# clfs-7309.sys-clfs-7462.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_1757897016__private_IsEnabledDeviceUsageNoInline](#feature_1757897016__private_isenableddeviceusagenoinline) * [Feature_1757897016__private_IsEnabledFallback](#feature_1757897016__private_isenabledfallback) * [Modified](#modified) * [CClfsRequest::WriteRestart](#cclfsrequestwriterestart) * [`CClfsRequest::WriteRestart'::__l1::fin$2](#cclfsrequestwriterestart__l1fin2) * [`CClfsRequest::WriteRestart'::__l1::filt$0](#cclfsrequestwriterestart__l1filt0) * [`CClfsRequest::WriteRestart'::__l1::filt$1](#cclfsrequestwriterestart__l1filt1) * [CClfsRequest::ReserveAndAppendLog](#cclfsrequestreserveandappendlog) * [CClfsLogCcb::MarkAccessed](#cclfslogccbmarkaccessed) * [CClfsLogFcbCommon::ReportFlushFailure](#cclfslogfcbcommonreportflushfailure) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [__security_check_cookie](#__security_check_cookie) * [ReportFlushFailure](#reportflushfailure) * [MarkAccessed](#markaccessed) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [memset](#memset) # Visual Chart Diff ```mermaid flowchart LR CClfsRequestWriteRestart-1-old<--Match 56%-->CClfsRequestWriteRestart-1-new CClfsRequestWriteRestart__l1fin2-2-old<--Match 91%-->CClfsRequestWriteRestart__l1fin2-2-new CClfsRequestWriteRestart__l1filt0-2-old<--Match 95%-->CClfsRequestWriteRestart__l1filt0-2-new CClfsRequestWriteRestart__l1filt1-2-old<--Match 95%-->CClfsRequestWriteRestart__l1filt1-2-new CClfsRequestReserveAndAppendLog-1-old<--Match 49%-->CClfsRequestReserveAndAppendLog-1-new CClfsLogCcbMarkAccessed-1-old<--Match 11%-->CClfsRequestGetAlignedBufferSize-1-new CClfsLogFcbCommonReportFlushFailure-2-old<--Match 22%-->CClfsRequestGetAlignedBufferSize-2-new subgraph clfs-7462.sys CClfsRequestWriteRestart-1-new CClfsRequestWriteRestart__l1fin2-2-new CClfsRequestWriteRestart__l1filt0-2-new CClfsRequestWriteRestart__l1filt1-2-new CClfsRequestReserveAndAppendLog-1-new CClfsRequestGetAlignedBufferSize-1-new CClfsRequestGetAlignedBufferSize-2-new subgraph Added direction LR Feature_1757897016__private_IsEnabledDeviceUsageNoInline Feature_1757897016__private_IsEnabledFallback end end subgraph clfs-7309.sys CClfsRequestWriteRestart-1-old CClfsRequestWriteRestart__l1fin2-2-old CClfsRequestWriteRestart__l1filt0-2-old CClfsRequestWriteRestart__l1filt1-2-old CClfsRequestReserveAndAppendLog-1-old CClfsLogCcbMarkAccessed-1-old CClfsLogFcbCommonReportFlushFailure-2-old end ``` ```mermaid pie showData title Function Matches - 99.9466% "unmatched_funcs_len" : 2 "matched_funcs_len" : 3741 ``` ```mermaid pie showData title Matched Function Similarity - 99.6525% "matched_funcs_with_code_changes_len" : 7 "matched_funcs_with_non_code_changes_len" : 6 "matched_funcs_no_changes_len" : 3728 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ./proj --project-name c62470 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 clfs-7309.sys clfs-7462.sys ``` #### Verbose Args

``` --old ['clfs-7309.sys'] --new [['clfs-7462.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name c62470 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/E799DFEB8C000/Clfs.Sys -O clfs.sys.x64.10.0.26100.7309 wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/4C76C7ED8C000/Clfs.Sys -O clfs.sys.x64.10.0.26100.7462 ``` ## Binary Metadata Diff ```diff --- clfs-7309.sys Meta +++ clfs-7462.sys Meta @@ -1,44 +1,44 @@ -Program Name: clfs-7309.sys +Program Name: clfs-7462.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 578032 +# of Bytes: 578040 # of Memory Blocks: 14 -# of Instructions: 101689 -# of Defined Data: 3955 -# of Functions: 1870 -# of Symbols: 14720 +# of Instructions: 101756 +# of Defined Data: 3962 +# of Functions: 1873 +# of Symbols: 14740 # of Data Types: 470 # of Data Type Categories: 20 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 15 18:06:11 SGT 2026 +Date Created: Sat Aug 15 18:06:15 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-7309.sys -Executable MD5: 3a04fb504e3e1106c67f63bad3a16159 -Executable SHA256: d3733ef5d7a94570cf6bcac765c79fa39aa74f36fd6832b8a65c4cf7e41c4e18 -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-7309.sys?MD5=3a04fb504e3e1106c67f63bad3a16159 +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-7462.sys +Executable MD5: e667782e1ef16d09e91c8dd3e58dbd40 +Executable SHA256: ed49d88235472bc05b94ca971988a842544b1314c7848ff944117b5f67b9172e +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/clfs2025/clfs-7462.sys?MD5=e667782e1ef16d09e91c8dd3e58dbd40 PDB Age: 1 PDB File: clfs.pdb -PDB GUID: 1e8a0e2e-7ddf-49e4-9331-c25d510501c3 +PDB GUID: b277826e-b492-cd28-739c-b1f0c69c150f PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Common Log File System Driver -PE Property[FileVersion]: 10.0.26100.7309 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.7462 (WinBuild.160101.0800) PE Property[InternalName]: clfs.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: Clfs.Sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7309 +PE Property[ProductVersion]: 10.0.26100.7462 PE Property[Translation]: 4b00000 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra clfs-7309.sys Decompiler Options

Ghidra clfs-7309.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra clfs-7309.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra clfs-7462.sys Decompiler Options

Ghidra clfs-7462.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra clfs-7462.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|0| |modified_funcs_len|13| |added_symbols_len|4| |deleted_symbols_len|1| |diff_time|4.558972597122192| |deleted_strings_len|1| |added_strings_len|1| |match_types|Counter({'SymbolsHash': 1856, 'ExternalsName': 247, 'ExactInstructionsFunctionHasher': 12, 'Implied Match': 2, 'ExactBytesFunctionHasher': 1})| |items_to_process|20| |diff_types|Counter({'address': 10, 'refcount': 8, 'code': 7, 'length': 7, 'calling': 6, 'called': 5, 'name': 2, 'fullname': 2, 'sig': 2, 'parent': 2})| |unmatched_funcs_len|2| |total_funcs_len|3743| |matched_funcs_len|3741| |matched_funcs_with_code_changes_len|7| |matched_funcs_with_non_code_changes_len|6| |matched_funcs_no_changes_len|3728| |match_func_similarity_percent|99.6525%| |func_match_overall_percent|99.9466%| |first_matches|Counter({'SymbolsHash': 1856, 'ExactInstructionsFunctionHasher': 12, 'Implied Match': 2, 'ExactBytesFunctionHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1856 "ExternalsName" : 247 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 12 "Implied-Match" : 2 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1856 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 12 "Implied-Match" : 2 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 0 "modified_funcs_len" : 13 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 4 "deleted_symbols_len" : 1 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 1 "added_strings_len" : 1 ``` ### Strings Diff ```diff ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_CClfsRequest::Create::CClfsRequest::WriteRestart| |paramcount|0| |address|140015618| |sig|ulonglong __fastcall Feature_1757897016__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1757897016__private_IsEnabledDeviceUsageNoInline +++ Feature_1757897016__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_1757897016__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_1757897016__private_featureState; + if ((Feature_1757897016__private_featureState & 0x10) == 0) { + uVar1 = Feature_1757897016__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_1757897016__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_1757897016__private_IsEnabledFallback ### Function Meta |Key|clfs-7462.sys| | :---: | :---: | |name|Feature_1757897016__private_IsEnabledFallback| |fullname|Feature_1757897016__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1757897016__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140015650| |sig|undefined __fastcall Feature_1757897016__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1757897016__private_IsEnabledFallback +++ Feature_1757897016__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1757897016__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1757897016__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## CClfsRequest::WriteRestart ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.31| |i_ratio|0.68| |m_ratio|0.96| |b_ratio|0.56| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|WriteRestart|WriteRestart| |fullname|CClfsRequest::WriteRestart|CClfsRequest::WriteRestart| |refcount|2|2| |`length`|1010|1088| |`called`|

Expand for full list:
CClfsLogCcb::AddRef
CClfsLogCcb::MarkAccessed
CClfsRequest_State::Change_State_Done
CClfsRequest_State::Change_State_WriteRestartPending
ClfsProbeAndAllocateMdl
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::ProbeForRead
_guard_dispatch_icall

Expand for full list:
CClfsLogCcb::AddRef
CClfsRequest::GetAlignedBufferSize
CClfsRequest_State::Change_State_Done
CClfsRequest_State::Change_State_WriteRestartPending
ClfsProbeAndAllocateMdl
Feature_1757897016__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::ProbeForRead

_guard_dispatch_icall

| |calling|CClfsRequest::Dispatch|CClfsRequest::Dispatch| |paramcount|1|1| |`address`|1400463fc|1400464cc| |sig|long __thiscall WriteRestart(CClfsRequest * this)|long __thiscall WriteRestart(CClfsRequest * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsRequest::WriteRestart Called Diff ```diff --- CClfsRequest::WriteRestart called +++ CClfsRequest::WriteRestart called @@ -2 +2 @@ -CClfsLogCcb::MarkAccessed +CClfsRequest::GetAlignedBufferSize @@ -5,0 +6 @@ +Feature_1757897016__private_IsEnabledDeviceUsageNoInline ``` ### CClfsRequest::WriteRestart Diff ```diff --- CClfsRequest::WriteRestart +++ CClfsRequest::WriteRestart @@ -1,148 +1,165 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* private: long __cdecl CClfsRequest::WriteRestart(void) __ptr64 */ long __thiscall CClfsRequest::WriteRestart(CClfsRequest *this) { CClfsRequest *pCVar1; byte *pbVar2; - uint uVar3; - ulonglong uVar4; - uint uVar5; - undefined8 *puVar6; - longlong lVar7; - undefined8 *puVar8; - longlong lVar9; - CClfsRequest *pCVar10; - undefined1 local_res10; - uint local_res18 [2]; + uint *puVar3; + uint uVar4; + longlong lVar5; + ulong uVar6; + uint uVar7; + ulonglong uVar8; + undefined8 *puVar9; + longlong lVar10; + char cVar11; + undefined8 *puVar12; + undefined8 uVar13; + uint local_res10 [2]; + longlong local_res18; longlong local_res20; - ulonglong in_stack_ffffffffffffff38; - undefined8 in_stack_ffffffffffffff40; - undefined4 uVar11; - longlong *plVar12; - longlong local_50; - CClfsRequest *local_48; - CClfsRequest *local_40; + ulonglong in_stack_ffffffffffffff18; + undefined8 in_stack_ffffffffffffff20; + undefined4 uVar14; + longlong *plVar15; + uint local_78; + undefined1 local_74; - uVar11 = (undefined4)((ulonglong)in_stack_ffffffffffffff40 >> 0x20); - puVar8 = (undefined8 *)0x0; + uVar14 = (undefined4)((ulonglong)in_stack_ffffffffffffff20 >> 0x20); + puVar12 = (undefined8 *)0x0; + uVar7 = 0; + local_res18 = 0; + local_78 = 0; local_res20 = 0; - uVar5 = 0; - local_50 = 0; - local_res18[0] = 0; - local_res10 = 0; + local_res10[0] = 0; + local_74 = 0; pCVar1 = this + 0x30; - lVar9 = *(longlong *)(*(longlong *)pCVar1 + 0xb8); - local_48 = pCVar1; - local_40 = this; - if ((*(int *)(lVar9 + 0x10) == 0x30) && - (uVar3 = *(uint *)(lVar9 + 8), *(uint *)(this + 0x108) = uVar3, 0x6f < uVar3)) { + lVar5 = *(longlong *)(*(longlong *)pCVar1 + 0xb8); + if ((*(int *)(lVar5 + 0x10) == 0x30) && + (uVar4 = *(uint *)(lVar5 + 8), *(uint *)(this + 0x108) = uVar4, 0x6f < uVar4)) { *(CClfsRequest **)(*(longlong *)pCVar1 + 0x78) = this; - puVar6 = *(undefined8 **)(lVar9 + 0x20); - if (puVar6 == (undefined8 *)0x0) { - uVar5 = 0xc00000e8; + puVar9 = *(undefined8 **)(lVar5 + 0x20); + if (puVar9 == (undefined8 *)0x0) { + uVar7 = 0xc00000e8; + local_78 = 0xc00000e8; } else { - ProbeForRead(puVar6,0x30,4); - *(undefined8 *)(this + 0xd8) = puVar6[3]; - *(undefined8 *)(this + 0xe0) = puVar6[4]; - *(undefined8 *)(this + 0xf0) = *puVar6; - *(undefined8 *)(this + 0xf8) = puVar6[2]; - *(undefined8 *)(this + 0x100) = puVar6[1]; - local_res10 = *(undefined1 *)(puVar6 + 5); + ProbeForRead(puVar9,0x30,4); + *(undefined8 *)(this + 0xd8) = puVar9[3]; + *(undefined8 *)(this + 0xe0) = puVar9[4]; + *(undefined8 *)(this + 0xf0) = *puVar9; + *(undefined8 *)(this + 0xf8) = puVar9[2]; + *(undefined8 *)(this + 0x100) = puVar9[1]; + local_74 = *(undefined1 *)(puVar9 + 5); } - if (-1 < (int)uVar5) { - plVar12 = *(longlong **)(*(longlong *)(*(longlong *)(lVar9 + 0x30) + 0x18) + 0x78); - *(longlong **)(this + 0x90) = plVar12; - *(undefined8 *)(this + 0x98) = *(undefined8 *)(*(longlong *)(lVar9 + 0x30) + 0x20); - (**(code **)(*plVar12 + 0x40))(); + if (-1 < (int)uVar7) { + plVar15 = *(longlong **)(*(longlong *)(*(longlong *)(lVar5 + 0x30) + 0x18) + 0x78); + *(longlong **)(this + 0x90) = plVar15; + *(undefined8 *)(this + 0x98) = *(undefined8 *)(*(longlong *)(lVar5 + 0x30) + 0x20); + (**(code **)(*plVar15 + 0x40))(); CClfsLogCcb::AddRef(*(CClfsLogCcb **)(this + 0x98)); - uVar4 = *(ulonglong *)(*(longlong *)pCVar1 + 0x70); - if ((uVar4 & 7) == 0) { - plVar12 = &local_res20; - uVar5 = ClfsProbeAndAllocateMdl - (*(char *)(*(longlong *)pCVar1 + 0x40),uVar4,*(undefined4 *)(this + 0x108) - ); - if (-1 < (int)uVar5) { - puVar6 = (undefined8 *)ExAllocatePoolWithTag(0x200,0x18,0x4a666c43); - lVar7 = local_res20; - if (puVar6 != (undefined8 *)0x0) { - *puVar6 = &CClfsMdlReference::_vftable_; - *(undefined4 *)(puVar6 + 1) = 0; - puVar6[2] = local_res20; - puVar8 = puVar6; + if ((*(byte *)(*(longlong *)pCVar1 + 0x70) & 7) == 0) { + uVar8 = Feature_1757897016__private_IsEnabledDeviceUsageNoInline(); + uVar6 = *(ulong *)(this + 0x108); + if ((int)uVar8 == 0) { + uVar13 = *(undefined8 *)(*(longlong *)pCVar1 + 0x70); + cVar11 = *(char *)(*(longlong *)pCVar1 + 0x40); + } + else { + uVar6 = GetAlignedBufferSize(this,uVar6); + uVar13 = *(undefined8 *)(*(longlong *)pCVar1 + 0x70); + cVar11 = *(char *)(*(longlong *)pCVar1 + 0x40); + } + plVar15 = &local_res18; + local_78 = ClfsProbeAndAllocateMdl(cVar11,uVar13,uVar6); + if (-1 < (int)local_78) { + puVar9 = (undefined8 *)ExAllocatePoolWithTag(0x200,0x18,0x4a666c43); + lVar10 = local_res18; + if (puVar9 != (undefined8 *)0x0) { + *puVar9 = &CClfsMdlReference::_vftable_; + *(undefined4 *)(puVar9 + 1) = 0; + puVar9[2] = local_res18; + puVar12 = puVar9; } - *(undefined8 **)(this + 0x50) = puVar8; - if (puVar8 == (undefined8 *)0x0) { - IoFreeMdl(local_res20); - local_res20 = 0; - uVar5 = 0xc000009a; + *(undefined8 **)(this + 0x50) = puVar12; + if (puVar12 == (undefined8 *)0x0) { + IoFreeMdl(local_res18); + local_res18 = 0; + local_78 = 0xc000009a; } else { - (**(code **)*puVar8)(); - MmProbeAndLockPages(lVar7,CONCAT71((int7)((ulonglong)*(longlong *)pCVar1 >> 8), - *(undefined1 *)(*(longlong *)pCVar1 + 0x40)),2); - if ((*(byte *)(lVar7 + 10) & 5) == 0) { - lVar7 = MmMapLockedPagesSpecifyCache - (lVar7,0,1,0,in_stack_ffffffffffffff38 & 0xffffffff00000000, - CONCAT44(uVar11,0x40000010),plVar12); + (**(code **)*puVar12)(); + MmProbeAndLockPages(lVar10,CONCAT71((int7)((ulonglong)*(longlong *)pCVar1 >> 8), + *(undefined1 *)(*(longlong *)pCVar1 + 0x40)),2); + if ((*(byte *)(lVar10 + 10) & 5) == 0) { + lVar10 = MmMapLockedPagesSpecifyCache + (lVar10,0,1,0,in_stack_ffffffffffffff18 & 0xffffffff00000000, + CONCAT44(uVar14,0x40000010),plVar15); } else { - lVar7 = *(longlong *)(lVar7 + 0x18); + lVar10 = *(longlong *)(lVar10 + 0x18); } - *(longlong *)(this + 0x110) = lVar7; - if (lVar7 == 0) { - uVar5 = 0xc000009a; + *(longlong *)(this + 0x110) = lVar10; + if (lVar10 == 0) { + local_78 = 0xc000009a; } } } } else { - uVar5 = 0xc00000e8; + local_78 = 0xc00000e8; } - if (-1 < (int)uVar5) { + uVar7 = local_78; + if (-1 < (int)local_78) { if (*(longlong *)(*(longlong *)(this + 0x98) + 0x68) + *(longlong *)(this + 0xf0) < 0) { - uVar5 = 0xc01a0010; + uVar7 = 0xc01a0010; + local_78 = uVar7; } else { CClfsRequest_State::Change_State_WriteRestartPending (*(CClfsRequest_State **)(this + 0x68),this); - uVar5 = (**(code **)(**(longlong **)(this + 0x90) + 0x98)) - (*(longlong **)(this + 0x90),*(undefined8 *)(lVar9 + 0x30), + uVar7 = (**(code **)(**(longlong **)(this + 0x90) + 0x98)) + (*(longlong **)(this + 0x90),*(undefined8 *)(lVar5 + 0x30), *(longlong *)(this + 0x110),*(undefined4 *)(this + 0x108),this + 0xf0, - this + 0xf8,this + 0x100,local_res10,0,0,this,this + 0xd8,this + 0xe0, - this + 0xd0,*(longlong *)(this + 0x110) + 0x20,local_res18,&local_50); + this + 0xf8,this + 0x100,local_74,0,0,this,this + 0xd8,this + 0xe0, + this + 0xd0,*(longlong *)(this + 0x110) + 0x20,local_res10,&local_res20 + ); + local_78 = uVar7; } } } } else { - uVar5 = 0xc0000206; + uVar7 = 0xc0000206; + local_78 = uVar7; } - if ((int)uVar5 < 0) { - pCVar10 = local_40 + 0x98; + if (-1 < (int)uVar7) { + *(longlong *)(*(longlong *)(this + 0x98) + 0x68) = + *(longlong *)(*(longlong *)(this + 0x98) + 0x68) + local_res20; } - else { - pCVar10 = this + 0x98; - *(longlong *)(*(longlong *)pCVar10 + 0x68) = - *(longlong *)(*(longlong *)pCVar10 + 0x68) + local_50; - } - if (uVar5 == 0x103) { + if (uVar7 == 0x103) { pbVar2 = (byte *)(*(longlong *)(*(longlong *)pCVar1 + 0xb8) + 3); *pbVar2 = *pbVar2 | 1; } else { CClfsRequest_State::Change_State_Done(*(CClfsRequest_State **)(this + 0x68),this); - if (-1 < (int)uVar5) { - lVar9 = *(longlong *)(this + 0x110); - CClfsLogCcb::MarkAccessed(*(CClfsLogCcb **)pCVar10); - *(undefined8 *)(lVar9 + 0x18) = *(undefined8 *)(this + 0xf8); + if (-1 < (int)uVar7) { + lVar5 = *(longlong *)(this + 0x110); + if ((*(uint *)(*(longlong *)(this + 0x98) + 0x1c) & 8) == 0) { + LOCK(); + puVar3 = (uint *)(*(longlong *)(this + 0x98) + 0x1c); + *puVar3 = *puVar3 | 8; + UNLOCK(); + } + *(undefined8 *)(lVar5 + 0x18) = *(undefined8 *)(this + 0xf8); + uVar7 = local_78; } - *(uint *)(*(longlong *)(this + 0x30) + 0x30) = uVar5; - *(ulonglong *)(*(longlong *)(this + 0x30) + 0x38) = (ulonglong)local_res18[0]; + *(uint *)(*(longlong *)(this + 0x30) + 0x30) = uVar7; + *(ulonglong *)(*(longlong *)(this + 0x30) + 0x38) = (ulonglong)local_res10[0]; } - return uVar5; + return uVar7; } ``` ## `CClfsRequest::WriteRestart'::__l1::fin$2 ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.29| |i_ratio|0.67| |m_ratio|0.94| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|fin$2|fin$2| |fullname|`CClfsRequest::WriteRestart'::__l1::fin$2|`CClfsRequest::WriteRestart'::__l1::fin$2| |refcount|1|1| |`length`|152|172| |`called`|CClfsLogCcb::MarkAccessed
CClfsRequest_State::Change_State_Done|CClfsRequest_State::Change_State_Done| |calling||| |paramcount|2|2| |`address`|1400817b8|1400817d7| |sig|undefined __fastcall fin$2(undefined8 param_1, longlong param_2)|undefined __fastcall fin$2(undefined8 param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### `CClfsRequest::WriteRestart'::__l1::fin$2 Called Diff ```diff --- `CClfsRequest::WriteRestart'::__l1::fin$2 called +++ `CClfsRequest::WriteRestart'::__l1::fin$2 called @@ -1 +0,0 @@ -CClfsLogCcb::MarkAccessed ``` ### `CClfsRequest::WriteRestart'::__l1::fin$2 Diff ```diff --- `CClfsRequest::WriteRestart'::__l1::fin$2 +++ `CClfsRequest::WriteRestart'::__l1::fin$2 @@ -1,32 +1,42 @@ void `CClfsRequest::WriteRestart'::__l1::fin_2(undefined8 param_1,longlong param_2) { - byte *pbVar1; - int iVar2; - CClfsRequest *pCVar3; - longlong lVar4; + longlong *plVar1; + byte *pbVar2; + uint *puVar3; + CClfsRequest *pCVar4; + longlong lVar5; + int iVar6; - iVar2 = *(int *)(param_2 + 0x94); - pCVar3 = *(CClfsRequest **)(param_2 + 0xf0); - if (-1 < iVar2) { - *(longlong *)(*(longlong *)(pCVar3 + 0x98) + 0x68) = - *(longlong *)(*(longlong *)(pCVar3 + 0x98) + 0x68) + *(longlong *)(param_2 + 0x98); + iVar6 = *(int *)(param_2 + 0x90); + pCVar4 = *(CClfsRequest **)(param_2 + 0x110); + if (-1 < iVar6) { + lVar5 = *(longlong *)(pCVar4 + 0x98); + *(longlong *)(param_2 + 0x110) = lVar5; + plVar1 = (longlong *)(lVar5 + 0x68); + *plVar1 = *plVar1 + *(longlong *)(param_2 + 0x128); } - if (iVar2 == 0x103) { - pbVar1 = (byte *)(*(longlong *)(*(longlong *)(pCVar3 + 0x30) + 0xb8) + 3); - *pbVar1 = *pbVar1 | 1; + if (iVar6 == 0x103) { + pbVar2 = (byte *)(*(longlong *)(*(longlong *)(pCVar4 + 0x30) + 0xb8) + 3); + *pbVar2 = *pbVar2 | 1; } else { - CClfsRequest_State::Change_State_Done(*(CClfsRequest_State **)(pCVar3 + 0x68),pCVar3); - if (-1 < iVar2) { - lVar4 = *(longlong *)(pCVar3 + 0x110); - CClfsLogCcb::MarkAccessed(*(CClfsLogCcb **)(pCVar3 + 0x98)); - *(undefined8 *)(lVar4 + 0x18) = *(undefined8 *)(pCVar3 + 0xf8); + CClfsRequest_State::Change_State_Done(*(CClfsRequest_State **)(pCVar4 + 0x68),pCVar4); + if (-1 < iVar6) { + lVar5 = *(longlong *)(pCVar4 + 0x110); + if ((*(uint *)(*(longlong *)(pCVar4 + 0x98) + 0x1c) & 8) == 0) { + LOCK(); + puVar3 = (uint *)(*(longlong *)(pCVar4 + 0x98) + 0x1c); + *puVar3 = *puVar3 | 8; + UNLOCK(); + } + *(undefined8 *)(lVar5 + 0x18) = *(undefined8 *)(pCVar4 + 0xf8); + iVar6 = *(int *)(param_2 + 0x90); } - *(int *)(*(longlong *)(pCVar3 + 0x30) + 0x30) = iVar2; - *(ulonglong *)(*(longlong *)(pCVar3 + 0x30) + 0x38) = (ulonglong)*(uint *)(param_2 + 0x100); + *(int *)(*(longlong *)(pCVar4 + 0x30) + 0x30) = iVar6; + *(ulonglong *)(*(longlong *)(pCVar4 + 0x30) + 0x38) = (ulonglong)*(uint *)(param_2 + 0x118); } return; } ``` ## `CClfsRequest::WriteRestart'::__l1::filt$0 ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.73| |i_ratio|0.86| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|filt$0|filt$0| |fullname|`CClfsRequest::WriteRestart'::__l1::filt$0|`CClfsRequest::WriteRestart'::__l1::filt$0| |refcount|1|1| |`length`|37|44| |called|CClfsRequest::ProcessException|CClfsRequest::ProcessException| |calling||| |paramcount|2|2| |`address`|140081792|1400817aa| |sig|undefined __fastcall filt$0(_EXCEPTION_POINTERS * param_1, longlong param_2)|undefined __fastcall filt$0(_EXCEPTION_POINTERS * param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### `CClfsRequest::WriteRestart'::__l1::filt$0 Diff ```diff --- `CClfsRequest::WriteRestart'::__l1::filt$0 +++ `CClfsRequest::WriteRestart'::__l1::filt$0 @@ -1,8 +1,9 @@ void `CClfsRequest::WriteRestart'::__l1::filt_0(_EXCEPTION_POINTERS *param_1,longlong param_2) { - CClfsRequest::ProcessException(*(CClfsRequest **)(param_2 + 0xf0),param_1); + *(_EXCEPTION_POINTERS **)(param_2 + 0xc0) = param_1; + CClfsRequest::ProcessException(*(CClfsRequest **)(param_2 + 0x110),param_1); return; } ``` ## `CClfsRequest::WriteRestart'::__l1::filt$1 ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.73| |i_ratio|0.86| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|filt$1|filt$1| |fullname|`CClfsRequest::WriteRestart'::__l1::filt$1|`CClfsRequest::WriteRestart'::__l1::filt$1| |refcount|1|1| |`length`|37|44| |called|CClfsRequest::ProcessException|CClfsRequest::ProcessException| |calling||| |paramcount|2|2| |`address`|14008176c|14008177d| |sig|undefined __fastcall filt$1(_EXCEPTION_POINTERS * param_1, longlong param_2)|undefined __fastcall filt$1(_EXCEPTION_POINTERS * param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### `CClfsRequest::WriteRestart'::__l1::filt$1 Diff ```diff --- `CClfsRequest::WriteRestart'::__l1::filt$1 +++ `CClfsRequest::WriteRestart'::__l1::filt$1 @@ -1,8 +1,9 @@ void `CClfsRequest::WriteRestart'::__l1::filt_1(_EXCEPTION_POINTERS *param_1,longlong param_2) { - CClfsRequest::ProcessException(*(CClfsRequest **)(param_2 + 0xf0),param_1); + *(_EXCEPTION_POINTERS **)(param_2 + 200) = param_1; + CClfsRequest::ProcessException(*(CClfsRequest **)(param_2 + 0x110),param_1); return; } ``` ## CClfsRequest::ReserveAndAppendLog ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.43| |i_ratio|0.47| |m_ratio|0.98| |b_ratio|0.49| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|ReserveAndAppendLog|ReserveAndAppendLog| |fullname|CClfsRequest::ReserveAndAppendLog|CClfsRequest::ReserveAndAppendLog| |refcount|2|2| |`length`|2757|2522| |`called`|

Expand for full list:
CClfsLogCcb::MarkAccessed
CClfsLogFcbCommon::ReportFlushFailure
CClfsLogFcbCommon::SetGlobalFlushFailureTag
CClfsRequest_State::Change_State_AppendPendingFlush
CClfsRequest_State::Change_State_Done
ClfsProbeAndAllocateMdl
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache

NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::ProbeForWrite
_guard_dispatch_icall
memset

Expand for full list:
CClfsLogCcb::MarkAccessed
CClfsLogFcbCommon::ReportFlushFailure
CClfsLogFcbCommon::SetGlobalFlushFailureTag
CClfsRequest::GetAlignedBufferSize
CClfsRequest_State::Change_State_AppendPendingFlush
CClfsRequest_State::Change_State_Done
ClfsProbeAndAllocateMdl
Feature_1757897016__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl

NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ProbeForRead
NTOSKRNL.EXE::ProbeForWrite
_guard_dispatch_icall
memset

| |calling|CClfsRequest::Dispatch|CClfsRequest::Dispatch| |paramcount|1|1| |`address`|140074110|140079144| |sig|long __thiscall ReserveAndAppendLog(CClfsRequest * this)|long __thiscall ReserveAndAppendLog(CClfsRequest * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsRequest::ReserveAndAppendLog Called Diff ```diff --- CClfsRequest::ReserveAndAppendLog called +++ CClfsRequest::ReserveAndAppendLog called @@ -3,0 +4 @@ +CClfsRequest::GetAlignedBufferSize @@ -6,0 +8 @@ +Feature_1757897016__private_IsEnabledDeviceUsageNoInline ``` ### CClfsRequest::ReserveAndAppendLog Diff ```diff --- CClfsRequest::ReserveAndAppendLog +++ CClfsRequest::ReserveAndAppendLog @@ -1,413 +1,380 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ -/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* private: long __cdecl CClfsRequest::ReserveAndAppendLog(void) __ptr64 */ long __thiscall CClfsRequest::ReserveAndAppendLog(CClfsRequest *this) { CClfsLogCcb *pCVar1; byte *pbVar2; char cVar3; - int iVar4; + uint uVar4; CClfsLogCcb *this_00; uint uVar5; char cVar6; uint uVar7; longlong lVar8; longlong lVar9; - longlong *plVar10; + ulonglong uVar10; undefined8 *puVar11; ulong uVar12; - CClfsRequest *pCVar13; - longlong *plVar14; - char local_res18; - uint local_res20; - undefined1 auStack_1e8 [32]; - longlong *local_1c8; - longlong *local_1c0; - uint *local_1b8; - char local_1b0; - CClfsRequest *local_1a8; - longlong *local_1a0; - longlong local_198; + longlong *plVar13; + CClfsRequest *pCVar14; + undefined1 auStack_1d8 [32]; + longlong *local_1b8; + longlong *local_1b0; + uint *local_1a8; + char local_1a0; + CClfsRequest *local_198; longlong *local_190; - undefined8 *local_188; - undefined8 *local_180; + longlong local_188; + longlong *local_180; undefined8 *local_178; - uint local_168; - char local_164; - CClfsRequest *local_160; - int local_158; + undefined8 *local_170; + undefined8 *local_168; + uint local_158; longlong local_150; - uint local_148; + char local_148; uint local_144; - undefined8 *local_140; - int local_138; + ulong local_140; + longlong local_138; longlong *local_130; - longlong *local_128; - longlong local_120; + longlong local_128; + undefined8 *local_120; longlong local_118; - undefined8 *local_110; + uint local_110; longlong local_108; - longlong local_100; - longlong local_f8; - CClfsLogCcb *local_f0; - undefined8 *local_e8; - CClfsLogCcb *local_e0; - undefined8 *local_d8; - longlong *local_d0; - longlong local_c8; - longlong local_c0; - longlong local_b8; + longlong *local_100; + longlong *local_f8; + longlong local_f0; + longlong local_e8; + longlong local_e0; + longlong local_d8; + undefined8 local_d0; + undefined8 *local_c8; + undefined8 local_c0; + CClfsRequest *local_b8; longlong local_b0; - undefined8 local_a8; + CClfsLogCcb *local_a8; undefined8 local_a0; - longlong *local_98; - undefined8 local_90; - undefined1 *local_88; + undefined1 *local_98; + longlong local_90; + ulonglong local_88; longlong local_80; ulonglong local_78; - longlong local_70; - ulonglong local_68; + ulonglong local_70; ulonglong local_60; - ulonglong local_50; - undefined4 local_48; - undefined1 local_44; + undefined4 local_58; + undefined1 local_54; + undefined8 *local_50; + undefined8 *local_48; + longlong *local_40; - local_88 = auStack_1e8; - local_a8 = 0; - local_90 = 0xffffffff00000000; + local_98 = auStack_1d8; + local_d0 = 0; local_a0 = 0xffffffff00000000; - local_c8 = 0; + local_c0 = 0xffffffff00000000; + local_f0 = 0; + local_128 = 0; local_118 = 0; + local_e8 = 0; + local_d8 = 0; local_108 = 0; - local_c0 = 0; - local_b0 = 0; - local_f8 = 0; lVar9 = 0; local_150 = 0; - local_120 = 0; - local_168 = 0; - local_148 = 0; - memset(&local_80,0,0x40); - pCVar13 = this + 0x30; - cVar3 = *(char *)(*(longlong *)pCVar13 + 0x40); - lVar8 = *(longlong *)(*(longlong *)pCVar13 + 0xb8); - local_b8 = *(longlong *)(lVar8 + 0x30); - plVar10 = *(longlong **)(*(longlong *)(local_b8 + 0x18) + 0x78); - *(longlong **)(this + 0x90) = plVar10; - local_f0 = *(CClfsLogCcb **)(*(longlong *)(lVar8 + 0x30) + 0x20); - local_160 = pCVar13; - local_e0 = local_f0; - (**(code **)(*plVar10 + 0x40))(); - plVar10 = *(longlong **)(lVar8 + 0x20); - local_98 = plVar10; - cVar6 = IoIs32bitProcess(*(longlong *)pCVar13); + local_138 = 0; + local_158 = 0; + local_144 = 0; + memset(&local_90,0,0x40); + pCVar14 = this + 0x30; + cVar3 = *(char *)(*(longlong *)pCVar14 + 0x40); + lVar8 = *(longlong *)(*(longlong *)pCVar14 + 0xb8); + local_e0 = *(longlong *)(lVar8 + 0x30); + plVar13 = *(longlong **)(*(longlong *)(local_e0 + 0x18) + 0x78); + *(longlong **)(this + 0x90) = plVar13; + local_a8 = *(CClfsLogCcb **)(*(longlong *)(lVar8 + 0x30) + 0x20); + local_b8 = pCVar14; + (**(code **)(*plVar13 + 0x40))(); + plVar13 = *(longlong **)(lVar8 + 0x20); + cVar6 = IoIs32bitProcess(*(longlong *)pCVar14); if (cVar6 == '\0') { if (*(uint *)(lVar8 + 0x10) < 0x40) goto LAB_0; - ProbeForRead(plVar10,0x40,8); + ProbeForRead(plVar13,0x40,8); } else { if (*(uint *)(lVar8 + 0x10) < 0x38) { LAB_0: uVar7 = 0xc0000206; uVar5 = uVar7; goto LAB_1; } - ProbeForRead(plVar10,0x38,8); - local_48 = *(undefined4 *)((longlong)plVar10 + 0x2c); - local_70 = plVar10[2]; - local_80 = *plVar10; - local_44 = (char)plVar10[6]; - local_78 = (ulonglong)*(uint *)(plVar10 + 1); - local_50 = (ulonglong)*(uint *)(plVar10 + 5); - local_68 = (ulonglong)*(uint *)(plVar10 + 3); - local_60 = (ulonglong)*(uint *)((longlong)plVar10 + 0x1c); - plVar10 = &local_80; - local_98 = plVar10; - } - local_158 = *(int *)(lVar8 + 8); - local_138 = local_158; - if ((local_158 != 0) && (*(longlong *)(*(longlong *)pCVar13 + 0x70) == 0)) { + ProbeForRead(plVar13,0x38,8); + local_58 = *(undefined4 *)((longlong)plVar13 + 0x2c); + local_80 = plVar13[2]; + local_90 = *plVar13; + local_54 = (char)plVar13[6]; + local_88 = (ulonglong)*(uint *)(plVar13 + 1); + local_60 = (ulonglong)*(uint *)(plVar13 + 5); + local_78 = (ulonglong)*(uint *)(plVar13 + 3); + local_70 = (ulonglong)*(uint *)((longlong)plVar13 + 0x1c); + plVar13 = &local_90; + } + local_140 = *(ulong *)(lVar8 + 8); + if ((local_140 != 0) && (*(longlong *)(*(longlong *)pCVar14 + 0x70) == 0)) { uVar7 = 0xc00000e8; uVar5 = uVar7; goto LAB_1; } - local_110 = (undefined8 *)plVar10[3]; - local_140 = (undefined8 *)plVar10[4]; - local_130 = (longlong *)plVar10[1]; - local_res20 = *(uint *)(plVar10 + 7); - plVar14 = (longlong *)plVar10[6]; - local_c8 = plVar10[5]; - local_144 = local_res20; - local_128 = plVar14; - local_e8 = local_110; - local_d8 = local_140; - local_d0 = local_130; - ProbeForWrite(local_110,8,8); - ProbeForWrite(local_140,8,8); - ProbeForWrite(local_130,8,8); - local_108 = *local_130; - local_res18 = *(char *)((longlong)plVar10 + 0x3c); - local_c0 = plVar10[2]; - local_118 = *plVar10; - *(undefined8 **)(this + 0x78) = local_110; - *(undefined8 *)(this + 0xd0) = *local_110; - *(undefined8 **)(this + 0x80) = local_140; + local_c8 = (undefined8 *)plVar13[3]; + local_50 = local_c8; + local_120 = (undefined8 *)plVar13[4]; + local_48 = local_120; + local_100 = (longlong *)plVar13[1]; + local_40 = local_100; + uVar4 = *(uint *)(plVar13 + 7); + local_130 = (longlong *)plVar13[6]; + local_f0 = plVar13[5]; + local_110 = uVar4; + local_f8 = local_130; + ProbeForWrite(local_c8,8,8); + ProbeForWrite(local_120,8,8); + ProbeForWrite(local_100,8,8); + local_118 = *local_100; + cVar6 = *(char *)((longlong)plVar13 + 0x3c); + local_e8 = plVar13[2]; + local_128 = *plVar13; + *(undefined8 **)(this + 0x78) = local_c8; + *(undefined8 *)(this + 0xd0) = *local_c8; + *(undefined8 **)(this + 0x80) = local_120; uVar7 = 0; - local_164 = local_res18; - if (local_res18 == '\0') { + local_148 = cVar6; + if (cVar6 == '\0') { LAB_2: - pCVar13 = local_160; - uVar5 = local_168; + uVar5 = local_158; if ((int)uVar7 < 0) goto LAB_1; - if (local_res20 != 0) { - if (plVar14 == (longlong *)0x0) { + if (uVar4 != 0) { + if (local_130 == (longlong *)0x0) { uVar7 = 0xc000000d; uVar5 = uVar7; goto LAB_1; } - local_1c8 = (longlong *)0x0; - lVar9 = IoAllocateMdl(plVar14,local_res20,0,1); + local_1b8 = (longlong *)0x0; + lVar9 = IoAllocateMdl(local_130,uVar4,0,1); local_150 = lVar9; if (lVar9 == 0) { CClfsLogFcbCommon::ReportFlushFailure(5,-0x3fffffff); uVar12 = 0x14; goto LAB_3; } MmProbeAndLockPages(lVar9,cVar3,1); if ((*(byte *)(lVar9 + 10) & 5) == 0) { - local_1c0 = (longlong *)CONCAT44(local_1c0._4_4_,0x40000010); - local_1c8 = (longlong *)((ulonglong)local_1c8 & 0xffffffff00000000); - plVar10 = (longlong *)MmMapLockedPagesSpecifyCache(lVar9,0,1); - } - else { - plVar10 = *(longlong **)(lVar9 + 0x18); - } - local_128 = plVar10; - if (plVar10 == (longlong *)0x0) { + local_1b0 = (longlong *)CONCAT44(local_1b0._4_4_,0x40000010); + local_1b8 = (longlong *)((ulonglong)local_1b8 & 0xffffffff00000000); + local_130 = (longlong *)MmMapLockedPagesSpecifyCache(lVar9,0,1); + } + else { + local_130 = *(longlong **)(lVar9 + 0x18); + } + local_f8 = local_130; + if (local_130 == (longlong *)0x0) { CClfsLogFcbCommon::ReportFlushFailure(8,-0x3fffffff); - local_168 = 0xc000009a; + local_158 = 0xc000009a; CClfsLogFcbCommon::SetGlobalFlushFailureTag(0x15,-0x3fffff66); uVar7 = 0xc000009a; } - pCVar13 = local_160; - uVar5 = local_168; + uVar5 = local_158; if ((int)uVar7 < 0) goto LAB_1; - local_148 = local_res20; - local_1b8 = &local_148; - local_1c8 = (longlong *)((ulonglong)local_1c8 & 0xffffffff00000000); - local_1c0 = plVar10; + local_1a8 = &local_144; + local_1b8 = (longlong *)((ulonglong)local_1b8 & 0xffffffff00000000); + local_1b0 = local_130; + local_144 = uVar4; uVar7 = (**(code **)(**(longlong **)(this + 0x90) + 0xf0)) - (*(longlong **)(this + 0x90),local_b8,0,0); + (*(longlong **)(this + 0x90),local_e0,0,0); if ((int)uVar7 < 0) { - memset(plVar10,0,(ulonglong)local_res20); - local_144 = local_148; - if ((local_158 == 0) && (pCVar13 = local_160, uVar5 = uVar7, local_118 == 0)) - goto LAB_1; - } - } - lVar8 = local_f8; - if (local_158 != 0) { - local_1b8 = (uint *)&local_120; - uVar7 = ClfsProbeAndAllocateMdl - (cVar3,*(undefined8 *)(*(longlong *)local_160 + 0x70), - local_158 + 0x1ffU & 0xfffffe00); - local_168 = uVar7; + memset(local_130,0,(ulonglong)uVar4); + local_110 = local_144; + if ((local_140 == 0) && (uVar5 = uVar7, local_128 == 0)) goto LAB_1; + } + } + uVar12 = local_140; + if (local_140 != 0) { + uVar10 = Feature_1757897016__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar10 == 0) { + uVar12 = uVar12 + 0x1ff & 0xfffffe00; + } + else { + uVar12 = GetAlignedBufferSize(this,uVar12); + } + local_1a8 = (uint *)&local_138; + uVar7 = ClfsProbeAndAllocateMdl(cVar3,*(undefined8 *)(*(longlong *)pCVar14 + 0x70),uVar12); + local_158 = uVar7; if ((int)uVar7 < 0) { if (uVar7 == 0xc000009a) { CClfsLogFcbCommon::ReportFlushFailure(5,-0x3fffffff); } uVar12 = 0x16; goto LAB_4; } puVar11 = (undefined8 *)ExAllocatePoolWithTag(0x200,0x18,0x4a666c43); - lVar8 = local_120; + lVar8 = local_138; if (puVar11 == (undefined8 *)0x0) { puVar11 = (undefined8 *)0x0; } else { *puVar11 = &CClfsMdlReference::_vftable_; *(undefined4 *)(puVar11 + 1) = 0; - puVar11[2] = local_120; + puVar11[2] = local_138; } *(undefined8 **)(this + 0x50) = puVar11; if (puVar11 == (undefined8 *)0x0) { - IoFreeMdl(local_120); - local_120 = 0; + IoFreeMdl(local_138); + local_138 = 0; CClfsLogFcbCommon::ReportFlushFailure(5,-0x3fffffff); uVar12 = 0x17; goto LAB_3; } (**(code **)*puVar11)(); MmProbeAndLockPages(lVar8,cVar3,0); if ((*(byte *)(lVar8 + 10) & 5) == 0) { - local_1c0 = (longlong *)CONCAT44(local_1c0._4_4_,0x40000010); - local_1c8 = (longlong *)((ulonglong)local_1c8 & 0xffffffff00000000); - lVar8 = MmMapLockedPagesSpecifyCache(lVar8,0,1); - } - else { - lVar8 = *(longlong *)(lVar8 + 0x18); - } - local_f8 = lVar8; - if (lVar8 == 0) { + local_1b0 = (longlong *)CONCAT44(local_1b0._4_4_,0x40000010); + local_1b8 = (longlong *)((ulonglong)local_1b8 & 0xffffffff00000000); + local_108 = MmMapLockedPagesSpecifyCache(lVar8,0,1); + } + else { + local_108 = *(longlong *)(lVar8 + 0x18); + } + local_b0 = local_108; + if (local_108 == 0) { CClfsLogFcbCommon::ReportFlushFailure(8,-0x3fffffff); uVar7 = 0xc000009a; - local_168 = 0xc000009a; + local_158 = 0xc000009a; CClfsLogFcbCommon::SetGlobalFlushFailureTag(0x18,-0x3fffff66); } - pCVar13 = local_160; - uVar5 = local_168; + pCVar14 = local_b8; + uVar5 = local_158; if ((int)uVar7 < 0) goto LAB_1; } - this_00 = local_f0; - iVar4 = local_158; - if ((local_118 + *(longlong *)(local_f0 + 0x68) < 0) || - (*(longlong *)(local_f0 + 0x68) - local_108 < 0)) { + this_00 = local_a8; + uVar12 = local_140; + if ((local_128 + *(longlong *)(local_a8 + 0x68) < 0) || + (*(longlong *)(local_a8 + 0x68) - local_118 < 0)) { uVar7 = 0xc01a0010; - pCVar13 = local_160; uVar5 = uVar7; } else { CClfsRequest_State::Change_State_AppendPendingFlush (*(CClfsRequest_State **)(this + 0x68),this); - pCVar13 = local_160; - local_198 = *(longlong *)local_160 + 0x30; - local_178 = &local_a0; - local_180 = &local_90; - local_188 = &local_a8; - local_190 = &local_b0; - local_1a0 = &local_c8; - local_1b0 = local_res18; - local_1b8 = (uint *)&local_c0; - local_1c0 = &local_108; - local_1c8 = &local_118; - local_1a8 = this; + local_188 = *(longlong *)pCVar14 + 0x30; + local_168 = &local_c0; + local_170 = &local_a0; + local_178 = &local_d0; + local_180 = &local_d8; + local_190 = &local_f0; + local_1a8 = (uint *)&local_e8; + local_1b0 = &local_118; + local_1b8 = &local_128; + local_1a0 = cVar6; + local_198 = this; uVar7 = (**(code **)(**(longlong **)(this + 0x90) + 0x78)) - (*(longlong **)(this + 0x90),local_b8,lVar8,iVar4); + (*(longlong **)(this + 0x90),local_e0,local_108,uVar12); uVar5 = uVar7; if (-1 < (int)uVar7) { pCVar1 = this_00 + 0x68; - *(longlong *)pCVar1 = *(longlong *)pCVar1 + local_b0; - *local_110 = local_a8; + *(longlong *)pCVar1 = *(longlong *)pCVar1 + local_d8; + *local_c8 = local_d0; if (uVar7 != 0x103) { - *local_140 = local_a0; - } - *local_130 = local_108; - local_168 = uVar7; + *local_120 = local_c0; + } + *local_100 = local_118; + local_158 = uVar7; CClfsLogCcb::MarkAccessed(this_00); - uVar5 = local_168; + uVar5 = local_158; } } } else { - local_1c8 = (longlong *)0x0; - lVar8 = IoAllocateMdl(local_110,8,0,1); + local_1b8 = (longlong *)0x0; + lVar8 = IoAllocateMdl(local_c8,8,0,1); *(longlong *)(this + 0x58) = lVar8; if (lVar8 == 0) { CClfsLogFcbCommon::ReportFlushFailure(5,-0x3fffffff); uVar12 = 0x10; } else { MmProbeAndLockPages(lVar8,cVar3,1); lVar8 = *(longlong *)(this + 0x58); if ((*(byte *)(lVar8 + 10) & 5) == 0) { - local_1c0 = (longlong *)CONCAT44(local_1c0._4_4_,0x40000010); - local_1c8 = (longlong *)((ulonglong)local_1c8 & 0xffffffff00000000); - local_100 = MmMapLockedPagesSpecifyCache(lVar8,0,1); - } - else { - local_100 = *(longlong *)(lVar8 + 0x18); - } - if (local_100 == 0) { - LOCK(); - _DAT_5 = _DAT_5 + 1; - UNLOCK(); - local_168 = 0xc000009a; + local_1b0 = (longlong *)CONCAT44(local_1b0._4_4_,0x40000010); + local_1b8 = (longlong *)((ulonglong)local_1b8 & 0xffffffff00000000); + lVar8 = MmMapLockedPagesSpecifyCache(lVar8,0,1); + } + else { + lVar8 = *(longlong *)(lVar8 + 0x18); + } + if (lVar8 == 0) { + CClfsLogFcbCommon::ReportFlushFailure(8,-0x3fffffff); + local_158 = 0xc000009a; CClfsLogFcbCommon::SetGlobalFlushFailureTag(0x11,-0x3fffff66); - local_110 = local_e8; - local_f0 = local_e0; - local_140 = local_d8; - local_130 = local_d0; - local_res18 = local_164; - local_res20 = local_144; - local_158 = local_138; - plVar14 = local_128; - lVar9 = local_150; uVar7 = 0xc000009a; } else { - *(longlong *)(this + 0x78) = local_100; + *(longlong *)(this + 0x78) = lVar8; uVar7 = 0; } - pCVar13 = local_160; - uVar5 = local_168; + uVar5 = local_158; if ((int)uVar7 < 0) goto LAB_1; - local_1c8 = (longlong *)0x0; - lVar8 = IoAllocateMdl(local_140,8,0,1); + local_1b8 = (longlong *)0x0; + lVar8 = IoAllocateMdl(local_120,8,0,1); *(longlong *)(this + 0x60) = lVar8; if (lVar8 != 0) { MmProbeAndLockPages(lVar8,cVar3,1); lVar8 = *(longlong *)(this + 0x60); if ((*(byte *)(lVar8 + 10) & 5) == 0) { - local_1c0 = (longlong *)CONCAT44(local_1c0._4_4_,0x40000010); - local_1c8 = (longlong *)((ulonglong)local_1c8 & 0xffffffff00000000); - local_100 = MmMapLockedPagesSpecifyCache(lVar8,0,1); + local_1b0 = (longlong *)CONCAT44(local_1b0._4_4_,0x40000010); + local_1b8 = (longlong *)((ulonglong)local_1b8 & 0xffffffff00000000); + lVar8 = MmMapLockedPagesSpecifyCache(lVar8,0,1); } else { - local_100 = *(longlong *)(lVar8 + 0x18); - } - if (local_100 == 0) { - LOCK(); - _DAT_5 = _DAT_5 + 1; - UNLOCK(); - local_168 = 0xc000009a; + lVar8 = *(longlong *)(lVar8 + 0x18); + } + if (lVar8 == 0) { + CClfsLogFcbCommon::ReportFlushFailure(8,-0x3fffffff); + local_158 = 0xc000009a; CClfsLogFcbCommon::SetGlobalFlushFailureTag(0x13,-0x3fffff66); - local_110 = local_e8; - local_f0 = local_e0; - local_140 = local_d8; - local_130 = local_d0; - local_res18 = local_164; - local_res20 = local_144; - local_158 = local_138; - plVar14 = local_128; - lVar9 = local_150; uVar7 = 0xc000009a; } else { - *(longlong *)(this + 0x80) = local_100; + *(longlong *)(this + 0x80) = lVar8; } goto LAB_2; } CClfsLogFcbCommon::ReportFlushFailure(5,-0x3fffffff); uVar12 = 0x12; } LAB_3: uVar7 = 0xc000009a; - local_168 = 0xc000009a; + local_158 = 0xc000009a; LAB_4: CClfsLogFcbCommon::SetGlobalFlushFailureTag(uVar12,uVar7); - pCVar13 = local_160; - uVar5 = local_168; + uVar5 = local_158; } LAB_1: - local_168 = uVar5; + local_158 = uVar5; if (uVar7 == 0x103) { - pbVar2 = (byte *)(*(longlong *)(*(longlong *)pCVar13 + 0xb8) + 3); + pbVar2 = (byte *)(*(longlong *)(*(longlong *)local_b8 + 0xb8) + 3); *pbVar2 = *pbVar2 | 1; } else { - *(uint *)(*(longlong *)pCVar13 + 0x30) = uVar7; - *(undefined8 *)(*(longlong *)pCVar13 + 0x38) = 0; + *(uint *)(*(longlong *)local_b8 + 0x30) = uVar7; + *(undefined8 *)(*(longlong *)local_b8 + 0x38) = 0; CClfsRequest_State::Change_State_Done(*(CClfsRequest_State **)(this + 0x68),this); } if (lVar9 != 0) { if ((*(byte *)(lVar9 + 10) & 2) != 0) { MmUnlockPages(lVar9); } IoFreeMdl(lVar9); } return uVar7; } ``` ## CClfsLogCcb::MarkAccessed ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.21| |i_ratio|0.04| |m_ratio|0.19| |b_ratio|0.11| |match_types|Implied Match| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |`name`|MarkAccessed|GetAlignedBufferSize| |`fullname`|CClfsLogCcb::MarkAccessed|CClfsRequest::GetAlignedBufferSize| |`refcount`|16|3| |`length`|13|199| |`called`||__security_check_cookie
_guard_dispatch_icall
memset| |`calling`|

Expand for full list:
CClfsRequest::AdvanceLogBase
CClfsRequest::Flush
CClfsRequest::ReadLogBlock
CClfsRequest::ReadRestart
CClfsRequest::ReserveAndAppendLog
CClfsRequest::RetryAdvanceLogBase
CClfsRequest::RetryWriteRestart
CClfsRequest::WriteRestart
`CClfsRequest::AdvanceLogBase'::__l1::fin$0
`CClfsRequest::Flush'::__l1::fin$0
`CClfsRequest::ReadLogBlock'::__l1::fin$0

`CClfsRequest::ReadRestart'::__l1::fin$0
`CClfsRequest::RetryAdvanceLogBase'::__l1::fin$0
`CClfsRequest::RetryWriteRestart'::__l1::fin$0
`CClfsRequest::WriteRestart'::__l1::fin$2

|CClfsRequest::ReserveAndAppendLog
CClfsRequest::WriteRestart| |paramcount|1|2| |`address`|14001536c|140044cbc| |`sig`|void __thiscall MarkAccessed(CClfsLogCcb * this)|ulong __thiscall GetAlignedBufferSize(CClfsRequest * this, ulong param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsLogCcb::MarkAccessed Called Diff ```diff --- CClfsLogCcb::MarkAccessed called +++ CClfsRequest::GetAlignedBufferSize called @@ -0,0 +1,3 @@ +__security_check_cookie +_guard_dispatch_icall +memset ``` ### CClfsLogCcb::MarkAccessed Calling Diff ```diff --- CClfsLogCcb::MarkAccessed calling +++ CClfsRequest::GetAlignedBufferSize calling @@ -1,4 +0,0 @@ -CClfsRequest::AdvanceLogBase -CClfsRequest::Flush -CClfsRequest::ReadLogBlock -CClfsRequest::ReadRestart @@ -6,2 +1,0 @@ -CClfsRequest::RetryAdvanceLogBase -CClfsRequest::RetryWriteRestart @@ -9,7 +2,0 @@ -`CClfsRequest::AdvanceLogBase'::__l1::fin$0 -`CClfsRequest::Flush'::__l1::fin$0 -`CClfsRequest::ReadLogBlock'::__l1::fin$0 -`CClfsRequest::ReadRestart'::__l1::fin$0 -`CClfsRequest::RetryAdvanceLogBase'::__l1::fin$0 -`CClfsRequest::RetryWriteRestart'::__l1::fin$0 -`CClfsRequest::WriteRestart'::__l1::fin$2 ``` ### CClfsLogCcb::MarkAccessed Diff ```diff --- CClfsLogCcb::MarkAccessed +++ CClfsRequest::GetAlignedBufferSize @@ -1,14 +1,36 @@ -/* public: void __cdecl CClfsLogCcb::MarkAccessed(void) __ptr64 */ +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* private: unsigned long __cdecl CClfsRequest::GetAlignedBufferSize(unsigned long) __ptr64 */ -void __thiscall CClfsLogCcb::MarkAccessed(CClfsLogCcb *this) +ulong __thiscall CClfsRequest::GetAlignedBufferSize(CClfsRequest *this,ulong param_1) { - if ((*(uint *)(this + 0x1c) & 8) == 0) { - LOCK(); - *(uint *)(this + 0x1c) = *(uint *)(this + 0x1c) | 8; - UNLOCK(); + int iVar1; + uint uVar2; + undefined1 auStack_e8 [32]; + undefined4 local_c8; + undefined1 *local_c0; + undefined4 *local_b8; + undefined4 local_a8 [4]; + undefined1 local_98 [60]; + uint local_5c; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_e8; + memset(local_98,0,0x78); + local_b8 = local_a8; + uVar2 = 0; + local_a8[0] = 0x78; + local_c0 = local_98; + local_c8 = 0; + iVar1 = (**(code **)(**(longlong **)(this + 0x90) + 0xf0))(*(longlong **)(this + 0x90),0,1,0); + if ((iVar1 < 0) || (local_5c < 0x201)) { + uVar2 = param_1 + 0x1ff & 0xfffffe00; } - return; + else if (local_5c != 0) { + uVar2 = (local_5c - 1) + param_1 & ~(local_5c - 1); + } + return uVar2; } ``` ## CClfsLogFcbCommon::ReportFlushFailure ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.2| |i_ratio|0.03| |m_ratio|0.47| |b_ratio|0.22| |match_types|Implied Match| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |`name`|ReportFlushFailure|GetAlignedBufferSize| |`fullname`|CClfsLogFcbCommon::ReportFlushFailure|CClfsRequest::GetAlignedBufferSize| |`refcount`|16|3| |`length`|67|199| |`called`||__security_check_cookie
_guard_dispatch_icall
memset| |`calling`|CClfsContainer::IoAsyncWriteCompletion
CClfsContainer::WriteSector
CClfsLogFcbPhysical::AppendLog
CClfsLogFcbPhysical::CreateContainerQueue
CClfsRequest::ReserveAndAppendLog|CClfsRequest::ReserveAndAppendLog
CClfsRequest::WriteRestart| |paramcount|2|2| |`address`|14000ea70|140044cbc| |`sig`|void __cdecl ReportFlushFailure(_CLFS_FLUSH_FAILURE param_1, long param_2)|ulong __thiscall GetAlignedBufferSize(CClfsRequest * this, ulong param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsLogFcbCommon::ReportFlushFailure Called Diff ```diff --- CClfsLogFcbCommon::ReportFlushFailure called +++ CClfsRequest::GetAlignedBufferSize called @@ -0,0 +1,3 @@ +__security_check_cookie +_guard_dispatch_icall +memset ``` ### CClfsLogFcbCommon::ReportFlushFailure Calling Diff ```diff --- CClfsLogFcbCommon::ReportFlushFailure calling +++ CClfsRequest::GetAlignedBufferSize calling @@ -1,4 +0,0 @@ -CClfsContainer::IoAsyncWriteCompletion -CClfsContainer::WriteSector -CClfsLogFcbPhysical::AppendLog -CClfsLogFcbPhysical::CreateContainerQueue @@ -5,0 +2 @@ +CClfsRequest::WriteRestart ``` ### CClfsLogFcbCommon::ReportFlushFailure Diff ```diff --- CClfsLogFcbCommon::ReportFlushFailure +++ CClfsRequest::GetAlignedBufferSize @@ -1,27 +1,36 @@ -/* public: static void __cdecl CClfsLogFcbCommon::ReportFlushFailure(enum _CLFS_FLUSH_FAILURE,long) - */ +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* private: unsigned long __cdecl CClfsRequest::GetAlignedBufferSize(unsigned long) __ptr64 */ -void __cdecl CClfsLogFcbCommon::ReportFlushFailure(_CLFS_FLUSH_FAILURE param_1,long param_2) +ulong __thiscall CClfsRequest::GetAlignedBufferSize(CClfsRequest *this,ulong param_1) { - int *piVar1; - int iVar2; + int iVar1; + uint uVar2; + undefined1 auStack_e8 [32]; + undefined4 local_c8; + undefined1 *local_c0; + undefined4 *local_b8; + undefined4 local_a8 [4]; + undefined1 local_98 [60]; + uint local_5c; + ulonglong local_18; - LOCK(); - piVar1 = (int *)((longlong)&m_cFlushFailures + (longlong)(int)param_1 * 4); - *piVar1 = *piVar1 + 1; - UNLOCK(); - if (param_1 == 0xb) { - LOCK(); - UNLOCK(); - iVar2 = m_cFlushFailureCodes + 1; - if (0x13 < m_cFlushFailureCodes) { - iVar2 = 0x14; - } - m_cFlushFailureCodes = m_cFlushFailureCodes + 1; - *(long *)((longlong)&m_rcFlushFailureCodes + (ulonglong)(iVar2 - 1) * 4) = param_2; + local_18 = __security_cookie ^ (ulonglong)auStack_e8; + memset(local_98,0,0x78); + local_b8 = local_a8; + uVar2 = 0; + local_a8[0] = 0x78; + local_c0 = local_98; + local_c8 = 0; + iVar1 = (**(code **)(**(longlong **)(this + 0x90) + 0xf0))(*(longlong **)(this + 0x90),0,1,0); + if ((iVar1 < 0) || (local_5c < 0x201)) { + uVar2 = param_1 + 0x1ff & 0xfffffe00; } - return; + else if (local_5c != 0) { + uVar2 = (local_5c - 1) + param_1 & ~(local_5c - 1); + } + return uVar2; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|25|26| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|140018568|1400185b8| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## __security_check_cookie ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|43|44| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|

Expand for full list:
CClfsAuthContainer::CreateTempContainerSecurityDescriptor
CClfsAuthContainer::CreateTemporaryContainerPath
CClfsContainer::Create
CClfsContainer::GetRawSectorSize
CClfsContainer::InitializeSecurityDescriptors
CClfsContainer::Open
CClfsContainer::QueryContainerInfo
CClfsKernelMarshallingContext::Initialize
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbVirtual::QueryLogFileInfo

CClfsManagedLog::FixupContainerName
CClfsManagedLog::QueryLogBoundaryLsns
CClfsManagedLog::QueryLogContainerSize
CClfsManagedLog::QueryLogEphemeral
CClfsManagedLog::QueryLogSize
CClfsManagedLog::SetLogFileSize
CClfsManagedLogClient::Initialize
CClfsRequest::GetIoStatistics
ClfsCreateAuthRegistrySecurityDescriptor
ClfsCreateLogFile
ClfsEnableThreadPrivilege
ClfsGetIoStatistics
ClfsIsRegFile
ClfsRegistryInitialize
ClfsRegistryQueryGroupPolicySetting
CmRegUtilWstrValueGetDword
PiRegStateOpenClassKey
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapBuffer,struct__tlgWrapBuffer,struct__tlgWrapBuffer,struct__tlgWrapBuffer,struct__tlgWrapBuffer,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapBuffer,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>_>
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates

CClfsManagedLog::FixupContainerName
CClfsManagedLog::QueryLogBoundaryLsns
CClfsManagedLog::QueryLogContainerSize
CClfsManagedLog::QueryLogEphemeral
CClfsManagedLog::QueryLogSize
CClfsManagedLog::SetLogFileSize
CClfsManagedLogClient::Initialize
CClfsRequest::GetAlignedBufferSize
CClfsRequest::GetIoStatistics
ClfsCreateAuthRegistrySecurityDescriptor
ClfsCreateLogFile
ClfsEnableThreadPrivilege
ClfsGetIoStatistics
ClfsIsRegFile
ClfsRegistryInitialize
ClfsRegistryQueryGroupPolicySetting
CmRegUtilWstrValueGetDword
PiRegStateOpenClassKey
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapBuffer,struct__tlgWrapBuffer,struct__tlgWrapBuffer,struct__tlgWrapBuffer,struct__tlgWrapBuffer,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapBuffer,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>_>
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates

| |paramcount|1|1| |`address`|1400186a0|1400186f0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -18,0 +19 @@ +CClfsRequest::GetAlignedBufferSize ``` ## ReportFlushFailure ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.93| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|ReportFlushFailure|ReportFlushFailure| |fullname|CClfsLogFcbCommon::ReportFlushFailure|CClfsLogFcbCommon::ReportFlushFailure| |`refcount`|16|18| |length|67|67| |called||| |calling|CClfsContainer::IoAsyncWriteCompletion
CClfsContainer::WriteSector
CClfsLogFcbPhysical::AppendLog
CClfsLogFcbPhysical::CreateContainerQueue
CClfsRequest::ReserveAndAppendLog|CClfsContainer::IoAsyncWriteCompletion
CClfsContainer::WriteSector
CClfsLogFcbPhysical::AppendLog
CClfsLogFcbPhysical::CreateContainerQueue
CClfsRequest::ReserveAndAppendLog| |paramcount|2|2| |address|14000ea70|14000ea70| |sig|void __cdecl ReportFlushFailure(_CLFS_FLUSH_FAILURE param_1, long param_2)|void __cdecl ReportFlushFailure(_CLFS_FLUSH_FAILURE param_1, long param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## MarkAccessed ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|MarkAccessed|MarkAccessed| |fullname|CClfsLogCcb::MarkAccessed|CClfsLogCcb::MarkAccessed| |`refcount`|16|14| |length|13|13| |called||| |`calling`|

`CClfsRequest::ReadRestart'::__l1::fin$0
`CClfsRequest::RetryAdvanceLogBase'::__l1::fin$0
`CClfsRequest::RetryWriteRestart'::__l1::fin$0
`CClfsRequest::WriteRestart'::__l1::fin$2

Expand for full list:
CClfsRequest::AdvanceLogBase
CClfsRequest::Flush
CClfsRequest::ReadLogBlock
CClfsRequest::ReadRestart
CClfsRequest::ReserveAndAppendLog
CClfsRequest::RetryAdvanceLogBase
CClfsRequest::RetryWriteRestart
`CClfsRequest::AdvanceLogBase'::__l1::fin$0
`CClfsRequest::Flush'::__l1::fin$0
`CClfsRequest::ReadLogBlock'::__l1::fin$0
`CClfsRequest::ReadRestart'::__l1::fin$0

`CClfsRequest::RetryAdvanceLogBase'::__l1::fin$0
`CClfsRequest::RetryWriteRestart'::__l1::fin$0

| |paramcount|1|1| |address|14001536c|14001536c| |sig|void __thiscall MarkAccessed(CClfsLogCcb * this)|void __thiscall MarkAccessed(CClfsLogCcb * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### MarkAccessed Calling Diff ```diff --- CClfsLogCcb::MarkAccessed calling +++ CClfsLogCcb::MarkAccessed calling @@ -8 +7,0 @@ -CClfsRequest::WriteRestart @@ -15 +13,0 @@ -`CClfsRequest::WriteRestart'::__l1::fin$2 ``` ## wil_details_IsEnabledFallback ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|7|8| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_1005355321__private_IsEnabledFallback
Feature_CClfsLogFcbPhysicalDeadlockFix__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallback
Feature_ClfsCreateLogFileCorruptMetadata_Fix__private_IsEnabledFallback
Feature_Servicing_CLFS_AuthenticationExemptions__private_IsEnabledFallback
Feature_Servicing_EresourceCircularWaitCausedDeadlock__private_IsEnabledFallback|Feature_1005355321__private_IsEnabledFallback
Feature_1757897016__private_IsEnabledFallback
Feature_CClfsLogFcbPhysicalDeadlockFix__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallback
Feature_ClfsCreateLogFileCorruptMetadata_Fix__private_IsEnabledFallback
Feature_Servicing_CLFS_AuthenticationExemptions__private_IsEnabledFallback
Feature_Servicing_EresourceCircularWaitCausedDeadlock__private_IsEnabledFallback| |paramcount|3|3| |address|14001235c|14001235c| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1,0 +2 @@ +Feature_1757897016__private_IsEnabledFallback ``` ## memset ### Match Info |Key|clfs-7309.sys - clfs-7462.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-7309.sys|clfs-7462.sys| | :---: | :---: | :---: | |name|memset|memset| |fullname|memset|memset| |`refcount`|111|112| |length|236|236| |called||| |`calling`|

Expand for full list:
CClfsAuthContainer::CommitExtendedHashTable
CClfsAuthContainer::CreatePatchFile
CClfsAuthContainer::CreatePatchFilePath
CClfsAuthContainer::CreateTemporaryContainerPath
CClfsAuthContainer::FillContainer
CClfsAuthContainer::InitializeHashTableMetadata
CClfsAuthContainer::InitializePatchMagic
CClfsAuthContainer::ProcessHashTable
CClfsAuthContainer::VerifyIsPatchFile
CClfsBaseFilePersisted::AddClient
CClfsBaseFilePersisted::AllocSymbol

CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::ResetContainerQ
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsBaseFileSnapshot::ReadContainerQ
CClfsContainer::Create
CClfsContainer::InitializeFile
CClfsContainer::InitializeGlobals
CClfsContainer::Open
CClfsContainer::WriteSector
CClfsDriver::ReadRegistry
CClfsKernelMarshallingContext::AllocateIocb
CClfsKernelMarshallingContext::AppendRecord
CClfsKernelMarshallingContext::FormatWriteBlock
CClfsKernelMarshallingContext::Initialize
CClfsKernelMarshallingContext::ReserveAndAppendLog
CClfsLogFcbCommon::CClfsLogFcbCommon
CClfsLogFcbPhysical::AddLsnOffset
CClfsLogFcbPhysical::AddLsnOffset
CClfsLogFcbPhysical::CClfsLogFcbPhysical
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CreateBaseFileName
CClfsLogFcbPhysical::CreateContainerQueue
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryLogFileInfo
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::TruncateLogDiscardBlocks
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::Initialize
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::QueryLogBoundaryLsns
CClfsManagedLog::QueryLogContainerSize
CClfsManagedLog::QueryLogEphemeral
CClfsManagedLog::QueryLogSize
CClfsManagedLog::SetLogFileSize
CClfsRequest::CreateReadCompletionElement
CClfsRequest::GetContainerName
CClfsRequest::GetIoStatistics
CClfsRequest::ReserveAndAppendLog
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsGetContainerName
ClfsInitializeEventLog
ClfsInitializeOwnerPage
ClfsRegistryIsFileAuthExempt
ClfsRegistryQuerySystemTempPath
CmRegUtilUcValueGetFullBuffer
CmRegUtilUcValueSetUcString
SeSddlSecurityDescriptorFromSDDL
SepSddlAddAceToAcl
SepSddlGetAclForString
SepSddlSecurityDescriptorFromSDDLString
WppTraceCallback
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
memcpy_s

CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::ResetContainerQ
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsBaseFileSnapshot::ReadContainerQ
CClfsContainer::Create
CClfsContainer::InitializeFile
CClfsContainer::InitializeGlobals
CClfsContainer::Open
CClfsContainer::WriteSector
CClfsDriver::ReadRegistry
CClfsKernelMarshallingContext::AllocateIocb
CClfsKernelMarshallingContext::AppendRecord
CClfsKernelMarshallingContext::FormatWriteBlock
CClfsKernelMarshallingContext::Initialize
CClfsKernelMarshallingContext::ReserveAndAppendLog
CClfsLogFcbCommon::CClfsLogFcbCommon
CClfsLogFcbPhysical::AddLsnOffset
CClfsLogFcbPhysical::AddLsnOffset
CClfsLogFcbPhysical::CClfsLogFcbPhysical
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CreateBaseFileName
CClfsLogFcbPhysical::CreateContainerQueue
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryLogFileInfo
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::TruncateLogDiscardBlocks
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::Initialize
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::QueryLogBoundaryLsns
CClfsManagedLog::QueryLogContainerSize
CClfsManagedLog::QueryLogEphemeral
CClfsManagedLog::QueryLogSize
CClfsManagedLog::SetLogFileSize
CClfsRequest::CreateReadCompletionElement
CClfsRequest::GetAlignedBufferSize
CClfsRequest::GetContainerName
CClfsRequest::GetIoStatistics
CClfsRequest::ReserveAndAppendLog
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsGetContainerName
ClfsInitializeEventLog
ClfsInitializeOwnerPage
ClfsRegistryIsFileAuthExempt
ClfsRegistryQuerySystemTempPath
CmRegUtilUcValueGetFullBuffer
CmRegUtilUcValueSetUcString
SeSddlSecurityDescriptorFromSDDL
SepSddlAddAceToAcl
SepSddlGetAclForString
SepSddlSecurityDescriptorFromSDDLString
WppTraceCallback
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
memcpy_s

| |paramcount|3|3| |`address`|140018b00|140018b40| |sig|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### memset Calling Diff ```diff --- memset calling +++ memset calling @@ -61,0 +62 @@ +CClfsRequest::GetAlignedBufferSize ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-15T18:07:03}