# clfs-7019.sys-clfs-7171.sys Diff

# TOC

* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
	* [Ghidra Diff Engine](#ghidra-diff-engine)
		* [Command Line](#command-line)
	* [Binary Metadata Diff](#binary-metadata-diff)
	* [Program Options](#program-options)
	* [Diff Stats](#diff-stats)
	* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
	* [Feature_1005355321__private_IsEnabledDeviceUsageNoInline](#feature_1005355321__private_isenableddeviceusagenoinline)
	* [Feature_1005355321__private_IsEnabledFallback](#feature_1005355321__private_isenabledfallback)
* [Modified](#modified)
	* [ClfsGetFirstRecord](#clfsgetfirstrecord)
* [Modified (No Code Changes)](#modified-no-code-changes)
	* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)

# Visual Chart Diff



```mermaid

flowchart LR

ClfsGetFirstRecord-2-old<--Match 33%-->ClfsGetFirstRecord-2-new

subgraph clfs-7171.sys
    ClfsGetFirstRecord-2-new
    subgraph Added
direction LR
Feature_1005355321__private_IsEnabledDeviceUsageNoInline
    Feature_1005355321__private_IsEnabledFallback
end
end

subgraph clfs-7019.sys
    ClfsGetFirstRecord-2-old
    
end

```


```mermaid
pie showData
    title Function Matches - 99.9461%
"unmatched_funcs_len" : 2
"matched_funcs_len" : 3710
```



```mermaid
pie showData
    title Matched Function Similarity - 99.9461%
"matched_funcs_with_code_changes_len" : 1
"matched_funcs_with_non_code_changes_len" : 1
"matched_funcs_no_changes_len" : 3708
```

# Metadata

## Ghidra Diff Engine

### Command Line

#### Captured Command Line


```
ghidriff --project-location ./proj --project-name c60709 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 clfs-7019.sys clfs-7171.sys
```


#### Verbose Args


<details>

```
--old ['clfs-7019.sys'] --new [['clfs-7171.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name c60709 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```


</details>

#### Download Original PEs


```
wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/3A2A519A8B000/Clfs.Sys -O clfs.sys.x64.10.0.26100.7019
wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/9C5FC10F8B000/Clfs.Sys -O clfs.sys.x64.10.0.26100.7171
```


## Binary Metadata Diff


```diff
--- clfs-7019.sys Meta
+++ clfs-7171.sys Meta
@@ -1,44 +1,44 @@
-Program Name: clfs-7019.sys
+Program Name: clfs-7171.sys
 Language ID: x86:LE:64:default (4.6)
 Compiler ID: windows
 Processor: x86
 Endian: Little
 Address Size: 64
 Minimum Address: 140000000
 Maximum Address: ff0000184f
-# of Bytes: 573928
+# of Bytes: 573936
 # of Memory Blocks: 14
-# of Instructions: 100814
-# of Defined Data: 3936
-# of Functions: 1855
-# of Symbols: 14597
+# of Instructions: 100851
+# of Defined Data: 3945
+# of Functions: 1857
+# of Symbols: 14609
 # of Data Types: 470
 # of Data Type Categories: 20
 Analyzed: true
 Compiler: visualstudio:unknown
 Created With Ghidra Version: 12.0.4
-Date Created: Sat Aug 15 18:05:07 SGT 2026
+Date Created: Sat Aug 15 18:05:11 SGT 2026
 Executable Format: Portable Executable (PE)
-Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-7019.sys
-Executable MD5: 3b7fb7f39a914b0200073ea68bddda17
-Executable SHA256: fae7669c9554c562b79e37c0a9acfa19e25f4d0df982dd16e92a224436cd791e
-FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-7019.sys?MD5=3b7fb7f39a914b0200073ea68bddda17
+Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-7171.sys
+Executable MD5: aeb151fcd2a0ae3b0fb28a8740abe5e8
+Executable SHA256: c2be814f279019220a8e3c99e9e463ecf83d7a6f269248e7515cc662087ca572
+FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-7171.sys?MD5=aeb151fcd2a0ae3b0fb28a8740abe5e8
 PDB Age: 1
 PDB File: clfs.pdb
-PDB GUID: b6145366-c038-b15e-c977-52d794812d7a
+PDB GUID: 84c45995-c9dd-9439-5484-8d96fc5165aa
 PDB Loaded: true
 PDB Version: RSDS
 PE Property[CompanyName]: Microsoft Corporation
 PE Property[FileDescription]: Common Log File System Driver
-PE Property[FileVersion]: 10.0.26100.7019 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.26100.7171 (WinBuild.160101.0800)
 PE Property[InternalName]: clfs.sys
 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
 PE Property[OriginalFilename]: Clfs.Sys
 PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.26100.7019
+PE Property[ProductVersion]: 10.0.26100.7171
 PE Property[Translation]: 4b00000
 Preferred Root Namespace Category: 
 RTTI Found: false
 Relocatable: true
 SectionAlignment: 4096
 Should Ask To Analyze: false

```


## Program Options


<details>
<summary>Ghidra clfs-7019.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra clfs-7019.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra clfs-7019.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>


<details>
<summary>Ghidra clfs-7171.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra clfs-7171.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra clfs-7171.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>

## Diff Stats



|Stat|Value|
| :---: | :---: |
|added_funcs_len|2|
|deleted_funcs_len|0|
|modified_funcs_len|2|
|added_symbols_len|5|
|deleted_symbols_len|2|
|diff_time|4.013236999511719|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 1842, 'ExternalsName': 245, 'ExactInstructionsFunctionHasher': 9, 'ExactBytesFunctionHasher': 3})|
|items_to_process|11|
|diff_types|Counter({'code': 1, 'length': 1, 'called': 1, 'refcount': 1, 'address': 1, 'calling': 1})|
|unmatched_funcs_len|2|
|total_funcs_len|3712|
|matched_funcs_len|3710|
|matched_funcs_with_code_changes_len|1|
|matched_funcs_with_non_code_changes_len|1|
|matched_funcs_no_changes_len|3708|
|match_func_similarity_percent|99.9461%|
|func_match_overall_percent|99.9461%|
|first_matches|Counter({'SymbolsHash': 1842, 'ExactInstructionsFunctionHasher': 9, 'ExactBytesFunctionHasher': 3})|



```mermaid
pie showData
    title All Matches
"SymbolsHash" : 1842
"ExternalsName" : 245
"ExactBytesFunctionHasher" : 3
"ExactInstructionsFunctionHasher" : 9
```



```mermaid
pie showData
    title First Matches
"SymbolsHash" : 1842
"ExactBytesFunctionHasher" : 3
"ExactInstructionsFunctionHasher" : 9
```



```mermaid
pie showData
    title Diff Stats
"added_funcs_len" : 2
"deleted_funcs_len" : 0
"modified_funcs_len" : 2
```



```mermaid
pie showData
    title Symbols
"added_symbols_len" : 5
"deleted_symbols_len" : 2
```

## Strings


*No string differences found*

# Deleted

# Added

## Feature_1005355321__private_IsEnabledDeviceUsageNoInline

### Function Meta



|Key|clfs-7171.sys|
| :---: | :---: |
|name|Feature_1005355321__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_1005355321__private_IsEnabledDeviceUsageNoInline|
|refcount|2|
|length|49|
|called|Feature_1005355321__private_IsEnabledFallback|
|calling|ClfsGetFirstRecord|
|paramcount|0|
|address|140016e18|
|sig|ulonglong __fastcall Feature_1005355321__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_1005355321__private_IsEnabledDeviceUsageNoInline
+++ Feature_1005355321__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_1005355321__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+  ulonglong uVar1;
+  undefined8 local_res8;
+  
+  local_res8 = (ulonglong)Feature_1005355321__private_featureState;
+  if ((Feature_1005355321__private_featureState & 0x10) == 0) {
+    uVar1 = Feature_1005355321__private_IsEnabledFallback(local_res8,3);
+  }
+  else {
+    uVar1 = (ulonglong)(Feature_1005355321__private_featureState & 1);
+  }
+  return uVar1;
+}
+

```


## Feature_1005355321__private_IsEnabledFallback

### Function Meta



|Key|clfs-7171.sys|
| :---: | :---: |
|name|Feature_1005355321__private_IsEnabledFallback|
|fullname|Feature_1005355321__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_1005355321__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|140016e50|
|sig|undefined __fastcall Feature_1005355321__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_1005355321__private_IsEnabledFallback
+++ Feature_1005355321__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_1005355321__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+  wil_details_IsEnabledFallback(param_1,param_2,&Feature_1005355321__private_descriptor);
+  return;
+}
+

```


# Modified


*Modified functions contain code changes*
## ClfsGetFirstRecord

### Match Info



|Key|clfs-7019.sys - clfs-7171.sys|
| :---: | :---: |
|diff_type|code,length,called|
|ratio|0.47|
|i_ratio|0.08|
|m_ratio|0.61|
|b_ratio|0.33|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|clfs-7019.sys|clfs-7171.sys|
| :---: | :---: | :---: |
|name|ClfsGetFirstRecord|ClfsGetFirstRecord|
|fullname|ClfsGetFirstRecord|ClfsGetFirstRecord|
|refcount|4|4|
|`length`|42|102|
|`called`||Feature_1005355321__private_IsEnabledDeviceUsageNoInline|
|calling|CClfsLogFcbPhysical::AppendRegion<br>CClfsLogFcbPhysical::UpdateCachedOwnerPage|CClfsLogFcbPhysical::AppendRegion<br>CClfsLogFcbPhysical::UpdateCachedOwnerPage|
|paramcount|2|2|
|address|140004478|140004478|
|sig|_CLFS_RECORD_HEADER * __cdecl ClfsGetFirstRecord(uchar * param_1, ulong param_2)|_CLFS_RECORD_HEADER * __cdecl ClfsGetFirstRecord(uchar * param_1, ulong param_2)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### ClfsGetFirstRecord Called Diff


```diff
--- ClfsGetFirstRecord called
+++ ClfsGetFirstRecord called
@@ -0,0 +1 @@
+Feature_1005355321__private_IsEnabledDeviceUsageNoInline
```


### ClfsGetFirstRecord Diff


```diff
--- ClfsGetFirstRecord
+++ ClfsGetFirstRecord
@@ -1,20 +1,26 @@
 
 /* struct _CLFS_RECORD_HEADER * __ptr64 __cdecl ClfsGetFirstRecord(unsigned char * __ptr64,unsigned
    long) */
 
 _CLFS_RECORD_HEADER * __cdecl ClfsGetFirstRecord(uchar *param_1,ulong param_2)
 
 {
   uint uVar1;
-  _CLFS_RECORD_HEADER *p_Var2;
+  ulonglong uVar2;
+  uint uVar3;
   
-  if ((param_1 != (uchar *)0x0) && (uVar1 = *(uint *)(param_1 + 0x28), 0x27 < uVar1 + 0x28)) {
-    p_Var2 = (_CLFS_RECORD_HEADER *)(param_1 + uVar1);
-    if ((ulonglong)param_2 + 0x28 < (ulonglong)uVar1) {
-      p_Var2 = (_CLFS_RECORD_HEADER *)0x0;
+  if (param_1 != (uchar *)0x0) {
+    uVar1 = *(uint *)(param_1 + 0x28);
+    uVar3 = uVar1 + 0x28;
+    uVar2 = Feature_1005355321__private_IsEnabledDeviceUsageNoInline();
+    if ((int)uVar2 == 0) {
+      if ((0x27 < uVar3) && ((ulonglong)uVar1 <= (ulonglong)param_2 + 0x28)) {
+LAB_0:
+        return (_CLFS_RECORD_HEADER *)(param_1 + uVar1);
+      }
     }
-    return p_Var2;
+    else if (((0x27 < uVar3) && (0x6f < uVar1)) && (uVar3 <= param_2)) goto LAB_0;
   }
   return (_CLFS_RECORD_HEADER *)0x0;
 }
 

```


# Modified (No Code Changes)


*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname

## wil_details_IsEnabledFallback

### Match Info



|Key|clfs-7019.sys - clfs-7171.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.83|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|clfs-7019.sys|clfs-7171.sys|
| :---: | :---: | :---: |
|name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|`refcount`|5|6|
|length|140|140|
|called|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|`calling`|Feature_CClfsLogFcbPhysicalDeadlockFix__private_IsEnabledFallback<br>Feature_CLFS_Signing__private_IsEnabledFallback<br>Feature_ClfsCreateLogFileCorruptMetadata_Fix__private_IsEnabledFallback<br>Feature_Servicing_EresourceCircularWaitCausedDeadlock__private_IsEnabledFallback|Feature_1005355321__private_IsEnabledFallback<br>Feature_CClfsLogFcbPhysicalDeadlockFix__private_IsEnabledFallback<br>Feature_CLFS_Signing__private_IsEnabledFallback<br>Feature_ClfsCreateLogFileCorruptMetadata_Fix__private_IsEnabledFallback<br>Feature_Servicing_EresourceCircularWaitCausedDeadlock__private_IsEnabledFallback|
|paramcount|3|3|
|`address`|1400122c8|140012308|
|sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### wil_details_IsEnabledFallback Calling Diff


```diff
--- wil_details_IsEnabledFallback calling
+++ wil_details_IsEnabledFallback calling
@@ -0,0 +1 @@
+Feature_1005355321__private_IsEnabledFallback
```




<sub>Generated with `ghidriff` version: 1.0.0 on 2026-08-15T18:05:56</sub>