# clfs-2026-07.sys-clfs-2026-08.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_344697147__private_IsEnabledDeviceUsageNoInline](#feature_344697147__private_isenableddeviceusagenoinline) * [Feature_344697147__private_IsEnabledFallback](#feature_344697147__private_isenabledfallback) * [Modified](#modified) * [ClfsValidateBlock](#clfsvalidateblock) * [CClfsLogFcbPhysical::ValidateLogBlock](#cclfslogfcbphysicalvalidatelogblock) * [CClfsLogFcbPhysical::CompleteAsyncReadBlock](#cclfslogfcbphysicalcompleteasyncreadblock) * [CClfsLogFcbPhysical::ReadLogBlock](#cclfslogfcbphysicalreadlogblock) * [CClfsLogFcbPhysical::IsEof](#cclfslogfcbphysicaliseof) * [Modified (No Code Changes)](#modified-no-code-changes) * [ClfsLsnBlockOffset](#clfslsnblockoffset) * [ValidateContainerSize](#validatecontainersize) * [ClfsValidateSector](#clfsvalidatesector) * [ClfsDecodeBlock](#clfsdecodeblock) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [ClfsDecodeBlockPrivate](#clfsdecodeblockprivate) * [AddLsnOffset](#addlsnoffset) # Visual Chart Diff ```mermaid flowchart LR ClfsValidateBlock-6-old<--Match 37%-->ClfsValidateBlock-6-new CClfsLogFcbPhysicalValidateLogBlock-7-old<--Match 28%-->CClfsLogFcbPhysicalValidateLogBlock-7-new CClfsLogFcbPhysicalCompleteAsyncReadBlock-7-old<--Match 9%-->CClfsLogFcbPhysicalCompleteAsyncReadBlock-7-new CClfsLogFcbPhysicalReadLogBlock-10-old<--Match 96%-->CClfsLogFcbPhysicalReadLogBlock-10-new CClfsLogFcbPhysicalIsEof-7-old<--Match 38%-->CClfsLogFcbPhysicalIsEof-7-new subgraph clfs-2026-08.sys ClfsValidateBlock-6-new CClfsLogFcbPhysicalValidateLogBlock-7-new CClfsLogFcbPhysicalCompleteAsyncReadBlock-7-new CClfsLogFcbPhysicalReadLogBlock-10-new CClfsLogFcbPhysicalIsEof-7-new subgraph Added direction LR Feature_344697147__private_IsEnabledDeviceUsageNoInline Feature_344697147__private_IsEnabledFallback end end subgraph clfs-2026-07.sys ClfsValidateBlock-6-old CClfsLogFcbPhysicalValidateLogBlock-7-old CClfsLogFcbPhysicalCompleteAsyncReadBlock-7-old CClfsLogFcbPhysicalReadLogBlock-10-old CClfsLogFcbPhysicalIsEof-7-old end ``` ```mermaid pie showData title Function Matches - 99.9474% "unmatched_funcs_len" : 2 "matched_funcs_len" : 3798 ``` ```mermaid pie showData title Matched Function Similarity - 99.6577% "matched_funcs_with_code_changes_len" : 5 "matched_funcs_with_non_code_changes_len" : 8 "matched_funcs_no_changes_len" : 3785 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ./proj --project-name clfs62728 --symbols-path ./sym --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 clfs-2026-07.sys clfs-2026-08.sys ``` #### Verbose Args

``` --old ['clfs-2026-07.sys'] --new [['clfs-2026-08.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name clfs62728 --symbols-path ./sym --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/92B569108C000/Clfs.Sys -O clfs.sys.x64.10.0.26100.8972 wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/F44FD6298C000/Clfs.Sys -O clfs.sys.x64.10.0.26100.9168 ``` ## Binary Metadata Diff ```diff --- clfs-2026-07.sys Meta +++ clfs-2026-08.sys Meta @@ -1,44 +1,44 @@ -Program Name: clfs-2026-07.sys +Program Name: clfs-2026-08.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 577968 +# of Bytes: 578040 # of Memory Blocks: 14 -# of Instructions: 101386 -# of Defined Data: 3919 -# of Functions: 1899 -# of Symbols: 14802 +# of Instructions: 101593 +# of Defined Data: 3921 +# of Functions: 1901 +# of Symbols: 14831 # of Data Types: 473 # of Data Type Categories: 20 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 15 17:27:08 SGT 2026 +Date Created: Sat Aug 15 17:27:12 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2026-62728/clfs-2026-07.sys -Executable MD5: 4c76299e63ae7ef334d8a101c3c594c0 -Executable SHA256: 0a784dad4648caf108f7fe985cde29c262de4696410b6a1defe3f40bfbb7e05e -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2026-62728/clfs-2026-07.sys?MD5=4c76299e63ae7ef334d8a101c3c594c0 +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2026-62728/clfs-2026-08.sys +Executable MD5: dcf5ec0612e12fe01201c66c3e6a7d31 +Executable SHA256: 5880c90802c71110794d4be2552225b9d7784ecae63df144ae0177c11f35546c +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2026-62728/clfs-2026-08.sys?MD5=dcf5ec0612e12fe01201c66c3e6a7d31 PDB Age: 1 PDB File: clfs.pdb -PDB GUID: c38f85ce-c10b-ec59-66f1-03ba75987e5b +PDB GUID: 8a5c0dd6-a46d-1628-5528-058ff96860a5 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Common Log File System Driver -PE Property[FileVersion]: 10.0.26100.8972 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.9168 (WinBuild.160101.0800) PE Property[InternalName]: clfs.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: Clfs.Sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8972 +PE Property[ProductVersion]: 10.0.26100.9168 PE Property[Translation]: 4b00000 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra clfs-2026-07.sys Decompiler Options

Ghidra clfs-2026-07.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra clfs-2026-07.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra clfs-2026-08.sys Decompiler Options

Ghidra clfs-2026-08.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra clfs-2026-08.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|0| |modified_funcs_len|13| |added_symbols_len|4| |deleted_symbols_len|1| |diff_time|4.549384832382202| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1886, 'ExternalsName': 247, 'ExactInstructionsFunctionHasher': 11, 'ExactBytesFunctionHasher': 1})| |items_to_process|20| |diff_types|Counter({'refcount': 9, 'calling': 9, 'address': 9, 'length': 6, 'code': 5, 'called': 5})| |unmatched_funcs_len|2| |total_funcs_len|3800| |matched_funcs_len|3798| |matched_funcs_with_code_changes_len|5| |matched_funcs_with_non_code_changes_len|8| |matched_funcs_no_changes_len|3785| |match_func_similarity_percent|99.6577%| |func_match_overall_percent|99.9474%| |first_matches|Counter({'SymbolsHash': 1886, 'ExactInstructionsFunctionHasher': 11, 'ExactBytesFunctionHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1886 "ExternalsName" : 247 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 11 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1886 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 11 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 0 "modified_funcs_len" : 13 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 4 "deleted_symbols_len" : 1 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_344697147__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|clfs-2026-08.sys| | :---: | :---: | |name|Feature_344697147__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_344697147__private_IsEnabledDeviceUsageNoInline| |refcount|14| |length|49| |called|Feature_344697147__private_IsEnabledFallback| |calling|CClfsLogFcbPhysical::CompleteAsyncReadBlock
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ValidateLogBlock
ClfsValidateBlock| |paramcount|0| |address|140016de0| |sig|ulonglong __fastcall Feature_344697147__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_344697147__private_IsEnabledDeviceUsageNoInline +++ Feature_344697147__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_344697147__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_344697147__private_featureState; + if ((Feature_344697147__private_featureState & 0x10) == 0) { + uVar1 = Feature_344697147__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_344697147__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_344697147__private_IsEnabledFallback ### Function Meta |Key|clfs-2026-08.sys| | :---: | :---: | |name|Feature_344697147__private_IsEnabledFallback| |fullname|Feature_344697147__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_344697147__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140016e18| |sig|undefined __fastcall Feature_344697147__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_344697147__private_IsEnabledFallback +++ Feature_344697147__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_344697147__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_344697147__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## ClfsValidateBlock ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.29| |i_ratio|0.11| |m_ratio|0.99| |b_ratio|0.37| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|ClfsValidateBlock|ClfsValidateBlock| |fullname|ClfsValidateBlock|ClfsValidateBlock| |`refcount`|9|3| |`length`|820|664| |`called`||ClfsValidateSector
Feature_344697147__private_IsEnabledDeviceUsageNoInline| |`calling`|CClfsLogFcbPhysical::CompleteAsyncReadBlock
CClfsLogFcbPhysical::IsEof
CClfsLogFcbPhysical::ValidateLogBlock
ClfsIsOwnerPage|CClfsLogFcbPhysical::ValidateLogBlock
ClfsIsOwnerPage| |paramcount|6|6| |`address`|140008e20|14000dfc0| |sig|long __cdecl ClfsValidateBlock(_CLS_LSN * param_1, _CLFS_LOG_BLOCK_HEADER * param_2, ulong param_3, uchar param_4, uchar param_5, ulong * param_6)|long __cdecl ClfsValidateBlock(_CLS_LSN * param_1, _CLFS_LOG_BLOCK_HEADER * param_2, ulong param_3, uchar param_4, uchar param_5, ulong * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClfsValidateBlock Called Diff ```diff --- ClfsValidateBlock called +++ ClfsValidateBlock called @@ -0,0 +1,2 @@ +ClfsValidateSector +Feature_344697147__private_IsEnabledDeviceUsageNoInline ``` ### ClfsValidateBlock Calling Diff ```diff --- ClfsValidateBlock calling +++ ClfsValidateBlock calling @@ -1,2 +0,0 @@ -CClfsLogFcbPhysical::CompleteAsyncReadBlock -CClfsLogFcbPhysical::IsEof ``` ### ClfsValidateBlock Diff ```diff --- ClfsValidateBlock +++ ClfsValidateBlock @@ -1,132 +1,146 @@ /* long __cdecl ClfsValidateBlock(union _CLS_LSN const & __ptr64,struct _CLFS_LOG_BLOCK_HEADER * __ptr64,unsigned long,unsigned char,unsigned char,unsigned long & __ptr64) */ long __cdecl ClfsValidateBlock(_CLS_LSN *param_1,_CLFS_LOG_BLOCK_HEADER *param_2,ulong param_3,uchar param_4, uchar param_5,ulong *param_6) { _CLFS_LOG_BLOCK_HEADER _Var1; ushort uVar2; uint uVar3; - ulonglong uVar4; - longlong lVar5; - byte bVar6; - byte bVar7; - uint uVar8; - byte bVar9; + long lVar4; + ulonglong uVar5; + uint uVar6; *param_6 = 0; if ((0x10 < param_5) || ((0x10111U >> (param_5 & 0x1f) & 1) == 0)) { return -0x3ffffff3; } - uVar4 = 0xffffffff00000000; + uVar5 = 0xffffffff00000000; if ((param_1 != (_CLS_LSN *)0x0) && (*(int *)(param_1 + 4) != -1)) { - uVar4 = *(ulonglong *)param_1 & 0xfffffffffffffe00; + uVar5 = *(ulonglong *)param_1 & 0xfffffffffffffe00; } - if (param_2 + 0x18 == (_CLFS_LOG_BLOCK_HEADER *)0x0) { + if (((param_2 + 0x18 == (_CLFS_LOG_BLOCK_HEADER *)0x0) || + (*(ulonglong *)(param_2 + 0x18) != uVar5)) || + (uVar6 = (uint)*(ushort *)(param_2 + 4), *(ushort *)(param_2 + 6) < *(ushort *)(param_2 + 4))) + { return -0x3fe5fff6; } - if (*(ulonglong *)(param_2 + 0x18) != uVar4) { - return -0x3fe5fff6; + lVar4 = ClfsValidateSector((uchar *)param_2,param_4,param_5 | 0x40); + if (lVar4 < 0) { + return lVar4; } - uVar2 = *(ushort *)(param_2 + 4); - if (*(ushort *)(param_2 + 6) < uVar2) { - return -0x3fe5fff6; - } - _Var1 = param_2[0x1fe]; - if ((char)_Var1 < '\0') { - return -0x3fe5fffd; - } - if (param_2[0x1ff] == (_CLFS_LOG_BLOCK_HEADER)param_4) { - bVar9 = param_5 & 4; - if ((((((bVar9 == 0) || (((byte)_Var1 & 4) != 0)) && (((byte)_Var1 & 0x40) != 0)) && - (((param_5 & 0x20) == 0 || (((byte)_Var1 & 0x20) != 0)))) && - ((bVar7 = param_5 & 8, bVar7 == 0 || (((byte)_Var1 & 8) != 0)))) && - ((bVar6 = param_5 & 0x10, bVar6 == 0 || (((byte)_Var1 & 0x10) != 0)))) { - uVar8 = *(uint *)(param_2 + 0x28); - if (param_5 == '\b') { - if (uVar8 != 0) { - return -0x3fe5fff6; - } - if (uVar2 != 8) { - return -0x3fe5fff6; - } - uVar8 = *(uint *)(param_2 + 0x2c); - if (uVar8 != 0) { - if ((uVar8 & 7) != 0) { - return -0x3fe5fff6; - } - if (uVar8 != 0x70) { - return -0x3fe5fff6; - } - } - uVar3 = *(uint *)(param_2 + 0x30); - if (uVar3 != 0) { - if ((uVar3 & 7) != 0) { - return -0x3fe5fff6; - } - if (uVar3 != (uVar8 + 0x800 & 0xffff)) { - return -0x3fe5fff6; - } - } - } - else if (((uVar8 < 0x70) || ((uVar8 & 7) != 0)) || ((uint)uVar2 << 9 < uVar8)) { + uVar3 = *(uint *)(param_2 + 0x28); + if (param_5 == '\b') { + if (uVar3 != 0) { + return -0x3fe5fff6; + } + if ((short)uVar6 != 8) { + return -0x3fe5fff6; + } + uVar6 = *(uint *)(param_2 + 0x2c); + if (uVar6 != 0) { + if ((uVar6 & 7) != 0) { return -0x3fe5fff6; } - if (param_3 < (uint)uVar2 << 9) { - return -0x3fe5fffc; + if (uVar6 != 0x70) { + return -0x3fe5fff6; } - uVar8 = 1; - while( true ) { - *param_6 = uVar8; - if (*(ushort *)(param_2 + 4) - 1 <= uVar8) break; - _Var1 = param_2[(ulonglong)uVar8 * 0x200 + 0x1fe]; + } + uVar3 = *(uint *)(param_2 + 0x30); + if (uVar3 != 0) { + if ((uVar3 & 7) != 0) { + return -0x3fe5fff6; + } + if (uVar3 != (uVar6 + 0x800 & 0xffff)) { + return -0x3fe5fff6; + } + } + } + else { + if (uVar3 < 0x70) { + return -0x3fe5fff6; + } + if ((uVar3 & 7) != 0) { + return -0x3fe5fff6; + } + if (uVar6 << 9 < uVar3) { + return -0x3fe5fff6; + } + } + uVar5 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar5 == 0) { + if (param_3 < (uint)*(ushort *)(param_2 + 4) << 9) { + return -0x3fe5fffc; + } + uVar5 = 1; + *param_6 = 1; + uVar2 = *(ushort *)(param_2 + 4); + if (1 < uVar2 - 1) { + do { + _Var1 = param_2[uVar5 * 0x200 + 0x1fe]; if ((char)_Var1 < '\0') { return -0x3fe5fffd; } - if (param_2[(ulonglong)uVar8 * 0x200 + 0x1ff] != (_CLFS_LOG_BLOCK_HEADER)param_4) { + if (param_2[uVar5 * 0x200 + 0x1ff] != (_CLFS_LOG_BLOCK_HEADER)param_4) { return -0x3fe5fffe; } - if ((bVar9 != 0) && (((byte)_Var1 & 4) == 0)) { + if (((((((param_5 & 4) != 0) && (((byte)_Var1 & 4) == 0)) || + (((param_5 & 0x40) != 0 && (((byte)_Var1 & 0x40) == 0)))) || + (((param_5 & 0x20) != 0 && (((byte)_Var1 & 0x20) == 0)))) || + (((param_5 & 8) != 0 && (((byte)_Var1 & 8) == 0)))) || + (((param_5 & 0x10) != 0 && (((byte)_Var1 & 0x10) == 0)))) { + return -0x3fe5ffff; + } + uVar6 = *param_6 + 1; + uVar5 = (ulonglong)uVar6; + *param_6 = uVar6; + uVar2 = *(ushort *)(param_2 + 4); + } while (uVar6 < uVar2 - 1); + } + } + else { + uVar2 = *(ushort *)(param_2 + 4); + if (param_3 < (uint)uVar2 << 9) { + return -0x3fe5fffc; + } + uVar5 = 1; + uVar6 = 1; + *param_6 = 1; + if (1 < uVar2 - 1) { + do { + _Var1 = param_2[uVar5 * 0x200 + 0x1fe]; + if ((char)_Var1 < '\0') { + return -0x3fe5fffd; + } + if (param_2[uVar5 * 0x200 + 0x1ff] != (_CLFS_LOG_BLOCK_HEADER)param_4) { + return -0x3fe5fffe; + } + if (((param_5 & 4) != 0) && (((byte)_Var1 & 4) == 0)) { return -0x3fe5ffff; } if (((param_5 & 0x40) != 0) && (((byte)_Var1 & 0x40) == 0)) { return -0x3fe5ffff; } if (((param_5 & 0x20) != 0) && (((byte)_Var1 & 0x20) == 0)) { return -0x3fe5ffff; } - if ((bVar7 != 0) && (((byte)_Var1 & 8) == 0)) { + if (((param_5 & 8) != 0) && (((byte)_Var1 & 8) == 0)) { return -0x3fe5ffff; } - if ((bVar6 != 0) && (((byte)_Var1 & 0x10) == 0)) { + if (((param_5 & 0x10) != 0) && (((byte)_Var1 & 0x10) == 0)) { return -0x3fe5ffff; } - uVar8 = uVar8 + 1; - } - lVar5 = ((ulonglong)*(ushort *)(param_2 + 4) - 1) * 0x200; - _Var1 = param_2[lVar5 + 0x1fe]; - if ((char)_Var1 < '\0') { - return -0x3fe5fffd; - } - if (param_2[lVar5 + 0x1ff] != (_CLFS_LOG_BLOCK_HEADER)param_4) { - return -0x3fe5fffe; - } - if ((((bVar9 == 0) || (((byte)_Var1 & 4) != 0)) && - (((param_5 & 0x40) == 0 || (((byte)_Var1 & 0x40) != 0)))) && - ((((byte)_Var1 & 0x20) != 0 && ((bVar7 == 0 || (((byte)_Var1 & 8) != 0)))))) { - if (bVar6 == 0) { - return 0; - } - if (((byte)_Var1 & 0x10) != 0) { - return 0; - } - } + uVar6 = uVar6 + 1; + uVar5 = (ulonglong)uVar6; + *param_6 = uVar6; + } while (uVar6 < uVar2 - 1); } - return -0x3fe5ffff; } - return -0x3fe5fffe; + lVar4 = ClfsValidateSector((uchar *)(param_2 + ((ulonglong)uVar2 - 1) * 0x200),param_4, + param_5 | 0x20); + return lVar4; } ``` ## CClfsLogFcbPhysical::ValidateLogBlock ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.11| |i_ratio|0.1| |m_ratio|0.64| |b_ratio|0.29| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|ValidateLogBlock|ValidateLogBlock| |fullname|CClfsLogFcbPhysical::ValidateLogBlock|CClfsLogFcbPhysical::ValidateLogBlock| |`refcount`|3|4| |`length`|608|284| |`called`|CClfsLogFcbPhysical::ValidateContainerSize
ClfsValidateBlock|CClfsLogFcbPhysical::AddLsnOffset
ClfsValidateBlock
Feature_344697147__private_IsEnabledDeviceUsageNoInline| |`calling`|CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadRawOwnerPage|CClfsLogFcbPhysical::IsEof
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadRawOwnerPage| |paramcount|7|7| |`address`|140008bb0|14000f850| |sig|long __thiscall ValidateLogBlock(CClfsLogFcbPhysical * this, _CLS_LSN * param_1, _CLFS_LOG_BLOCK_HEADER * param_2, ulong param_3, uchar param_4, uchar param_5, ulong * param_6)|long __thiscall ValidateLogBlock(CClfsLogFcbPhysical * this, _CLS_LSN * param_1, _CLFS_LOG_BLOCK_HEADER * param_2, ulong param_3, uchar param_4, uchar param_5, ulong * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsLogFcbPhysical::ValidateLogBlock Called Diff ```diff --- CClfsLogFcbPhysical::ValidateLogBlock called +++ CClfsLogFcbPhysical::ValidateLogBlock called @@ -1 +1 @@ -CClfsLogFcbPhysical::ValidateContainerSize +CClfsLogFcbPhysical::AddLsnOffset @@ -2,0 +3 @@ +Feature_344697147__private_IsEnabledDeviceUsageNoInline ``` ### CClfsLogFcbPhysical::ValidateLogBlock Calling Diff ```diff --- CClfsLogFcbPhysical::ValidateLogBlock calling +++ CClfsLogFcbPhysical::ValidateLogBlock calling @@ -0,0 +1 @@ +CClfsLogFcbPhysical::IsEof ``` ### CClfsLogFcbPhysical::ValidateLogBlock Diff ```diff --- CClfsLogFcbPhysical::ValidateLogBlock +++ CClfsLogFcbPhysical::ValidateLogBlock @@ -1,109 +1,37 @@ /* private: long __cdecl CClfsLogFcbPhysical::ValidateLogBlock(union _CLS_LSN const & __ptr64,struct _CLFS_LOG_BLOCK_HEADER * __ptr64,unsigned long,unsigned char,unsigned char,unsigned long & __ptr64) __ptr64 */ long __thiscall CClfsLogFcbPhysical::ValidateLogBlock (CClfsLogFcbPhysical *this,_CLS_LSN *param_1,_CLFS_LOG_BLOCK_HEADER *param_2,ulong param_3 ,uchar param_4,uchar param_5,ulong *param_6) { - _CLFS_LOG_BLOCK_HEADER *p_Var1; - CClfsLogFcbPhysical *pCVar2; - ushort uVar3; - longlong lVar4; - undefined1 auVar5 [16]; - undefined1 auVar6 [16]; - undefined1 auVar7 [16]; - undefined1 auVar8 [16]; - uchar uVar9; - uint uVar10; - long lVar11; - ulonglong uVar12; - ulonglong uVar13; - ulonglong uVar14; - uint uStackX_c; + long lVar1; + uint *puVar2; + uint *puVar3; + ulonglong uVar4; + undefined8 local_res8; + _CLS_LSN local_38 [8]; + _CLS_LSN local_30 [8]; - pCVar2 = this + 0x1e8; - if ((pCVar2 == (CClfsLogFcbPhysical *)0x0) || (*(longlong *)pCVar2 != -0x100000000)) { - ValidateContainerSize(this); - } - uVar3 = *(ushort *)(param_2 + 4); - lVar4 = *(longlong *)(this + 0x50); - if (SUB168(ZEXT816(0x200) * ZEXT216(uVar3),8) != 0) { - return -0x3fe5fff6; - } - p_Var1 = param_2 + 0x18; - if ((p_Var1 == (_CLFS_LOG_BLOCK_HEADER *)0x0) || (*(longlong *)p_Var1 != -0x100000000)) { - uVar9 = ValidateContainerSize(this); - if (uVar9 == '\0') { - uVar13 = 0xffffffff00000000; - } - else { - if (p_Var1 == (_CLFS_LOG_BLOCK_HEADER *)0x0) { - uVar12 = 0xffffffff; - uVar14 = 0xffffffff; + AddLsnOffset(this,(_CLS_LSN *)&local_res8,(__uint64 *)(this + 0x1e8)); + local_res8 = SUB168(ZEXT816(0x200) * ZEXT216(*(ushort *)(param_2 + 4)),0); + if (SUB168(ZEXT816(0x200) * ZEXT216(*(ushort *)(param_2 + 4)),8) == 0) { + puVar2 = (uint *)AddLsnOffset(this,local_38,(__uint64 *)(param_2 + 0x18)); + puVar3 = (uint *)AddLsnOffset(this,local_30,(__uint64 *)(this + 0x1e8)); + if ((((puVar3 == (uint *)0x0) || (puVar2 == (uint *)0x0)) || (puVar2[1] < puVar3[1])) || + ((puVar3[1] == puVar2[1] && (*puVar2 <= *puVar3)))) { + uVar4 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + param_4 = *(uchar *)(param_2 + 2); } - else { - uVar12 = (ulonglong)*(uint *)(param_2 + 0x1c); - uVar14 = (ulonglong)(*(uint *)p_Var1 & 0xfffffe00); - } - uVar13 = 0xffffffff00000000; - auVar5._8_8_ = 0; - auVar5._0_8_ = *(ulonglong *)(this + 0x2b8); - auVar6._8_8_ = 0; - auVar6._0_8_ = uVar14 + uVar12 * *(ulonglong *)(this + 0x2b8) + - SUB168(ZEXT816(0x200) * ZEXT216(uVar3),0); - auVar8 = auVar6 / auVar5; - auVar6 = auVar6 % auVar5; - if ((((auVar8._4_4_ == 0) && (auVar6._4_4_ == 0)) && (auVar8._0_4_ != -1)) && - ((auVar6._0_8_ & 0x1ff) == 0)) { - uVar13 = auVar8._0_8_ << 0x20 | (ulonglong)auVar6._0_4_; - } + lVar1 = ClfsValidateBlock(param_1,param_2,param_3,param_4,param_5,param_6); + return lVar1; } } - else { - uVar13 = 0xffffffff00000000; - } - uVar14 = 0; - if ((pCVar2 == (CClfsLogFcbPhysical *)0x0) || (*(longlong *)pCVar2 != -0x100000000)) { - uVar9 = ValidateContainerSize(this); - if (uVar9 != '\0') { - if (pCVar2 == (CClfsLogFcbPhysical *)0x0) { - uVar12 = 0xffffffff; - uVar14 = 0xffffffff; - } - else { - uVar12 = (ulonglong)*(uint *)(this + 0x1ec); - uVar14 = (ulonglong)(*(uint *)pCVar2 & 0xfffffe00); - } - auVar8._8_8_ = 0; - auVar8._0_8_ = *(ulonglong *)(this + 0x2b8); - auVar7._8_8_ = 0; - auVar7._0_8_ = uVar14 + uVar12 * *(ulonglong *)(this + 0x2b8) + lVar4; - auVar5 = auVar7 / auVar8; - auVar7 = auVar7 % auVar8; - if ((auVar5._4_4_ == 0) && (uVar14 = 0xffffffff00000000, auVar7._4_4_ == 0)) { - if ((auVar5._0_4_ != -1) && ((auVar7._0_8_ & 0x1ff) == 0)) { - uVar14 = auVar5._0_8_ << 0x20 | (ulonglong)auVar7._0_4_; - } - uVar10 = (uint)(uVar14 >> 0x20); - goto LAB_0; - } - } - uVar14 = 0; - uVar10 = 0xffffffff; - } - else { - uVar10 = 0xffffffff; - } -LAB_0: - uStackX_c = (uint)(uVar13 >> 0x20); - if ((uVar10 <= uStackX_c) && (((uint)uVar14 < (uint)uVar13 || (uVar10 != uStackX_c)))) { - return -0x3fe5fff6; - } - lVar11 = ClfsValidateBlock(param_1,param_2,param_3,(uchar)param_2[2],param_5,param_6); - return lVar11; + return -0x3fe5fff6; } ``` ## CClfsLogFcbPhysical::CompleteAsyncReadBlock ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.06| |i_ratio|0.17| |m_ratio|0.68| |b_ratio|0.09| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|CompleteAsyncReadBlock|CompleteAsyncReadBlock| |fullname|CClfsLogFcbPhysical::CompleteAsyncReadBlock|CClfsLogFcbPhysical::CompleteAsyncReadBlock| |refcount|5|5| |`length`|1589|2876| |`called`|CClfsLogFcbPhysical::AddLsnOffset
CClfsLogFcbPhysical::ValidateContainerSize
ClfsDecodeBlockPrivate
ClfsLsnBlockOffset
ClfsValidateBlock
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
_guard_dispatch_icall|CClfsLogFcbPhysical::AddLsnOffset
CClfsLogFcbPhysical::AddLsnOffset
ClfsDecodeBlock
ClfsValidateSector
Feature_344697147__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
_guard_dispatch_icall| |calling||| |paramcount|7|7| |`address`|140067700|140078b10| |sig|long __thiscall CompleteAsyncReadBlock(CClfsLogFcbPhysical * this, _CLS_LSN * param_1, ulong param_2, void * param_3, ulong param_4, __uint64 * param_5, _CLS_LSN * param_6)|long __thiscall CompleteAsyncReadBlock(CClfsLogFcbPhysical * this, _CLS_LSN * param_1, ulong param_2, void * param_3, ulong param_4, __uint64 * param_5, _CLS_LSN * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsLogFcbPhysical::CompleteAsyncReadBlock Called Diff ```diff --- CClfsLogFcbPhysical::CompleteAsyncReadBlock called +++ CClfsLogFcbPhysical::CompleteAsyncReadBlock called @@ -2,4 +2,4 @@ -CClfsLogFcbPhysical::ValidateContainerSize -ClfsDecodeBlockPrivate -ClfsLsnBlockOffset -ClfsValidateBlock +CClfsLogFcbPhysical::AddLsnOffset +ClfsDecodeBlock +ClfsValidateSector +Feature_344697147__private_IsEnabledDeviceUsageNoInline ``` ### CClfsLogFcbPhysical::CompleteAsyncReadBlock Diff ```diff --- CClfsLogFcbPhysical::CompleteAsyncReadBlock +++ CClfsLogFcbPhysical::CompleteAsyncReadBlock @@ -1,284 +1,525 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: virtual long __cdecl CClfsLogFcbPhysical::CompleteAsyncReadBlock(union _CLS_LSN const & __ptr64,unsigned long,void * __ptr64,unsigned long,unsigned __int64 & __ptr64,union _CLS_LSN & __ptr64) __ptr64 */ long __thiscall CClfsLogFcbPhysical::CompleteAsyncReadBlock (CClfsLogFcbPhysical *this,_CLS_LSN *param_1,ulong param_2,void *param_3,ulong param_4, __uint64 *param_5,_CLS_LSN *param_6) { - _CLFS_LOG_BLOCK_HEADER *p_Var1; - uint *puVar2; - CClfsLogFcbPhysical *pCVar3; - _CLFS_LOG_BLOCK_HEADER *p_Var4; - ushort uVar5; - undefined8 uVar6; - undefined1 auVar7 [16]; - undefined1 auVar8 [16]; - undefined1 auVar9 [16]; - undefined1 auVar10 [16]; - undefined1 auVar11 [16]; - undefined1 auVar12 [16]; - uchar uVar13; - char cVar14; - uint uVar15; - uint uVar16; - ulonglong *puVar17; - ulonglong uVar18; - longlong lVar19; - ulonglong uVar20; - undefined8 *puVar21; - uint uVar22; - ulonglong uVar23; - _CLS_LSN *p_Var24; - undefined8 uVar25; - long lVar26; - uint uVar27; - ulonglong uVar28; - int iVar29; - bool bVar30; - uint local_res8; - ulong local_res10 [2]; - ulong local_res18; - void *local_res20; - uint uStack_84; - undefined8 local_80; - longlong local_78; - undefined1 local_70 [8]; + ushort uVar1; + int iVar2; + ulonglong uVar3; + undefined8 uVar4; + undefined1 auVar5 [16]; + undefined1 auVar6 [16]; + char cVar7; + uint uVar8; + long lVar9; + uint uVar10; + uint uVar11; + ulonglong *puVar12; + ulonglong uVar13; + ulonglong uVar14; + uint *puVar15; + uint *puVar16; + __uint64 _Var17; + longlong lVar18; + undefined8 *puVar19; + _CLS_LSN *p_Var20; + uint uVar21; + _CLFS_LOG_BLOCK_HEADER _Var22; + _CLFS_LOG_BLOCK_HEADER *p_Var23; + _CLFS_LOG_BLOCK_HEADER *p_Var24; + bool bVar25; + _CLFS_LOG_BLOCK_HEADER local_res8; + ushort local_res10; + uint local_e8; + int iStack_dc; + ulong local_d4; + longlong local_d0; + undefined8 local_c8; + undefined8 local_c0; + longlong local_b8; + undefined8 local_b0; + undefined8 local_a8; + undefined1 local_a0 [8]; + _CLS_LSN local_98 [8]; + _CLS_LSN local_90 [8]; + _CLS_LSN local_88 [8]; + _CLS_LSN local_80 [8]; + _CLS_LSN local_78 [8]; + _CLS_LSN local_70 [8]; _CLS_LSN local_68 [8]; _CLS_LSN local_60 [8]; _CLS_LSN local_58 [24]; - lVar26 = 0; - uVar20 = 0; - local_res10[0] = 0; - local_res8 = 0; + lVar9 = 0; + local_e8 = 0; + local_res10 = 0; + local_res8 = (_CLFS_LOG_BLOCK_HEADER)0x0; *(undefined8 *)param_6 = 0xffffffff00000000; - local_res18 = param_2; - local_res20 = param_3; ExAcquireResourceSharedLite(this + 200,1); - puVar17 = (ulonglong *)(**(code **)(*(longlong *)this + 0x160))(this,local_70); - uVar18 = 0xffffffff00000000; - if ((int)(*puVar17 >> 0x20) != -1) { - uVar18 = *puVar17 & 0xfffffffffffffe00; + puVar12 = (ulonglong *)(**(code **)(*(longlong *)this + 0x160))(this,local_a0); + uVar13 = 0xffffffff00000000; + if ((int)(*puVar12 >> 0x20) != -1) { + uVar13 = *puVar12 & 0xfffffffffffffe00; } if (((param_1 == (_CLS_LSN *)0x0) || - (uVar22 = (uint)(uVar18 >> 0x20), uVar22 < *(uint *)(param_1 + 4))) || - ((*(uint *)(param_1 + 4) == uVar22 && ((uint)uVar18 <= *(uint *)param_1)))) { + (uVar11 = (uint)(uVar13 >> 0x20), uVar11 < *(uint *)(param_1 + 4))) || + ((*(uint *)(param_1 + 4) == uVar11 && ((uint)uVar13 <= *(uint *)param_1)))) { ExReleaseResourceForThreadLite(this + 200,SystemReserved1[0xf]); - uVar18 = 0; *(undefined8 *)param_6 = *(undefined8 *)param_1; - local_80 = *(undefined8 *)param_1; - do { - if (*param_5 - 0x28 <= uVar18) break; - pCVar3 = this + 0x1e8; - p_Var4 = (_CLFS_LOG_BLOCK_HEADER *)(uVar18 + (longlong)param_3); - if ((pCVar3 == (CClfsLogFcbPhysical *)0x0) || (*(longlong *)pCVar3 != -0x100000000)) { - ValidateContainerSize(this); - } - uVar5 = *(ushort *)(p_Var4 + 4); - lVar19 = *(longlong *)(this + 0x50); - local_78 = SUB168(ZEXT816(0x200) * ZEXT216(uVar5),8); - if (local_78 != 0) { + uVar13 = *(ulonglong *)param_1; + p_Var24 = param_3; + uVar11 = 0; + if (*param_5 != 0x28) { LAB_0: - lVar26 = -0x3fe5fff6; -LAB_1: - if ((int)uVar20 == 0) { - return lVar26; - } - lVar26 = 0; - param_3 = local_res20; - break; - } - p_Var1 = p_Var4 + 0x18; - if ((p_Var1 == (_CLFS_LOG_BLOCK_HEADER *)0x0) || (*(longlong *)p_Var1 != -0x100000000)) { - uVar13 = ValidateContainerSize(this); - if (uVar13 == '\0') { - uVar18 = 0xffffffff00000000; + uVar11 = (param_4 - local_e8) - 0x28; + uVar14 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + _Var22 = p_Var24[2]; + iStack_dc = (int)(uVar13 >> 0x20); + if ((int)uVar14 == 0) { + AddLsnOffset(this,local_80,(__uint64 *)(this + 0x1e8)); + local_a8 = *(undefined8 *)(this + 0x50); + local_b8 = SUB168(ZEXT816(0x200) * ZEXT216(*(ushort *)(p_Var24 + 4)),8); + local_b0 = SUB168(ZEXT816(0x200) * ZEXT216(*(ushort *)(p_Var24 + 4)),0); + if (local_b8 != 0) goto LAB_1; + p_Var23 = p_Var24 + 0x18; + puVar15 = (uint *)AddLsnOffset(this,local_78,(__uint64 *)p_Var23); + puVar16 = (uint *)AddLsnOffset(this,local_70,(__uint64 *)(this + 0x1e8)); + if ((((puVar16 != (uint *)0x0) && (puVar15 != (uint *)0x0)) && (puVar16[1] <= puVar15[1])) + && ((puVar16[1] != puVar15[1] || (*puVar16 < *puVar15)))) goto LAB_1; + uVar14 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar14 == 0) { + _Var22 = p_Var24[2]; + _Var17 = 0xffffffff00000000; + if (iStack_dc != -1) { + _Var17 = uVar13 & 0xfffffffffffffe00; + } + if (((p_Var23 == (_CLFS_LOG_BLOCK_HEADER *)0x0) || (*(__uint64 *)p_Var23 != _Var17)) || + (uVar8 = (uint)*(ushort *)(p_Var24 + 4), + *(ushort *)(p_Var24 + 6) < *(ushort *)(p_Var24 + 4))) goto LAB_2; + lVar9 = ClfsValidateSector((uchar *)p_Var24,(uchar)_Var22,'D'); + if (lVar9 < 0) goto LAB_3; + uVar21 = *(uint *)(p_Var24 + 0x28); + if (((uVar21 < 0x70) || ((uVar21 & 7) != 0)) || (uVar8 << 9 < uVar21)) goto LAB_2; + uVar13 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar13 == 0) { + if (uVar11 < (uint)*(ushort *)(p_Var24 + 4) << 9) { + lVar9 = -0x3fe5fffc; + } + else { + uVar11 = *(ushort *)(p_Var24 + 4) - 1; + if (1 < uVar11) { + uVar13 = 1; + uVar8 = 1; + do { + if ((char)p_Var24[uVar13 * 0x200 + 0x1fe] < '\0') goto LAB_4; + if (p_Var24[uVar13 * 0x200 + 0x1ff] != _Var22) goto LAB_5; + if (((byte)p_Var24[uVar13 * 0x200 + 0x1fe] & 4) == 0) goto LAB_6; + uVar8 = uVar8 + 1; + uVar13 = (ulonglong)uVar8; + } while (uVar8 < uVar11); + } + uVar1 = *(ushort *)(p_Var24 + 4); +LAB_7: + lVar9 = ClfsValidateSector((uchar *)(p_Var24 + ((ulonglong)uVar1 - 1) * 0x200), + (uchar)_Var22,'$'); + } + } + else { + uVar1 = *(ushort *)(p_Var24 + 4); + if ((uint)uVar1 << 9 <= uVar11) { + if (1 < uVar1 - 1) { + uVar13 = 1; + uVar11 = 1; + do { + if ((char)p_Var24[uVar13 * 0x200 + 0x1fe] < '\0') goto LAB_4; + if (p_Var24[uVar13 * 0x200 + 0x1ff] != _Var22) goto LAB_5; + if (((byte)p_Var24[uVar13 * 0x200 + 0x1fe] & 4) == 0) goto LAB_6; + uVar11 = uVar11 + 1; + uVar13 = (ulonglong)uVar11; + } while (uVar11 < uVar1 - 1); + } + goto LAB_7; + } + lVar9 = -0x3fe5fffc; + } } else { - if (p_Var1 == (_CLFS_LOG_BLOCK_HEADER *)0x0) { - uVar18 = 0xffffffff; - uVar28 = 0xffffffff; + _Var17 = 0xffffffff00000000; + if (iStack_dc != -1) { + _Var17 = uVar13 & 0xfffffffffffffe00; + } + if (((p_Var23 != (_CLFS_LOG_BLOCK_HEADER *)0x0) && (*(__uint64 *)p_Var23 == _Var17)) && + (uVar8 = (uint)*(ushort *)(p_Var24 + 4), + *(ushort *)(p_Var24 + 4) <= *(ushort *)(p_Var24 + 6))) { + lVar9 = ClfsValidateSector((uchar *)p_Var24,(uchar)_Var22,'D'); + if (lVar9 < 0) goto LAB_3; + uVar21 = *(uint *)(p_Var24 + 0x28); + if (((0x6f < uVar21) && ((uVar21 & 7) == 0)) && (uVar21 <= uVar8 << 9)) { + uVar13 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar13 == 0) { + if (uVar11 < (uint)*(ushort *)(p_Var24 + 4) << 9) { + lVar9 = -0x3fe5fffc; + } + else { + uVar11 = *(ushort *)(p_Var24 + 4) - 1; + if (1 < uVar11) { + uVar13 = 1; + uVar8 = 1; + do { + if ((char)p_Var24[uVar13 * 0x200 + 0x1fe] < '\0') goto LAB_4; + if (p_Var24[uVar13 * 0x200 + 0x1ff] != _Var22) goto LAB_5; + if (((byte)p_Var24[uVar13 * 0x200 + 0x1fe] & 4) == 0) goto LAB_6; + uVar8 = uVar8 + 1; + uVar13 = (ulonglong)uVar8; + } while (uVar8 < uVar11); + } + uVar1 = *(ushort *)(p_Var24 + 4); +LAB_8: + lVar9 = ClfsValidateSector((uchar *)(p_Var24 + ((ulonglong)uVar1 - 1) * 0x200), + (uchar)_Var22,'$'); + } + } + else { + uVar1 = *(ushort *)(p_Var24 + 4); + if ((uint)uVar1 << 9 <= uVar11) { + if (1 < uVar1 - 1) { + uVar13 = 1; + uVar11 = 1; + do { + if ((char)p_Var24[uVar13 * 0x200 + 0x1fe] < '\0') goto LAB_4; + if (p_Var24[uVar13 * 0x200 + 0x1ff] != _Var22) goto LAB_5; + if (((byte)p_Var24[uVar13 * 0x200 + 0x1fe] & 4) == 0) goto LAB_6; + uVar11 = uVar11 + 1; + uVar13 = (ulonglong)uVar11; + } while (uVar11 < uVar1 - 1); + } + goto LAB_8; + } + lVar9 = -0x3fe5fffc; + } + goto LAB_3; + } + } +LAB_2: + lVar9 = -0x3fe5fff6; + } + goto LAB_3; + } + local_res10 = *(ushort *)(p_Var24 + 4); + AddLsnOffset(this,local_98,(__uint64 *)(this + 0x1e8)); + local_c0 = *(undefined8 *)(this + 0x50); + local_d0 = SUB168(ZEXT816(0x200) * ZEXT216(*(ushort *)(p_Var24 + 4)),8); + local_c8 = SUB168(ZEXT816(0x200) * ZEXT216(*(ushort *)(p_Var24 + 4)),0); + if (local_d0 == 0) { + p_Var23 = p_Var24 + 0x18; + puVar15 = (uint *)AddLsnOffset(this,local_90,(__uint64 *)p_Var23); + puVar16 = (uint *)AddLsnOffset(this,local_88,(__uint64 *)(this + 0x1e8)); + if ((((puVar16 == (uint *)0x0) || (puVar15 == (uint *)0x0)) || (puVar15[1] < puVar16[1])) || + ((puVar16[1] == puVar15[1] && (*puVar15 <= *puVar16)))) { + uVar14 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + local_res8 = _Var22; + if ((int)uVar14 == 0) { + _Var22 = p_Var24[2]; + _Var17 = 0xffffffff00000000; + if (iStack_dc != -1) { + _Var17 = uVar13 & 0xfffffffffffffe00; + } + if (((p_Var23 != (_CLFS_LOG_BLOCK_HEADER *)0x0) && (*(__uint64 *)p_Var23 == _Var17)) && + (uVar8 = (uint)*(ushort *)(p_Var24 + 4), + *(ushort *)(p_Var24 + 4) <= *(ushort *)(p_Var24 + 6))) { + lVar9 = ClfsValidateSector((uchar *)p_Var24,(uchar)_Var22,'D'); + if (-1 < lVar9) { + uVar21 = *(uint *)(p_Var24 + 0x28); + if (uVar21 < 0x70) { + lVar9 = -0x3fe5fff6; + } + else { + if ((uVar21 & 7) != 0) goto LAB_9; + if (uVar8 << 9 < uVar21) { + lVar9 = -0x3fe5fff6; + } + else { + uVar13 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar13 == 0) { + if (uVar11 < (uint)*(ushort *)(p_Var24 + 4) << 9) { + lVar9 = -0x3fe5fffc; + } + else { + uVar11 = *(ushort *)(p_Var24 + 4) - 1; + if (1 < uVar11) { + uVar13 = 1; + uVar8 = 1; + do { + if ((char)p_Var24[uVar13 * 0x200 + 0x1fe] < '\0') goto LAB_10; + if (p_Var24[uVar13 * 0x200 + 0x1ff] != _Var22) goto LAB_11; + if (((byte)p_Var24[uVar13 * 0x200 + 0x1fe] & 4) == 0) + goto LAB_12; + uVar8 = uVar8 + 1; + uVar13 = (ulonglong)uVar8; + } while (uVar8 < uVar11); + } + uVar1 = *(ushort *)(p_Var24 + 4); +LAB_13: + lVar9 = ClfsValidateSector((uchar *)(p_Var24 + + ((ulonglong)uVar1 - 1) * 0x200), + (uchar)_Var22,'$'); + } + } + else { + uVar1 = *(ushort *)(p_Var24 + 4); + if ((uint)uVar1 << 9 <= uVar11) { + if (1 < uVar1 - 1) { + uVar13 = 1; + uVar11 = 1; + do { + if ((char)p_Var24[uVar13 * 0x200 + 0x1fe] < '\0') goto LAB_10; + if (p_Var24[uVar13 * 0x200 + 0x1ff] != _Var22) goto LAB_11; + if (((byte)p_Var24[uVar13 * 0x200 + 0x1fe] & 4) == 0) + goto LAB_12; + uVar11 = uVar11 + 1; + uVar13 = (ulonglong)uVar11; + } while (uVar11 < uVar1 - 1); + } + goto LAB_13; + } + lVar9 = -0x3fe5fffc; + } + } + } + } + goto LAB_3; + } } else { - uVar28 = (ulonglong)(*(uint *)p_Var1 & 0xfffffe00); - uVar18 = (ulonglong)*(uint *)(p_Var4 + 0x1c); - } - auVar7._8_8_ = 0; - auVar7._0_8_ = *(ulonglong *)(this + 0x2b8); - auVar9._8_8_ = 0; - auVar9._0_8_ = uVar18 * *(ulonglong *)(this + 0x2b8) + - SUB168(ZEXT816(0x200) * ZEXT216(uVar5),0) + uVar28; - auVar12 = auVar9 / auVar7; - auVar9 = auVar9 % auVar7; - uVar18 = 0xffffffff00000000; - if ((((auVar12._4_4_ == 0) && (auVar9._4_4_ == 0)) && (auVar12._0_4_ != -1)) && - ((auVar9._0_8_ & 0x1ff) == 0)) { - uVar18 = auVar12._0_8_ << 0x20 | (ulonglong)auVar9._0_4_; - } + _Var17 = 0xffffffff00000000; + if (iStack_dc != -1) { + _Var17 = uVar13 & 0xfffffffffffffe00; + } + if ((p_Var23 != (_CLFS_LOG_BLOCK_HEADER *)0x0) && (*(__uint64 *)p_Var23 == _Var17)) { + uVar8 = (uint)*(ushort *)(p_Var24 + 4); + if (*(ushort *)(p_Var24 + 6) < *(ushort *)(p_Var24 + 4)) { + lVar9 = -0x3fe5fff6; + } + else { + lVar9 = ClfsValidateSector((uchar *)p_Var24,(uchar)_Var22,'D'); + if (-1 < lVar9) { + uVar21 = *(uint *)(p_Var24 + 0x28); + if (uVar21 < 0x70) { + lVar9 = -0x3fe5fff6; + } + else { + if ((uVar21 & 7) != 0) goto LAB_9; + if (uVar8 << 9 < uVar21) { + lVar9 = -0x3fe5fff6; + } + else { + uVar13 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar13 == 0) { + if (uVar11 < (uint)*(ushort *)(p_Var24 + 4) << 9) { + lVar9 = -0x3fe5fffc; + } + else { + uVar11 = *(ushort *)(p_Var24 + 4) - 1; + if (1 < uVar11) { + uVar13 = 1; + uVar8 = 1; + do { + if ((char)p_Var24[uVar13 * 0x200 + 0x1fe] < '\0') goto LAB_10; + if (p_Var24[uVar13 * 0x200 + 0x1ff] != _Var22) goto LAB_11; + if (((byte)p_Var24[uVar13 * 0x200 + 0x1fe] & 4) == 0) + goto LAB_12; + uVar8 = uVar8 + 1; + uVar13 = (ulonglong)uVar8; + } while (uVar8 < uVar11); + } + uVar1 = *(ushort *)(p_Var24 + 4); +LAB_14: + lVar9 = ClfsValidateSector((uchar *)(p_Var24 + + ((ulonglong)uVar1 - 1) * 0x200), + (uchar)_Var22,'$'); + } + } + else { + uVar1 = *(ushort *)(p_Var24 + 4); + if ((uint)uVar1 << 9 <= uVar11) { + if (1 < uVar1 - 1) { + uVar13 = 1; + uVar11 = 1; + do { + if ((char)p_Var24[uVar13 * 0x200 + 0x1fe] < '\0') goto LAB_10; + if (p_Var24[uVar13 * 0x200 + 0x1ff] != _Var22) goto LAB_11; + if (((byte)p_Var24[uVar13 * 0x200 + 0x1fe] & 4) == 0) + goto LAB_12; + uVar11 = uVar11 + 1; + uVar13 = (ulonglong)uVar11; + } while (uVar11 < uVar1 - 1); + } + goto LAB_14; + } + lVar9 = -0x3fe5fffc; + } + } + } + } + } + goto LAB_3; + } + } +LAB_9: + lVar9 = -0x3fe5fff6; + goto LAB_3; } } - else { - uVar18 = 0xffffffff00000000; +LAB_1: + lVar9 = -0x3fe5fff6; + goto LAB_15; + } +LAB_16: + *(undefined8 *)((longlong)param_3 + ((ulonglong)param_4 - 0x20)) = *(undefined8 *)param_6; + *param_5 = (ulonglong)uVar11; + uVar11 = *(uint *)((longlong)param_3 + ((ulonglong)param_4 - 0x10)); + puVar15 = (uint *)((longlong)param_3 + ((ulonglong)param_4 - 0x10)); + LOCK(); + bVar25 = uVar11 == *puVar15; + if (bVar25) { + *puVar15 = uVar11 & 0xffffff7f; + } + UNLOCK(); + while (!bVar25) { + uVar11 = *(uint *)((longlong)param_3 + ((ulonglong)param_4 - 0x10)); + puVar15 = (uint *)((longlong)param_3 + ((ulonglong)param_4 - 0x10)); + LOCK(); + bVar25 = uVar11 == *puVar15; + if (bVar25) { + *puVar15 = uVar11 & 0xffffff7f; } - uVar28 = 0; - if ((pCVar3 == (CClfsLogFcbPhysical *)0x0) || (*(longlong *)pCVar3 != -0x100000000)) { - uVar13 = ValidateContainerSize(this); - if (uVar13 != '\0') { - if (pCVar3 == (CClfsLogFcbPhysical *)0x0) { - uVar28 = 0xffffffff; - uVar23 = 0xffffffff; - } - else { - uVar23 = (ulonglong)(*(uint *)pCVar3 & 0xfffffe00); - uVar28 = (ulonglong)*(uint *)(this + 0x1ec); - } - auVar12._8_8_ = 0; - auVar12._0_8_ = *(ulonglong *)(this + 0x2b8); - auVar10._8_8_ = 0; - auVar10._0_8_ = uVar28 * *(ulonglong *)(this + 0x2b8) + lVar19 + uVar23; - auVar7 = auVar10 / auVar12; - auVar10 = auVar10 % auVar12; - if ((auVar7._4_4_ == 0) && (uVar28 = 0xffffffff00000000, auVar10._4_4_ == 0)) { - if ((auVar7._0_4_ != -1) && ((auVar10._0_8_ & 0x1ff) == 0)) { - uVar28 = auVar7._0_8_ << 0x20 | (ulonglong)auVar10._0_4_; - } - uVar22 = (uint)(uVar28 >> 0x20); - goto LAB_2; - } - } - uVar28 = 0; - uVar22 = 0xffffffff; + UNLOCK(); + } + } + else { + ExReleaseResourceForThreadLite(this + 200,SystemReserved1[0xf]); + lVar9 = -0x3fe5ffed; + } + return lVar9; +LAB_4: + lVar9 = -0x3fe5fffd; + goto LAB_3; +LAB_5: + lVar9 = -0x3fe5fffe; + goto LAB_3; +LAB_6: + lVar9 = -0x3fe5ffff; + goto LAB_3; +LAB_10: + lVar9 = -0x3fe5fffd; + goto LAB_3; +LAB_11: + lVar9 = -0x3fe5fffe; + goto LAB_3; +LAB_12: + lVar9 = -0x3fe5ffff; +LAB_3: + if (lVar9 < 0) { +LAB_15: + if (local_e8 == 0) { + return lVar9; + } + lVar9 = 0; + uVar11 = local_e8; + goto LAB_16; + } + uVar13 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar13 == 0) { + _Var22 = p_Var24[2]; + uVar1 = *(ushort *)(p_Var24 + 4); + } + else { + _Var22 = local_res8; + uVar1 = local_res10; + if ((ulonglong)(param_4 - local_e8) - 0x28 < (ulonglong)local_res10 << 9) { + lVar9 = -0x3fe5fffc; + goto LAB_15; + } + } + lVar9 = ClfsDecodeBlock(p_Var24,(uint)uVar1,(uchar)_Var22,'\x04',&local_d4); + if (lVar9 < 0) goto LAB_15; + uVar13 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + iVar2 = *(int *)(*(longlong *)(this + 0x2c8) + 0x90); + if ((int)uVar13 == 0) { + if (iVar2 == 0) { + uVar11 = 0; + } + else { + uVar1 = *(ushort *)(p_Var24 + 4); +LAB_17: + uVar11 = (uint)uVar1 * 0x200 + -1 + iVar2 & -iVar2; + } + } + else { + uVar1 = local_res10; + if (iVar2 != 0) goto LAB_17; + uVar11 = 0; + } + cVar7 = (**(code **)(*(longlong *)this + 0x138))(this); + if (cVar7 == '\0') { + p_Var20 = local_68; + } + else { + p_Var23 = p_Var24 + 0x18; + cVar7 = (**(code **)(*(longlong *)this + 0x138))(); + if (cVar7 == '\0') { +LAB_18: + uVar8 = 0; + uVar21 = 0xffffffff; + } + else { + if (p_Var23 == (_CLFS_LOG_BLOCK_HEADER *)0x0) { + uVar14 = 0xffffffff; + uVar13 = 0xffffffff; } else { - uVar22 = 0xffffffff; + if (*(longlong *)p_Var23 == -0x100000000) goto LAB_18; + uVar14 = (ulonglong)*(uint *)(p_Var24 + 0x1c); + uVar13 = (ulonglong)(*(uint *)p_Var23 & 0xfffffe00); } -LAB_2: - uStack_84 = (uint)(uVar18 >> 0x20); - if ((uVar22 <= uStack_84) && (((uint)uVar28 < (uint)uVar18 || (uVar22 != uStack_84)))) - goto LAB_0; - lVar26 = ClfsValidateBlock((_CLS_LSN *)&local_80,p_Var4,(param_4 - (int)uVar20) - 0x28, - (uchar)p_Var4[2],'\x04',local_res10); - if (lVar26 < 0) goto LAB_1; - uVar22 = *(uint *)(p_Var4 + 0xc); - uVar5 = *(ushort *)(p_Var4 + 4); - if (uVar22 != 0) { - if (uVar22 != 0xffffffff) { - *(undefined4 *)(p_Var4 + 0xc) = 0; - iVar29 = (uint)uVar5 << 9; - uVar28 = 0; - uVar18 = 0xffffffff; - if (uVar5 != 0) { - do { - p_Var1 = p_Var4 + uVar28; - uVar28 = (ulonglong)((int)uVar28 + 1); - uVar15 = (uint)(uVar18 >> 8) ^ - *(uint *)((longlong)&CCrc32::m_rgCrcTable + - ((ulonglong)(byte)*p_Var1 ^ uVar18 & 0xff) * 4); - uVar18 = (ulonglong)uVar15; - iVar29 = iVar29 + -1; - } while (iVar29 != 0); - uVar20 = (ulonglong)local_res8; - if (uVar22 == ~uVar15) goto LAB_3; - } - *(uint *)(p_Var4 + 0xc) = uVar22; - } - goto LAB_0; + uVar3 = *(ulonglong *)(this + 0x2b8); + lVar18 = uVar13 + uVar14 * uVar3; + uVar13 = (lVar18 + (ulonglong)((uint)(lVar18 >> 0x3f) & 0x7ffff) & 0xfffffffffff80000) + + 0x7f000; + auVar5._8_8_ = 0; + auVar5._0_8_ = uVar3; + auVar6._8_8_ = 0; + auVar6._0_8_ = uVar13; + uVar10 = (uint)(uVar13 / uVar3); + uVar8 = 0; + uVar21 = 0xffffffff; + if ((uVar10 != 0xffffffff) && ((SUB168(auVar6 % auVar5,0) & 0x1ff) == 0)) { + uVar8 = SUB164(auVar6 % auVar5,0); + uVar21 = uVar10; } -LAB_3: - uVar22 = (uint)uVar20; - lVar26 = ClfsDecodeBlockPrivate(p_Var4,(uint)uVar5,(uchar)p_Var4[2],'\x04',local_res10); - if (lVar26 < 0) goto LAB_1; - iVar29 = *(int *)(*(longlong *)(this + 0x2c8) + 0x90); - if (iVar29 == 0) { - uVar15 = 0; - } - else { - uVar15 = (uint)*(ushort *)(p_Var4 + 4) * 0x200 + -1 + iVar29 & -iVar29; - } - cVar14 = (**(code **)(*(longlong *)this + 0x138))(this); - if (cVar14 == '\0') { - p_Var24 = local_68; -LAB_4: - puVar21 = (undefined8 *)AddLsnOffset(this,p_Var24,(ulong)param_6); - *(undefined8 *)param_6 = *puVar21; - } - else { - p_Var1 = p_Var4 + 0x18; - cVar14 = (**(code **)(*(longlong *)this + 0x138))(); - uVar25 = 0xffffffff00000000; - if (cVar14 != '\0') { - if (p_Var1 == (_CLFS_LOG_BLOCK_HEADER *)0x0) { - uVar22 = 0xffffffff; - } - else { - if (*(longlong *)p_Var1 == -0x100000000) goto LAB_5; - uVar22 = *(uint *)(p_Var4 + 0x1c); - } - uVar18 = *(ulonglong *)(this + 0x2b8); - uVar16 = ClfsLsnBlockOffset((uint *)p_Var1); - local_80 = 0xffffffff00000000; - lVar19 = (ulonglong)uVar16 + uVar22 * uVar18; - uVar20 = (lVar19 + (ulonglong)((uint)(lVar19 >> 0x3f) & 0x7ffff) & 0xfffffffffff80000) + - 0x7f000; - auVar8._8_8_ = 0; - auVar8._0_8_ = uVar18; - auVar11._8_8_ = 0; - auVar11._0_8_ = uVar20; - iVar29 = (int)(uVar20 / uVar18); - uVar25 = local_80; - uVar22 = local_res8; - if ((iVar29 != -1) && ((SUB168(auVar11 % auVar8,0) & 0x1ff) == 0)) { - uVar25 = CONCAT44(iVar29,SUB164(auVar11 % auVar8,0)); - local_80 = uVar25; - } - } -LAB_5: - puVar21 = (undefined8 *)AddLsnOffset(this,local_60,(int)p_Var4 + 0x18); - uVar6 = *puVar21; - *(undefined8 *)param_6 = uVar6; - uVar16 = (uint)((ulonglong)uVar6 >> 0x20); - uVar27 = (uint)((ulonglong)uVar25 >> 0x20); - if ((uVar27 < uVar16) || ((uVar27 == uVar16 && ((uint)uVar25 <= (uint)uVar6)))) { - p_Var24 = local_58; - goto LAB_4; - } - } - local_res8 = uVar22 + uVar15; - uVar20 = (ulonglong)local_res8; - uVar18 = (ulonglong)local_res8; - local_80 = *(undefined8 *)(uVar20 + 0x18 + (longlong)local_res20); - param_3 = local_res20; - } while ((local_res18 & 1) == 0); - *(undefined8 *)((longlong)param_3 + ((ulonglong)param_4 - 0x20)) = *(undefined8 *)param_6; - *param_5 = uVar20; - uVar22 = *(uint *)((longlong)param_3 + ((ulonglong)param_4 - 0x10)); - puVar2 = (uint *)((longlong)param_3 + ((ulonglong)param_4 - 0x10)); - LOCK(); - bVar30 = uVar22 == *puVar2; - if (bVar30) { - *puVar2 = uVar22 & 0xffffff7f; - } - UNLOCK(); - while (!bVar30) { - uVar22 = *(uint *)((longlong)param_3 + ((ulonglong)param_4 - 0x10)); - puVar2 = (uint *)((longlong)param_3 + ((ulonglong)param_4 - 0x10)); - LOCK(); - bVar30 = uVar22 == *puVar2; - if (bVar30) { - *puVar2 = uVar22 & 0xffffff7f; - } - UNLOCK(); - } - } - else { - ExReleaseResourceForThreadLite(this + 200,SystemReserved1[0xf]); - lVar26 = -0x3fe5ffed; - } - return lVar26; + } + puVar19 = (undefined8 *)AddLsnOffset(this,local_60,(ulong)p_Var23); + uVar4 = *puVar19; + *(undefined8 *)param_6 = uVar4; + uVar10 = (uint)((ulonglong)uVar4 >> 0x20); + if ((uVar10 <= uVar21) && ((uVar21 != uVar10 || ((uint)uVar4 < uVar8)))) goto LAB_19; + p_Var20 = local_58; + } + puVar19 = (undefined8 *)AddLsnOffset(this,p_Var20,(ulong)param_6); + *(undefined8 *)param_6 = *puVar19; +LAB_19: + uVar11 = local_e8 + uVar11; + p_Var24 = (_CLFS_LOG_BLOCK_HEADER *)((longlong)param_3 + (ulonglong)uVar11); + uVar13 = *(ulonglong *)(p_Var24 + 0x18); + if (((param_2 & 1) != 0) || (local_e8 = uVar11, *param_5 - 0x28 <= (ulonglong)uVar11)) + goto LAB_16; + goto LAB_0; } ``` ## CClfsLogFcbPhysical::ReadLogBlock ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.29| |i_ratio|0.51| |m_ratio|0.97| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|ReadLogBlock|ReadLogBlock| |fullname|CClfsLogFcbPhysical::ReadLogBlock|CClfsLogFcbPhysical::ReadLogBlock| |refcount|4|4| |`length`|2442|2590| |`called`|

Expand for full list:
CClfsLogFcbCommon::IsMainLocked
CClfsLogFcbCommon::SetInvalidLogTag
CClfsLogFcbPhysical::AddLsnOffset
CClfsLogFcbPhysical::GetNextOwnerPageLsn
CClfsLogFcbPhysical::LsnToCacheOffset
CClfsLogFcbPhysical::RawSectorAlign
CClfsLogFcbPhysical::ReadLog
CClfsLogFcbPhysical::ValidateLogBlock
ClfsCheckAndResetReadInProgress
ClfsDecodeBlock
Feature_950255931__private_IsEnabledDeviceUsageNoInline

NTOSKRNL.EXE::CcCopyRead
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
NTOSKRNL.EXE::KeBugCheckEx
RtlLongLongAdd
_CLFS_READ_BUFFER::GetAddress
_guard_dispatch_icall
memset
operator>=

Feature_950255931__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::CcCopyRead
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
NTOSKRNL.EXE::KeBugCheckEx
RtlLongLongAdd
_CLFS_READ_BUFFER::GetAddress
_guard_dispatch_icall
memset
operator>=

| |calling|CClfsLogFcbPhysical::ReadLogBlock`adjustor{608}'|CClfsLogFcbPhysical::ReadLogBlock`adjustor{608}'| |paramcount|10|10| |`address`|14000f0b0|14000eda0| |sig|long __thiscall ReadLogBlock(CClfsLogFcbPhysical * this, _FILE_OBJECT * param_1, _CLS_LSN * param_2, ulong param_3, _CLFS_READ_BUFFER * param_4, ulong param_5, IClfsRequestAsync * param_6, ulong param_7, _CLS_LSN * param_8, ulong * param_9)|long __thiscall ReadLogBlock(CClfsLogFcbPhysical * this, _FILE_OBJECT * param_1, _CLS_LSN * param_2, ulong param_3, _CLFS_READ_BUFFER * param_4, ulong param_5, IClfsRequestAsync * param_6, ulong param_7, _CLS_LSN * param_8, ulong * param_9)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsLogFcbPhysical::ReadLogBlock Called Diff ```diff --- CClfsLogFcbPhysical::ReadLogBlock called +++ CClfsLogFcbPhysical::ReadLogBlock called @@ -10,0 +11 @@ +Feature_344697147__private_IsEnabledDeviceUsageNoInline ``` ### CClfsLogFcbPhysical::ReadLogBlock Diff ```diff --- CClfsLogFcbPhysical::ReadLogBlock +++ CClfsLogFcbPhysical::ReadLogBlock @@ -1,332 +1,358 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: virtual long __cdecl CClfsLogFcbPhysical::ReadLogBlock(struct _FILE_OBJECT * __ptr64,union _CLS_LSN const & __ptr64,unsigned long,struct _CLFS_READ_BUFFER const & __ptr64,unsigned long,struct IClfsRequestAsync * __ptr64,unsigned long,union _CLS_LSN & __ptr64,unsigned long & __ptr64) __ptr64 */ long __thiscall CClfsLogFcbPhysical::ReadLogBlock (CClfsLogFcbPhysical *this,_FILE_OBJECT *param_1,_CLS_LSN *param_2,ulong param_3, _CLFS_READ_BUFFER *param_4,ulong param_5,IClfsRequestAsync *param_6,ulong param_7, _CLS_LSN *param_8,ulong *param_9) { bool bVar1; bool bVar2; uchar uVar3; char cVar4; - uint uVar5; - long lVar6; - ulong uVar7; - int iVar8; + _CLFS_LOG_BLOCK_HEADER _Var5; + uint uVar6; + long lVar7; + ulong uVar8; int iVar9; - _CLFS_LOG_BLOCK_HEADER *p_Var10; - longlong *plVar11; - ulonglong uVar12; - undefined8 *puVar13; - IClfsRequestAsync *pIVar14; - __uint64 _Var15; - ulonglong uVar16; + int iVar10; + _CLFS_LOG_BLOCK_HEADER *p_Var11; + longlong *plVar12; + ulonglong uVar13; + undefined8 *puVar14; + IClfsRequestAsync *pIVar15; + __uint64 _Var16; ulong uVar17; - longlong lVar18; - ushort uVar19; - uchar *puVar20; - ulong uVar21; - uchar *in_stack_fffffffffffffed8; - char local_108; - int local_104; - ulong local_fc; - ulong local_f8; - int local_f4; - uint local_f0; - uint local_ec; - uint local_e8; - ulong local_e4; - uchar *local_e0; - undefined8 local_d8; - ulonglong local_d0; - __uint64 local_c8; - uint local_c0; - uint local_bc; - __int64 local_b8; - _CLS_LSN *local_b0; - undefined8 local_a8; - ulonglong local_a0; - _CLS_LSN *local_98; - _CLFS_LOG_BLOCK_HEADER *local_90; - undefined8 local_88; - undefined8 uStack_80; - undefined8 local_78; - _CLS_LSN local_70 [8]; - undefined8 local_68; - __uint64 local_60; - ulonglong local_58; + ulonglong uVar18; + longlong lVar19; + ushort uVar20; + uchar *puVar21; + ulong uVar22; + char local_128; + int local_124; + _CLFS_LOG_BLOCK_HEADER local_120; + ushort local_11c; + ulong local_118; + ulong local_114; + int local_110; + uint local_10c; + ulong local_108; + uint local_104; + uint local_100; + undefined8 local_f8; + ulonglong local_f0; + uchar *local_e8; + __uint64 local_e0; + uint local_d8; + uint local_d4; + __int64 local_d0; + _CLS_LSN *local_c8; + _CLFS_LOG_BLOCK_HEADER *local_c0; + undefined8 local_b8; + ulonglong local_b0; + _CLS_LSN *local_a8; + _CLS_LSN *local_a0; + CClfsLogFcbPhysical *local_98; + undefined8 local_90; + undefined8 uStack_88; + undefined8 local_80; + _CLS_LSN local_78 [8]; + undefined8 local_70; + __uint64 local_68; + ulonglong local_60; + _CLS_LSN local_58 [8]; _CLS_LSN local_50 [8]; - _CLS_LSN local_48 [8]; - _CLS_LSN local_40 [8]; + _CLS_LSN local_48 [16]; - lVar18 = -0x100000000; - local_d8 = -0x100000000; - local_a8 = 0; - local_a0 = 0; - local_c8 = 0; - local_104 = 0; - local_e4 = 0; - local_fc = 0; - local_f4 = 0; - local_108 = '\0'; - local_ec = *(uint *)(*(longlong *)(this + 0x2c8) + 0x90); - if (((0xfff < local_ec - 1) || ((local_ec & 0x1ff) != 0)) || - ((int)(0x1000 % (ulonglong)local_ec) != 0)) { + lVar19 = -0x100000000; + local_f8 = -0x100000000; + local_b8 = 0; + local_b0 = 0; + local_e0 = 0; + local_124 = 0; + local_108 = 0; + local_118 = 0; + local_110 = 0; + local_128 = '\0'; + local_11c = 0; + local_104 = *(uint *)(*(longlong *)(this + 0x2c8) + 0x90); + if (((0xfff < local_104 - 1) || ((local_104 & 0x1ff) != 0)) || + ((int)(0x1000 % (ulonglong)local_104) != 0)) { return -0x3fffff68; } *param_9 = 0; *(undefined8 *)param_8 = 0xffffffff00000000; - local_88 = *(undefined8 *)param_4; - uStack_80 = *(undefined8 *)(param_4 + 8); - local_78 = *(undefined8 *)(param_4 + 0x10); + local_90 = *(undefined8 *)param_4; + uStack_88 = *(undefined8 *)(param_4 + 8); + local_80 = *(undefined8 *)(param_4 + 0x10); if (1 < param_3 - 1) { return -0x3fffff45; } - local_c0 = local_ec; - p_Var10 = (_CLFS_LOG_BLOCK_HEADER *)_CLFS_READ_BUFFER::GetAddress(param_4); - local_90 = p_Var10; - if ((p_Var10 == (_CLFS_LOG_BLOCK_HEADER *)0x0) || - (local_e0 = _CLFS_READ_BUFFER::GetAddress((_CLFS_READ_BUFFER *)&local_88), - local_e0 == (uchar *)0x0)) { - local_104 = -0x3fffff66; - iVar9 = -0x3fffff66; + local_d8 = local_104; + local_a0 = param_2; + local_98 = this; + p_Var11 = (_CLFS_LOG_BLOCK_HEADER *)_CLFS_READ_BUFFER::GetAddress(param_4); + local_c0 = p_Var11; + if ((p_Var11 == (_CLFS_LOG_BLOCK_HEADER *)0x0) || + (local_e8 = _CLFS_READ_BUFFER::GetAddress((_CLFS_READ_BUFFER *)&local_90), + local_e8 == (uchar *)0x0)) { + local_124 = -0x3fffff66; + iVar10 = -0x3fffff66; } else { - local_e8 = param_7 & 1; - local_bc = local_e8; - if (((local_e8 == 0) && (*(longlong *)(param_1 + 0x30) == 0)) && - (local_104 = (*(code *)**(undefined8 **)this)(this,param_1,this), local_104 < 0)) { - local_108 = '\0'; - iVar9 = local_104; + local_100 = param_7 & 1; + local_d4 = local_100; + if (((local_100 == 0) && (*(longlong *)(param_1 + 0x30) == 0)) && + (local_124 = (*(code *)**(undefined8 **)this)(this,param_1,this), local_124 < 0)) { + local_128 = '\0'; + iVar10 = local_124; } else { uVar3 = CClfsLogFcbCommon::IsMainLocked((CClfsLogFcbCommon *)this); if (uVar3 == '\0') { - local_108 = ExAcquireResourceSharedLite(this + 200,1); + local_128 = ExAcquireResourceSharedLite(this + 200,1); } cVar4 = (**(code **)(*(longlong *)this + 0x138))(this); if ((cVar4 == '\0') || ((param_7 & 8) == 0)) { if ((*(uint *)(this + 0x16c) >> 0xc & 1) == 0) { - puVar13 = (undefined8 *)(**(code **)(*(longlong *)this + 0x160))(this,&local_b0); - local_b0 = (_CLS_LSN *)*puVar13; + puVar14 = (undefined8 *)(**(code **)(*(longlong *)this + 0x160))(this,&local_c8); + local_c8 = (_CLS_LSN *)*puVar14; if (((param_2 == (_CLS_LSN *)0x0) || - (uVar5 = (uint)((ulonglong)local_b0 >> 0x20), uVar5 < *(uint *)(param_2 + 4))) || - ((*(uint *)(param_2 + 4) == uVar5 && ((uint)local_b0 <= *(uint *)param_2)))) { - local_b0 = (_CLS_LSN *)(this + 0x1e0); - local_98 = local_b0; - uVar3 = operator>=(param_2,local_b0); + (uVar6 = (uint)((ulonglong)local_c8 >> 0x20), uVar6 < *(uint *)(param_2 + 4))) || + ((*(uint *)(param_2 + 4) == uVar6 && ((uint)local_c8 <= *(uint *)param_2)))) { + local_c8 = (_CLS_LSN *)(this + 0x1e0); + local_a8 = local_c8; + uVar3 = operator>=(param_2,local_c8); if (uVar3 == '\0') { cVar4 = (**(code **)(*(longlong *)this + 0x138))(this); if (cVar4 != '\0') { - plVar11 = (longlong *)GetNextOwnerPageLsn(this,(_CLS_LSN *)&local_b8,(ulong)param_2) + plVar12 = (longlong *)GetNextOwnerPageLsn(this,(_CLS_LSN *)&local_d0,(ulong)param_2) ; - lVar18 = *plVar11; - local_d8 = lVar18; - uVar12 = Feature_950255931__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar12 != 0) && + lVar19 = *plVar12; + local_f8 = lVar19; + uVar13 = Feature_950255931__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar13 != 0) && (((param_2 == (_CLS_LSN *)0x0 || - (uVar5 = (uint)((ulonglong)lVar18 >> 0x20), uVar5 < *(uint *)(param_2 + 4))) || - ((uVar5 == *(uint *)(param_2 + 4) && ((uint)lVar18 <= *(uint *)param_2)))))) { - local_104 = -0x3ffffff3; - iVar9 = -0x3ffffff3; + (uVar6 = (uint)((ulonglong)lVar19 >> 0x20), uVar6 < *(uint *)(param_2 + 4))) || + ((uVar6 == *(uint *)(param_2 + 4) && ((uint)lVar19 <= *(uint *)param_2)))))) { + local_124 = -0x3ffffff3; + iVar10 = -0x3ffffff3; goto LAB_0; } } if (param_6 != (IClfsRequestAsync *)0x0) { - local_f4 = (**(code **)(*(longlong *)param_6 + 0x10))(param_6); + local_110 = (**(code **)(*(longlong *)param_6 + 0x10))(param_6); } *param_9 = 0; - uVar12 = *(ulonglong *)param_2; - local_f8 = param_5; - uVar16 = uVar12 & 0xffffffff; - uVar21 = param_5; - iVar9 = local_104; - while( true ) { - uVar3 = (uchar)in_stack_fffffffffffffed8; - local_d0 = uVar12; - if ((uVar21 <= *param_9) || (local_98 == (_CLS_LSN *)0x0)) break; - uVar5 = (uint)(uVar12 >> 0x20); - if ((*(uint *)(local_98 + 4) < uVar5) || - ((uVar5 == *(uint *)(local_98 + 4) && (*(uint *)local_98 <= (uint)uVar16)))) + uVar13 = *(ulonglong *)param_2; + local_114 = param_5; + uVar18 = uVar13 & 0xffffffff; + iVar10 = local_124; + uVar22 = param_5; + while ((local_f0 = uVar13, *param_9 < uVar22 && (local_a8 != (_CLS_LSN *)0x0))) { + uVar6 = (uint)(uVar13 >> 0x20); + if ((*(uint *)(local_a8 + 4) < uVar6) || + ((uVar6 == *(uint *)(local_a8 + 4) && (*(uint *)local_a8 <= (uint)uVar18)))) break; - local_f0 = uVar21 - *param_9; - uVar16 = (ulonglong)local_f0; + local_10c = uVar22 - *param_9; + uVar18 = (ulonglong)local_10c; cVar4 = (**(code **)(*(longlong *)this + 0x138))(this); if (cVar4 != '\0') { - puVar13 = (undefined8 *)AddLsnOffset(this,local_70,(ulong)&local_d0); - local_68 = *puVar13; - uVar5 = (uint)((ulonglong)local_68 >> 0x20); - if ((local_d8._4_4_ <= uVar5) && - ((uVar5 != local_d8._4_4_ || ((uint)lVar18 < (uint)local_68)))) { - local_f0 = ((uint)lVar18 & 0xfffffe00) - ((uint)uVar12 & 0xfffffe00); - uVar16 = (ulonglong)local_f0; - } - } - if ((int)(uVar16 % (ulonglong)local_ec) != 0) { - local_104 = -0x3ffffff3; - iVar9 = local_104; + puVar14 = (undefined8 *)AddLsnOffset(this,local_78,(ulong)&local_f0); + local_70 = *puVar14; + uVar6 = (uint)((ulonglong)local_70 >> 0x20); + if ((local_f8._4_4_ <= uVar6) && + ((uVar6 != local_f8._4_4_ || ((uint)lVar19 < (uint)local_70)))) { + local_10c = ((uint)lVar19 & 0xfffffe00) - ((uint)uVar13 & 0xfffffe00); + uVar18 = (ulonglong)local_10c; + } + } + if ((int)(uVar18 % (ulonglong)local_104) != 0) { + local_124 = -0x3ffffff3; + iVar10 = local_124; goto LAB_0; } bVar1 = false; bVar2 = false; if (((param_3 & 1) != 0) && (bVar2 = false, *param_9 == 0)) { - uVar16 = (ulonglong)local_ec; - local_f0 = local_ec; + uVar18 = (ulonglong)local_104; + local_10c = local_104; bVar1 = true; bVar2 = true; } - if (local_e8 == 0) { - _Var15 = LsnToCacheOffset(this,(_CLS_LSN *)&local_d0); - local_c8 = _Var15; - local_60 = LsnToCacheOffset(this,local_b0); - uVar21 = local_f8; - if ((-1 < (longlong)_Var15) && (-1 < (longlong)local_60)) { - if ((longlong)local_60 < (longlong)(uVar16 + _Var15)) { - uVar16 = local_60 - _Var15; - local_58 = uVar16; - if ((int)(uVar16 >> 0x20) != 0) goto LAB_1; - local_f0 = (uint)uVar16; - memset(local_e0 + (uVar16 & 0xffffffff),0, - (ulonglong)((local_f8 - local_f0) - *param_9)); - _Var15 = local_c8; + if (local_100 == 0) { + _Var16 = LsnToCacheOffset(this,(_CLS_LSN *)&local_f0); + local_e0 = _Var16; + local_68 = LsnToCacheOffset(this,local_c8); + uVar22 = local_114; + if ((-1 < (longlong)_Var16) && (-1 < (longlong)local_68)) { + if ((longlong)local_68 < (longlong)(uVar18 + _Var16)) { + uVar18 = local_68 - _Var16; + local_60 = uVar18; + if ((int)(uVar18 >> 0x20) != 0) goto LAB_1; + local_10c = (uint)uVar18; + memset(local_e8 + (uVar18 & 0xffffffff),0, + (ulonglong)((local_114 - local_10c) - *param_9)); + _Var16 = local_e0; } - local_b8 = 0; - if ((((-1 < (longlong)_Var15) && ((uint)uVar16 <= uVar21 - *param_9)) && - (lVar6 = RtlLongLongAdd(_Var15,uVar16 & 0xffffffff,&local_b8), -1 < lVar6)) - && (local_b8 <= *(longlong *)(this + 0x50))) { - in_stack_fffffffffffffed8 = local_e0; - cVar4 = CcCopyRead(param_1,&local_c8,uVar16 & 0xffffffff,1,local_e0,&local_a8) + local_d0 = 0; + if ((((-1 < (longlong)_Var16) && ((uint)uVar18 <= uVar22 - *param_9)) && + (lVar7 = RtlLongLongAdd(_Var16,uVar18 & 0xffffffff,&local_d0), -1 < lVar7)) + && (local_d0 <= *(longlong *)(this + 0x50))) { + cVar4 = CcCopyRead(param_1,&local_e0,uVar18 & 0xffffffff,1,local_e8,&local_b8) ; - uVar12 = local_a0; - uVar17 = local_fc; + uVar13 = local_b0; + uVar17 = local_118; bVar1 = bVar2; if (cVar4 != '\0') { - if ((int)local_a8 != 0) { + if ((int)local_b8 != 0) { /* WARNING: Subroutine does not return */ - KeBugCheckEx(0xc1f5,0x3e,(longlong)(int)local_a8,this,0); + KeBugCheckEx(0xc1f5,0x3e,(longlong)(int)local_b8,this,0); } - local_104 = 0; - uVar17 = (uint)local_a0; - local_fc = (uint)local_a0; - puVar13 = (undefined8 *)AddLsnOffset(this,local_50,(ulong)&local_d0); - *(undefined8 *)param_8 = *puVar13; - iVar9 = 0; + local_124 = 0; + uVar17 = (uint)local_b0; + local_118 = (uint)local_b0; + puVar14 = (undefined8 *)AddLsnOffset(this,local_58,(ulong)&local_f0); + *(undefined8 *)param_8 = *puVar14; + iVar10 = 0; if (param_6 != (IClfsRequestAsync *)0x0) { - (**(code **)(*(longlong *)param_6 + 0x58))(param_6,0,uVar12 & 0xffffffff); - iVar9 = 0; + (**(code **)(*(longlong *)param_6 + 0x58))(param_6,0,uVar13 & 0xffffffff); + iVar10 = 0; } } goto LAB_2; } } LAB_1: - local_104 = -0x3fe5fff3; - iVar9 = local_104; + local_124 = -0x3fe5fff3; + iVar10 = local_124; goto LAB_0; } - pIVar14 = param_6; + pIVar15 = param_6; if (bVar1) { - pIVar14 = (IClfsRequestAsync *)0x0; - } - in_stack_fffffffffffffed8 = (uchar *)0x3; - local_104 = ReadLog(this,(_CLS_LSN *)&local_d0,(_CLFS_READ_BUFFER *)&local_88, - (uint)uVar16 >> 9,3,pIVar14,param_8,&local_fc); - uVar17 = local_fc; - iVar9 = local_104; + pIVar15 = (IClfsRequestAsync *)0x0; + } + local_124 = ReadLog(this,(_CLS_LSN *)&local_f0,(_CLFS_READ_BUFFER *)&local_90, + (uint)uVar18 >> 9,3,pIVar15,param_8,&local_118); + uVar17 = local_118; + iVar10 = local_124; if ((bVar1) && (param_6 != (IClfsRequestAsync *)0x0)) { - (**(code **)(*(longlong *)param_6 + 0x58))(param_6,local_104,local_fc); + (**(code **)(*(longlong *)param_6 + 0x58))(param_6,local_124,local_118); } LAB_2: - uVar3 = (uchar)in_stack_fffffffffffffed8; - if ((iVar9 == -0x3fffffef) || (iVar9 == -0x3fe5ffed)) break; - if ((bVar1) && (iVar9 == 0)) { - uVar19 = *(ushort *)(local_e0 + 4); - puVar20 = local_e0; - uVar7 = RawSectorAlign(this,(uint)uVar19 << 9); - if ((*puVar20 != '\0') && - ((uVar19 != 0 && (param_5 = uVar21, local_f8 = uVar21, uVar7 < uVar21)))) { - uVar21 = uVar7; - param_5 = uVar7; - local_f8 = uVar7; + if ((iVar10 == -0x3fffffef) || (iVar10 == -0x3fe5ffed)) break; + if ((bVar1) && (iVar10 == 0)) { + uVar20 = *(ushort *)(local_e8 + 4); + puVar21 = local_e8; + uVar8 = RawSectorAlign(this,(uint)uVar20 << 9); + if (((*puVar21 != '\0') && (uVar20 != 0)) && + (param_5 = uVar22, local_114 = uVar22, uVar8 < uVar22)) { + param_5 = uVar8; + local_114 = uVar8; + uVar22 = uVar8; } } *param_9 = *param_9 + uVar17; - local_78 = CONCAT44(local_78._4_4_,(int)local_78 + uVar17); - local_e0 = local_e0 + uVar17; - if (iVar9 < 0) goto LAB_0; + local_80 = CONCAT44(local_80._4_4_,(int)local_80 + uVar17); + local_e8 = local_e8 + uVar17; + if (iVar10 < 0) goto LAB_0; cVar4 = (**(code **)(*(longlong *)this + 0x138))(this); - if ((cVar4 != '\0') && (*(longlong *)param_8 == lVar18)) { - puVar13 = (undefined8 *)AddLsnOffset(this,local_48,(ulong)param_8); - *(undefined8 *)param_8 = *puVar13; - plVar11 = (longlong *)AddLsnOffset(this,local_40,(ulong)&local_d8); - lVar18 = *plVar11; - local_d8 = lVar18; - } - uVar12 = *(ulonglong *)param_8; - uVar16 = uVar12; - } - if (local_108 != '\0') { + if ((cVar4 != '\0') && (*(longlong *)param_8 == lVar19)) { + puVar14 = (undefined8 *)AddLsnOffset(this,local_50,(ulong)param_8); + *(undefined8 *)param_8 = *puVar14; + plVar12 = (longlong *)AddLsnOffset(this,local_48,(ulong)&local_f8); + lVar19 = *plVar12; + local_f8 = lVar19; + } + uVar13 = *(ulonglong *)param_8; + uVar18 = uVar13; + } + if (local_128 != '\0') { ExReleaseResourceForThreadLite(this + 200,SystemReserved1[0xf]); - local_108 = '\0'; - uVar21 = param_5; - iVar9 = local_104; - } - p_Var10 = local_90; - if (((param_6 == (IClfsRequestAsync *)0x0) && (-1 < iVar9)) && - (local_104 = ValidateLogBlock(this,param_2,local_90,uVar21,uVar3,'\x04',&local_e4), - iVar9 = local_104, -1 < local_104)) { - local_104 = ClfsDecodeBlock(p_Var10,(uint)*(ushort *)(p_Var10 + 4),(uchar)p_Var10[2] - ,'\x04',&local_e4); - iVar9 = local_104; + local_128 = '\0'; + uVar22 = param_5; + iVar10 = local_124; + } + local_120 = (_CLFS_LOG_BLOCK_HEADER)0x0; + if ((param_6 == (IClfsRequestAsync *)0x0) && (-1 < iVar10)) { + uVar13 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + p_Var11 = local_c0; + if ((int)uVar13 == 0) { + _Var5 = local_c0[2]; + } + else { + local_11c = *(ushort *)(local_c0 + 4); + _Var5 = local_c0[2]; + local_120 = _Var5; + } + local_124 = ValidateLogBlock(local_98,local_a0,local_c0,uVar22,(uchar)_Var5,'\x04', + &local_108); + iVar10 = local_124; + if (-1 < local_124) { + uVar13 = Feature_344697147__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar13 == 0) { + uVar17 = (ulong)*(ushort *)(p_Var11 + 4); + local_120 = p_Var11[2]; + } + else { + uVar17 = (ulong)local_11c; + if (uVar22 < uVar17 << 9) { + local_124 = -0x3fe5fffc; + iVar10 = -0x3fe5fffc; + goto LAB_0; + } + } + local_124 = ClfsDecodeBlock(p_Var11,uVar17,(uchar)local_120,'\x04',&local_108); + iVar10 = local_124; + } } } else { if ((param_7 & 0x10) == 0) { - ClfsCheckAndResetReadInProgress((longlong)p_Var10,param_5); - } - local_104 = -0x3fffffef; - iVar9 = -0x3fffffef; + ClfsCheckAndResetReadInProgress((longlong)p_Var11,param_5); + } + local_124 = -0x3fffffef; + iVar10 = -0x3fffffef; } } else { if ((param_7 & 0x10) == 0) { - ClfsCheckAndResetReadInProgress((longlong)p_Var10,param_5); + ClfsCheckAndResetReadInProgress((longlong)p_Var11,param_5); } - local_104 = -0x3fe5ffed; - iVar9 = -0x3fe5ffed; + local_124 = -0x3fe5ffed; + iVar10 = -0x3fe5ffed; } } else { - local_104 = -0x3fe5ffd5; + local_124 = -0x3fe5ffd5; CClfsLogFcbCommon::SetInvalidLogTag((CClfsLogFcbCommon *)this,0xf,-0x3fe5ffd5); - iVar9 = -0x3fe5ffd5; + iVar10 = -0x3fe5ffd5; } } else { - local_104 = -0x3fe5ffe2; - iVar9 = -0x3fe5ffe2; + local_124 = -0x3fe5ffe2; + iVar10 = -0x3fe5ffe2; } } } LAB_0: - if (local_108 != '\0') { + if (local_128 != '\0') { ExReleaseResourceForThreadLite(this + 200,SystemReserved1[0xf]); - iVar9 = local_104; - } - if ((iVar9 < 0) && (*param_9 = 0, param_6 != (IClfsRequestAsync *)0x0)) { - (**(code **)(*(longlong *)param_6 + 0x58))(param_6,iVar9,0); - } - if (((local_f4 != 0) && (iVar8 = (**(code **)(*(longlong *)param_6 + 0x18))(param_6), iVar8 != 0)) - && (-1 < iVar9)) { - iVar9 = 0x103; - } - return iVar9; + iVar10 = local_124; + } + if ((iVar10 < 0) && (*param_9 = 0, param_6 != (IClfsRequestAsync *)0x0)) { + (**(code **)(*(longlong *)param_6 + 0x58))(param_6,iVar10,0); + } + if (((local_110 != 0) && (iVar9 = (**(code **)(*(longlong *)param_6 + 0x18))(param_6), iVar9 != 0) + ) && (-1 < iVar10)) { + iVar10 = 0x103; + } + return iVar10; } ``` ## CClfsLogFcbPhysical::IsEof ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.1| |i_ratio|0.2| |m_ratio|0.75| |b_ratio|0.38| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|IsEof|IsEof| |fullname|CClfsLogFcbPhysical::IsEof|CClfsLogFcbPhysical::IsEof| |refcount|8|8| |`length`|1146|715| |`called`|CClfsBaseFile::GetUsn
CClfsLogFcbPhysical::ValidateContainerSize
ClfsValidateBlock
_guard_dispatch_icall|CClfsBaseFile::GetUsn
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateLogBlock
_guard_dispatch_icall| |calling|CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateRegionBlocks|CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateRegionBlocks| |paramcount|7|7| |`address`|1400671dc|1400677bc| |sig|uchar __thiscall IsEof(CClfsLogFcbPhysical * this, _CLFS_LOG_BLOCK_HEADER * param_1, uchar * param_2, _CLS_LSN * param_3, _CLS_LSN * param_4, _CLS_LSN * param_5, ulong * param_6)|uchar __thiscall IsEof(CClfsLogFcbPhysical * this, _CLFS_LOG_BLOCK_HEADER * param_1, uchar * param_2, _CLS_LSN * param_3, _CLS_LSN * param_4, _CLS_LSN * param_5, ulong * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsLogFcbPhysical::IsEof Called Diff ```diff --- CClfsLogFcbPhysical::IsEof called +++ CClfsLogFcbPhysical::IsEof called @@ -3 +3 @@ -ClfsValidateBlock +CClfsLogFcbPhysical::ValidateLogBlock ``` ### CClfsLogFcbPhysical::IsEof Diff ```diff --- CClfsLogFcbPhysical::IsEof +++ CClfsLogFcbPhysical::IsEof @@ -1,199 +1,99 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* private: unsigned char __cdecl CClfsLogFcbPhysical::IsEof(struct _CLFS_LOG_BLOCK_HEADER * __ptr64 const,unsigned char & __ptr64,union _CLS_LSN & __ptr64,union _CLS_LSN & __ptr64,union _CLS_LSN & __ptr64,unsigned long & __ptr64) __ptr64 */ uchar __thiscall CClfsLogFcbPhysical::IsEof (CClfsLogFcbPhysical *this,_CLFS_LOG_BLOCK_HEADER *param_1,uchar *param_2, _CLS_LSN *param_3,_CLS_LSN *param_4,_CLS_LSN *param_5,ulong *param_6) { - _CLFS_LOG_BLOCK_HEADER *p_Var1; - CClfsLogFcbPhysical *pCVar2; + _CLS_LSN *p_Var1; + _CLFS_LOG_BLOCK_HEADER _Var2; _CLFS_LOG_BLOCK_HEADER _Var3; - _CLFS_LOG_BLOCK_HEADER _Var4; - ushort uVar5; - ushort uVar6; - longlong lVar7; + ushort uVar4; + longlong lVar5; + undefined1 auVar6 [16]; + undefined1 auVar7 [16]; undefined1 auVar8 [16]; - undefined1 auVar9 [16]; - undefined1 auVar10 [16]; - undefined1 auVar11 [16]; - undefined1 auVar12 [16]; - undefined1 auVar13 [16]; - _CLFS_LOG_BLOCK_HEADER _Var14; - uchar uVar15; - char cVar16; - uint uVar17; - long lVar18; - undefined8 uVar19; - ulonglong uVar20; - uint uVar21; - int iVar22; - ulonglong uVar23; - uint uVar24; - undefined8 local_res8; - uint uStackX_14; + uchar uVar9; + _CLFS_LOG_BLOCK_HEADER _Var10; + char cVar11; + long lVar12; + undefined8 uVar13; + ulonglong uVar14; + int iVar15; + uint uVar16; CClfsBaseFile::GetUsn(*(CClfsBaseFile **)(this + 0x2c8)); if ((param_3 != (_CLS_LSN *)0x0) && (*(longlong *)param_3 == 0)) { *param_2 = (uchar)param_1[2]; } *param_6 = 0; - if ((char)param_1[0x1fe] < '\0') { - return '\x01'; - } - if (param_1[0x1ff] != param_1[2]) { - return '\x01'; - } - if (((byte)param_1[0x1fe] & 0x40) == 0) { - return '\x01'; - } - local_res8 = 0xffffffff00000000; - if ((param_5 != (_CLS_LSN *)0x0) && (*(int *)(param_5 + 4) != -1)) { - local_res8 = *(ulonglong *)param_5 & 0xfffffffffffffe00; - } - if (((param_1 + 0x18 != (_CLFS_LOG_BLOCK_HEADER *)0x0) && - (uVar24 = (uint)(local_res8 >> 0x20), *(uint *)(param_1 + 0x1c) <= uVar24)) && - ((*(uint *)(param_1 + 0x1c) != uVar24 || (*(uint *)(param_1 + 0x18) < (uint)local_res8)))) { - if (param_5 == (_CLS_LSN *)0x0) { - return '\x01'; + if (((-1 < (char)param_1[0x1fe]) && (param_1[0x1ff] == param_1[2])) && + (((byte)param_1[0x1fe] & 0x40) != 0)) { + uVar14 = 0xffffffff00000000; + if ((param_5 != (_CLS_LSN *)0x0) && (*(int *)(param_5 + 4) != -1)) { + uVar14 = *(ulonglong *)param_5 & 0xfffffffffffffe00; } - if (*(longlong *)param_5 != -0x100000000) { - return '\x01'; + p_Var1 = (_CLS_LSN *)(param_1 + 0x18); + if ((((p_Var1 == (_CLS_LSN *)0x0) || + (uVar16 = (uint)(uVar14 >> 0x20), uVar16 < *(uint *)(param_1 + 0x1c))) || + ((*(uint *)(param_1 + 0x1c) == uVar16 && ((uint)uVar14 <= *(uint *)p_Var1)))) || + ((param_5 != (_CLS_LSN *)0x0 && (*(longlong *)param_5 == -0x100000000)))) { + _Var2 = (_CLFS_LOG_BLOCK_HEADER)*param_2; + _Var10 = (_CLFS_LOG_BLOCK_HEADER)CClfsBaseFile::GetUsn(*(CClfsBaseFile **)(this + 0x2c8)); + *param_2 = (uchar)_Var2; + _Var3 = param_1[2]; + if ((((byte)_Var3 <= (byte)_Var10) || (_Var10 == (_CLFS_LOG_BLOCK_HEADER)0x0)) && + (((uint)(byte)_Var10 <= (byte)_Var3 + 1 && + (((((byte)_Var2 <= (byte)_Var3 || (_Var2 == (_CLFS_LOG_BLOCK_HEADER)0xff)) || + (_Var3 == (_CLFS_LOG_BLOCK_HEADER)0x0)) && ((byte)((char)_Var3 - (char)_Var2) < 2)))))) + { + *param_2 = (uchar)_Var3; + lVar12 = ValidateLogBlock(this,p_Var1,param_1,(uint)*(ushort *)(param_1 + 4) << 9, + (uchar)param_1[2],'\0',param_6); + if ((-1 < lVar12) && + ((cVar11 = (**(code **)(*(longlong *)this + 0x138))(this), cVar11 != '\0' || + ((*(uint *)(param_1 + 0x10) & 8) == 0)))) { + cVar11 = (**(code **)(*(longlong *)this + 0x138))(this); + if ((cVar11 == '\0') || + (uVar4 = *(ushort *)(param_1 + 6), uVar4 <= *(ushort *)(param_1 + 4))) { + uVar4 = *(ushort *)(param_1 + 4); + } + lVar5 = *(longlong *)(param_1 + 0x18); + *(longlong *)param_3 = lVar5; + uVar13 = 0xffffffff00000000; + if (lVar5 != -0x100000000) { + uVar9 = ValidateContainerSize(this); + if (uVar9 != '\0') { + auVar6._8_8_ = 0; + auVar6._0_8_ = *(ulonglong *)(this + 0x2b8); + auVar7._8_8_ = 0; + auVar7._0_8_ = (ulonglong)*(uint *)(param_3 + 4) * *(ulonglong *)(this + 0x2b8) + + (ulonglong)uVar4 * 0x200 + (ulonglong)(*(uint *)param_3 & 0xfffffe00); + auVar8 = auVar7 % auVar6; + if (SUB164(auVar7 / auVar6,4) == 0) { + uVar13 = 0xffffffff00000000; + if (((auVar8._4_4_ == 0) && (iVar15 = SUB164(auVar7 / auVar6,0), iVar15 != -1)) && + ((auVar8._0_8_ & 0x1ff) == 0)) { + uVar13 = CONCAT44(iVar15,auVar8._0_4_); + } + goto LAB_0; + } + } + uVar13 = 0xffffffff00000000; + } +LAB_0: + *(undefined8 *)param_4 = uVar13; + *(undefined8 *)param_5 = uVar13; + return '\0'; + } + } } } - _Var3 = (_CLFS_LOG_BLOCK_HEADER)*param_2; - _Var14 = (_CLFS_LOG_BLOCK_HEADER)CClfsBaseFile::GetUsn(*(CClfsBaseFile **)(this + 0x2c8)); - *param_2 = (uchar)_Var3; - _Var4 = param_1[2]; - if (((byte)_Var14 < (byte)_Var4) && (_Var14 != (_CLFS_LOG_BLOCK_HEADER)0x0)) { - return '\x01'; - } - if ((byte)_Var4 + 1 < (uint)(byte)_Var14) { - return '\x01'; - } - if ((((byte)_Var4 < (byte)_Var3) && (_Var3 != (_CLFS_LOG_BLOCK_HEADER)0xff)) && - (_Var4 != (_CLFS_LOG_BLOCK_HEADER)0x0)) { - return '\x01'; - } - if (1 < (byte)((char)_Var4 - (char)_Var3)) { - return '\x01'; - } - *param_2 = (uchar)_Var4; - uVar5 = *(ushort *)(param_1 + 4); - if ((this + 0x1e8 == (CClfsLogFcbPhysical *)0x0) || (*(longlong *)(this + 0x1e8) != -0x100000000)) - { - ValidateContainerSize(this); - } - uVar6 = *(ushort *)(param_1 + 4); - lVar7 = *(longlong *)(this + 0x50); - if (SUB168(ZEXT816(0x200) * ZEXT216(uVar6),8) != 0) { - return '\x01'; - } - p_Var1 = param_1 + 0x18; - if (((p_Var1 == (_CLFS_LOG_BLOCK_HEADER *)0x0) || (*(longlong *)p_Var1 != -0x100000000)) && - (uVar15 = ValidateContainerSize(this), uVar15 != '\0')) { - if (p_Var1 == (_CLFS_LOG_BLOCK_HEADER *)0x0) { - uVar20 = 0xffffffff; - uVar23 = 0xffffffff; - } - else { - uVar20 = (ulonglong)*(uint *)(param_1 + 0x1c); - uVar23 = (ulonglong)(*(uint *)p_Var1 & 0xfffffe00); - } - auVar8._8_8_ = 0; - auVar8._0_8_ = *(ulonglong *)(this + 0x2b8); - auVar10._8_8_ = 0; - auVar10._0_8_ = - uVar20 * *(ulonglong *)(this + 0x2b8) + SUB168(ZEXT816(0x200) * ZEXT216(uVar6),0) + uVar23; - auVar13 = auVar10 % auVar8; - if (SUB164(auVar10 / auVar8,4) != 0) goto LAB_0; - if (auVar13._4_4_ != 0) goto LAB_0; - uVar17 = SUB164(auVar10 / auVar8,0); - uStackX_14 = 0xffffffff; - uVar24 = 0; - if ((uVar17 != 0xffffffff) && ((auVar13._0_8_ & 0x1ff) == 0)) { - uStackX_14 = uVar17; - uVar24 = auVar13._0_4_; - } - } - else { -LAB_0: - uStackX_14 = 0xffffffff; - uVar24 = 0; - } - pCVar2 = this + 0x1e8; - if (((pCVar2 == (CClfsLogFcbPhysical *)0x0) || (*(longlong *)pCVar2 != -0x100000000)) && - (uVar15 = ValidateContainerSize(this), uVar15 != '\0')) { - if (pCVar2 == (CClfsLogFcbPhysical *)0x0) { - uVar20 = 0xffffffff; - uVar23 = 0xffffffff; - } - else { - uVar20 = (ulonglong)*(uint *)(this + 0x1ec); - uVar23 = (ulonglong)(*(uint *)pCVar2 & 0xfffffe00); - } - auVar13._8_8_ = 0; - auVar13._0_8_ = *(ulonglong *)(this + 0x2b8); - auVar11._8_8_ = 0; - auVar11._0_8_ = uVar20 * *(ulonglong *)(this + 0x2b8) + lVar7 + uVar23; - auVar8 = auVar11 % auVar13; - if (SUB164(auVar11 / auVar13,4) != 0) goto LAB_1; - if (auVar8._4_4_ != 0) goto LAB_1; - uVar21 = SUB164(auVar11 / auVar13,0); - local_res8._4_4_ = 0xffffffff; - uVar17 = 0; - if ((uVar21 != 0xffffffff) && ((auVar8._0_8_ & 0x1ff) == 0)) { - local_res8._4_4_ = uVar21; - uVar17 = auVar8._0_4_; - } - } - else { -LAB_1: - local_res8._4_4_ = 0xffffffff; - uVar17 = 0; - } - if ((((local_res8._4_4_ <= uStackX_14) && ((local_res8._4_4_ != uStackX_14 || (uVar17 < uVar24)))) - || (lVar18 = ClfsValidateBlock((_CLS_LSN *)(param_1 + 0x18),param_1,(uint)uVar5 << 9, - (uchar)param_1[2],'\0',param_6), lVar18 < 0)) || - ((cVar16 = (**(code **)(*(longlong *)this + 0x138))(this), cVar16 == '\0' && - ((*(uint *)(param_1 + 0x10) & 8) != 0)))) { - return '\x01'; - } - cVar16 = (**(code **)(*(longlong *)this + 0x138))(this); - if ((cVar16 == '\0') || (uVar5 = *(ushort *)(param_1 + 6), uVar5 <= *(ushort *)(param_1 + 4))) { - uVar5 = *(ushort *)(param_1 + 4); - } - lVar7 = *(longlong *)(param_1 + 0x18); - *(longlong *)param_3 = lVar7; - uVar19 = 0xffffffff00000000; - if (lVar7 != -0x100000000) { - uVar15 = ValidateContainerSize(this); - if (uVar15 != '\0') { - auVar9._8_8_ = 0; - auVar9._0_8_ = *(ulonglong *)(this + 0x2b8); - auVar12._8_8_ = 0; - auVar12._0_8_ = - (ulonglong)*(uint *)(param_3 + 4) * *(ulonglong *)(this + 0x2b8) + - (ulonglong)uVar5 * 0x200 + (ulonglong)(*(uint *)param_3 & 0xfffffe00); - auVar8 = auVar12 % auVar9; - if (SUB164(auVar12 / auVar9,4) == 0) { - uVar19 = 0xffffffff00000000; - if (((auVar8._4_4_ == 0) && (iVar22 = SUB164(auVar12 / auVar9,0), iVar22 != -1)) && - ((auVar8._0_8_ & 0x1ff) == 0)) { - uVar19 = CONCAT44(iVar22,auVar8._0_4_); - } - goto LAB_2; - } - } - uVar19 = 0xffffffff00000000; - } -LAB_2: - *(undefined8 *)param_4 = uVar19; - *(undefined8 *)param_5 = uVar19; - return '\0'; + return '\x01'; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## ClfsLsnBlockOffset ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|ClfsLsnBlockOffset|ClfsLsnBlockOffset| |fullname|ClfsLsnBlockOffset|ClfsLsnBlockOffset| |`refcount`|45|44| |length|19|19| |called||| |`calling`|

Expand for full list:
CClfsFlushElt::GetContainerOffset
CClfsKernelMarshallingContext::AdvanceLogBase
CClfsKernelMarshallingContext::ReadLogRecord
CClfsKernelMarshallingContext::ReadMarshalledLogRecord
CClfsKernelMarshallingContext::ReadNextLogRecord
CClfsLogFcbPhysical::AdvanceLogBase
CClfsLogFcbPhysical::AppendLog
CClfsLogFcbPhysical::CalculateAvailableFreeSpace
CClfsLogFcbPhysical::CompleteAsyncReadBlock
CClfsLogFcbPhysical::CompleteAsyncWriteRestart
CClfsLogFcbPhysical::CompleteFlush

CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MapPhysicalBlockOffset
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::ReadLog
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::ReadOneRawSectorSync
CClfsLogFcbPhysical::SetArchiveTail
CClfsLogFcbPhysical::SetCacheFileSizes
CClfsLogFcbPhysical::SubtractLsnOffset
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::VirtualToPhysicalLsn
CClfsLogFcbPhysical::WrapContainers
CClfsLogFcbPhysical::WriteOneRawSectorSync
CClfsLogFcbPhysical::WriteRestart
CClfsLogFcbVirtual::CompleteAsyncWriteRestart
CClfsLogFcbVirtual::ReserveAndAppendLog

Expand for full list:
CClfsFlushElt::GetContainerOffset
CClfsKernelMarshallingContext::AdvanceLogBase
CClfsKernelMarshallingContext::ReadLogRecord
CClfsKernelMarshallingContext::ReadMarshalledLogRecord
CClfsKernelMarshallingContext::ReadNextLogRecord
CClfsLogFcbPhysical::AdvanceLogBase
CClfsLogFcbPhysical::AppendLog
CClfsLogFcbPhysical::CalculateAvailableFreeSpace
CClfsLogFcbPhysical::CompleteAsyncWriteRestart
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::GetArchiveDescriptors

CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MapPhysicalBlockOffset
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::ReadLog
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::ReadOneRawSectorSync
CClfsLogFcbPhysical::SetArchiveTail
CClfsLogFcbPhysical::SetCacheFileSizes
CClfsLogFcbPhysical::SubtractLsnOffset
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::VirtualToPhysicalLsn
CClfsLogFcbPhysical::WrapContainers
CClfsLogFcbPhysical::WriteOneRawSectorSync
CClfsLogFcbPhysical::WriteRestart
CClfsLogFcbVirtual::CompleteAsyncWriteRestart
CClfsLogFcbVirtual::ReserveAndAppendLog

| |paramcount|1|1| |address|140007120|140007120| |sig|uint __fastcall ClfsLsnBlockOffset(uint * param_1)|uint __fastcall ClfsLsnBlockOffset(uint * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### ClfsLsnBlockOffset Calling Diff ```diff --- ClfsLsnBlockOffset calling +++ ClfsLsnBlockOffset calling @@ -9 +8,0 @@ -CClfsLogFcbPhysical::CompleteAsyncReadBlock ``` ## ValidateContainerSize ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.8| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|ValidateContainerSize|ValidateContainerSize| |fullname|CClfsLogFcbPhysical::ValidateContainerSize|CClfsLogFcbPhysical::ValidateContainerSize| |`refcount`|17|8| |length|312|312| |called|NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_sdiSi
WPP_SF_sdii
memmove
memset|NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_sdiSi
WPP_SF_sdii
memmove
memset| |`calling`|CClfsLogFcbPhysical::CompleteAsyncReadBlock
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::IsEof
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::ValidateLogBlock|CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::IsEof
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::ReadLogPagingIo| |paramcount|1|1| |`address`|1400689c0|1400687b0| |sig|uchar __thiscall ValidateContainerSize(CClfsLogFcbPhysical * this)|uchar __thiscall ValidateContainerSize(CClfsLogFcbPhysical * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ValidateContainerSize Calling Diff ```diff --- CClfsLogFcbPhysical::ValidateContainerSize calling +++ CClfsLogFcbPhysical::ValidateContainerSize calling @@ -1 +0,0 @@ -CClfsLogFcbPhysical::CompleteAsyncReadBlock @@ -6 +4,0 @@ -CClfsLogFcbPhysical::ValidateLogBlock ``` ## ClfsValidateSector ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|ClfsValidateSector|ClfsValidateSector| |fullname|ClfsValidateSector|ClfsValidateSector| |`refcount`|5|15| |length|98|98| |called||| |`calling`|CClfsLogFcbPhysical::CacheBlock
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateRegionBlocks|CClfsLogFcbPhysical::CacheBlock
CClfsLogFcbPhysical::CompleteAsyncReadBlock
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateRegionBlocks
ClfsValidateBlock| |paramcount|3|3| |address|140008b40|140008b40| |sig|long __cdecl ClfsValidateSector(uchar * param_1, uchar param_2, uchar param_3)|long __cdecl ClfsValidateSector(uchar * param_1, uchar param_2, uchar param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClfsValidateSector Calling Diff ```diff --- ClfsValidateSector calling +++ ClfsValidateSector calling @@ -1,0 +2 @@ +CClfsLogFcbPhysical::CompleteAsyncReadBlock @@ -4,0 +6 @@ +ClfsValidateBlock ``` ## ClfsDecodeBlock ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.99| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|ClfsDecodeBlock|ClfsDecodeBlock| |fullname|ClfsDecodeBlock|ClfsDecodeBlock| |`refcount`|15|16| |length|531|531| |called||| |`calling`|CClfsBaseFilePersisted::WriteMetadataBlock
CClfsBaseFileSnapshot::CopyImage
CClfsKernelMarshallingContext::ReadMarshalledLogRecord
CClfsLogFcbPhysical::AppendRegion
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadRawOwnerPage
CClfsLogFcbPhysical::ReserveAndAppendLog
`CClfsBaseFilePersisted::WriteMetadataBlock'::__l1::fin$0
`CClfsBaseFileSnapshot::CopyImage'::__l1::fin$0
`CClfsLogFcbPhysical::AppendRegion'::__l1::fin$0|

Expand for full list:
CClfsBaseFilePersisted::WriteMetadataBlock
CClfsBaseFileSnapshot::CopyImage
CClfsKernelMarshallingContext::ReadMarshalledLogRecord
CClfsLogFcbPhysical::AppendRegion
CClfsLogFcbPhysical::CompleteAsyncReadBlock
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadRawOwnerPage
CClfsLogFcbPhysical::ReserveAndAppendLog
`CClfsBaseFilePersisted::WriteMetadataBlock'::__l1::fin$0
`CClfsBaseFileSnapshot::CopyImage'::__l1::fin$0
`CClfsLogFcbPhysical::AppendRegion'::__l1::fin$0

Expand for full list:
Feature_1403240762__private_IsEnabledFallback
Feature_3236415803__private_IsEnabledFallback
Feature_326875449__private_IsEnabledFallback
Feature_3650604346__private_IsEnabledFallback
Feature_950255931__private_IsEnabledFallback
Feature_CLFS_EventLog__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallback
Feature_ClfsContainerMemberInitFixes__private_IsEnabledFallback
Feature_ClfsFixCpfHeaderLeak__private_IsEnabledFallback
Feature_ClfsHashNodeReturnCode__private_IsEnabledFallback
Feature_Servicing_CLFSFuzzerBugInvalidContainerID__private_IsEnabledFallback

Feature_Servicing_CLFS_AuthenticationExemptions__private_IsEnabledFallback
Feature_Servicing_MSRC97927__private_IsEnabledFallback

Expand for full list:
Feature_1403240762__private_IsEnabledFallback
Feature_3236415803__private_IsEnabledFallback
Feature_326875449__private_IsEnabledFallback
Feature_344697147__private_IsEnabledFallback
Feature_3650604346__private_IsEnabledFallback
Feature_950255931__private_IsEnabledFallback
Feature_CLFS_EventLog__private_IsEnabledFallback
Feature_CLFS_Signing__private_IsEnabledFallback
Feature_ClfsContainerMemberInitFixes__private_IsEnabledFallback
Feature_ClfsFixCpfHeaderLeak__private_IsEnabledFallback
Feature_ClfsHashNodeReturnCode__private_IsEnabledFallback

Feature_Servicing_CLFSFuzzerBugInvalidContainerID__private_IsEnabledFallback
Feature_Servicing_CLFS_AuthenticationExemptions__private_IsEnabledFallback
Feature_Servicing_MSRC97927__private_IsEnabledFallback

| |paramcount|3|3| |`address`|1400111a4|140011054| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -3,0 +4 @@ +Feature_344697147__private_IsEnabledFallback ``` ## ClfsDecodeBlockPrivate ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|ClfsDecodeBlockPrivate|ClfsDecodeBlockPrivate| |fullname|ClfsDecodeBlockPrivate|ClfsDecodeBlockPrivate| |`refcount`|5|4| |length|414|414| |called||| |`calling`|CClfsBaseFilePersisted::ReadMetadataBlock
CClfsLogFcbPhysical::CompleteAsyncReadBlock|CClfsBaseFilePersisted::ReadMetadataBlock| |paramcount|5|5| |address|140007a70|140007a70| |sig|long __cdecl ClfsDecodeBlockPrivate(_CLFS_LOG_BLOCK_HEADER * param_1, ulong param_2, uchar param_3, uchar param_4, ulong * param_5)|long __cdecl ClfsDecodeBlockPrivate(_CLFS_LOG_BLOCK_HEADER * param_1, ulong param_2, uchar param_3, uchar param_4, ulong * param_5)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClfsDecodeBlockPrivate Calling Diff ```diff --- ClfsDecodeBlockPrivate calling +++ ClfsDecodeBlockPrivate calling @@ -2 +1,0 @@ -CClfsLogFcbPhysical::CompleteAsyncReadBlock ``` ## AddLsnOffset ### Match Info |Key|clfs-2026-07.sys - clfs-2026-08.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.8| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-2026-07.sys|clfs-2026-08.sys| | :---: | :---: | :---: | |name|AddLsnOffset|AddLsnOffset| |fullname|CClfsLogFcbPhysical::AddLsnOffset|CClfsLogFcbPhysical::AddLsnOffset| |`refcount`|11|20| |length|455|455| |called|NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_sdiSi
WPP_SF_sdii
memmove
memset|NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
WPP_SF_sdiSi
WPP_SF_sdii
memmove
memset| |`calling`|CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateRegionBlocks|CClfsLogFcbPhysical::CompleteAsyncReadBlock
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateLogBlock
CClfsLogFcbPhysical::ValidateRegionBlocks| |paramcount|3|3| |`address`|14006a310|140069b30| |sig|_CLS_LSN __thiscall AddLsnOffset(CClfsLogFcbPhysical * this, _CLS_LSN * param_1, __uint64 * param_2)|_CLS_LSN __thiscall AddLsnOffset(CClfsLogFcbPhysical * this, _CLS_LSN * param_1, __uint64 * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### AddLsnOffset Calling Diff ```diff --- CClfsLogFcbPhysical::AddLsnOffset calling +++ CClfsLogFcbPhysical::AddLsnOffset calling @@ -0,0 +1 @@ +CClfsLogFcbPhysical::CompleteAsyncReadBlock @@ -2,0 +4 @@ +CClfsLogFcbPhysical::ValidateLogBlock ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-15T17:27:56}