f2cd65f6bebdcd52fcac6baf292 +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/cldflt-2026-09.sys?MD5=5ea4161782ac33adde4f868c40c2ca21 PDB Age: 1 PDB File: cldflt.pdb -PDB GUID: bdf2117d-9d70-8c0c-9779-940316490276 +PDB GUID: 1ee01f06-2a4e-3ef2-f5d3-6571a1ea7395 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Cloud Files Mini Filter Driver -PE Property[FileVersion]: 10.0.26100.9278 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.9444 (WinBuild.160101.0800) PE Property[InternalName]: cldflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: cldflt.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.9278 +PE Property[ProductVersion]: 10.0.26100.9444 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra cldflt-2026-08.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra cldflt-2026-08.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra cldflt-2026-08.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra cldflt-2026-09.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra cldflt-2026-09.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra cldflt-2026-09.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|8| |deleted_funcs_len|0| |modified_funcs_len|31| |added_symbols_len|11| |deleted_symbols_len|2| |diff_time|16.519275903701782| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1459, 'ExternalsName': 342})| |items_to_process|52| |diff_types|Counter({'refcount': 22, 'address': 17, 'calling': 11, 'code': 9, 'length': 9, 'called': 7, 'sig': 1})| |unmatched_funcs_len|8| |total_funcs_len|2928| |matched_funcs_len|2920| |matched_funcs_with_code_changes_len|9| |matched_funcs_with_non_code_changes_len|22| |matched_funcs_no_changes_len|2889| |match_func_similarity_percent|98.9384%| |func_match_overall_percent|99.7268%| |first_matches|Counter({'SymbolsHash': 1459})| ```mermaid pie showData title All Matches "SymbolsHash" : 1459 "ExternalsName" : 342 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1459 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 8 "deleted_funcs_len" : 0 "modified_funcs_len" : 31 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 11 "deleted_symbols_len" : 2 ``` ## Strings *No string differences found* # Deleted # Added ## CldiIsStreamListEmpty ### Function Meta |Key|cldflt-2026-09.sys| | :---: | :---: | |name|CldiIsStreamListEmpty| |fullname|CldiIsStreamListEmpty| |refcount|4| |length|30| |called|| |calling|CldStreamHasPendingRequests
CldStreamReportProgress
CldiStreamCompleteRequest| |paramcount|1| |address|140011090| |sig|undefined1 __fastcall CldiIsStreamListEmpty(longlong param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- CldiIsStreamListEmpty +++ CldiIsStreamListEmpty @@ -0,0 +1,17 @@ + +undefined1 CldiIsStreamListEmpty(longlong param_1) + +{ + undefined8 *puVar1; + + puVar1 = *(undefined8 **)(param_1 + 0x10); + while( true ) { + if (puVar1 == (undefined8 *)(param_1 + 0x10)) { + return 1; + } + if (*(short *)(puVar1 + -1) != 0) break; + puVar1 = (undefined8 *)*puVar1; + } + return 0; +} + ``` ## Feature_3750208824__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|cldflt-2026-09.sys| | :---: | :---: | |name|Feature_3750208824__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3750208824__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_3750208824__private_IsEnabledFallback| |calling|CldiStreamStartCountdownTimer| |paramcount|0| |address|140011248| |sig|ulonglong __fastcall Feature_3750208824__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3750208824__private_IsEnabledDeviceUsageNoInline +++ Feature_3750208824__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3750208824__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3750208824__private_featureState; + if ((Feature_3750208824__private_featureState & 0x10) == 0) { + uVar1 = Feature_3750208824__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3750208824__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3750208824__private_IsEnabledFallback ### Function Meta |Key|cldflt-2026-09.sys| | :---: | :---: | |name|Feature_3750208824__private_IsEnabledFallback| |fullname|Feature_3750208824__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3750208824__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140011280| |sig|undefined __fastcall Feature_3750208824__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3750208824__private_IsEnabledFallback +++ Feature_3750208824__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3750208824__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3750208824__private_descriptor); + return; +} + ``` ## Feature_544180536__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|cldflt-2026-09.sys| | :---: | :---: | |name|Feature_544180536__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_544180536__private_IsEnabledDeviceUsageNoInline| |refcount|7| |length|49| |called|Feature_544180536__private_IsEnabledFallback| |calling|CldStreamAbortOperation
CldStreamClose
CldStreamHasPendingRequests
CldStreamReportProgress
CldiStreamCompleteRequest| |paramcount|0| |address|14001129c| |sig|ulonglong __fastcall Feature_544180536__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_544180536__private_IsEnabledDeviceUsageNoInline +++ Feature_544180536__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_544180536__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_544180536__private_featureState; + if ((Feature_544180536__private_featureState & 0x10) == 0) { + uVar1 = Feature_544180536__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_544180536__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_544180536__private_IsEnabledFallback ### Function Meta |Key|cldflt-2026-09.sys| | :---: | :---: | |name|Feature_544180536__private_IsEnabledFallback| |fullname|Feature_544180536__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_544180536__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400112d4| |sig|undefined __fastcall Feature_544180536__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_544180536__private_IsEnabledFallback +++ Feature_544180536__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_544180536__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_544180536__private_descriptor); + return; +} + ``` ## Feature_1245077819__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|cldflt-2026-09.sys| | :---: | :---: | |name|Feature_1245077819__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1245077819__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_1245077819__private_IsEnabledFallback| |calling|HsmpOpCreatePlaceholders| |paramcount|0| |address|14001ddd4| |sig|ulonglong __fastcall Feature_1245077819__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1245077819__private_IsEnabledDeviceUsageNoInline +++ Feature_1245077819__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_1245077819__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_1245077819__private_featureState; + if ((Feature_1245077819__private_featureState & 0x10) == 0) { + uVar1 = Feature_1245077819__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_1245077819__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_1245077819__private_IsEnabledFallback ### Function Meta |Key|cldflt-2026-09.sys| | :---: | :---: | |name|Feature_1245077819__private_IsEnabledFallback| |fullname|Feature_1245077819__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1245077819__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|14001de0c| |sig|undefined __fastcall Feature_1245077819__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1245077819__private_IsEnabledFallback +++ Feature_1245077819__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1245077819__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1245077819__private_descriptor); + return; +} + ``` ## CldSyncUnregisterStream ### Function Meta |Key|cldflt-2026-09.sys| | :---: | :---: | |name|CldSyncUnregisterStream| |fullname|CldSyncUnregisterStream| |refcount|2| |length|330| |called|FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltReleasePushLockEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl| |calling|CldStreamClose| |paramcount|2| |address|1400711c0| |sig|undefined __fastcall CldSyncUnregisterStream(longlong param_1, undefined8 param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- CldSyncUnregisterStream +++ CldSyncUnregisterStream @@ -0,0 +1,41 @@ + +void CldSyncUnregisterStream(longlong param_1,undefined8 param_2) + +{ + longlong lVar1; + undefined8 *puVar2; + longlong lVar3; + undefined8 *puVar4; + undefined8 local_res10; + + lVar1 = param_1 + 0x68; + local_res10 = param_2; + FltAcquirePushLockExclusiveEx(lVar1,0); + lVar3 = RtlLookupElementGenericTableAvl(param_1 + 0x70,&local_res10); + puVar4 = (undefined8 *)0x0; + if ((lVar3 != 0) && (puVar2 = *(undefined8 **)(lVar3 + 8), puVar2 != (undefined8 *)0x0)) { + *(undefined8 *)(lVar3 + 8) = 0; + puVar4 = puVar2; + } + FltReleasePushLockEx(lVar1,0); + if (lVar3 != 0) { + ExWaitForRundownProtectionRelease(lVar3 + 0x10); + if ((*(uint *)(*(longlong *)*puVar4 + 0x1c) & 2) == 0) { + if (*(longlong *)(lVar3 + 0x40) != 0) { + ExFreePoolWithTag(*(longlong *)(lVar3 + 0x40),0x6d726c43); + } + if (*(longlong *)(lVar3 + 0x50) != 0) { + ExFreePoolWithTag(*(longlong *)(lVar3 + 0x50),0x6d726c43); + } + FsRtlUninitializeBaseMcb(lVar3 + 0x20); + } + else if (*(longlong *)(lVar3 + 0x30) != 0) { + ExFreePoolWithTag(*(longlong *)(lVar3 + 0x30),0x73557348); + } + FltAcquirePushLockExclusiveEx(lVar1,0); + RtlDeleteElementGenericTableAvl(param_1 + 0x70,&local_res10); + FltReleasePushLockEx(lVar1,0); + } + return; +} + ``` # Modified *Modified functions contain code changes* ## WPP_SF_qqsDd ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.96| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|WPP_SF_qqsDd|WPP_SF_qqsDd| |fullname|WPP_SF_qqsDd|WPP_SF_qqsDd| |refcount|2|2| |`length`|199|201| |called|_guard_dispatch_icall|_guard_dispatch_icall| |calling|QueryIfEAExists|QueryIfEAExists| |paramcount|6|6| |`address`|14001e110|14001e244| |sig|undefined __fastcall WPP_SF_qqsDd(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, char * param_6)|undefined __fastcall WPP_SF_qqsDd(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, char * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_qqsDd Diff ```diff --- WPP_SF_qqsDd +++ WPP_SF_qqsDd @@ -1,34 +1,34 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void WPP_SF_qqsDd(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4, undefined8 param_5,char *param_6) { longlong lVar1; longlong lVar2; char *pcVar3; undefined8 local_res20; if (param_6 == (char *)0x0) { lVar2 = 5; } else { lVar1 = -1; do { lVar2 = lVar1; lVar1 = lVar2 + 1; } while (param_6[lVar1] != '\0'); lVar2 = lVar2 + 2; } pcVar3 = param_6; if (param_6 == (char *)0x0) { pcVar3 = "NULL"; } local_res20 = param_4; (*pfnWppTraceMessage) - (param_1,0x2b,&WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids,0x84,&local_res20,8, + (param_1,0x2b,&WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids,0x85,&local_res20,8, ¶m_5,8,pcVar3,lVar2,&stack0x00000038,4,&stack0x00000040,4,0); return; } ``` ## HsmpOpCreatePlaceholders ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.49| |i_ratio|0.48| |m_ratio|0.97| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|HsmpOpCreatePlaceholders|HsmpOpCreatePlaceholders| |fullname|HsmpOpCreatePlaceholders|HsmpOpCreatePlaceholders| |refcount|3|3| |`length`|4736|5056| |`called`|
Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltSetInformationFile
HsmDbgBreakOnStatus
HsmpAccessCheckHsmpMarkHandleUsnSourceInfo
HsmpQueryLastEffectiveUsn
HsmpRpBuildBuffer
HsmpRpCreate
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpToggleFileSparseAttribute
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ProbeForWrite
TlmWriteAccessDeniedForAddSubDirectory
WPP_SF_id
WPP_SF_qid
WPP_SF_qqdd
__security_check_cookie
memmove
memset
|
Expand for full list:
FLTMGR.SYS::FltAllocateExtraCreateParameterFromLookasideList
FLTMGR.SYS::FltAllocateExtraCreateParameterList
FLTMGR.SYS::FltClose
FLTMGR.SYS::FltCreateFileEx
FLTMGR.SYS::FltCreateFileEx2
FLTMGR.SYS::FltFreeExtraCreateParameterList
FLTMGR.SYS::FltInsertExtraCreateParameter
FLTMGR.SYS::FltQueryInformationFile
FLTMGR.SYS::FltSetInformationFile
Feature_1245077819__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatusHsmpAccessCheck
HsmpMarkHandleUsnSourceInfo
HsmpQueryLastEffectiveUsn
HsmpRpBuildBuffer
HsmpRpCreate
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpToggleFileSparseAttribute
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ProbeForWrite
TlmWriteAccessDeniedForAddSubDirectory
WPP_SF_id
WPP_SF_qid
WPP_SF_qqdd
__security_check_cookie
memmove
memset
| |calling|HsmFltProcessCreatePlaceholders
HsmRecallTransferPlaceholders|HsmFltProcessCreatePlaceholders
HsmRecallTransferPlaceholders| |paramcount|6|6| |`address`|14005d724|14005d8c4| |sig|uint __fastcall HsmpOpCreatePlaceholders(longlong param_1, undefined8 param_2, uint param_3, void * param_4, uint param_5, int * param_6)|uint __fastcall HsmpOpCreatePlaceholders(longlong param_1, undefined8 param_2, uint param_3, void * param_4, uint param_5, int * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### HsmpOpCreatePlaceholders Called Diff ```diff --- HsmpOpCreatePlaceholders called +++ HsmpOpCreatePlaceholders called @@ -9,0 +10 @@ +Feature_1245077819__private_IsEnabledDeviceUsageNoInline ``` ### HsmpOpCreatePlaceholders Diff ```diff --- HsmpOpCreatePlaceholders +++ HsmpOpCreatePlaceholders @@ -1,594 +1,633 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Removing unreachable block (ram,0x00014005e70f) */ -/* WARNING: Removing unreachable block (ram,0x00014005e713) */ -/* WARNING: Removing unreachable block (ram,0x00014005e727) */ +/* WARNING: Removing unreachable block (ram,0x00014005e9ef) */ +/* WARNING: Removing unreachable block (ram,0x00014005e9f3) */ +/* WARNING: Removing unreachable block (ram,0x00014005ea07) */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ uint HsmpOpCreatePlaceholders (longlong param_1,undefined8 param_2,uint param_3,void *param_4,uint param_5, int *param_6) { undefined1 (*pauVar1) [16]; undefined1 (*pauVar2) [16]; ushort uVar3; ulonglong uVar4; - ulonglong uVar5; - ulonglong uVar6; - uint uVar7; + bool bVar5; + bool bVar6; + ulonglong uVar7; uint uVar8; + uint uVar9; void *_Dst; - ushort uVar9; - ushort uVar10; - uint uVar11; - ulonglong uVar12; - undefined8 uVar13; - undefined2 uVar14; - undefined1 (*pauVar15) [16]; - uint uVar16; - uint uVar17; - longlong ****pppplVar18; - bool bVar19; - undefined1 auStackY_268 [32]; - undefined1 (*local_1e8) [16]; - uint local_1d0; - int local_1cc; + ulonglong uVar10; + ushort uVar11; + ushort uVar12; + uint uVar13; + ulonglong uVar14; + undefined8 uVar15; + undefined2 uVar16; + undefined1 (*pauVar17) [16]; + uint uVar18; + longlong ****pppplVar19; + undefined1 auStackY_288 [32]; + undefined1 (*local_200) [16]; + uint local_1e8; + int local_1e4; + uint local_1d8; uint local_1b4; - uint local_1a4; - uint *local_188; + undefined1 (*local_1a8) [16]; + uint *local_1a0; + longlong **local_198; + longlong local_190; + undefined1 (*local_188) [16]; longlong **local_180; - longlong local_178; - uint local_170; - undefined1 (*local_168) [16]; - undefined8 local_160; + uint local_178; + undefined8 local_170; + undefined8 local_168; + longlong local_160; undefined8 local_158; - longlong local_150; + undefined1 *puStack_150; undefined8 local_148; - undefined1 *puStack_140; + longlong lStack_140; undefined8 local_138; - longlong lStack_130; - undefined8 local_128; - undefined8 uStack_120; - ulonglong local_118; - int *local_110; - ulonglong local_108; + undefined8 uStack_130; + ulonglong local_128; + undefined8 local_120; + undefined8 uStack_118; + undefined8 *local_110; + undefined8 uStack_108; undefined8 local_100; - undefined8 uStack_f8; - undefined8 *local_f0; - undefined8 uStack_e8; + ulonglong uStack_f8; + int *local_f0; + ulonglong local_e8; undefined8 local_e0; - ulonglong uStack_d8; + undefined8 uStack_d8; undefined8 local_d0; undefined8 uStack_c8; undefined1 local_b8 [16]; longlong **local_a8; undefined8 uStack_a0; undefined8 local_98; undefined8 uStack_90; ulonglong local_88; longlong ***ppplStack_80; undefined8 local_78; undefined8 uStack_70; longlong **local_68; undefined8 uStack_60; undefined8 local_58; undefined8 uStack_50; undefined8 local_48; ulonglong local_40; - local_40 = __security_cookie ^ (ulonglong)auStackY_268; - local_108 = (ulonglong)param_5; - local_170 = param_5; - local_110 = param_6; + local_40 = __security_cookie ^ (ulonglong)auStackY_288; + local_e8 = (ulonglong)param_5; + local_178 = param_5; + local_f0 = param_6; pauVar2 = *(undefined1 (**) [16])(param_1 + 0x20); - uVar11 = 0; - local_160 = 0; - local_1cc = 0; - local_180 = (longlong **)0x0; - local_1b4 = 0; - local_168 = (undefined1 (*) [16])0x0; + local_170 = 0; + local_1e4 = 0; + local_198 = (longlong **)0x0; + local_1d8 = 0; + local_188 = (undefined1 (*) [16])0x0; + local_148 = 0; + lStack_140 = 0; local_138 = 0; - lStack_130 = 0; - local_128 = 0; - uStack_120 = 0; - local_118 = local_118 & 0xffffffffffff0000; - local_188 = (uint *)0x0; - local_178 = 0; - local_158 = param_2; - local_150 = param_1; + uStack_130 = 0; + local_128 = local_128 & 0xffffffffffff0000; + local_1a0 = (uint *)0x0; + local_190 = 0; + local_168 = param_2; + local_160 = param_1; _Dst = (void *)ExAllocatePool2(0x102,param_5,0x70537348); if (_Dst == (void *)0x0) { HsmDbgBreakOnStatus(-0x3fffff66); - uVar7 = 0xc000009a; + uVar8 = 0xc000009a; if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - (uVar7 = 0xc000009a, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || + (uVar8 = 0xc000009a, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar14 = 0x61; + uVar16 = 0x61; } else { ProbeForWrite(param_4,(ulonglong)param_5,4); memmove(_Dst,param_4,(ulonglong)param_5); - local_188 = (uint *)ExAllocatePool2(0x100,0x4000,0x70527348); - if (local_188 != (uint *)0x0) { - uVar7 = FltAllocateExtraCreateParameterList(DAT_1,0,&local_178); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + local_1a0 = (uint *)ExAllocatePool2(0x100,0x4000,0x70527348); + if (local_1a0 != (uint *)0x0) { + uVar8 = FltAllocateExtraCreateParameterList(DAT_1,0,&local_190); + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar14 = 100; - uVar13 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + uVar16 = 100; + uVar15 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); } else { - uVar7 = FltAllocateExtraCreateParameterFromLookasideList + uVar8 = FltAllocateExtraCreateParameterFromLookasideList (DAT_1,&GUID_ECP_ATOMIC_CREATE,0x58); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar14 = 0x65; + uVar16 = 0x65; } else { - FltInsertExtraCreateParameter(DAT_1,local_178,0); - uVar7 = ObReferenceObjectByHandle(param_2,0,*(undefined8 *)IoFileObjectType_exref,0); - HsmDbgBreakOnStatus(uVar7); - if (-1 < (int)uVar7) { - uVar16 = 0; + FltInsertExtraCreateParameter(DAT_1,local_190,0); + uVar8 = ObReferenceObjectByHandle(param_2,0,*(undefined8 *)IoFileObjectType_exref,0); + HsmDbgBreakOnStatus(uVar8); + if (-1 < (int)uVar8) { + uVar18 = 0; do { - local_1e8 = (undefined1 (*) [16])0x0; - pppplVar18 = (longlong ****)0x50; + local_200 = (undefined1 (*) [16])0x0; + pppplVar19 = (longlong ****)0x50; memset(local_b8,0,0x50); - pauVar1 = (undefined1 (*) [16])((longlong)_Dst + (ulonglong)local_1b4); - local_148 = 0; - puStack_140 = (undefined1 *)0x0; + pauVar1 = (undefined1 (*) [16])((longlong)_Dst + (ulonglong)local_1d8); + local_158 = 0; + puStack_150 = (undefined1 *)0x0; + local_120 = 0; + uStack_118 = 0; + local_110 = (undefined8 *)0x0; + uStack_108 = 0; local_100 = 0; - uStack_f8 = 0; - local_f0 = (undefined8 *)0x0; - uStack_e8 = 0; + uStack_f8 = uStack_f8 & 0xffffffff00000000; local_e0 = 0; - uStack_d8 = uStack_d8 & 0xffffffff00000000; - local_d0 = 0; - uStack_c8 = 0; + uStack_d8 = 0; local_68 = (longlong **)0x0; uStack_60 = 0; local_58 = 0; uStack_50 = 0; local_48 = 0; - bVar19 = true; - uVar7 = local_170 - local_1b4; - pauVar15 = (undefined1 (*) [16])(ulonglong)uVar7; - if (uVar7 < 0x50) { - uVar7 = 0xc000cf0b; + bVar6 = true; + uVar8 = local_178 - local_1d8; + pauVar17 = (undefined1 (*) [16])(ulonglong)uVar8; + if (uVar8 < 0x50) { + uVar8 = 0xc000cf0b; HsmDbgBreakOnStatus(-0x3fff30f5); - uVar11 = ~-(uint)(local_1cc != 0) & 0xc000cf0b; - uVar17 = uVar11; + uVar13 = ~-(uint)(local_1e4 != 0) & 0xc000cf0b; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x67; + pauVar17 = (undefined1 (*) [16])0x67; LAB_2: - uVar13 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + uVar15 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); LAB_3: - uVar7 = 0xc000cf0b; - pppplVar18 = (longlong ****)&WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids; - WPP_SF_qid(uVar13,(short)pauVar15,&WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids + uVar8 = 0xc000cf0b; + pppplVar19 = (longlong ****)&WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids; + WPP_SF_qid(uVar15,(short)pauVar17,&WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids ,param_1); - uVar17 = uVar11; } break; } local_b8 = *pauVar1; local_a8 = *(longlong ***)pauVar1[1]; uStack_a0 = *(undefined8 *)(pauVar1[1] + 8); local_98 = *(undefined8 *)pauVar1[2]; uStack_90 = *(undefined8 *)(pauVar1[2] + 8); local_88 = *(ulonglong *)pauVar1[3]; ppplStack_80 = *(longlong ****)(pauVar1[3] + 8); local_78 = *(undefined8 *)pauVar1[4]; uStack_70 = *(undefined8 *)(pauVar1[4] + 8); - pppplVar18 = (longlong ****)(local_b8._8_8_ >> 0x20 & 0xffff); - uVar17 = (uint)pppplVar18; + pppplVar19 = (longlong ****)(local_b8._8_8_ >> 0x20 & 0xffff); + uVar13 = (uint)pppplVar19; uVar3 = local_b8._14_2_; - uVar9 = local_b8._10_2_; - uVar10 = local_b8._8_2_; - uVar8 = uVar17 + uVar3; - if (uVar17 + uVar3 < (uint)uVar10 + (uint)uVar9) { - uVar8 = (uint)uVar10 + (uint)uVar9; - } - if (((uVar7 < uVar10) || (uVar7 - uVar10 < (uint)uVar9)) || - ((uVar7 < uVar17 || ((uVar7 - uVar17 < (uint)uVar3 || (0x1000 < uVar3)))))) { + uVar11 = local_b8._10_2_; + uVar12 = local_b8._8_2_; + uVar9 = uVar13 + uVar3; + if (uVar13 + uVar3 < (uint)uVar12 + (uint)uVar11) { + uVar9 = (uint)uVar12 + (uint)uVar11; + } + if (((uVar8 < uVar12) || (uVar8 - uVar12 < (uint)uVar11)) || + ((uVar8 < uVar13 || ((uVar8 - uVar13 < (uint)uVar3 || (0x1000 < uVar3)))))) { LAB_4: - uVar7 = 0xc000cf0b; + uVar8 = 0xc000cf0b; HsmDbgBreakOnStatus(-0x3fff30f5); - uVar11 = ~-(uint)(local_1cc != 0) & 0xc000cf0b; - uVar17 = uVar11; + uVar13 = ~-(uint)(local_1e4 != 0) & 0xc000cf0b; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0 && (1 < (byte)WPP_GLOBAL_Control[0x29])))) { - pauVar15 = (undefined1 (*) [16])0x68; - uVar13 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + pauVar17 = (undefined1 (*) [16])0x68; + uVar15 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); goto LAB_3; } break; } - pppplVar18 = (longlong ****)(ulonglong)(uint)local_b8._0_4_; + pppplVar19 = (longlong ****)(ulonglong)(uint)local_b8._0_4_; if ((local_b8._0_4_ != 0) && - (((uint)local_b8._0_4_ < uVar8 || (uVar7 < (uint)local_b8._0_4_)))) + (((uint)local_b8._0_4_ < uVar9 || (uVar8 < (uint)local_b8._0_4_)))) goto LAB_4; - pauVar15 = (undefined1 (*) [16])(*pauVar1 + uVar10); - uVar10 = 0; - uVar17 = uVar16; - if (uVar9 >> 1 != 0) { + pauVar17 = (undefined1 (*) [16])(*pauVar1 + uVar12); + uVar12 = 0; + uVar13 = uVar18; + if (uVar11 >> 1 != 0) { do { - if ((*(short *)(*pauVar15 + (ulonglong)uVar10 * 2) == 0x5c) || - (*(short *)(*pauVar15 + (ulonglong)uVar10 * 2) == 0x3a)) { - uVar7 = 0xc000cf0b; + if ((*(short *)(*pauVar17 + (ulonglong)uVar12 * 2) == 0x5c) || + (*(short *)(*pauVar17 + (ulonglong)uVar12 * 2) == 0x3a)) { + uVar8 = 0xc000cf0b; HsmDbgBreakOnStatus(-0x3fff30f5); if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0 || ((byte)WPP_GLOBAL_Control[0x29] < 2)))) goto LAB_5; - pauVar15 = (undefined1 (*) [16])0x69; + pauVar17 = (undefined1 (*) [16])0x69; goto LAB_6; } - uVar10 = uVar10 + 1; - } while (uVar10 < uVar9 >> 1); + uVar12 = uVar12 + 1; + } while (uVar12 < uVar11 >> 1); } if ((local_b8._0_4_ & 3) != 0) { HsmDbgBreakOnStatus(-0x3fff30f5); - uVar7 = 0xc000cf0b; + uVar8 = 0xc000cf0b; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (uVar7 = 0xc000cf0b, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && + (uVar8 = 0xc000cf0b, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x6a; + pauVar17 = (undefined1 (*) [16])0x6a; + uVar13 = 0; goto LAB_2; } break; } + uVar10 = local_88 & 0x10; uVar4 = local_88 & 0x10; - uVar5 = local_88 & 0x10; - uVar6 = local_88 & 0x10; + uVar7 = local_88 & 0x10; if (((((local_88 & 0x10) == 0) && ((param_3 & 2) == 0)) && ((longlong ****)ppplStack_80 != (longlong ****)0x0)) || ((((local_88 & 0x10) != 0 && ((param_3 & 4) == 0)) && ((local_b8[4] & 0x40) == 0))) ) { HsmDbgBreakOnStatus(-0x3fff30f5); - uVar7 = 0xc000cf0b; + uVar8 = 0xc000cf0b; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (uVar7 = 0xc000cf0b, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && + (uVar8 = 0xc000cf0b, (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x6b; + pauVar17 = (undefined1 (*) [16])0x6b; LAB_6: - uVar7 = 0xc000cf0b; + uVar8 = 0xc000cf0b; LAB_7: - pppplVar18 = (longlong ****)&WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids; - WPP_SF_qid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(short)pauVar15, - &WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids,param_1); + pppplVar19 = (longlong ****)&WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids; + WPP_SF_qid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(short)pauVar17, + &WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids,param_1); } } else if (uVar3 == 0) { - uVar7 = 0xc000cf0b; + uVar8 = 0xc000cf0b; HsmDbgBreakOnStatus(-0x3fff30f5); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x6c; + pauVar17 = (undefined1 (*) [16])0x6c; goto LAB_6; } } else { - local_1cc = local_1cc + 1; - uVar12 = (ulonglong)local_78 >> 0x20; - local_78 = CONCAT44((int)uVar12,0xc000cf07); + local_1e4 = local_1e4 + 1; + uVar14 = (ulonglong)local_78 >> 0x20; + local_78 = CONCAT44((int)uVar14,0xc000cf07); uStack_70 = 0; if ((local_88 & 0x10) != 0) { - pppplVar18 = (longlong ****)0x4; - pauVar15 = local_168; - uVar7 = HsmpAccessCheck(param_1,(ulonglong)local_168,4); - uVar12 = (ulonglong)uVar7; - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + pppplVar19 = (longlong ****)0x4; + pauVar17 = local_188; + uVar8 = HsmpAccessCheck(param_1,(ulonglong)local_188,4); + uVar14 = (ulonglong)uVar8; + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (uVar12 = (ulonglong)*(uint *)(WPP_GLOBAL_Control + 0x2c), + (uVar14 = (ulonglong)*(uint *)(WPP_GLOBAL_Control + 0x2c), (*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x6d; - pppplVar18 = (longlong ****)&WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids; - uVar12 = *(ulonglong *)(WPP_GLOBAL_Control + 0x18); - WPP_SF_qid(uVar12,0x6d,&WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids, + pauVar17 = (undefined1 (*) [16])0x6d; + pppplVar19 = (longlong ****)&WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids; + uVar14 = *(ulonglong *)(WPP_GLOBAL_Control + 0x18); + WPP_SF_qid(uVar14,0x6d,&WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids, param_1); } - TlmWriteAccessDeniedForAddSubDirectory(uVar12,pauVar15,pppplVar18); + TlmWriteAccessDeniedForAddSubDirectory(uVar14,pauVar17,pppplVar19); goto LAB_5; } } - local_1a4 = (uint)local_88 | 0x401000; - if (uVar4 == 0) { - local_1d0 = (uint)local_88 >> 9 & 1; + local_1b4 = (uint)local_88 | 0x401000; + if (uVar10 == 0) { + local_1e8 = (uint)local_88 >> 9 & 1; } else { - local_1d0 = 0x10; + local_1e8 = 0x10; if ((local_b8[4] & 0x40) != 0) { - local_1d0 = 0x16; - local_1a4 = (uint)local_88 & 0xffbfefff; + local_1e8 = 0x16; + local_1b4 = (uint)local_88 & 0xffbfefff; } } if ((local_b8[4] & 1) != 0) { - local_1d0 = local_1d0 | 0x40; + local_1e8 = local_1e8 | 0x40; } if ((local_b8._4_4_ & 0x400) != 0) { - local_1d0 = local_1d0 | 0x100; - } - pppplVar18 = (longlong ****)(*pauVar1 + (ushort)local_b8._12_2_); - pauVar15 = (undefined1 (*) [16])(ulonglong)local_1d0; - uVar7 = HsmpRpBuildBuffer(ppplStack_80,local_1d0,pppplVar18,local_b8._14_2_, - local_188); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + local_1e8 = local_1e8 | 0x100; + } + pppplVar19 = (longlong ****)(*pauVar1 + (ushort)local_b8._12_2_); + pauVar17 = (undefined1 (*) [16])(ulonglong)local_1e8; + uVar8 = HsmpRpBuildBuffer(ppplStack_80,local_1e8,pppplVar19,local_b8._14_2_, + local_1a0); + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x6e; + pauVar17 = (undefined1 (*) [16])0x6e; goto LAB_7; } } else { uRam0000000000000000 = 0x58; uRam0000000000000002 = 0x1e32; uRam0000000000000004 = 0; - sRam0000000000000006 = (short)local_188[1] + 8; + sRam0000000000000006 = (short)local_1a0[1] + 8; _DAT_8 = &local_a8; - uRam0000000000000028 = local_1a4; - if (uVar5 == 0) { + uRam0000000000000028 = local_1b4; + if (uVar4 == 0) { if (0 < (longlong)ppplStack_80) { uRam0000000000000002 = 0x1e33; } pppplRam0000000000000010 = (longlong ****)ppplStack_80; pppplRam0000000000000018 = (longlong ****)ppplStack_80; uRam0000000000000002 = uRam0000000000000002 | 0xc; } uRam000000000000002c = 8; - local_128 = 0; - uStack_120 = 0; - local_138 = 0x28; - local_118 = 1; - lStack_130 = local_178; - puStack_140 = *pauVar1 + (ushort)local_b8._8_2_; - local_148._0_4_ = CONCAT22(local_b8._10_2_,local_b8._10_2_); - local_100 = CONCAT44(local_100._4_4_,0x30); - uStack_e8 = CONCAT44(uStack_e8._4_4_,0x240); - local_f0 = &local_148; - local_e0 = 0; - uStack_d8 = 0; - pppplVar18 = (longlong ****)&local_180; - pauVar15 = pauVar2; - uStack_f8 = param_2; - puRam0000000000000008 = local_188; - uVar7 = FltCreateFileEx2(DAT_1); - HsmDbgBreakOnStatus(uVar7); - if ((uVar7 == 0xc0000035) || (uVar7 == 0xc0000279)) { - bVar19 = (local_b8._4_4_ & 0x4000) == 0; - } - if (!bVar19) { - pppplVar18 = (longlong ****)&local_180; - pauVar15 = pauVar2; - uVar7 = FltCreateFileEx(DAT_1); - HsmDbgBreakOnStatus(uVar7); - } - if ((int)uVar7 < 0) { + local_138 = 0; + uStack_130 = 0; + local_148 = 0x28; + local_128 = 1; + lStack_140 = local_190; + puStack_150 = *pauVar1 + (ushort)local_b8._8_2_; + local_158._0_4_ = CONCAT22(local_b8._10_2_,local_b8._10_2_); + local_120 = CONCAT44(local_120._4_4_,0x30); + uStack_108 = CONCAT44(uStack_108._4_4_,0x240); + local_110 = &local_158; + local_100 = 0; + uStack_f8 = 0; + pppplVar19 = (longlong ****)&local_198; + pauVar17 = pauVar2; + uStack_118 = param_2; + puRam0000000000000008 = local_1a0; + uVar8 = FltCreateFileEx2(DAT_1); + HsmDbgBreakOnStatus(uVar8); + if (((uVar8 == 0xc0000035) || (uVar8 == 0xc0000279)) && + ((local_b8._4_4_ & 0x4000) != 0)) { + uVar10 = Feature_1245077819__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar10 != 0) { + local_180 = (longlong **)0x0; + local_1a8 = (undefined1 (*) [16])0x0; + local_d0 = 0; + uStack_c8 = 0; + pppplVar19 = (longlong ****)0x40; + pauVar17 = local_188; + uVar8 = HsmpAccessCheck(param_1,(ulonglong)local_188,0x40); + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { + pppplVar19 = (longlong ****)&local_180; + pauVar17 = pauVar2; + uVar8 = FltCreateFileEx(DAT_1); + if (-1 < (int)uVar8) { + pppplVar19 = (longlong ****)0x10000; + uVar8 = HsmpAccessCheck(param_1,0,0x10000); + ObfDereferenceObject(0); + FltClose(local_180); + pauVar17 = local_1a8; + } + if ((int)uVar8 < 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && + (1 < (byte)WPP_GLOBAL_Control[0x29])) { + pauVar17 = (undefined1 (*) [16])0x6f; + goto LAB_7; + } + goto LAB_5; + } + } + } + bVar5 = false; + bVar6 = false; + } + else { + bVar5 = true; + } + if (!bVar5) { + pppplVar19 = (longlong ****)&local_198; + pauVar17 = pauVar2; + uVar8 = FltCreateFileEx(DAT_1); + HsmDbgBreakOnStatus(uVar8); + bVar5 = bVar6; + } + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x6f; + pauVar17 = (undefined1 (*) [16])0x70; goto LAB_7; } } - else if (bVar19) { + else if (bVar5) { *(longlong ***)pauVar1[1] = local_a8; *(undefined8 *)(pauVar1[1] + 8) = uStack_a0; *(undefined8 *)pauVar1[2] = local_98; *(undefined8 *)(pauVar1[2] + 8) = uStack_90; *(uint *)pauVar1[3] = uRam0000000000000028; *(undefined8 *)(pauVar1[4] + 8) = uRam0000000000000030; - local_1e8 = pauVar1; + local_200 = pauVar1; LAB_9: - pauVar15 = local_1e8; + pauVar17 = local_200; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x78; - pppplVar18 = (longlong ****)&WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids; - WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x78, - &WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids,param_1); + pauVar17 = (undefined1 (*) [16])0x79; + pppplVar19 = (longlong ****)&WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids; + WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x79, + &WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids,param_1); } } else { - pppplVar18 = (longlong ****)0x8; - pauVar15 = local_1e8; - uVar7 = HsmpMarkHandleUsnSourceInfo(param_1,0,8,0); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + pppplVar19 = (longlong ****)0x8; + pauVar17 = local_200; + uVar8 = HsmpMarkHandleUsnSourceInfo(param_1,0,8,0); + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x70; + pauVar17 = (undefined1 (*) [16])0x71; goto LAB_7; } } else { - pauVar15 = local_1e8; - pppplVar18 = (longlong ****)ppplStack_80; - uVar7 = HsmpRpCreate(param_1,0,(longlong)ppplStack_80,local_1d0, + pauVar17 = local_200; + pppplVar19 = (longlong ****)ppplStack_80; + uVar8 = HsmpRpCreate(param_1,0,(longlong)ppplStack_80,local_1e8, *pauVar1 + (ushort)local_b8._12_2_,local_b8._14_2_,'\0'); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x71; + pauVar17 = (undefined1 (*) [16])0x72; goto LAB_7; } } - else if ((uVar6 == 0) && ((longlong ****)ppplStack_80 != (longlong ****)0x0)) + else if ((uVar7 == 0) && ((longlong ****)ppplStack_80 != (longlong ****)0x0)) { - pppplVar18 = (longlong ****)CONCAT71((int7)((ulonglong)pppplVar18 >> 8),1); - pauVar15 = local_1e8; - uVar7 = HsmpToggleFileSparseAttribute(param_1,0,'\x01'); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + pppplVar19 = (longlong ****)CONCAT71((int7)((ulonglong)pppplVar19 >> 8),1); + pauVar17 = local_200; + uVar8 = HsmpToggleFileSparseAttribute(param_1,0,'\x01'); + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x72; + pauVar17 = (undefined1 (*) [16])0x73; goto LAB_7; } } else { - pppplVar18 = &ppplStack_80; - pauVar15 = local_1e8; - uVar7 = FltSetInformationFile(pauVar2,0,pppplVar18,8); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + pppplVar19 = &ppplStack_80; + pauVar17 = local_200; + uVar8 = FltSetInformationFile(pauVar2,0,pppplVar19,8); + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x73; + pauVar17 = (undefined1 (*) [16])0x74; goto LAB_7; } } else { - pauVar15 = local_1e8; - pppplVar18 = (longlong ****)ppplStack_80; - uVar7 = HsmpSetFileVDL(pauVar2,0,ppplStack_80); - HsmDbgBreakOnStatus(uVar7); - if (-1 < (int)uVar7) goto LAB_10; + pauVar17 = local_200; + pppplVar19 = (longlong ****)ppplStack_80; + uVar8 = HsmpSetFileVDL(pauVar2,0,ppplStack_80); + HsmDbgBreakOnStatus(uVar8); + if (-1 < (int)uVar8) goto LAB_10; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x74; + pauVar17 = (undefined1 (*) [16])0x75; goto LAB_7; } } } } else { LAB_10: local_68 = local_a8; uStack_60 = uStack_a0; local_58 = local_98; uStack_50 = uStack_90; - local_48 = CONCAT44((int)(local_88 >> 0x20),local_1a4); - pppplVar18 = (longlong ****)&local_68; - pauVar15 = local_1e8; - uVar7 = FltSetInformationFile(pauVar2,0,pppplVar18,0x28); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + local_48 = CONCAT44((int)(local_88 >> 0x20),local_1b4); + pppplVar19 = (longlong ****)&local_68; + pauVar17 = local_200; + uVar8 = FltSetInformationFile(pauVar2,0,pppplVar19,0x28); + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x75; + pauVar17 = (undefined1 (*) [16])0x76; goto LAB_7; } } else { - pppplVar18 = (longlong ****)(pauVar1[4] + 8); - pauVar15 = local_1e8; - uVar7 = HsmpQueryLastEffectiveUsn(pauVar2,0,(longlong *)pppplVar18); - HsmDbgBreakOnStatus(uVar7); - if ((int)uVar7 < 0) { + pppplVar19 = (longlong ****)(pauVar1[4] + 8); + pauVar17 = local_200; + uVar8 = HsmpQueryLastEffectiveUsn(pauVar2,0,(longlong *)pppplVar19); + HsmDbgBreakOnStatus(uVar8); + if ((int)uVar8 < 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x76; + pauVar17 = (undefined1 (*) [16])0x77; goto LAB_7; } } else { - pppplVar18 = (longlong ****)&local_68; - uVar7 = FltQueryInformationFile(pauVar2,0,pppplVar18,0x28); - HsmDbgBreakOnStatus(uVar7); - if (-1 < (int)uVar7) { + pppplVar19 = (longlong ****)&local_68; + uVar8 = FltQueryInformationFile(pauVar2,0,pppplVar19,0x28); + HsmDbgBreakOnStatus(uVar8); + if (-1 < (int)uVar8) { *(longlong ***)pauVar1[1] = local_68; *(undefined8 *)(pauVar1[1] + 8) = uStack_60; *(undefined8 *)pauVar1[2] = local_58; *(undefined8 *)(pauVar1[2] + 8) = uStack_50; *(undefined8 *)pauVar1[3] = local_48; goto LAB_9; } - pauVar15 = local_1e8; + pauVar17 = local_200; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) { - pauVar15 = (undefined1 (*) [16])0x77; + pauVar17 = (undefined1 (*) [16])0x78; goto LAB_7; } } } } } } } } LAB_5: - *(uint *)pauVar1[4] = uVar7; - if ((longlong ***)local_180 != (longlong ***)0x0) { + *(uint *)pauVar1[4] = uVar8; + if ((longlong ***)local_198 != (longlong ***)0x0) { FltClose(); - local_180 = (longlong **)0x0; - } - if (((int)uVar7 < 0) && (uVar17 = uVar11, (param_3 & 1) != 0)) break; - uVar8 = 0; + local_198 = (longlong **)0x0; + } + if (((int)uVar8 < 0) && (uVar13 = 0, (param_3 & 1) != 0)) break; + uVar9 = 0; if (local_b8._0_4_ != 0) { - uVar8 = local_1b4 + local_b8._0_4_; - } - uVar17 = uVar16; - local_1b4 = uVar8; - } while (uVar8 != 0); - if ((((local_1cc != 0) && - (uVar7 = uVar17, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + uVar9 = local_1d8 + local_b8._0_4_; + } + uVar13 = uVar18; + local_1d8 = uVar9; + } while (uVar9 != 0); + if ((((local_1e4 != 0) && + (uVar8 = uVar13, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_qqdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),pauVar15,pppplVar18,param_1); + WPP_SF_qqdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),pauVar17,pppplVar19,param_1); } - *local_110 = local_1cc; + *local_f0 = local_1e4; goto LAB_0; } if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar14 = 0x66; + uVar16 = 0x66; } - uVar13 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); + uVar15 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18); } - WPP_SF_qid(uVar13,uVar14,&WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids,param_1); + WPP_SF_qid(uVar15,uVar16,&WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids,param_1); goto LAB_0; } - uVar7 = 0xc000009a; + uVar8 = 0xc000009a; HsmDbgBreakOnStatus(-0x3fffff66); if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || ((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_0; - uVar14 = 99; + uVar16 = 99; } - uVar7 = 0xc000009a; - WPP_SF_qid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar14, - &WPP_6dcf8bf8d51436f7d18b577bac385464_Traceguids,param_1); + uVar8 = 0xc000009a; + WPP_SF_qid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar16, + &WPP_9e087c7213aa3c93e046c4a2d16fcfea_Traceguids,param_1); LAB_0: - if (local_188 != (uint *)0x0) { - ExFreePoolWithTag(local_188,0x70527348); + if (local_1a0 != (uint *)0x0) { + ExFreePoolWithTag(local_1a0,0x70527348); } - if (local_178 != 0) { + if (local_190 != 0) { FltFreeExtraCreateParameterList(DAT_1); } if (_Dst != (void *)0x0) { - if (-1 < (int)uVar7) { - memmove(param_4,_Dst,local_108); + if (-1 < (int)uVar8) { + memmove(param_4,_Dst,local_e8); } ExFreePoolWithTag(_Dst,0x70537348); } - if (local_168 != (undefined1 (*) [16])0x0) { + if (local_188 != (undefined1 (*) [16])0x0) { ObfDereferenceObject(); } - return uVar7; + return uVar8; } ``` ## CldStreamReportProgress ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.52| |i_ratio|0.27| |m_ratio|0.98| |b_ratio|0.58| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldStreamReportProgress|CldStreamReportProgress| |fullname|CldStreamReportProgress|CldStreamReportProgress| |refcount|2|2| |`length`|493|457| |`called`|CldiStreamBuildProviderRequest
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteProviderRequest
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::PsGetProcessId
WPP_SF_qiiiiL|CldiIsStreamListEmpty
CldiStreamBuildProviderRequest
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteProviderRequest
Feature_544180536__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::PsGetProcessId
WPP_SF_qiiiiL| |calling|CldSyncReportProgress|CldSyncReportProgress| |paramcount|6|6| |`address`|14004b1d0|14004b3f0| |sig|ulonglong __fastcall CldStreamReportProgress(longlong * param_1, longlong param_2, longlong param_3, longlong param_4, uint param_5, char * param_6)|ulonglong __fastcall CldStreamReportProgress(longlong * param_1, longlong param_2, longlong param_3, longlong param_4, uint param_5, char * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldStreamReportProgress Called Diff ```diff --- CldStreamReportProgress called +++ CldStreamReportProgress called @@ -0,0 +1 @@ +CldiIsStreamListEmpty @@ -4,0 +6 @@ +Feature_544180536__private_IsEnabledDeviceUsageNoInline ``` ### CldStreamReportProgress Diff ```diff --- CldStreamReportProgress +++ CldStreamReportProgress @@ -1,52 +1,66 @@ ulonglong CldStreamReportProgress (longlong *param_1,longlong param_2,longlong param_3,longlong param_4, uint param_5,char *param_6) { longlong *plVar1; - int iVar2; - undefined8 uVar3; + char cVar2; + int iVar3; ulonglong uVar4; - char cVar5; + undefined8 uVar5; + ulonglong uVar6; + char cVar7; - uVar4 = 0; + uVar6 = 0; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]) ) { WPP_SF_qiiiiL(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(ulonglong)param_5,param_2,param_1); } - if ((param_3 != param_1[5]) || (cVar5 = '\0', param_1[6] < param_4)) { - cVar5 = '\x01'; + cVar7 = '\x01'; + if ((param_3 != param_1[5]) || (cVar2 = '\0', param_1[6] < param_4)) { + cVar2 = '\x01'; } param_1[6] = param_4; param_1[5] = param_3; - *param_6 = cVar5; + *param_6 = cVar2; CldiStreamCdqACQUIRE(*(longlong *)(*param_1 + 8) + 0x90); for (plVar1 = (longlong *)param_1[2]; plVar1 != param_1 + 2; plVar1 = (longlong *)*plVar1) { - uVar3 = IoGetCurrentProcess(); - iVar2 = PsGetProcessId(uVar3); - if (((*(int *)((longlong)plVar1 + 0x4c) == iVar2) && (plVar1 + -1 != (longlong *)param_1[7])) && - ((param_2 == 0 || (plVar1[6] == param_2)))) { - *(uint *)(plVar1 + 9) = param_5; + uVar4 = Feature_544180536__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar4 == 0) || ((short)plVar1[-1] != 0)) { + uVar5 = IoGetCurrentProcess(); + iVar3 = PsGetProcessId(uVar5); + if (((*(int *)((longlong)plVar1 + 0x4c) == iVar3) && (plVar1 + -1 != (longlong *)param_1[7])) + && ((param_2 == 0 || (plVar1[6] == param_2)))) { + *(uint *)(plVar1 + 9) = param_5; + } } } - cVar5 = '\x01'; - if (((longlong *)param_1[2] != param_1 + 2) && (param_1[7] == 0)) { - cVar5 = '\0'; + uVar4 = Feature_544180536__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + if ((longlong *)param_1[2] == param_1 + 2) goto LAB_0; } + else { + cVar2 = CldiIsStreamListEmpty((longlong)param_1); + if (cVar2 != '\0') goto LAB_0; + } + if (param_1[7] == 0) { + cVar7 = '\0'; + } +LAB_0: CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); - if (cVar5 != '\0') { + if (cVar7 != '\0') { if (param_4 < param_3) { if (param_1[7] == 0) { - uVar4 = CldiStreamBuildProviderRequest(param_1,param_3,param_4,param_5); - uVar4 = uVar4 & 0xffffffff; + uVar6 = CldiStreamBuildProviderRequest(param_1,param_3,param_4,param_5); + uVar6 = uVar6 & 0xffffffff; } } else { CldiStreamCompleteProviderRequest(param_1); } } - return uVar4; + return uVar6; } ``` ## CldiStreamStartCountdownTimer ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.24| |i_ratio|0.39| |m_ratio|0.63| |b_ratio|0.47| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldiStreamStartCountdownTimer|CldiStreamStartCountdownTimer| |fullname|CldiStreamStartCountdownTimer|CldiStreamStartCountdownTimer| |refcount|7|7| |`length`|486|981| |`called`|
Expand for full list:
CldiStreamCancelSynchronousRequest
CldiStreamInsertIntoGlobalRequestListNoLock
CldiStreamIsRequestExpired
CldiStreamRemoveFromGlobalRequestListNoLock
FLTMGR.SYS::FltCancelIo
HsmDbgBreakOnTimeOut
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegionNTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeSetTimer
TlmWriteFltTimeout
|
Expand for full list:
CldiCanDoNonCdqCompletion
CldiStreamCancelSynchronousRequest
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamInsertIntoGlobalRequestListNoLock
CldiStreamIsRequestExpired
CldiStreamPrepareRequestForNonCdqCompletion
CldiStreamRemoveFromGlobalRequestListNoLock
FLTMGR.SYS::FltCancelIo
Feature_3750208824__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnTimeOutNTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeSetTimer
TlmWriteFltTimeout
WPP_SF_qid
| |calling|CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldStreamUninitialize
CldiStreamRestartCountdownTimer
CldiStreamTimeoutWorker|CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldStreamUninitialize
CldiStreamRestartCountdownTimer
CldiStreamTimeoutWorker| |paramcount|3|3| |`address`|140035c94|140042978| |`sig`|undefined __fastcall CldiStreamStartCountdownTimer(char param_1, undefined8 param_2, undefined8 param_3)|undefined __fastcall CldiStreamStartCountdownTimer(char param_1, undefined8 param_2, undefined * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamStartCountdownTimer Called Diff ```diff --- CldiStreamStartCountdownTimer called +++ CldiStreamStartCountdownTimer called @@ -0,0 +1 @@ +CldiCanDoNonCdqCompletion @@ -1,0 +3,2 @@ +CldiStreamCdqRELEASE +CldiStreamCompleteCanceledRequest @@ -3,0 +7 @@ +CldiStreamPrepareRequestForNonCdqCompletion @@ -5,0 +10 @@ +Feature_3750208824__private_IsEnabledDeviceUsageNoInline @@ -14,0 +20 @@ +WPP_SF_qid ``` ### CldiStreamStartCountdownTimer Diff ```diff --- CldiStreamStartCountdownTimer +++ CldiStreamStartCountdownTimer @@ -1,71 +1,144 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -void CldiStreamStartCountdownTimer(char param_1,longlong param_2,undefined8 param_3) +void CldiStreamStartCountdownTimer(char param_1,longlong param_2,undefined *param_3) { - undefined8 *puVar1; - char cVar2; - bool bVar3; - longlong lVar4; - uint *puVar5; + longlong *plVar1; + undefined8 *puVar2; + longlong lVar3; + char cVar4; + bool bVar5; + ulonglong uVar6; + undefined8 uVar7; + longlong lVar8; + longlong lVar9; + uint *puVar10; - cVar2 = ExAcquireRundownProtection(&DAT_0); - lVar4 = _DAT_1; - if (cVar2 != '\0') { + cVar4 = ExAcquireRundownProtection(&DAT_0); + lVar3 = _DAT_1; + if (cVar4 == '\0') { + return; + } + uVar6 = Feature_3750208824__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 == 0) { do { while( true ) { - puVar5 = (uint *)0x0; + puVar10 = (uint *)0x0; KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite(&DAT_2,1); - puVar1 = DAT_3; + puVar2 = DAT_3; if ((undefined8 **)DAT_3 != &DAT_3) break; LAB_4: ExReleaseResourceLite(&DAT_2); KeLeaveCriticalRegion(); - if (puVar5 == (uint *)0x0) goto LAB_5; + if (puVar10 == (uint *)0x0) goto LAB_5; HsmDbgBreakOnTimeOut(); - TlmWriteFltTimeout((longlong)(int)*puVar5,*(undefined1 *)((longlong)puVar5 + 0x69),param_3); - puVar5[0x24] = 0; - puVar5[0x25] = 0; - if (*(undefined8 **)(puVar5 + 0x18) == (undefined8 *)0x0) { - CldiStreamCancelSynchronousRequest(puVar5); + TlmWriteFltTimeout((longlong)(int)*puVar10,*(undefined1 *)((longlong)puVar10 + 0x69),param_3 + ); + puVar10[0x24] = 0; + puVar10[0x25] = 0; + if (*(undefined8 **)(puVar10 + 0x18) == (undefined8 *)0x0) { + CldiStreamCancelSynchronousRequest(puVar10); } else { - FltCancelIo(**(undefined8 **)(puVar5 + 0x18)); + FltCancelIo(**(undefined8 **)(puVar10 + 0x18)); } } - puVar5 = (uint *)(DAT_3 + -5); - if ((param_1 == '\0') && (lVar4 < (longlong)DAT_3[0xd])) { - lVar4 = lVar4 - DAT_3[0xd]; + puVar10 = (uint *)(DAT_3 + -5); + if ((param_1 == '\0') && (lVar8 = DAT_3[0xd], lVar3 < lVar8)) goto LAB_140042c9c; + CldiStreamRemoveFromGlobalRequestListNoLock(puVar10); + if ((param_1 != '\0') || (bVar5 = CldiStreamIsRequestExpired((longlong)puVar10,lVar3), bVar5)) + { + *(undefined1 *)(puVar2 + 8) = 1; + goto LAB_4; + } + CldiStreamInsertIntoGlobalRequestListNoLock(puVar10); + ExReleaseResourceLite(&DAT_2); + KeLeaveCriticalRegion(); + } while (puVar10 != (uint *)0x0); + } + else { + while( true ) { + KeEnterCriticalRegion(); + ExAcquireResourceExclusiveLite(&DAT_2,1); + puVar2 = DAT_3; + if ((undefined8 **)DAT_3 == &DAT_3) break; + puVar10 = (uint *)(DAT_3 + -5); + plVar1 = DAT_3 + 0xd; + if (param_1 == '\0') { + lVar8 = *plVar1; + if (lVar3 < lVar8) goto LAB_6; + bVar5 = CldiStreamIsRequestExpired((longlong)puVar10,lVar3); + if (bVar5) goto LAB_7; +LAB_8: + CldiStreamRemoveFromGlobalRequestListNoLock(puVar10); + CldiStreamInsertIntoGlobalRequestListNoLock(puVar10); ExReleaseResourceLite(&DAT_2); KeLeaveCriticalRegion(); - if (lVar4 != 0) { - LOCK(); - bVar3 = DAT_6 == 0; - if (bVar3) { - DAT_6 = 1; + } + else { +LAB_7: + lVar8 = *(longlong *)(*(longlong *)puVar2[10] + 8); + KeEnterCriticalRegion(); + cVar4 = ExAcquireResourceExclusiveLite(lVar8 + 0x110,0); + if (cVar4 == '\0') { + KeLeaveCriticalRegion(); + goto LAB_8; + } + CldiStreamRemoveFromGlobalRequestListNoLock(puVar10); + *(undefined1 *)(puVar2 + 8) = 1; + ExReleaseResourceLite(&DAT_2); + KeLeaveCriticalRegion(); + *plVar1 = 0; + HsmDbgBreakOnTimeOut(); + TlmWriteFltTimeout((longlong)(int)*puVar10,*(undefined1 *)((longlong)puVar2 + 0x41),param_3) + ; + lVar9 = 0; + if ((longlong *)puVar2[7] != (longlong *)0x0) { + lVar9 = *(longlong *)puVar2[7]; + } + cVar4 = CldiStreamPrepareRequestForNonCdqCompletion(puVar10); + if ((cVar4 == '\0') || + (uVar7 = CldiCanDoNonCdqCompletion((longlong)puVar10), (char)uVar7 == '\0')) { + CldiStreamCdqRELEASE(lVar8 + 0x90); + } + else { + CldiStreamCdqRELEASE(lVar8 + 0x90); + if (lVar9 != 0) { + FltCancelIo(lVar9); } - UNLOCK(); - if ((bVar3) && (cVar2 = ExAcquireRundownProtection(&DAT_0), cVar2 != '\0')) { - KeSetTimer(&DAT_7,lVar4,&DAT_14002a870); + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && + (3 < (byte)WPP_GLOBAL_Control[0x29])) { + param_3 = &WPP_a78e013c7d4c3d563646d4dabbac4ab7_Traceguids; + WPP_SF_qid(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x12, + &WPP_a78e013c7d4c3d563646d4dabbac4ab7_Traceguids,puVar10); } + CldiStreamCompleteCanceledRequest(puVar10,0xc0000120); } - break; } - CldiStreamRemoveFromGlobalRequestListNoLock(puVar5); - if ((param_1 != '\0') || (bVar3 = CldiStreamIsRequestExpired((longlong)puVar5,lVar4), bVar3)) - { - *(undefined1 *)(puVar1 + 8) = 1; - goto LAB_4; - } - CldiStreamInsertIntoGlobalRequestListNoLock(puVar5); - ExReleaseResourceLite(&DAT_2); - KeLeaveCriticalRegion(); - } while (puVar5 != (uint *)0x0); + } + ExReleaseResourceLite(&DAT_2); + KeLeaveCriticalRegion(); + } LAB_5: - ExReleaseRundownProtection(&DAT_0); + ExReleaseRundownProtection(&DAT_0); + return; +LAB_6: + ExReleaseResourceLite(&DAT_2); + KeLeaveCriticalRegion(); + if (lVar3 - lVar8 != 0) { + LOCK(); + bVar5 = DAT_9 == 0; + if (bVar5) { + DAT_9 = 1; + } + UNLOCK(); + if ((bVar5) && (cVar4 = ExAcquireRundownProtection(&DAT_0), cVar4 != '\0')) { + KeSetTimer(&DAT_10,lVar3 - lVar8,&DAT_14002a870); + } } - return; + goto LAB_5; } ``` ## WPP_SF_iqiiqd ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.91| |i_ratio|0.43| |m_ratio|0.98| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|WPP_SF_iqiiqd|WPP_SF_iqiiqd| |fullname|WPP_SF_iqiiqd|WPP_SF_iqiiqd| |refcount|2|2| |`length`|136|138| |called|_guard_dispatch_icall|_guard_dispatch_icall| |calling|CldStreamTransferData|CldStreamTransferData| |paramcount|4|4| |`address`|140011758|140011830| |sig|undefined __fastcall WPP_SF_iqiiqd(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_iqiiqd(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_iqiiqd Diff ```diff --- WPP_SF_iqiiqd +++ WPP_SF_iqiiqd @@ -1,16 +1,16 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void WPP_SF_iqiiqd(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4) { undefined8 local_res20; local_res20 = param_4; (*pfnWppTraceMessage) - (param_1,0x2b,&WPP_025e7f730a9e36307dae1c922f2f324d_Traceguids,0x2a,&local_res20,8, + (param_1,0x2b,&WPP_a78e013c7d4c3d563646d4dabbac4ab7_Traceguids,0x2b,&local_res20,8, &stack0x00000028,8,&stack0x00000030,8,&stack0x00000038,8,&stack0x00000040,8, &stack0x00000048,4,0); return; } ``` ## CldStreamHasPendingRequests ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.46| |i_ratio|0.32| |m_ratio|0.98| |b_ratio|0.63| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldStreamHasPendingRequests|CldStreamHasPendingRequests| |fullname|CldStreamHasPendingRequests|CldStreamHasPendingRequests| |refcount|5|5| |`length`|132|105| |`called`|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion|CldiIsStreamListEmpty
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
Feature_544180536__private_IsEnabledDeviceUsageNoInline| |calling|CldSyncAbortOperation
CldSyncDisconnectRootByObject
CldiSyncAcquireRundown|CldSyncAbortOperation
CldSyncDisconnectRootByObject
CldiSyncAcquireRundown| |paramcount|1|1| |`address`|14004c980|14004cb00| |sig|bool __fastcall CldStreamHasPendingRequests(longlong * param_1)|bool __fastcall CldStreamHasPendingRequests(longlong * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldStreamHasPendingRequests Called Diff ```diff --- CldStreamHasPendingRequests called +++ CldStreamHasPendingRequests called @@ -1,4 +1,4 @@ -NTOSKRNL.EXE::ExAcquireResourceExclusiveLite -NTOSKRNL.EXE::ExReleaseResourceLite -NTOSKRNL.EXE::KeEnterCriticalRegion -NTOSKRNL.EXE::KeLeaveCriticalRegion +CldiIsStreamListEmpty +CldiStreamCdqACQUIRE +CldiStreamCdqRELEASE +Feature_544180536__private_IsEnabledDeviceUsageNoInline ``` ### CldStreamHasPendingRequests Diff ```diff --- CldStreamHasPendingRequests +++ CldStreamHasPendingRequests @@ -1,21 +1,24 @@ bool CldStreamHasPendingRequests(longlong *param_1) { - longlong lVar1; - longlong *plVar2; + char cVar1; + ulonglong uVar2; bool bVar3; bVar3 = false; if (param_1 != (longlong *)0x0) { - lVar1 = *(longlong *)(*param_1 + 8); - KeEnterCriticalRegion(); - ExAcquireResourceExclusiveLite(lVar1 + 0x110,1); - plVar2 = (longlong *)param_1[2]; - ExReleaseResourceLite(*(longlong *)(*param_1 + 8) + 0x110); - KeLeaveCriticalRegion(); - bVar3 = plVar2 != param_1 + 2; + CldiStreamCdqACQUIRE(*(longlong *)(*param_1 + 8) + 0x90); + uVar2 = Feature_544180536__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { + bVar3 = (longlong *)param_1[2] != param_1 + 2; + } + else { + cVar1 = CldiIsStreamListEmpty((longlong)param_1); + bVar3 = cVar1 == '\0'; + } + CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); } return bVar3; } ``` ## CldiStreamCompleteRequest ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.63| |i_ratio|0.56| |m_ratio|0.98| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldiStreamCompleteRequest|CldiStreamCompleteRequest| |fullname|CldiStreamCompleteRequest|CldiStreamCompleteRequest| |refcount|6|6| |`length`|666|683| |`called`|
Expand for full list:
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoGlobalRequestListNoLock
CldiStreamRemoveFromGlobalRequestListNoLock
FLTMGR.SYS::FltCbdqRemoveIo
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
Feature_4003697978__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeEnterCriticalRegionNTOSKRNL.EXE::KeLeaveCriticalRegion
WPP_SF_iqq
WPP_SF_iqqd
_guard_dispatch_icall
|
Expand for full list:
CldiIsStreamListEmpty
CldiStreamCdqRELEASE
CldiStreamDeleteRequest
CldiStreamInsertIntoGlobalRequestListNoLock
CldiStreamRemoveFromGlobalRequestListNoLock
FLTMGR.SYS::FltCbdqRemoveIo
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
Feature_4003697978__private_IsEnabledDeviceUsageNoInline
Feature_544180536__private_IsEnabledDeviceUsageNoInline
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAcquireResourceExclusiveLiteNTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
WPP_SF_iqq
WPP_SF_iqqd
_guard_dispatch_icall
| |calling|CldiStreamCompleteCanceledRequest
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests|CldiStreamCompleteCanceledRequest
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests| |paramcount|4|4| |`address`|1400829ac|140082cec| |sig|undefined __fastcall CldiStreamCompleteRequest(longlong * param_1, uint * param_2, ulonglong param_3, uint param_4)|undefined __fastcall CldiStreamCompleteRequest(longlong * param_1, uint * param_2, ulonglong param_3, uint param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCompleteRequest Called Diff ```diff --- CldiStreamCompleteRequest called +++ CldiStreamCompleteRequest called @@ -0,0 +1 @@ +CldiIsStreamListEmpty @@ -7,0 +9 @@ +Feature_544180536__private_IsEnabledDeviceUsageNoInline ``` ### CldiStreamCompleteRequest Diff ```diff --- CldiStreamCompleteRequest +++ CldiStreamCompleteRequest @@ -1,83 +1,91 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void CldiStreamCompleteRequest(longlong *param_1,uint *param_2,ulonglong param_3,uint param_4) { longlong *plVar1; undefined8 uVar2; code *pcVar3; undefined8 uVar4; - ulonglong uVar5; - longlong lVar6; - ulonglong uVar7; - longlong *plVar8; + char cVar5; + ulonglong uVar6; + longlong lVar7; + ulonglong uVar8; + longlong *plVar9; uVar2 = *(undefined8 *)(param_2 + 0x28); - uVar7 = param_3 & 0xffffffff; + uVar8 = param_3 & 0xffffffff; pcVar3 = *(code **)(param_2 + 0x26); uVar4 = *(undefined8 *)(*(longlong *)(*(longlong *)*param_1 + 0x10) + 0x20); if (((*(longlong **)(param_2 + 0x18) != (longlong *)0x0) && (*(char *)((longlong)param_2 + 0x69) == '\0')) && - (lVar6 = **(longlong **)(param_2 + 0x18), lVar6 != 0)) { - plVar1 = (longlong *)(lVar6 + 0x30); + (lVar7 = **(longlong **)(param_2 + 0x18), lVar7 != 0)) { + plVar1 = (longlong *)(lVar7 + 0x30); if ((longlong *)*plVar1 == plVar1) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])) { - WPP_SF_iqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x12,param_3,uVar4); + WPP_SF_iqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x13,param_3,uVar4); } - uVar5 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar5 == 0) && - (lVar6 = FltCbdqRemoveIo(*(longlong *)(*param_1 + 8) + 0x90, - *(longlong *)(param_2 + 0x18) + 8), lVar6 == 0)) { - uVar7 = 0xc0000120; + uVar6 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar6 == 0) && + (lVar7 = FltCbdqRemoveIo(*(longlong *)(*param_1 + 8) + 0x90, + *(longlong *)(param_2 + 0x18) + 8), lVar7 == 0)) { + uVar8 = 0xc0000120; HsmDbgBreakOnStatus(-0x3ffffee0); } } else { KeEnterCriticalRegion(); ExAcquireResourceExclusiveLite(&DAT_0,1); - for (plVar8 = (longlong *)*plVar1; plVar8 != plVar1; plVar8 = (longlong *)*plVar8) { - CldiStreamRemoveFromGlobalRequestListNoLock((uint *)(plVar8 + -3)); - CldiStreamInsertIntoGlobalRequestListNoLock((uint *)(plVar8 + -3)); + for (plVar9 = (longlong *)*plVar1; plVar9 != plVar1; plVar9 = (longlong *)*plVar9) { + CldiStreamRemoveFromGlobalRequestListNoLock((uint *)(plVar9 + -3)); + CldiStreamInsertIntoGlobalRequestListNoLock((uint *)(plVar9 + -3)); } ExReleaseResourceLite(&DAT_0); KeLeaveCriticalRegion(); } } - if ((longlong *)param_1[2] == param_1 + 2) { - param_1[6] = 0; - param_1[5] = 0; + uVar6 = Feature_544180536__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 == 0) { + if ((longlong *)param_1[2] != param_1 + 2) goto LAB_1; } - uVar5 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 == 0) { + else { + cVar5 = CldiIsStreamListEmpty((longlong)param_1); + if (cVar5 == '\0') goto LAB_1; + } + param_1[6] = 0; + param_1[5] = 0; +LAB_1: + uVar6 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 == 0) { if (*(char *)((longlong)param_2 + 0x69) == '\0') { CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); } CldiStreamDeleteRequest(param_2); } else { CldiStreamDeleteRequest(param_2); - uVar5 = Feature_4003697978__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar5 == 0) { + uVar6 = Feature_4003697978__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar6 == 0) { CldiStreamCdqRELEASE(*(longlong *)(*param_1 + 8) + 0x90); } } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]) ) { - WPP_SF_iqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x13,param_3,uVar4); + WPP_SF_iqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x14,param_3,uVar4); } if (pcVar3 != (code *)0x0) { param_3 = (ulonglong)param_4; - (*pcVar3)(uVar2,uVar7); + (*pcVar3)(uVar2,uVar8); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]) ) { - WPP_SF_iqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x14,param_3,uVar4); + WPP_SF_iqqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x15,param_3,uVar4); } return; } ``` ## CldStreamClose ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.42| |i_ratio|0.16| |m_ratio|0.57| |b_ratio|0.39| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldStreamClose|CldStreamClose| |fullname|CldStreamClose|CldStreamClose| |refcount|2|2| |`length`|529|204| |`called`|CldStreamPurgeCache
CldiStreamCompleteProviderRequest
FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltReleasePushLockEx
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb
NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl
NTOSKRNL.EXE::RtlLookupElementGenericTableAvl
WPP_SF_qqq|CldStreamPurgeCache
CldSyncUnregisterStream
CldiStreamCompleteProviderRequest
Feature_544180536__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_qqq| |calling|CldHsmDeleteStreamContext|CldHsmDeleteStreamContext| |paramcount|1|1| |`address`|140070630|140072c70| |sig|undefined __fastcall CldStreamClose(longlong * param_1)|undefined __fastcall CldStreamClose(longlong * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldStreamClose Called Diff ```diff --- CldStreamClose called +++ CldStreamClose called @@ -1,0 +2 @@ +CldSyncUnregisterStream @@ -3,2 +4 @@ -FLTMGR.SYS::FltAcquirePushLockExclusiveEx -FLTMGR.SYS::FltReleasePushLockEx +Feature_544180536__private_IsEnabledDeviceUsageNoInline @@ -6,4 +5,0 @@ -NTOSKRNL.EXE::ExWaitForRundownProtectionRelease -NTOSKRNL.EXE::FsRtlUninitializeBaseMcb -NTOSKRNL.EXE::RtlDeleteElementGenericTableAvl -NTOSKRNL.EXE::RtlLookupElementGenericTableAvl ``` ### CldStreamClose Diff ```diff --- CldStreamClose +++ CldStreamClose @@ -1,58 +1,25 @@ void CldStreamClose(longlong *param_1) { - longlong lVar1; - longlong lVar2; - undefined8 *puVar3; - longlong lVar4; - undefined8 *puVar5; - undefined8 local_res8; - - lVar2 = *(longlong *)(((longlong *)*param_1)[2] + 0x20); - lVar1 = lVar2 + 0x68; - local_res8 = *(undefined8 *)(*(longlong *)*param_1 + 0x28); - FltAcquirePushLockExclusiveEx(lVar1,0); - lVar2 = lVar2 + 0x70; - lVar4 = RtlLookupElementGenericTableAvl(lVar2,&local_res8); - puVar5 = (undefined8 *)0x0; - if ((lVar4 != 0) && (puVar3 = *(undefined8 **)(lVar4 + 8), puVar3 != (undefined8 *)0x0)) { - *(undefined8 *)(lVar4 + 8) = 0; - puVar5 = puVar3; - } - FltReleasePushLockEx(lVar1,0); - if (lVar4 != 0) { - ExWaitForRundownProtectionRelease(lVar4 + 0x10); - if ((*(uint *)(*(longlong *)*puVar5 + 0x1c) & 2) == 0) { - if (*(longlong *)(lVar4 + 0x40) != 0) { - ExFreePoolWithTag(*(longlong *)(lVar4 + 0x40),0x6d726c43); - } - if (*(longlong *)(lVar4 + 0x50) != 0) { - ExFreePoolWithTag(*(longlong *)(lVar4 + 0x50),0x6d726c43); - } - FsRtlUninitializeBaseMcb(lVar4 + 0x20); - } - else if (*(longlong *)(lVar4 + 0x30) != 0) { - ExFreePoolWithTag(*(longlong *)(lVar4 + 0x30),0x73557348); - } - FltAcquirePushLockExclusiveEx(lVar1,0); - RtlDeleteElementGenericTableAvl(lVar2,&local_res8); - FltReleasePushLockEx(lVar1,0); - } + CldSyncUnregisterStream + (*(longlong *)(((longlong *)*param_1)[2] + 0x20), + *(undefined8 *)(*(longlong *)*param_1 + 0x28)); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x29]) ) { - WPP_SF_qqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x24, - &WPP_025e7f730a9e36307dae1c922f2f324d_Traceguids,param_1); + WPP_SF_qqq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x25, + &WPP_a78e013c7d4c3d563646d4dabbac4ab7_Traceguids,param_1); } CldiStreamCompleteProviderRequest(param_1); if ((*(uint *)(*(longlong *)*param_1 + 0x1c) & 2) == 0) { CldStreamPurgeCache(param_1); } + Feature_544180536__private_IsEnabledDeviceUsageNoInline(); if (param_1[8] != 0) { ExFreePoolWithTag(param_1[8],0x68727343); } ExFreePoolWithTag(param_1,0x74736c43); return; } ``` ## CldStreamAbortOperation ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.44| |i_ratio|0.5| |m_ratio|0.96| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldStreamAbortOperation|CldStreamAbortOperation| |fullname|CldStreamAbortOperation|CldStreamAbortOperation| |refcount|3|3| |`length`|384|420| |`called`|
Expand for full list:
CldSyncGetSyncProviderProcess
CldiCanDoNonCdqCompletion
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmOsGetProcessSessionIdFromEproccess
HsmOsIsInSameSession
NTOSKRNL.EXE::IoGetCurrentProcess
WPP_SF_i
|
Expand for full list:
CldSyncGetSyncProviderProcess
CldiCanDoNonCdqCompletion
CldiStreamCdqACQUIRE
CldiStreamCdqRELEASE
CldiStreamCompleteCanceledRequest
CldiStreamPrepareRequestForNonCdqCompletion
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
Feature_544180536__private_IsEnabledDeviceUsageNoInline
HsmOsGetProcessSessionIdFromEproccess
HsmOsIsInSameSession
NTOSKRNL.EXE::IoGetCurrentProcessWPP_SF_i
| |calling|CldSyncAbortOperation|CldSyncAbortOperation| |paramcount|3|3| |`address`|140040ce8|140040af8| |sig|undefined __fastcall CldStreamAbortOperation(int param_1, longlong * param_2, longlong param_3)|undefined __fastcall CldStreamAbortOperation(int param_1, longlong * param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldStreamAbortOperation Called Diff ```diff --- CldStreamAbortOperation called +++ CldStreamAbortOperation called @@ -7,0 +8 @@ +Feature_544180536__private_IsEnabledDeviceUsageNoInline ``` ### CldStreamAbortOperation Diff ```diff --- CldStreamAbortOperation +++ CldStreamAbortOperation @@ -1,61 +1,64 @@ void CldStreamAbortOperation(int param_1,longlong *param_2,longlong param_3) { uint *puVar1; - char cVar2; - int iVar3; + uint uVar2; + char cVar3; int iVar4; - longlong lVar5; - ulonglong uVar6; - undefined8 uVar7; - longlong *plVar8; + int iVar5; + longlong lVar6; + ulonglong uVar7; + undefined8 uVar8; longlong *plVar9; - uVar7 = *(undefined8 *)(*(longlong *)(*(longlong *)*param_2 + 0x10) + 0x20); - lVar5 = IoGetCurrentProcess(); - iVar3 = HsmOsGetProcessSessionIdFromEproccess(lVar5); - lVar5 = CldSyncGetSyncProviderProcess(*(longlong *)(*(longlong *)(*param_2 + 0x10) + 0x20)); - iVar4 = iVar3; - if (lVar5 != 0) { - iVar4 = HsmOsGetProcessSessionIdFromEproccess(lVar5); + uVar8 = *(undefined8 *)(*(longlong *)(*(longlong *)*param_2 + 0x10) + 0x20); + lVar6 = IoGetCurrentProcess(); + iVar4 = HsmOsGetProcessSessionIdFromEproccess(lVar6); + lVar6 = CldSyncGetSyncProviderProcess(*(longlong *)(*(longlong *)(*param_2 + 0x10) + 0x20)); + iVar5 = iVar4; + if (lVar6 != 0) { + iVar5 = HsmOsGetProcessSessionIdFromEproccess(lVar6); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x100) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]) ) { - WPP_SF_i(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x39, - &WPP_025e7f730a9e36307dae1c922f2f324d_Traceguids,uVar7); + WPP_SF_i(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x3a, + &WPP_a78e013c7d4c3d563646d4dabbac4ab7_Traceguids,uVar8); } do { while( true ) { CldiStreamCdqACQUIRE(*(longlong *)(*param_2 + 8) + 0x90); - plVar8 = (longlong *)param_2[2]; + plVar9 = (longlong *)param_2[2]; while( true ) { - if (plVar8 == param_2 + 2) { + if (plVar9 == param_2 + 2) { CldiStreamCdqRELEASE(*(longlong *)(*param_2 + 8) + 0x90); return; } - puVar1 = (uint *)(plVar8 + -1); - plVar9 = plVar8; - cVar2 = HsmOsIsInSameSession(iVar4,(int)plVar8[9],iVar3); - if (((cVar2 != '\0') && (*(int *)((longlong)plVar8 + 0x4c) == param_1)) && - ((param_3 == 0 || (param_3 == plVar8[6])))) break; - plVar8 = (longlong *)*plVar9; + puVar1 = (uint *)(plVar9 + -1); + uVar2 = *puVar1; + uVar7 = Feature_544180536__private_IsEnabledDeviceUsageNoInline(); + if (((((int)uVar7 == 0) || ((uVar2 & 0xffff) != 0)) && + ((cVar3 = HsmOsIsInSameSession(iVar5,(int)plVar9[9],iVar4), cVar3 != '\0' && + (*(int *)((longlong)plVar9 + 0x4c) == param_1)))) && + ((param_3 == 0 || (param_3 == plVar9[6])))) break; + plVar9 = (longlong *)*plVar9; } - uVar6 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); - if ((int)uVar6 != 0) break; - cVar2 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); - if (cVar2 != '\0') goto LAB_0; + uVar7 = Feature_2089223483__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar7 == 0) break; + cVar3 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if ((cVar3 != '\0') && + (uVar8 = CldiCanDoNonCdqCompletion((longlong)puVar1), (char)uVar8 != '\0')) { + CldiStreamCdqRELEASE(*(longlong *)(*param_2 + 8) + 0x90); + goto LAB_0; + } LAB_1: CldiStreamCdqRELEASE(*(longlong *)(*param_2 + 8) + 0x90); } - cVar2 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); - if ((cVar2 == '\0') || - (uVar7 = CldiCanDoNonCdqCompletion((longlong)puVar1), (char)uVar7 == '\0')) - goto LAB_1; - CldiStreamCdqRELEASE(*(longlong *)(*param_2 + 8) + 0x90); + cVar3 = CldiStreamPrepareRequestForNonCdqCompletion(puVar1); + if (cVar3 == '\0') goto LAB_1; LAB_0: CldiStreamCompleteCanceledRequest(puVar1,0xc000cf16); } while( true ); } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## TlmWriteFltTimeout ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.95| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|TlmWriteFltTimeout|TlmWriteFltTimeout| |fullname|TlmWriteFltTimeout|TlmWriteFltTimeout| |`refcount`|2|3| |length|267|267| |called|NTOSKRNL.EXE::KeQueryUnbiasedInterruptTime
__security_check_cookie
_tlgKeywordOn
_tlgWriteAgg|NTOSKRNL.EXE::KeQueryUnbiasedInterruptTime
__security_check_cookie
_tlgKeywordOn
_tlgWriteAgg| |calling|CldiStreamStartCountdownTimer|CldiStreamStartCountdownTimer| |paramcount|3|3| |`address`|140016bfc|140016cdc| |sig|undefined __fastcall TlmWriteFltTimeout(undefined8 param_1, undefined1 param_2, undefined8 param_3)|undefined __fastcall TlmWriteFltTimeout(undefined8 param_1, undefined1 param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::KeEnterCriticalRegion ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|KeEnterCriticalRegion|KeEnterCriticalRegion| |fullname|NTOSKRNL.EXE::KeEnterCriticalRegion|NTOSKRNL.EXE::KeEnterCriticalRegion| |`refcount`|35|36| |length|0|0| |called||| |`calling`|
Expand for full list:
CldHsmAddCrossContainerNotificationEvent
CldStreamHasPendingRequests
CldStreamQueryProgress
CldiStreamBuildProviderRequest
CldiStreamCdqACQUIRE
CldiStreamCdqINSERT_IO
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamScheduleRequestForMoreProcessing
CldiStreamStartCountdownTimer
HsmFileCacheCloseFileObjectHsmFileCacheCreateFileObject
HsmFileCacheMapData
HsmFileCacheUnpinData
HsmFltPreCLEANUP
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiPropertyLockWait
HsmpCldIsHydrationDisallowed
HsmpCtxCreateStreamHandleContext
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpUninitializePropertyContext
HsmpUnloadPropertyStream
|
Expand for full list:
CldHsmAddCrossContainerNotificationEvent
CldStreamQueryProgress
CldiStreamBuildProviderRequest
CldiStreamCdqACQUIRE
CldiStreamCdqINSERT_IO
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamScheduleRequestForMoreProcessing
CldiStreamStartCountdownTimer
HsmFileCacheCloseFileObject
HsmFileCacheCreateFileObjectHsmFileCacheMapData
HsmFileCacheUnpinData
HsmFltPreCLEANUP
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiPropertyLockWait
HsmpCldIsHydrationDisallowed
HsmpCtxCreateStreamHandleContext
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpUninitializePropertyContext
HsmpUnloadPropertyStream
| |paramcount|0|0| |address|EXTERNAL:00000098|EXTERNAL:00000098| |sig|undefined KeEnterCriticalRegion(void)|undefined KeEnterCriticalRegion(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeEnterCriticalRegion Calling Diff ```diff --- NTOSKRNL.EXE::KeEnterCriticalRegion calling +++ NTOSKRNL.EXE::KeEnterCriticalRegion calling @@ -2 +1,0 @@ -CldStreamHasPendingRequests ``` ## CldiStreamPrepareRequestForNonCdqCompletion ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldiStreamPrepareRequestForNonCdqCompletion|CldiStreamPrepareRequestForNonCdqCompletion| |fullname|CldiStreamPrepareRequestForNonCdqCompletion|CldiStreamPrepareRequestForNonCdqCompletion| |`refcount`|18|19| |length|133|133| |called|CldiStreamPrepareRequestForMoreProcessing
Feature_2089223483__private_IsEnabledDeviceUsageNoInline|CldiStreamPrepareRequestForMoreProcessing
Feature_2089223483__private_IsEnabledDeviceUsageNoInline| |`calling`|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamCdqREMOVE_IO
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamCdqREMOVE_IO
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequestsCldiStreamStartCountdownTimer
| |paramcount|1|1| |`address`|1400110e4|14001110c| |sig|char __fastcall CldiStreamPrepareRequestForNonCdqCompletion(uint * param_1)|char __fastcall CldiStreamPrepareRequestForNonCdqCompletion(uint * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamPrepareRequestForNonCdqCompletion Calling Diff ```diff --- CldiStreamPrepareRequestForNonCdqCompletion calling +++ CldiStreamPrepareRequestForNonCdqCompletion calling @@ -11,0 +12 @@ +CldiStreamStartCountdownTimer ``` ## NTOSKRNL.EXE::ObfDereferenceObject ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|ObfDereferenceObject|ObfDereferenceObject| |fullname|NTOSKRNL.EXE::ObfDereferenceObject|NTOSKRNL.EXE::ObfDereferenceObject| |`refcount`|71|72| |length|0|0| |called||| |calling|
Expand for full list:
CldStreamUninitialize
CldiPortNotifyConnect
CldiPortProcessServiceCommands
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmFileCacheCloseFileObject
HsmFltPostSetRenameInformation
HsmFltPreSetRenameInformation
HsmFltProcessCreatePlaceholders
HsmFltProcessSetPinState
HsmIBitmapNORMALReleaseHsmOsBlockPlaceholderAccessByProcessId
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCreateEnsureDirectoryFullyPopulated
HsmiFileCacheFreeStreamControlBlock
HsmiFltPreECPCREATE
HsmiInfoPrepareForPostRename
HsmiOpenFile
HsmiRecallFreeHydrationContext
HsmiRecallFreePopulationContext
HsmiUnloadPropertyStream
HsmpAccessCheckByFileId
HsmpBuildFullLinkPath
HsmpCaptureProcessInfo
HsmpCldGetSyncPolicyByPath
HsmpCleanupAttributionInformation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamHandleContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpQueryLastEffectiveUsn
HsmpRecallInitiateHydrationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpReportCorruption
HsmpSetCompressionNoLock
HsmpSetupContexts
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpUpdateLastAccessTime
|
Expand for full list:
CldStreamUninitialize
CldiPortNotifyConnect
CldiPortProcessServiceCommands
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmFileCacheCloseFileObject
HsmFltPostSetRenameInformation
HsmFltPreSetRenameInformation
HsmFltProcessCreatePlaceholders
HsmFltProcessSetPinState
HsmIBitmapNORMALReleaseHsmOsBlockPlaceholderAccessByProcessId
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapNORMALCloseOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCreateEnsureDirectoryFullyPopulated
HsmiFileCacheFreeStreamControlBlock
HsmiFltPreECPCREATE
HsmiInfoPrepareForPostRename
HsmiOpenFile
HsmiRecallFreeHydrationContext
HsmiRecallFreePopulationContext
HsmiUnloadPropertyStream
HsmpAccessCheckByFileId
HsmpBuildFullLinkPath
HsmpCaptureProcessInfo
HsmpCldGetSyncPolicyByPath
HsmpCleanupAttributionInformation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamHandleContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpQueryLastEffectiveUsn
HsmpRecallInitiateHydrationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpReportCorruption
HsmpSetCompressionNoLock
HsmpSetupContexts
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpUpdateLastAccessTime
| |paramcount|0|0| |address|EXTERNAL:000000bb|EXTERNAL:000000bb| |sig|undefined ObfDereferenceObject(void)|undefined ObfDereferenceObject(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## NTOSKRNL.EXE::ExReleaseResourceLite ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|ExReleaseResourceLite|ExReleaseResourceLite| |fullname|NTOSKRNL.EXE::ExReleaseResourceLite|NTOSKRNL.EXE::ExReleaseResourceLite| |`refcount`|38|40| |length|0|0| |called||| |`calling`|
Expand for full list:
CldHsmAddCrossContainerNotificationEvent
CldStreamHasPendingRequests
CldStreamQueryProgress
CldiStreamBuildProviderRequest
CldiStreamCdqINSERT_IO
CldiStreamCdqRELEASE
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamScheduleRequestForMoreProcessing
CldiStreamStartCountdownTimer
HsmFltPreCLEANUPHsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessStoreProperties
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiPropertyLockWait
HsmpCldIsHydrationDisallowed
HsmpCtxCreateStreamHandleContext
HsmpDeletePropertyStream
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpUninitializePropertyContext
HsmpUnloadPropertyStream
|
Expand for full list:
CldHsmAddCrossContainerNotificationEvent
CldStreamQueryProgress
CldiStreamBuildProviderRequest
CldiStreamCdqINSERT_IO
CldiStreamCdqRELEASE
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamScheduleRequestForMoreProcessing
CldiStreamStartCountdownTimer
HsmFltPreCLEANUP
HsmFltProcessHSMControlHsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessStoreProperties
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiPropertyLockWait
HsmpCldIsHydrationDisallowed
HsmpCtxCreateStreamHandleContext
HsmpDeletePropertyStream
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpUninitializePropertyContext
HsmpUnloadPropertyStream
| |paramcount|0|0| |address|EXTERNAL:00000091|EXTERNAL:00000091| |sig|undefined ExReleaseResourceLite(void)|undefined ExReleaseResourceLite(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExReleaseResourceLite Calling Diff ```diff --- NTOSKRNL.EXE::ExReleaseResourceLite calling +++ NTOSKRNL.EXE::ExReleaseResourceLite calling @@ -2 +1,0 @@ -CldStreamHasPendingRequests ``` ## HsmDbgBreakOnTimeOut ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.6| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|HsmDbgBreakOnTimeOut|HsmDbgBreakOnTimeOut| |fullname|HsmDbgBreakOnTimeOut|HsmDbgBreakOnTimeOut| |`refcount`|2|3| |length|12|12| |called||| |calling|CldiStreamStartCountdownTimer|CldiStreamStartCountdownTimer| |paramcount|0|0| |`address`|140012ce0|140012dbc| |sig|undefined __fastcall HsmDbgBreakOnTimeOut(void)|undefined __fastcall HsmDbgBreakOnTimeOut(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## FLTMGR.SYS::FltCancelIo ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|FltCancelIo|FltCancelIo| |fullname|FLTMGR.SYS::FltCancelIo|FLTMGR.SYS::FltCancelIo| |`refcount`|7|8| |length|0|0| |called||| |calling|CldiStreamStartCountdownTimer
HsmFltPreCLEANUP
HsmFltPreSetDispositionInformation
HsmFltPreSetRenameInformation
HsmPreLockControlSynchronous
HsmpCldCancelIo|CldiStreamStartCountdownTimer
HsmFltPreCLEANUP
HsmFltPreSetDispositionInformation
HsmFltPreSetRenameInformation
HsmPreLockControlSynchronous
HsmpCldCancelIo| |paramcount|0|0| |address|EXTERNAL:0000013e|EXTERNAL:0000013e| |sig|undefined FltCancelIo(void)|undefined FltCancelIo(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## NTOSKRNL.EXE::KeLeaveCriticalRegion ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|KeLeaveCriticalRegion|KeLeaveCriticalRegion| |fullname|NTOSKRNL.EXE::KeLeaveCriticalRegion|NTOSKRNL.EXE::KeLeaveCriticalRegion| |`refcount`|51|54| |length|0|0| |called||| |`calling`|
Expand for full list:
CldHsmAddCrossContainerNotificationEvent
CldStreamHasPendingRequests
CldStreamQueryProgress
CldiStreamBuildProviderRequest
CldiStreamCdqINSERT_IO
CldiStreamCdqRELEASE
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamScheduleRequestForMoreProcessing
CldiStreamStartCountdownTimer
HsmFileCacheCloseFileObjectHsmFileCacheCloseFileObject$fin$0
HsmFileCacheCreateFileObject
HsmFileCacheCreateFileObject$fin$2
HsmFileCacheMapData
HsmFileCacheMapData$fin$1
HsmFileCacheUnpinData
HsmFileCacheUnpinData$fin$0
HsmFltPreCLEANUP
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessStoreProperties
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiPropertyLockWait
HsmpCldIsHydrationDisallowed
HsmpCtxCreateStreamHandleContext
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCacheFlush$fin$1
HsmpFileCachePreparePinWrite
HsmpFileCachePreparePinWrite$fin$1
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpUninitializePropertyContext
HsmpUnloadPropertyStream
|
Expand for full list:
CldHsmAddCrossContainerNotificationEvent
CldStreamQueryProgress
CldiStreamBuildProviderRequest
CldiStreamCdqINSERT_IO
CldiStreamCdqRELEASE
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamScheduleRequestForMoreProcessing
CldiStreamStartCountdownTimer
HsmFileCacheCloseFileObject
HsmFileCacheCloseFileObject$fin$0HsmFileCacheCreateFileObject
HsmFileCacheCreateFileObject$fin$2
HsmFileCacheMapData
HsmFileCacheMapData$fin$1
HsmFileCacheUnpinData
HsmFileCacheUnpinData$fin$0
HsmFltPreCLEANUP
HsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmFltProcessStoreProperties
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiPropertyLockWait
HsmpCldIsHydrationDisallowed
HsmpCtxCreateStreamHandleContext
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCacheFlush$fin$1
HsmpFileCachePreparePinWrite
HsmpFileCachePreparePinWrite$fin$1
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpUninitializePropertyContext
HsmpUnloadPropertyStream
| |paramcount|0|0| |address|EXTERNAL:0000008c|EXTERNAL:0000008c| |sig|undefined KeLeaveCriticalRegion(void)|undefined KeLeaveCriticalRegion(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeLeaveCriticalRegion Calling Diff ```diff --- NTOSKRNL.EXE::KeLeaveCriticalRegion calling +++ NTOSKRNL.EXE::KeLeaveCriticalRegion calling @@ -2 +1,0 @@ -CldStreamHasPendingRequests ``` ## NTOSKRNL.EXE::ExAcquireResourceExclusiveLite ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|ExAcquireResourceExclusiveLite|ExAcquireResourceExclusiveLite| |fullname|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite| |`refcount`|24|25| |length|0|0| |called||| |`calling`|
Expand for full list:
CldHsmAddCrossContainerNotificationEvent
CldStreamHasPendingRequests
CldStreamQueryProgress
CldiStreamBuildProviderRequest
CldiStreamCdqACQUIRE
CldiStreamCdqINSERT_IO
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamScheduleRequestForMoreProcessing
CldiStreamStartCountdownTimer
HsmFltPreCLEANUPHsmFltProcessHSMControl
HsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiPropertyLockWait
HsmpDeletePropertyStream
HsmpLoadPropertyStream
HsmpUninitializePropertyContext
HsmpUnloadPropertyStream
|
Expand for full list:
CldHsmAddCrossContainerNotificationEvent
CldStreamQueryProgress
CldiStreamBuildProviderRequest
CldiStreamCdqACQUIRE
CldiStreamCdqINSERT_IO
CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamScheduleRequestForMoreProcessing
CldiStreamStartCountdownTimer
HsmFltPreCLEANUP
HsmFltProcessHSMControlHsmFltProcessLockProperties
HsmFltProcessRetrieveProperties
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiPropertyLockWait
HsmpDeletePropertyStream
HsmpLoadPropertyStream
HsmpUninitializePropertyContext
HsmpUnloadPropertyStream
| |paramcount|0|0| |address|EXTERNAL:00000096|EXTERNAL:00000096| |sig|undefined ExAcquireResourceExclusiveLite(void)|undefined ExAcquireResourceExclusiveLite(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAcquireResourceExclusiveLite Calling Diff ```diff --- NTOSKRNL.EXE::ExAcquireResourceExclusiveLite calling +++ NTOSKRNL.EXE::ExAcquireResourceExclusiveLite calling @@ -2 +1,0 @@ -CldStreamHasPendingRequests ``` ## FLTMGR.SYS::FltClose ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|FltClose|FltClose| |fullname|FLTMGR.SYS::FltClose|FLTMGR.SYS::FltClose| |`refcount`|53|54| |length|0|0| |called||| |calling|
Expand for full list:
HsmCldPersistSyncRootInfo
HsmFltPostSetRenameInformation
HsmFltPreSetRenameInformation
HsmFltProcessCreatePlaceholders
HsmFltProcessSetPinState
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFileHsmiBitmapNORMALOpenOnDisk
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCreateEnsureDirectoryFullyPopulated
HsmiInfoPrepareForPostRename
HsmiOpenFile
HsmiUnloadPropertyStream
HsmpAccessCheckByFileId
HsmpBuildFullLinkPath
HsmpCldGetSyncPolicyByPath
HsmpCtxCreateInstanceContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpQueryLastEffectiveUsn
HsmpRecallInitiateHydrationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpReportCorruption
HsmpSetCompressionNoLock
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpUpdateLastAccessTime
|
Expand for full list:
HsmCldPersistSyncRootInfo
HsmFltPostSetRenameInformation
HsmFltPreSetRenameInformation
HsmFltProcessCreatePlaceholders
HsmFltProcessSetPinState
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFileHsmiBitmapNORMALOpenOnDisk
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCreateEnsureDirectoryFullyPopulated
HsmiInfoPrepareForPostRename
HsmiOpenFile
HsmiUnloadPropertyStream
HsmpAccessCheckByFileId
HsmpBuildFullLinkPath
HsmpCldGetSyncPolicyByPath
HsmpCtxCreateInstanceContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpGetPropertyStreamSize
HsmpLoadPropertyStream
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpQueryLastEffectiveUsn
HsmpRecallInitiateHydrationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpReportCorruption
HsmpSetCompressionNoLock
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpUpdateLastAccessTime
| |paramcount|0|0| |address|EXTERNAL:00000121|EXTERNAL:00000121| |sig|undefined FltClose(void)|undefined FltClose(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## wil_details_IsEnabledFallback ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|16|19| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|
Expand for full list:
Feature_1008182587__private_IsEnabledFallback
Feature_1966059833__private_IsEnabledFallback
Feature_2089223483__private_IsEnabledFallback
Feature_2092950840__private_IsEnabledFallback
Feature_2617485625__private_IsEnabledFallback
Feature_3051065658__private_IsEnabledFallback
Feature_4003440952__private_IsEnabledFallback
Feature_4003697978__private_IsEnabledFallback
Feature_510375226__private_IsEnabledFallback
Feature_955245880__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallbackFeature_Cldflt_BitmapNullValueCheck__private_IsEnabledFallback
Feature_CloudFilesCrashInLogFailStreamContextAllocation__private_IsEnabledFallback
Feature_CloudFilesCrashReadingProcessImageName__private_IsEnabledFallback
Feature_CloudFilesKASANCrashInGapFilling__private_IsEnabledFallback
|
Expand for full list:
Feature_1008182587__private_IsEnabledFallback
Feature_1245077819__private_IsEnabledFallback
Feature_1966059833__private_IsEnabledFallback
Feature_2089223483__private_IsEnabledFallback
Feature_2092950840__private_IsEnabledFallback
Feature_2617485625__private_IsEnabledFallback
Feature_3051065658__private_IsEnabledFallback
Feature_3750208824__private_IsEnabledFallback
Feature_4003440952__private_IsEnabledFallback
Feature_4003697978__private_IsEnabledFallback
Feature_510375226__private_IsEnabledFallbackFeature_544180536__private_IsEnabledFallback
Feature_955245880__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallback
Feature_Cldflt_BitmapNullValueCheck__private_IsEnabledFallback
Feature_CloudFilesCrashInLogFailStreamContextAllocation__private_IsEnabledFallback
Feature_CloudFilesCrashReadingProcessImageName__private_IsEnabledFallback
Feature_CloudFilesKASANCrashInGapFilling__private_IsEnabledFallback
| |paramcount|3|3| |address|14000c14c|14000c14c| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1,0 +2 @@ +Feature_1245077819__private_IsEnabledFallback @@ -6,0 +8 @@ +Feature_3750208824__private_IsEnabledFallback @@ -9,0 +12 @@ +Feature_544180536__private_IsEnabledFallback ``` ## HsmpAccessCheck ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.89| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|HsmpAccessCheck|HsmpAccessCheck| |fullname|HsmpAccessCheck|HsmpAccessCheck| |`refcount`|6|8| |length|889|889| |called|
Expand for full list:
FLTMGR.SYS::FltQuerySecurityObject
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetFileObjectGenericMapping
NTOSKRNL.EXE::SeAccessCheck
NTOSKRNL.EXE::SeCaptureSubjectContext
NTOSKRNL.EXE::SeLockSubjectContext
NTOSKRNL.EXE::SePrivilegeCheck
NTOSKRNL.EXE::SeReleaseSubjectContext
NTOSKRNL.EXE::SeUnlockSubjectContextWPP_SF_qid
__security_check_cookie
|
Expand for full list:
FLTMGR.SYS::FltQuerySecurityObject
HsmDbgBreakOnStatus
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetFileObjectGenericMapping
NTOSKRNL.EXE::SeAccessCheck
NTOSKRNL.EXE::SeCaptureSubjectContext
NTOSKRNL.EXE::SeLockSubjectContext
NTOSKRNL.EXE::SePrivilegeCheck
NTOSKRNL.EXE::SeReleaseSubjectContext
NTOSKRNL.EXE::SeUnlockSubjectContextWPP_SF_qid
__security_check_cookie
| |calling|CldiPortProcessServiceCommands
HsmiOpPrepareOperation
HsmpAccessCheckByFileId
HsmpOpCreatePlaceholders|CldiPortProcessServiceCommands
HsmiOpPrepareOperation
HsmpAccessCheckByFileId
HsmpOpCreatePlaceholders| |paramcount|3|3| |`address`|14005c3f0|14005c590| |sig|int __fastcall HsmpAccessCheck(longlong param_1, ulonglong param_2, uint param_3)|int __fastcall HsmpAccessCheck(longlong param_1, ulonglong param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## FLTMGR.SYS::FltCreateFileEx ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|FltCreateFileEx|FltCreateFileEx| |fullname|FLTMGR.SYS::FltCreateFileEx|FLTMGR.SYS::FltCreateFileEx| |`refcount`|9|10| |length|0|0| |called||| |calling|HsmFltProcessSetPinState
HsmiCldOpenSyncRoot
HsmiCreateEnsureDirectoryFullyPopulated
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById|HsmFltProcessSetPinState
HsmiCldOpenSyncRoot
HsmiCreateEnsureDirectoryFullyPopulated
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById| |paramcount|0|0| |address|EXTERNAL:00000118|EXTERNAL:00000118| |sig|undefined FltCreateFileEx(void)|undefined FltCreateFileEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## CldiStreamCdqRELEASE ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldiStreamCdqRELEASE|CldiStreamCdqRELEASE| |fullname|CldiStreamCdqRELEASE|CldiStreamCdqRELEASE| |`refcount`|47|50| |length|37|37| |called|NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeLeaveCriticalRegion|NTOSKRNL.EXE::ExReleaseResourceLite
NTOSKRNL.EXE::KeLeaveCriticalRegion| |`calling`|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldStreamCdqRELEASE
CldStreamReportProgress
CldiStreamBuildProviderRequest
CldiStreamCancelSynchronousRequestCldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamCompleteProviderRequest
CldiStreamCompleteRequest
CldiStreamDeleteRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
HsmpCompletePendedDehydrationRequests
HsmpQueueDehydrationRequest
|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldStreamCdqRELEASE
CldStreamHasPendingRequests
CldStreamReportProgress
CldiStreamBuildProviderRequestCldiStreamCancelSynchronousRequest
CldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamCompleteProviderRequest
CldiStreamCompleteRequest
CldiStreamDeleteRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
CldiStreamStartCountdownTimer
HsmpCompletePendedDehydrationRequests
HsmpQueueDehydrationRequest
| |paramcount|1|1| |`address`|14004b410|14004cd90| |sig|undefined __fastcall CldiStreamCdqRELEASE(longlong param_1)|undefined __fastcall CldiStreamCdqRELEASE(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCdqRELEASE Calling Diff ```diff --- CldiStreamCdqRELEASE calling +++ CldiStreamCdqRELEASE calling @@ -8,0 +9 @@ +CldStreamHasPendingRequests @@ -18,0 +20 @@ +CldiStreamStartCountdownTimer ``` ## CldiStreamCdqACQUIRE ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldiStreamCdqACQUIRE|CldiStreamCdqACQUIRE| |fullname|CldiStreamCdqACQUIRE|CldiStreamCdqACQUIRE| |`refcount`|28|29| |length|48|48| |called|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::KeEnterCriticalRegion|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::KeEnterCriticalRegion| |`calling`|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldStreamCdqACQUIRE
CldStreamReportProgress
CldiStreamBuildProviderRequest
CldiStreamCancelSynchronousRequestCldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamCompleteCanceledRequest
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
HsmpCompletePendedDehydrationRequests
HsmpQueueDehydrationRequest
|
Expand for full list:
CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmHydratePlaceholder
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldStreamCdqACQUIRE
CldStreamHasPendingRequests
CldStreamReportProgress
CldiStreamBuildProviderRequestCldiStreamCancelSynchronousRequest
CldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamCompleteCanceledRequest
CldiStreamCompleteProviderRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
HsmpCompletePendedDehydrationRequests
HsmpQueueDehydrationRequest
| |paramcount|1|1| |`address`|14004b3d0|140078a50| |sig|undefined __fastcall CldiStreamCdqACQUIRE(longlong param_1)|undefined __fastcall CldiStreamCdqACQUIRE(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCdqACQUIRE Calling Diff ```diff --- CldiStreamCdqACQUIRE calling +++ CldiStreamCdqACQUIRE calling @@ -8,0 +9 @@ +CldStreamHasPendingRequests ``` ## CldiStreamInsertIntoGlobalRequestListNoLock ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldiStreamInsertIntoGlobalRequestListNoLock|CldiStreamInsertIntoGlobalRequestListNoLock| |fullname|CldiStreamInsertIntoGlobalRequestListNoLock|CldiStreamInsertIntoGlobalRequestListNoLock| |`refcount`|6|7| |length|141|141| |called|CldiStreamSignalEvents|CldiStreamSignalEvents| |calling|CldiStreamBuildProviderRequest
CldiStreamCdqINSERT_IO
CldiStreamCompleteRequest
CldiStreamScheduleRequestForMoreProcessing
CldiStreamStartCountdownTimer|CldiStreamBuildProviderRequest
CldiStreamCdqINSERT_IO
CldiStreamCompleteRequest
CldiStreamScheduleRequestForMoreProcessing
CldiStreamStartCountdownTimer| |paramcount|1|1| |address|14000cf64|14000cf64| |sig|undefined __fastcall CldiStreamInsertIntoGlobalRequestListNoLock(uint * param_1)|undefined __fastcall CldiStreamInsertIntoGlobalRequestListNoLock(uint * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## WPP_SF_qid ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.95| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|WPP_SF_qid|WPP_SF_qid| |fullname|WPP_SF_qid|WPP_SF_qid| |`refcount`|112|113| |length|87|87| |called|_guard_dispatch_icall|_guard_dispatch_icall| |`calling`|
Expand for full list:
CldHsmCreateStreamHandleContext
CldStreamOpen
CldStreamQueryProgress
CldSyncDisconnectRootByObject
CldSyncReportSyncStatusOnRoot
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldiPortProcessRetrieveDataCldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiSyncCreateRootNoLock
CldiSyncInitializeRootNoLock
HsmFileCacheCreateFileObject
HsmFileCacheMapData
HsmFltPreDIRECTORY_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltProcessConvertPlaceholder
HsmFltProcessQueryPlaceholder
HsmFltProcessSetPinState
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootInfoByFileObject
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFltPreECPCREATE
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiIsUnsupportedLogfilePlaceholder
HsmiOpInheritPinStatePre
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiPrepareBitmapCommit
HsmiQueryFullFilePath
HsmiUpdateFileAttributes
HsmpAccessCheck
HsmpBuildFullLinkPath
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpFileCacheFlush
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpQueryLastEffectiveUsn
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpSetCompressionNoLock
HsmpSetupContexts
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
|
Expand for full list:
CldHsmCreateStreamHandleContext
CldStreamOpen
CldStreamQueryProgress
CldSyncDisconnectRootByObject
CldSyncReportSyncStatusOnRoot
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldiPortProcessRetrieveDataCldiPortProcessServiceCommands
CldiPortProcessTransferData
CldiStreamStartCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncInitializeRootNoLock
HsmFileCacheCreateFileObject
HsmFileCacheMapData
HsmFltPreDIRECTORY_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltProcessConvertPlaceholder
HsmFltProcessQueryPlaceholder
HsmFltProcessSetPinState
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootInfoByFileObject
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFltPreECPCREATE
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiIsUnsupportedLogfilePlaceholder
HsmiOpInheritPinStatePre
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiPrepareBitmapCommit
HsmiQueryFullFilePath
HsmiUpdateFileAttributes
HsmpAccessCheck
HsmpBuildFullLinkPath
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpFileCacheFlush
HsmpLoadPropertyStream
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpQueryLastEffectiveUsn
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpSetCompressionNoLock
HsmpSetupContexts
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
| |paramcount|4|4| |address|14000a694|14000a694| |sig|undefined __fastcall WPP_SF_qid(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_qid(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_qid Calling Diff ```diff --- WPP_SF_qid calling +++ WPP_SF_qid calling @@ -13,0 +14 @@ +CldiStreamStartCountdownTimer ``` ## CldiCanDoNonCdqCompletion ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.98| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldiCanDoNonCdqCompletion|CldiCanDoNonCdqCompletion| |fullname|CldiCanDoNonCdqCompletion|CldiCanDoNonCdqCompletion| |`refcount`|9|10| |length|131|131| |called|CldiStreamGetCdq
FLTMGR.SYS::FltCbdqRemoveIo|CldiStreamGetCdq
FLTMGR.SYS::FltCbdqRemoveIo| |`calling`|CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests|CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamProcessPendingHydrationRequests
CldiStreamProcessPendingNotificationRequests
CldiStreamProcessPendingPopulationRequests
CldiStreamStartCountdownTimer| |paramcount|1|1| |address|140011004|140011004| |sig|undefined8 __fastcall CldiCanDoNonCdqCompletion(longlong param_1)|undefined8 __fastcall CldiCanDoNonCdqCompletion(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiCanDoNonCdqCompletion Calling Diff ```diff --- CldiCanDoNonCdqCompletion calling +++ CldiCanDoNonCdqCompletion calling @@ -8,0 +9 @@ +CldiStreamStartCountdownTimer ``` ## CldiStreamCompleteCanceledRequest ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldiStreamCompleteCanceledRequest|CldiStreamCompleteCanceledRequest| |fullname|CldiStreamCompleteCanceledRequest|CldiStreamCompleteCanceledRequest| |`refcount`|8|9| |length|657|657| |called|CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldiStreamCdqACQUIRE
CldiStreamCompleteRequest
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmpGetStreamSize
TlmWriteCvForCldStreamCancelIO
WPP_SF_iqLd
WPP_SF_qqiqdd|CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldiStreamCdqACQUIRE
CldiStreamCompleteRequest
Feature_2089223483__private_IsEnabledDeviceUsageNoInline
HsmpGetStreamSize
TlmWriteCvForCldStreamCancelIO
WPP_SF_iqLd
WPP_SF_qqiqdd| |`calling`|CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamCdqCOMPLETE_CANCELED_IO|CldHsmCancelAllRequests
CldHsmCancelSynchronousCbd
CldHsmTerminateProgressiveHydration
CldStreamAbortOperation
CldiStreamCancelSynchronousRequest
CldiStreamCdqCOMPLETE_CANCELED_IO
CldiStreamStartCountdownTimer| |paramcount|2|2| |`address`|140042270|1400420b0| |sig|undefined __fastcall CldiStreamCompleteCanceledRequest(uint * param_1, uint param_2)|undefined __fastcall CldiStreamCompleteCanceledRequest(uint * param_1, uint param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CldiStreamCompleteCanceledRequest Calling Diff ```diff --- CldiStreamCompleteCanceledRequest calling +++ CldiStreamCompleteCanceledRequest calling @@ -6,0 +7 @@ +CldiStreamStartCountdownTimer ``` ## CldiStreamRemoveFromGlobalRequestListNoLock ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldiStreamRemoveFromGlobalRequestListNoLock|CldiStreamRemoveFromGlobalRequestListNoLock| |fullname|CldiStreamRemoveFromGlobalRequestListNoLock|CldiStreamRemoveFromGlobalRequestListNoLock| |`refcount`|4|6| |length|115|115| |called|CldiStreamSignalEvents|CldiStreamSignalEvents| |calling|CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamStartCountdownTimer|CldiStreamCompleteRequest
CldiStreamPrepareRequestForMoreProcessing
CldiStreamStartCountdownTimer| |paramcount|1|1| |address|14000a7f0|14000a7f0| |sig|bool __fastcall CldiStreamRemoveFromGlobalRequestListNoLock(uint * param_1)|bool __fastcall CldiStreamRemoveFromGlobalRequestListNoLock(uint * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## HsmDbgBreakOnStatus ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.77| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|HsmDbgBreakOnStatus|HsmDbgBreakOnStatus| |fullname|HsmDbgBreakOnStatus|HsmDbgBreakOnStatus| |`refcount`|1481|1482| |length|147|147| |called|HsmpGetRegDword
NTOSKRNL.EXE::IoGetCurrentProcess|HsmpGetRegDword
NTOSKRNL.EXE::IoGetCurrentProcess| |calling|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldHsmGetSyncPolicy
CldHsmGetSyncPolicyByPath
CldHsmGetSyncProviderProcessByPath
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncRootInfoByPathCldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldHsmInitialize
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldLookupSyncRoot
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldPortSendUpstreamMessage
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamRestartHydration
CldStreamRetrieveData
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncAccessCheck
CldSyncAckDehydrate
CldSyncAckDelete
CldSyncAckRename
CldSyncConnectRoot
CldSyncGetPlaceholderRangeInfo
CldSyncGetPolicy
CldSyncGetRootInfo
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncRegisterStream
CldSyncReportProgress
CldSyncReportSyncStatusOnRoot
CldSyncRestartHydration
CldSyncRetrieveData
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldSyncSetSyncStatusOnStream
CldSyncTransferPlaceholders
CldiPortAccessCheck
CldiPortAddCrossVmProgressEvent
CldiPortCheckAllSystemsGo
CldiPortInsertSyncRootNoLock
CldiPortLookupAndReferenceSyncRoot
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessFilterControl
CldiPortProcessGetRangeInfo
CldiPortProcessGlobal
CldiPortProcessQueryProgress
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransfer
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamProcessPendingHydrationRequests
CldiStreamRestartCountdownTimer
CldiStreamServiceHydrationRequest
CldiStreamStopCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncReferenceRoot
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CldiSyncTransferOrAckData
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmDriverEntry
HsmExpandKernelStackAndCallout
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFileCacheMapData
HsmFltInstanceQueryTeardown
HsmFltPostLOCK_CONTROL
HsmFltPostSetRenameInformation
HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION
HsmFltPreCLEANUP
HsmFltPreDIRECTORY_CONTROL
HsmFltPreFILE_SYSTEM_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltPreREAD
HsmFltPreSET_EA
HsmFltPreSET_INFORMATION
HsmFltPreSET_PURGE_FAILURE_MODE
HsmFltPreSET_REPARSE_POINT
HsmFltPreSET_REPARSE_POINT_EX
HsmFltPreSET_ZERO_DATA
HsmFltPreSetBasicInformation
HsmFltPreSetDispositionInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltPreWRITE
HsmFltProcessClearInSync
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessGetCorrelationVector
HsmFltProcessGetLastSyncStatus
HsmFltProcessHSMControl
HsmFltProcessHydrate
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessQueryStreamKey
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetCorrelationVector
HsmFltProcessSetInSync
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmPreLockControlSynchronous
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapCheckVersion
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALLoadFromDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapNORMALVerifyBitmapPages
HsmiBitmapNormalDeleteStream
HsmiBitmapNormalOpenStream
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompleteLockCallbackDataRoutine
HsmiCompressBuffer
HsmiCreateAllocateECPTags
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiExpandBitmapNoLock
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiFileCacheWriteCompletion
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiInfoRecallForRenameCompletion
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiIsUnsupportedLogfilePlaceholder
HsmiMarkFileRangeNoLock
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpInheritPinStatePre
HsmiOpPrepareOperation
HsmiOpRevertCompletion
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOpenFile
HsmiPrepareBitmapCommit
HsmiProcessPropertyLockRequestList
HsmiPropertyLockWait
HsmiQueryFileRangeNoLock
HsmiQueryFileRangesTotalNoLock
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallAllocatePopulationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmiRecallWriteFileNoLock
HsmiRpInitializeTable
HsmiUpdateFileAttributes
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpAccessCheckByFileId
HsmpAcquireFileNameLock
HsmpAcquireSyncOpRundownProtection
HsmpAcquireUserRequestRundownProtection
HsmpBitmapCreateSnapshot
HsmpBitmapGetRangeState
HsmpBitmapIsReparseBufferSupported
HsmpBitmapQueryRange
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo
HsmpCldIsHydrationDisallowed
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpCtxGetOrCreateFileContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpFileCacheSetFileSize
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpLoadPropertyStream
HsmpMarkHandleUsnSourceInfo
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpProcessQueryRangeStateHelper
HsmpQueryLastEffectiveUsn
HsmpQueryModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpBuildBuffer
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpRpValidateBuffer
HsmpRpiDecompressBuffer
HsmpSetCompressionNoLock
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpSetupContexts
HsmpToggleFileAttributes
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
HsmpUpdateLastAccessTime
HsmpValidateAttributionEcp
HsmpValidateStreamContextNoLock
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
|
Expand for full list:
CldCaptureProcessInfo
CldHsmAddCrossContainerNotificationEvent
CldHsmCreateFileContext
CldHsmCreateInstanceContext
CldHsmCreateStreamContext
CldHsmCreateStreamHandleContext
CldHsmGetSyncPolicy
CldHsmGetSyncPolicyByPath
CldHsmGetSyncProviderProcessByPath
CldHsmGetSyncRootFileIdByPath
CldHsmGetSyncRootInfoByPathCldHsmGetSyncStatus
CldHsmHydratePlaceholder
CldHsmInitialize
CldHsmNotifyPreOperation
CldHsmPopulatePlaceholders
CldHsmTerminateProgressiveHydration
CldLookupSyncRoot
CldPortInitialize
CldPortSendCancelHydrationMessage
CldPortSendCancelNotificationMessage
CldPortSendCancelPopulationMessage
CldPortSendHydrationMessage
CldPortSendPopulationMessage
CldPortSendPostOpMessage
CldPortSendPreOpMessage
CldPortSendUpstreamMessage
CldStreamAckData
CldStreamGetPlaceholderRangeInfo
CldStreamInitialize
CldStreamOpen
CldStreamQueryProgress
CldStreamRestartHydration
CldStreamRetrieveData
CldStreamSetSyncStatus
CldStreamTransferData
CldStreamTransferPlaceholders
CldSyncAccessCheck
CldSyncAckDehydrate
CldSyncAckDelete
CldSyncAckRename
CldSyncConnectRoot
CldSyncGetPlaceholderRangeInfo
CldSyncGetPolicy
CldSyncGetRootInfo
CldSyncGetSyncStatusOnRoot
CldSyncLookupRootByName
CldSyncRegisterStream
CldSyncReportProgress
CldSyncReportSyncStatusOnRoot
CldSyncRestartHydration
CldSyncRetrieveData
CldSyncSendCancelHydrationRequest
CldSyncSendCancelNotificationRequest
CldSyncSendCancelPopulationRequest
CldSyncSendHydrationRequest
CldSyncSendPopulationRequest
CldSyncSendPostNotification
CldSyncSendPreNotification
CldSyncSetSyncStatusOnStream
CldSyncTransferPlaceholders
CldiPortAccessCheck
CldiPortAddCrossVmProgressEvent
CldiPortCheckAllSystemsGo
CldiPortInsertSyncRootNoLock
CldiPortLookupAndReferenceSyncRoot
CldiPortNotifyConnect
CldiPortNotifyMessage
CldiPortProcessAbortHydration
CldiPortProcessAckData
CldiPortProcessAckNotification
CldiPortProcessFilterControl
CldiPortProcessGetRangeInfo
CldiPortProcessGlobal
CldiPortProcessQueryProgress
CldiPortProcessReportProgress
CldiPortProcessRestartHydration
CldiPortProcessRetrieveData
CldiPortProcessServiceCommands
CldiPortProcessTransfer
CldiPortProcessTransferData
CldiPortProcessTransferPlaceholders
CldiPortSetSyncStatus
CldiStreamAckNotification
CldiStreamBuildProviderRequest
CldiStreamCompleteRequest
CldiStreamInsertIntoCancelSafeQueue
CldiStreamProcessPendingHydrationRequests
CldiStreamRestartCountdownTimer
CldiStreamServiceHydrationRequest
CldiStreamStopCountdownTimer
CldiSyncCreateRootNoLock
CldiSyncEnsurePendingRanges
CldiSyncInitializeRootNoLock
CldiSyncInsertPendingRange
CldiSyncReferenceRoot
CldiSyncSetSyncStatusOnRoot
CldiSyncSplitPendingRange
CldiSyncTransferOrAckData
CldiSyncTransferOrAckDataByObject
CldiSyncTransferPlaceholdersByObject
HsmCldDeleteSyncRootInfo
HsmCldPersistSyncRootInfo
HsmCreateOrOpenNamedEvent
HsmDriverEntry
HsmExpandKernelStackAndCallout
HsmFileCacheCreateFileObject
HsmFileCacheInitialize
HsmFileCacheMapData
HsmFltInstanceQueryTeardown
HsmFltPostLOCK_CONTROL
HsmFltPostSetRenameInformation
HsmFltPreACQUIRE_FOR_SECTION_SYNCHRONIZATION
HsmFltPreCLEANUP
HsmFltPreDIRECTORY_CONTROL
HsmFltPreFILE_SYSTEM_CONTROL
HsmFltPreLOCK_CONTROL
HsmFltPreQUERY_ALLOCATED_RANGES
HsmFltPreREAD
HsmFltPreSET_EA
HsmFltPreSET_INFORMATION
HsmFltPreSET_PURGE_FAILURE_MODE
HsmFltPreSET_REPARSE_POINT
HsmFltPreSET_REPARSE_POINT_EX
HsmFltPreSET_ZERO_DATA
HsmFltPreSetBasicInformation
HsmFltPreSetDispositionInformation
HsmFltPreSetLinkInformation
HsmFltPreSetRenameInformation
HsmFltPreWRITE
HsmFltProcessClearInSync
HsmFltProcessConvertPlaceholder
HsmFltProcessCreatePlaceholders
HsmFltProcessDehydrate
HsmFltProcessGetCorrelationVector
HsmFltProcessGetLastSyncStatus
HsmFltProcessHSMControl
HsmFltProcessHydrate
HsmFltProcessLockProperties
HsmFltProcessQueryPlaceholder
HsmFltProcessQueryStreamKey
HsmFltProcessRetrieveProperties
HsmFltProcessRevert
HsmFltProcessSetCorrelationVector
HsmFltProcessSetInSync
HsmFltProcessSetPinState
HsmFltProcessStoreProperties
HsmFltProcessUpdatePlaceholder
HsmIBitmapNORMALCreate
HsmIBitmapNORMALMarkRangeEx
HsmIBitmapNORMALMayContainDirtyRange
HsmIBitmapNORMALOpen
HsmIBitmapNORMALPrepareCommit
HsmIBitmapNORMALQueryRangeEx
HsmIBitmapVOLATILEMarkRangeEx
HsmPreLockControlSynchronous
HsmProcessGetPlaceholderRangeInfo
HsmRecallAckData
HsmRecallRetrieveData
HsmRecallTransferData
HsmRecallTransferPlaceholders
HsmRecallUpdatePlaceholderFile
HsmiBitmapCheckVersion
HsmiBitmapNORMALDeleteOnDisk
HsmiBitmapNORMALEnsureOpened
HsmiBitmapNORMALFlushBitmapOnDisk
HsmiBitmapNORMALLoadFromDisk
HsmiBitmapNORMALMapBlock
HsmiBitmapNORMALMarkBitmapOnDisk
HsmiBitmapNORMALOpenOnDisk
HsmiBitmapNORMALPrepareBlockForWrite
HsmiBitmapNORMALPrepareMcbsForCommit
HsmiBitmapNORMALVerifyBitmapPages
HsmiBitmapNormalDeleteStream
HsmiBitmapNormalOpenStream
HsmiCldGetSyncProviderProcess
HsmiCldGetSyncRootFileIdByFileObject
HsmiCldGetSyncRootFileIdByPath
HsmiCldGetSyncRootInfo
HsmiCldGetSyncRootInfoByFileObject
HsmiCldGetSyncRootInfoByPath
HsmiCldLoadSyncRootInfoByFileId
HsmiCldLoadSyncRootInfoByFileObject
HsmiCldOpenSyncRoot
HsmiCompleteLockCallbackDataRoutine
HsmiCompressBuffer
HsmiCreateAllocateECPTags
HsmiCreateEnsureDirectoryFullyPopulated
HsmiCtxCreateFileContext
HsmiCtxGetOrCreateFileContext
HsmiExpandBitmapNoLock
HsmiFileCacheAllocateStreamControlBlock
HsmiFileCacheIrpClose
HsmiFileCacheIrpQueryInformation
HsmiFileCacheIrpRead
HsmiFileCacheIrpWrite
HsmiFileCacheValidateFileObject
HsmiFileCacheWriteCompletion
HsmiFltPostECPCREATE
HsmiFltPreECPCREATE
HsmiGrantLockRequest
HsmiInfoHydratePlaceholderOnRename
HsmiInfoPopulatePlaceholderOnRename
HsmiInfoPrepareForPostRename
HsmiInfoPrepareForPostSetDispostionInformation
HsmiInfoRecallForRenameCompletion
HsmiInfoUpdatePlaceholderStatesOnRenamePre
HsmiIsFileAttributeChangeRequired
HsmiIsUnsupportedLogfilePlaceholder
HsmiMarkFileRangeNoLock
HsmiMungeQueryDirectory
HsmiOOBECompleteWnfCallback
HsmiOpDehydrateNotificationCallback
HsmiOpInheritPinStatePre
HsmiOpPrepareOperation
HsmiOpRevertCompletion
HsmiOpSetPinStateInternal
HsmiOpUpdateInSyncState
HsmiOpUpdatePlaceholderDirectory
HsmiOpUpdatePlaceholderFile
HsmiOpenFile
HsmiPrepareBitmapCommit
HsmiProcessPropertyLockRequestList
HsmiPropertyLockWait
HsmiQueryFileRangeNoLock
HsmiQueryFileRangesTotalNoLock
HsmiQueryFullFilePath
HsmiRecallAllocateHydrationContext
HsmiRecallAllocatePopulationContext
HsmiRecallInitiateHydration
HsmiRecallPostProcessUserHydrationRequest
HsmiRecallWriteFileNoLock
HsmiRpInitializeTable
HsmiUpdateFileAttributes
HsmiValidateAndAttachAttributionEcpToStreamHandleContext
HsmpAccessCheck
HsmpAccessCheckByFileId
HsmpAcquireFileNameLock
HsmpAcquireSyncOpRundownProtection
HsmpAcquireUserRequestRundownProtection
HsmpBitmapCreateSnapshot
HsmpBitmapGetRangeState
HsmpBitmapIsReparseBufferSupported
HsmpBitmapQueryRange
HsmpBuildFullLinkPath
HsmpCheckLegacyFilterAbsence
HsmpCldCheckSyncProviderAccess
HsmpCldGetSyncPolicy
HsmpCldGetSyncPolicyByPath
HsmpCldGetSyncRootBasicInfo
HsmpCldGetSyncRootFileIdEx
HsmpCldGetSyncRootProviderInfo
HsmpCldGetSyncRootStandardInfo
HsmpCldIsHydrationDisallowed
HsmpCldNotifyPostOperation
HsmpCldNotifyPreOperation
HsmpCtxCreateInstanceContext
HsmpCtxCreateStreamContext
HsmpCtxCreateStreamHandleContext
HsmpCtxGetOrCreateFileContext
HsmpDeleteAlternateStream
HsmpDeleteAlternateStreamById
HsmpDeletePropertyStream
HsmpFileCacheFlush
HsmpFileCachePreparePinWrite
HsmpFileCacheSetFileSize
HsmpFillOutAttributionInformation
HsmpGetAttributionInformation
HsmpLoadPropertyStream
HsmpMarkHandleUsnSourceInfo
HsmpNotifyDataChange
HsmpOpCreatePlaceholders
HsmpOpenFileById
HsmpOpenFileByIdEx
HsmpOpenFileByPath
HsmpPrepareForMgmtOperation
HsmpProcessQueryRangeStateHelper
HsmpQueryLastEffectiveUsn
HsmpQueryModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangeNoLock
HsmpQueryValidatedNonModifiedRangesTotalNoLock
HsmpQueueDehydrationRequest
HsmpRecallInitiateHydrationEx
HsmpRecallInitiatePopulationEx
HsmpRecurseDirectory
HsmpRelativeStreamOpen
HsmpRelativeStreamOpenById
HsmpRpBuildBuffer
HsmpRpCommitNoLock
HsmpRpCreate
HsmpRpReadBuffer
HsmpRpRemove
HsmpRpValidateBuffer
HsmpRpiDecompressBuffer
HsmpSetCompressionNoLock
HsmpSetFileDisposition
HsmpSetFileVDL
HsmpSetupContexts
HsmpToggleFileAttributes
HsmpToggleFileAttributesNoNotify
HsmpToggleFileAttributesNotify
HsmpToggleFileSparseAttribute
HsmpUpdateLastAccessTime
HsmpValidateAttributionEcp
HsmpValidateStreamContextNoLock
QueryIfEAExists
TlmInitializeCorrelationVector
TlmWriteFilterAttachEvent
| |paramcount|1|1| |address|140003d70|140003d70| |sig|undefined __fastcall HsmDbgBreakOnStatus(int param_1)|undefined __fastcall HsmDbgBreakOnStatus(int param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## CldiStreamIsRequestExpired ### Match Info |Key|cldflt-2026-08.sys - cldflt-2026-09.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cldflt-2026-08.sys|cldflt-2026-09.sys| | :---: | :---: | :---: | |name|CldiStreamIsRequestExpired|CldiStreamIsRequestExpired| |fullname|CldiStreamIsRequestExpired|CldiStreamIsRequestExpired| |`refcount`|2|3| |length|81|81| |called|CldSyncGetProviderLastSuccessfulTransferTime|CldSyncGetProviderLastSuccessfulTransferTime| |calling|CldiStreamStartCountdownTimer|CldiStreamStartCountdownTimer| |paramcount|2|2| |`address`|1400428ac|1400426ec| |sig|bool __fastcall CldiStreamIsRequestExpired(longlong param_1, longlong param_2)|bool __fastcall CldiStreamIsRequestExpired(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| Generated with `ghidriff` version: 1.0.0 on 2026-09-09T18:15:07