# clfs_8115.sys-clfs_8246.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_1664551224__private_IsEnabledDeviceUsageNoInline](#feature_1664551224__private_isenableddeviceusagenoinline) * [Feature_1664551224__private_IsEnabledFallback](#feature_1664551224__private_isenabledfallback) * [Modified](#modified) * [CClfsManagedLog::AddNewClient](#cclfsmanagedlogaddnewclient) * [Modified (No Code Changes)](#modified-no-code-changes) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) # Visual Chart Diff ```mermaid flowchart LR CClfsManagedLogAddNewClient-5-old<--Match 49%-->CClfsManagedLogAddNewClient-5-new subgraph clfs_8246.sys CClfsManagedLogAddNewClient-5-new subgraph Added direction LR Feature_1664551224__private_IsEnabledDeviceUsageNoInline Feature_1664551224__private_IsEnabledFallback end end subgraph clfs_8115.sys CClfsManagedLogAddNewClient-5-old end ``` ```mermaid pie showData title Function Matches - 99.9464% "unmatched_funcs_len" : 2 "matched_funcs_len" : 3732 ``` ```mermaid pie showData title Matched Function Similarity - 99.9464% "matched_funcs_with_code_changes_len" : 1 "matched_funcs_with_non_code_changes_len" : 1 "matched_funcs_no_changes_len" : 3730 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 clfs_8115.sys clfs_8246.sys ``` #### Verbose Args

``` --old ['clfs_8115.sys'] --new [['clfs_8246.sys']] --engine VersionTrackingDiff --output-path clfs_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/30744E6E8B000/Clfs.Sys -O clfs.sys.x64.10.0.26100.8115 wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/0E61A1838B000/Clfs.Sys -O clfs.sys.x64.10.0.26100.8246 ``` ## Binary Metadata Diff ```diff --- clfs_8115.sys Meta +++ clfs_8246.sys Meta @@ -1,44 +1,44 @@ -Program Name: clfs_8115.sys +Program Name: clfs_8246.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 573544 +# of Bytes: 573552 # of Memory Blocks: 14 -# of Instructions: 100711 -# of Defined Data: 3735 -# of Functions: 1866 -# of Symbols: 14595 +# of Instructions: 100750 +# of Defined Data: 3741 +# of Functions: 1868 +# of Symbols: 14602 # of Data Types: 470 # of Data Type Categories: 20 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Tue Aug 18 21:58:16 SGT 2026 +Date Created: Tue Aug 18 21:58:19 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/clfs/clfs_8115.sys -Executable MD5: 69ebbca51766651d9494a1cfe0349256 -Executable SHA256: 1e0744c8e88853a05b07635daf5eadccd381658e28c2703316decb7e58e90bc9 -FSRL: file:///tmp/clfs/clfs_8115.sys?MD5=69ebbca51766651d9494a1cfe0349256 +Executable Location: /tmp/clfs/clfs_8246.sys +Executable MD5: 3ac49924a1bce321aba6f9a4b15b35e9 +Executable SHA256: d7e779b93dc05dcbc745b1ad100637b0376c29ffdff90ccad4e4fc69dcb932df +FSRL: file:///tmp/clfs/clfs_8246.sys?MD5=3ac49924a1bce321aba6f9a4b15b35e9 PDB Age: 1 PDB File: clfs.pdb -PDB GUID: 39bb469e-3fd6-f3d4-53a7-12846d9d1d36 +PDB GUID: 5756ed41-927e-47a1-f09c-bba9e126db65 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Common Log File System Driver -PE Property[FileVersion]: 10.0.26100.8115 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8246 (WinBuild.160101.0800) PE Property[InternalName]: clfs.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: Clfs.Sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8115 +PE Property[ProductVersion]: 10.0.26100.8246 PE Property[Translation]: 4b00000 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra clfs_8115.sys Decompiler Options

Ghidra clfs_8115.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra clfs_8115.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra clfs_8246.sys Decompiler Options

Ghidra clfs_8246.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra clfs_8246.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|0| |modified_funcs_len|2| |added_symbols_len|4| |deleted_symbols_len|1| |diff_time|5.262144327163696| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1834, 'ExternalsName': 247, 'ExactInstructionsFunctionHasher': 17, 'ExactBytesFunctionHasher': 7, 'BSIM': 1})| |items_to_process|9| |diff_types|Counter({'code': 1, 'length': 1, 'address': 1, 'called': 1, 'refcount': 1, 'calling': 1})| |unmatched_funcs_len|2| |total_funcs_len|3734| |matched_funcs_len|3732| |matched_funcs_with_code_changes_len|1| |matched_funcs_with_non_code_changes_len|1| |matched_funcs_no_changes_len|3730| |match_func_similarity_percent|99.9464%| |func_match_overall_percent|99.9464%| |first_matches|Counter({'SymbolsHash': 1834, 'ExactInstructionsFunctionHasher': 17, 'ExactBytesFunctionHasher': 7, 'BSIM': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1834 "ExternalsName" : 247 "ExactBytesFunctionHasher" : 7 "ExactInstructionsFunctionHasher" : 17 "BSIM" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1834 "ExactBytesFunctionHasher" : 7 "ExactInstructionsFunctionHasher" : 17 "BSIM" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 0 "modified_funcs_len" : 2 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 4 "deleted_symbols_len" : 1 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_1664551224__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|clfs_8246.sys| | :---: | :---: | |name|Feature_1664551224__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1664551224__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_1664551224__private_IsEnabledFallback| |calling|CClfsManagedLog::AddNewClient| |paramcount|0| |address|140018310| |sig|ulonglong __fastcall Feature_1664551224__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1664551224__private_IsEnabledDeviceUsageNoInline +++ Feature_1664551224__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_1664551224__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_1664551224__private_featureState; + if ((Feature_1664551224__private_featureState & 0x10) == 0) { + uVar1 = Feature_1664551224__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_1664551224__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_1664551224__private_IsEnabledFallback ### Function Meta |Key|clfs_8246.sys| | :---: | :---: | |name|Feature_1664551224__private_IsEnabledFallback| |fullname|Feature_1664551224__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1664551224__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140018348| |sig|undefined __fastcall Feature_1664551224__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1664551224__private_IsEnabledFallback +++ Feature_1664551224__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1664551224__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1664551224__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## CClfsManagedLog::AddNewClient ### Match Info |Key|clfs_8115.sys - clfs_8246.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.38| |i_ratio|0.38| |m_ratio|0.93| |b_ratio|0.49| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs_8115.sys|clfs_8246.sys| | :---: | :---: | :---: | |name|AddNewClient|AddNewClient| |fullname|CClfsManagedLog::AddNewClient|CClfsManagedLog::AddNewClient| |refcount|2|2| |`length`|488|530| |`called`|CClfsManagedLog::InstallLogObserver
CClfsManagedLog::RemoveClient
CClfsManagedLogClientKernel::CClfsManagedLogClientKernel
CClfsManagedLogClientUser::CClfsManagedLogClientUser
NTOSKRNL.EXE::ExAcquireFastMutexUnsafe
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExReleaseFastMutexUnsafe
_guard_dispatch_icall|CClfsManagedLog::InstallLogObserver
CClfsManagedLog::RemoveClient
CClfsManagedLogClientKernel::CClfsManagedLogClientKernel
CClfsManagedLogClientUser::CClfsManagedLogClientUser
Feature_1664551224__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireFastMutexUnsafe
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExReleaseFastMutexUnsafe
_guard_dispatch_icall| |calling|ClfsMgmtpRegisterManagedClient|ClfsMgmtpRegisterManagedClient| |paramcount|5|5| |`address`|1400586b8|140058678| |sig|long __thiscall AddNewClient(CClfsManagedLog * this, _FILE_OBJECT * param_1, void * param_2, char param_3, CClfsManagedLogClient * * param_4)|long __thiscall AddNewClient(CClfsManagedLog * this, _FILE_OBJECT * param_1, void * param_2, char param_3, CClfsManagedLogClient * * param_4)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsManagedLog::AddNewClient Called Diff ```diff --- CClfsManagedLog::AddNewClient called +++ CClfsManagedLog::AddNewClient called @@ -4,0 +5 @@ +Feature_1664551224__private_IsEnabledDeviceUsageNoInline ``` ### CClfsManagedLog::AddNewClient Diff ```diff --- CClfsManagedLog::AddNewClient +++ CClfsManagedLog::AddNewClient @@ -1,115 +1,145 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: long __cdecl CClfsManagedLog::AddNewClient(struct _FILE_OBJECT * __ptr64,void * __ptr64,char,class CClfsManagedLogClient * __ptr64 * __ptr64) __ptr64 */ long __thiscall CClfsManagedLog::AddNewClient (CClfsManagedLog *this,_FILE_OBJECT *param_1,void *param_2,char param_3, CClfsManagedLogClient **param_4) { CClfsManagedLog *pCVar1; - undefined8 *puVar2; - longlong lVar3; - code *pcVar4; - int iVar5; + code *pcVar2; + int iVar3; CClfsManagedLogClientKernel *this_00; - CClfsManagedLogClient *pCVar6; - CClfsManagedLogClient *pCVar7; + CClfsManagedLogClient *pCVar4; CClfsManagedLogClientUser *this_01; + ulonglong uVar5; + undefined8 *puVar6; + longlong lVar7; CClfsManagedLog *pCVar8; undefined1 *puVar9; + undefined1 *puVar10; + undefined1 *puVar11; undefined1 auStack_48 [8]; undefined1 auStack_40 [40]; int local_18; puVar9 = auStack_48; + puVar10 = auStack_48; + puVar11 = auStack_48; local_18 = 0xc0000001; if (param_3 == '\0') { this_00 = (CClfsManagedLogClientKernel *)ExAllocatePoolWithTag(); if (this_00 == (CClfsManagedLogClientKernel *)0x0) { LAB_0: - pCVar7 = (CClfsManagedLogClient *)0x0; + pCVar4 = (CClfsManagedLogClient *)0x0; } else { - pCVar7 = (CClfsManagedLogClient *) + pCVar4 = (CClfsManagedLogClient *) CClfsManagedLogClientKernel::CClfsManagedLogClientKernel(this_00); } } else { this_01 = (CClfsManagedLogClientUser *)ExAllocatePoolWithTag(0x200,0xf0,0x634d6c43); if (this_01 == (CClfsManagedLogClientUser *)0x0) goto LAB_0; - pCVar7 = (CClfsManagedLogClient *)CClfsManagedLogClientUser::CClfsManagedLogClientUser(this_01); + pCVar4 = (CClfsManagedLogClient *)CClfsManagedLogClientUser::CClfsManagedLogClientUser(this_01); } - *param_4 = pCVar7; - if (pCVar7 == (CClfsManagedLogClient *)0x0) { - iVar5 = -0x3fffff66; + *param_4 = pCVar4; + if (pCVar4 == (CClfsManagedLogClient *)0x0) { + iVar3 = -0x3fffff66; local_18 = -0x3fffff66; + puVar11 = auStack_48; goto LAB_1; } - iVar5 = (**(code **)(*(longlong *)pCVar7 + 0x20))(pCVar7,param_1,param_2,this); - pCVar7 = *param_4; - local_18 = iVar5; - if (iVar5 < 0) { - if (pCVar7 != (CClfsManagedLogClient *)0x0) { - (**(code **)(*(longlong *)pCVar7 + 0x50))(); + uVar5 = Feature_1664551224__private_IsEnabledDeviceUsageNoInline(); + puVar6 = *(undefined8 **)*param_4; + if ((int)uVar5 == 0) { + iVar3 = (*(code *)puVar6[4])(*param_4,param_1,param_2,this); + pCVar4 = *param_4; + local_18 = iVar3; + if (-1 < iVar3) { + (*(code *)**(undefined8 **)pCVar4)(); + goto LAB_2; } - *param_4 = (CClfsManagedLogClient *)0x0; - puVar9 = auStack_48; - goto LAB_1; + if (pCVar4 != (CClfsManagedLogClient *)0x0) { + (**(code **)(*(longlong *)pCVar4 + 0x50))(); + } } - (*(code *)**(undefined8 **)pCVar7)(); - ExAcquireFastMutexUnsafe(this + 0x50); - if ((*(longlong *)(this + 0x160) != 0) || - (iVar5 = InstallLogObserver(this), local_18 = iVar5, -1 < iVar5)) { - pCVar1 = this + 0x40; - for (pCVar8 = *(CClfsManagedLog **)pCVar1; - (pCVar8 != pCVar1 && ((byte)pCVar8[0x58] <= (byte)*(CClfsManagedLog *)(*param_4 + 0x68))); - pCVar8 = *(CClfsManagedLog **)pCVar8) { - } - if (-1 < iVar5) { - pCVar7 = *param_4; - pCVar6 = pCVar7 + 0x10; - if (pCVar8 == pCVar1) { - puVar2 = *(undefined8 **)(pCVar8 + 8); - if ((CClfsManagedLog *)*puVar2 != pCVar8) { + else { + (*(code *)*puVar6)(); + iVar3 = (**(code **)(*(longlong *)*param_4 + 0x20))(*param_4,param_1,param_2,this); + local_18 = iVar3; + if (-1 < iVar3) { LAB_2: - pcVar4 = (code *)swi(0x29); - (*pcVar4)(3); - puVar9 = auStack_40; - goto LAB_1; - } - *(CClfsManagedLog **)pCVar6 = pCVar8; - *(undefined8 **)(pCVar7 + 0x18) = puVar2; - *puVar2 = pCVar6; - *(CClfsManagedLogClient **)(pCVar8 + 8) = pCVar6; + ExAcquireFastMutexUnsafe(this + 0x50); + if (*(longlong *)(this + 0x160) == 0) { + iVar3 = InstallLogObserver(this); + puVar11 = auStack_48; + local_18 = iVar3; + if (-1 < iVar3) goto LAB_3; } else { - lVar3 = *(longlong *)pCVar8; - if (*(CClfsManagedLog **)(lVar3 + 8) != pCVar8) goto LAB_2; - *(longlong *)pCVar6 = lVar3; - *(CClfsManagedLog **)(pCVar7 + 0x18) = pCVar8; - *(CClfsManagedLogClient **)(lVar3 + 8) = pCVar6; - *(CClfsManagedLogClient **)pCVar8 = pCVar6; +LAB_3: + pCVar1 = this + 0x40; + for (pCVar8 = *(CClfsManagedLog **)pCVar1; + (pCVar8 != pCVar1 && ((byte)pCVar8[0x58] <= (byte)*(CClfsManagedLog *)(*param_4 + 0x68)) + ); pCVar8 = *(CClfsManagedLog **)pCVar8) { + } + puVar11 = auStack_48; + if (-1 < iVar3) { + pCVar4 = *param_4 + 0x10; + if (pCVar8 == pCVar1) { + puVar6 = *(undefined8 **)(pCVar8 + 8); + if ((CClfsManagedLog *)*puVar6 != pCVar8) { + puVar6 = (undefined8 *)0x3; + pcVar2 = (code *)swi(0x29); + pCVar4 = (CClfsManagedLogClient *)(*pcVar2)(); + puVar9 = auStack_40; + } + *(CClfsManagedLog **)pCVar4 = pCVar8; + *(undefined8 **)(pCVar4 + 8) = puVar6; + *puVar6 = pCVar4; + *(CClfsManagedLogClient **)(pCVar8 + 8) = pCVar4; + puVar11 = puVar9; + } + else { + lVar7 = *(longlong *)pCVar8; + if (*(CClfsManagedLog **)(lVar7 + 8) != pCVar8) { + lVar7 = 3; + pcVar2 = (code *)swi(0x29); + pCVar4 = (CClfsManagedLogClient *)(*pcVar2)(); + puVar10 = auStack_40; + } + *(longlong *)pCVar4 = lVar7; + *(CClfsManagedLog **)(pCVar4 + 8) = pCVar8; + *(CClfsManagedLogClient **)(lVar7 + 8) = pCVar4; + *(CClfsManagedLogClient **)pCVar8 = pCVar4; + puVar11 = puVar10; + } + } } + *(undefined8 *)(puVar11 + -8) = 0x140058844; + ExReleaseFastMutexUnsafe(this + 0x50); + goto LAB_1; } + (**(code **)(*(longlong *)*param_4 + 8))(); } - ExReleaseFastMutexUnsafe(this + 0x50); - puVar9 = auStack_48; + *param_4 = (CClfsManagedLogClient *)0x0; LAB_1: - if (iVar5 < 0) { + if (iVar3 < 0) { if (*param_4 == (CClfsManagedLogClient *)0x0) { - *(undefined8 *)(puVar9 + -8) = 0x14005889f; + *(undefined8 *)(puVar11 + -8) = 0x140058872; RemoveClient(this,(CClfsManagedLogClient *)0x0); } else { - pcVar4 = *(code **)(*(longlong *)*param_4 + 8); - *(undefined8 *)(puVar9 + -8) = 0x14005888f; - (*pcVar4)(); + pcVar2 = *(code **)(*(longlong *)*param_4 + 8); + *(undefined8 *)(puVar11 + -8) = 0x140058862; + (*pcVar2)(); *param_4 = (CClfsManagedLogClient *)0x0; } } - return iVar5; + return iVar3; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## wil_details_IsEnabledFallback ### Match Info |Key|clfs_8115.sys - clfs_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs_8115.sys|clfs_8246.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|5|6| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_2816432440__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallback
Feature_Servicing_CLFS_AuthenticationExemptions__private_IsEnabledFallback
Feature_Servicing_EresourceCircularWaitCausedDeadlock__private_IsEnabledFallback|Feature_1664551224__private_IsEnabledFallback
Feature_2816432440__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallback
Feature_Servicing_CLFS_AuthenticationExemptions__private_IsEnabledFallback
Feature_Servicing_EresourceCircularWaitCausedDeadlock__private_IsEnabledFallback| |paramcount|3|3| |address|1400122e0|1400122e0| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_1664551224__private_IsEnabledFallback ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-18T21:59:05}