# clfs.sys KB5005033 vs KB5005565 (CVE-2021-36955)
# TOC
* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
* [Ghidra Diff Engine](#ghidra-diff-engine)
* [Command Line](#command-line)
* [Binary Metadata Diff](#binary-metadata-diff)
* [Program Options](#program-options)
* [Diff Stats](#diff-stats)
* [Strings](#strings)
* [Deleted](#deleted)
* [Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled](#feature_servicing_2103c_clfsstatusprivilegenotheld_31093721__private_isenabled)
* [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache)
* [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache)
* [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache)
* [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice)
* [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect)
* [wil_details_FeatureStateCache_GetCachedFeatureEnabledState](#wil_details_featurestatecache_getcachedfeatureenabledstate)
* [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate)
* [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate)
* [wil_details_MapReportingKind](#wil_details_mapreportingkind)
* [wil_details_StagingConfigFeature_HasUniqueState](#wil_details_stagingconfigfeature_hasuniquestate)
* [wil_details_StagingConfig_Load](#wil_details_stagingconfig_load)
* [wil_details_StagingConfig_QueryFeatureState](#wil_details_stagingconfig_queryfeaturestate)
* [wil_RtlStagingConfig_QueryFeatureState](#wil_rtlstagingconfig_queryfeaturestate)
* [wil_StagingConfig_QueryFeatureState](#wil_stagingconfig_queryfeaturestate)
* [NTOSKRNL.EXE::ZwQueryWnfStateData](#ntoskrnlexezwquerywnfstatedata)
* [NTOSKRNL.EXE::RtlNotifyFeatureUsage](#ntoskrnlexertlnotifyfeatureusage)
* [Added](#added)
* [RtlULongAdd](#rtlulongadd)
* [RtlULongMult](#rtlulongmult)
* [Modified](#modified)
* [CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor](#cclfsbasefilepersistedextendmetadatablockdescriptor)
* [CClfsLogFcbVirtual::Open](#cclfslogfcbvirtualopen)
* [CClfsBaseFilePersisted::CreateContainer](#cclfsbasefilepersistedcreatecontainer)
* [CClfsContainer::Create](#cclfscontainercreate)
* [CClfsBaseFile::GetSymbol](#cclfsbasefilegetsymbol)
* [ClfsCreateLogFile](#clfscreatelogfile)
* [CClfsBaseFile::GetSymbol](#cclfsbasefilegetsymbol)
* [ClfsCreateLogFile$fin$0](#clfscreatelogfilefin0)
* [Modified (No Code Changes)](#modified-no-code-changes)
* [__GSHandlerCheck](#__gshandlercheck)
* [NTOSKRNL.EXE::RtlQueryFeatureConfiguration](#ntoskrnlexertlqueryfeatureconfiguration)
* [__security_check_cookie](#__security_check_cookie)
* [memset](#memset)
* [NTOSKRNL.EXE::ExAllocatePoolWithTag](#ntoskrnlexeexallocatepoolwithtag)
* [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag)
# Visual Chart Diff
```mermaid
flowchart LR
CClfsBaseFilePersistedExtendMetadataBlockDescriptor-3-old<--Match 79%-->CClfsBaseFilePersistedExtendMetadataBlockDescriptor-3-new
CClfsLogFcbVirtualOpen-11-old<--Match 97%-->CClfsLogFcbVirtualOpen-11-new
CClfsBaseFilePersistedCreateContainer-7-old<--Match 99%-->CClfsBaseFilePersistedCreateContainer-7-new
CClfsContainerCreate-7-old<--Match 84%-->CClfsContainerCreate-7-new
CClfsBaseFileGetSymbol-4-old<--Match 52%-->CClfsBaseFileGetSymbol-4-new
ClfsCreateLogFile-11-old<--Match 89%-->ClfsCreateLogFile-11-new
CClfsBaseFileGetSymbol-4-old<--Match 68%-->CClfsBaseFileGetSymbol-4-new
ClfsCreateLogFilefin0-2-old<--Match 93%-->ClfsCreateLogFilefin0-2-new
subgraph clfs-10.0.19041.1237.sys
CClfsBaseFilePersistedExtendMetadataBlockDescriptor-3-new
CClfsLogFcbVirtualOpen-11-new
CClfsBaseFilePersistedCreateContainer-7-new
CClfsContainerCreate-7-new
CClfsBaseFileGetSymbol-4-new
ClfsCreateLogFile-11-new
CClfsBaseFileGetSymbol-4-new
ClfsCreateLogFilefin0-2-new
subgraph Added
direction LR
RtlULongAdd
RtlULongMult
end
end
subgraph clfs-10.0.19041.1052.sys
CClfsBaseFilePersistedExtendMetadataBlockDescriptor-3-old
CClfsLogFcbVirtualOpen-11-old
CClfsBaseFilePersistedCreateContainer-7-old
CClfsContainerCreate-7-old
CClfsBaseFileGetSymbol-4-old
ClfsCreateLogFile-11-old
CClfsBaseFileGetSymbol-4-old
ClfsCreateLogFilefin0-2-old
subgraph Deleted
direction LR
Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache
wil_details_FeatureReporting_RecordUsageInCache
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_GetCurrentFeatureEnabledState
wil_details_MapReportingKind
wil_details_StagingConfigFeature_HasUniqueState
wil_details_StagingConfig_Load
wil_details_StagingConfig_QueryFeatureState
wil_RtlStagingConfig_QueryFeatureState
wil_StagingConfig_QueryFeatureState
NTOSKRNLEXE-ZwQueryWnfStateData
NTOSKRNLEXE-RtlNotifyFeatureUsage
end
end
```
```mermaid
pie showData
title Function Matches - 99.3217%
"unmatched_funcs_len" : 19
"matched_funcs_len" : 2782
```
```mermaid
pie showData
title Matched Function Similarity - 99.4608%
"matched_funcs_with_code_changes_len" : 8
"matched_funcs_with_non_code_changes_len" : 7
"matched_funcs_no_changes_len" : 2767
```
# Metadata
## Ghidra Diff Engine
### Command Line
#### Captured Command Line
```
ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2021-36955\ghidra_projects --project-name CVE-2021-36955 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2021-36955\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title clfs.sys KB5005033 vs KB5005565 (CVE-2021-36955) clfs-10.0.19041.1052.sys clfs-10.0.19041.1237.sys
```
#### Verbose Args
```
--old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2021-36955\\clfs-10.0.19041.1052.sys'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2021-36955\\clfs-10.0.19041.1237.sys']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2021-36955\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2021-36955\ghidra_projects --project-name CVE-2021-36955 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2021-36955\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title clfs.sys KB5005033 vs KB5005565 (CVE-2021-36955)
```
#### Download Original PEs
```
wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/83D3669C6A000/Clfs.Sys -O clfs.sys.x64.10.0.19041.1052
wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/B6B72B1469000/Clfs.Sys -O clfs.sys.x64.10.0.19041.1237
```
## Binary Metadata Diff
```diff
--- clfs-10.0.19041.1052.sys Meta
+++ clfs-10.0.19041.1237.sys Meta
@@ -1,44 +1,44 @@
-Program Name: clfs-10.0.19041.1052.sys
+Program Name: clfs-10.0.19041.1237.sys
Language ID: x86:LE:64:default (4.7)
Compiler ID: windows
Processor: x86
Endian: Little
Address Size: 64
Minimum Address: 1c0000000
Maximum Address: ff0000184f
-# of Bytes: 420732
+# of Bytes: 416536
# of Memory Blocks: 13
-# of Instructions: 74900
-# of Defined Data: 7703
-# of Functions: 1408
-# of Symbols: 10716
-# of Data Types: 432
+# of Instructions: 73854
+# of Defined Data: 7637
+# of Functions: 1393
+# of Symbols: 10561
+# of Data Types: 408
# of Data Type Categories: 17
Analyzed: true
Compiler: visualstudio:unknown
Created With Ghidra Version: 12.1.2
-Date Created: Sat Jul 25 22:03:23 SGT 2026
+Date Created: Sat Jul 25 22:03:30 SGT 2026
Executable Format: Portable Executable (PE)
-Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2021-36955/clfs-10.0.19041.1052.sys
-Executable MD5: b4558c5f4a1989cadbe9695aa9cfeba4
-Executable SHA256: 54dcde184634a12555b6df21b7c747adc059d37304bc18734322b8bd8088425e
-FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2021-36955/clfs-10.0.19041.1052.sys?MD5=b4558c5f4a1989cadbe9695aa9cfeba4
+Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2021-36955/clfs-10.0.19041.1237.sys
+Executable MD5: c068ee092dc1016095aa9fa42ad4dc11
+Executable SHA256: 443ae2c8d48ad56df1ce62494bf6a2a8fb32d20b015137d54e5e0ea61477c852
+FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2021-36955/clfs-10.0.19041.1237.sys?MD5=c068ee092dc1016095aa9fa42ad4dc11
PDB Age: 1
PDB File: clfs.pdb
-PDB GUID: 90d822e9-5e1d-76d3-ef30-51fd8372a51d
+PDB GUID: 45c5117b-e5a1-afdc-fb4a-cb66c4f7a5de
PDB Loaded: true
PDB Version: RSDS
PE Property[CompanyName]: Microsoft Corporation
PE Property[FileDescription]: Common Log File System Driver
-PE Property[FileVersion]: 10.0.19041.1052 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.19041.1237 (WinBuild.160101.0800)
PE Property[InternalName]: clfs.sys
PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
PE Property[OriginalFilename]: Clfs.Sys
PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.19041.1052
+PE Property[ProductVersion]: 10.0.19041.1237
PE Property[Translation]: 4b00000
Preferred Root Namespace Category:
RTTI Found: false
Relocatable: true
SectionAlignment: 4096
Should Ask To Analyze: false
```
## Program Options
Ghidra clfs-10.0.19041.1052.sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra clfs-10.0.19041.1052.sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra clfs-10.0.19041.1052.sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.msdApplyOptions|{
interpretation: FUNCTION_IF_EXISTS,
applyCallingConvention: true,
applySignature: true,
demangleOnlyKnownPatterns: true,
doDisassembly: true
}|
|Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra clfs-10.0.19041.1237.sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra clfs-10.0.19041.1237.sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra clfs-10.0.19041.1237.sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.msdApplyOptions|{
interpretation: FUNCTION_IF_EXISTS,
applyCallingConvention: true,
applySignature: true,
demangleOnlyKnownPatterns: true,
doDisassembly: true
}|
|Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats
|Stat|Value|
| :---: | :---: |
|added_funcs_len|2|
|deleted_funcs_len|17|
|modified_funcs_len|15|
|added_symbols_len|3|
|deleted_symbols_len|13|
|diff_time|20.320664882659912|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 1354, 'ExternalsName': 182, 'ExactInstructionsFunctionHasher': 32, 'StructuralGraphHash': 4, 'ExactBytesFunctionHasher': 2, 'BSIM': 1})|
|items_to_process|50|
|diff_types|Counter({'address': 12, 'code': 8, 'length': 8, 'refcount': 7, 'called': 6, 'calling': 6})|
|unmatched_funcs_len|19|
|total_funcs_len|2801|
|matched_funcs_len|2782|
|matched_funcs_with_code_changes_len|8|
|matched_funcs_with_non_code_changes_len|7|
|matched_funcs_no_changes_len|2767|
|match_func_similarity_percent|99.4608%|
|func_match_overall_percent|99.3217%|
|first_matches|Counter({'SymbolsHash': 1354, 'ExactInstructionsFunctionHasher': 32, 'StructuralGraphHash': 4, 'ExactBytesFunctionHasher': 2, 'BSIM': 1})|
```mermaid
pie showData
title All Matches
"SymbolsHash" : 1354
"ExternalsName" : 182
"ExactBytesFunctionHasher" : 2
"ExactInstructionsFunctionHasher" : 32
"BSIM" : 1
"StructuralGraphHash" : 4
```
```mermaid
pie showData
title First Matches
"SymbolsHash" : 1354
"ExactBytesFunctionHasher" : 2
"ExactInstructionsFunctionHasher" : 32
"BSIM" : 1
"StructuralGraphHash" : 4
```
```mermaid
pie showData
title Diff Stats
"added_funcs_len" : 2
"deleted_funcs_len" : 17
"modified_funcs_len" : 15
```
```mermaid
pie showData
title Symbols
"added_symbols_len" : 3
"deleted_symbols_len" : 13
```
## Strings
*No string differences found*
# Deleted
## Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled|
|fullname|Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled|
|refcount|8|
|length|70|
|called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_GetCachedFeatureEnabledState|
|calling|CClfsBaseFilePersisted::CreateContainer
CClfsContainer::Create
ClfsCreateLogFile
ClfsCreateLogFile$fin$0|
|paramcount|0|
|address|1c000c21c|
|sig|int __cdecl Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled(void)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
+++ Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
@@ -1,33 +0,0 @@
-
-/* int __cdecl Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled(void)
- */
-
-int __cdecl Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled(void)
-
-{
- uint uVar1;
- wil_details_FeatureReportingCache *pwVar2;
- uint uVar3;
- uint uVar4;
- FEATURE_LOGGED_TRAITS *in_stack_ffffffffffffffd8;
- wil_ReportingKind in_stack_ffffffffffffffe8;
- __uint64 in_stack_fffffffffffffff0;
-
- uVar3 = 0xc001ba60;
- pwVar2 = (wil_details_FeatureReportingCache *)
- &Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_featureState;
- uVar1 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
- ((wil_details_FeatureStateCache *)
- &
- Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_featureState
- ,(wil_details_FeatureDescriptor *)
- &
- Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_descriptor
- );
- uVar4 = uVar1 >> 3 & 1;
- wil_details_FeatureReporting_ReportUsageToService
- (pwVar2,uVar3,uVar1 >> 8 & 1,uVar1 >> 9 & 1,in_stack_ffffffffffffffd8,uVar4,
- in_stack_ffffffffffffffe8,in_stack_fffffffffffffff0);
- return uVar4;
-}
-
```
## wil_details_FeatureReporting_IncrementOpportunityInCache
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_IncrementOpportunityInCache|
|fullname|wil_details_FeatureReporting_IncrementOpportunityInCache|
|refcount|2|
|length|222|
|called||
|calling|wil_details_FeatureReporting_RecordUsageInCache|
|paramcount|4|
|address|1c000c2b0|
|sig|void __cdecl wil_details_FeatureReporting_IncrementOpportunityInCache(wil_details_FeatureReportingCache * param_1, wil_details_ServiceReportingKind param_2, uint param_3, wil_details_RecordUsageResult * param_4)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_FeatureReporting_IncrementOpportunityInCache
+++ wil_details_FeatureReporting_IncrementOpportunityInCache
@@ -1,63 +0,0 @@
-
-/* void __cdecl wil_details_FeatureReporting_IncrementOpportunityInCache(struct
- wil_details_FeatureReportingCache * __ptr64,enum wil_details_ServiceReportingKind,unsigned
- int,struct wil_details_RecordUsageResult * __ptr64) */
-
-void __cdecl
-wil_details_FeatureReporting_IncrementOpportunityInCache
- (wil_details_FeatureReportingCache *param_1,wil_details_ServiceReportingKind param_2,
- uint param_3,wil_details_RecordUsageResult *param_4)
-
-{
- uint uVar1;
- uint uVar2;
- undefined4 uVar3;
- uint uVar4;
- uint uVar5;
- bool bVar6;
-
- uVar4 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- do {
- uVar2 = uVar4;
- *(undefined4 *)(param_4 + 4) = 0;
- uVar1 = uVar2 | 1;
- if ((uVar2 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) {
- uVar4 = (uVar2 & 0x3f8000) >> 0xf;
- if (uVar4 != 0) {
- *(uint *)(param_4 + 4) = uVar4;
- uVar3 = 5;
- if (param_2 != 1) {
- uVar3 = 1;
- }
- uVar1 = uVar2 & 0xffc07fff | 1;
- *(undefined4 *)(param_4 + 8) = uVar3;
- }
- uVar4 = 0;
- if (param_2 == 5) {
- uVar4 = 0x400000;
- }
- uVar1 = uVar4 | uVar1 & 0xffbfffff;
- }
- uVar4 = uVar1 >> 0xf & 0x7f;
- uVar5 = uVar4 + 1;
- if ((0x7f < uVar5) || (uVar5 < (uVar1 >> 0xf & 0x7f))) {
- uVar5 = 1;
- *(wil_details_ServiceReportingKind *)(param_4 + 8) = param_2;
- *(uint *)(param_4 + 4) = uVar4;
- }
- LOCK();
- bVar6 = uVar2 != Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- uVar4 = uVar2;
- uVar1 = (uVar5 << 0xf ^ uVar1) & 0x3f8000 ^ uVar1;
- if (bVar6) {
- uVar4 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- uVar1 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- }
- Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting = uVar1;
- UNLOCK();
- } while (bVar6);
- *(undefined4 *)(param_4 + 0x10) = 0;
- *(uint *)param_4 = ~uVar2 & 1;
- return;
-}
-
```
## wil_details_FeatureReporting_IncrementUsageInCache
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_IncrementUsageInCache|
|fullname|wil_details_FeatureReporting_IncrementUsageInCache|
|refcount|2|
|length|229|
|called||
|calling|wil_details_FeatureReporting_RecordUsageInCache|
|paramcount|4|
|address|1c000c398|
|sig|void __cdecl wil_details_FeatureReporting_IncrementUsageInCache(wil_details_FeatureReportingCache * param_1, wil_details_ServiceReportingKind param_2, uint param_3, wil_details_RecordUsageResult * param_4)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_FeatureReporting_IncrementUsageInCache
+++ wil_details_FeatureReporting_IncrementUsageInCache
@@ -1,58 +0,0 @@
-
-/* void __cdecl wil_details_FeatureReporting_IncrementUsageInCache(struct
- wil_details_FeatureReportingCache * __ptr64,enum wil_details_ServiceReportingKind,unsigned
- int,struct wil_details_RecordUsageResult * __ptr64) */
-
-void __cdecl
-wil_details_FeatureReporting_IncrementUsageInCache
- (wil_details_FeatureReportingCache *param_1,wil_details_ServiceReportingKind param_2,
- uint param_3,wil_details_RecordUsageResult *param_4)
-
-{
- uint uVar1;
- uint uVar2;
- uint uVar3;
- uint uVar4;
- bool bVar5;
-
- uVar4 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- do {
- uVar2 = uVar4;
- *(undefined4 *)(param_4 + 4) = 0;
- uVar1 = uVar2 | 1;
- if ((uVar2 & 0x4000) >> 0xe != (uint)(param_2 == 4)) {
- uVar4 = (uVar2 & 0x3fe0) >> 5;
- if (uVar4 != 0) {
- *(uint *)(param_4 + 4) = uVar4;
- *(uint *)(param_4 + 8) = ~-(uint)(param_2 != 0) & 4;
- uVar1 = uVar2 & 0xffffc01f | 1;
- }
- uVar4 = 0;
- if (param_2 == 4) {
- uVar4 = 0x4000;
- }
- uVar1 = uVar4 | uVar1 & 0xffffbfff;
- }
- uVar4 = uVar1 >> 5 & 0x1ff;
- uVar3 = uVar4 + 1;
- if ((0x1ff < uVar3) || (uVar3 < (uVar1 >> 5 & 0x1ff))) {
- uVar3 = 1;
- *(wil_details_ServiceReportingKind *)(param_4 + 8) = param_2;
- *(uint *)(param_4 + 4) = uVar4;
- }
- LOCK();
- bVar5 = uVar2 != Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- uVar4 = uVar2;
- uVar1 = (uVar3 << 5 ^ uVar1) & 0x3fe0 ^ uVar1;
- if (bVar5) {
- uVar4 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- uVar1 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- }
- Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting = uVar1;
- UNLOCK();
- } while (bVar5);
- *(undefined4 *)(param_4 + 0x10) = 0;
- *(uint *)param_4 = ~uVar2 & 1;
- return;
-}
-
```
## wil_details_FeatureReporting_RecordUsageInCache
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_RecordUsageInCache|
|fullname|wil_details_FeatureReporting_RecordUsageInCache|
|refcount|2|
|length|324|
|called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache|
|calling|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|paramcount|4|
|address|1c000c484|
|sig|wil_details_RecordUsageResult __cdecl wil_details_FeatureReporting_RecordUsageInCache(wil_details_FeatureReportingCache * param_1, wil_details_ServiceReportingKind param_2, uint param_3, uint param_4)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_FeatureReporting_RecordUsageInCache
+++ wil_details_FeatureReporting_RecordUsageInCache
@@ -1,95 +0,0 @@
-
-/* struct wil_details_RecordUsageResult __cdecl
- wil_details_FeatureReporting_RecordUsageInCache(struct wil_details_FeatureReportingCache *
- __ptr64,enum wil_details_ServiceReportingKind,unsigned int,unsigned int) */
-
-wil_details_FeatureReportingCache * __cdecl
-wil_details_FeatureReporting_RecordUsageInCache
- (wil_details_FeatureReportingCache *param_1,wil_details_ServiceReportingKind param_2,
- uint param_3,uint param_4)
-
-{
- uint uVar1;
- uint uVar2;
- uint uVar3;
- uint uVar4;
- bool bVar5;
-
- *(undefined8 *)param_1 = 0;
- *(undefined8 *)(param_1 + 8) = 0;
- *(undefined8 *)(param_1 + 0x10) = 0;
- if (param_3 == 0) {
-LAB_1c000c5b7:
- wil_details_FeatureReporting_IncrementUsageInCache
- (param_1,param_3,param_3,(wil_details_RecordUsageResult *)param_1);
- }
- else {
- if (param_3 == 1) {
-LAB_1c000c5ad:
- wil_details_FeatureReporting_IncrementOpportunityInCache
- (param_1,param_3,param_3,(wil_details_RecordUsageResult *)param_1);
- return param_1;
- }
- uVar3 = 0;
- if ((int)param_3 < 2) {
-LAB_1c000c547:
- uVar4 = param_3 - 0x140;
- if (uVar4 < 0x40) {
- uVar1 = DAT_1c001e604;
- do {
- if (((uVar1 & 0x10) == 0) || (uVar2 = 1, (uVar1 >> 5 & 0x3f) != uVar4)) {
- uVar2 = uVar3;
- }
- *(uint *)(param_1 + 0x10) = uVar2;
- LOCK();
- bVar5 = uVar1 != DAT_1c001e604;
- uVar2 = uVar1 & 0xfffff81f | (uVar4 & 0x3f) << 5 | 0x10;
- if (bVar5) {
- uVar1 = DAT_1c001e604;
- uVar2 = DAT_1c001e604;
- }
- DAT_1c001e604 = uVar2;
- UNLOCK();
- } while (bVar5);
- }
- *(uint *)(param_1 + 8) = param_3;
- *(undefined4 *)(param_1 + 4) = 1;
- *(undefined4 *)(param_1 + 0xc) = 0;
- return param_1;
- }
- if (3 < (int)param_3) {
- if (param_3 == 4) goto LAB_1c000c5b7;
- if (param_3 == 5) goto LAB_1c000c5ad;
- if (1 < param_3 - 6) goto LAB_1c000c547;
- }
- if (param_3 == 2) {
- uVar3 = 2;
- }
- else if (param_3 == 3) {
- uVar3 = 8;
- }
- else if (param_3 == 6) {
- uVar3 = 4;
- }
- else if (param_3 == 7) {
- uVar3 = 0x10;
- }
- uVar4 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- do {
- LOCK();
- bVar5 = uVar4 !=
- Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- uVar1 = uVar4 | uVar3 | 1;
- if (bVar5) {
- uVar4 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- uVar1 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting;
- }
- Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting = uVar1;
- UNLOCK();
- } while (bVar5);
- *(uint *)param_1 = ~uVar4 & 1;
- *(uint *)(param_1 + 0x10) = (uint)((uVar3 & uVar4) == uVar3);
- }
- return param_1;
-}
-
```
## wil_details_FeatureReporting_ReportUsageToService
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_ReportUsageToService|
|fullname|wil_details_FeatureReporting_ReportUsageToService|
|refcount|2|
|length|124|
|called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind|
|calling|Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled|
|paramcount|8|
|address|1c000c5d0|
|sig|void __cdecl wil_details_FeatureReporting_ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_FeatureReporting_ReportUsageToService
+++ wil_details_FeatureReporting_ReportUsageToService
@@ -1,41 +0,0 @@
-
-/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
-/* void __cdecl wil_details_FeatureReporting_ReportUsageToService(struct
- wil_details_FeatureReportingCache * __ptr64,unsigned int,int,int,struct FEATURE_LOGGED_TRAITS
- const * __ptr64,int,enum wil_ReportingKind,unsigned __int64) */
-
-void __cdecl
-wil_details_FeatureReporting_ReportUsageToService
- (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4,
- FEATURE_LOGGED_TRAITS *param_5,int param_6,wil_ReportingKind param_7,__uint64 param_8)
-
-{
- wil_details_ServiceReportingKind wVar1;
- int iVar2;
- wil_details_FeatureReportingCache *pwVar3;
- uint uVar4;
- wil_ReportingKind local_res10 [6];
- uint in_stack_ffffffffffffffd0;
- undefined1 in_stack_ffffffffffffffd8;
- undefined7 in_stack_ffffffffffffffd9;
-
- pwVar3 = (wil_details_FeatureReportingCache *)0x3;
- local_res10[0] = 3;
- uVar4 = param_6;
- wVar1 = wil_details_MapReportingKind(3,param_6);
- iVar2 = wil_details_FeatureReporting_ReportUsageToServiceDirect
- (pwVar3,uVar4,param_3,param_4,wVar1,in_stack_ffffffffffffffd0,
- CONCAT71(in_stack_ffffffffffffffd9,in_stack_ffffffffffffffd8));
- if ((iVar2 != 0) &&
- (g_wil_details_pfnFeatureLoggingHook !=
- (_func_void_uint_FEATURE_LOGGED_TRAITS_ptr_FEATURE_ERROR_ptr_int_wil_ReportingKind_ptr_wil_VariantReportingKind_ptr_uchar___uint64
- *)0x0)) {
- (*g_wil_details_pfnFeatureLoggingHook)
- (0x1da73d9,
- (FEATURE_LOGGED_TRAITS *)
- &Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721_logged_traits,
- (FEATURE_ERROR *)0x0,param_6,local_res10,(wil_VariantReportingKind *)0x0,'\0',1);
- }
- return;
-}
-
```
## wil_details_FeatureReporting_ReportUsageToServiceDirect
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|refcount|2|
|length|289|
|called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|
|calling|wil_details_FeatureReporting_ReportUsageToService|
|paramcount|7|
|address|1c000c654|
|sig|int __cdecl wil_details_FeatureReporting_ReportUsageToServiceDirect(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, wil_details_ServiceReportingKind param_5, uint param_6, __uint64 param_7)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_FeatureReporting_ReportUsageToServiceDirect
+++ wil_details_FeatureReporting_ReportUsageToServiceDirect
@@ -1,69 +0,0 @@
-
-/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
-/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-/* WARNING: Exceeded maximum restarts with more pending */
-/* int __cdecl wil_details_FeatureReporting_ReportUsageToServiceDirect(struct
- wil_details_FeatureReportingCache * __ptr64,unsigned int,int,int,enum
- wil_details_ServiceReportingKind,unsigned int,unsigned __int64) */
-
-int __cdecl
-wil_details_FeatureReporting_ReportUsageToServiceDirect
- (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4,
- wil_details_ServiceReportingKind param_5,uint param_6,__uint64 param_7)
-
-{
- uint6 uVar1;
- undefined4 *puVar2;
- undefined1 auStack_88 [32];
- undefined8 *local_68;
- undefined8 local_58;
- undefined8 local_50;
- wil_details_ServiceReportingKind local_48;
- undefined8 local_44;
- int local_3c;
- undefined4 local_38;
- undefined4 uStack_34;
- undefined4 uStack_30;
- undefined4 uStack_2c;
- undefined8 local_28;
- ulonglong local_20;
-
- local_20 = __security_cookie ^ (ulonglong)auStack_88;
- puVar2 = (undefined4 *)
- wil_details_FeatureReporting_RecordUsageInCache
- ((wil_details_FeatureReportingCache *)&local_50,param_2,param_5,param_4);
- local_38 = *puVar2;
- uStack_34 = puVar2[1];
- uStack_30 = puVar2[2];
- uStack_2c = puVar2[3];
- local_28 = *(undefined8 *)(puVar2 + 4);
- if (g_wil_details_recordFeatureUsage ==
- (_func_void_uint_wil_details_ServiceReportingKind_uint_wil_details_FeatureReportingCache_ptr_wil_details_RecordUsageResult_ptr
- *)0x0) {
- if ((param_3 != 0) && (param_5 != 0xfe)) {
- local_58._0_6_ = CONCAT24((short)param_5,0x1da73d9);
- uVar1 = (uint6)local_58;
- local_58 = (ulonglong)(uint6)local_58;
- if (param_4 != 0) {
- local_58 = CONCAT26(1,uVar1);
- }
- RtlNotifyFeatureUsage(&local_58);
- }
- }
- else {
- local_68 = (undefined8 *)&local_38;
- (*g_wil_details_recordFeatureUsage)
- (0x1da73d9,param_5,1,
- &Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_reporting);
- if (param_3 != 0) {
- local_68 = &local_50;
- local_50 = 0;
- local_44 = 0;
- local_48 = param_5;
- local_3c = param_4;
- (*g_wil_details_recordFeatureUsage)(0x1da73d9,param_5,1,0);
- }
- }
- return (int)((int)local_28 == 0);
-}
-
```
## wil_details_FeatureStateCache_GetCachedFeatureEnabledState
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_FeatureStateCache_GetCachedFeatureEnabledState|
|fullname|wil_details_FeatureStateCache_GetCachedFeatureEnabledState|
|refcount|3|
|length|45|
|called|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|calling|Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
wil_details_GetCurrentFeatureEnabledState|
|paramcount|2|
|address|1c000c77c|
|sig|wil_details_FeatureStateCache __cdecl wil_details_FeatureStateCache_GetCachedFeatureEnabledState(wil_details_FeatureStateCache * param_1, wil_details_FeatureDescriptor * param_2)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+++ wil_details_FeatureStateCache_GetCachedFeatureEnabledState
@@ -1,20 +0,0 @@
-
-/* union wil_details_FeatureStateCache __cdecl
- wil_details_FeatureStateCache_GetCachedFeatureEnabledState(union wil_details_FeatureStateCache *
- __ptr64,struct wil_details_FeatureDescriptor const * __ptr64) */
-
-ulonglong __cdecl
-wil_details_FeatureStateCache_GetCachedFeatureEnabledState
- (wil_details_FeatureStateCache *param_1,wil_details_FeatureDescriptor *param_2)
-
-{
- undefined8 local_res8;
-
- local_res8 = (ulonglong)*(uint *)param_1;
- if ((*(uint *)param_1 & 1) == 0) {
- local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
- (param_1,local_res8,param_2);
- }
- return local_res8;
-}
-
```
## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|refcount|2|
|length|249|
|called|_guard_dispatch_icall
wil_details_GetCurrentFeatureEnabledState|
|calling|wil_details_FeatureStateCache_GetCachedFeatureEnabledState|
|paramcount|3|
|address|1c000c7b0|
|sig|wil_details_FeatureStateCache __cdecl wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(wil_details_FeatureStateCache * param_1, wil_details_FeatureStateCache param_2, wil_details_FeatureDescriptor * param_3)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
@@ -1,67 +0,0 @@
-
-/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
-/* union wil_details_FeatureStateCache __cdecl
- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(union
- wil_details_FeatureStateCache * __ptr64,union wil_details_FeatureStateCache,struct
- wil_details_FeatureDescriptor const * __ptr64) */
-
-ulonglong __cdecl
-wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
- (uint *param_1,ulonglong param_2,wil_details_FeatureDescriptor *param_3)
-
-{
- int iVar1;
- uint uVar2;
- uint uVar3;
- uint uVar4;
- uint uVar5;
- bool bVar6;
- uint local_res8 [2];
- undefined8 local_res10;
-
- iVar1 = 0;
- local_res8[0] = 0;
- local_res10 = param_2;
- if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != 0) {
- iVar1 = (*(code *)g_wil_details_ensureSubscribedToFeatureConfigurationChanges)();
- }
- uVar2 = wil_details_GetCurrentFeatureEnabledState(param_3,(int *)local_res8);
- if (param_3[0xc] == (wil_details_FeatureDescriptor)0x0) {
- local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0);
- }
- while( true ) {
- uVar5 = (uint)param_2;
- local_res10 = CONCAT44(local_res10._4_4_,uVar5);
- uVar4 = uVar5;
- if ((local_res8[0] != 0) && ((param_2 & 1) == 0)) {
- uVar3 = (uVar5 ^ uVar2) & 0x278 ^ uVar5;
- uVar4 = uVar3 | 1;
- local_res10 = CONCAT44(local_res10._4_4_,uVar3) | 1;
- }
- if ((param_2 & 2) == 0) {
- uVar3 = uVar4 ^ (uVar2 ^ uVar4) & 0x100;
- uVar4 = uVar3 | 2;
- local_res10 = CONCAT44(local_res10._4_4_,uVar3) | 2;
- }
- LOCK();
- uVar3 = *param_1;
- bVar6 = uVar5 == uVar3;
- if (bVar6) {
- *param_1 = uVar4;
- uVar3 = uVar5;
- }
- UNLOCK();
- if (bVar6) break;
- param_2 = (ulonglong)uVar3;
- }
- if (((param_2 & 2) == 0) && (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != 0))
- {
- (*(code *)g_wil_details_subscribeFeatureStateCacheToConfigurationChanges)
- (param_1,param_3[0xc],iVar1);
- }
- if (local_res8[0] == 0) {
- local_res10 = (ulonglong)(uVar4 ^ (uVar2 ^ uVar4) & 0x278);
- }
- return local_res10;
-}
-
```
## wil_details_GetCurrentFeatureEnabledState
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_GetCurrentFeatureEnabledState|
|fullname|wil_details_GetCurrentFeatureEnabledState|
|refcount|2|
|length|336|
|called|wil_RtlStagingConfig_QueryFeatureState
wil_StagingConfig_QueryFeatureState
wil_details_FeatureStateCache_GetCachedFeatureEnabledState|
|calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|paramcount|2|
|address|1c000c8b0|
|sig|wil_details_FeatureStateCache __cdecl wil_details_GetCurrentFeatureEnabledState(wil_details_FeatureDescriptor * param_1, int * param_2)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_GetCurrentFeatureEnabledState
+++ wil_details_GetCurrentFeatureEnabledState
@@ -1,81 +0,0 @@
-
-/* union wil_details_FeatureStateCache __cdecl wil_details_GetCurrentFeatureEnabledState(struct
- wil_details_FeatureDescriptor const * __ptr64,int * __ptr64) */
-
-uint __cdecl
-wil_details_GetCurrentFeatureEnabledState(wil_details_FeatureDescriptor *param_1,int *param_2)
-
-{
- wil_details_FeatureDescriptor wVar1;
- wil_details_FeatureDescriptor *pwVar2;
- byte bVar3;
- int iVar4;
- uint uVar5;
- wil_FeatureState *pwVar6;
- undefined8 *puVar7;
- uint uVar8;
- int *in_R9;
- int *in_stack_ffffffffffffffc8;
- uint local_28 [8];
-
- wVar1 = param_1[0xc];
- uVar5 = *(uint *)(param_1 + 8);
- *param_2 = 1;
- pwVar6 = (wil_FeatureState *)local_28;
- local_28[4] = 0;
- local_28[5] = 0;
- local_28[0] = 0;
- local_28[1] = 0;
- local_28[2] = 0;
- local_28[3] = 0;
- uVar8 = (uint)((byte)((char)wVar1 - 2U) < 2);
- iVar4 = wil_RtlStagingConfig_QueryFeatureState(pwVar6,uVar5,uVar8,in_R9);
- if (iVar4 == 0) {
- iVar4 = wil_StagingConfig_QueryFeatureState
- ((wil_FeatureStore)pwVar6,(wil_FeatureState *)local_28,uVar5,uVar8,
- in_stack_ffffffffffffffc8);
- }
- uVar5 = (-(uint)(iVar4 != 0) & local_28[0] & 3) << 5 ^
- (-(uint)(local_28[4] != 0) & 0x100 | -(uint)(local_28[5] != 0) & 0x200);
- if ((uVar5 & 0x60) == 0) {
- uVar8 = -(uint)(param_1[0xf] != (wil_details_FeatureDescriptor)0x0) & 0x10;
- }
- else {
- uVar8 = 0;
- if (local_28[0] == 2) {
- uVar8 = 0x10;
- }
- }
- uVar5 = (uVar8 | uVar5) ^ uVar8 >> 1;
- if (((uVar5 & 8) != 0) && (puVar7 = *(undefined8 **)(param_1 + 0x10), puVar7 != (undefined8 *)0x0)
- ) {
- do {
- pwVar2 = (wil_details_FeatureDescriptor *)*puVar7;
- if (pwVar2 == (wil_details_FeatureDescriptor *)0x0) {
- return uVar5;
- }
- if ((pwVar2[0xe] == (wil_details_FeatureDescriptor)0x0) &&
- (pwVar2[0xd] == (wil_details_FeatureDescriptor)0x0)) {
- bVar3 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
- (*(wil_details_FeatureStateCache **)pwVar2,pwVar2);
- if ((uVar5 & 8) == 0) goto LAB_1c000c9d5;
- wVar1 = (wil_details_FeatureDescriptor)(bVar3 & 8);
-LAB_1c000c9cf:
- uVar8 = 8;
- if (wVar1 == (wil_details_FeatureDescriptor)0x0) goto LAB_1c000c9d5;
- }
- else {
- if ((uVar5 & 8) != 0) {
- wVar1 = pwVar2[0xf];
- goto LAB_1c000c9cf;
- }
-LAB_1c000c9d5:
- uVar8 = 0;
- }
- puVar7 = puVar7 + 1;
- uVar5 = uVar5 & 0xfffffff7 | uVar8;
- } while (uVar8 != 0);
- }
- return uVar5;
-}
-
```
## wil_details_MapReportingKind
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_MapReportingKind|
|fullname|wil_details_MapReportingKind|
|refcount|2|
|length|144|
|called||
|calling|wil_details_FeatureReporting_ReportUsageToService|
|paramcount|2|
|address|1c000ca08|
|sig|wil_details_ServiceReportingKind __cdecl wil_details_MapReportingKind(wil_ReportingKind param_1, int param_2)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_MapReportingKind
+++ wil_details_MapReportingKind
@@ -1,37 +0,0 @@
-
-/* enum wil_details_ServiceReportingKind __cdecl wil_details_MapReportingKind(enum
- wil_ReportingKind,int) */
-
-wil_details_ServiceReportingKind __cdecl
-wil_details_MapReportingKind(wil_ReportingKind param_1,int param_2)
-
-{
- byte bVar1;
-
- if (param_1 != 0) {
- if (param_1 == 1) {
- return ~-(uint)(param_2 != 0) & 4;
- }
- if (param_1 == 2) {
- return (-(uint)(param_2 != 0) & 0xfffffffc) + 5;
- }
- if (param_1 == 3) {
- return (-(uint)(param_2 != 0) & 0xfffffffc) + 6;
- }
- if (param_1 == 4) {
- return (-(uint)(param_2 != 0) & 0xfffffffc) + 7;
- }
- if (param_1 == 5) {
- return (-(uint)(param_2 != 0) & 0xfffffffe) + 10;
- }
- if (param_1 == 6) {
- return (-(uint)(param_2 != 0) & 0xfffffffe) + 0xb;
- }
- bVar1 = (char)param_1 + 0x9c;
- if (bVar1 < 0x32) {
- return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1;
- }
- }
- return 0xff;
-}
-
```
## wil_details_StagingConfigFeature_HasUniqueState
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_StagingConfigFeature_HasUniqueState|
|fullname|wil_details_StagingConfigFeature_HasUniqueState|
|refcount|2|
|length|49|
|called||
|calling|wil_details_StagingConfig_QueryFeatureState|
|paramcount|1|
|address|1c000caa8|
|sig|int __cdecl wil_details_StagingConfigFeature_HasUniqueState(wil_details_StagingConfigFeature * param_1)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_StagingConfigFeature_HasUniqueState
+++ wil_details_StagingConfigFeature_HasUniqueState
@@ -1,18 +0,0 @@
-
-/* int __cdecl wil_details_StagingConfigFeature_HasUniqueState(struct
- wil_details_StagingConfigFeature const * __ptr64) */
-
-int __cdecl
-wil_details_StagingConfigFeature_HasUniqueState(wil_details_StagingConfigFeature *param_1)
-
-{
- uint uVar1;
-
- if ((*(int *)param_1 != 0) &&
- ((((uVar1 = *(uint *)(param_1 + 4), (uVar1 & 0x300) != 0 || ((uVar1 & 0xc00) != 0)) ||
- ((uVar1 & 0x3000) != 0)) || (((uVar1 & 0x3f000000) != 0 || ((uVar1 & 2) != 0)))))) {
- return 1;
- }
- return 0;
-}
-
```
## wil_details_StagingConfig_Load
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_StagingConfig_Load|
|fullname|wil_details_StagingConfig_Load|
|refcount|2|
|length|757|
|called|NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ZwQueryWnfStateData
__security_check_cookie
memset|
|calling|wil_StagingConfig_QueryFeatureState|
|paramcount|5|
|address|1c000cae4|
|sig|long __cdecl wil_details_StagingConfig_Load(wil_details_StagingConfig * param_1, wil_FeatureStore param_2, __uint64 param_3, void * param_4, int param_5)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_StagingConfig_Load
+++ wil_details_StagingConfig_Load
@@ -1,135 +0,0 @@
-
-/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-/* long __cdecl wil_details_StagingConfig_Load(struct wil_details_StagingConfig * __ptr64,enum
- wil_FeatureStore,unsigned __int64,void * __ptr64,int) */
-
-long __cdecl
-wil_details_StagingConfig_Load
- (wil_details_StagingConfig *param_1,wil_FeatureStore param_2,__uint64 param_3,
- void *param_4,int param_5)
-
-{
- ushort uVar1;
- long lVar2;
- wil_details_StagingConfig *pwVar3;
- wil_details_StagingConfig *pwVar4;
- ulonglong uVar5;
- int iVar6;
- ulonglong uVar7;
- wil_details_StagingConfig *pwVar8;
- undefined1 auStack_98 [32];
- wil_details_StagingConfig *local_78;
- wil_details_StagingConfig **local_70;
- uint local_68;
- int local_64;
- wil_details_StagingConfig *local_60;
- undefined8 local_58;
- undefined8 local_50;
- ulonglong local_48;
-
- local_48 = __security_cookie ^ (ulonglong)auStack_98;
- local_60 = param_4;
- memset(param_1 + 8,0,0x50);
- pwVar4 = (wil_details_StagingConfig *)0x0;
- *(undefined8 *)param_1 = 0;
- local_58 = 0x418a073aa3bc7c75;
- uVar7 = -(ulonglong)(param_4 != (void *)0x0) & 200;
- local_68 = -(uint)(param_4 != (void *)0x0) & 200;
- local_70 = (wil_details_StagingConfig **)&local_68;
- local_78 = param_4;
- lVar2 = ZwQueryWnfStateData(&local_58,0,0,param_1 + 8);
- pwVar3 = pwVar4;
- pwVar8 = pwVar4;
- if (lVar2 != 0) goto LAB_1c000cc2c;
- pwVar3 = local_60;
- pwVar8 = (wil_details_StagingConfig *)0x0;
- if (local_60 != (wil_details_StagingConfig *)0x0) goto LAB_1c000cc2c;
- while( true ) {
- if (uVar7 < 200) {
- uVar7 = 200;
- }
- uVar5 = (ulonglong)local_68;
- if (local_68 <= uVar7) {
- uVar5 = uVar7;
- }
- uVar7 = uVar5;
- if (uVar5 < 0x10) {
- uVar7 = 0x10;
- }
- if (pwVar4 != (wil_details_StagingConfig *)0x0) {
- ExFreePoolWithTag(pwVar4,0x4c4957);
- }
- pwVar3 = (wil_details_StagingConfig *)ExAllocatePoolWithTag(0x200,uVar7,0x4c4957);
- if (pwVar3 == (wil_details_StagingConfig *)0x0) break;
- local_70 = (wil_details_StagingConfig **)&local_68;
- local_68 = (uint)uVar7;
- local_78 = pwVar3;
- lVar2 = ZwQueryWnfStateData(&local_58,0,0,param_1 + 8);
- pwVar8 = pwVar3;
-LAB_1c000cc2c:
- pwVar4 = pwVar8;
- if (lVar2 != -0x3fffffdd) {
- if ((lVar2 == 0) && (pwVar3 != (wil_details_StagingConfig *)0x0)) {
- uVar5 = (ulonglong)local_68;
- if (4 < local_68) {
- param_1[0xc] = *pwVar3;
- }
- if ((((local_68 < 0x10) || (param_1[0xc] != (wil_details_StagingConfig)0x2)) ||
- (*(ushort *)(pwVar3 + 2) < 0x10)) ||
- (uVar5 < (ulonglong)*(ushort *)(pwVar3 + 6) * 0x10 +
- (ulonglong)*(ushort *)(pwVar3 + 4) * 0xc + (ulonglong)*(ushort *)(pwVar3 + 2)))
- {
- *(undefined8 *)pwVar3 = 0;
- *(undefined8 *)(pwVar3 + 8) = 0;
- *(undefined4 *)pwVar3 = 0x100202;
- uVar5 = 0x10;
- *(wil_details_StagingConfig **)(param_1 + 0x18) = pwVar3;
- uVar1 = *(ushort *)(pwVar3 + 2);
- *(wil_details_StagingConfig **)(param_1 + 0x20) = pwVar3 + uVar1;
- *(wil_details_StagingConfig **)(param_1 + 0x28) =
- pwVar3 + uVar1 + (ulonglong)*(ushort *)(pwVar3 + 4) * 0xc;
- }
- else {
- local_64 = 0;
- iVar6 = 0;
- if (*(ushort *)(pwVar3 + 4) != 0) {
- local_50 = 0x418a073aa3bc8075;
- local_70 = &local_60;
- local_60 = (wil_details_StagingConfig *)((ulonglong)local_60 & 0xffffffff00000000);
- local_78 = (wil_details_StagingConfig *)0x0;
- ZwQueryWnfStateData(&local_50,0,0,&local_64);
- uVar5 = (ulonglong)local_68;
- iVar6 = local_64;
- }
- *(wil_details_StagingConfig **)(param_1 + 0x18) = pwVar3;
- *(wil_details_StagingConfig **)(param_1 + 0x20) = pwVar3 + 0x10;
- *(wil_details_StagingConfig **)(param_1 + 0x28) =
- pwVar3 + 0x10 + (ulonglong)*(ushort *)(pwVar3 + 4) * 0xc;
- *(uint *)(param_1 + 0x30) = (uint)(iVar6 != 0);
- if ((*pwVar3 == (wil_details_StagingConfig)0x2) && ((byte)pwVar3[1] < 2)) {
- uVar5 = (ulonglong)
- ((uint)*(ushort *)(pwVar3 + 6) * 0x10 +
- ((uint)*(ushort *)(pwVar3 + 4) + (uint)*(ushort *)(pwVar3 + 4) * 2) * 4 +
- (uint)*(ushort *)(pwVar3 + 2));
- *(undefined4 *)(param_1 + 0x10) = 1;
- }
- }
- *(ulonglong *)(param_1 + 0x40) = uVar5;
- uVar5 = 200;
- if (pwVar8 != (wil_details_StagingConfig *)0x0) {
- uVar5 = uVar7;
- }
- *(wil_details_StagingConfig **)(param_1 + 0x38) = pwVar3;
- *(ulonglong *)(param_1 + 0x48) = uVar5;
- lVar2 = 0;
- *(uint *)(param_1 + 0x50) = (uint)(pwVar3 == pwVar8);
- }
- else if (pwVar8 != (wil_details_StagingConfig *)0x0) {
- ExFreePoolWithTag(pwVar8,0x4c4957);
- }
- return lVar2;
- }
- }
- return -0x3fffff66;
-}
-
```
## wil_details_StagingConfig_QueryFeatureState
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_details_StagingConfig_QueryFeatureState|
|fullname|wil_details_StagingConfig_QueryFeatureState|
|refcount|2|
|length|462|
|called|wil_details_StagingConfigFeature_HasUniqueState|
|calling|wil_StagingConfig_QueryFeatureState|
|paramcount|4|
|address|1c000cde0|
|sig|int __cdecl wil_details_StagingConfig_QueryFeatureState(wil_details_StagingConfig * param_1, wil_FeatureState * param_2, uint param_3, int param_4)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_details_StagingConfig_QueryFeatureState
+++ wil_details_StagingConfig_QueryFeatureState
@@ -1,125 +0,0 @@
-
-/* int __cdecl wil_details_StagingConfig_QueryFeatureState(struct wil_details_StagingConfig *
- __ptr64,struct wil_FeatureState * __ptr64,unsigned int,int) */
-
-int __cdecl
-wil_details_StagingConfig_QueryFeatureState
- (wil_details_StagingConfig *param_1,wil_FeatureState *param_2,uint param_3,int param_4)
-
-{
- longlong lVar1;
- int iVar2;
- longlong lVar3;
- uint *puVar4;
- uint uVar5;
- ulonglong uVar6;
- uint uVar7;
- uint uVar8;
- undefined4 uVar10;
- int iVar11;
- ulonglong uVar12;
- undefined8 local_38;
- undefined4 local_30;
- ulonglong uVar9;
-
- lVar1 = *(longlong *)(param_1 + 0x18);
- uVar6 = 0;
- lVar3 = *(longlong *)(param_1 + 0x20);
- uVar10 = 0;
- local_38 = 0;
- local_30 = 0;
- iVar11 = 0;
- uVar9 = uVar6;
- uVar12 = uVar6;
- iVar2 = iVar11;
- if (*(ushort *)(lVar1 + 4) != 0) {
- do {
- if (*(uint *)(lVar3 + uVar9 * 0xc) == param_3) {
- if ((param_4 == 0) || (*(int *)(param_1 + 0x30) == 0)) {
- uVar12 = 1;
- iVar2 = 1;
- local_38 = *(ulonglong *)(lVar3 + uVar9 * 0xc);
- uVar10 = *(undefined4 *)(lVar3 + 8 + uVar9 * 0xc);
- local_30 = uVar10;
- if ((*(uint *)(lVar3 + 4 + uVar9 * 0xc) & 1) != 0) break;
- }
- else if ((*(uint *)(lVar3 + 4 + uVar9 * 0xc) & 1) == 0) {
- local_38 = *(ulonglong *)(lVar3 + uVar9 * 0xc);
- uVar10 = *(undefined4 *)(lVar3 + 8 + uVar9 * 0xc);
- local_30 = uVar10;
- goto LAB_1c000cea7;
- }
- }
- iVar2 = (int)uVar12;
- uVar5 = (int)uVar9 + 1;
- uVar9 = (ulonglong)uVar5;
- } while (uVar5 < *(ushort *)(lVar1 + 4));
- }
- if (iVar2 != 0) {
-LAB_1c000cea7:
- if ((param_4 == 0) || (lVar3 = 0xc, *(int *)(param_1 + 0x30) == 0)) {
- lVar3 = 8;
- }
- uVar5 = *(uint *)(lVar3 + lVar1);
- uVar7 = local_38._4_4_;
- if ((uVar5 & 4) != 0) {
- uVar7 = local_38._4_4_ & 0xffffcfff;
- local_38 = local_38 & 0xffffcfffffffffff;
- }
- uVar8 = uVar7;
- if ((uVar5 & 2) != 0) {
- uVar8 = uVar7 & 0xfffff3ff;
- local_38 = CONCAT44(uVar7,(undefined4)local_38) & 0xfffff3ffffffffff;
- }
- uVar7 = uVar8;
- if ((uVar5 & 1) != 0) {
- uVar7 = uVar8 & 0xfffffcff;
- local_38 = CONCAT44(uVar8,(undefined4)local_38) & 0xfffffcffffffffff;
- }
- uVar8 = uVar7;
- if ((uVar5 & 8) != 0) {
- uVar8 = uVar7 & 0xc0ffffff;
- local_38 = CONCAT44(uVar7,(undefined4)local_38) & 0xc0ffffffffffffff;
- uVar10 = 0;
- local_30 = 0;
- }
- uVar9 = (ulonglong)uVar8;
- iVar11 = 0;
- iVar2 = wil_details_StagingConfigFeature_HasUniqueState
- ((wil_details_StagingConfigFeature *)&local_38);
- if (iVar2 != 0) {
- *(undefined4 *)(param_2 + 0xc) = uVar10;
- *(uint *)(param_2 + 8) = (uint)(uVar9 >> 0x1e) & 3;
- param_2[4] = (wil_FeatureState)((byte)(uVar9 >> 0x18) & 0x3f);
- *(uint *)(param_2 + 0x14) = (uint)(uVar9 >> 1) & 1;
- uVar5 = (uint)(uVar9 >> 0xc);
- if (((uVar9 >> 0xc & 3) == 0) && (uVar5 = (uint)(uVar9 >> 10), (uVar9 >> 10 & 3) == 0)) {
- uVar5 = (uint)uVar9 >> 8 & 3;
- if (uVar5 != 0) {
- *(uint *)param_2 = uVar5;
- }
- }
- else {
- *(uint *)param_2 = uVar5 & 3;
- }
- iVar11 = 1;
- }
- }
- uVar10 = (undefined4)uVar6;
- uVar6 = uVar6 & 0xffffffff;
- puVar4 = *(uint **)(param_1 + 0x28);
- if (*(ushort *)(lVar1 + 6) != 0) {
- do {
- if (*puVar4 == param_3) {
- uVar10 = 1;
- break;
- }
- uVar5 = (int)uVar6 + 1;
- uVar6 = (ulonglong)uVar5;
- puVar4 = puVar4 + 4;
- } while (uVar5 < *(ushort *)(lVar1 + 6));
- }
- *(undefined4 *)(param_2 + 0x10) = uVar10;
- return iVar11;
-}
-
```
## wil_RtlStagingConfig_QueryFeatureState
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_RtlStagingConfig_QueryFeatureState|
|fullname|wil_RtlStagingConfig_QueryFeatureState|
|refcount|2|
|length|188|
|called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie|
|calling|wil_details_GetCurrentFeatureEnabledState|
|paramcount|4|
|address|1c0026a18|
|sig|int __cdecl wil_RtlStagingConfig_QueryFeatureState(wil_FeatureState * param_1, uint param_2, int param_3, int * param_4)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_RtlStagingConfig_QueryFeatureState
+++ wil_RtlStagingConfig_QueryFeatureState
@@ -1,39 +0,0 @@
-
-/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-/* int __cdecl wil_RtlStagingConfig_QueryFeatureState(struct wil_FeatureState * __ptr64,unsigned
- int,int,int * __ptr64) */
-
-int __cdecl
-wil_RtlStagingConfig_QueryFeatureState
- (wil_FeatureState *param_1,uint param_2,int param_3,int *param_4)
-
-{
- int iVar1;
- int iVar2;
- undefined1 auStack_48 [32];
- undefined8 local_28;
- undefined8 local_20;
- undefined4 local_18;
- ulonglong local_10;
-
- local_10 = __security_cookie ^ (ulonglong)auStack_48;
- iVar2 = 0;
- local_28 = 0;
- local_20 = 0;
- local_18 = 0;
- iVar1 = RtlQueryFeatureConfiguration(param_2,param_3 == 0,&local_28,&local_20);
- if (iVar1 == 0) {
- iVar2 = 1;
- *(uint *)param_1 = local_20._4_4_ >> 4 & 3;
- param_1[4] = (wil_FeatureState)((byte)((ulonglong)local_20 >> 0x28) & 0x3f);
- *(undefined4 *)(param_1 + 0xc) = local_18;
- *(uint *)(param_1 + 8) = local_20._4_4_ >> 0xe & 3;
- *(uint *)(param_1 + 0x14) = local_20._4_4_ >> 6 & 1;
- }
- else if (iVar1 != 0x117) {
- return 0;
- }
- *(uint *)(param_1 + 0x10) = local_20._4_4_ >> 7 & 1;
- return iVar2;
-}
-
```
## wil_StagingConfig_QueryFeatureState
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|wil_StagingConfig_QueryFeatureState|
|fullname|wil_StagingConfig_QueryFeatureState|
|refcount|2|
|length|186|
|called|NTOSKRNL.EXE::ExFreePoolWithTag
__security_check_cookie
memset
wil_details_StagingConfig_Load
wil_details_StagingConfig_QueryFeatureState|
|calling|wil_details_GetCurrentFeatureEnabledState|
|paramcount|5|
|address|1c0026adc|
|sig|int __cdecl wil_StagingConfig_QueryFeatureState(wil_FeatureStore param_1, wil_FeatureState * param_2, uint param_3, int param_4, int * param_5)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- wil_StagingConfig_QueryFeatureState
+++ wil_StagingConfig_QueryFeatureState
@@ -1,37 +0,0 @@
-
-/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-/* int __cdecl wil_StagingConfig_QueryFeatureState(enum wil_FeatureStore,struct wil_FeatureState *
- __ptr64,unsigned int,int,int * __ptr64) */
-
-int __cdecl
-wil_StagingConfig_QueryFeatureState
- (wil_FeatureStore param_1,wil_FeatureState *param_2,uint param_3,int param_4,int *param_5)
-
-{
- long lVar1;
- int iVar2;
- wil_FeatureStore wVar3;
- __uint64 _Var4;
- undefined1 auStackY_178 [32];
- int in_stack_fffffffffffffea8;
- wil_details_StagingConfig local_148 [56];
- undefined8 local_110;
- int local_f8;
- undefined1 local_e8 [208];
- ulonglong local_18;
-
- local_18 = __security_cookie ^ (ulonglong)auStackY_178;
- iVar2 = 0;
- _Var4 = 0x58;
- wVar3 = 0;
- memset(local_148,0,0x58);
- lVar1 = wil_details_StagingConfig_Load(local_148,wVar3,_Var4,local_e8,in_stack_fffffffffffffea8);
- if (lVar1 == 0) {
- iVar2 = wil_details_StagingConfig_QueryFeatureState(local_148,param_2,param_3,param_4);
- if (local_f8 != 0) {
- ExFreePoolWithTag(local_110,0x4c4957);
- }
- }
- return iVar2;
-}
-
```
## NTOSKRNL.EXE::ZwQueryWnfStateData
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|ZwQueryWnfStateData|
|fullname|NTOSKRNL.EXE::ZwQueryWnfStateData|
|refcount|4|
|length|0|
|called||
|calling|wil_details_StagingConfig_Load|
|paramcount|0|
|address|EXTERNAL:00000014|
|sig|undefined ZwQueryWnfStateData(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::ZwQueryWnfStateData*
## NTOSKRNL.EXE::RtlNotifyFeatureUsage
### Function Meta
|Key|clfs-10.0.19041.1052.sys|
| :---: | :---: |
|name|RtlNotifyFeatureUsage|
|fullname|NTOSKRNL.EXE::RtlNotifyFeatureUsage|
|refcount|2|
|length|0|
|called||
|calling|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|paramcount|0|
|address|EXTERNAL:00000013|
|sig|undefined RtlNotifyFeatureUsage(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlNotifyFeatureUsage*
# Added
## RtlULongAdd
### Function Meta
|Key|clfs-10.0.19041.1237.sys|
| :---: | :---: |
|name|RtlULongAdd|
|fullname|RtlULongAdd|
|refcount|2|
|length|22|
|called||
|calling|CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor|
|paramcount|3|
|address|1c0001a80|
|sig|long __cdecl RtlULongAdd(ulong param_1, ulong param_2, ulong * param_3)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- RtlULongAdd
+++ RtlULongAdd
@@ -0,0 +1,18 @@
+
+/* long __cdecl RtlULongAdd(unsigned long,unsigned long,unsigned long * __ptr64) */
+
+long __cdecl RtlULongAdd(ulong param_1,ulong param_2,ulong *param_3)
+
+{
+ uint uVar1;
+ uint uVar2;
+
+ uVar1 = param_1 + param_2;
+ uVar2 = 0xffffffff;
+ if (uVar1 >= param_1) {
+ uVar2 = uVar1;
+ }
+ *param_3 = uVar2;
+ return -(uint)(uVar1 < param_1) & 0xc0000095;
+}
+
```
## RtlULongMult
### Function Meta
|Key|clfs-10.0.19041.1237.sys|
| :---: | :---: |
|name|RtlULongMult|
|fullname|RtlULongMult|
|refcount|2|
|length|37|
|called||
|calling|CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor|
|paramcount|3|
|address|1c000ead0|
|sig|long __cdecl RtlULongMult(ulong param_1, ulong param_2, ulong * param_3)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- RtlULongMult
+++ RtlULongMult
@@ -0,0 +1,18 @@
+
+/* long __cdecl RtlULongMult(unsigned long,unsigned long,unsigned long * __ptr64) */
+
+long __cdecl RtlULongMult(ulong param_1,ulong param_2,ulong *param_3)
+
+{
+ ulong uVar1;
+ ulonglong uVar2;
+
+ uVar2 = (ulonglong)param_1 * (ulonglong)param_2;
+ uVar1 = 0xffffffff;
+ if (uVar2 < 0x100000000) {
+ uVar1 = (ulong)uVar2;
+ }
+ *param_3 = uVar1;
+ return -(uint)(0xffffffff < uVar2) & 0xc0000095;
+}
+
```
# Modified
*Modified functions contain code changes*
## CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
### Match Info
|Key|clfs-10.0.19041.1052.sys - clfs-10.0.19041.1237.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.12|
|i_ratio|0.48|
|m_ratio|0.97|
|b_ratio|0.79|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|clfs-10.0.19041.1052.sys|clfs-10.0.19041.1237.sys|
| :---: | :---: | :---: |
|name|ExtendMetadataBlockDescriptor|ExtendMetadataBlockDescriptor|
|fullname|CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor|CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor|
|refcount|3|3|
|`length`|847|907|
|`called`|CClfsBaseFile::GetBaseLogRecord
CClfsBaseFilePersisted::IsShadowBlock
CClfsContainer::GetAlignmentRequirement
ClfsStampLogBlock
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
memcpy
memset|CClfsBaseFile::GetBaseLogRecord
CClfsBaseFilePersisted::IsShadowBlock
CClfsContainer::GetAlignmentRequirement
ClfsStampLogBlock
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
RtlULongAdd
RtlULongMult
memcpy
memset|
|calling|CClfsBaseFilePersisted::ExtendMetadataBlock
CClfsBaseFilePersisted::ProcessCurrentBlockForExtend|CClfsBaseFilePersisted::ExtendMetadataBlock
CClfsBaseFilePersisted::ProcessCurrentBlockForExtend|
|paramcount|3|3|
|`address`|1c004f3d8|1c004e238|
|sig|long __thiscall ExtendMetadataBlockDescriptor(CClfsBaseFilePersisted * this, ulong param_1, ulong param_2)|long __thiscall ExtendMetadataBlockDescriptor(CClfsBaseFilePersisted * this, ulong param_1, ulong param_2)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|
### CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor Called Diff
```diff
--- CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor called
+++ CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor called
@@ -6,0 +7,2 @@
+RtlULongAdd
+RtlULongMult
```
### CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor Diff
```diff
--- CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
+++ CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
@@ -1,147 +1,189 @@
/* private: long __cdecl CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor(unsigned
long,unsigned long) __ptr64 */
long __thiscall
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
(CClfsBaseFilePersisted *this,ulong param_1,ulong param_2)
{
undefined8 *puVar1;
- undefined8 uVar2;
- int iVar3;
- longlong lVar4;
- undefined8 uVar5;
- undefined8 uVar6;
- uchar uVar7;
- ulong uVar8;
+ int iVar2;
+ longlong lVar3;
+ uchar uVar4;
+ long lVar5;
+ ulong uVar6;
+ _CLFS_BASE_RECORD_HEADER *p_Var7;
+ _CLFS_LOG_BLOCK_HEADER *_Dst;
+ ulonglong uVar8;
uint uVar9;
- _CLFS_BASE_RECORD_HEADER *p_Var10;
- _CLFS_LOG_BLOCK_HEADER *_Dst;
- uint uVar11;
CClfsBaseFilePersisted *this_00;
CClfsBaseFilePersisted *this_01;
- uint uVar12;
- void *_Src;
- int iVar13;
- longlong lVar14;
- uint uVar15;
- ulonglong uVar16;
+ uint uVar10;
+ ulonglong uVar11;
+ void *pvVar12;
+ longlong lVar13;
+ uint uVar14;
+ ulonglong uVar15;
+ ulonglong local_res20;
+ void *local_80;
+ uint local_78;
+ uint local_74;
+ void *local_70;
+ _CLFS_LOG_BLOCK_HEADER *local_68;
+ undefined8 local_60;
+ undefined8 uStack_58;
+ undefined8 local_50;
+ undefined8 local_48;
+ undefined8 uStack_40;
- uVar16 = (ulonglong)param_1;
+ uVar15 = (ulonglong)param_1;
_Dst = (_CLFS_LOG_BLOCK_HEADER *)0x0;
- _Src = (void *)0x0;
- iVar13 = 0;
- iVar3 = *(int *)(this + 0x90);
- if (iVar3 == 0) {
- uVar15 = 0;
- }
- else {
- uVar15 = iVar3 + -1 + *(int *)(*(longlong *)(this + 0x30) + 8 + uVar16 * 0x18) + param_2 * 0x200
- & -iVar3;
- }
- lVar14 = *(longlong *)(this + 0x30);
- puVar1 = (undefined8 *)(lVar14 + uVar16 * 0x18);
- uVar5 = *puVar1;
- uVar6 = puVar1[1];
- uVar2 = *(undefined8 *)(lVar14 + 0x10 + uVar16 * 0x18);
- this_00 = (CClfsBaseFilePersisted *)(ulonglong)(param_1 + 1);
- uVar7 = IsShadowBlock(this_00,param_1,param_1 + 1);
- if ((uVar7 == '\0') && (uVar7 = IsShadowBlock(this_00,(ulong)this_00,param_1), uVar7 != '\0')) {
- lVar4 = *(longlong *)(lVar14 + uVar16 * 0x18);
- if (lVar4 != 0) {
- ExFreePoolWithTag(lVar4,0);
- *(undefined8 *)(*(longlong *)(this + 0x30) + uVar16 * 0x18) = 0;
- lVar14 = *(longlong *)(this + 0x30);
- this_00 = (CClfsBaseFilePersisted *)(ulonglong)(param_1 + 1);
- }
- *(undefined4 *)(lVar14 + 8 + uVar16 * 0x18) =
- *(undefined4 *)(lVar14 + 8 + (longlong)this_00 * 0x18);
- this_01 = *(CClfsBaseFilePersisted **)(this + 0x30);
- *(undefined8 *)(this_01 + uVar16 * 0x18) = *(undefined8 *)(this_01 + (longlong)this_00 * 0x18);
- }
- else {
- _Src = *(void **)(lVar14 + uVar16 * 0x18);
- uVar9 = *(uint *)((longlong)_Src + 0x28);
- if ((param_1 == 3) &&
- (this_01 = this, p_Var10 = CClfsBaseFile::GetBaseLogRecord((CClfsBaseFile *)this),
- p_Var10 == (_CLFS_BASE_RECORD_HEADER *)0x0)) {
- iVar13 = -0x3fe5fff3;
- }
- else {
- this_01 = (CClfsBaseFilePersisted *)0x5;
- _Dst = (_CLFS_LOG_BLOCK_HEADER *)ExAllocatePoolWithTag(5,uVar15,0x73666c43);
- if (_Dst == (_CLFS_LOG_BLOCK_HEADER *)0x0) {
- iVar13 = -0x3fffff66;
+ local_68 = (_CLFS_LOG_BLOCK_HEADER *)0x0;
+ pvVar12 = (void *)0x0;
+ local_70 = (void *)0x0;
+ local_60 = 0;
+ uStack_58 = 0;
+ local_50 = 0;
+ local_res20 = local_res20 & 0xffffffff00000000;
+ local_80 = (void *)((ulonglong)local_80 & 0xffffffff00000000);
+ lVar5 = RtlULongMult(param_2,0x200,(ulong *)&local_res20);
+ if (-1 < lVar5) {
+ lVar13 = *(longlong *)(this + 0x30);
+ lVar5 = RtlULongAdd((ulong)local_res20,*(ulong *)(lVar13 + 8 + uVar15 * 0x18),(ulong *)&local_80
+ );
+ if (-1 < lVar5) {
+ iVar2 = *(int *)(this + 0x90);
+ if (iVar2 == 0) {
+ uVar14 = 0;
}
else {
- this_01 = *(CClfsBaseFilePersisted **)(this + 0x98);
- uVar8 = CClfsContainer::GetAlignmentRequirement((CClfsContainer *)this_01);
- if (((ulonglong)_Dst & (ulonglong)uVar8) == 0) {
- uVar11 = *(uint *)(*(longlong *)(this + 0x30) + 8 + uVar16 * 0x18);
- memcpy(_Dst,_Src,(ulonglong)uVar11);
- memset(_Dst + *(uint *)(*(longlong *)(this + 0x30) + 8 + uVar16 * 0x18),0,
- (ulonglong)(uVar15 - uVar11));
- *(short *)(_Dst + 4) = (short)(uVar15 >> 9);
- *(undefined4 *)(_Dst + 0x28) = 0x70;
- memcpy(_Dst + 0x70,(void *)((ulonglong)uVar9 + (longlong)_Src),
- (ulonglong)
- (uint)(*(int *)(*(longlong *)(this + 0x30) + 8 + uVar16 * 0x18) -
- *(int *)((longlong)_Src + 0x28)));
- uVar12 = uVar15 / 0x1fe;
- uVar11 = uVar15 % 0x1fe;
- this_01 = (CClfsBaseFilePersisted *)(ulonglong)uVar11;
- uVar9 = uVar12;
- if (uVar11 != 0) {
- uVar9 = uVar12 + 1;
+ uVar14 = (int)local_80 + -1 + iVar2 & -iVar2;
+ }
+ local_res20 = CONCAT44(local_res20._4_4_,uVar14 >> 9);
+ puVar1 = (undefined8 *)(lVar13 + uVar15 * 0x18);
+ local_60 = *puVar1;
+ uStack_58 = puVar1[1];
+ local_50 = *(undefined8 *)(lVar13 + 0x10 + uVar15 * 0x18);
+ this_00 = (CClfsBaseFilePersisted *)(ulonglong)(param_1 + 1);
+ local_48 = local_60;
+ uStack_40 = uStack_58;
+ uVar4 = IsShadowBlock(this_00,param_1,param_1 + 1);
+ if ((uVar4 == '\0') && (uVar4 = IsShadowBlock(this_00,(ulong)this_00,param_1), uVar4 != '\0'))
+ {
+ lVar3 = *(longlong *)(lVar13 + uVar15 * 0x18);
+ if ((lVar3 != 0) && (lVar3 != *(longlong *)(lVar13 + (longlong)this_00 * 0x18))) {
+ ExFreePoolWithTag(lVar3,0);
+ *(undefined8 *)(*(longlong *)(this + 0x30) + uVar15 * 0x18) = 0;
+ lVar13 = *(longlong *)(this + 0x30);
+ this_00 = (CClfsBaseFilePersisted *)(ulonglong)(param_1 + 1);
+ }
+ *(undefined4 *)(lVar13 + 8 + uVar15 * 0x18) =
+ *(undefined4 *)(lVar13 + 8 + (longlong)this_00 * 0x18);
+ this_01 = *(CClfsBaseFilePersisted **)(this + 0x30);
+ *(undefined8 *)(this_01 + uVar15 * 0x18) =
+ *(undefined8 *)(this_01 + (longlong)this_00 * 0x18);
+ lVar5 = 0;
+ }
+ else {
+ pvVar12 = *(void **)(lVar13 + uVar15 * 0x18);
+ local_80 = (void *)((ulonglong)*(uint *)((longlong)pvVar12 + 0x28) + (longlong)pvVar12);
+ local_70 = pvVar12;
+ if ((param_1 == 3) &&
+ (this_01 = this, p_Var7 = CClfsBaseFile::GetBaseLogRecord((CClfsBaseFile *)this),
+ p_Var7 == (_CLFS_BASE_RECORD_HEADER *)0x0)) {
+ lVar5 = -0x3fe5fff3;
+ }
+ else {
+ this_01 = (CClfsBaseFilePersisted *)0x5;
+ _Dst = (_CLFS_LOG_BLOCK_HEADER *)ExAllocatePoolWithTag(5,uVar14,0x73666c43);
+ local_68 = _Dst;
+ if (_Dst == (_CLFS_LOG_BLOCK_HEADER *)0x0) {
+ lVar5 = -0x3fffff66;
}
- if ((uVar9 * 2 + 7 & 0xfffffff8) < uVar15) {
- if (uVar11 != 0) {
- uVar12 = uVar12 + 1;
+ else {
+ this_01 = *(CClfsBaseFilePersisted **)(this + 0x98);
+ uVar6 = CClfsContainer::GetAlignmentRequirement((CClfsContainer *)this_01);
+ if (((ulonglong)_Dst & (ulonglong)uVar6) == 0) {
+ uVar9 = *(uint *)(*(longlong *)(this + 0x30) + 8 + uVar15 * 0x18);
+ memcpy(_Dst,local_70,(ulonglong)uVar9);
+ memset(_Dst + *(uint *)(*(longlong *)(this + 0x30) + 8 + uVar15 * 0x18),0,
+ (ulonglong)(uVar14 - uVar9));
+ pvVar12 = local_70;
+ *(short *)(_Dst + 4) = (short)local_res20;
+ *(undefined4 *)(_Dst + 0x28) = 0x70;
+ memcpy(_Dst + 0x70,local_80,
+ (ulonglong)
+ (uint)(*(int *)(*(longlong *)(this + 0x30) + 8 + uVar15 * 0x18) -
+ *(int *)((longlong)local_70 + 0x28)));
+ uVar11 = (ulonglong)uVar14 / 0x1fe;
+ uVar10 = (uint)uVar11;
+ uVar9 = uVar14 + uVar10 * -0x1fe;
+ this_01 = (CClfsBaseFilePersisted *)(ulonglong)uVar9;
+ uVar8 = uVar11;
+ local_78 = uVar10;
+ if (uVar9 != 0) {
+ local_78 = uVar10 + 1;
+ uVar8 = (ulonglong)local_78;
+ }
+ local_res20 = uVar8 * 2 + 7 & 0xfffffffffffffff8;
+ if ((uint)local_res20 < uVar14) {
+ local_74 = uVar10;
+ if (uVar9 != 0) {
+ local_74 = uVar10 + 1;
+ uVar11 = (ulonglong)local_74;
+ }
+ local_80 = (void *)(uVar11 * 2 + 7 & 0xfffffffffffffff8);
+ this_01 = (CClfsBaseFilePersisted *)_Dst;
+ ClfsStampLogBlock(_Dst,uVar14 - (int)local_80,*(ulong *)(this + 0x90),
+ (_CLFS_RECORD_HEADER *)0x0);
+ *(uint *)(*(longlong *)(this + 0x30) + 8 + uVar15 * 0x18) = uVar14;
+ *(_CLFS_LOG_BLOCK_HEADER **)(*(longlong *)(this + 0x30) + uVar15 * 0x18) = _Dst;
+ if (param_1 == 3) {
+ this_01 = (CClfsBaseFilePersisted *)(ulonglong)*(uint *)(_Dst + 0x28);
+ *(_CLFS_LOG_BLOCK_HEADER **)(this + 0x40) = _Dst + 0x18 + (longlong)this_01;
+ *(undefined4 *)(this + 0x48) = 0xb;
+ *(CClfsBaseFilePersisted **)(this + 0x50) = this;
+ *(_CLFS_LOG_BLOCK_HEADER **)(this + 0x58) = _Dst + 0x70 + (longlong)this_01;
+ *(undefined4 *)(this + 0x60) = 0xb;
+ *(CClfsBaseFilePersisted **)(this + 0x68) = this;
+ *(_CLFS_LOG_BLOCK_HEADER **)(this + 0x70) = _Dst + 200 + (longlong)this_01;
+ *(undefined4 *)(this + 0x78) = 0xb;
+ *(CClfsBaseFilePersisted **)(this + 0x80) = this;
+ }
+ }
+ else {
+ lVar5 = -0x3fe5fff6;
+ }
}
- this_01 = (CClfsBaseFilePersisted *)_Dst;
- ClfsStampLogBlock(_Dst,uVar15 - (uVar12 * 2 + 7 & 0xfffffff8),*(ulong *)(this + 0x90),
- (_CLFS_RECORD_HEADER *)0x0);
- *(uint *)(*(longlong *)(this + 0x30) + 8 + uVar16 * 0x18) = uVar15;
- *(_CLFS_LOG_BLOCK_HEADER **)(*(longlong *)(this + 0x30) + uVar16 * 0x18) = _Dst;
- if (param_1 == 3) {
- this_01 = (CClfsBaseFilePersisted *)(ulonglong)*(uint *)(_Dst + 0x28);
- *(_CLFS_LOG_BLOCK_HEADER **)(this + 0x40) = _Dst + 0x18 + (longlong)this_01;
- *(undefined4 *)(this + 0x48) = 0xb;
- *(CClfsBaseFilePersisted **)(this + 0x50) = this;
- *(_CLFS_LOG_BLOCK_HEADER **)(this + 0x58) = _Dst + 0x70 + (longlong)this_01;
- *(undefined4 *)(this + 0x60) = 0xb;
- *(CClfsBaseFilePersisted **)(this + 0x68) = this;
- *(_CLFS_LOG_BLOCK_HEADER **)(this + 0x70) = _Dst + 200 + (longlong)this_01;
- *(undefined4 *)(this + 0x78) = 0xb;
- *(CClfsBaseFilePersisted **)(this + 0x80) = this;
- iVar13 = 0;
+ else {
+ lVar5 = -0x3ffffde0;
}
}
- else {
- iVar13 = -0x3fe5fff6;
- }
- }
- else {
- iVar13 = -0x3ffffde0;
}
}
+ if (lVar5 < 0) {
+ if (_Dst != (_CLFS_LOG_BLOCK_HEADER *)0x0) {
+ ExFreePoolWithTag(_Dst,0);
+ }
+ lVar13 = *(longlong *)(this + 0x30);
+ puVar1 = (undefined8 *)(lVar13 + uVar15 * 0x18);
+ *puVar1 = local_48;
+ puVar1[1] = uStack_40;
+ *(undefined8 *)(lVar13 + 0x10 + uVar15 * 0x18) = local_50;
+ return lVar5;
+ }
+ if (pvVar12 == (void *)0x0) {
+ return lVar5;
+ }
+ uVar4 = IsShadowBlock(this_01,param_1,param_1 - 1);
+ if (uVar4 != '\0') {
+ return lVar5;
+ }
+ ExFreePoolWithTag(pvVar12,0);
+ return lVar5;
}
}
- if (iVar13 < 0) {
- if (_Dst != (_CLFS_LOG_BLOCK_HEADER *)0x0) {
- ExFreePoolWithTag(_Dst,0);
- }
- lVar14 = *(longlong *)(this + 0x30);
- puVar1 = (undefined8 *)(lVar14 + uVar16 * 0x18);
- *puVar1 = uVar5;
- puVar1[1] = uVar6;
- *(undefined8 *)(lVar14 + 0x10 + uVar16 * 0x18) = uVar2;
- }
- else if ((_Src != (void *)0x0) &&
- (uVar7 = IsShadowBlock(this_01,param_1,param_1 - 1), uVar7 == '\0')) {
- ExFreePoolWithTag(_Src,0);
- }
- return iVar13;
+ return -0x3fe5fff3;
}
```
## CClfsLogFcbVirtual::Open
### Match Info
|Key|clfs-10.0.19041.1052.sys - clfs-10.0.19041.1237.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.99|
|i_ratio|0.79|
|m_ratio|0.97|
|b_ratio|0.97|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|clfs-10.0.19041.1052.sys|clfs-10.0.19041.1237.sys|
| :---: | :---: | :---: |
|name|Open|Open|
|fullname|CClfsLogFcbVirtual::Open|CClfsLogFcbVirtual::Open|
|refcount|3|3|
|`length`|969|1041|
|`called`|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
NTOSKRNL.EXE::IoCheckShareAccess
NTOSKRNL.EXE::IoSetShareAccess
_guard_dispatch_icall|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
NTOSKRNL.EXE::IoCheckShareAccess
NTOSKRNL.EXE::IoSetShareAccess
NTOSKRNL.EXE::KeBugCheckEx
_guard_dispatch_icall|
|calling|CClfsLogFcbPhysical::OpenClient|CClfsLogFcbPhysical::OpenClient|
|paramcount|11|11|
|`address`|1c0044978|1c00437e8|
|sig|long __thiscall Open(CClfsLogFcbVirtual * this, uchar param_1, IFcbPhysical * param_2, void * param_3, _SECURITY_SUBJECT_CONTEXT * param_4, ulong param_5, ulong param_6, _ACCESS_STATE * param_7, char param_8, _FILE_OBJECT * param_9, CClfsLogCcb * param_10)|long __thiscall Open(CClfsLogFcbVirtual * this, uchar param_1, IFcbPhysical * param_2, void * param_3, _SECURITY_SUBJECT_CONTEXT * param_4, ulong param_5, ulong param_6, _ACCESS_STATE * param_7, char param_8, _FILE_OBJECT * param_9, CClfsLogCcb * param_10)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### CClfsLogFcbVirtual::Open Called Diff
```diff
--- CClfsLogFcbVirtual::Open called
+++ CClfsLogFcbVirtual::Open called
@@ -4,0 +5 @@
+NTOSKRNL.EXE::KeBugCheckEx
```
### CClfsLogFcbVirtual::Open Diff
```diff
--- CClfsLogFcbVirtual::Open
+++ CClfsLogFcbVirtual::Open
@@ -1,171 +1,171 @@
/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
/* public: long __cdecl CClfsLogFcbVirtual::Open(unsigned char,struct IFcbPhysical * __ptr64,void *
__ptr64,struct _SECURITY_SUBJECT_CONTEXT & __ptr64,unsigned long,unsigned long,struct
_ACCESS_STATE * __ptr64,char,struct _FILE_OBJECT * __ptr64,class CClfsLogCcb * __ptr64) __ptr64
*/
long __thiscall
CClfsLogFcbVirtual::Open
(CClfsLogFcbVirtual *this,uchar param_1,IFcbPhysical *param_2,void *param_3,
_SECURITY_SUBJECT_CONTEXT *param_4,ulong param_5,ulong param_6,_ACCESS_STATE *param_7,
char param_8,_FILE_OBJECT *param_9,CClfsLogCcb *param_10)
{
CClfsLogFcbVirtual *pCVar1;
longlong *plVar2;
code *pcVar3;
char cVar4;
char cVar5;
undefined8 uVar6;
longlong lVar7;
undefined7 in_register_00000011;
undefined1 *puVar8;
long lVar9;
CClfsLogCcb *pCVar10;
longlong local_res20;
undefined1 auStack_78 [8];
undefined1 auStack_70 [24];
_ACCESS_STATE *local_58;
char local_50;
undefined1 local_48;
char local_38;
uint local_34;
longlong local_30;
local_res20 = 0;
local_38 = 0;
if (0x5f < (byte)(param_1 - 1)) {
local_58 = (_ACCESS_STATE *)0x0;
/* WARNING: Subroutine does not return */
KeBugCheckEx(0xc1f5,0x1f,param_1,this);
}
cVar4 = ExAcquireResourceExclusiveLite(this + 0xb8,CONCAT71(in_register_00000011,1));
local_38 = cVar4;
if (((byte)this[0x15c] & 1) != 0) {
this[600] = (CClfsLogFcbVirtual)param_1;
*(undefined8 *)(this + 0x220) = *(undefined8 *)(param_9 + 8);
*(IFcbPhysical **)(this + 0x270) = param_2;
(**(code **)(*(longlong *)param_2 + 0x28))(param_2);
(**(code **)(**(longlong **)(this + 0x270) + 0x1c8))(*(longlong **)(this + 0x270),this + 0x38);
(**(code **)(**(longlong **)(this + 0x270) + 0x148))
(*(longlong **)(this + 0x270),this[600],&local_res20);
if (local_res20 == 0) {
pCVar10 = (CClfsLogCcb *)0xc01a000d;
local_34 = 0xc01a000d;
lVar7 = local_res20;
puVar8 = auStack_78;
goto LAB_0;
}
*(undefined2 *)(this + 0x168) = *(undefined2 *)(local_res20 + 10);
*(undefined8 *)(this + 0x1a0) = *(undefined8 *)(local_res20 + 0x20);
*(undefined8 *)(this + 0x1a8) = *(undefined8 *)(local_res20 + 0x28);
*(undefined8 *)(this + 0x1b0) = *(undefined8 *)(local_res20 + 0x30);
*(undefined8 *)(this + 0x1e0) = *(undefined8 *)(local_res20 + 0x40);
*(undefined8 *)(this + 0x1d8) = *(undefined8 *)(local_res20 + 0x48);
*(undefined8 *)(this + 0x1e8) = *(undefined8 *)(local_res20 + 0x50);
*(undefined8 *)(this + 0x1f0) = *(undefined8 *)(local_res20 + 0x58);
*(undefined4 *)(this + 0x16c) = *(undefined4 *)(local_res20 + 0x10);
local_30 = *(longlong *)(local_res20 + 0x60);
if ((*(byte *)(local_res20 + 0x78) & 0x20) != 0) {
*(undefined8 *)(this + 0x1f0) = 0xffffffff00000000;
*(byte *)(local_res20 + 0x78) = *(byte *)(local_res20 + 0x78) & 0xdf;
}
if (local_30 != -0x100000000) {
this[0x278] = (CClfsLogFcbVirtual)0x1;
}
(**(code **)(**(longlong **)(this + 0x270) + 0x150))(*(longlong **)(this + 0x270),&local_res20);
local_34 = (**(code **)(**(longlong **)(this + 0x270) + 0x70))
(*(longlong **)(this + 0x270),this[600],this + 0x1e8);
pCVar10 = (CClfsLogCcb *)(ulonglong)local_34;
lVar7 = local_res20;
puVar8 = auStack_78;
if ((int)local_34 < 0) goto LAB_0;
*(uint *)(this + 0x15c) = *(uint *)(this + 0x15c) | 4;
*(uint *)(this + 0x15c) = *(uint *)(this + 0x15c) & 0xfffffffe;
}
cVar5 = (**(code **)(**(longlong **)(this + 0x270) + 0x40))();
if (cVar5 != '\0') {
local_48 = 1;
local_50 = param_8;
local_58 = param_7;
local_34 = (**(code **)(**(longlong **)(this + 0x270) + 400))
(*(longlong **)(this + 0x270),param_4,param_5,
*(undefined4 *)(param_7 + 0x14));
pCVar10 = (CClfsLogCcb *)(ulonglong)local_34;
lVar7 = local_res20;
puVar8 = auStack_78;
if ((int)local_34 < 0) goto LAB_0;
}
cVar5 = (**(code **)(**(longlong **)(this + 0x270) + 0x38))();
if ((cVar5 == '\0') || ((param_5 & 0x10006) == 0)) {
cVar5 = (**(code **)(*(longlong *)this + 0x158))(this);
if (cVar5 == '\0') {
IoSetShareAccess();
pCVar10 = (CClfsLogCcb *)0x0;
local_34 = 0;
}
else {
local_58 = (_ACCESS_STATE *)CONCAT71(local_58._1_7_,1);
local_34 = IoCheckShareAccess(param_5,param_6,param_9,this + 0x140);
pCVar10 = (CClfsLogCcb *)(ulonglong)local_34;
lVar7 = local_res20;
puVar8 = auStack_78;
if ((int)local_34 < 0) goto LAB_0;
}
lVar7 = local_res20;
puVar8 = auStack_78;
if (-1 < (int)pCVar10) {
pCVar1 = this + 0x180;
pCVar10 = param_10 + 8;
lVar7 = *(longlong *)pCVar1;
if (*(CClfsLogFcbVirtual **)(lVar7 + 8) == pCVar1) {
*(longlong *)pCVar10 = lVar7;
*(CClfsLogFcbVirtual **)(param_10 + 0x10) = pCVar1;
*(CClfsLogCcb **)(lVar7 + 8) = pCVar10;
*(CClfsLogCcb **)pCVar1 = pCVar10;
*(uint *)(param_10 + 0x1c) = *(uint *)(param_10 + 0x1c) | 0x80;
LOCK();
*(int *)(this + 0x164) = *(int *)(this + 0x164) + 1;
UNLOCK();
(**(code **)(*(longlong *)this + 0x40))(this);
*(CClfsLogFcbVirtual **)(param_9 + 0x18) = this + 0x38;
*(CClfsLogCcb **)(param_9 + 0x20) = param_10;
uVar6 = (**(code **)(*(longlong *)this + 0x30))(this);
*(undefined8 *)(param_9 + 0x28) = uVar6;
pCVar10 = (CClfsLogCcb *)(ulonglong)local_34;
lVar7 = local_res20;
puVar8 = auStack_78;
}
else {
lVar7 = 3;
pcVar3 = (code *)swi(0x29);
(*pcVar3)();
puVar8 = auStack_70;
pCVar10 = param_10;
}
}
}
else {
pCVar10 = (CClfsLogCcb *)0xc0000022;
local_34 = 0xc0000022;
lVar7 = local_res20;
puVar8 = auStack_78;
}
LAB_0:
lVar9 = (long)pCVar10;
if (cVar4 != '\0') {
- *(undefined8 *)(puVar8 + -8) = 0x1c0044d10;
+ *(undefined8 *)(puVar8 + -8) = 0x1c0043b80;
ExReleaseResourceForThreadLite(this + 0xb8,SystemReserved1[0xf]);
lVar7 = *(longlong *)(puVar8 + 0x98);
lVar9 = *(long *)(puVar8 + 0x44);
}
if (lVar7 != 0) {
plVar2 = *(longlong **)(this + 0x270);
pcVar3 = *(code **)(*plVar2 + 0x150);
- *(undefined8 *)(puVar8 + -8) = 0x1c004e03b;
+ *(undefined8 *)(puVar8 + -8) = 0x1c004ce9b;
(*pcVar3)(plVar2,puVar8 + 0x98);
}
return lVar9;
}
```
## CClfsBaseFilePersisted::CreateContainer
### Match Info
|Key|clfs-10.0.19041.1052.sys - clfs-10.0.19041.1237.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.78|
|i_ratio|0.72|
|m_ratio|0.99|
|b_ratio|0.99|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|clfs-10.0.19041.1052.sys|clfs-10.0.19041.1237.sys|
| :---: | :---: | :---: |
|name|CreateContainer|CreateContainer|
|fullname|CClfsBaseFilePersisted::CreateContainer|CClfsBaseFilePersisted::CreateContainer|
|refcount|2|2|
|`length`|953|943|
|`called`|Expand for full list:
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::DestroyAbsoluteContainerPath
CClfsBaseFilePersisted::QueryBaseSecurity
CClfsContainer::CClfsContainer
CClfsContainer::Create
CClfsContainer::GetRawSectorSize
CClfsContainer::MarkSystemLogContainer
ClfsFlagOn
ClfsIsContainerPathRelative
ExAllocateFromPagedLookasideList
Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
_guard_dispatch_icall
memcpyExpand for full list:
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::DestroyAbsoluteContainerPath
CClfsBaseFilePersisted::QueryBaseSecurity
CClfsContainer::CClfsContainer
CClfsContainer::Create
CClfsContainer::GetRawSectorSize
CClfsContainer::MarkSystemLogContainer
ClfsFlagOn
ClfsIsContainerPathRelative
ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
_guard_dispatch_icall
memcpyExpand for full list:
CClfsContainer::InitializeFile
CClfsContainer::QueryVolumeInformation
CClfsContainer::SetInformation
ClfsAlignToBoundary
ClfsCreateEventObject
ClfsCreateSaclProtectedLogFile
ClfsFlagOn
ClfsSetThreadImpersonationToken
Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
NTOSKRNL.EXE::FsRtlInitializeExtraCreateParameter
NTOSKRNL.EXE::FsRtlInitializeExtraCreateParameterList
NTOSKRNL.EXE::FsRtlInsertExtraCreateParameter
NTOSKRNL.EXE::IoCreateFileEx
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ZwClose
WPP_SF_slS
WPP_SF_slq
__security_check_cookie
memsetExpand for full list:
CClfsContainer::InitializeFile
CClfsContainer::QueryVolumeInformation
CClfsContainer::SetInformation
ClfsAlignToBoundary
ClfsCreateEventObject
ClfsCreateSaclProtectedLogFile
ClfsFlagOn
ClfsSetThreadImpersonationToken
NTOSKRNL.EXE::FsRtlInitializeExtraCreateParameter
NTOSKRNL.EXE::FsRtlInitializeExtraCreateParameterList
NTOSKRNL.EXE::FsRtlInsertExtraCreateParameter
NTOSKRNL.EXE::IoCreateFileEx
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ZwClose
WPP_SF_slS
WPP_SF_slq
__security_check_cookie
memset
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::LoadContainerQ|CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::LoadContainerQ|
|paramcount|7|7|
|`address`|1c0029d74|1c0028bdc|
|sig|long __thiscall Create(CClfsContainer * this, _UNICODE_STRING * param_1, __uint64 * param_2, _CLFS_FILTER_CONTEXT * param_3, void * param_4, uchar param_5, uchar * param_6)|long __thiscall Create(CClfsContainer * this, _UNICODE_STRING * param_1, __uint64 * param_2, _CLFS_FILTER_CONTEXT * param_3, void * param_4, uchar param_5, uchar * param_6)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|
### CClfsContainer::Create Called Diff
```diff
--- CClfsContainer::Create called
+++ CClfsContainer::Create called
@@ -9 +8,0 @@
-Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
```
### CClfsContainer::Create Diff
```diff
--- CClfsContainer::Create
+++ CClfsContainer::Create
@@ -1,204 +1,206 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* public: long __cdecl CClfsContainer::Create(struct _UNICODE_STRING & __ptr64,unsigned __int64
const & __ptr64,struct _CLFS_FILTER_CONTEXT const & __ptr64,void * __ptr64 const,unsigned
char,unsigned char & __ptr64) __ptr64 */
long __thiscall
CClfsContainer::Create
(CClfsContainer *this,_UNICODE_STRING *param_1,__uint64 *param_2,
_CLFS_FILTER_CONTEXT *param_3,void *param_4,uchar param_5,uchar *param_6)
{
uchar uVar1;
int iVar2;
- int iVar3;
- long lVar4;
- longlong lVar5;
+ long lVar3;
+ longlong lVar4;
+ undefined8 uVar5;
undefined8 uVar6;
- undefined8 uVar7;
+ short sVar7;
ulong uVar8;
undefined1 auStackY_1d8 [32];
undefined8 in_stack_fffffffffffffe48;
undefined4 uVar9;
ulong uVar10;
ulong uVar11;
ulong uVar12;
ulong uVar13;
uchar local_158 [4];
int local_154;
void *local_150;
undefined8 local_148;
undefined8 local_140;
__uint64 local_138;
undefined8 local_130;
uchar *local_128;
CClfsContainer *local_120;
- undefined8 local_118;
+ short local_118 [4];
undefined8 *puStack_110;
longlong local_108;
undefined8 uStack_100;
undefined8 local_f8;
undefined8 local_f0;
undefined8 uStack_e8;
undefined8 local_e0;
undefined4 local_d8;
undefined4 local_d4;
undefined8 local_d0;
_UNICODE_STRING *local_c8;
undefined4 local_c0;
undefined4 local_bc;
void *local_b8;
undefined8 local_b0;
undefined8 local_a8;
undefined8 uStack_a0;
undefined1 local_98 [72];
undefined1 local_50 [8];
ulonglong local_48;
uVar9 = (undefined4)((ulonglong)in_stack_fffffffffffffe48 >> 0x20);
local_48 = __security_cookie ^ (ulonglong)auStackY_1d8;
local_128 = param_6;
local_148 = 0;
local_140 = 0;
local_d4 = 0;
local_bc = 0;
local_154 = 0;
local_158[1] = 0;
local_a8 = 0;
uStack_a0 = 0;
- local_118 = 0;
+ local_118[0] = 0;
+ local_118[1] = 0;
+ local_118[2] = 0;
+ local_118[3] = 0;
puStack_110 = (undefined8 *)0x0;
local_108 = 0;
uStack_100 = 0;
local_f8 = 0;
local_120 = this;
memset(local_98,0,0x48);
local_f0 = 0;
uStack_e8 = 0;
local_e0 = 0;
local_150 = (void *)0x0;
local_158[0] = '\0';
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) {
- WPP_SF_slS(WPP_GLOBAL_Control[3],0xb,&WPP_1b0c927180553b142197ae2fdf68110b_Traceguids,
+ WPP_SF_slS(WPP_GLOBAL_Control[3],0xb,&WPP_866eaa33685f322d6254f9be497f5b75_Traceguids,
"CClfsContainer::Create",CONCAT44(uVar9,0x23f),*(wchar_t **)(param_1 + 8));
}
+ sVar7 = 0;
*param_6 = '\0';
local_d8 = 0x30;
local_d0 = 0;
local_c0 = 0x240;
local_b8 = param_4;
local_b0 = 0;
local_c8 = param_1;
local_138 = ClfsAlignToBoundary(param_2,*(ulong *)(this + 0x44));
- local_118 = CONCAT62(local_118._2_6_,0x28);
+ local_118[0] = sVar7 + 0x28;
local_f8 = 1;
local_108 = *(longlong *)param_3;
if (local_108 != 0) {
iVar2 = FsRtlInitializeExtraCreateParameterList(&local_f0);
local_154 = iVar2;
uVar1 = '\0';
if (iVar2 < 0) goto LAB_0;
- FsRtlInitializeExtraCreateParameter(local_98,0,0,0x48);
+ FsRtlInitializeExtraCreateParameter(local_98,0,0);
iVar2 = FsRtlInsertExtraCreateParameter(&local_f0,local_50);
local_154 = iVar2;
if (iVar2 < 0) goto LAB_0;
puStack_110 = &local_f0;
}
uVar13 = 0x101;
uVar12 = *(ulong *)(param_3 + 0x10);
uVar11 = (ulong)*(undefined8 *)(param_3 + 8);
uVar10 = 0x804e;
uVar8 = (ulong)&local_148;
iVar2 = IoCreateFileEx(this + 0x20,0xc0120000);
local_154 = iVar2;
- iVar3 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled();
- if ((((iVar3 != 0) && (iVar2 == -0x3fffff9f)) && (param_4 != (void *)0x0)) &&
- ((uVar1 = ClfsFlagOn((uint)*(ushort *)((longlong)param_4 + 2),0x2000), uVar1 != '\0' &&
- (lVar4 = ClfsCreateSaclProtectedLogFile
- ((void **)(this + 0x20),&local_150,local_158,uVar8,
- (_OBJECT_ATTRIBUTES *)&local_d8,(_IO_STATUS_BLOCK *)&local_148,
- (_LARGE_INTEGER *)&local_138,(-(uint)(param_5 != '\0') & 6) + 0x2000,
- uVar10,uVar11,uVar12,*(void **)(param_3 + 8),*(ulong *)(param_3 + 0x10),
- uVar13,(_IO_DRIVER_CREATE_CONTEXT *)&local_118), local_154 = iVar2,
- -1 < lVar4)))) {
- iVar2 = lVar4;
- local_154 = lVar4;
+ if ((((iVar2 == -0x3fffff9f) && (param_4 != (void *)0x0)) &&
+ (uVar1 = ClfsFlagOn((uint)*(ushort *)((longlong)param_4 + 2),0x2000), uVar1 != '\0')) &&
+ (lVar3 = ClfsCreateSaclProtectedLogFile
+ ((void **)(this + 0x20),&local_150,local_158,uVar8,
+ (_OBJECT_ATTRIBUTES *)&local_d8,(_IO_STATUS_BLOCK *)&local_148,
+ (_LARGE_INTEGER *)&local_138,(-(uint)(param_5 != '\0') & 6) + 0x2000,uVar10
+ ,uVar11,uVar12,*(void **)(param_3 + 8),*(ulong *)(param_3 + 0x10),uVar13,
+ (_IO_DRIVER_CREATE_CONTEXT *)local_118), local_154 = iVar2, -1 < lVar3)) {
+ iVar2 = lVar3;
+ local_154 = lVar3;
}
if (iVar2 < 0) {
*(undefined8 *)(this + 0x20) = 0;
uVar1 = local_158[0];
}
else {
*(__uint64 *)(this + 8) = *param_2;
local_130 = 0;
- uVar7 = 0;
+ uVar6 = 0;
iVar2 = ObReferenceObjectByHandle(*(undefined8 *)(this + 0x20),0xc0000000,0,0);
*(undefined8 *)(this + 0x30) = local_130;
local_154 = iVar2;
if (iVar2 < 0) {
*(undefined8 *)(this + 0x30) = 0;
uVar1 = local_158[0];
}
else {
- uVar6 = local_130;
- lVar5 = IoGetRelatedDeviceObject();
+ uVar5 = local_130;
+ lVar4 = IoGetRelatedDeviceObject();
uVar1 = local_158[0];
- if (lVar5 == 0) {
+ if (lVar4 == 0) {
iVar2 = -0x3ffffff0;
local_154 = iVar2;
}
- else if (*(int *)(lVar5 + 0x48) == 0x14) {
+ else if (*(int *)(lVar4 + 0x48) == 0x14) {
iVar2 = -0x3fffff45;
local_154 = iVar2;
}
else {
if (*(_KEVENT **)(this + 0x28) == (_KEVENT *)0x0) {
- iVar2 = ClfsCreateEventObject((_EVENT_TYPE)uVar6,(_KEVENT **)(this + 0x28));
+ iVar2 = ClfsCreateEventObject((_EVENT_TYPE)uVar5,(_KEVENT **)(this + 0x28));
local_154 = iVar2;
uVar1 = local_158[0];
if (iVar2 < 0) goto LAB_0;
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) {
- WPP_SF_slq(WPP_GLOBAL_Control[3],0xc,uVar7,"CClfsContainer::Create");
+ WPP_SF_slq(WPP_GLOBAL_Control[3],0xc,uVar6,"CClfsContainer::Create");
}
}
iVar2 = QueryVolumeInformation(this,(_IO_STATUS_BLOCK *)&local_148,&local_a8,0x10,5);
local_154 = iVar2;
if (((iVar2 + 0x80000000U & 0x80000000) != 0) ||
(uVar1 = local_158[0], iVar2 == -0x7ffffffb)) {
uVar1 = ClfsFlagOn((ulong)local_a8,8);
*local_128 = uVar1;
if ((uVar1 == '\0') && (param_4 != (void *)0x0)) {
iVar2 = -0x3fffff29;
local_154 = iVar2;
uVar1 = local_158[0];
}
else {
iVar2 = InitializeFile(this);
local_154 = iVar2;
uVar1 = local_158[0];
}
}
}
}
}
LAB_0:
if (uVar1 != '\0') {
ClfsSetThreadImpersonationToken(local_150);
}
if ((iVar2 < 0) && (*(longlong *)(this + 0x20) != 0)) {
local_158[1] = 1;
SetInformation(this,(_IO_STATUS_BLOCK *)&local_148,local_158 + 1,1,0xd);
if (*(longlong *)(this + 0x30) != 0) {
ObfDereferenceObject();
*(undefined8 *)(this + 0x30) = 0;
}
ZwClose(*(undefined8 *)(this + 0x20));
*(undefined8 *)(this + 0x20) = 0;
*(undefined8 *)(this + 8) = 0;
}
return iVar2;
}
```
## CClfsBaseFile::GetSymbol
### Match Info
|Key|clfs-10.0.19041.1052.sys - clfs-10.0.19041.1237.sys|
| :---: | :---: |
|diff_type|code,length,address|
|ratio|0.95|
|i_ratio|0.37|
|m_ratio|0.96|
|b_ratio|0.52|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|clfs-10.0.19041.1052.sys|clfs-10.0.19041.1237.sys|
| :---: | :---: | :---: |
|name|GetSymbol|GetSymbol|
|fullname|CClfsBaseFile::GetSymbol|CClfsBaseFile::GetSymbol|
|refcount|4|4|
|`length`|168|186|
|called|CClfsBaseFile::OffsetToAddr
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite|CClfsBaseFile::OffsetToAddr
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite|
|calling|CClfsBaseFile::AcquireClientContext
CClfsBaseFile::LoadClientBaseLsn
CClfsBaseFile::ReleaseClientContext|CClfsBaseFile::AcquireClientContext
CClfsBaseFile::LoadClientBaseLsn
CClfsBaseFile::ReleaseClientContext|
|paramcount|4|4|
|`address`|1c0031a68|1c00308c8|
|sig|long __thiscall GetSymbol(CClfsBaseFile * this, long param_1, uchar param_2, _CLFS_CLIENT_CONTEXT * * param_3)|long __thiscall GetSymbol(CClfsBaseFile * this, long param_1, uchar param_2, _CLFS_CLIENT_CONTEXT * * param_3)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|
### CClfsBaseFile::GetSymbol Diff
```diff
--- CClfsBaseFile::GetSymbol
+++ CClfsBaseFile::GetSymbol
@@ -1,38 +1,41 @@
/* public: long __cdecl CClfsBaseFile::GetSymbol(long,unsigned char,struct _CLFS_CLIENT_CONTEXT *
__ptr64 * __ptr64) __ptr64 */
long __thiscall
CClfsBaseFile::GetSymbol
(CClfsBaseFile *this,long param_1,uchar param_2,_CLFS_CLIENT_CONTEXT **param_3)
{
char cVar1;
_CLFS_CLIENT_CONTEXT *p_Var2;
undefined4 in_register_00000014;
long local_38;
local_38 = 0;
+ if ((uint)param_1 < 0x1368) {
+ return -0x3fe5fff3;
+ }
*param_3 = (_CLFS_CLIENT_CONTEXT *)0x0;
cVar1 = ExAcquireResourceSharedLite
(*(undefined8 *)(this + 0x20),
CONCAT71((int7)(CONCAT44(in_register_00000014,param_1) >> 8),1));
p_Var2 = OffsetToAddr(this,param_1);
if (p_Var2 != (_CLFS_CLIENT_CONTEXT *)0x0) {
if (*(int *)(p_Var2 + -0xc) != param_1) {
local_38 = -0x3ffffff8;
goto LAB_0;
}
if (p_Var2[8] == (_CLFS_CLIENT_CONTEXT)param_2) {
*param_3 = p_Var2;
goto LAB_0;
}
}
local_38 = -0x3fe5fff3;
LAB_0:
if (cVar1 != '\0') {
ExReleaseResourceForThreadLite(*(undefined8 *)(this + 0x20),SystemReserved1[0xf]);
}
return local_38;
}
```
## ClfsCreateLogFile
### Match Info
|Key|clfs-10.0.19041.1052.sys - clfs-10.0.19041.1237.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.66|
|i_ratio|0.55|
|m_ratio|1.0|
|b_ratio|0.89|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|clfs-10.0.19041.1052.sys|clfs-10.0.19041.1237.sys|
| :---: | :---: | :---: |
|name|ClfsCreateLogFile|ClfsCreateLogFile|
|fullname|ClfsCreateLogFile|ClfsCreateLogFile|
|refcount|6|6|
|`length`|4409|4390|
|`called`|Expand for full list:
CClfsLogCcb::AddRef
CClfsLogCcb::Release
CClfsLogCcb::SetFileSystemFlag
CClfsLogCcb::SetPhysicalHandle
ClfsCreateSaclProtectedLogFileWithHint
ClfsFlagOn
ClfsSetThreadImpersonationToken
ClfsTokenizeStreamNames
Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoCreateFileSpecifyDeviceObjectHint
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlIsSandboxedToken
NTOSKRNL.EXE::RtlPrefixUnicodeString
NTOSKRNL.EXE::ZwClose
WPP_SF_sdD
WPP_SF_sl
WPP_SF_slDDDDDD
__security_check_cookie
memsetExpand for full list:
CClfsLogCcb::AddRef
CClfsLogCcb::Release
CClfsLogCcb::SetFileSystemFlag
CClfsLogCcb::SetPhysicalHandle
ClfsCreateSaclProtectedLogFileWithHint
ClfsFlagOn
ClfsSetThreadImpersonationToken
ClfsTokenizeStreamNames
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoCreateFileSpecifyDeviceObjectHint
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeStringToString
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlIsSandboxedToken
NTOSKRNL.EXE::RtlPrefixUnicodeString
NTOSKRNL.EXE::ZwClose
WPP_SF_sdD
WPP_SF_sl
WPP_SF_slDDDDDD
__security_check_cookie
memset
ClfsDeleteLogFile|CClfsManagedLog::Initialize
ClfsDeleteLogFile|
|paramcount|11|11|
|`address`|1c0032550|1c00313d0|
|sig|int __fastcall ClfsCreateLogFile(longlong * param_1, _UNICODE_STRING * param_2, ulong param_3, ulong param_4, longlong param_5, ulong param_6, uint param_7, uint param_8, uint param_9, longlong param_10, uint param_11)|int __fastcall ClfsCreateLogFile(longlong * param_1, _UNICODE_STRING * param_2, ulong param_3, ulong param_4, longlong param_5, ulong param_6, uint param_7, uint param_8, uint param_9, longlong param_10, uint param_11)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### ClfsCreateLogFile Called Diff
```diff
--- ClfsCreateLogFile called
+++ ClfsCreateLogFile called
@@ -9 +8,0 @@
-Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
```
### ClfsCreateLogFile Diff
```diff
--- ClfsCreateLogFile
+++ ClfsCreateLogFile
@@ -1,510 +1,506 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
int ClfsCreateLogFile(longlong *param_1,_UNICODE_STRING *param_2,ulong param_3,ulong param_4,
longlong param_5,ulong param_6,uint param_7,uint param_8,uint param_9,
longlong param_10,uint param_11)
{
undefined1 auVar1 [16];
uint uVar2;
char cVar3;
uchar uVar4;
uchar uVar5;
int iVar6;
- int iVar7;
- long lVar8;
- undefined8 uVar9;
- ushort uVar10;
- CClfsLogCcb *pCVar11;
- undefined2 uVar12;
- uint uVar13;
- ulong uVar14;
- ushort uVar15;
- short sVar16;
- uint uVar17;
- longlong lVar18;
- _CLFS_EA *p_Var19;
- longlong *plVar20;
+ long lVar7;
+ undefined8 uVar8;
+ void *_Dst;
+ CClfsLogCcb *pCVar9;
+ undefined2 uVar10;
+ uint uVar11;
+ ulong uVar12;
+ ushort uVar13;
+ short sVar14;
+ uint uVar15;
+ longlong lVar16;
+ _CLFS_EA *p_Var17;
+ longlong *plVar18;
undefined1 auStackY_1f8 [32];
- ulong uVar21;
- undefined4 uVar22;
+ ulong uVar19;
+ undefined4 uVar20;
undefined4 in_stack_fffffffffffffe3c;
uchar local_178;
uchar local_177;
int local_174;
ulong local_170;
longlong *local_168;
ulong local_160;
void *local_158;
ulong local_150;
undefined8 local_148;
void *pvStack_140;
longlong local_138;
void *pvStack_130;
ulong local_128;
longlong local_120;
void *local_118;
void *local_110;
undefined8 local_108;
undefined8 local_100;
undefined8 local_f8;
undefined8 local_f0;
undefined8 local_e8;
undefined8 local_e0;
short local_d8 [8];
undefined4 local_c8;
undefined4 local_c4;
void *local_c0;
short *local_b8;
undefined4 local_b0;
undefined4 local_ac;
longlong local_a8;
undefined8 local_a0;
- longlong local_98;
+ size_t local_98;
longlong local_90;
longlong local_88;
- short local_80;
- short local_7e;
- undefined4 local_7c;
- void *local_78;
- longlong *local_70;
- undefined8 local_68;
+ longlong local_80;
+ short local_78;
+ short local_76;
+ undefined4 local_74;
+ void *local_70;
+ longlong *local_68;
undefined8 local_60;
undefined8 local_58;
- longlong local_50;
- ulonglong local_48;
+ undefined8 local_50;
+ longlong local_48;
+ ulonglong local_40;
- /* 0x32550 10 ClfsCreateLogFile */
- local_48 = __security_cookie ^ (ulonglong)auStackY_1f8;
- local_90 = param_5;
+ /* 0x313d0 10 ClfsCreateLogFile */
+ local_40 = __security_cookie ^ (ulonglong)auStackY_1f8;
+ local_88 = param_5;
local_148 = 0;
pvStack_140 = (void *)0x0;
local_d8[0] = 0;
local_d8[1] = 0;
local_d8[2] = 0;
local_d8[3] = 0;
local_d8[4] = 0;
local_d8[5] = 0;
local_d8[6] = 0;
local_d8[7] = 0;
local_138 = 0;
pvStack_130 = (void *)0x0;
local_e8 = 0;
local_e0 = 0;
local_108 = 0;
local_100 = 0;
local_f8 = 0;
local_f0 = 0;
- local_68 = 0;
local_60 = 0;
local_58 = 0;
local_50 = 0;
+ local_48 = 0;
local_c4 = 0;
local_ac = 0;
local_110 = (void *)0x0;
local_158 = (void *)0x0;
local_120 = 0;
local_118 = (void *)0x0;
local_160 = 0;
local_174 = 0;
local_177 = '\0';
local_178 = '\0';
local_170 = param_3;
local_168 = param_1;
local_150 = param_4;
- local_70 = param_1;
+ local_68 = param_1;
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) {
WPP_SF_slDDDDDD(WPP_GLOBAL_Control[3]);
}
cVar3 = RtlIsSandboxedToken(0,*(undefined1 *)((longlong)SystemReserved1[0xf] + 0x232));
if (cVar3 != '\0') {
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) {
- WPP_SF_sdD(WPP_GLOBAL_Control[3],0x1b,&WPP_f7d0181c99d230095a7fa23347d9439e_Traceguids,
+ WPP_SF_sdD(WPP_GLOBAL_Control[3],0x1b,&WPP_2769d8e43fef30abb70b4cd4a4a77ec0_Traceguids,
"ClfsCreateLogFile");
}
return -0x3fffffde;
}
if (CClfsDriver::m_fInitialized == '\0') {
CClfsDriver::m_fInitialized = '\x01';
}
if ((param_2 == (_UNICODE_STRING *)0x0) || (param_1 == (longlong *)0x0)) {
if ((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return -0x3ffffff3;
}
if ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0) {
return -0x3ffffff3;
}
- uVar12 = 0x1c;
+ uVar10 = 0x1c;
goto LAB_0;
}
if (param_10 == 0) {
LAB_1:
if (param_11 == 0) {
LAB_2:
uVar4 = ClfsFlagOn(param_9,0x40);
uVar2 = param_9 & 0xffffffbf;
if (uVar4 == '\0') {
uVar2 = param_9;
}
- uVar14 = 0x100;
+ uVar12 = 0x100;
local_128 = (-(uint)(uVar4 != '\0') & 0x800) + 0x100;
- uVar17 = uVar2;
+ uVar15 = uVar2;
uVar4 = ClfsFlagOn(uVar2,0x20);
- lVar18 = 0;
+ lVar16 = 0;
if (uVar4 != '\0') {
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) {
- WPP_SF_sdD(WPP_GLOBAL_Control[3],0x1e,&WPP_f7d0181c99d230095a7fa23347d9439e_Traceguids,
+ WPP_SF_sdD(WPP_GLOBAL_Control[3],0x1e,&WPP_2769d8e43fef30abb70b4cd4a4a77ec0_Traceguids,
"ClfsCreateLogFile");
}
return -0x3fffff45;
}
if ((uVar2 != 0) && ((uVar2 & 0x318) == 0)) {
if ((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return -0x3ffffff3;
}
if ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0) {
return -0x3ffffff3;
}
- uVar12 = 0x1f;
+ uVar10 = 0x1f;
goto LAB_0;
}
- uVar4 = ClfsFlagOn(uVar17,0x10);
- if ((uVar4 != '\0') && (uVar5 = ClfsFlagOn(uVar17,uVar14), uVar5 != '\0')) {
+ uVar4 = ClfsFlagOn(uVar15,0x10);
+ if ((uVar4 != '\0') && (uVar5 = ClfsFlagOn(uVar15,uVar12), uVar5 != '\0')) {
if ((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return -0x3ffffff3;
}
if ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0) {
return -0x3ffffff3;
}
- uVar12 = 0x20;
+ uVar10 = 0x20;
goto LAB_0;
}
- p_Var19 = (_CLFS_EA *)0x0;
+ p_Var17 = (_CLFS_EA *)0x0;
if (uVar4 == '\0') goto LAB_3;
- uVar4 = ClfsFlagOn(uVar2,uVar14);
+ uVar4 = ClfsFlagOn(uVar2,uVar12);
if (uVar4 != '\0') {
if ((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return -0x3ffffff3;
}
if ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0) {
return -0x3ffffff3;
}
- uVar12 = 0x21;
+ uVar10 = 0x21;
goto LAB_0;
}
if (param_10 == 0) {
- p_Var19 = (_CLFS_EA *)0x0;
+ p_Var17 = (_CLFS_EA *)0x0;
if (param_11 != 0) {
LAB_4:
if ((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return -0x3ffffff3;
}
if ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0) {
return -0x3ffffff3;
}
- uVar12 = 0x22;
+ uVar10 = 0x22;
goto LAB_0;
}
}
else {
if (param_11 == 0) goto LAB_4;
- local_68 = CONCAT44(0x100000,(int)lVar18);
- local_60 = CONCAT71(local_60._1_7_,(char)lVar18);
- local_58 = CONCAT44(param_11,(uint)local_58) | 0x10;
- local_50 = param_10;
+ local_60 = CONCAT44(0x100000,(int)lVar16);
+ local_58 = CONCAT71(local_58._1_7_,(char)lVar16);
+ local_50 = CONCAT44(param_11,(uint)local_50) | 0x10;
+ local_48 = param_10;
local_160 = 0x20;
- p_Var19 = (_CLFS_EA *)&local_68;
+ p_Var17 = (_CLFS_EA *)&local_60;
}
LAB_3:
- uVar17 = uVar2;
- uVar4 = ClfsFlagOn(uVar2,uVar14);
- if ((uVar4 != '\0') || (uVar5 = ClfsFlagOn(uVar17,0x200), uVar5 != '\0')) {
- uVar17 = (uint)local_58;
+ uVar15 = uVar2;
+ uVar4 = ClfsFlagOn(uVar2,uVar12);
+ if ((uVar4 != '\0') || (uVar5 = ClfsFlagOn(uVar15,0x200), uVar5 != '\0')) {
+ uVar15 = (uint)local_50;
if (uVar4 != '\0') {
if ((param_10 == 0) || (param_11 < 0x18)) {
if ((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return -0x3ffffff3;
}
if ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0) {
return -0x3ffffff3;
}
- uVar12 = 0x23;
+ uVar10 = 0x23;
goto LAB_0;
}
- uVar17 = (uint)local_58 | 0x100;
- }
- local_68 = CONCAT44(0x100000,(int)lVar18);
- local_60 = CONCAT71(local_60._1_7_,(char)lVar18);
+ uVar15 = (uint)local_50 | 0x100;
+ }
+ local_60 = CONCAT44(0x100000,(int)lVar16);
+ local_58 = CONCAT71(local_58._1_7_,(char)lVar16);
uVar4 = ClfsFlagOn(uVar2,0x200);
- uVar13 = uVar17 | 0x200;
+ uVar11 = uVar15 | 0x200;
if (uVar4 == '\0') {
- uVar13 = uVar17;
- }
- local_58 = CONCAT44(param_11,uVar13);
- local_50 = param_10;
- p_Var19 = (_CLFS_EA *)&local_68;
+ uVar11 = uVar15;
+ }
+ local_50 = CONCAT44(param_11,uVar11);
+ local_48 = param_10;
+ p_Var17 = (_CLFS_EA *)&local_60;
local_160 = 0x20;
}
- *param_1 = lVar18;
+ *param_1 = lVar16;
uVar4 = ClfsTokenizeStreamNames
(param_2,(_UNICODE_STRING *)&local_148,(_UNICODE_STRING *)local_d8);
if (uVar4 == '\0') {
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) {
- WPP_SF_sdD(WPP_GLOBAL_Control[3],0x24,&WPP_f7d0181c99d230095a7fa23347d9439e_Traceguids,
+ WPP_SF_sdD(WPP_GLOBAL_Control[3],0x24,&WPP_2769d8e43fef30abb70b4cd4a4a77ec0_Traceguids,
"ClfsCreateLogFile");
}
return -0x3fffffcd;
}
RtlInitUnicodeString(&local_108,L"\\??\\LOG:");
RtlInitUnicodeString(&local_e8,L"LOG:");
cVar3 = RtlPrefixUnicodeString(&local_e8,&local_148,1);
if ((cVar3 != '\0') || (cVar3 = RtlPrefixUnicodeString(&local_108,&local_148), cVar3 != '\0'))
{
- local_7c = 0;
+ local_74 = 0;
cVar3 = RtlPrefixUnicodeString(&local_108,&local_148,1);
- uVar15 = (ushort)local_e8;
+ uVar13 = (ushort)local_e8;
if (cVar3 != '\0') {
- uVar15 = (ushort)local_108;
+ uVar13 = (ushort)local_108;
}
RtlInitUnicodeString(&local_138,L"\\GLOBAL??\\LOG:");
- uVar10 = ((short)local_138 - uVar15) + (short)local_148 + 2;
+ local_98 = (size_t)(ushort)(((short)local_138 - uVar13) + (short)local_148 + 2);
auVar1._8_8_ = 0;
- auVar1._0_8_ = (ulonglong)uVar10 + 1 >> 1;
- uVar9 = SUB168(ZEXT816(2) * auVar1,0);
+ auVar1._0_8_ = local_98 + 1 >> 1;
+ uVar8 = SUB168(ZEXT816(2) * auVar1,0);
if (SUB168(ZEXT816(2) * auVar1,8) != 0) {
- uVar9 = 0xffffffffffffffff;
- }
- local_110 = (void *)ExAllocatePoolWithTag(1,uVar9,0x73666c43);
- if (local_110 == (void *)0x0) {
+ uVar8 = 0xffffffffffffffff;
+ }
+ _Dst = (void *)ExAllocatePoolWithTag(1,uVar8,0x73666c43);
+ local_110 = _Dst;
+ if (_Dst == (void *)0x0) {
if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) {
- WPP_SF_sdD(WPP_GLOBAL_Control[3],0x25,&WPP_f7d0181c99d230095a7fa23347d9439e_Traceguids,
+ WPP_SF_sdD(WPP_GLOBAL_Control[3],0x25,&WPP_2769d8e43fef30abb70b4cd4a4a77ec0_Traceguids,
"ClfsCreateLogFile");
}
return -0x3fffff66;
}
- memset(local_110,0,(ulonglong)uVar10);
- pvStack_130 = local_110;
- local_138 = (ulonglong)CONCAT42((int)((ulonglong)local_138 >> 0x20),uVar10) << 0x10;
- local_78 = (void *)((longlong)pvStack_140 + (ulonglong)(uVar15 >> 1) * 2);
- local_80 = (short)local_148 - uVar15;
- local_7e = local_148._2_2_ - uVar15;
+ memset(_Dst,0,local_98);
+ local_138 = (ulonglong)CONCAT42((int)((ulonglong)local_138 >> 0x20),(short)local_98) << 0x10
+ ;
+ local_70 = (void *)((longlong)pvStack_140 + (ulonglong)(uVar13 >> 1) * 2);
+ local_78 = (short)local_148 - uVar13;
+ local_76 = local_148._2_2_ - uVar13;
+ pvStack_130 = _Dst;
RtlAppendUnicodeToString(&local_138,L"\\GLOBAL??\\LOG:");
- RtlAppendUnicodeStringToString(&local_138,&local_80);
+ RtlAppendUnicodeStringToString(&local_138,&local_78);
RtlAppendUnicodeToString(&local_138,L"");
local_148 = local_138;
pvStack_140 = pvStack_130;
}
- lVar18 = local_90;
+ sVar14 = 0;
local_c8 = 0x30;
local_c0 = (void *)0x0;
local_b0 = 0x242;
local_b8 = (short *)&local_148;
- local_a8 = local_90;
+ local_a8 = local_88;
local_a0 = 0;
- iVar6 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled();
- sVar16 = 0;
- if ((iVar6 != 0) && (lVar18 != 0)) {
- sVar16 = 0;
- local_177 = ClfsFlagOn((uint)*(ushort *)(lVar18 + 2),0x2000);
- }
- if (local_d8[0] == sVar16) {
- uVar21 = local_150;
+ if (local_88 != 0) {
+ sVar14 = 0;
+ local_177 = ClfsFlagOn((uint)*(ushort *)(local_88 + 2),0x2000);
+ }
+ if (local_d8[0] == sVar14) {
+ uVar19 = local_150;
iVar6 = IoCreateFileSpecifyDeviceObjectHint(&local_158,local_170,&local_c8,&local_f8);
+ uVar12 = local_170;
+ if ((((iVar6 == -0x3fffff9f) && (local_177 != '\0')) && (param_6 - 2 < 2)) &&
+ (local_174 = iVar6,
+ lVar7 = ClfsCreateSaclProtectedLogFileWithHint
+ (&local_158,&local_118,&local_178,local_170,
+ (_OBJECT_ATTRIBUTES *)&local_c8,(_IO_STATUS_BLOCK *)&local_f8,
+ (_LARGE_INTEGER *)CONCAT44(in_stack_fffffffffffffe3c,uVar19),
+ param_8 | 0x180,local_150,param_6,param_7 | 0x8040,p_Var17,local_160,
+ local_128), -1 < lVar7)) {
+ iVar6 = lVar7;
+ }
local_174 = iVar6;
- iVar7 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled();
- uVar14 = local_170;
- if ((((iVar7 != 0) && (iVar6 == -0x3fffff9f)) && (local_177 != '\0')) &&
- ((param_6 - 2 < 2 &&
- (lVar8 = ClfsCreateSaclProtectedLogFileWithHint
- (&local_158,&local_118,&local_178,local_170,
- (_OBJECT_ATTRIBUTES *)&local_c8,(_IO_STATUS_BLOCK *)&local_f8,
- (_LARGE_INTEGER *)CONCAT44(in_stack_fffffffffffffe3c,uVar21),
- param_8 | 0x180,local_150,param_6,param_7 | 0x8040,p_Var19,local_160
- ,local_128), local_174 = iVar6, -1 < lVar8)))) {
- iVar6 = lVar8;
- local_174 = lVar8;
- }
if (iVar6 < 0) {
- plVar20 = local_168;
+ plVar18 = local_168;
if (((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0))
goto LAB_5;
- uVar12 = 0x26;
+ uVar10 = 0x26;
LAB_6:
- WPP_SF_sdD(WPP_GLOBAL_Control[3],uVar12,&WPP_f7d0181c99d230095a7fa23347d9439e_Traceguids,
+ iVar6 = local_174;
+ WPP_SF_sdD(WPP_GLOBAL_Control[3],uVar10,&WPP_2769d8e43fef30abb70b4cd4a4a77ec0_Traceguids,
"ClfsCreateLogFile");
- plVar20 = local_168;
+ plVar18 = local_168;
goto LAB_5;
}
- local_98 = 0;
- iVar6 = ObReferenceObjectByHandle(local_158,uVar14,0,0);
- plVar20 = local_168;
- *local_168 = local_98;
+ local_90 = 0;
+ iVar6 = ObReferenceObjectByHandle(local_158,uVar12,0,0);
+ plVar18 = local_168;
+ *local_168 = local_90;
local_174 = iVar6;
if (iVar6 < 0) {
if (((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0))
goto LAB_5;
- uVar12 = 0x27;
+ uVar10 = 0x27;
LAB_7:
- plVar20 = local_168;
+ plVar18 = local_168;
local_174 = iVar6;
- WPP_SF_sdD(WPP_GLOBAL_Control[3],uVar12,&WPP_f7d0181c99d230095a7fa23347d9439e_Traceguids,
+ WPP_SF_sdD(WPP_GLOBAL_Control[3],uVar10,&WPP_2769d8e43fef30abb70b4cd4a4a77ec0_Traceguids,
"ClfsCreateLogFile");
goto LAB_5;
}
ObfDereferenceObject();
- pCVar11 = *(CClfsLogCcb **)(*plVar20 + 0x20);
- CClfsLogCcb::AddRef(pCVar11);
- CClfsLogCcb::SetPhysicalHandle(pCVar11,local_158);
- CClfsLogCcb::Release(pCVar11);
+ pCVar9 = *(CClfsLogCcb **)(*plVar18 + 0x20);
+ CClfsLogCcb::AddRef(pCVar9);
+ CClfsLogCcb::SetPhysicalHandle(pCVar9,local_158);
+ CClfsLogCcb::Release(pCVar9);
}
else {
if (param_6 == 1) {
ClfsFlagOn(local_170,0x10000);
iVar6 = IoCreateFileSpecifyDeviceObjectHint(&local_158,0xc0010000,&local_c8,&local_f8);
local_174 = iVar6;
if (((iVar6 < 0) && ((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) {
- uVar12 = 0x28;
+ uVar10 = 0x28;
LAB_8:
- WPP_SF_sdD(WPP_GLOBAL_Control[3],uVar12,&WPP_f7d0181c99d230095a7fa23347d9439e_Traceguids
+ iVar6 = local_174;
+ WPP_SF_sdD(WPP_GLOBAL_Control[3],uVar10,&WPP_2769d8e43fef30abb70b4cd4a4a77ec0_Traceguids
,"ClfsCreateLogFile");
}
}
else {
if (1 < param_6 - 2) {
iVar6 = -0x3fffff45;
local_174 = -0x3fffff45;
- plVar20 = local_168;
+ plVar18 = local_168;
if (((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0))
goto LAB_5;
- uVar12 = 0x2a;
- iVar6 = -0x3fffff45;
+ uVar10 = 0x2a;
goto LAB_6;
}
- uVar22 = 7;
+ uVar20 = 7;
iVar6 = IoCreateFileSpecifyDeviceObjectHint(&local_158,0xc0010000,&local_c8,&local_f8);
local_174 = iVar6;
- iVar7 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled();
- if (((iVar7 != 0) && (local_177 != '\0')) &&
- ((iVar6 == -0x3fffff9f &&
- (lVar8 = ClfsCreateSaclProtectedLogFileWithHint
- (&local_158,&local_118,&local_178,0xc0010000,
- (_OBJECT_ATTRIBUTES *)&local_c8,(_IO_STATUS_BLOCK *)&local_f8,
- (_LARGE_INTEGER *)CONCAT44(in_stack_fffffffffffffe3c,uVar22),
- param_7 & 0x20 | 0x80,7,3,param_7 | 3,p_Var19,local_160,0x101),
- local_174 = iVar6, -1 < lVar8)))) {
- iVar6 = lVar8;
- local_174 = lVar8;
- }
- if (((iVar6 < 0) && ((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) &&
+ if (((local_177 != '\0') && (iVar6 == -0x3fffff9f)) &&
+ (lVar7 = ClfsCreateSaclProtectedLogFileWithHint
+ (&local_158,&local_118,&local_178,0xc0010000,
+ (_OBJECT_ATTRIBUTES *)&local_c8,(_IO_STATUS_BLOCK *)&local_f8,
+ (_LARGE_INTEGER *)CONCAT44(in_stack_fffffffffffffe3c,uVar20),
+ param_7 & 0x20 | 0x80,7,3,param_7 | 3,p_Var17,local_160,0x101),
+ local_174 = iVar6, -1 < lVar7)) {
+ local_174 = lVar7;
+ }
+ iVar6 = local_174;
+ if (((local_174 < 0) && ((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) {
- uVar12 = 0x29;
+ uVar10 = 0x29;
goto LAB_8;
}
}
- uVar14 = local_170;
- plVar20 = local_168;
+ uVar12 = local_170;
+ plVar18 = local_168;
if (iVar6 < 0) goto LAB_5;
local_c8 = 0x30;
local_c0 = local_158;
local_b0 = 0x242;
local_b8 = local_d8;
- local_a8 = local_90;
+ local_a8 = local_88;
local_a0 = 0;
iVar6 = IoCreateFileSpecifyDeviceObjectHint(&local_120,local_170,&local_c8,&local_f8);
local_174 = iVar6;
if (iVar6 < 0) {
- plVar20 = local_168;
+ plVar18 = local_168;
if (((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0))
goto LAB_5;
- uVar12 = 0x2b;
+ uVar10 = 0x2b;
goto LAB_6;
}
- local_88 = 0;
- iVar6 = ObReferenceObjectByHandle(local_120,uVar14,0,0);
- plVar20 = local_168;
- *local_168 = local_88;
+ local_80 = 0;
+ iVar6 = ObReferenceObjectByHandle(local_120,uVar12,0,0);
+ plVar18 = local_168;
+ *local_168 = local_80;
local_174 = iVar6;
if (iVar6 < 0) {
if (((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0))
goto LAB_5;
- uVar12 = 0x2c;
+ uVar10 = 0x2c;
goto LAB_7;
}
ObfDereferenceObject();
}
- pCVar11 = *(CClfsLogCcb **)(*plVar20 + 0x20);
- CClfsLogCcb::AddRef(pCVar11);
- uVar14 = 8;
+ pCVar9 = *(CClfsLogCcb **)(*plVar18 + 0x20);
+ CClfsLogCcb::AddRef(pCVar9);
+ uVar12 = 8;
uVar4 = ClfsFlagOn(uVar2,8);
if ((((uVar4 != '\0') &&
- (iVar6 = CClfsLogCcb::SetFileSystemFlag(pCVar11,uVar14), local_174 = iVar6, iVar6 < 0))
- && ((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) &&
+ (iVar6 = CClfsLogCcb::SetFileSystemFlag(pCVar9,uVar12), local_174 = iVar6, iVar6 < 0)) &&
+ ((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) &&
((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) {
- WPP_SF_sdD(WPP_GLOBAL_Control[3],0x2d,&WPP_f7d0181c99d230095a7fa23347d9439e_Traceguids,
+ WPP_SF_sdD(WPP_GLOBAL_Control[3],0x2d,&WPP_2769d8e43fef30abb70b4cd4a4a77ec0_Traceguids,
"ClfsCreateLogFile");
}
- CClfsLogCcb::SetPhysicalHandle(pCVar11,local_158);
+ CClfsLogCcb::SetPhysicalHandle(pCVar9,local_158);
if (local_120 - 1U < 0xfffffffffffffffe) {
- *(longlong *)(pCVar11 + 0x38) = local_120;
- }
- CClfsLogCcb::Release(pCVar11);
+ *(longlong *)(pCVar9 + 0x38) = local_120;
+ }
+ CClfsLogCcb::Release(pCVar9);
LAB_5:
- iVar7 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled();
- if ((iVar7 != 0) && (local_178 != '\0')) {
+ if (local_178 != '\0') {
ClfsSetThreadImpersonationToken(local_118);
}
if (iVar6 < 0) {
if (local_120 != 0) {
ZwClose();
}
if (local_158 != (void *)0x0) {
ZwClose();
}
- *plVar20 = 0;
+ *plVar18 = 0;
}
if (local_110 != (void *)0x0) {
ExFreePoolWithTag(local_110,0);
}
if (iVar6 < 0) {
return iVar6;
}
if ((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return iVar6;
}
if ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0) {
- WPP_SF_sl(WPP_GLOBAL_Control[3],0x2e,&WPP_f7d0181c99d230095a7fa23347d9439e_Traceguids,
+ WPP_SF_sl(WPP_GLOBAL_Control[3],0x2e,&WPP_2769d8e43fef30abb70b4cd4a4a77ec0_Traceguids,
"ClfsCreateLogFile");
return iVar6;
}
return iVar6;
}
}
else if (param_11 != 0) {
if (param_10 == 0) goto LAB_1;
goto LAB_2;
}
if ((undefined8 **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return -0x3ffffff3;
}
if ((*(uint *)((longlong)WPP_GLOBAL_Control + 0x2c) & 0x4000000) == 0) {
return -0x3ffffff3;
}
- uVar12 = 0x1d;
+ uVar10 = 0x1d;
LAB_0:
- WPP_SF_sdD(WPP_GLOBAL_Control[3],uVar12,&WPP_f7d0181c99d230095a7fa23347d9439e_Traceguids,
+ WPP_SF_sdD(WPP_GLOBAL_Control[3],uVar10,&WPP_2769d8e43fef30abb70b4cd4a4a77ec0_Traceguids,
"ClfsCreateLogFile");
return -0x3ffffff3;
}
```
## CClfsBaseFile::GetSymbol
### Match Info
|Key|clfs-10.0.19041.1052.sys - clfs-10.0.19041.1237.sys|
| :---: | :---: |
|diff_type|code,length,address|
|ratio|0.96|
|i_ratio|0.21|
|m_ratio|0.97|
|b_ratio|0.68|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|clfs-10.0.19041.1052.sys|clfs-10.0.19041.1237.sys|
| :---: | :---: | :---: |
|name|GetSymbol|GetSymbol|
|fullname|CClfsBaseFile::GetSymbol|CClfsBaseFile::GetSymbol|
|refcount|12|12|
|`length`|227|246|
|called|CClfsBaseFile::GetBaseLogRecord
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
ULongAdd|CClfsBaseFile::GetBaseLogRecord
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
ULongAdd|
|calling|CClfsBaseFile::AcquireContainerContext
CClfsBaseFile::ReleaseContainerContext
CClfsBaseFile::ScanContainerInfo
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::RemoveContainer
CClfsBaseFilePersisted::ResetContainerQ
CClfsBaseFilePersisted::UnloadContainerQ
CClfsBaseFileSnapshot::ReadContainerQ|CClfsBaseFile::AcquireContainerContext
CClfsBaseFile::ReleaseContainerContext
CClfsBaseFile::ScanContainerInfo
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::RemoveContainer
CClfsBaseFilePersisted::ResetContainerQ
CClfsBaseFilePersisted::UnloadContainerQ
CClfsBaseFileSnapshot::ReadContainerQ|
|paramcount|4|4|
|`address`|1c0032420|1c0031290|
|sig|long __thiscall GetSymbol(CClfsBaseFile * this, long param_1, ulong param_2, _CLFS_CONTAINER_CONTEXT * * param_3)|long __thiscall GetSymbol(CClfsBaseFile * this, long param_1, ulong param_2, _CLFS_CONTAINER_CONTEXT * * param_3)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|
### CClfsBaseFile::GetSymbol Diff
```diff
--- CClfsBaseFile::GetSymbol
+++ CClfsBaseFile::GetSymbol
@@ -1,46 +1,49 @@
/* public: long __cdecl CClfsBaseFile::GetSymbol(long,unsigned long,struct _CLFS_CONTAINER_CONTEXT *
__ptr64 * __ptr64) __ptr64 */
long __thiscall
CClfsBaseFile::GetSymbol
(CClfsBaseFile *this,long param_1,ulong param_2,_CLFS_CONTAINER_CONTEXT **param_3)
{
char cVar1;
long lVar2;
_CLFS_BASE_RECORD_HEADER *p_Var3;
undefined4 in_register_00000014;
longlong lVar4;
long local_28;
ulong local_24 [3];
local_28 = 0;
+ if ((uint)param_1 < 0x1368) {
+ return -0x3fe5fff3;
+ }
*param_3 = (_CLFS_CONTAINER_CONTEXT *)0x0;
cVar1 = ExAcquireResourceSharedLite
(*(undefined8 *)(this + 0x20),
CONCAT71((int7)(CONCAT44(in_register_00000014,param_1) >> 8),1));
lVar4 = *(longlong *)(*(longlong *)(this + 0x30) + 0x30);
p_Var3 = GetBaseLogRecord(this);
local_24[0] = 0;
lVar2 = ULongAdd(param_1,*(ulong *)(lVar4 + 0x28),local_24);
if ((((-1 < lVar2) && (p_Var3 != (_CLFS_BASE_RECORD_HEADER *)0x0)) &&
(local_24[0] < (uint)*(ushort *)(lVar4 + 4) << 9)) &&
(p_Var3 = p_Var3 + (uint)param_1, p_Var3 != (_CLFS_BASE_RECORD_HEADER *)0x0)) {
if (*(int *)(p_Var3 + -0xc) != param_1) {
local_28 = -0x3ffffff8;
goto LAB_0;
}
if (*(ulong *)(p_Var3 + 0x10) == param_2) {
*param_3 = (_CLFS_CONTAINER_CONTEXT *)p_Var3;
goto LAB_0;
}
}
local_28 = -0x3fe5fff3;
LAB_0:
if (cVar1 != '\0') {
ExReleaseResourceForThreadLite(*(undefined8 *)(this + 0x20),SystemReserved1[0xf]);
}
return local_28;
}
```
## ClfsCreateLogFile$fin$0
### Match Info
|Key|clfs-10.0.19041.1052.sys - clfs-10.0.19041.1237.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.83|
|i_ratio|0.68|
|m_ratio|0.96|
|b_ratio|0.93|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|clfs-10.0.19041.1052.sys|clfs-10.0.19041.1237.sys|
| :---: | :---: | :---: |
|name|ClfsCreateLogFile$fin$0|ClfsCreateLogFile$fin$0|
|fullname|ClfsCreateLogFile$fin$0|ClfsCreateLogFile$fin$0|
|refcount|1|1|
|`length`|149|140|
|`called`|ClfsSetThreadImpersonationToken
Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ZwClose|ClfsSetThreadImpersonationToken
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ZwClose|
|calling|||
|paramcount|2|2|
|`address`|1c0047c0a|1c0046a7a|
|sig|undefined __fastcall ClfsCreateLogFile$fin$0(undefined8 param_1, longlong param_2)|undefined __fastcall ClfsCreateLogFile$fin$0(undefined8 param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### ClfsCreateLogFile$fin$0 Called Diff
```diff
--- ClfsCreateLogFile$fin$0 called
+++ ClfsCreateLogFile$fin$0 called
@@ -2 +1,0 @@
-Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled
```
### ClfsCreateLogFile$fin$0 Diff
```diff
--- ClfsCreateLogFile$fin$0
+++ ClfsCreateLogFile$fin$0
@@ -1,25 +1,22 @@
void ClfsCreateLogFile_fin_0(undefined8 param_1,longlong param_2)
{
- int iVar1;
-
- iVar1 = Feature_Servicing_2103c_ClfsStatusPrivilegeNotHeld_31093721__private_IsEnabled();
- if ((iVar1 != 0) && (*(char *)(param_2 + 0x80) != '\0')) {
+ if (*(char *)(param_2 + 0x80) != '\0') {
ClfsSetThreadImpersonationToken(*(void **)(param_2 + 0xe0));
}
if (*(int *)(param_2 + 0x84) < 0) {
if (*(longlong *)(param_2 + 0xd8) != 0) {
ZwClose();
}
if (*(longlong *)(param_2 + 0xa0) != 0) {
ZwClose();
}
- **(undefined8 **)(param_2 + 0x188) = 0;
+ **(undefined8 **)(param_2 + 400) = 0;
}
if (*(longlong *)(param_2 + 0xe8) != 0) {
ExFreePoolWithTag(*(longlong *)(param_2 + 0xe8),0);
}
return;
}
```
# Modified (No Code Changes)
*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname
## __GSHandlerCheck
### Match Info
|Key|clfs-10.0.19041.1052.sys - clfs-10.0.19041.1237.sys|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|0.88|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|clfs-10.0.19041.1052.sys|clfs-10.0.19041.1237.sys|
| :---: | :---: | :---: |
|name|__GSHandlerCheck|__GSHandlerCheck|
|fullname|__GSHandlerCheck|__GSHandlerCheck|
|`refcount`|16|12|
|length|29|29|
|called|__GSHandlerCheckCommon|__GSHandlerCheckCommon|
|calling|||
|paramcount|4|4|
|`address`|1c000cfb8|1c000c288|
|sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
## NTOSKRNL.EXE::RtlQueryFeatureConfiguration
### Match Info
|Key|clfs-10.0.19041.1052.sys - clfs-10.0.19041.1237.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|
### Function Meta Diff
|Key|clfs-10.0.19041.1052.sys|clfs-10.0.19041.1237.sys|
| :---: | :---: | :---: |
|name|RtlQueryFeatureConfiguration|RtlQueryFeatureConfiguration|
|fullname|NTOSKRNL.EXE::RtlQueryFeatureConfiguration|NTOSKRNL.EXE::RtlQueryFeatureConfiguration|
|`refcount`|4|3|
|length|0|0|
|called|||
|`calling`|wil_RtlStagingConfig_QueryFeatureState
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates|wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates|
|paramcount|0|0|
|address|EXTERNAL:00000004|EXTERNAL:00000004|
|sig|undefined RtlQueryFeatureConfiguration(void)|undefined RtlQueryFeatureConfiguration(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|
### NTOSKRNL.EXE::RtlQueryFeatureConfiguration Calling Diff
```diff
--- NTOSKRNL.EXE::RtlQueryFeatureConfiguration calling
+++ NTOSKRNL.EXE::RtlQueryFeatureConfiguration calling
@@ -1 +0,0 @@
-wil_RtlStagingConfig_QueryFeatureState
```
## __security_check_cookie
### Match Info
|Key|clfs-10.0.19041.1052.sys - clfs-10.0.19041.1237.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.5|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|clfs-10.0.19041.1052.sys|clfs-10.0.19041.1237.sys|
| :---: | :---: | :---: |
|name|__security_check_cookie|__security_check_cookie|
|fullname|__security_check_cookie|__security_check_cookie|
|`refcount`|27|23|
|length|30|30|
|called|__report_gsfailure|__report_gsfailure|
|`calling`|Expand for full list:
CClfsBaseFile::InitializeGlobals
CClfsContainer::Create
CClfsContainer::GetRawSectorSize
CClfsContainer::Open
CClfsContainer::QueryContainerInfo
CClfsKernelMarshallingContext::Initialize
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsManagedLog::FixupContainerName
CClfsManagedLog::QueryLogBoundaryLsns
CClfsManagedLog::QueryLogContainerSize
CClfsManagedLog::QueryLogEphemeral
CClfsManagedLog::QueryLogSize
CClfsManagedLogClient::Initialize
CClfsRequest::GetIoStatistics
ClfsCreateLogFile
ClfsEnableThreadPrivilege
ClfsGetIoStatistics
__GSHandlerCheckCommon
wil_RtlStagingConfig_QueryFeatureState
wil_StagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_StagingConfig_Load
wil_details_UpdateFeatureConfiguredStatesExpand for full list:
CClfsBaseFile::InitializeGlobals
CClfsContainer::Create
CClfsContainer::GetRawSectorSize
CClfsContainer::Open
CClfsContainer::QueryContainerInfo
CClfsKernelMarshallingContext::Initialize
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsManagedLog::FixupContainerName
CClfsManagedLog::QueryLogBoundaryLsns
CClfsManagedLog::QueryLogContainerSize
CClfsManagedLog::QueryLogEphemeral
CClfsManagedLog::QueryLogSize
CClfsManagedLogClient::Initialize
CClfsRequest::GetIoStatistics
ClfsCreateLogFile
ClfsEnableThreadPrivilege
ClfsGetIoStatistics
__GSHandlerCheckCommon
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStatesExpand for full list:
CClfsBaseFilePersisted::AddClient
CClfsBaseFilePersisted::AllocSymbol
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsContainer::Create
CClfsContainer::InitializeGlobals
CClfsContainer::Open
CClfsContainer::WriteSector
CClfsDriver::ReadRegistry
CClfsDriver::SetIrpFunctions
CClfsKernelMarshallingContext::AllocateIocb
CClfsKernelMarshallingContext::AppendRecord
CClfsKernelMarshallingContext::FormatWriteBlock
CClfsKernelMarshallingContext::Initialize
CClfsLogFcbCommon::CClfsLogFcbCommon
CClfsLogFcbPhysical::CClfsLogFcbPhysical
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CreateBaseFileName
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryLogFileInfo
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::TruncateLogDiscardBlocks
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::Initialize
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::QueryLogBoundaryLsns
CClfsManagedLog::QueryLogContainerSize
CClfsManagedLog::QueryLogEphemeral
CClfsManagedLog::QueryLogSize
CClfsManagedLogClientUser::Initialize
CClfsRequest::CreateReadCompletionElement
CClfsRequest::GetContainerName
CClfsRequest::GetIoStatistics
CClfsRequest::ReserveAndAppendLog
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsGetContainerName
ClfsInitializeEventLog
ClfsInitializeOwnerPage
WppTraceCallback
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
wil_StagingConfig_QueryFeatureState
wil_details_StagingConfig_LoadExpand for full list:
CClfsBaseFilePersisted::AddClient
CClfsBaseFilePersisted::AllocSymbol
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsContainer::Create
CClfsContainer::InitializeGlobals
CClfsContainer::Open
CClfsContainer::WriteSector
CClfsDriver::ReadRegistry
CClfsDriver::SetIrpFunctions
CClfsKernelMarshallingContext::AllocateIocb
CClfsKernelMarshallingContext::AppendRecord
CClfsKernelMarshallingContext::FormatWriteBlock
CClfsKernelMarshallingContext::Initialize
CClfsLogFcbCommon::CClfsLogFcbCommon
CClfsLogFcbPhysical::CClfsLogFcbPhysical
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CreateBaseFileName
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryLogFileInfo
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::TruncateLogDiscardBlocks
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::Initialize
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::QueryLogBoundaryLsns
CClfsManagedLog::QueryLogContainerSize
CClfsManagedLog::QueryLogEphemeral
CClfsManagedLog::QueryLogSize
CClfsManagedLogClientUser::Initialize
CClfsRequest::CreateReadCompletionElement
CClfsRequest::GetContainerName
CClfsRequest::GetIoStatistics
CClfsRequest::ReserveAndAppendLog
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsGetContainerName
ClfsInitializeEventLog
ClfsInitializeOwnerPage
WppTraceCallback
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0Expand for full list:
CClfsBaseFile::InitializeGlobals
CClfsBaseFile::InitializeImageResource
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::QueryContainerSecurity
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptor
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsContainer::InitializeGlobals
CClfsContainer::WriteSector
CClfsDriver::Initialize
CClfsDriver::SetIrpFunctions
CClfsKernelMarshallingContext::Initialize
CClfsLogFcbCommon::InstallObserver
CClfsLogFcbPhysical::AddArchiveRef
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CreateBaseFileName
CClfsLogFcbPhysical::EraseClientBlocks
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateRegionBlocks
CClfsManagedLog::AddNewClient
CClfsManagedLog::AllocateAndBuildContainerNameTemplate
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::Initialize
CClfsManagedLog::InstallDefaultNewContainerNamePolicies
CClfsManagedLog::InstallPolicy
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::QueueAutoGrowWorker
CClfsManagedLogClientUser::CreateNotification
CClfsManagedLogClientUser::DeliverNotification
CClfsManagedLogCollection::AddNewManagedLog
CClfsManagedLogCollection::AllocateAndQueryPhysicalLogName
CClfsRequest::InitializeGlobals
CClfsRequest::ReserveAndAppendLog
CClfsRequest::WriteRestart
CDynamicLsnQ::Initialize
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsCreateMarshallingAreaInternal
ClfsCreateScanContext
ClfsEnableThreadPrivilege
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
wil_details_StagingConfig_LoadExpand for full list:
CClfsBaseFile::InitializeGlobals
CClfsBaseFile::InitializeImageResource
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::QueryContainerSecurity
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptor
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsContainer::InitializeGlobals
CClfsContainer::WriteSector
CClfsDriver::Initialize
CClfsDriver::SetIrpFunctions
CClfsKernelMarshallingContext::Initialize
CClfsLogFcbCommon::InstallObserver
CClfsLogFcbPhysical::AddArchiveRef
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CreateBaseFileName
CClfsLogFcbPhysical::EraseClientBlocks
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateRegionBlocks
CClfsManagedLog::AddNewClient
CClfsManagedLog::AllocateAndBuildContainerNameTemplate
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::Initialize
CClfsManagedLog::InstallDefaultNewContainerNamePolicies
CClfsManagedLog::InstallPolicy
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::QueueAutoGrowWorker
CClfsManagedLogClientUser::CreateNotification
CClfsManagedLogClientUser::DeliverNotification
CClfsManagedLogCollection::AddNewManagedLog
CClfsManagedLogCollection::AllocateAndQueryPhysicalLogName
CClfsRequest::InitializeGlobals
CClfsRequest::ReserveAndAppendLog
CClfsRequest::WriteRestart
CDynamicLsnQ::Initialize
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsCreateMarshallingAreaInternal
ClfsCreateScanContext
ClfsEnableThreadPrivilege
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0Expand for full list:
CClfsBaseFile::InitializeGlobals
CClfsBaseFile::`scalar_deleting_destructor'
CClfsBaseFile::~CClfsBaseFile
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::DestroyAbsoluteContainerPath
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::QueryContainerSecurity
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptor
CClfsBaseFilePersisted::~CClfsBaseFilePersisted
CClfsBaseFileSnapshot::FreeMetadataBlock
CClfsBaseFileSnapshot::`vector_deleting_destructor'
CClfsContainer::WriteSector
CClfsDriver::Finalize
CClfsKernelMarshallingContext::Release
CClfsKernelMarshallingContext::~CClfsKernelMarshallingContext
CClfsLogFcbCommon::UninstallObserver
CClfsLogFcbPhysical::AddArchiveRef
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::DestroyBaseFileName
CClfsLogFcbPhysical::EraseClientBlocks
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::ReleaseLsnMap
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateRegionBlocks
CClfsLogFcbPhysical::~CClfsLogFcbPhysical
CClfsManagedLog::AddContainersForGrowth
CClfsManagedLog::DeleteContainersForShrink
CClfsManagedLog::Finalize
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::GetNextSuffixFromExistingContainers
CClfsManagedLog::InstallDefaultNewContainerNamePolicies
CClfsManagedLog::InstallPolicy
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::UninstallPolicy
CClfsManagedLog::`scalar_deleting_destructor'
CClfsManagedLogClient::`scalar_deleting_destructor'
CClfsManagedLogClientKernel::`vector_deleting_destructor'
CClfsManagedLogClientUser::DestroyNotification
CClfsManagedLogClientUser::DestroyNotificationQueue
CClfsManagedLogClientUser::Finalize
CClfsManagedLogCollection::AllocateAndQueryPhysicalLogName
CClfsManagedLogCollection::FindManagedLog
CClfsManagedLogCollection::FindOrCreateManagedLog
CClfsMdlReference::`scalar_deleting_destructor'
CClfsRequest::FinalizeGlobals
CDynamicLsnQ::Initialize
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsCreateLogFile$fin$0
ClfsCreateScanContext
ClfsCreateScanContext$fin$0
ClfsEnableThreadPrivilege
ClfsFinalize
ClfsMgmtpApcRundown
ClfsMgmtpAutoGrowWorker
ClfsScanLogContainers
`CClfsBaseFile::InitializeGlobals'::__l1::fin$0
`CClfsBaseFilePersisted::CheckSecureAccess'::__l1::fin$0
`CClfsBaseFilePersisted::CreateAbsoluteContainerPath'::__l1::fin$0
`CClfsBaseFilePersisted::CreateContainer'::__l1::fin$0
`CClfsBaseFilePersisted::CreateContainerSecurityDescriptor'::__l1::fin$0
`CClfsBaseFilePersisted::CreateMetadataBlock'::__l1::fin$0
`CClfsBaseFilePersisted::ExtendMetadataBlock'::__l1::fin$0
`CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor'::__l1::fin$0
`CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0
`CClfsBaseFilePersisted::OpenImage'::__l1::fin$0
`CClfsBaseFilePersisted::QueryContainerSecurity'::__l1::fin$0
`CClfsBaseFilePersisted::ReadImage'::__l1::fin$0
`CClfsBaseFilePersisted::ReadMetadataBlock'::__l1::fin$0
`CClfsContainer::WriteSector'::__l1::fin$0
`CClfsLogFcbPhysical::AddArchiveRef'::__l1::fin$0
`CClfsLogFcbPhysical::EraseClientBlocks'::__l1::fin$0
`CClfsLogFcbPhysical::FindEndOfLog'::__l1::fin$0
`CClfsLogFcbPhysical::GetArchiveDescriptors'::__l1::fin$0
`CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$1
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
`CClfsLogFcbPhysical::QueryPhysicalLsn'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogModifyStreams'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogStart'::__l1::fin$0
`CClfsLogFcbPhysical::UpdateCachedOwnerPage'::__l1::fin$0
`CClfsLogFcbPhysical::ValidateRegionBlocks'::__l1::fin$0
`CClfsManagedLog::DeleteContainersForShrink'::__l1::fin$0
`CClfsManagedLog::GetNextSuffixFromExistingContainers'::__l1::fin$0
`CClfsManagedLog::InvokeGrowWorker'::__l1::fin$0
`ClfsEnableThreadPrivilege'::__l1::fin$0
wil_StagingConfig_QueryFeatureState
wil_details_StagingConfig_LoadExpand for full list:
CClfsBaseFile::InitializeGlobals
CClfsBaseFile::`scalar_deleting_destructor'
CClfsBaseFile::~CClfsBaseFile
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::DestroyAbsoluteContainerPath
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::QueryContainerSecurity
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptor
CClfsBaseFilePersisted::~CClfsBaseFilePersisted
CClfsBaseFileSnapshot::FreeMetadataBlock
CClfsBaseFileSnapshot::`vector_deleting_destructor'
CClfsContainer::WriteSector
CClfsDriver::Finalize
CClfsKernelMarshallingContext::Release
CClfsKernelMarshallingContext::~CClfsKernelMarshallingContext
CClfsLogFcbCommon::UninstallObserver
CClfsLogFcbPhysical::AddArchiveRef
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::DestroyBaseFileName
CClfsLogFcbPhysical::EraseClientBlocks
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::ReleaseLsnMap
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateRegionBlocks
CClfsLogFcbPhysical::~CClfsLogFcbPhysical
CClfsManagedLog::AddContainersForGrowth
CClfsManagedLog::DeleteContainersForShrink
CClfsManagedLog::Finalize
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::GetNextSuffixFromExistingContainers
CClfsManagedLog::InstallDefaultNewContainerNamePolicies
CClfsManagedLog::InstallPolicy
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::UninstallPolicy
CClfsManagedLog::`scalar_deleting_destructor'
CClfsManagedLogClient::`scalar_deleting_destructor'
CClfsManagedLogClientKernel::`vector_deleting_destructor'
CClfsManagedLogClientUser::DestroyNotification
CClfsManagedLogClientUser::DestroyNotificationQueue
CClfsManagedLogClientUser::Finalize
CClfsManagedLogCollection::AllocateAndQueryPhysicalLogName
CClfsManagedLogCollection::FindManagedLog
CClfsManagedLogCollection::FindOrCreateManagedLog
CClfsMdlReference::`scalar_deleting_destructor'
CClfsRequest::FinalizeGlobals
CDynamicLsnQ::Initialize
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsCreateLogFile$fin$0
ClfsCreateScanContext
ClfsCreateScanContext$fin$0
ClfsEnableThreadPrivilege
ClfsFinalize
ClfsMgmtpApcRundown
ClfsMgmtpAutoGrowWorker
ClfsScanLogContainers
`CClfsBaseFile::InitializeGlobals'::__l1::fin$0
`CClfsBaseFilePersisted::CheckSecureAccess'::__l1::fin$0
`CClfsBaseFilePersisted::CreateAbsoluteContainerPath'::__l1::fin$0
`CClfsBaseFilePersisted::CreateContainer'::__l1::fin$0
`CClfsBaseFilePersisted::CreateContainerSecurityDescriptor'::__l1::fin$0
`CClfsBaseFilePersisted::CreateMetadataBlock'::__l1::fin$0
`CClfsBaseFilePersisted::ExtendMetadataBlock'::__l1::fin$0
`CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor'::__l1::fin$0
`CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0
`CClfsBaseFilePersisted::OpenImage'::__l1::fin$0
`CClfsBaseFilePersisted::QueryContainerSecurity'::__l1::fin$0
`CClfsBaseFilePersisted::ReadImage'::__l1::fin$0
`CClfsBaseFilePersisted::ReadMetadataBlock'::__l1::fin$0
`CClfsContainer::WriteSector'::__l1::fin$0
`CClfsLogFcbPhysical::AddArchiveRef'::__l1::fin$0
`CClfsLogFcbPhysical::EraseClientBlocks'::__l1::fin$0
`CClfsLogFcbPhysical::FindEndOfLog'::__l1::fin$0
`CClfsLogFcbPhysical::GetArchiveDescriptors'::__l1::fin$0
`CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$1
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
`CClfsLogFcbPhysical::QueryPhysicalLsn'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogModifyStreams'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogStart'::__l1::fin$0
`CClfsLogFcbPhysical::UpdateCachedOwnerPage'::__l1::fin$0
`CClfsLogFcbPhysical::ValidateRegionBlocks'::__l1::fin$0
`CClfsManagedLog::DeleteContainersForShrink'::__l1::fin$0
`CClfsManagedLog::GetNextSuffixFromExistingContainers'::__l1::fin$0
`CClfsManagedLog::InvokeGrowWorker'::__l1::fin$0
`ClfsEnableThreadPrivilege'::__l1::fin$0