# clfs-3624.sys-clfs-3775.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_2931883321__private_IsEnabledDeviceUsageNoInline](#feature_2931883321__private_isenableddeviceusagenoinline) * [Feature_2931883321__private_IsEnabledFallback](#feature_2931883321__private_isenabledfallback) * [Modified](#modified) * [CClfsRequest::Close](#cclfsrequestclose) * [CClfsLogCcb::Cleanup](#cclfslogccbcleanup) * [`CClfsRequest::Close'::__l1::fin$0](#cclfsrequestclose__l1fin0) * [Feature_2633002298__private_IsEnabledFallback](#feature_2633002298__private_isenabledfallback) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [Modified (No Code Changes)](#modified-no-code-changes) * [AddRef](#addref) * [Release](#release) # Visual Chart Diff ```mermaid flowchart LR CClfsRequestClose-1-old<--Match 69%-->CClfsRequestClose-1-new CClfsLogCcbCleanup-1-old<--Match 51%-->CClfsLogCcbCleanup-1-new CClfsRequestClose__l1fin0-2-old<--Match 81%-->CClfsRequestClose__l1fin0-2-new Feature_2633002298__private_IsEnabledFallback-2-old<--Match 89%-->Feature_2633002298__private_IsEnabledFallback-2-new wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old<--Match 95%-->wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new wil_details_FeatureReporting_ReportUsageToService-3-old<--Match 94%-->wil_details_FeatureReporting_ReportUsageToService-3-new wil_details_IsEnabledFallback-2-old<--Match 94%-->wil_details_IsEnabledFallback-2-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-old<--Match 90%-->wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-new subgraph clfs-3775.sys CClfsRequestClose-1-new CClfsLogCcbCleanup-1-new CClfsRequestClose__l1fin0-2-new Feature_2633002298__private_IsEnabledFallback-2-new wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new wil_details_FeatureReporting_ReportUsageToService-3-new wil_details_IsEnabledFallback-2-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-new subgraph Added direction LR Feature_2931883321__private_IsEnabledDeviceUsageNoInline Feature_2931883321__private_IsEnabledFallback end end subgraph clfs-3624.sys CClfsRequestClose-1-old CClfsLogCcbCleanup-1-old CClfsRequestClose__l1fin0-2-old Feature_2633002298__private_IsEnabledFallback-2-old wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old wil_details_FeatureReporting_ReportUsageToService-3-old wil_details_IsEnabledFallback-2-old wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-old end ``` ```mermaid pie showData title Function Matches - 99.9448% "unmatched_funcs_len" : 2 "matched_funcs_len" : 3622 ``` ```mermaid pie showData title Matched Function Similarity - 99.7239% "matched_funcs_with_code_changes_len" : 8 "matched_funcs_with_non_code_changes_len" : 2 "matched_funcs_no_changes_len" : 3612 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ./proj --project-name c29824 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 clfs-3624.sys clfs-3775.sys ``` #### Verbose Args

``` --old ['clfs-3624.sys'] --new [['clfs-3775.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name c29824 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/B199B0AF86000/Clfs.Sys -O clfs.sys.x64.10.0.26100.3624 wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/931DCBBD86000/Clfs.Sys -O clfs.sys.x64.10.0.26100.3775 ``` ## Binary Metadata Diff ```diff --- clfs-3624.sys Meta +++ clfs-3775.sys Meta @@ -1,44 +1,44 @@ -Program Name: clfs-3624.sys +Program Name: clfs-3775.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f -# of Bytes: 552936 +# of Bytes: 552944 # of Memory Blocks: 14 -# of Instructions: 97815 -# of Defined Data: 3612 -# of Functions: 1811 -# of Symbols: 13912 +# of Instructions: 97898 +# of Defined Data: 3618 +# of Functions: 1813 +# of Symbols: 13928 # of Data Types: 467 # of Data Type Categories: 20 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 15 18:01:36 SGT 2026 +Date Created: Sat Aug 15 18:01:40 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-3624.sys -Executable MD5: 868f53d68b2ae6c2fce2e2887d120f9e -Executable SHA256: 3f6d52194ba69ac5b72aa94c81e7aafb00dc643edced2347d1420f58af98411f -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-3624.sys?MD5=868f53d68b2ae6c2fce2e2887d120f9e +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-3775.sys +Executable MD5: c319e5d8c2f1a3f12e2cd0de13830799 +Executable SHA256: 1236ade15a1d9549947821aec37e5d016ce10e0a88f9546ccd7b4e5dc42f53e7 +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-3775.sys?MD5=c319e5d8c2f1a3f12e2cd0de13830799 PDB Age: 1 PDB File: clfs.pdb -PDB GUID: 13f89e9c-7828-fb7f-468e-82e8f3434f57 +PDB GUID: 59a49944-f0b3-1ccf-96e7-0f370e67415d PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Common Log File System Driver -PE Property[FileVersion]: 10.0.26100.3624 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.3775 (WinBuild.160101.0800) PE Property[InternalName]: clfs.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: Clfs.Sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.3624 +PE Property[ProductVersion]: 10.0.26100.3775 PE Property[Translation]: 4b00000 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra clfs-3624.sys Decompiler Options

Ghidra clfs-3624.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra clfs-3624.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra clfs-3775.sys Decompiler Options

Ghidra clfs-3775.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra clfs-3775.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|0| |modified_funcs_len|10| |added_symbols_len|6| |deleted_symbols_len|3| |diff_time|3.765150785446167| |deleted_strings_len|1| |added_strings_len|1| |match_types|Counter({'SymbolsHash': 1797, 'ExternalsName': 244, 'ExactInstructionsFunctionHasher': 12, 'ExactBytesFunctionHasher': 1})| |items_to_process|21| |diff_types|Counter({'code': 8, 'length': 8, 'address': 7, 'sig': 5, 'refcount': 3, 'calling': 3, 'called': 3})| |unmatched_funcs_len|2| |total_funcs_len|3624| |matched_funcs_len|3622| |matched_funcs_with_code_changes_len|8| |matched_funcs_with_non_code_changes_len|2| |matched_funcs_no_changes_len|3612| |match_func_similarity_percent|99.7239%| |func_match_overall_percent|99.9448%| |first_matches|Counter({'SymbolsHash': 1797, 'ExactInstructionsFunctionHasher': 12, 'ExactBytesFunctionHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1797 "ExternalsName" : 244 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 12 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1797 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 12 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 0 "modified_funcs_len" : 10 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 6 "deleted_symbols_len" : 3 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 1 "added_strings_len" : 1 ``` ### Strings Diff ```diff ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_CClfsRequest::Create::CClfsRequest::Close
`CClfsRequest::Close'::__l1::fin$0| |paramcount|0| |address|1c00145fc| |sig|ulonglong __fastcall Feature_2931883321__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2931883321__private_IsEnabledDeviceUsageNoInline +++ Feature_2931883321__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_2931883321__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_2931883321__private_featureState; + if ((Feature_2931883321__private_featureState & 0x10) == 0) { + uVar1 = Feature_2931883321__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_2931883321__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_2931883321__private_IsEnabledFallback ### Function Meta |Key|clfs-3775.sys| | :---: | :---: | |name|Feature_2931883321__private_IsEnabledFallback| |fullname|Feature_2931883321__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_2931883321__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1c0014634| |sig|undefined __fastcall Feature_2931883321__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2931883321__private_IsEnabledFallback +++ Feature_2931883321__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_2931883321__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_2931883321__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## CClfsRequest::Close ### Match Info |Key|clfs-3624.sys - clfs-3775.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.42| |i_ratio|0.37| |m_ratio|0.81| |b_ratio|0.69| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-3624.sys|clfs-3775.sys| | :---: | :---: | :---: | |name|Close|Close| |fullname|CClfsRequest::Close|CClfsRequest::Close| |refcount|2|2| |`length`|246|341| |`called`|CClfsLogFcbCommon::Close
CClfsLogFcbCommon::Unlock
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeBugCheckEx
_guard_dispatch_icall|CClfsLogCcb::AddRef
CClfsLogCcb::Release
CClfsLogFcbCommon::Close
CClfsLogFcbCommon::Unlock
Feature_2931883321__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeBugCheckEx
_guard_dispatch_icall| |calling|ClfsDispatchIoRequest|ClfsDispatchIoRequest| |paramcount|1|1| |address|1c0068f70|1c0068f70| |sig|long __cdecl Close(_IRP * param_1)|long __cdecl Close(_IRP * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsRequest::Close Called Diff ```diff --- CClfsRequest::Close called +++ CClfsRequest::Close called @@ -0,0 +1,2 @@ +CClfsLogCcb::AddRef +CClfsLogCcb::Release @@ -2,0 +5 @@ +Feature_2931883321__private_IsEnabledDeviceUsageNoInline ``` ### CClfsRequest::Close Diff ```diff --- CClfsRequest::Close +++ CClfsRequest::Close @@ -1,33 +1,56 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: static long __cdecl CClfsRequest::Close(struct _IRP * __ptr64) */ long __cdecl CClfsRequest::Close(_IRP *param_1) { + char *pcVar1; + longlong lVar2; CClfsLogFcbCommon *this; - char cVar1; + char cVar3; + ulonglong uVar4; + CClfsLogCcb *this_00; undefined8 in_RDX; - _FILE_OBJECT *p_Var2; + _FILE_OBJECT *p_Var5; + CClfsLogCcb *this_01; - cVar1 = **(char **)(param_1 + 0xb8); - if (cVar1 != '\x02') { + this_01 = (CClfsLogCcb *)0x0; + pcVar1 = *(char **)(param_1 + 0xb8); + if (*pcVar1 != '\x02') { /* WARNING: Subroutine does not return */ - KeBugCheckEx(0xc1f5,0x46,cVar1,0,0); + KeBugCheckEx(0xc1f5,0x46,*pcVar1,0,0); } - this = *(CClfsLogFcbCommon **) - (*(longlong *)(*(longlong *)(*(char **)(param_1 + 0xb8) + 0x30) + 0x18) + 0x78); + lVar2 = *(longlong *)(pcVar1 + 0x30); + this = *(CClfsLogFcbCommon **)(*(longlong *)(lVar2 + 0x18) + 0x78); (**(code **)(*(longlong *)this + 0x40))(this); - p_Var2 = (_FILE_OBJECT *)CONCAT71((int7)((ulonglong)in_RDX >> 8),1); - cVar1 = ExAcquireResourceExclusiveLite((_ERESOURCE *)(this + 200)); - CClfsLogFcbCommon::Close(this,p_Var2); - if (cVar1 != '\0') { + uVar4 = Feature_2931883321__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 != 0) { + this_01 = *(CClfsLogCcb **)(*(longlong *)(pcVar1 + 0x30) + 0x20); + if (this_01 != (CClfsLogCcb *)0x0) { + this_00 = this_01; + CClfsLogCcb::AddRef(this_01); + CClfsLogCcb::Release(this_00); + } + } + p_Var5 = (_FILE_OBJECT *)CONCAT71((int7)((ulonglong)in_RDX >> 8),1); + cVar3 = ExAcquireResourceExclusiveLite((_ERESOURCE *)(this + 200)); + CClfsLogFcbCommon::Close(this,p_Var5); + if (cVar3 != '\0') { CClfsLogFcbCommon::Unlock((_ERESOURCE *)(this + 200)); + } + uVar4 = Feature_2931883321__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 != 0) { + *(undefined8 *)(lVar2 + 0x18) = 0; + *(undefined8 *)(lVar2 + 0x20) = 0; + if (this_01 != (CClfsLogCcb *)0x0) { + CClfsLogCcb::Release(this_01); + } } (**(code **)(*(longlong *)this + 0x48))(this); *(undefined4 *)(param_1 + 0x30) = 0; *(undefined8 *)(param_1 + 0x38) = 0; IofCompleteRequest(param_1,0); return 0; } ``` ## CClfsLogCcb::Cleanup ### Match Info |Key|clfs-3624.sys - clfs-3775.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.81| |i_ratio|0.26| |m_ratio|0.98| |b_ratio|0.51| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-3624.sys|clfs-3775.sys| | :---: | :---: | :---: | |name|Cleanup|Cleanup| |fullname|CClfsLogCcb::Cleanup|CClfsLogCcb::Cleanup| |refcount|2|2| |`length`|309|301| |`called`|CClfsLogCcb::Release
CClfsLogCcb::ResetFileSystemFlag
CClfsLogCcb::Unlink
CClfsLogFcbCommon::Unlock
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
_guard_dispatch_icall|CClfsLogCcb::Release
CClfsLogCcb::ResetFileSystemFlag
CClfsLogCcb::Unlink
CClfsLogFcbCommon::Unlock
Feature_2931883321__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
_guard_dispatch_icall| |calling|CClfsRequest::Cleanup|CClfsRequest::Cleanup| |paramcount|1|1| |`address`|1c006e50c|1c0074d44| |sig|void __thiscall Cleanup(CClfsLogCcb * this)|void __thiscall Cleanup(CClfsLogCcb * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsLogCcb::Cleanup Called Diff ```diff --- CClfsLogCcb::Cleanup called +++ CClfsLogCcb::Cleanup called @@ -4,0 +5 @@ +Feature_2931883321__private_IsEnabledDeviceUsageNoInline ``` ### CClfsLogCcb::Cleanup Diff ```diff --- CClfsLogCcb::Cleanup +++ CClfsLogCcb::Cleanup @@ -1,39 +1,47 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: void __cdecl CClfsLogCcb::Cleanup(void) __ptr64 */ void __thiscall CClfsLogCcb::Cleanup(CClfsLogCcb *this) { longlong *plVar1; + ulonglong uVar2; ulonglong local_res8; longlong local_res10; if (*(longlong **)(this + 0x100) != (longlong *)0x0) { (**(code **)(**(longlong **)(this + 0x100) + 0x10))(); if (*(longlong **)(this + 0x100) != (longlong *)0x0) { (**(code **)(**(longlong **)(this + 0x100) + 8))(); *(undefined8 *)(this + 0x100) = 0; } } ResetFileSystemFlag(this); plVar1 = *(longlong **)(*(longlong *)(*(longlong *)(this + 0x48) + 0x18) + 0x78); if (0 < *(int *)(this + 0x28)) { local_res8 = local_res8 & 0xffffffff00000000; (**(code **)(*plVar1 + 0x58)) (plVar1,*(longlong *)(this + 0x48),*(int *)(this + 0x28),&local_res8,this + 0x70); } if (0 < *(longlong *)(this + 0x68)) { + local_res8 = 0; local_res10 = -*(longlong *)(this + 0x68); - local_res8 = 0; (**(code **)(*plVar1 + 0x128))(plVar1,*(undefined8 *)(this + 0x48),&local_res10,&local_res8); } ExAcquireResourceExclusiveLite((_ERESOURCE *)(plVar1 + 0x19),1); Unlink(this); + uVar2 = Feature_2931883321__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 != 0) { + *(uint *)(this + 0x1c) = *(uint *)(this + 0x1c) | 4; + } CClfsLogFcbCommon::Unlock((_ERESOURCE *)(plVar1 + 0x19)); (**(code **)(*plVar1 + 0x68))(plVar1,*(undefined8 *)(this + 0x48)); - *(uint *)(this + 0x1c) = *(uint *)(this + 0x1c) | 4; - Release(this); + uVar2 = Feature_2931883321__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 == 0) { + *(uint *)(this + 0x1c) = *(uint *)(this + 0x1c) | 4; + Release(this); + } return; } ``` ## `CClfsRequest::Close'::__l1::fin$0 ### Match Info |Key|clfs-3624.sys - clfs-3775.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.7| |i_ratio|0.66| |m_ratio|0.81| |b_ratio|0.81| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-3624.sys|clfs-3775.sys| | :---: | :---: | :---: | |name|fin$0|fin$0| |fullname|`CClfsRequest::Close'::__l1::fin$0|`CClfsRequest::Close'::__l1::fin$0| |refcount|1|1| |`length`|93|136| |`called`|CClfsLogFcbCommon::Unlock
NTOSKRNL.EXE::IofCompleteRequest
_guard_dispatch_icall|CClfsLogCcb::Release
CClfsLogFcbCommon::Unlock
Feature_2931883321__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IofCompleteRequest
_guard_dispatch_icall| |calling||| |paramcount|2|2| |`address`|1c00783cb|1c007840b| |sig|undefined __fastcall fin$0(undefined8 param_1, longlong param_2)|undefined __fastcall fin$0(undefined8 param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### `CClfsRequest::Close'::__l1::fin$0 Called Diff ```diff --- `CClfsRequest::Close'::__l1::fin$0 called +++ `CClfsRequest::Close'::__l1::fin$0 called @@ -0,0 +1 @@ +CClfsLogCcb::Release @@ -1,0 +3 @@ +Feature_2931883321__private_IsEnabledDeviceUsageNoInline ``` ### `CClfsRequest::Close'::__l1::fin$0 Diff ```diff --- `CClfsRequest::Close'::__l1::fin$0 +++ `CClfsRequest::Close'::__l1::fin$0 @@ -1,22 +1,34 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void `CClfsRequest::Close'::__l1::fin_0(undefined8 param_1,longlong param_2) { longlong lVar1; + ulonglong uVar2; if (*(char *)(param_2 + 0x30) != '\0') { CClfsLogFcbCommon::Unlock((_ERESOURCE *)(*(longlong *)(param_2 + 0x38) + 200)); *(undefined1 *)(param_2 + 0x30) = 0; } + uVar2 = Feature_2931883321__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar2 != 0) { + lVar1 = *(longlong *)(param_2 + 0x40); + if (lVar1 != 0) { + *(undefined8 *)(lVar1 + 0x18) = 0; + *(undefined8 *)(lVar1 + 0x20) = 0; + } + if (*(CClfsLogCcb **)(param_2 + 0x48) != (CClfsLogCcb *)0x0) { + CClfsLogCcb::Release(*(CClfsLogCcb **)(param_2 + 0x48)); + } + } if (*(longlong **)(param_2 + 0x38) != (longlong *)0x0) { (**(code **)(**(longlong **)(param_2 + 0x38) + 0x48))(); } - lVar1 = *(longlong *)(param_2 + 0x50); + lVar1 = *(longlong *)(param_2 + 0x70); *(undefined4 *)(lVar1 + 0x30) = *(undefined4 *)(param_2 + 0x34); *(undefined8 *)(lVar1 + 0x38) = 0; IofCompleteRequest(lVar1,0); return; } ``` ## Feature_2633002298__private_IsEnabledFallback ### Match Info |Key|clfs-3624.sys - clfs-3775.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.8| |i_ratio|0.67| |m_ratio|0.89| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-3624.sys|clfs-3775.sys| | :---: | :---: | :---: | |name|Feature_2633002298__private_IsEnabledFallback|Feature_2633002298__private_IsEnabledFallback| |fullname|Feature_2633002298__private_IsEnabledFallback|Feature_2633002298__private_IsEnabledFallback| |refcount|2|2| |`length`|14|21| |called|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |calling|Feature_2633002298__private_IsEnabledDeviceUsageNoInline|Feature_2633002298__private_IsEnabledDeviceUsageNoInline| |paramcount|2|2| |`address`|1c0015e90|1c00167b0| |`sig`|undefined __fastcall Feature_2633002298__private_IsEnabledFallback(undefined4 * param_1, uint param_2)|undefined __fastcall Feature_2633002298__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### Feature_2633002298__private_IsEnabledFallback Diff ```diff --- Feature_2633002298__private_IsEnabledFallback +++ Feature_2633002298__private_IsEnabledFallback @@ -1,8 +1,8 @@ -void Feature_2633002298__private_IsEnabledFallback(undefined4 *param_1,uint param_2) +void Feature_2633002298__private_IsEnabledFallback(ulonglong param_1,int param_2) { - wil_details_IsEnabledFallback(param_1,param_2); + wil_details_IsEnabledFallback(param_1,param_2,&Feature_2633002298__private_descriptor); return; } ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Match Info |Key|clfs-3624.sys - clfs-3775.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.35| |i_ratio|0.56| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-3624.sys|clfs-3775.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2|2| |`length`|226|232| |called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3|3| |`address`|1c0016a48|1c0014a2c| |`sig`|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, ulonglong param_3)|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(longlong param_1, undefined8 param_2, ulonglong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToServiceDirect Diff ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -1,47 +1,46 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ bool wil_details_FeatureReporting_ReportUsageToServiceDirect - (undefined8 param_1,undefined8 param_2,ulonglong param_3) + (longlong param_1,undefined8 param_2,ulonglong param_3) { uint6 uVar1; uint *puVar2; - undefined1 auStack_88 [32]; - uint *local_68; - undefined8 local_58; - uint local_50 [6]; - uint local_38; - uint uStack_34; - uint uStack_30; - uint uStack_2c; - undefined8 local_28; - ulonglong local_20; + undefined1 auStack_98 [32]; + uint *local_78; + undefined8 local_68; + uint local_60 [6]; + uint local_48; + uint uStack_44; + uint uStack_40; + uint uStack_3c; + undefined8 local_38; + ulonglong local_30; - local_20 = __security_cookie ^ (ulonglong)auStack_88; + local_30 = __security_cookie ^ (ulonglong)auStack_98; puVar2 = wil_details_FeatureReporting_RecordUsageInCache - (local_50,(uint *)&Feature_2633002298__private_reporting,param_3, - (uint)((ulonglong)param_2 >> 0x20)); - local_38 = *puVar2; - uStack_34 = puVar2[1]; - uStack_30 = puVar2[2]; - uStack_2c = puVar2[3]; - local_28 = *(undefined8 *)(puVar2 + 4); + (local_60,*(uint **)(param_1 + 8),param_3,(uint)((ulonglong)param_2 >> 0x20)); + local_48 = *puVar2; + uStack_44 = puVar2[1]; + uStack_40 = puVar2[2]; + uStack_3c = puVar2[3]; + local_38 = *(undefined8 *)(puVar2 + 4); if (g_wil_details_recordFeatureUsage != (code *)0x0) { - local_68 = &local_38; + local_78 = &local_48; (*g_wil_details_recordFeatureUsage) - (0x34762f9,param_3 & 0xffffffff,1,&Feature_2633002298__private_reporting); + (*(undefined4 *)(param_1 + 0x18),param_3 & 0xffffffff,1,*(undefined8 *)(param_1 + 8)); } if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) { - local_58._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),0x34762f9); - uVar1 = (uint6)local_58; - local_58 = (ulonglong)(uint6)local_58; + local_68._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),*(undefined4 *)(param_1 + 0x18)); + uVar1 = (uint6)local_68; + local_68 = (ulonglong)(uint6)local_68; if (((uint)param_2 >> 0xb & 1) != 0) { - local_58 = CONCAT26(1,uVar1); + local_68 = CONCAT26(1,uVar1); } - RtlNotifyFeatureUsage(&local_58); + RtlNotifyFeatureUsage(&local_68); } - return (int)local_28 == 0; + return (int)local_38 == 0; } ``` ## wil_details_FeatureReporting_ReportUsageToService ### Match Info |Key|clfs-3624.sys - clfs-3775.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.63| |i_ratio|0.53| |m_ratio|0.94| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-3624.sys|clfs-3775.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |refcount|2|2| |`length`|114|125| |called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|3|3| |`address`|1c00169cc|1c00149a8| |`sig`|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, uint param_3)|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(longlong param_1, undefined8 param_2, int param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToService Diff ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -1,27 +1,26 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void wil_details_FeatureReporting_ReportUsageToService - (undefined8 param_1,undefined8 param_2,uint param_3) + (longlong param_1,undefined8 param_2,int param_3) { bool bVar1; uint uVar2; undefined7 extraout_var; - ulonglong uVar3; - uint uVar4; - uint local_res18 [4]; + uint uVar3; + int local_res18 [4]; - uVar4 = (uint)param_2 & 1; - uVar3 = (ulonglong)param_3; + uVar3 = (uint)param_2 & 1; local_res18[0] = param_3; - uVar2 = wil_details_MapReportingKind(param_3,uVar4); - bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,(ulonglong)uVar2); + uVar2 = wil_details_MapReportingKind(param_3,uVar3); + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(param_1,param_2,(ulonglong)uVar2); if (((int)CONCAT71(extraout_var,bVar1) != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { (*g_wil_details_pfnFeatureLoggingHook) - (0x34762f9,&Feature_2633002298_logged_traits,0,uVar4,local_res18,0,0,1); + (*(undefined4 *)(param_1 + 0x18),*(undefined8 *)(param_1 + 0x10),0,uVar3,local_res18,0 + ,0,1); } return; } ``` ## wil_details_IsEnabledFallback ### Match Info |Key|clfs-3624.sys - clfs-3775.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.48| |i_ratio|0.43| |m_ratio|0.96| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-3624.sys|clfs-3775.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|2|3| |`length`|135|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_2633002298__private_IsEnabledFallback|Feature_2633002298__private_IsEnabledFallback
Feature_2931883321__private_IsEnabledFallback| |paramcount|2|3| |`address`|1c0016df8|1c0014df0| |`sig`|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1,0 +2 @@ +Feature_2931883321__private_IsEnabledFallback ``` ### wil_details_IsEnabledFallback Diff ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -1,26 +1,22 @@ -uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) +uint wil_details_IsEnabledFallback(ulonglong param_1,int param_2,undefined8 *param_3) { uint uVar1; - undefined4 *puVar2; - ulonglong local_res18; + ulonglong local_res8; uVar1 = (uint)param_1; - local_res18 = (ulonglong)param_1 & 0xffffffff; - if (((ulonglong)param_1 & 2) == 0) { - puVar2 = &Feature_2633002298__private_featureState; - local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - (&Feature_2633002298__private_featureState,(ulonglong)param_1, - 0x1c0024830); - param_1 = puVar2; - uVar1 = (uint)local_res18; + local_res8 = param_1 & 0xffffffff; + if ((param_1 & 2) == 0) { + local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*param_3,param_1,(longlong)param_3); + uVar1 = (uint)local_res8; } if ((param_2 != 0) && - (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), - param_2 - 3 < 2)) { - wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); + (wil_details_FeatureReporting_ReportUsageToService((longlong)param_3,local_res8,param_2), + param_2 - 3U < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res8,param_2,param_3); } return uVar1 & 1; } ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Match Info |Key|clfs-3624.sys - clfs-3775.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.4| |i_ratio|0.37| |m_ratio|0.9| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-3624.sys|clfs-3775.sys| | :---: | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|2|2| |`length`|76|91| |called||| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|2|3| |`address`|1c0016c44|1c0014c2c| |`sig`|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath Diff ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -1,41 +1,52 @@ -void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath + (uint param_1,int param_2,undefined8 *param_3) { - uint uVar1; + uint *puVar1; uint uVar2; uint uVar3; - bool bVar4; + uint uVar4; + bool bVar5; + puVar1 = (uint *)*param_3; if (param_2 == 3) { - uVar3 = 0x10; + uVar4 = 0x10; } else { if (param_2 != 4) { return; } - uVar3 = 0x20; + uVar4 = 0x20; } - if ((Feature_2633002298__private_featureState & 2) != 0) { - uVar2 = Feature_2633002298__private_featureState; - while ((uVar2 & 1) == (param_1 & 1)) { - LOCK(); - bVar4 = uVar2 == Feature_2633002298__private_featureState; - uVar1 = uVar3 | uVar2; - if (!bVar4) { - uVar2 = Feature_2633002298__private_featureState; - uVar1 = Feature_2633002298__private_featureState; - } - Feature_2633002298__private_featureState = uVar1; - UNLOCK(); - if (bVar4) { - return; - } - if ((uVar2 & 2) == 0) { - return; + if ((*(char *)((longlong)param_3 + 0x1e) == '\0') && (*(char *)((longlong)param_3 + 0x1d) == '\0') + ) { + if ((*puVar1 & 2) != 0) { + uVar3 = *puVar1; + while ((uVar3 & 1) == (param_1 & 1)) { + LOCK(); + uVar2 = *puVar1; + bVar5 = uVar3 == uVar2; + if (bVar5) { + *puVar1 = uVar4 | uVar3; + uVar2 = uVar3; + } + UNLOCK(); + if (bVar5) { + return; + } + uVar3 = uVar2; + if ((uVar2 & 2) == 0) { + return; + } } } + } + else { + LOCK(); + *puVar1 = *puVar1 | uVar4; + UNLOCK(); } return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## AddRef ### Match Info |Key|clfs-3624.sys - clfs-3775.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-3624.sys|clfs-3775.sys| | :---: | :---: | :---: | |name|AddRef|AddRef| |fullname|CClfsLogCcb::AddRef|CClfsLogCcb::AddRef| |`refcount`|35|36| |length|13|13| |called||| |`calling`|

Expand for full list:
CClfsRequest::AdvanceLogBase
CClfsRequest::CClfsRequest
CClfsRequest::Cleanup
CClfsRequest::EndArchival
CClfsRequest::GetArchivalDescriptors
CClfsRequest::ReadArchiveMetadata
CClfsRequest::ReadLogBlock
CClfsRequest::ReadRestart
CClfsRequest::ScanContainers
CClfsRequest::StartArchival
CClfsRequest::WriteRestart

ClfsAddLogContainerSet
ClfsAdvanceLogBaseInternal
ClfsCloseAndResetLogFile
ClfsCloseLogFileObject
ClfsCreateLogFile
ClfsDeleteLogByPointer
ClfsFlushToLsnInternal
ClfsFreeReservedLogInternal
ClfsGetContainerName
ClfsGetIoStatistics
ClfsGetLogFileInformation
ClfsPrivQueryErrorState
ClfsQueryLogFileInformation
ClfsReadLogRecordInternal
ClfsReadRestartAreaInternal
ClfsRemoveContainersInternal
ClfsRemoveLogContainerSet
ClfsReserveAndAppendLogInternal
ClfsScanLogContainersInternal
ClfsSetArchiveTail
ClfsWriteRestartAreaInternal

Expand for full list:
CClfsRequest::AdvanceLogBase
CClfsRequest::CClfsRequest
CClfsRequest::Cleanup
CClfsRequest::Close
CClfsRequest::EndArchival
CClfsRequest::GetArchivalDescriptors
CClfsRequest::ReadArchiveMetadata
CClfsRequest::ReadLogBlock
CClfsRequest::ReadRestart
CClfsRequest::ScanContainers
CClfsRequest::StartArchival

CClfsRequest::WriteRestart
ClfsAddLogContainerSet
ClfsAdvanceLogBaseInternal
ClfsCloseAndResetLogFile
ClfsCloseLogFileObject
ClfsCreateLogFile
ClfsDeleteLogByPointer
ClfsFlushToLsnInternal
ClfsFreeReservedLogInternal
ClfsGetContainerName
ClfsGetIoStatistics
ClfsGetLogFileInformation
ClfsPrivQueryErrorState
ClfsQueryLogFileInformation
ClfsReadLogRecordInternal
ClfsReadRestartAreaInternal
ClfsRemoveContainersInternal
ClfsRemoveLogContainerSet
ClfsReserveAndAppendLogInternal
ClfsScanLogContainersInternal
ClfsSetArchiveTail
ClfsWriteRestartAreaInternal

Expand for full list:
CClfsLogCcb::Cleanup
CClfsLogFcbPhysical::AddClient
CClfsLogFcbPhysical::OpenClient
CClfsLogFcbPhysical::TearDownOpen
CClfsRequest::Cleanup
CClfsRequest::EndArchival
CClfsRequest::GetArchivalDescriptors
CClfsRequest::ReadArchiveMetadata
CClfsRequest::StartArchival
ClfsAddLogContainerSet
ClfsAddLogContainerSet$fin$0

ClfsAdvanceLogBaseInternal
ClfsAdvanceLogBaseInternal$fin$0
ClfsCloseAndResetLogFile
ClfsCloseAndResetLogFile$fin$0
ClfsCloseLogFileObject
ClfsCreateLogFile
ClfsDeleteLogByPointer
ClfsDeleteLogByPointer$fin$0
ClfsFlushToLsnInternal$fin$0
ClfsFreeReservedLogInternal
ClfsFreeReservedLogInternal$fin$0
ClfsGetContainerName
ClfsGetContainerName$fin$0
ClfsGetIoStatistics
ClfsGetIoStatistics$fin$0
ClfsGetLogFileInformation$fin$0
ClfsPrivQueryErrorState
ClfsQueryLogFileInformation
ClfsQueryLogFileInformation$fin$0
ClfsReadLogRecordInternal
ClfsReadLogRecordInternal$fin$0
ClfsReadRestartAreaInternal
ClfsReadRestartAreaInternal$fin$0
ClfsRemoveContainersInternal
ClfsRemoveContainersInternal$fin$0
ClfsRemoveLogContainerSet
ClfsRemoveLogContainerSet$fin$0
ClfsReserveAndAppendLogInternal$fin$0
ClfsScanLogContainersInternal
ClfsScanLogContainersInternal$fin$0
ClfsSetArchiveTail
ClfsWriteRestartAreaInternal
ClfsWriteRestartAreaInternal$fin$0
`CClfsLogFcbPhysical::AddClient'::__l1::fin$0
`CClfsLogFcbPhysical::OpenClient'::__l1::fin$0
`CClfsRequest::Cleanup'::__l1::fin$0
`CClfsRequest::EndArchival'::__l1::fin$0
`CClfsRequest::GetArchivalDescriptors'::__l1::fin$0
`CClfsRequest::ReadArchiveMetadata'::__l1::fin$0
`CClfsRequest::StartArchival'::__l1::fin$0

Expand for full list:
CClfsLogCcb::Cleanup
CClfsLogFcbPhysical::AddClient
CClfsLogFcbPhysical::OpenClient
CClfsLogFcbPhysical::TearDownOpen
CClfsRequest::Cleanup
CClfsRequest::Close
CClfsRequest::EndArchival
CClfsRequest::GetArchivalDescriptors
CClfsRequest::ReadArchiveMetadata
CClfsRequest::StartArchival
ClfsAddLogContainerSet

ClfsAddLogContainerSet$fin$0
ClfsAdvanceLogBaseInternal
ClfsAdvanceLogBaseInternal$fin$0
ClfsCloseAndResetLogFile
ClfsCloseAndResetLogFile$fin$0
ClfsCloseLogFileObject
ClfsCreateLogFile
ClfsDeleteLogByPointer
ClfsDeleteLogByPointer$fin$0
ClfsFlushToLsnInternal$fin$0
ClfsFreeReservedLogInternal
ClfsFreeReservedLogInternal$fin$0
ClfsGetContainerName
ClfsGetContainerName$fin$0
ClfsGetIoStatistics
ClfsGetIoStatistics$fin$0
ClfsGetLogFileInformation$fin$0
ClfsPrivQueryErrorState
ClfsQueryLogFileInformation
ClfsQueryLogFileInformation$fin$0
ClfsReadLogRecordInternal
ClfsReadLogRecordInternal$fin$0
ClfsReadRestartAreaInternal
ClfsReadRestartAreaInternal$fin$0
ClfsRemoveContainersInternal
ClfsRemoveContainersInternal$fin$0
ClfsRemoveLogContainerSet
ClfsRemoveLogContainerSet$fin$0
ClfsReserveAndAppendLogInternal$fin$0
ClfsScanLogContainersInternal
ClfsScanLogContainersInternal$fin$0
ClfsSetArchiveTail
ClfsWriteRestartAreaInternal
ClfsWriteRestartAreaInternal$fin$0
`CClfsLogFcbPhysical::AddClient'::__l1::fin$0
`CClfsLogFcbPhysical::OpenClient'::__l1::fin$0
`CClfsRequest::Cleanup'::__l1::fin$0
`CClfsRequest::Close'::__l1::fin$0
`CClfsRequest::EndArchival'::__l1::fin$0
`CClfsRequest::GetArchivalDescriptors'::__l1::fin$0
`CClfsRequest::ReadArchiveMetadata'::__l1::fin$0
`CClfsRequest::StartArchival'::__l1::fin$0

| |paramcount|1|1| |address|1c00570b0|1c00570b0| |sig|ulong __thiscall Release(CClfsLogCcb * this)|ulong __thiscall Release(CClfsLogCcb * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### Release Calling Diff ```diff --- CClfsLogCcb::Release calling +++ CClfsLogCcb::Release calling @@ -5,0 +6 @@ +CClfsRequest::Close @@ -47,0 +49 @@ +`CClfsRequest::Close'::__l1::fin$0 ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-15T18:02:25}