# clfs.sys 22000.258 vs 22000.376 (CVE-2021-43224, manual pair) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [operator_delete](#operator_delete) * [operator_new](#operator_new) * [CompareOffsets](#compareoffsets) * [CClfsBaseFile::ValidateContainerOffsets](#cclfsbasefilevalidatecontaineroffsets) * [NTOSKRNL.EXE::qsort](#ntoskrnlexeqsort) * [Modified](#modified) * [CClfsLogFcbVirtual::Open](#cclfslogfcbvirtualopen) * [CClfsBaseFile::GetSymbol](#cclfsbasefilegetsymbol) * [CClfsBaseFile::GetSymbol](#cclfsbasefilegetsymbol) * [CClfsLogFcbVirtual::QueryLogFileInfo](#cclfslogfcbvirtualquerylogfileinfo) * [`CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0](#cclfsbasefilepersistedloadcontainerq__l1fin0) * [CClfsBaseFile::FindSymbol](#cclfsbasefilefindsymbol) * [CClfsBaseFilePersisted::LoadContainerQ](#cclfsbasefilepersistedloadcontainerq) * [CClfsBaseFile::GetBaseLogRecord](#cclfsbasefilegetbaselogrecord) * [Modified (No Code Changes)](#modified-no-code-changes) * [_guard_dispatch_icall](#_guard_dispatch_icall) * [GetBaseLogRecord](#getbaselogrecord) * [memcpy](#memcpy) * [memset](#memset) * [NTOSKRNL.EXE::ExAllocatePoolWithTag](#ntoskrnlexeexallocatepoolwithtag) * [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag) # Visual Chart Diff ```mermaid flowchart LR CClfsLogFcbVirtualOpen-11-old<--Match 97%-->CClfsLogFcbVirtualOpen-11-new CClfsBaseFileGetSymbol-4-old<--Match 95%-->CClfsBaseFileGetSymbol-4-new CClfsBaseFileGetSymbol-4-old<--Match 97%-->CClfsBaseFileGetSymbol-4-new CClfsLogFcbVirtualQueryLogFileInfo-7-old<--Match 53%-->CClfsLogFcbVirtualQueryLogFileInfo-7-new CClfsBaseFilePersistedLoadContainerQ__l1fin0-3-old<--Match 94%-->CClfsBaseFilePersistedLoadContainerQ__l1fin0-3-new CClfsBaseFileFindSymbol-5-old<--Match 31%-->CClfsBaseFileFindSymbol-5-new CClfsBaseFilePersistedLoadContainerQ-9-old<--Match 14%-->CClfsBaseFilePersistedLoadContainerQ-9-new CClfsBaseFileGetBaseLogRecord-1-old<--Match 22%-->CClfsBaseFileAddrToOffset-1-new subgraph clfs-10.0.22000.376.sys CClfsLogFcbVirtualOpen-11-new CClfsBaseFileGetSymbol-4-new CClfsBaseFileGetSymbol-4-new CClfsLogFcbVirtualQueryLogFileInfo-7-new CClfsBaseFilePersistedLoadContainerQ__l1fin0-3-new CClfsBaseFileFindSymbol-5-new CClfsBaseFilePersistedLoadContainerQ-9-new CClfsBaseFileAddrToOffset-1-new subgraph Added direction LR operator_delete operator_new CompareOffsets CClfsBaseFile-ValidateContainerOffsets NTOSKRNLEXE-qsort end end subgraph clfs-10.0.22000.258.sys CClfsLogFcbVirtualOpen-11-old CClfsBaseFileGetSymbol-4-old CClfsBaseFileGetSymbol-4-old CClfsLogFcbVirtualQueryLogFileInfo-7-old CClfsBaseFilePersistedLoadContainerQ__l1fin0-3-old CClfsBaseFileFindSymbol-5-old CClfsBaseFilePersistedLoadContainerQ-9-old CClfsBaseFileGetBaseLogRecord-1-old end ``` ```mermaid pie showData title Function Matches - 99.8196% "unmatched_funcs_len" : 5 "matched_funcs_len" : 2767 ``` ```mermaid pie showData title Matched Function Similarity - 99.4940% "matched_funcs_with_code_changes_len" : 8 "matched_funcs_with_non_code_changes_len" : 6 "matched_funcs_no_changes_len" : 2753 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2021-43224\ghidra_projects --project-name CVE-2021-43224 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2021-43224\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title clfs.sys 22000.258 vs 22000.376 (CVE-2021-43224, manual pair) clfs-10.0.22000.258.sys clfs-10.0.22000.376.sys ``` #### Verbose Args
``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2021-43224\\clfs-10.0.22000.258.sys'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2021-43224\\clfs-10.0.22000.376.sys']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2021-43224\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2021-43224\ghidra_projects --project-name CVE-2021-43224 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2021-43224\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title clfs.sys 22000.258 vs 22000.376 (CVE-2021-43224, manual pair) ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/FE8C3A146A000/Clfs.Sys -O clfs.sys.x64.10.0.22000.318 wget https://msdl.microsoft.com/download/symbols/Clfs.Sys/85241AA56A000/Clfs.Sys -O clfs.sys.x64.10.0.22000.376 ``` ## Binary Metadata Diff ```diff --- clfs-10.0.22000.258.sys Meta +++ clfs-10.0.22000.376.sys Meta @@ -1,44 +1,44 @@ -Program Name: clfs-10.0.22000.258.sys +Program Name: clfs-10.0.22000.376.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f # of Bytes: 440220 # of Memory Blocks: 13 -# of Instructions: 74079 -# of Defined Data: 7711 -# of Functions: 1383 -# of Symbols: 10454 -# of Data Types: 402 -# of Data Type Categories: 17 +# of Instructions: 74192 +# of Defined Data: 7722 +# of Functions: 1389 +# of Symbols: 10483 +# of Data Types: 404 +# of Data Type Categories: 19 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Tue Jul 28 08:30:49 SGT 2026 +Date Created: Tue Jul 28 08:30:55 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2021-43224/clfs-10.0.22000.258.sys -Executable MD5: f4c245649b6ae9f7eb6686928c31089a -Executable SHA256: 8d06169a392335286c2ae82aa4186511f8fbe80cfedaf77ae83f3131f0ae26d2 -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2021-43224/clfs-10.0.22000.258.sys?MD5=f4c245649b6ae9f7eb6686928c31089a +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2021-43224/clfs-10.0.22000.376.sys +Executable MD5: 2636c692148a2c90f2ab9d80a7d121ee +Executable SHA256: baccd8b44a5388c5da84bdf687103baceb1d8500572232c943f4de7172e1220d +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2021-43224/clfs-10.0.22000.376.sys?MD5=2636c692148a2c90f2ab9d80a7d121ee PDB Age: 1 PDB File: clfs.pdb -PDB GUID: 8bd485c4-0b7b-aab4-dc80-8cda37350e38 +PDB GUID: c1bdc6a9-a497-b585-e240-9e9f1b56c18d PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Common Log File System Driver -PE Property[FileVersion]: 10.0.22000.318 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.22000.376 (WinBuild.160101.0800) PE Property[InternalName]: clfs.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: Clfs.Sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.22000.318 +PE Property[ProductVersion]: 10.0.22000.376 PE Property[Translation]: 4b00000 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra clfs-10.0.22000.258.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra clfs-10.0.22000.258.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra clfs-10.0.22000.258.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra clfs-10.0.22000.376.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra clfs-10.0.22000.376.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra clfs-10.0.22000.376.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|5| |deleted_funcs_len|0| |modified_funcs_len|14| |added_symbols_len|3| |deleted_symbols_len|2| |diff_time|18.39988613128662| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1350, 'ExternalsName': 180, 'ExactInstructionsFunctionHasher': 28, 'StructuralGraphHash': 4, 'ExactBytesFunctionHasher': 2, 'BSIM': 1, 'Implied Match': 1})| |items_to_process|24| |diff_types|Counter({'address': 9, 'refcount': 9, 'code': 8, 'length': 8, 'calling': 6, 'called': 5, 'name': 1, 'fullname': 1, 'sig': 1})| |unmatched_funcs_len|5| |total_funcs_len|2772| |matched_funcs_len|2767| |matched_funcs_with_code_changes_len|8| |matched_funcs_with_non_code_changes_len|6| |matched_funcs_no_changes_len|2753| |match_func_similarity_percent|99.4940%| |func_match_overall_percent|99.8196%| |first_matches|Counter({'SymbolsHash': 1350, 'ExactInstructionsFunctionHasher': 28, 'StructuralGraphHash': 4, 'ExactBytesFunctionHasher': 2, 'BSIM': 1, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1350 "ExternalsName" : 180 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 28 "BSIM" : 1 "StructuralGraphHash" : 4 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1350 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 28 "BSIM" : 1 "StructuralGraphHash" : 4 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 5 "deleted_funcs_len" : 0 "modified_funcs_len" : 14 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 3 "deleted_symbols_len" : 2 ``` ## Strings *No string differences found* # Deleted # Added ## operator_delete ### Function Meta |Key|clfs-10.0.22000.376.sys| | :---: | :---: | |name|operator_delete| |fullname|operator_delete| |refcount|8| |length|23| |called|NTOSKRNL.EXE::ExFreePoolWithTag| |calling|CClfsBaseFile::FindSymbol
CClfsBaseFilePersisted::LoadContainerQ
`CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0| |paramcount|1| |address|1c000f134| |sig|void __cdecl operator_delete(void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- operator_delete +++ operator_delete @@ -0,0 +1,10 @@ + +/* void __cdecl operator delete(void * __ptr64) */ + +void __cdecl operator_delete(void *param_1) + +{ + ExFreePoolWithTag(param_1,0); + return; +} + ``` ## operator_new ### Function Meta |Key|clfs-10.0.22000.376.sys| | :---: | :---: | |name|operator_new| |fullname|operator_new| |refcount|5| |length|34| |called|NTOSKRNL.EXE::ExAllocatePoolWithTag| |calling|CClfsBaseFile::FindSymbol
CClfsBaseFilePersisted::LoadContainerQ| |paramcount|2| |address|1c000f1dc| |sig|void * __cdecl operator_new(__uint64 param_1, _POOL_TYPE param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- operator_new +++ operator_new @@ -0,0 +1,12 @@ + +/* void * __ptr64 __cdecl operator new(unsigned __int64,enum _POOL_TYPE) */ + +void * __cdecl operator_new(__uint64 param_1,_POOL_TYPE param_2) + +{ + void *pvVar1; + + pvVar1 = (void *)ExAllocatePoolWithTag(param_2,param_1,0x73666c43); + return pvVar1; +} + ``` ## CompareOffsets ### Function Meta |Key|clfs-10.0.22000.376.sys| | :---: | :---: | |name|CompareOffsets| |fullname|CompareOffsets| |refcount|3| |length|10| |called|| |calling|| |paramcount|2| |address|1c0026010| |sig|int __cdecl CompareOffsets(void * param_1, void * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- CompareOffsets +++ CompareOffsets @@ -0,0 +1,9 @@ + +/* int __cdecl CompareOffsets(void const * __ptr64,void const * __ptr64) */ + +int __cdecl CompareOffsets(void *param_1,void *param_2) + +{ + return (int)(*(uint *)param_2 < *(uint *)param_1); +} + ``` ## CClfsBaseFile::ValidateContainerOffsets ### Function Meta |Key|clfs-10.0.22000.376.sys| | :---: | :---: | |name|ValidateContainerOffsets| |fullname|CClfsBaseFile::ValidateContainerOffsets| |refcount|3| |length|127| |called|NTOSKRNL.EXE::qsort| |calling|CClfsBaseFile::FindSymbol
CClfsBaseFilePersisted::LoadContainerQ| |paramcount|3| |address|1c002608c| |sig|long __thiscall ValidateContainerOffsets(CClfsBaseFile * this, ulong * param_1, ulong param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- CClfsBaseFile::ValidateContainerOffsets +++ CClfsBaseFile::ValidateContainerOffsets @@ -0,0 +1,31 @@ + +/* protected: long __cdecl CClfsBaseFile::ValidateContainerOffsets(unsigned long * __ptr64,unsigned + long) __ptr64 */ + +long __thiscall +CClfsBaseFile::ValidateContainerOffsets(CClfsBaseFile *this,ulong *param_1,ulong param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + + uVar3 = 0; + uVar4 = 0; + qsort(param_1,0x400,4,CompareOffsets); + while( true ) { + uVar1 = *param_1; + uVar2 = uVar3; + if (((uVar1 != 0) && (uVar2 = uVar1, uVar3 != 0)) && + ((ulonglong)uVar1 < (ulonglong)uVar3 + 0x60)) break; + uVar3 = uVar2; + uVar4 = uVar4 + 1; + param_1 = param_1 + 1; + if (0x3ff < uVar4) { + return 0; + } + } + return -0x3fe5fff3; +} + ``` ## NTOSKRNL.EXE::qsort ### Function Meta |Key|clfs-10.0.22000.376.sys| | :---: | :---: | |name|qsort| |fullname|NTOSKRNL.EXE::qsort| |refcount|2| |length|0| |called|| |calling|CClfsBaseFile::ValidateContainerOffsets| |paramcount|4| |address|EXTERNAL:0000001b| |sig|void __cdecl qsort(void * _Base, size_t _NumOfElements, size_t _SizeOfElements, _PtFuncCompare * _PtFuncCompare)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::qsort* # Modified *Modified functions contain code changes* ## CClfsLogFcbVirtual::Open ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.99| |i_ratio|0.8| |m_ratio|0.97| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|Open|Open| |fullname|CClfsLogFcbVirtual::Open|CClfsLogFcbVirtual::Open| |refcount|3|3| |`length`|974|1046| |`called`|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
NTOSKRNL.EXE::IoCheckShareAccess
NTOSKRNL.EXE::IoSetShareAccess
_guard_dispatch_icall|NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
NTOSKRNL.EXE::IoCheckShareAccess
NTOSKRNL.EXE::IoSetShareAccess
NTOSKRNL.EXE::KeBugCheckEx
_guard_dispatch_icall| |calling|CClfsLogFcbPhysical::OpenClient|CClfsLogFcbPhysical::OpenClient| |paramcount|11|11| |`address`|1c0041408|1c0041510| |sig|long __thiscall Open(CClfsLogFcbVirtual * this, uchar param_1, IFcbPhysical * param_2, void * param_3, _SECURITY_SUBJECT_CONTEXT * param_4, ulong param_5, ulong param_6, _ACCESS_STATE * param_7, char param_8, _FILE_OBJECT * param_9, CClfsLogCcb * param_10)|long __thiscall Open(CClfsLogFcbVirtual * this, uchar param_1, IFcbPhysical * param_2, void * param_3, _SECURITY_SUBJECT_CONTEXT * param_4, ulong param_5, ulong param_6, _ACCESS_STATE * param_7, char param_8, _FILE_OBJECT * param_9, CClfsLogCcb * param_10)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### CClfsLogFcbVirtual::Open Called Diff ```diff --- CClfsLogFcbVirtual::Open called +++ CClfsLogFcbVirtual::Open called @@ -4,0 +5 @@ +NTOSKRNL.EXE::KeBugCheckEx ``` ### CClfsLogFcbVirtual::Open Diff ```diff --- CClfsLogFcbVirtual::Open +++ CClfsLogFcbVirtual::Open @@ -1,171 +1,171 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: long __cdecl CClfsLogFcbVirtual::Open(unsigned char,struct IFcbPhysical * __ptr64,void * __ptr64,struct _SECURITY_SUBJECT_CONTEXT & __ptr64,unsigned long,unsigned long,struct _ACCESS_STATE * __ptr64,char,struct _FILE_OBJECT * __ptr64,class CClfsLogCcb * __ptr64) __ptr64 */ long __thiscall CClfsLogFcbVirtual::Open (CClfsLogFcbVirtual *this,uchar param_1,IFcbPhysical *param_2,void *param_3, _SECURITY_SUBJECT_CONTEXT *param_4,ulong param_5,ulong param_6,_ACCESS_STATE *param_7, char param_8,_FILE_OBJECT *param_9,CClfsLogCcb *param_10) { CClfsLogFcbVirtual *pCVar1; longlong *plVar2; code *pcVar3; char cVar4; char cVar5; undefined8 uVar6; longlong lVar7; undefined7 in_register_00000011; undefined1 *puVar8; long lVar9; CClfsLogCcb *pCVar10; longlong local_res20; undefined1 auStack_78 [8]; undefined1 auStack_70 [24]; _ACCESS_STATE *local_58; char local_50; undefined1 local_48; char local_38; uint local_34; longlong local_30; local_res20 = 0; local_38 = 0; if (0x5f < (byte)(param_1 - 1)) { local_58 = (_ACCESS_STATE *)0x0; /* WARNING: Subroutine does not return */ KeBugCheckEx(0xc1f5,0x1f,param_1,this); } cVar4 = ExAcquireResourceExclusiveLite(this + 0xc0,CONCAT71(in_register_00000011,1)); local_38 = cVar4; if (((byte)this[0x164] & 1) != 0) { this[0x260] = (CClfsLogFcbVirtual)param_1; *(undefined8 *)(this + 0x228) = *(undefined8 *)(param_9 + 8); *(IFcbPhysical **)(this + 0x278) = param_2; (**(code **)(*(longlong *)param_2 + 0x28))(param_2); (**(code **)(**(longlong **)(this + 0x278) + 0x1c8))(*(longlong **)(this + 0x278),this + 0x38); (**(code **)(**(longlong **)(this + 0x278) + 0x148)) (*(longlong **)(this + 0x278),this[0x260],&local_res20); if (local_res20 == 0) { pCVar10 = (CClfsLogCcb *)0xc01a000d; local_34 = 0xc01a000d; lVar7 = local_res20; puVar8 = auStack_78; goto LAB_0; } *(undefined2 *)(this + 0x170) = *(undefined2 *)(local_res20 + 10); *(undefined8 *)(this + 0x1a8) = *(undefined8 *)(local_res20 + 0x20); *(undefined8 *)(this + 0x1b0) = *(undefined8 *)(local_res20 + 0x28); *(undefined8 *)(this + 0x1b8) = *(undefined8 *)(local_res20 + 0x30); *(undefined8 *)(this + 0x1e8) = *(undefined8 *)(local_res20 + 0x40); *(undefined8 *)(this + 0x1e0) = *(undefined8 *)(local_res20 + 0x48); *(undefined8 *)(this + 0x1f0) = *(undefined8 *)(local_res20 + 0x50); *(undefined8 *)(this + 0x1f8) = *(undefined8 *)(local_res20 + 0x58); *(undefined4 *)(this + 0x174) = *(undefined4 *)(local_res20 + 0x10); local_30 = *(longlong *)(local_res20 + 0x60); if ((*(byte *)(local_res20 + 0x78) & 0x20) != 0) { *(undefined8 *)(this + 0x1f8) = 0xffffffff00000000; *(byte *)(local_res20 + 0x78) = *(byte *)(local_res20 + 0x78) & 0xdf; } if (local_30 != -0x100000000) { this[0x280] = (CClfsLogFcbVirtual)0x1; } (**(code **)(**(longlong **)(this + 0x278) + 0x150))(*(longlong **)(this + 0x278),&local_res20); local_34 = (**(code **)(**(longlong **)(this + 0x278) + 0x70)) (*(longlong **)(this + 0x278),this[0x260],this + 0x1f0); pCVar10 = (CClfsLogCcb *)(ulonglong)local_34; lVar7 = local_res20; puVar8 = auStack_78; if ((int)local_34 < 0) goto LAB_0; *(uint *)(this + 0x164) = *(uint *)(this + 0x164) | 4; *(uint *)(this + 0x164) = *(uint *)(this + 0x164) & 0xfffffffe; } cVar5 = (**(code **)(**(longlong **)(this + 0x278) + 0x40))(); if (cVar5 != '\0') { local_48 = 1; local_50 = param_8; local_58 = param_7; local_34 = (**(code **)(**(longlong **)(this + 0x278) + 400)) (*(longlong **)(this + 0x278),param_4,param_5, *(undefined4 *)(param_7 + 0x14)); pCVar10 = (CClfsLogCcb *)(ulonglong)local_34; lVar7 = local_res20; puVar8 = auStack_78; if ((int)local_34 < 0) goto LAB_0; } cVar5 = (**(code **)(**(longlong **)(this + 0x278) + 0x38))(); if ((cVar5 == '\0') || ((param_5 & 0x10006) == 0)) { cVar5 = (**(code **)(*(longlong *)this + 0x158))(this); if (cVar5 == '\0') { IoSetShareAccess(); pCVar10 = (CClfsLogCcb *)0x0; local_34 = 0; } else { local_58 = (_ACCESS_STATE *)CONCAT71(local_58._1_7_,1); local_34 = IoCheckShareAccess(param_5,param_6,param_9,this + 0x148); pCVar10 = (CClfsLogCcb *)(ulonglong)local_34; lVar7 = local_res20; puVar8 = auStack_78; if ((int)local_34 < 0) goto LAB_0; } lVar7 = local_res20; puVar8 = auStack_78; if (-1 < (int)pCVar10) { pCVar1 = this + 0x188; pCVar10 = param_10 + 8; lVar7 = *(longlong *)pCVar1; if (*(CClfsLogFcbVirtual **)(lVar7 + 8) == pCVar1) { *(longlong *)pCVar10 = lVar7; *(CClfsLogFcbVirtual **)(param_10 + 0x10) = pCVar1; *(CClfsLogCcb **)(lVar7 + 8) = pCVar10; *(CClfsLogCcb **)pCVar1 = pCVar10; *(uint *)(param_10 + 0x1c) = *(uint *)(param_10 + 0x1c) | 0x80; LOCK(); *(int *)(this + 0x16c) = *(int *)(this + 0x16c) + 1; UNLOCK(); (**(code **)(*(longlong *)this + 0x40))(this); *(CClfsLogFcbVirtual **)(param_9 + 0x18) = this + 0x38; *(CClfsLogCcb **)(param_9 + 0x20) = param_10; uVar6 = (**(code **)(*(longlong *)this + 0x30))(this); *(undefined8 *)(param_9 + 0x28) = uVar6; pCVar10 = (CClfsLogCcb *)(ulonglong)local_34; lVar7 = local_res20; puVar8 = auStack_78; } else { lVar7 = 3; pcVar3 = (code *)swi(0x29); (*pcVar3)(); puVar8 = auStack_70; pCVar10 = param_10; } } } else { pCVar10 = (CClfsLogCcb *)0xc0000022; local_34 = 0xc0000022; lVar7 = local_res20; puVar8 = auStack_78; } LAB_0: lVar9 = (long)pCVar10; if (cVar4 != '\0') { - *(undefined8 *)(puVar8 + -8) = 0x1c00417a5; + *(undefined8 *)(puVar8 + -8) = 0x1c00418ad; ExReleaseResourceForThreadLite(this + 0xc0,SystemReserved1[0xf]); lVar7 = *(longlong *)(puVar8 + 0x98); lVar9 = *(long *)(puVar8 + 0x44); } if (lVar7 != 0) { plVar2 = *(longlong **)(this + 0x278); pcVar3 = *(code **)(*plVar2 + 0x150); - *(undefined8 *)(puVar8 + -8) = 0x1c004b5e9; + *(undefined8 *)(puVar8 + -8) = 0x1c004b677; (*pcVar3)(plVar2,puVar8 + 0x98); } return lVar9; } ``` ## CClfsBaseFile::GetSymbol ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.96| |i_ratio|0.62| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|GetSymbol|GetSymbol| |fullname|CClfsBaseFile::GetSymbol|CClfsBaseFile::GetSymbol| |refcount|4|4| |`length`|204|226| |called|CClfsBaseFile::IsValidOffset
CClfsBaseFile::OffsetToAddr
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite|CClfsBaseFile::IsValidOffset
CClfsBaseFile::OffsetToAddr
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite| |calling|CClfsBaseFile::AcquireClientContext
CClfsBaseFile::LoadClientBaseLsn
CClfsBaseFile::ReleaseClientContext|CClfsBaseFile::AcquireClientContext
CClfsBaseFile::LoadClientBaseLsn
CClfsBaseFile::ReleaseClientContext| |paramcount|4|4| |`address`|1c002c788|1c002c858| |sig|long __thiscall GetSymbol(CClfsBaseFile * this, long param_1, uchar param_2, _CLFS_CLIENT_CONTEXT * * param_3)|long __thiscall GetSymbol(CClfsBaseFile * this, long param_1, uchar param_2, _CLFS_CLIENT_CONTEXT * * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsBaseFile::GetSymbol Diff ```diff --- CClfsBaseFile::GetSymbol +++ CClfsBaseFile::GetSymbol @@ -1,43 +1,44 @@ /* public: long __cdecl CClfsBaseFile::GetSymbol(long,unsigned char,struct _CLFS_CLIENT_CONTEXT * __ptr64 * __ptr64) __ptr64 */ long __thiscall CClfsBaseFile::GetSymbol (CClfsBaseFile *this,long param_1,uchar param_2,_CLFS_CLIENT_CONTEXT **param_3) { char cVar1; uchar uVar2; _CLFS_CLIENT_CONTEXT *p_Var3; undefined4 in_register_00000014; long local_38; local_38 = 0; if ((uint)param_1 < 0x1368) { return -0x3fe5fff3; } *param_3 = (_CLFS_CLIENT_CONTEXT *)0x0; cVar1 = ExAcquireResourceSharedLite (*(undefined8 *)(this + 0x20), CONCAT71((int7)(CONCAT44(in_register_00000014,param_1) >> 8),1)); uVar2 = IsValidOffset(this,param_1 + 0x87); if ((uVar2 != '\0') && (p_Var3 = OffsetToAddr(this,param_1), p_Var3 != (_CLFS_CLIENT_CONTEXT *)0x0)) { if (*(int *)(p_Var3 + -0xc) != param_1) { local_38 = -0x3ffffff8; goto LAB_0; } - if (p_Var3[8] == (_CLFS_CLIENT_CONTEXT)param_2) { + if (((longlong)*(int *)(p_Var3 + -0xc) + 0x88U <= (ulonglong)(longlong)*(int *)(p_Var3 + -0x10)) + && (p_Var3[8] == (_CLFS_CLIENT_CONTEXT)param_2)) { *param_3 = p_Var3; goto LAB_0; } } local_38 = -0x3fe5fff3; LAB_0: if (cVar1 != '\0') { ExReleaseResourceForThreadLite(*(undefined8 *)(this + 0x20),SystemReserved1[0xf]); } return local_38; } ``` ## CClfsBaseFile::GetSymbol ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.8| |i_ratio|0.7| |m_ratio|0.97| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|GetSymbol|GetSymbol| |fullname|CClfsBaseFile::GetSymbol|CClfsBaseFile::GetSymbol| |refcount|12|12| |`length`|285|305| |called|CClfsBaseFile::IsValidOffset
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite|CClfsBaseFile::IsValidOffset
NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite| |calling|CClfsBaseFile::AcquireContainerContext
CClfsBaseFile::ReleaseContainerContext
CClfsBaseFile::ScanContainerInfo
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::RemoveContainer
CClfsBaseFilePersisted::ResetContainerQ
CClfsBaseFilePersisted::UnloadContainerQ
CClfsBaseFileSnapshot::ReadContainerQ|CClfsBaseFile::AcquireContainerContext
CClfsBaseFile::ReleaseContainerContext
CClfsBaseFile::ScanContainerInfo
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::RemoveContainer
CClfsBaseFilePersisted::ResetContainerQ
CClfsBaseFilePersisted::UnloadContainerQ
CClfsBaseFileSnapshot::ReadContainerQ| |paramcount|4|4| |`address`|1c002bca0|1c002bd60| |sig|long __thiscall GetSymbol(CClfsBaseFile * this, long param_1, ulong param_2, _CLFS_CONTAINER_CONTEXT * * param_3)|long __thiscall GetSymbol(CClfsBaseFile * this, long param_1, ulong param_2, _CLFS_CONTAINER_CONTEXT * * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsBaseFile::GetSymbol Diff ```diff --- CClfsBaseFile::GetSymbol +++ CClfsBaseFile::GetSymbol @@ -1,63 +1,65 @@ /* public: long __cdecl CClfsBaseFile::GetSymbol(long,unsigned long,struct _CLFS_CONTAINER_CONTEXT * __ptr64 * __ptr64) __ptr64 */ long __thiscall CClfsBaseFile::GetSymbol (CClfsBaseFile *this,long param_1,ulong param_2,_CLFS_CONTAINER_CONTEXT **param_3) { uint uVar1; longlong lVar2; char cVar3; uchar uVar4; uint uVar5; - _CLFS_CONTAINER_CONTEXT *p_Var6; - longlong lVar7; + longlong lVar6; undefined4 in_register_00000014; + _CLFS_CONTAINER_CONTEXT *p_Var7; long local_28; local_28 = 0; if ((uint)param_1 < 0x1368) { return -0x3fe5fff3; } *param_3 = (_CLFS_CONTAINER_CONTEXT *)0x0; cVar3 = ExAcquireResourceSharedLite (*(undefined8 *)(this + 0x20), CONCAT71((int7)(CONCAT44(in_register_00000014,param_1) >> 8),1)); uVar4 = IsValidOffset(this,param_1 + 0x2f); if (uVar4 != '\0') { lVar2 = *(longlong *)(*(longlong *)(this + 0x30) + 0x30); if ((*(short *)(this + 0x28) == 0) || (lVar2 == 0)) { uVar5 = *(uint *)(lVar2 + 0x28); LAB_0: - lVar7 = 0; + lVar6 = 0; } else { uVar5 = *(uint *)(lVar2 + 0x28); uVar1 = *(uint *)(*(longlong *)(this + 0x30) + 0x38); if (((uVar1 <= uVar5) || (uVar5 < 0x70)) || - (lVar7 = lVar2 + (ulonglong)uVar5, uVar1 - uVar5 < 0x1338)) goto LAB_0; + (lVar6 = lVar2 + (ulonglong)uVar5, uVar1 - uVar5 < 0x1338)) goto LAB_0; } - if ((((uint)param_1 <= uVar5 + param_1) && (lVar7 != 0)) && + if ((((uint)param_1 <= uVar5 + param_1) && (lVar6 != 0)) && ((uVar5 + param_1 < (uint)*(ushort *)(lVar2 + 4) << 9 && - (p_Var6 = (_CLFS_CONTAINER_CONTEXT *)((ulonglong)(uint)param_1 + lVar7), - p_Var6 != (_CLFS_CONTAINER_CONTEXT *)0x0)))) { - if (*(int *)(p_Var6 + -0xc) != param_1) { + (p_Var7 = (_CLFS_CONTAINER_CONTEXT *)((ulonglong)(uint)param_1 + lVar6), + p_Var7 != (_CLFS_CONTAINER_CONTEXT *)0x0)))) { + if (*(int *)(p_Var7 + -0xc) != param_1) { local_28 = -0x3ffffff8; goto LAB_1; } - if (*(ulong *)(p_Var6 + 0x10) == param_2) { - *param_3 = p_Var6; + if (((longlong)*(int *)(p_Var7 + -0xc) + 0x30U <= + (ulonglong)(longlong)*(int *)(p_Var7 + -0x10)) && (*(ulong *)(p_Var7 + 0x10) == param_2)) + { + *param_3 = p_Var7; goto LAB_1; } } } local_28 = -0x3fe5fff3; LAB_1: if (cVar3 != '\0') { ExReleaseResourceForThreadLite(*(undefined8 *)(this + 0x20),SystemReserved1[0xf]); } return local_28; } ``` ## CClfsLogFcbVirtual::QueryLogFileInfo ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.71| |i_ratio|0.42| |m_ratio|0.98| |b_ratio|0.53| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|QueryLogFileInfo|QueryLogFileInfo| |fullname|CClfsLogFcbVirtual::QueryLogFileInfo|CClfsLogFcbVirtual::QueryLogFileInfo| |refcount|3|3| |`length`|810|813| |called|NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
__security_check_cookie
_guard_dispatch_icall
memcpy
memset|NTOSKRNL.EXE::ExAcquireResourceSharedLite
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
__security_check_cookie
_guard_dispatch_icall
memcpy
memset| |calling||| |paramcount|7|7| |`address`|1c0040d90|1c0040e00| |sig|long __thiscall QueryLogFileInfo(CClfsLogFcbVirtual * this, _FILE_OBJECT * param_1, _CLS_LOG_INFORMATION_CLASS param_2, void * param_3, ulong param_4, void * param_5, ulong * param_6)|long __thiscall QueryLogFileInfo(CClfsLogFcbVirtual * this, _FILE_OBJECT * param_1, _CLS_LOG_INFORMATION_CLASS param_2, void * param_3, ulong param_4, void * param_5, ulong * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsLogFcbVirtual::QueryLogFileInfo Diff ```diff --- CClfsLogFcbVirtual::QueryLogFileInfo +++ CClfsLogFcbVirtual::QueryLogFileInfo @@ -1,147 +1,155 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* public: virtual long __cdecl CClfsLogFcbVirtual::QueryLogFileInfo(struct _FILE_OBJECT * __ptr64,enum _CLS_LOG_INFORMATION_CLASS,void * __ptr64,unsigned long,void * __ptr64,unsigned long & __ptr64) __ptr64 */ long __thiscall CClfsLogFcbVirtual::QueryLogFileInfo (CClfsLogFcbVirtual *this,_FILE_OBJECT *param_1,_CLS_LOG_INFORMATION_CLASS param_2, void *param_3,ulong param_4,void *param_5,ulong *param_6) { undefined1 uVar1; int iVar2; - uint uVar3; - code *pcVar4; - longlong *plVar5; - CClfsLogFcbVirtual *pCVar6; + code *pcVar3; + longlong *plVar4; + CClfsLogFcbVirtual *pCVar5; + ulong uVar6; undefined8 uVar7; bool bVar8; undefined1 auStack_128 [32]; ulong local_108; undefined1 *local_100; ulong *local_f8; char local_e8; int local_e4; - CClfsLogFcbVirtual *local_e0; + ulong local_e0 [2]; CClfsLogFcbVirtual *local_d8; + CClfsLogFcbVirtual *local_d0; undefined1 local_c8 [16]; undefined8 local_b8; uint local_94; longlong local_80; undefined8 local_70; undefined8 local_68; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStack_128; iVar2 = 0; local_e4 = 0; - local_d8 = this; + local_e0[0] = 0; + local_d0 = this; memset(local_c8,0,0x78); - local_e0 = this + 0xc0; - local_e8 = ExAcquireResourceSharedLite(local_e0); + local_d8 = this + 0xc0; + local_e8 = ExAcquireResourceSharedLite(local_d8); if ((int)param_2 < 0) { LAB_0: iVar2 = -0x3ffffffd; local_e4 = -0x3ffffffd; goto LAB_1; } if (1 < (int)param_2) { if (param_2 == 2) { memset(param_5,0,(ulonglong)*param_6); - plVar5 = *(longlong **)(this + 0x278); - pcVar4 = *(code **)(*plVar5 + 0x98); + plVar4 = *(longlong **)(this + 0x278); + pcVar3 = *(code **)(*plVar4 + 0x98); local_108 = 0; param_3 = (void *)0x0; uVar7 = 2; } else { if (param_2 == 3) { memset(param_5,0,(ulonglong)*param_6); - if (*param_6 == 0) { - *param_6 = 1; - iVar2 = -0x7ffffffb; - local_e4 = -0x7ffffffb; - } - else { + if (*param_6 != 0) { uVar1 = (**(code **)(*(longlong *)this + 0x130))(this); *(undefined1 *)param_5 = uVar1; + goto LAB_1; } - goto LAB_1; + *param_6 = 1; + goto LAB_2; } if (param_2 == 4) { memset(param_5,0,(ulonglong)*param_6); - plVar5 = *(longlong **)(this + 0x278); - pcVar4 = *(code **)(*plVar5 + 0x98); + plVar4 = *(longlong **)(this + 0x278); + pcVar3 = *(code **)(*plVar4 + 0x98); local_108 = 0; param_3 = (void *)0x0; uVar7 = 4; } else { uVar7 = 5; if (param_2 != 5) goto LAB_0; - plVar5 = *(longlong **)(this + 0x278); - pcVar4 = *(code **)(*plVar5 + 0x98); + plVar4 = *(longlong **)(this + 0x278); + pcVar3 = *(code **)(*plVar4 + 0x98); local_108 = param_4; } } local_f8 = param_6; local_100 = param_5; - iVar2 = (*pcVar4)(plVar5,param_1,uVar7,param_3); + iVar2 = (*pcVar3)(plVar4,param_1,uVar7,param_3); local_e4 = iVar2; goto LAB_1; } memset(param_5,0,(ulonglong)*param_6); - local_f8 = param_6; + if (*param_6 < 0x78) { + *param_6 = 0x78; +LAB_2: + iVar2 = -0x7ffffffb; + local_e4 = -0x7ffffffb; + goto LAB_1; + } + local_e0[0] = 0x78; + local_f8 = local_e0; local_100 = local_c8; local_108 = 0; iVar2 = (**(code **)(**(longlong **)(this + 0x278) + 0x98)) (*(longlong **)(this + 0x278),param_1,0,0); + *param_6 = local_e0[0]; local_e4 = iVar2; if (iVar2 < 0) goto LAB_1; if (param_2 == 0) { - pCVar6 = this + 0x1e0; - if (pCVar6 == (CClfsLogFcbVirtual *)0x0) { + pCVar5 = this + 0x1e0; + if (pCVar5 == (CClfsLogFcbVirtual *)0x0) { bVar8 = false; } else { - bVar8 = *(longlong *)pCVar6 == -0x100000000; + bVar8 = *(longlong *)pCVar5 == -0x100000000; } if (bVar8) { if (this[0x280] == (CClfsLogFcbVirtual)0x0) { - pCVar6 = this + 0x1f0; - if (pCVar6 == (CClfsLogFcbVirtual *)0x0) { + pCVar5 = this + 0x1f0; + if (pCVar5 == (CClfsLogFcbVirtual *)0x0) { bVar8 = false; } else { - bVar8 = *(longlong *)pCVar6 == 0; + bVar8 = *(longlong *)pCVar5 == 0; } - if (!bVar8) goto LAB_2; + if (!bVar8) goto LAB_3; } local_80 = 0; } else { -LAB_2: - local_80 = *(longlong *)pCVar6; +LAB_3: + local_80 = *(longlong *)pCVar5; } local_94 = (uint)*(ushort *)(this + 0x170); local_70 = *(undefined8 *)(this + 0x1f0); local_68 = *(undefined8 *)(this + 0x1f8); local_b8 = *(undefined8 *)(this + 0x1d0); } - uVar3 = *param_6; - if (0x78 < uVar3) { + uVar6 = local_e0[0]; + if (0x78 < local_e0[0]) { *param_6 = 0x78; - uVar3 = 0x78; + uVar6 = 0x78; } - memcpy(param_5,local_c8,(ulonglong)uVar3); + memcpy(param_5,local_c8,(ulonglong)uVar6); LAB_1: if (local_e8 != '\0') { - ExReleaseResourceForThreadLite(local_e0,SystemReserved1[0xf]); + ExReleaseResourceForThreadLite(local_d8,SystemReserved1[0xf]); iVar2 = local_e4; } return iVar2; } ``` ## `CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0 ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.71| |i_ratio|0.62| |m_ratio|0.98| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|fin$0|fin$0| |fullname|`CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0|`CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0| |refcount|1|1| |`length`|213|232| |`called`|CClfsBaseFile::ReleaseClientContext
CClfsBaseFilePersisted::DestroyAbsoluteContainerPath
CClfsBaseFilePersisted::UnloadContainerQ
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceForThreadLite|CClfsBaseFile::ReleaseClientContext
CClfsBaseFilePersisted::DestroyAbsoluteContainerPath
CClfsBaseFilePersisted::UnloadContainerQ
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
operator_delete| |calling||| |paramcount|3|3| |`address`|1c0046660|1c0046770| |sig|undefined __fastcall fin$0(CClfsBaseFilePersisted * param_1, longlong param_2, ulong param_3)|undefined __fastcall fin$0(CClfsBaseFilePersisted * param_1, longlong param_2, ulong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### `CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0 Called Diff ```diff --- `CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0 called +++ `CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0 called @@ -5,0 +6 @@ +operator_delete ``` ### `CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0 Diff ```diff --- `CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0 +++ `CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0 @@ -1,44 +1,48 @@ void `CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin_0 (CClfsBaseFilePersisted *param_1,longlong param_2,ulong param_3) { ulong uVar1; CClfsBaseFilePersisted *this; ulong *puVar2; ulong *puVar3; - this = *(CClfsBaseFilePersisted **)(param_2 + 0x120); + this = *(CClfsBaseFilePersisted **)(param_2 + 0x130); if (*(char *)(param_2 + 0x50) != '\0') { param_1 = *(CClfsBaseFilePersisted **)(this + 0x20); ExReleaseResourceForThreadLite(param_1,SystemReserved1[0xf]); *(undefined1 *)(param_2 + 0x50) = 0; } - if (*(char *)(param_2 + 0x51) != '\0') { + if (*(char *)(param_2 + 0x58) != '\0') { CClfsBaseFilePersisted::DestroyAbsoluteContainerPath - (param_1,(_UNICODE_STRING *)(param_2 + 0xb0)); + (param_1,(_UNICODE_STRING *)(param_2 + 0xc0)); } if (*(int *)(param_2 + 0x54) < 0) { - puVar2 = *(ulong **)(param_2 + 0x150); + puVar2 = *(ulong **)(param_2 + 0x160); uVar1 = *puVar2; - puVar3 = *(ulong **)(param_2 + 0x158); + puVar3 = *(ulong **)(param_2 + 0x168); if (uVar1 != 0xffffffff) { CClfsBaseFilePersisted::UnloadContainerQ - (this,*(ulong **)(param_2 + 0x128),param_3,uVar1,*puVar3); + (this,*(ulong **)(param_2 + 0x138),param_3,uVar1,*puVar3); } *puVar3 = 0; *puVar2 = 0; } - if (*(longlong *)(param_2 + 0x70) != 0) { + if (*(void **)(param_2 + 0x60) != (void *)0x0) { + operator_delete(*(void **)(param_2 + 0x60)); + *(undefined8 *)(param_2 + 0x60) = 0; + } + if (*(longlong *)(param_2 + 0x88) != 0) { CClfsBaseFile::ReleaseClientContext - ((CClfsBaseFile *)this,(_CLFS_CLIENT_CONTEXT **)(param_2 + 0x70)); + ((CClfsBaseFile *)this,(_CLFS_CLIENT_CONTEXT **)(param_2 + 0x88)); } - if (*(longlong *)(param_2 + 0x58) != 0) { - ExFreePoolWithTag(*(longlong *)(param_2 + 0x58),0); + if (*(void **)(param_2 + 0x78) != (void *)0x0) { + operator_delete(*(void **)(param_2 + 0x78)); } if (*(longlong *)(param_2 + 0x68) != 0) { ExFreePoolWithTag(*(longlong *)(param_2 + 0x68),0); } return; } ``` ## CClfsBaseFile::FindSymbol ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.36| |i_ratio|0.17| |m_ratio|0.89| |b_ratio|0.31| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|FindSymbol|FindSymbol| |fullname|CClfsBaseFile::FindSymbol|CClfsBaseFile::FindSymbol| |`refcount`|6|5| |`length`|673|781| |`called`|CClfsBaseFile::GetBaseLogRecord
CClfsBaseFile::OffsetToAddr
ClfsHashPJW
_guard_dispatch_icall
memcpy|CClfsBaseFile::AddrToOffset
CClfsBaseFile::GetBaseLogRecord
CClfsBaseFile::OffsetToAddr
CClfsBaseFile::ValidateContainerOffsets
ClfsHashPJW
_guard_dispatch_icall
memcpy
operator_delete
operator_new| |calling|CClfsBaseFile::FindClient
CClfsBaseFile::FindContainer
CClfsBaseFile::FindSharedSecurityDescriptor
CClfsBaseFilePersisted::AddSymbol|CClfsBaseFile::FindClient
CClfsBaseFile::FindContainer
CClfsBaseFile::FindSharedSecurityDescriptor
CClfsBaseFilePersisted::AddSymbol| |paramcount|5|5| |`address`|1c004118c|1c00411fc| |sig|long __cdecl FindSymbol(_UNICODE_STRING * param_1, _CLFSHASHTBL * param_2, uchar param_3, ulong param_4, _CLFSHASHSYM * * param_5)|long __cdecl FindSymbol(_UNICODE_STRING * param_1, _CLFSHASHTBL * param_2, uchar param_3, ulong param_4, _CLFSHASHSYM * * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### CClfsBaseFile::FindSymbol Called Diff ```diff --- CClfsBaseFile::FindSymbol called +++ CClfsBaseFile::FindSymbol called @@ -0,0 +1 @@ +CClfsBaseFile::AddrToOffset @@ -2,0 +4 @@ +CClfsBaseFile::ValidateContainerOffsets @@ -5,0 +8,2 @@ +operator_delete +operator_new ``` ### CClfsBaseFile::FindSymbol Diff ```diff --- CClfsBaseFile::FindSymbol +++ CClfsBaseFile::FindSymbol @@ -1,120 +1,162 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* protected: static long __cdecl CClfsBaseFile::FindSymbol(struct _UNICODE_STRING * __ptr64,struct _CLFSHASHTBL * __ptr64,unsigned char,unsigned long,struct _CLFSHASHSYM * __ptr64 * __ptr64) */ long __cdecl CClfsBaseFile::FindSymbol (_UNICODE_STRING *param_1,_CLFSHASHTBL *param_2,uchar param_3,ulong param_4, _CLFSHASHSYM **param_5) { ushort uVar1; CClfsBaseFile *pCVar2; - _CLFSHASHSYM *p_Var3; + ulong uVar3; ulong uVar4; int iVar5; - _CLFSHASHSYM *p_Var6; - void *pvVar7; - _CLFS_BASE_RECORD_HEADER *p_Var8; - _CLFS_BASE_RECORD_HEADER *p_Var9; - int *piVar10; - longlong lVar11; - _CLFSHASHSYM *p_Var12; - short *psVar13; - uint uVar14; - uint uVar15; - _CLFSHASHSYM *local_30; + ulong uVar6; + long lVar7; + _CLFSHASHSYM *p_Var8; + void *pvVar9; + _CLFS_BASE_RECORD_HEADER *p_Var10; + ulong *puVar11; + ulong *puVar12; + longlong lVar13; + CClfsBaseFile *this; + _CLFSHASHSYM *p_Var14; + ulonglong uVar15; + uint uVar16; + short *psVar17; + ulong uVar18; + uint uVar19; + _CLFSHASHSYM *local_48; + ulonglong local_40; uVar1 = *(ushort *)param_1; - local_30 = (_CLFSHASHSYM *)0x0; + this = (CClfsBaseFile *)0x0; + local_48 = (_CLFSHASHSYM *)0x0; if (param_5 == (_CLFSHASHSYM **)0x0) { return -0x3ffffff3; } *param_5 = (_CLFSHASHSYM *)0x0; - uVar4 = ClfsHashPJW(param_1); - uVar15 = param_4 + 0x37 & 0xfffffff8; - p_Var6 = (_CLFSHASHSYM *) - (*(longlong *)param_2 + ((ulonglong)uVar4 % (ulonglong)*(uint *)(param_2 + 8)) * 8); - if (*(longlong *)p_Var6 != 0) { + uVar3 = ClfsHashPJW(param_1); + uVar19 = param_4 + 0x37 & 0xfffffff8; + p_Var14 = (_CLFSHASHSYM *) + (*(longlong *)param_2 + ((ulonglong)uVar3 % (ulonglong)*(uint *)(param_2 + 8)) * 8); + if (*(longlong *)p_Var14 != 0) { pCVar2 = *(CClfsBaseFile **)(param_2 + 0x10); do { - p_Var6 = OffsetToAddr(pCVar2,*(ulong *)p_Var6); - if (p_Var6 == (_CLFSHASHSYM *)0x0) { + p_Var8 = OffsetToAddr(pCVar2,*(ulong *)p_Var14); + if (p_Var8 == (_CLFSHASHSYM *)0x0) { return -0x3fe5fff3; } - if (uVar4 == *(ulong *)(p_Var6 + 8)) { - uVar14 = *(uint *)(p_Var6 + 0xc); - if (uVar15 == uVar14) { - psVar13 = *(short **)(param_1 + 8); - pvVar7 = OffsetToAddr(pCVar2,*(ulong *)(p_Var6 + 0x20)); - if (pvVar7 == (void *)0x0) { + uVar16 = *(uint *)(p_Var8 + 0xc); + if (uVar3 == *(ulong *)(p_Var8 + 8)) { + if (uVar19 == uVar16) { + psVar17 = *(short **)(param_1 + 8); + pvVar9 = OffsetToAddr(pCVar2,*(ulong *)(p_Var8 + 0x20)); + if (pvVar9 == (void *)0x0) { return -0x3fe5fff3; } - uVar15 = 0; + uVar19 = 0; if (*(ushort *)param_1 >> 1 == 0) goto LAB_0; - lVar11 = (longlong)pvVar7 - (longlong)psVar13; + lVar13 = (longlong)pvVar9 - (longlong)psVar17; goto LAB_1; } + p_Var14 = p_Var8 + (-(ulonglong)(uVar19 < uVar16) & 0xfffffffffffffff8) + 0x18; } else { - uVar14 = *(uint *)(p_Var6 + 0xc); + p_Var14 = p_Var8 + 0x10; + if (uVar16 <= uVar19) { + p_Var14 = p_Var8 + 0x18; + } } - p_Var6 = p_Var6 + (-(ulonglong)(uVar15 < uVar14) & 0xfffffffffffffff8) + 0x18; - } while (*(longlong *)p_Var6 != 0); + } while (*(longlong *)p_Var14 != 0); } - uVar14 = 0xfffffff8; + uVar16 = 0xfffffff8; if (param_3 == '\0') { iVar5 = -0x3ffffddb; } else { pCVar2 = *(CClfsBaseFile **)(param_2 + 0x10); - p_Var8 = GetBaseLogRecord(pCVar2); + uVar4 = AddrToOffset(pCVar2,p_Var14); + local_40 = (ulonglong)(param_4 + 7); iVar5 = (**(code **)(*(longlong *)pCVar2 + 0x18)) - (pCVar2,(uVar1 + 9 & 0xfffffff8) + 0x30 + (param_4 + 7 & uVar14),&local_30); - p_Var3 = local_30; + (pCVar2,(uVar1 + 9 & 0xfffffff8) + 0x30 + (param_4 + 7 & uVar16),&local_48); + p_Var14 = local_48; if (-1 < iVar5) { - p_Var12 = local_30 + ((ulonglong)(param_4 + 7) & 0xfffffff8); - *(undefined4 *)local_30 = 0xc1fdf006; - *(undefined4 *)(local_30 + 4) = 0x30; - *(uint *)(local_30 + 0xc) = uVar15; - *(ulong *)(local_30 + 8) = uVar4; - *(undefined8 *)(local_30 + 0x18) = 0; - *(undefined8 *)(local_30 + 0x10) = 0; - p_Var9 = GetBaseLogRecord(pCVar2); - *(int *)(p_Var3 + 0x24) = ((int)p_Var3 - (int)p_Var9) + 0x30; - p_Var9 = GetBaseLogRecord(pCVar2); - *(int *)(p_Var3 + 0x20) = ((int)p_Var12 + 0x30) - (int)p_Var9; - memcpy(p_Var12 + 0x30,*(void **)(param_1 + 8),(ulonglong)*(ushort *)param_1); - *(undefined2 *)(p_Var12 + (ulonglong)(*(ushort *)param_1 >> 1) * 2 + 0x30) = 0; - piVar10 = OffsetToAddr(pCVar2,(int)p_Var6 - (int)p_Var8); - if (piVar10 != (int *)0x0) { - p_Var8 = GetBaseLogRecord(pCVar2); - *piVar10 = (int)p_Var3 - (int)p_Var8; - *param_5 = p_Var3; - return 0; + p_Var10 = GetBaseLogRecord(pCVar2); + if (p_Var10 != (_CLFS_BASE_RECORD_HEADER *)0x0) { + puVar11 = operator_new(0x1000,1); + if (puVar11 != (ulong *)0x0) { + uVar18 = 0x1000; + memcpy(puVar11,p_Var10 + 0x328,0x1000); + puVar12 = puVar11; + do { + if (*puVar12 == 0) { + uVar6 = AddrToOffset(pCVar2,p_Var14 + 0x30); + puVar11[(longlong)this] = uVar6; + goto LAB_2; + } + uVar16 = (int)this + 1; + this = (CClfsBaseFile *)(ulonglong)uVar16; + puVar12 = puVar12 + 1; + } while (uVar16 < 0x400); + this = (CClfsBaseFile *)0x400; + if (uVar16 != 0x400) { +LAB_2: + lVar7 = ValidateContainerOffsets(this,puVar11,uVar18); + operator_delete(puVar11); + if (-1 < lVar7) { + uVar15 = local_40 & 0xfffffff8; + *(undefined4 *)p_Var14 = 0xc1fdf006; + *(undefined4 *)(p_Var14 + 4) = 0x30; + *(uint *)(p_Var14 + 0xc) = uVar19; + *(ulong *)(p_Var14 + 8) = uVar3; + *(undefined8 *)(p_Var14 + 0x18) = 0; + *(undefined8 *)(p_Var14 + 0x10) = 0; + uVar3 = AddrToOffset(pCVar2,p_Var14 + 0x30); + *(ulong *)(p_Var14 + 0x24) = uVar3; + uVar3 = AddrToOffset(pCVar2,p_Var14 + uVar15 + 0x30); + *(ulong *)(p_Var14 + 0x20) = uVar3; + memcpy(p_Var14 + uVar15 + 0x30,*(void **)(param_1 + 8),(ulonglong)*(ushort *)param_1); + *(undefined2 *)(p_Var14 + (ulonglong)(*(ushort *)param_1 >> 1) * 2 + uVar15 + 0x30) = + 0; + puVar11 = OffsetToAddr(pCVar2,uVar4); + if (puVar11 != (ulong *)0x0) { + uVar3 = AddrToOffset(pCVar2,p_Var14); + *puVar11 = uVar3; + *param_5 = p_Var14; + return 0; + } + } + return -0x3fe5fff3; + } + operator_delete(puVar11); + } + return -0x3fffff66; } - return -0x3fe5fff3; + iVar5 = -0x3fe5fff3; } } *param_5 = (_CLFSHASHSYM *)0x0; return iVar5; while( true ) { - uVar15 = uVar15 + 1; - psVar13 = psVar13 + 1; - if (*(ushort *)param_1 >> 1 <= uVar15) break; + uVar19 = uVar19 + 1; + psVar17 = psVar17 + 1; + if (*(ushort *)param_1 >> 1 <= uVar19) break; LAB_1: - if (*psVar13 != *(short *)(lVar11 + (longlong)psVar13)) break; + if (*psVar17 != *(short *)(lVar13 + (longlong)psVar17)) break; } LAB_0: - *param_5 = p_Var6; + *param_5 = p_Var8; if (param_3 == '\0') { - return -(uint)(p_Var6[0x28] != (_CLFSHASHSYM)0x0) & 0xc0000225; + return -(uint)(p_Var8[0x28] != (_CLFSHASHSYM)0x0) & 0xc0000225; } - if (p_Var6[0x28] != (_CLFSHASHSYM)0x0) { - p_Var6[0x28] = (_CLFSHASHSYM)0x0; + if (p_Var8[0x28] != (_CLFSHASHSYM)0x0) { + p_Var8[0x28] = (_CLFSHASHSYM)0x0; return 0; } return -0x3fffff43; } ``` ## CClfsBaseFilePersisted::LoadContainerQ ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.09| |i_ratio|0.14| |m_ratio|0.99| |b_ratio|0.14| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|LoadContainerQ|LoadContainerQ| |fullname|CClfsBaseFilePersisted::LoadContainerQ|CClfsBaseFilePersisted::LoadContainerQ| |`refcount`|4|3| |`length`|2811|2581| |`called`|
Expand for full list:
CClfsBaseFile::ContainerCount
CClfsBaseFile::GetBaseLogRecord
CClfsBaseFile::GetSymbol
CClfsBaseFile::OffsetToAddr
CClfsBaseFile::ReleaseClientContext
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::DestroyAbsoluteContainerPath
CClfsBaseFilePersisted::FlushImage
CClfsBaseFilePersisted::QueryBaseSecurity
CClfsBaseFilePersisted::QueryContainerSecurity
CClfsBaseFilePersisted::RemoveContainerCClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptor
CClfsBaseFilePersisted::UnloadContainerQ
CClfsContainer::CClfsContainer
CClfsContainer::Create
CClfsContainer::FinishInitializeFile
CClfsContainer::GetRawSectorSize
CClfsContainer::Open
CClfsContainer::Remove
ClfsIsContainerPathRelative
ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlSetBits
WPP_SF_sdiD
WPP_SF_sdiSdd
WPP_SF_sdidd
WPP_SF_slS
_guard_dispatch_icall
memcpy
memset
|
Expand for full list:
CClfsBaseFile::ContainerCount
CClfsBaseFile::GetBaseLogRecord
CClfsBaseFile::GetSymbol
CClfsBaseFile::OffsetToAddr
CClfsBaseFile::ReleaseClientContext
CClfsBaseFile::ValidateContainerOffsets
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::DestroyAbsoluteContainerPath
CClfsBaseFilePersisted::FlushImage
CClfsBaseFilePersisted::QueryBaseSecurity
CClfsBaseFilePersisted::QueryContainerSecurityCClfsBaseFilePersisted::RemoveContainer
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptor
CClfsBaseFilePersisted::UnloadContainerQ
CClfsContainer::CClfsContainer
CClfsContainer::Create
CClfsContainer::FinishInitializeFile
CClfsContainer::GetRawSectorSize
CClfsContainer::Open
CClfsContainer::Remove
ClfsIsContainerPathRelative
ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExAcquireResourceExclusiveLite
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseResourceForThreadLite
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlSetBits
WPP_SF_sdiD
WPP_SF_sdiSdd
WPP_SF_sdidd
WPP_SF_slS
_guard_dispatch_icall
memcpy
memset
operator_delete
operator_new
| |`calling`|CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize|CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize| |paramcount|9|9| |`address`|1c0035450|1c0035540| |sig|long __thiscall LoadContainerQ(CClfsBaseFilePersisted * this, ulong * param_1, ulong param_2, uchar param_3, uchar param_4, _CLS_LSN param_5, ulong * param_6, ulong * param_7, __uint64 * param_8)|long __thiscall LoadContainerQ(CClfsBaseFilePersisted * this, ulong * param_1, ulong param_2, uchar param_3, uchar param_4, _CLS_LSN param_5, ulong * param_6, ulong * param_7, __uint64 * param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### CClfsBaseFilePersisted::LoadContainerQ Called Diff ```diff --- CClfsBaseFilePersisted::LoadContainerQ called +++ CClfsBaseFilePersisted::LoadContainerQ called @@ -5,0 +6 @@ +CClfsBaseFile::ValidateContainerOffsets @@ -23 +23,0 @@ -NTOSKRNL.EXE::ExAllocatePoolWithTag @@ -34,0 +35,2 @@ +operator_delete +operator_new ``` ### CClfsBaseFilePersisted::LoadContainerQ Calling Diff ```diff ``` ### CClfsBaseFilePersisted::LoadContainerQ Diff ```diff --- CClfsBaseFilePersisted::LoadContainerQ +++ CClfsBaseFilePersisted::LoadContainerQ @@ -1,514 +1,515 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: long __cdecl CClfsBaseFilePersisted::LoadContainerQ(unsigned long * __ptr64 const,unsigned long,unsigned char,unsigned char,union _CLS_LSN,unsigned long & __ptr64,unsigned long & __ptr64,unsigned __int64 & __ptr64) __ptr64 */ long __thiscall CClfsBaseFilePersisted::LoadContainerQ - (CClfsBaseFilePersisted *this,ulong *param_1,CClfsContainer **param_3_00,uchar param_3, - char param_4,undefined8 param_6,uint *param_7,uint *param_8,CClfsContainer *param_9) + (CClfsBaseFilePersisted *this,ulong *param_1,uint param_2,uchar param_3,char param_4, + undefined8 param_6,uint *param_7,uint *param_8,__uint64 *param_9) { - bool bVar1; - _CLFS_CONTAINER_CONTEXT *p_Var2; - char cVar3; - uchar uVar4; - ulong uVar5; - long lVar6; - uint uVar7; - uint uVar8; - ulong uVar9; - uint uVar10; - _CLFS_BASE_RECORD_HEADER *p_Var11; - void *pvVar12; - wchar_t *pwVar13; - CClfsContainer *pCVar14; - undefined8 *puVar15; - ulonglong uVar16; - _UNICODE_STRING *p_Var17; - _UNICODE_STRING *p_Var18; - uint uVar19; - uint *puVar20; - _CLFS_FILTER_CONTEXT *p_Var21; - ulong *puVar22; - _CLFS_CONTAINER_CONTEXT *p_Var23; - char cVar24; - uint uVar25; - uint *puVar26; - ulonglong uVar27; - undefined4 uVar28; - undefined4 uVar29; - undefined4 uVar30; + undefined1 auVar1 [16]; + bool bVar2; + _CLFS_CONTAINER_CONTEXT *p_Var3; + char cVar4; + uchar uVar5; + ulong uVar6; + long lVar7; + long lVar8; + uint uVar9; + _CLFS_BASE_RECORD_HEADER *p_Var10; + void *pvVar11; + wchar_t *pwVar12; + undefined8 *puVar13; + uint *puVar14; + __uint64 _Var15; + uint *puVar16; + CClfsContainer *pCVar17; + uint uVar18; + _UNICODE_STRING *p_Var19; + _UNICODE_STRING *p_Var20; + __uint64 *p_Var21; + uint *puVar22; + ulonglong uVar23; + _CLFS_FILTER_CONTEXT *p_Var24; + ulong *puVar25; + _CLFS_CONTAINER_CONTEXT *p_Var26; + char cVar27; + uint uVar28; + ulonglong uVar29; + uint *puVar30; undefined4 uVar31; + undefined4 uVar32; + undefined4 uVar33; + undefined4 uVar34; uint local_res18 [2]; uchar local_res20; - uint *in_stack_ffffffffffffff08; - uint local_c4; + uint *in_stack_fffffffffffffef8; + long local_d4; + CClfsBaseFile *local_c8; uint *local_c0; uint local_b8; - void *local_b0; - _CLFS_CLIENT_CONTEXT *local_a8 [2]; + uint *local_b0; + ulong local_a8; + _CLFS_CLIENT_CONTEXT *local_a0; undefined8 local_98; undefined8 uStack_90; undefined8 local_88; undefined8 uStack_80; uint local_78; - uint local_74; _CLFS_CONTAINER_CONTEXT *local_70; undefined8 local_68; undefined8 uStack_60; - ulonglong local_58; - _CLFS_BASE_RECORD_HEADER *local_50; + CClfsContainer *local_58; + ulonglong local_50; ulonglong local_48; - puVar26 = param_8; - puVar20 = param_7; - local_58 = 0; + p_Var21 = param_9; + puVar30 = param_8; + puVar16 = (uint *)0x0; + local_50 = 0; local_88 = 0; uStack_80 = 0; local_98 = 0; uStack_90 = 0; local_68 = 0; uStack_60 = 0; - local_a8[0] = (_CLFS_CLIENT_CONTEXT *)0x0; + local_c8 = (CClfsBaseFile *)0x0; + local_a0 = (_CLFS_CLIENT_CONTEXT *)0x0; + local_b0 = (uint *)0x0; local_c0 = (uint *)0x0; - local_b0 = (void *)0x0; param_6._0_4_ = 0; - local_c4 = 0; - local_res18[0] = (uint)param_3_00 & 0xffffff00; - bVar1 = false; - *(__uint64 *)param_9 = 0; + local_d4 = 0; + local_res18[0] = param_2 & 0xffffff00; + bVar2 = false; + *param_9 = 0; *param_7 = 0xffffffff; *param_8 = 0; - uVar27 = 0; - for (uVar16 = uVar27; (uint)uVar16 < 0x400; uVar16 = (ulonglong)((uint)uVar16 + 1)) { - param_1[uVar16] = 0xffffffff; - } + uVar9 = 0x1000; local_res20 = param_3; - cVar3 = ExAcquireResourceExclusiveLite(*(undefined8 *)(this + 0x20),1); - pCVar14 = (CClfsContainer *)this; - cVar24 = cVar3; - p_Var11 = CClfsBaseFile::GetBaseLogRecord((CClfsBaseFile *)this); - uVar10 = (uint)param_3_00; - if (p_Var11 == (_CLFS_BASE_RECORD_HEADER *)0x0) { - local_c4 = 0xc01a000d; - cVar3 = cVar24; - uVar7 = 0xc01a000d; + memset(param_1,-1,0x1000); + cVar4 = ExAcquireResourceExclusiveLite(*(undefined8 *)(this + 0x20),1); + pCVar17 = (CClfsContainer *)this; + cVar27 = cVar4; + p_Var10 = CClfsBaseFile::GetBaseLogRecord((CClfsBaseFile *)this); + puVar22 = puVar16; + puVar14 = puVar16; + if (p_Var10 == (_CLFS_BASE_RECORD_HEADER *)0x0) { + local_d4 = -0x3fe5fff3; + cVar4 = cVar27; + lVar7 = -0x3fe5fff3; } else { - pCVar14 = (CClfsContainer *)this; - local_50 = p_Var11 + 0x328; - uVar5 = CClfsBaseFile::ContainerCount((CClfsBaseFile *)this); - uVar10 = (uint)param_3_00; - if (uVar5 == 0) { + local_58 = (CClfsContainer *)(p_Var10 + 0x328); + pCVar17 = (CClfsContainer *)this; + uVar6 = CClfsBaseFile::ContainerCount((CClfsBaseFile *)this); + local_a8 = uVar6; + if (uVar6 == 0) { *param_7 = 0; - puVar20 = param_7; - uVar7 = 0; + puVar30 = param_8; + lVar7 = 0; } else { - uVar16 = 0; - local_74 = 0; - uVar25 = 0; - local_78 = 0; - p_Var11 = p_Var11 + 0x328; - while( true ) { - uVar10 = (uint)param_3_00; - uVar19 = (uint)uVar16; - if ((0x3ff < uVar19) || (uVar5 <= uVar25)) break; - local_70 = (_CLFS_CONTAINER_CONTEXT *)0x0; - pCVar14 = (CClfsContainer *)&local_98; - RtlInitUnicodeString(pCVar14,L""); - uVar10 = (uint)param_3_00; - uVar7 = *(uint *)(p_Var11 + uVar16 * 4); - if (uVar7 != 0) { - if (0x1337 < uVar7) { - pCVar14 = (CClfsContainer *)this; - lVar6 = CClfsBaseFile::GetSymbol((CClfsBaseFile *)this,uVar7,uVar19,&local_70); - uVar10 = (uint)uVar16; - if (lVar6 < 0) { - local_c4 = 0xc01a000d; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = 0xc01a000d; - goto LAB_0; + pCVar17 = (CClfsContainer *)0x1000; + local_c8 = operator_new(0x1000,1); + if (local_c8 == (CClfsBaseFile *)0x0) { + local_d4 = -0x3fffff66; + puVar30 = param_8; + lVar7 = -0x3fffff66; + } + else { + uVar23 = 0x1000; + pCVar17 = (CClfsContainer *)local_c8; + memcpy(local_c8,local_58,0x1000); + local_d4 = CClfsBaseFile::ValidateContainerOffsets + ((CClfsBaseFile *)pCVar17,(ulong *)local_c8,(ulong)uVar23); + uVar9 = (uint)uVar23; + puVar22 = (uint *)0x0; + puVar14 = (uint *)0x0; + puVar30 = param_8; + lVar7 = local_d4; + if (-1 < local_d4) { + uVar29 = 0; + local_78 = 0; + local_b8 = 0; + while( true ) { + uVar9 = (uint)uVar23; + uVar28 = (uint)uVar29; + puVar14 = puVar16; + if ((0x3ff < uVar28) || (uVar6 <= local_b8)) break; + local_70 = (_CLFS_CONTAINER_CONTEXT *)0x0; + RtlInitUnicodeString(&local_98,L""); + uVar9 = (uint)uVar23; + uVar18 = *(uint *)(local_58 + uVar29 * 4); + pCVar17 = local_58; + if (uVar18 == 0) { + local_78 = uVar28 + 1; + uVar29 = (ulonglong)local_78; } - pCVar14 = (CClfsContainer *)this; - pvVar12 = CClfsBaseFile::OffsetToAddr((CClfsBaseFile *)this,uVar7); - if (pvVar12 == (void *)0x0) { - local_c4 = 0xc01a000d; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = 0xc01a000d; - goto LAB_0; - } - pCVar14 = (CClfsContainer *)this; - pwVar13 = CClfsBaseFile::OffsetToAddr - ((CClfsBaseFile *)this,*(ulong *)((longlong)pvVar12 + -0x10)); - if (pwVar13 == (wchar_t *)0x0) { - local_c4 = 0xc01a000d; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = 0xc01a000d; - goto LAB_0; - } - if ((WPP_GLOBAL_Control != (CClfsContainer *)&WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) { - in_stack_ffffffffffffff08 = - (uint *)CONCAT44((int)((ulonglong)in_stack_ffffffffffffff08 >> 0x20),0x3556); - WPP_SF_slS(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x10, - &WPP_7915ca08928f3a17370c92aa85923426_Traceguids, - "CClfsBaseFilePersisted::LoadContainerQ",in_stack_ffffffffffffff08,pwVar13) - ; - } - p_Var2 = local_70; - param_3_00 = &WPP_GLOBAL_Control; - uVar10 = 0xc001c000; - p_Var23 = local_70 + 8; - if (*(__uint64 *)param_9 == 0) { - uVar16 = *(ulonglong *)p_Var23; - if ((uVar16 != 0) && ((uVar16 & 0x7ffff) == 0)) { - *(ulonglong *)param_9 = uVar16; - goto LAB_1; + else { + if (uVar18 < 0x1338) goto LAB_0; + pCVar17 = (CClfsContainer *)this; + uVar23 = uVar29; + lVar7 = CClfsBaseFile::GetSymbol((CClfsBaseFile *)this,uVar18,uVar28,&local_70); + uVar9 = (uint)uVar23; + if (((lVar7 < 0) || + (pCVar17 = (CClfsContainer *)this, + pvVar11 = CClfsBaseFile::OffsetToAddr((CClfsBaseFile *)this,uVar18), + pvVar11 == (void *)0x0)) || + (pCVar17 = (CClfsContainer *)this, + pwVar12 = CClfsBaseFile::OffsetToAddr + ((CClfsBaseFile *)this,*(ulong *)((longlong)pvVar11 + -0x10)), + pwVar12 == (wchar_t *)0x0)) goto LAB_0; + pCVar17 = WPP_GLOBAL_Control; + if ((WPP_GLOBAL_Control != (CClfsContainer *)&WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x4000000) != 0)) { + in_stack_fffffffffffffef8 = + (uint *)CONCAT44((int)((ulonglong)in_stack_fffffffffffffef8 >> 0x20),0x3600); + uVar9 = 0xc00141f8; + pCVar17 = *(CClfsContainer **)(WPP_GLOBAL_Control + 0x18); + WPP_SF_slS(pCVar17,0x10,&WPP_8dd3c077296234e0d10b9704d9fc7423_Traceguids, + "CClfsBaseFilePersisted::LoadContainerQ",in_stack_fffffffffffffef8, + pwVar12); + } + p_Var3 = local_70; + p_Var26 = local_70 + 8; + if (*p_Var21 == 0) { + uVar23 = *(ulonglong *)p_Var26; + if ((uVar23 == 0) || ((uVar23 & 0x7ffff) != 0)) goto LAB_0; + *p_Var21 = uVar23; + } + else if (*p_Var21 != *(__uint64 *)p_Var26) goto LAB_0; + uVar9 = *(uint *)(local_70 + 0x14); + uVar23 = (ulonglong)uVar9; + if (uVar9 == 0xffffffff) { + *(undefined8 *)(local_70 + 0x18) = 0; + pCVar17 = (CClfsContainer *)this; + local_d4 = RemoveContainer(this,uVar28); + uVar9 = (uint)uVar23; + puVar22 = local_c0; + puVar30 = param_8; + lVar7 = local_d4; + if (local_d4 < 0) goto LAB_1; + local_78 = uVar28 + 1; + uVar29 = (ulonglong)local_78; + uVar6 = local_a8; + } + else { + uVar18 = *(uint *)(local_70 + 0x24); + if ((uVar18 & 8) != 0) { + if ((WPP_GLOBAL_Control != (CClfsContainer *)&WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x8000000) != 0)) { + uVar9 = 0xc00141f8; + WPP_SF_sdiD(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x11, + &WPP_8dd3c077296234e0d10b9704d9fc7423_Traceguids, + "CClfsBaseFilePersisted::LoadContainerQ"); + uVar18 = *(uint *)(p_Var3 + 0x24); + } + uVar18 = uVar18 & 0xfffffff7; + *(uint *)(p_Var3 + 0x24) = uVar18; + } + if ((uVar18 & 0x20) != 0) { + if ((WPP_GLOBAL_Control != (CClfsContainer *)&WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x8000000) != 0)) { + uVar9 = 0xc00141f8; + WPP_SF_sdiD(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x12, + &WPP_8dd3c077296234e0d10b9704d9fc7423_Traceguids, + "CClfsBaseFilePersisted::LoadContainerQ"); + uVar18 = *(uint *)(p_Var3 + 0x24); + } + *(uint *)(p_Var3 + 0x24) = uVar18 & 0xffffffdf; + } + RtlInitUnicodeString(&local_98); + uVar6 = (ulong)pwVar12; + uVar5 = ClfsIsContainerPathRelative((_UNICODE_STRING *)&local_98); + if (uVar5 == '\0') { + uVar31 = (undefined4)local_98; + uVar32 = local_98._4_4_; + uVar33 = (undefined4)uStack_90; + uVar34 = uStack_90._4_4_; + } + else { + p_Var20 = (_UNICODE_STRING *)&local_68; + p_Var19 = (_UNICODE_STRING *)&local_98; + pCVar17 = (CClfsContainer *)this; + lVar7 = CreateAbsoluteContainerPath(this,p_Var19,p_Var20); + uVar6 = (ulong)p_Var19; + uVar9 = (uint)p_Var20; + puVar22 = local_c0; + puVar30 = param_8; + local_d4 = lVar7; + if (lVar7 < 0) goto LAB_1; + bVar2 = true; + uVar31 = (undefined4)local_68; + uVar32 = local_68._4_4_; + uVar33 = (undefined4)uStack_60; + uVar34 = uStack_60._4_4_; + } + local_88 = CONCAT44(uVar32,uVar31); + uStack_80 = CONCAT44(uVar34,uVar33); + pCVar17 = (CClfsContainer *)ExAllocateFromPagedLookasideList(0x1c001e900); + if (pCVar17 == (CClfsContainer *)0x0) { + puVar13 = (undefined8 *)0x0; + } + else { + puVar13 = (undefined8 *)CClfsContainer::CClfsContainer(pCVar17,uVar6); + } + *(undefined8 **)(p_Var3 + 0x18) = puVar13; + if (puVar13 == (undefined8 *)0x0) { + lVar7 = -0x3fffff66; + pCVar17 = (CClfsContainer *)0x0; + puVar22 = local_c0; + puVar30 = param_8; + local_d4 = lVar7; + goto LAB_1; + } + (**(code **)*puVar13)(); + pCVar17 = *(CClfsContainer **)(p_Var3 + 0x18); + in_stack_fffffffffffffef8 = local_res18; + p_Var24 = (_CLFS_FILTER_CONTEXT *)(this + 0xb0); + p_Var20 = (_UNICODE_STRING *)&local_88; + lVar7 = CClfsContainer::Open + (pCVar17,p_Var20,p_Var24,local_res20, + (uchar *)in_stack_fffffffffffffef8); + uVar6 = (ulong)p_Var20; + uVar9 = (uint)p_Var24; + if (lVar7 < 0) { + if ((lVar7 == -0x3fffffcc) || (lVar7 == -0x3fffffef)) { + if ((*(uint *)(p_Var3 + 0x24) & 1) == 0) { + lVar7 = -0x3fe5fff1; + local_d4 = -0x3fe5fff1; + puVar22 = local_c0; + puVar30 = param_8; + goto LAB_1; + } + if (lVar7 == -0x3fffffef) { + p_Var20 = (_UNICODE_STRING *)&local_88; + CClfsContainer::Remove(*(CClfsContainer **)(p_Var3 + 0x18),p_Var20); + uVar6 = (ulong)p_Var20; + } + (**(code **)(**(longlong **)(p_Var3 + 0x18) + 8))(); + *(undefined8 *)(p_Var3 + 0x18) = 0; + pCVar17 = (CClfsContainer *)ExAllocateFromPagedLookasideList(0x1c001e900); + if (pCVar17 == (CClfsContainer *)0x0) { + puVar13 = (undefined8 *)0x0; + } + else { + puVar13 = (undefined8 *)CClfsContainer::CClfsContainer(pCVar17,uVar6); + } + *(undefined8 **)(p_Var3 + 0x18) = puVar13; + if (puVar13 == (undefined8 *)0x0) { + lVar7 = -0x3fffff66; + pCVar17 = (CClfsContainer *)0x0; + puVar22 = local_c0; + puVar30 = param_8; + local_d4 = lVar7; + goto LAB_1; + } + (**(code **)*puVar13)(); + if (puVar16 == (uint *)0x0) { + if (param_4 != '\0') { + puVar25 = (ulong *)¶m_6; + lVar8 = QueryBaseSecurity(this,&local_b0,puVar25); + uVar9 = (uint)puVar25; + if (lVar8 < 0) { + local_d4 = -0x3fffff87; + } + else { + local_d4 = SetDefaultSaclSecurityDescriptor(&local_b0,(ulong *)¶m_6); + puVar16 = local_b0; + if (-1 < local_d4) goto LAB_2; + } + pCVar17 = *(CClfsContainer **)(p_Var3 + 0x18); + (**(code **)(*(longlong *)pCVar17 + 8))(); + *(undefined8 *)(p_Var3 + 0x18) = 0; + puVar22 = local_c0; + puVar14 = local_b0; + puVar30 = param_8; + lVar7 = local_d4; + goto LAB_1; + } + puVar14 = operator_new((ulonglong)CClfsBaseFile::m_cbNoSecurity,1); + local_b0 = puVar14; + if (puVar14 == (uint *)0x0) { + lVar7 = -0x3fffff66; + local_d4 = -0x3fffff66; + pCVar17 = *(CClfsContainer **)(p_Var3 + 0x18); + (**(code **)(*(longlong *)pCVar17 + 8))(); + *(undefined8 *)(p_Var3 + 0x18) = 0; + puVar22 = local_c0; + puVar30 = param_8; + goto LAB_1; + } + memcpy(puVar14,CClfsBaseFile::m_psdNoSecurity, + (ulonglong)CClfsBaseFile::m_cbNoSecurity); + puVar16 = puVar14; + } +LAB_2: + in_stack_fffffffffffffef8 = puVar16; + lVar8 = CClfsContainer::Create + (*(CClfsContainer **)(p_Var3 + 0x18), + (_UNICODE_STRING *)&local_88,(__uint64 *)p_Var26, + (_CLFS_FILTER_CONTEXT *)(this + 0xb0),puVar16,local_res20, + (uchar *)local_res18); + uVar9 = (uint)p_Var26; + if (-1 < lVar8) goto LAB_3; + lVar7 = -0x3fe5fff2; + local_d4 = -0x3fe5fff2; + pCVar17 = *(CClfsContainer **)(p_Var3 + 0x18); + (**(code **)(*(longlong *)pCVar17 + 8))(); + *(undefined8 *)(p_Var3 + 0x18) = 0; + puVar22 = local_c0; + puVar14 = puVar16; + puVar30 = param_8; + goto LAB_1; + } + local_d4 = lVar7; + if (lVar7 == -0x3fffffc6) { + local_d4 = -0x3fe5fff1; + } +LAB_4: + pCVar17 = *(CClfsContainer **)(p_Var3 + 0x18); +LAB_5: + (**(code **)(*(longlong *)pCVar17 + 8))(); + *(undefined8 *)(p_Var3 + 0x18) = 0; + puVar22 = local_c0; + puVar14 = puVar16; + puVar30 = param_8; + lVar7 = local_d4; + goto LAB_1; + } +LAB_3: + uVar6 = CClfsContainer::GetRawSectorSize(*(CClfsContainer **)(p_Var3 + 0x18)); + p_Var21 = param_9; + pCVar17 = *(CClfsContainer **)(p_Var3 + 0x18); + if (uVar6 != *(ulong *)(this + 0x90)) { + local_d4 = -0x3fe5ffff; + goto LAB_5; + } + if (*(longlong *)(pCVar17 + 0x20) != 0) { + local_50 = *(ulonglong *)(pCVar17 + 8); + local_48 = local_50; + } + if (local_50 < *param_9) { + if ((*(uint *)(p_Var3 + 0x24) & 1) != 0) { + lVar7 = CClfsContainer::FinishInitializeFile(pCVar17,param_9); + local_d4 = lVar7; + if (lVar7 < 0) goto LAB_4; + goto LAB_6; + } +LAB_7: + local_d4 = -0x3fe5fff3; + goto LAB_4; + } +LAB_6: + local_d4 = lVar7; + if ((param_4 == '\0') && ((char)local_res18[0] != '\0')) { + uVar9 = 0; + local_d4 = QueryContainerSecurity + (*(CClfsContainer **)(p_Var3 + 0x18),&local_c0,0, + (ulong *)¶m_6); + if (local_d4 < 0) goto LAB_4; + ExFreePoolWithTag(local_c0,0); + local_c0 = (uint *)0x0; + } + if ((*(uint *)(p_Var3 + 0x24) & 1) != 0) { + *(undefined4 *)(p_Var3 + 0x24) = 2; + local_d4 = FlushImage(this); + if (local_d4 < 0) goto LAB_4; + } + if (param_1[*(uint *)(p_Var3 + 0x14) & 0x3ff] != 0xffffffff) goto LAB_7; + param_1[*(uint *)(p_Var3 + 0x14) & 0x3ff] = uVar28; + uVar9 = *(uint *)(p_Var3 + 0x14); + if (uVar9 < *param_7) { + *param_7 = uVar9; + uVar9 = *(uint *)(p_Var3 + 0x14); + } + if (*param_8 <= uVar9) { + *param_8 = uVar9 + 1; + } + pCVar17 = (CClfsContainer *)(this + 0xe8); + uVar23 = 1; + RtlSetBits(pCVar17,uVar29); + local_b8 = local_b8 + 1; + local_78 = uVar28 + 1; + uVar29 = (ulonglong)local_78; + uVar6 = local_a8; + lVar7 = local_d4; } } - else if (*(__uint64 *)param_9 == *(__uint64 *)p_Var23) { -LAB_1: - if (*(int *)(local_70 + 0x14) == -1) { - *(undefined8 *)(local_70 + 0x18) = 0; - pCVar14 = (CClfsContainer *)this; - local_c4 = RemoveContainer(this,uVar19); - uVar10 = (uint)param_3_00; - uVar27 = (ulonglong)local_c4; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = local_c4; - if (-1 < (int)local_c4) goto LAB_2; - goto LAB_0; + } + puVar22 = local_c0; + puVar30 = param_8; + if (local_b8 != uVar6) { + auVar1._8_8_ = 0; + auVar1._0_8_ = (ulonglong)(*(ushort *)(this + 0xd8) >> 1) + 1; + _Var15 = SUB168(ZEXT816(2) * auVar1,0); + if (SUB168(ZEXT816(2) * auVar1,8) != 0) { + _Var15 = 0xffffffffffffffff; + } + pCVar17 = operator_new(_Var15,1); + if (pCVar17 == (CClfsContainer *)0x0) { + pCVar17 = WPP_GLOBAL_Control; + if ((WPP_GLOBAL_Control != (CClfsContainer *)&WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 0x1b & 1) != 0)) { + pCVar17 = *(CClfsContainer **)(WPP_GLOBAL_Control + 0x18); + WPP_SF_sdidd(pCVar17); } - uVar7 = *(uint *)(local_70 + 0x24); - if ((uVar7 & 8) != 0) { - if ((WPP_GLOBAL_Control != (CClfsContainer *)&WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x8000000) != 0)) { - WPP_SF_sdiD(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x11, - &WPP_7915ca08928f3a17370c92aa85923426_Traceguids, - "CClfsBaseFilePersisted::LoadContainerQ"); - uVar7 = *(uint *)(p_Var2 + 0x24); - } - uVar7 = uVar7 & 0xfffffff7; - *(uint *)(p_Var2 + 0x24) = uVar7; + } + else { + memset(pCVar17,0,(ulonglong)*(ushort *)(this + 0xd8) + 2); + uVar9 = (uint)*(ushort *)(this + 0xd8); + memcpy(pCVar17,*(void **)(this + 0xe0),(ulonglong)*(ushort *)(this + 0xd8)); + if ((WPP_GLOBAL_Control != (CClfsContainer *)&WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 0x1b & 1) != 0)) { + WPP_SF_sdiSdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18)); } - uVar10 = 0xc001c000; - if ((uVar7 & 0x20) != 0) { - uVar10 = 0xc001c000; - if ((WPP_GLOBAL_Control != (CClfsContainer *)&WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x8000000) != 0)) { - uVar10 = 0xc00143f0; - WPP_SF_sdiD(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x12, - &WPP_7915ca08928f3a17370c92aa85923426_Traceguids, - "CClfsBaseFilePersisted::LoadContainerQ"); - uVar7 = *(uint *)(p_Var2 + 0x24); - } - *(uint *)(p_Var2 + 0x24) = uVar7 & 0xffffffdf; - } - RtlInitUnicodeString(&local_98); - uVar9 = (ulong)pwVar13; - uVar4 = ClfsIsContainerPathRelative((_UNICODE_STRING *)&local_98); - if (uVar4 == '\0') { - uVar28 = (undefined4)local_98; - uVar29 = local_98._4_4_; - uVar30 = (undefined4)uStack_90; - uVar31 = uStack_90._4_4_; - } - else { - p_Var18 = (_UNICODE_STRING *)&local_68; - p_Var17 = (_UNICODE_STRING *)&local_98; - pCVar14 = (CClfsContainer *)this; - uVar7 = CreateAbsoluteContainerPath(this,p_Var17,p_Var18); - uVar9 = (ulong)p_Var17; - uVar10 = (uint)p_Var18; - puVar20 = param_7; - puVar26 = param_8; - local_c4 = uVar7; - if ((int)uVar7 < 0) goto LAB_0; - bVar1 = true; - uVar28 = (undefined4)local_68; - uVar29 = local_68._4_4_; - uVar30 = (undefined4)uStack_60; - uVar31 = uStack_60._4_4_; - } - local_88 = CONCAT44(uVar29,uVar28); - uStack_80 = CONCAT44(uVar31,uVar30); - pCVar14 = (CClfsContainer *)ExAllocateFromPagedLookasideList(0x1c001e900); - if (pCVar14 == (CClfsContainer *)0x0) { - puVar15 = (undefined8 *)0x0; - } - else { - puVar15 = (undefined8 *)CClfsContainer::CClfsContainer(pCVar14,uVar9); - } - *(undefined8 **)(p_Var2 + 0x18) = puVar15; - if (puVar15 == (undefined8 *)0x0) { -LAB_3: - uVar7 = 0xc000009a; - pCVar14 = (CClfsContainer *)0x0; - puVar20 = param_7; - puVar26 = param_8; - local_c4 = uVar7; - } - else { - (**(code **)*puVar15)(); - in_stack_ffffffffffffff08 = local_res18; - p_Var21 = (_CLFS_FILTER_CONTEXT *)(this + 0xb0); - p_Var18 = (_UNICODE_STRING *)&local_88; - uVar8 = CClfsContainer::Open - (*(CClfsContainer **)(p_Var2 + 0x18),p_Var18,p_Var21,local_res20, - (uchar *)in_stack_ffffffffffffff08); - uVar9 = (ulong)p_Var18; - uVar10 = (uint)p_Var21; - local_b8 = uVar8; - if ((int)uVar8 < 0) { - if ((uVar8 != 0xc0000034) && (uVar8 != 0xc0000011)) { - uVar7 = uVar8; - if (uVar8 == 0xc000003a) { - uVar7 = 0xc01a000f; - } - goto LAB_4; - } - if ((*(uint *)(p_Var2 + 0x24) & 1) == 0) { - local_c4 = 0xc01a000f; - pCVar14 = (CClfsContainer *)(ulonglong)uVar8; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = local_c4; - } - else { - if (uVar8 == 0xc0000011) { - p_Var18 = (_UNICODE_STRING *)&local_88; - CClfsContainer::Remove(*(CClfsContainer **)(p_Var2 + 0x18),p_Var18); - uVar9 = (ulong)p_Var18; - } - (**(code **)(**(longlong **)(p_Var2 + 0x18) + 8))(); - *(undefined8 *)(p_Var2 + 0x18) = 0; - pCVar14 = (CClfsContainer *)ExAllocateFromPagedLookasideList(0x1c001e900); - if (pCVar14 == (CClfsContainer *)0x0) { - puVar15 = (undefined8 *)0x0; - } - else { - puVar15 = (undefined8 *)CClfsContainer::CClfsContainer(pCVar14,uVar9); - } - *(undefined8 **)(p_Var2 + 0x18) = puVar15; - if (puVar15 == (undefined8 *)0x0) goto LAB_3; - (**(code **)*puVar15)(); - if (local_c0 == (uint *)0x0) { - if (param_4 == '\0') { - uVar10 = 0x73666c43; - local_c0 = (uint *)ExAllocatePoolWithTag(1,CClfsBaseFile::m_cbNoSecurity); - if (local_c0 != (uint *)0x0) { - memcpy(local_c0,CClfsBaseFile::m_psdNoSecurity, - (ulonglong)CClfsBaseFile::m_cbNoSecurity); - goto LAB_5; - } - uVar7 = 0xc000009a; - } - else { - puVar22 = (ulong *)¶m_6; - lVar6 = QueryBaseSecurity(this,&local_c0,puVar22); - uVar10 = (uint)puVar22; - if (lVar6 < 0) { - uVar7 = 0xc0000079; - } - else { - uVar7 = SetDefaultSaclSecurityDescriptor(&local_c0,(ulong *)¶m_6); - if (-1 < (int)uVar7) goto LAB_5; - } - } - } - else { -LAB_5: - in_stack_ffffffffffffff08 = local_c0; - lVar6 = CClfsContainer::Create - (*(CClfsContainer **)(p_Var2 + 0x18), - (_UNICODE_STRING *)&local_88,(__uint64 *)p_Var23, - (_CLFS_FILTER_CONTEXT *)(this + 0xb0),local_c0,local_res20, - (uchar *)local_res18); - uVar10 = (uint)p_Var23; - if (-1 < lVar6) goto LAB_6; - uVar7 = 0xc01a000e; - } -LAB_4: - pCVar14 = *(CClfsContainer **)(p_Var2 + 0x18); - (**(code **)(*(__uint64 *)pCVar14 + 8))(); - *(undefined8 *)(p_Var2 + 0x18) = 0; - puVar20 = param_7; - puVar26 = param_8; - local_c4 = uVar7; - } - } - else { -LAB_6: - uVar9 = CClfsContainer::GetRawSectorSize(*(CClfsContainer **)(p_Var2 + 0x18)); - pCVar14 = *(CClfsContainer **)(p_Var2 + 0x18); - if (uVar9 == *(ulong *)(this + 0x90)) { - if (*(longlong *)(pCVar14 + 0x20) != 0) { - local_58 = *(ulonglong *)(pCVar14 + 8); - local_48 = local_58; - } - uVar7 = local_b8; - local_c4 = uVar8; - if (local_58 < *(ulonglong *)param_9) { - if ((*(uint *)(p_Var2 + 0x24) & 1) == 0) goto LAB_7; - local_c4 = CClfsContainer::FinishInitializeFile(pCVar14,(__uint64 *)param_9); - uVar7 = local_c4; - if (-1 < (int)local_c4) goto LAB_8; - } - else { -LAB_8: - uVar27 = (ulonglong)uVar7; - if ((param_4 == '\0') && ((char)local_res18[0] != '\0')) { - uVar10 = 0; - local_c4 = QueryContainerSecurity - (*(CClfsContainer **)(p_Var2 + 0x18),&local_b0,0, - (ulong *)¶m_6); - uVar27 = (ulonglong)local_c4; - if ((int)local_c4 < 0) { - pCVar14 = *(CClfsContainer **)(p_Var2 + 0x18); - (**(code **)(*(__uint64 *)pCVar14 + 8))(); - *(undefined8 *)(p_Var2 + 0x18) = 0; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = local_c4; - goto LAB_0; - } - ExFreePoolWithTag(local_b0,0); - local_b0 = (void *)0x0; - } - if ((*(uint *)(p_Var2 + 0x24) & 1) != 0) { - *(undefined4 *)(p_Var2 + 0x24) = 2; - local_c4 = FlushImage(this); - uVar27 = (ulonglong)local_c4; - if ((int)local_c4 < 0) { - pCVar14 = *(CClfsContainer **)(p_Var2 + 0x18); - (**(code **)(*(__uint64 *)pCVar14 + 8))(); - *(undefined8 *)(p_Var2 + 0x18) = 0; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = local_c4; - goto LAB_0; - } - } - if (param_1[*(uint *)(p_Var2 + 0x14) & 0x3ff] == 0xffffffff) { - param_1[*(uint *)(p_Var2 + 0x14) & 0x3ff] = uVar19; - uVar10 = *(uint *)(p_Var2 + 0x14); - if (uVar10 < *param_7) { - *param_7 = uVar10; - uVar10 = *(uint *)(p_Var2 + 0x14); - } - if (*param_8 <= uVar10) { - *param_8 = uVar10 + 1; - } - pCVar14 = (CClfsContainer *)(this + 0xe8); - param_3_00 = (CClfsContainer **)0x1; - RtlSetBits(); - uVar25 = uVar25 + 1; - local_78 = uVar25; - goto LAB_2; - } -LAB_7: - local_c4 = 0xc01a000d; - } - pCVar14 = *(CClfsContainer **)(p_Var2 + 0x18); - (**(code **)(*(__uint64 *)pCVar14 + 8))(); - *(undefined8 *)(p_Var2 + 0x18) = 0; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = local_c4; - } - else { - local_c4 = 0xc01a0001; - (**(code **)(*(longlong *)pCVar14 + 8))(); - *(undefined8 *)(p_Var2 + 0x18) = 0; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = 0xc01a0001; - } - } - } - goto LAB_0; + operator_delete(pCVar17); } - uVar7 = 0xc01a000d; - pCVar14 = param_9; - puVar20 = param_7; - puVar26 = param_8; - local_c4 = uVar7; - goto LAB_0; - } - local_c4 = 0xc01a000d; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = 0xc01a000d; - goto LAB_0; - } -LAB_2: - local_74 = uVar19 + 1; - uVar16 = (ulonglong)local_74; - p_Var11 = local_50; - } - puVar20 = param_7; - puVar26 = param_8; - uVar7 = (uint)uVar27; - if (uVar25 != uVar5) { - uVar10 = 0x73666c43; - pCVar14 = (CClfsContainer *)ExAllocatePoolWithTag(1); - if (pCVar14 == (CClfsContainer *)0x0) { - pCVar14 = WPP_GLOBAL_Control; - if ((WPP_GLOBAL_Control != (CClfsContainer *)&WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 0x1b & 1) != 0)) { - pCVar14 = *(CClfsContainer **)(WPP_GLOBAL_Control + 0x18); - WPP_SF_sdidd(pCVar14); +LAB_0: + lVar7 = -0x3fe5fff3; + puVar22 = local_c0; + puVar30 = param_8; + local_d4 = lVar7; } } - else { - memset(pCVar14,0,(ulonglong)*(ushort *)(this + 0xd8) + 2); - uVar10 = (uint)*(ushort *)(this + 0xd8); - memcpy(pCVar14,*(void **)(this + 0xe0),(ulonglong)*(ushort *)(this + 0xd8)); - if ((WPP_GLOBAL_Control != (CClfsContainer *)&WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x2c) >> 0x1b & 1) != 0)) { - WPP_SF_sdiSdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18)); - } - ExFreePoolWithTag(pCVar14,0); - } - local_c4 = 0xc01a000d; - puVar20 = param_7; - puVar26 = param_8; - uVar7 = 0xc01a000d; } } } -LAB_0: - if (cVar3 != '\0') { - pCVar14 = *(CClfsContainer **)(this + 0x20); - ExReleaseResourceForThreadLite(pCVar14,SystemReserved1[0xf]); - uVar7 = local_c4; - } - if (bVar1) { - DestroyAbsoluteContainerPath((CClfsBaseFilePersisted *)pCVar14,(_UNICODE_STRING *)&local_68); - } - if ((int)uVar7 < 0) { - if (*puVar20 != 0xffffffff) { - UnloadContainerQ(this,param_1,uVar10,*puVar20,*puVar26); +LAB_1: + puVar16 = param_7; + if (cVar4 != '\0') { + pCVar17 = *(CClfsContainer **)(this + 0x20); + ExReleaseResourceForThreadLite(pCVar17,SystemReserved1[0xf]); + puVar22 = local_c0; + puVar14 = local_b0; + lVar7 = local_d4; + } + if (bVar2) { + DestroyAbsoluteContainerPath((CClfsBaseFilePersisted *)pCVar17,(_UNICODE_STRING *)&local_68); + } + if (lVar7 < 0) { + uVar6 = *puVar16; + if (uVar6 != 0xffffffff) { + UnloadContainerQ(this,param_1,uVar9,uVar6,*puVar30); } - *puVar26 = 0; - *puVar20 = 0; - } - if (local_a8[0] != (_CLFS_CLIENT_CONTEXT *)0x0) { - CClfsBaseFile::ReleaseClientContext((CClfsBaseFile *)this,local_a8); - } - if (local_c0 != (uint *)0x0) { - ExFreePoolWithTag(local_c0,0); - } - if (local_b0 != (void *)0x0) { - ExFreePoolWithTag(local_b0,0); - } - return uVar7; + *puVar30 = 0; + *puVar16 = 0; + } + if (local_c8 != (CClfsBaseFile *)0x0) { + operator_delete(local_c8); + } + if (local_a0 != (_CLFS_CLIENT_CONTEXT *)0x0) { + CClfsBaseFile::ReleaseClientContext((CClfsBaseFile *)this,&local_a0); + } + if (puVar14 != (uint *)0x0) { + operator_delete(puVar14); + } + if (puVar22 != (uint *)0x0) { + ExFreePoolWithTag(puVar22,0); + } + return lVar7; } ``` ## CClfsBaseFile::GetBaseLogRecord ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.3| |i_ratio|0.07| |m_ratio|0.52| |b_ratio|0.22| |match_types|Implied Match| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |`name`|GetBaseLogRecord|AddrToOffset| |`fullname`|CClfsBaseFile::GetBaseLogRecord|CClfsBaseFile::AddrToOffset| |`refcount`|37|6| |`length`|55|23| |`called`||CClfsBaseFile::GetBaseLogRecord| |`calling`|
Expand for full list:
CClfsBaseFile::AcquireClientContext
CClfsBaseFile::ClientCount
CClfsBaseFile::ContainerCount
CClfsBaseFile::FindSymbol
CClfsBaseFile::GetContainerName
CClfsBaseFile::GetUsn
CClfsBaseFile::HighWaterMarkClientId
CClfsBaseFile::LoadClientBaseLsn
CClfsBaseFile::OffsetToAddr
CClfsBaseFile::ReleaseClientContext
CClfsBaseFile::ScanContainerInfoCClfsBaseFilePersisted::AddClient
CClfsBaseFilePersisted::AddContainer
CClfsBaseFilePersisted::AddMetaClient
CClfsBaseFilePersisted::AddSymbol
CClfsBaseFilePersisted::AllocSymbol
CClfsBaseFilePersisted::AreClientIdsAvailable
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::IncrementUsn
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::RemoveClient
CClfsBaseFilePersisted::RemoveContainer
CClfsBaseFilePersisted::ResetContainerQ
CClfsBaseFilePersisted::UnloadContainerQ
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsBaseFileSnapshot::ReadContainerQ
|CClfsBaseFile::FindSymbol| |paramcount|1|2| |`address`|1c002c980|1c0029c88| |`sig`|_CLFS_BASE_RECORD_HEADER * __thiscall GetBaseLogRecord(CClfsBaseFile * this)|ulong __thiscall AddrToOffset(CClfsBaseFile * this, void * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CClfsBaseFile::GetBaseLogRecord Called Diff ```diff --- CClfsBaseFile::GetBaseLogRecord called +++ CClfsBaseFile::AddrToOffset called @@ -0,0 +1 @@ +CClfsBaseFile::GetBaseLogRecord ``` ### CClfsBaseFile::GetBaseLogRecord Calling Diff ```diff --- CClfsBaseFile::GetBaseLogRecord calling +++ CClfsBaseFile::AddrToOffset calling @@ -1,3 +0,0 @@ -CClfsBaseFile::AcquireClientContext -CClfsBaseFile::ClientCount -CClfsBaseFile::ContainerCount @@ -5,25 +1,0 @@ -CClfsBaseFile::GetContainerName -CClfsBaseFile::GetUsn -CClfsBaseFile::HighWaterMarkClientId -CClfsBaseFile::LoadClientBaseLsn -CClfsBaseFile::OffsetToAddr -CClfsBaseFile::ReleaseClientContext -CClfsBaseFile::ScanContainerInfo -CClfsBaseFilePersisted::AddClient -CClfsBaseFilePersisted::AddContainer -CClfsBaseFilePersisted::AddMetaClient -CClfsBaseFilePersisted::AddSymbol -CClfsBaseFilePersisted::AllocSymbol -CClfsBaseFilePersisted::AreClientIdsAvailable -CClfsBaseFilePersisted::CheckSecureAccess -CClfsBaseFilePersisted::CreateImage -CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor -CClfsBaseFilePersisted::IncrementUsn -CClfsBaseFilePersisted::LoadContainerQ -CClfsBaseFilePersisted::OpenImage -CClfsBaseFilePersisted::RemoveClient -CClfsBaseFilePersisted::RemoveContainer -CClfsBaseFilePersisted::ResetContainerQ -CClfsBaseFilePersisted::UnloadContainerQ -CClfsBaseFileSnapshot::InitializeSnapshot -CClfsBaseFileSnapshot::ReadContainerQ ``` ### CClfsBaseFile::GetBaseLogRecord Diff ```diff --- CClfsBaseFile::GetBaseLogRecord +++ CClfsBaseFile::AddrToOffset @@ -1,24 +1,14 @@ -/* protected: struct _CLFS_BASE_RECORD_HEADER * __ptr64 __cdecl - CClfsBaseFile::GetBaseLogRecord(void) __ptr64 */ +/* protected: unsigned long __cdecl CClfsBaseFile::AddrToOffset(void * __ptr64) __ptr64 */ -_CLFS_BASE_RECORD_HEADER * __thiscall CClfsBaseFile::GetBaseLogRecord(CClfsBaseFile *this) +ulong __thiscall CClfsBaseFile::AddrToOffset(CClfsBaseFile *this,void *param_1) { - uint uVar1; - uint uVar2; - longlong lVar3; + _CLFS_BASE_RECORD_HEADER *p_Var1; + int iVar2; - if (*(short *)(this + 0x28) != 0) { - lVar3 = *(longlong *)(*(longlong *)(this + 0x30) + 0x30); - if (lVar3 != 0) { - uVar1 = *(uint *)(*(longlong *)(this + 0x30) + 0x38); - uVar2 = *(uint *)(lVar3 + 0x28); - if (((uVar2 < uVar1) && (0x6f < uVar2)) && (0x1337 < uVar1 - uVar2)) { - return (_CLFS_BASE_RECORD_HEADER *)((ulonglong)uVar2 + lVar3); - } - } - } - return (_CLFS_BASE_RECORD_HEADER *)0x0; + iVar2 = (int)param_1; + p_Var1 = GetBaseLogRecord(this); + return iVar2 - (int)p_Var1; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## _guard_dispatch_icall ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|_guard_dispatch_icall|_guard_dispatch_icall| |fullname|_guard_dispatch_icall|_guard_dispatch_icall| |`refcount`|975|974| |length|2|2| |called||| |`calling`|
Expand for full list:
CClfsBaseFile::AcquireMetadataBlock
CClfsBaseFile::FindSymbol
CClfsBaseFile::Release
CClfsBaseFile::ReleaseMetadataBlock
CClfsBaseFilePersisted::AddContainer
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::CloseImage
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::MarkContainerQCClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::RemoveContainer
CClfsBaseFilePersisted::RemoveImage
CClfsBaseFilePersisted::UnloadContainerQ
CClfsBaseFilePersisted::UnmarkContainerQ
CClfsBaseFilePersisted::~CClfsBaseFilePersisted
CClfsContainer::IoAsyncReadCompletion
CClfsContainer::ReadSector
CClfsContainer::Remove
CClfsContainer::WorkRoutine
CClfsFlushElt::AsyncIoCompletion
CClfsFlushElt::Initialize
CClfsFlushElt::Release
CClfsFlushElt::~CClfsFlushElt
CClfsKernelMarshallingContext::AllocateIocb
CClfsKernelMarshallingContext::DeallocateIocb
CClfsLogCcb::AddArchiveRef
CClfsLogCcb::Cleanup
CClfsLogCcb::GetArchiveDescriptors
CClfsLogCcb::ReleaseArchiveRef
CClfsLogCcb::ResetFileSystemFlag
CClfsLogCcb::SetFileSystemFlag
CClfsLogCcb::UninstallLifetimeListener
CClfsLogFcbCommon::AddHandleRef
CClfsLogFcbCommon::Close
CClfsLogFcbCommon::InstallObserver
CClfsLogFcbCommon::NotifyObservers
CClfsLogFcbCommon::QueueRundownContainerDeleteQ
CClfsLogFcbCommon::RundownContainerDeleteQWorkRoutine
CClfsLogFcbCommon::UninstallObserver
CClfsLogFcbPhysical::AcquireClientSharedSecurityContext
CClfsLogFcbPhysical::AcquireForLazyWriteCallback
CClfsLogFcbPhysical::AcquireForReadAheadCallback
CClfsLogFcbPhysical::AcquireSharedSecurityContext
CClfsLogFcbPhysical::AddArchiveRef
CClfsLogFcbPhysical::AddClient
CClfsLogFcbPhysical::AdjustReservation
CClfsLogFcbPhysical::AdvanceLogBase
CClfsLogFcbPhysical::AdvanceQHead
CClfsLogFcbPhysical::AllocContainer
CClfsLogFcbPhysical::AllocateFcb
CClfsLogFcbPhysical::AppendLog
CClfsLogFcbPhysical::CacheBlock
CClfsLogFcbPhysical::CalculateAvailableFreeSpace
CClfsLogFcbPhysical::Cleanup
CClfsLogFcbPhysical::CleanupAsyncIo
CClfsLogFcbPhysical::CloseContainers
CClfsLogFcbPhysical::CloseLog
CClfsLogFcbPhysical::CompleteAsyncAdvanceLogBase
CClfsLogFcbPhysical::CompleteAsyncReadBlock
CClfsLogFcbPhysical::CompleteAsyncReadClientBlock
CClfsLogFcbPhysical::CompleteAsyncWriteRestart
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CompleteIrp
CClfsLogFcbPhysical::CreateSharedSecurityContext
CClfsLogFcbPhysical::CsqAcquireLock
CClfsLogFcbPhysical::CsqCompleteCanceledIrp
CClfsLogFcbPhysical::CsqInsertIrp
CClfsLogFcbPhysical::CsqPeekNextIrp
CClfsLogFcbPhysical::CsqReleaseLock
CClfsLogFcbPhysical::CsqRemoveIrp
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::DeleteLogIfNoVirtualStreams
CClfsLogFcbPhysical::EraseClientBlocks
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FindLsnBlock
CClfsLogFcbPhysical::FlushLog
CClfsLogFcbPhysical::FlushWorkRoutine
CClfsLogFcbPhysical::FreeFcb
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetContainer
CClfsLogFcbPhysical::GetContainerForLsn
CClfsLogFcbPhysical::GetManagementSupportInterface
CClfsLogFcbPhysical::GetNextBlockLsn
CClfsLogFcbPhysical::GetNextOwnerPageLsn
CClfsLogFcbPhysical::GetObservableInterface
CClfsLogFcbPhysical::GetPendingRequestQueueInterface
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::InsertContainerDeleteQ
CClfsLogFcbPhysical::InsertIrp
CClfsLogFcbPhysical::IsEof
CClfsLogFcbPhysical::MapCacheData
CClfsLogFcbPhysical::ModifySecurity
CClfsLogFcbPhysical::ObservationContainerAvailable
CClfsLogFcbPhysical::ObservationContainerConsumed
CClfsLogFcbPhysical::Open
CClfsLogFcbPhysical::OpenClient
CClfsLogFcbPhysical::PeekNextIrp
CClfsLogFcbPhysical::PostAsyncRequest
CClfsLogFcbPhysical::QueryLogFileInfo
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::QuerySecurity
CClfsLogFcbPhysical::QueueFlushWorker
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::ReadLog
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::ReadQueuedOwnerPage
CClfsLogFcbPhysical::ReadRawOwnerPage
CClfsLogFcbPhysical::ReadRestart
CClfsLogFcbPhysical::RebuildOwnerPage
CClfsLogFcbPhysical::ReleaseArchiveRef
CClfsLogFcbPhysical::ReleaseFlushRef
CClfsLogFcbPhysical::ReleaseFromLazyWriteCallback
CClfsLogFcbPhysical::ReleaseFromReadAheadCallback
CClfsLogFcbPhysical::RemoveClient
CClfsLogFcbPhysical::RemoveIrp
CClfsLogFcbPhysical::ReserveAndAppendLog
CClfsLogFcbPhysical::RundownContainerDeleteQ
CClfsLogFcbPhysical::SetArchiveTail
CClfsLogFcbPhysical::SetCacheFileSizes
CClfsLogFcbPhysical::SetEndOfLog
CClfsLogFcbPhysical::SetLogFileInfo
CClfsLogFcbPhysical::TearDownOpen
CClfsLogFcbPhysical::ToggleEphemeral
CClfsLogFcbPhysical::TruncateLogDiscardBlocks
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogRewriteOwnerPages
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::VirtualToPhysicalLsn
CClfsLogFcbPhysical::WrapContainers
CClfsLogFcbPhysical::WrapDeletePendingContainer
CClfsLogFcbPhysical::WriteOneRawSectorSync
CClfsLogFcbPhysical::WriteRestart
CClfsLogFcbPhysical::WriteRestartDone
CClfsLogFcbVirtual::AcquireForLazyWrite
CClfsLogFcbVirtual::AcquireForReadAhead
CClfsLogFcbVirtual::AcquireSharedSecurityContext
CClfsLogFcbVirtual::AddArchiveRef
CClfsLogFcbVirtual::AdjustReservation
CClfsLogFcbVirtual::AdvanceLogBase
CClfsLogFcbVirtual::AllocContainer
CClfsLogFcbVirtual::AllocateFcb
CClfsLogFcbVirtual::Cleanup
CClfsLogFcbVirtual::CloseLog
CClfsLogFcbVirtual::CompleteAsyncAdvanceLogBase
CClfsLogFcbVirtual::CompleteAsyncReadBlock
CClfsLogFcbVirtual::CompleteAsyncWriteRestart
CClfsLogFcbVirtual::Create
CClfsLogFcbVirtual::CreateSharedSecurityContext
CClfsLogFcbVirtual::DeleteContainer
CClfsLogFcbVirtual::Finalize
CClfsLogFcbVirtual::FlushLog
CClfsLogFcbVirtual::FlushMetadata
CClfsLogFcbVirtual::GetArchiveDescriptors
CClfsLogFcbVirtual::GetContainerName
CClfsLogFcbVirtual::GetErrorState
CClfsLogFcbVirtual::GetIoStatistics
CClfsLogFcbVirtual::GetManagementSupportInterface
CClfsLogFcbVirtual::GetMinLsn
CClfsLogFcbVirtual::GetObservableInterface
CClfsLogFcbVirtual::GetSectionObjectPointers
CClfsLogFcbVirtual::InitializeCacheMap
CClfsLogFcbVirtual::MarkLogFileContainers
CClfsLogFcbVirtual::ModifySecurity
CClfsLogFcbVirtual::Open
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsLogFcbVirtual::QuerySecurity
CClfsLogFcbVirtual::ReadLogBlock
CClfsLogFcbVirtual::ReadLogPagingIo
CClfsLogFcbVirtual::ReadRestart
CClfsLogFcbVirtual::Release
CClfsLogFcbVirtual::ReleaseArchiveRef
CClfsLogFcbVirtual::ReleaseFromLazyWrite
CClfsLogFcbVirtual::ReleaseFromReadAhead
CClfsLogFcbVirtual::ReleaseSharedSecurityContext
CClfsLogFcbVirtual::ReserveAndAppendLog
CClfsLogFcbVirtual::RundownContainerDeleteQ
CClfsLogFcbVirtual::ScanContainers
CClfsLogFcbVirtual::SetArchiveTail
CClfsLogFcbVirtual::SetEndOfLog
CClfsLogFcbVirtual::SetLogFileInfo
CClfsLogFcbVirtual::UninitializeCacheMap
CClfsLogFcbVirtual::UnmarkLogFileContainers
CClfsLogFcbVirtual::WriteRestart
CClfsLogFcbVirtual::~CClfsLogFcbVirtual
CClfsManagedLog::AddNewClient
CClfsManagedLog::AdvanceClientTailsToLsn
CClfsManagedLog::AutoGrow
CClfsManagedLog::CompleteLogGrowthOperation
CClfsManagedLog::Finalize
CClfsManagedLog::HandleLogFileFull
CClfsManagedLog::InstallLogObserver
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::ObservationContainerAvailable
CClfsManagedLog::ObservationContainerDeleted
CClfsManagedLog::ObservationToggleEphemeral
CClfsManagedLog::QueueAutoGrowWorker
CClfsManagedLog::RemoveClient
CClfsManagedLog::UninstallLogObserver
CClfsManagedLog::UnlinkClient
CClfsManagedLogClient::Finalize
CClfsManagedLogClient::Initialize
CClfsManagedLogClient::InstallLogObserver
CClfsManagedLogClient::LifetimeEndEvent
CClfsManagedLogClient::MakeObservation
CClfsManagedLogClient::Release
CClfsManagedLogClient::RemoveFromManagedLog
CClfsManagedLogClient::UninstallLogObserver
CClfsManagedLogClientKernel::AdvanceTail
CClfsManagedLogClientKernel::Initialize
CClfsManagedLogClientKernel::LogFileFullHandlerComplete
CClfsManagedLogClientKernel::LogFileUnpinComplete
CClfsManagedLogClientUser::DeliverNotification
CClfsManagedLogClientUser::Finalize
CClfsManagedLogClientUser::Initialize
CClfsManagedLogClientUser::ReadNotification
CClfsManagedLogCollection::FindManagedLog
CClfsManagedLogCollection::FindOrCreateManagedLog
CClfsRequest::AddRefReadIo
CClfsRequest::AdvanceLogBase
CClfsRequest::AdvanceLogBase
CClfsRequest::AllocContainer
CClfsRequest::AsyncReadIoCompletion
CClfsRequest::CClfsRequest
CClfsRequest::Cancel
CClfsRequest::Close
CClfsRequest::CloseLog
CClfsRequest::CompleteAsyncFlush
CClfsRequest::CompleteAsyncWriteRestart
CClfsRequest::Create
CClfsRequest::CreateReadCompletionElement
CClfsRequest::DeleteContainer
CClfsRequest::FinalizeAsyncRead
CClfsRequest::FinalizeReadRequest
CClfsRequest::Flush
CClfsRequest::Flush
CClfsRequest::FlushDone
CClfsRequest::GetContainerName
CClfsRequest::GetIoStatistics
CClfsRequest::GetMdlReference
CClfsRequest::GetMdlReferenceFromState
CClfsRequest::LogFileInfo
CClfsRequest::QueryWaitLsn
CClfsRequest::ReadDone
CClfsRequest::ReadLogBlock
CClfsRequest::ReadLogBlock
CClfsRequest::ReadLogPagingIo
CClfsRequest::ReadMgmtNotificationInProgress
CClfsRequest::ReadRestart
CClfsRequest::ReadRestart
CClfsRequest::Release
CClfsRequest::ReleaseReadIo
CClfsRequest::ReserveAdjustment
CClfsRequest::ReserveAndAppendLog
CClfsRequest::ReserveAndAppendLog
CClfsRequest::RetryAdvanceLogBase
CClfsRequest::RetryWriteRestart
CClfsRequest::ScanContainers
CClfsRequest::SetArchiveTail
CClfsRequest::SetEndOfLog
CClfsRequest::WriteRestart
CClfsRequest::WriteRestart
CClfsRequest::WriteRestartDone
CClfsRequest::WriteRestartInProgress
CClfsRequest::~CClfsRequest
CClfsRequest_State::Change_State_AdvanceLogBasePending
CClfsRequest_State::Change_State_AppendPendingFlush
CClfsRequest_State::Change_State_Done
CClfsRequest_State::Change_State_FlushPending
CClfsRequest_State::Change_State_ReadPending
CClfsRequest_State::Change_State_WriteRestartPending
CClfsRequest_State_AdvanceLogBasePending::FlushDone
CClfsRequest_State_AdvanceLogBasePending::WriteRestartInProgress
CClfsRequest_State_AppendPendingFlush::GetMdlReference
CClfsRequest_State_ReadPending::ReadDone
CClfsRequest_State_WriteRestartPending::WriteRestartInProgress
ClfsAddLogContainerSet
ClfsAddLogContainerSet$fin$0
ClfsAdvanceLogBaseInternal
ClfsAdvanceLogBaseInternal$fin$0
ClfsCloseAndResetLogFile
ClfsCloseAndResetLogFile$fin$0
ClfsDeleteLogByPointer
ClfsDeleteLogByPointer$fin$0
ClfsDispatchIoRequest
ClfsDispatchIoRequest$fin$0
ClfsFlushToLsnInternal
ClfsFlushToLsnInternal$fin$0
ClfsFreeReservedLogInternal
ClfsFreeReservedLogInternal$fin$0
ClfsGetContainerName
ClfsGetContainerName$fin$0
ClfsGetIoStatistics
ClfsGetIoStatistics$fin$0
ClfsGetLogFileInformation
ClfsGetLogFileInformation$fin$0
ClfsGetManagementSupportInterface
ClfsGetManagementSupportInterface$fin$0
ClfsGetObservableInterface
ClfsGetObservableInterface$fin$0
ClfsGetPendingRequestQueueInterface
ClfsGetPendingRequestQueueInterface$fin$0
ClfsMgmtDeregisterManagedClient
ClfsMgmtDispatchIo
ClfsMgmtInstallPolicy
ClfsMgmtInstallPolicy$fin$0
ClfsMgmtQueryPolicy
ClfsMgmtQueryPolicy$fin$0
ClfsMgmtRemovePolicy
ClfsMgmtRemovePolicy$fin$0
ClfsMgmtSetLogFileSizeAsClient
ClfsMgmtSetLogFileSizeAsClient$fin$0
ClfsMgmtUserModeDeregister
ClfsMgmtUserModeRegister
ClfsMgmtUserModeSetSizeCompletion
ClfsMgmtpAutoGrowWorker
ClfsMgmtpAutoShrinkWorker
ClfsMgmtpLogFullCompleteWorker
ClfsMgmtpLogPinnedArchiveTailWorker
ClfsMgmtpRegisterManagedClient
ClfsPrivQueryErrorState
ClfsPrivQueryErrorState$fin$0
ClfsQueryLogFileInformation
ClfsQueryLogFileInformation$fin$0
ClfsReadLogRecordInternal
ClfsReadLogRecordInternal$fin$0
ClfsReadRestartAreaInternal
ClfsReadRestartAreaInternal$fin$0
ClfsRemoveContainersInternal
ClfsRemoveContainersInternal$fin$0
ClfsRemoveLogContainerSet
ClfsRemoveLogContainerSet$fin$0
ClfsReserveAndAppendLogInternal
ClfsReserveAndAppendLogInternal$fin$0
ClfsScanLogContainersInternal
ClfsScanLogContainersInternal$fin$0
ClfsSetArchiveTail
ClfsSetArchiveTail$fin$0
ClfsSetLogFileInformation
ClfsSetLogFileInformation$fin$0
ClfsWriteRestartAreaInternal
ClfsWriteRestartAreaInternal$fin$0
ExAllocateFromPagedLookasideList
ExFreeToPagedLookasideList
FUN_1c000f0c0
FUN_1c004734b
FUN_1c004737c
WPP_SF_sdD
WPP_SF_sdSD
WPP_SF_sdiD
WPP_SF_sdiSD
WPP_SF_sdiSdd
WPP_SF_sdiSi
WPP_SF_sdid
WPP_SF_sdidd
WPP_SF_sdii
WPP_SF_sl
WPP_SF_slDD
WPP_SF_slDDDD
WPP_SF_slDDDDDD
WPP_SF_slS
WPP_SF_slSD
WPP_SF_slSiDDDiDD
WPP_SF_sld
WPP_SF_slidD
WPP_SF_sliiDDDDDD
WPP_SF_slq
WPP_SF_slqD
WPP_SF_slqdi
WPP_SF_slqqDddd
WppInitKm
WppLoadTracingSupport
WppTraceCallback
`CClfsBaseFilePersisted::AddContainer'::__l1::fin$0
`CClfsBaseFilePersisted::CheckSecureAccess'::__l1::fin$0
`CClfsBaseFilePersisted::CreateContainer'::__l1::fin$0
`CClfsBaseFilePersisted::MarkContainerQ'::__l1::fin$0
`CClfsBaseFilePersisted::UnmarkContainerQ'::__l1::fin$0
`CClfsContainer::ReadSector'::__l1::fin$0
`CClfsLogCcb::AddArchiveRef'::__l1::fin$0
`CClfsLogCcb::GetArchiveDescriptors'::__l1::fin$0
`CClfsLogCcb::ReleaseArchiveRef'::__l1::fin$0
`CClfsLogFcbPhysical::AcquireClientSharedSecurityContext'::__l1::fin$0
`CClfsLogFcbPhysical::AddArchiveRef'::__l1::fin$0
`CClfsLogFcbPhysical::AddClient'::__l1::fin$0
`CClfsLogFcbPhysical::AdjustReservation'::__l1::fin$0
`CClfsLogFcbPhysical::AdvanceLogBase'::__l1::fin$0
`CClfsLogFcbPhysical::AppendLog'::__l1::fin$0
`CClfsLogFcbPhysical::CloseLog'::__l1::fin$0
`CClfsLogFcbPhysical::CompleteAsyncAdvanceLogBase'::__l1::fin$0
`CClfsLogFcbPhysical::CompleteAsyncWriteRestart'::__l1::fin$0
`CClfsLogFcbPhysical::DeleteContainer'::__l1::fin$0
`CClfsLogFcbPhysical::EraseClientBlocks'::__l1::fin$0
`CClfsLogFcbPhysical::GetArchiveDescriptors'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$1
`CClfsLogFcbPhysical::OpenClient'::__l1::fin$0
`CClfsLogFcbPhysical::ReadClientBlock'::__l1::fin$0
`CClfsLogFcbPhysical::ReadLog'::__l1::fin$0
`CClfsLogFcbPhysical::ReadLogBlock'::__l1::fin$1
`CClfsLogFcbPhysical::ReadLogPagingIo'::__l1::fin$0
`CClfsLogFcbPhysical::SetArchiveTail'::__l1::fin$0
`CClfsLogFcbPhysical::SetLogFileInfo'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogDiscardBlocks'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogModifyStreams'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogRewriteOwnerPages'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogStart'::__l1::fin$0
`CClfsLogFcbPhysical::WriteRestart'::__l1::fin$0
`CClfsLogFcbVirtual::AdvanceLogBase'::__l1::fin$0
`CClfsLogFcbVirtual::Cleanup'::__l1::fin$0
`CClfsLogFcbVirtual::CloseLog'::__l1::fin$0
`CClfsLogFcbVirtual::CompleteAsyncAdvanceLogBase'::__l1::fin$0
`CClfsLogFcbVirtual::CompleteAsyncWriteRestart'::__l1::fin$0
`CClfsLogFcbVirtual::Create'::__l1::fin$0
`CClfsLogFcbVirtual::Open'::__l1::fin$0
`CClfsLogFcbVirtual::WriteRestart'::__l1::fin$0
`CClfsManagedLog::AddNewClient'::__l1::fin$0
`CClfsManagedLog::AutoGrow'::__l1::fin$0
`CClfsManagedLog::InvokeGrowWorker'::__l1::fin$0
`CClfsManagedLogClientUser::Initialize'::__l1::fin$0
`CClfsManagedLogClientUser::ReadNotification'::__l1::fin$0
`CClfsRequest::Close'::__l1::fin$0
`CClfsRequest::Create'::__l1::fin$0
`CClfsRequest::ReadLogPagingIo'::__l1::fin$0
`CClfsRequest::ReleaseReadIo'::__l1::fin$0
`ClfsMgmtpRegisterManagedClient'::__l1::fin$0
|
Expand for full list:
CClfsBaseFile::AcquireMetadataBlock
CClfsBaseFile::FindSymbol
CClfsBaseFile::Release
CClfsBaseFile::ReleaseMetadataBlock
CClfsBaseFilePersisted::AddContainer
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::CloseImage
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::MarkContainerQCClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::RemoveContainer
CClfsBaseFilePersisted::RemoveImage
CClfsBaseFilePersisted::UnloadContainerQ
CClfsBaseFilePersisted::UnmarkContainerQ
CClfsBaseFilePersisted::~CClfsBaseFilePersisted
CClfsContainer::IoAsyncReadCompletion
CClfsContainer::ReadSector
CClfsContainer::Remove
CClfsContainer::WorkRoutine
CClfsFlushElt::AsyncIoCompletion
CClfsFlushElt::Initialize
CClfsFlushElt::Release
CClfsFlushElt::~CClfsFlushElt
CClfsKernelMarshallingContext::AllocateIocb
CClfsKernelMarshallingContext::DeallocateIocb
CClfsLogCcb::AddArchiveRef
CClfsLogCcb::Cleanup
CClfsLogCcb::GetArchiveDescriptors
CClfsLogCcb::ReleaseArchiveRef
CClfsLogCcb::ResetFileSystemFlag
CClfsLogCcb::SetFileSystemFlag
CClfsLogCcb::UninstallLifetimeListener
CClfsLogFcbCommon::AddHandleRef
CClfsLogFcbCommon::Close
CClfsLogFcbCommon::InstallObserver
CClfsLogFcbCommon::NotifyObservers
CClfsLogFcbCommon::QueueRundownContainerDeleteQ
CClfsLogFcbCommon::RundownContainerDeleteQWorkRoutine
CClfsLogFcbCommon::UninstallObserver
CClfsLogFcbPhysical::AcquireClientSharedSecurityContext
CClfsLogFcbPhysical::AcquireForLazyWriteCallback
CClfsLogFcbPhysical::AcquireForReadAheadCallback
CClfsLogFcbPhysical::AcquireSharedSecurityContext
CClfsLogFcbPhysical::AddArchiveRef
CClfsLogFcbPhysical::AddClient
CClfsLogFcbPhysical::AdjustReservation
CClfsLogFcbPhysical::AdvanceLogBase
CClfsLogFcbPhysical::AdvanceQHead
CClfsLogFcbPhysical::AllocContainer
CClfsLogFcbPhysical::AllocateFcb
CClfsLogFcbPhysical::AppendLog
CClfsLogFcbPhysical::CacheBlock
CClfsLogFcbPhysical::CalculateAvailableFreeSpace
CClfsLogFcbPhysical::Cleanup
CClfsLogFcbPhysical::CleanupAsyncIo
CClfsLogFcbPhysical::CloseContainers
CClfsLogFcbPhysical::CloseLog
CClfsLogFcbPhysical::CompleteAsyncAdvanceLogBase
CClfsLogFcbPhysical::CompleteAsyncReadBlock
CClfsLogFcbPhysical::CompleteAsyncReadClientBlock
CClfsLogFcbPhysical::CompleteAsyncWriteRestart
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CompleteIrp
CClfsLogFcbPhysical::CreateSharedSecurityContext
CClfsLogFcbPhysical::CsqAcquireLock
CClfsLogFcbPhysical::CsqCompleteCanceledIrp
CClfsLogFcbPhysical::CsqInsertIrp
CClfsLogFcbPhysical::CsqPeekNextIrp
CClfsLogFcbPhysical::CsqReleaseLock
CClfsLogFcbPhysical::CsqRemoveIrp
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::DeleteLogIfNoVirtualStreams
CClfsLogFcbPhysical::EraseClientBlocks
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FindLsnBlock
CClfsLogFcbPhysical::FlushLog
CClfsLogFcbPhysical::FlushWorkRoutine
CClfsLogFcbPhysical::FreeFcb
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetContainer
CClfsLogFcbPhysical::GetContainerForLsn
CClfsLogFcbPhysical::GetManagementSupportInterface
CClfsLogFcbPhysical::GetNextBlockLsn
CClfsLogFcbPhysical::GetNextOwnerPageLsn
CClfsLogFcbPhysical::GetObservableInterface
CClfsLogFcbPhysical::GetPendingRequestQueueInterface
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::InsertContainerDeleteQ
CClfsLogFcbPhysical::InsertIrp
CClfsLogFcbPhysical::IsEof
CClfsLogFcbPhysical::MapCacheData
CClfsLogFcbPhysical::ModifySecurity
CClfsLogFcbPhysical::ObservationContainerAvailable
CClfsLogFcbPhysical::ObservationContainerConsumed
CClfsLogFcbPhysical::Open
CClfsLogFcbPhysical::OpenClient
CClfsLogFcbPhysical::PeekNextIrp
CClfsLogFcbPhysical::PostAsyncRequest
CClfsLogFcbPhysical::QueryLogFileInfo
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::QuerySecurity
CClfsLogFcbPhysical::QueueFlushWorker
CClfsLogFcbPhysical::ReadClientBlock
CClfsLogFcbPhysical::ReadLog
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::ReadQueuedOwnerPage
CClfsLogFcbPhysical::ReadRawOwnerPage
CClfsLogFcbPhysical::ReadRestart
CClfsLogFcbPhysical::RebuildOwnerPage
CClfsLogFcbPhysical::ReleaseArchiveRef
CClfsLogFcbPhysical::ReleaseFlushRef
CClfsLogFcbPhysical::ReleaseFromLazyWriteCallback
CClfsLogFcbPhysical::ReleaseFromReadAheadCallback
CClfsLogFcbPhysical::RemoveClient
CClfsLogFcbPhysical::RemoveIrp
CClfsLogFcbPhysical::ReserveAndAppendLog
CClfsLogFcbPhysical::RundownContainerDeleteQ
CClfsLogFcbPhysical::SetArchiveTail
CClfsLogFcbPhysical::SetCacheFileSizes
CClfsLogFcbPhysical::SetEndOfLog
CClfsLogFcbPhysical::SetLogFileInfo
CClfsLogFcbPhysical::TearDownOpen
CClfsLogFcbPhysical::ToggleEphemeral
CClfsLogFcbPhysical::TruncateLogDiscardBlocks
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogRewriteOwnerPages
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::VirtualToPhysicalLsn
CClfsLogFcbPhysical::WrapContainers
CClfsLogFcbPhysical::WrapDeletePendingContainer
CClfsLogFcbPhysical::WriteOneRawSectorSync
CClfsLogFcbPhysical::WriteRestart
CClfsLogFcbPhysical::WriteRestartDone
CClfsLogFcbVirtual::AcquireForLazyWrite
CClfsLogFcbVirtual::AcquireForReadAhead
CClfsLogFcbVirtual::AcquireSharedSecurityContext
CClfsLogFcbVirtual::AddArchiveRef
CClfsLogFcbVirtual::AdjustReservation
CClfsLogFcbVirtual::AdvanceLogBase
CClfsLogFcbVirtual::AllocContainer
CClfsLogFcbVirtual::AllocateFcb
CClfsLogFcbVirtual::Cleanup
CClfsLogFcbVirtual::CloseLog
CClfsLogFcbVirtual::CompleteAsyncAdvanceLogBase
CClfsLogFcbVirtual::CompleteAsyncReadBlock
CClfsLogFcbVirtual::CompleteAsyncWriteRestart
CClfsLogFcbVirtual::Create
CClfsLogFcbVirtual::CreateSharedSecurityContext
CClfsLogFcbVirtual::DeleteContainer
CClfsLogFcbVirtual::Finalize
CClfsLogFcbVirtual::FlushLog
CClfsLogFcbVirtual::FlushMetadata
CClfsLogFcbVirtual::GetArchiveDescriptors
CClfsLogFcbVirtual::GetContainerName
CClfsLogFcbVirtual::GetErrorState
CClfsLogFcbVirtual::GetIoStatistics
CClfsLogFcbVirtual::GetManagementSupportInterface
CClfsLogFcbVirtual::GetMinLsn
CClfsLogFcbVirtual::GetObservableInterface
CClfsLogFcbVirtual::GetSectionObjectPointers
CClfsLogFcbVirtual::InitializeCacheMap
CClfsLogFcbVirtual::MarkLogFileContainers
CClfsLogFcbVirtual::ModifySecurity
CClfsLogFcbVirtual::Open
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsLogFcbVirtual::QuerySecurity
CClfsLogFcbVirtual::ReadLogBlock
CClfsLogFcbVirtual::ReadLogPagingIo
CClfsLogFcbVirtual::ReadRestart
CClfsLogFcbVirtual::Release
CClfsLogFcbVirtual::ReleaseArchiveRef
CClfsLogFcbVirtual::ReleaseFromLazyWrite
CClfsLogFcbVirtual::ReleaseFromReadAhead
CClfsLogFcbVirtual::ReleaseSharedSecurityContext
CClfsLogFcbVirtual::ReserveAndAppendLog
CClfsLogFcbVirtual::RundownContainerDeleteQ
CClfsLogFcbVirtual::ScanContainers
CClfsLogFcbVirtual::SetArchiveTail
CClfsLogFcbVirtual::SetEndOfLog
CClfsLogFcbVirtual::SetLogFileInfo
CClfsLogFcbVirtual::UninitializeCacheMap
CClfsLogFcbVirtual::UnmarkLogFileContainers
CClfsLogFcbVirtual::WriteRestart
CClfsLogFcbVirtual::~CClfsLogFcbVirtual
CClfsManagedLog::AddNewClient
CClfsManagedLog::AdvanceClientTailsToLsn
CClfsManagedLog::AutoGrow
CClfsManagedLog::CompleteLogGrowthOperation
CClfsManagedLog::Finalize
CClfsManagedLog::HandleLogFileFull
CClfsManagedLog::InstallLogObserver
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::ObservationContainerAvailable
CClfsManagedLog::ObservationContainerDeleted
CClfsManagedLog::ObservationToggleEphemeral
CClfsManagedLog::QueueAutoGrowWorker
CClfsManagedLog::RemoveClient
CClfsManagedLog::UninstallLogObserver
CClfsManagedLog::UnlinkClient
CClfsManagedLogClient::Finalize
CClfsManagedLogClient::Initialize
CClfsManagedLogClient::InstallLogObserver
CClfsManagedLogClient::LifetimeEndEvent
CClfsManagedLogClient::MakeObservation
CClfsManagedLogClient::Release
CClfsManagedLogClient::RemoveFromManagedLog
CClfsManagedLogClient::UninstallLogObserver
CClfsManagedLogClientKernel::AdvanceTail
CClfsManagedLogClientKernel::Initialize
CClfsManagedLogClientKernel::LogFileFullHandlerComplete
CClfsManagedLogClientKernel::LogFileUnpinComplete
CClfsManagedLogClientUser::DeliverNotification
CClfsManagedLogClientUser::Finalize
CClfsManagedLogClientUser::Initialize
CClfsManagedLogClientUser::ReadNotification
CClfsManagedLogCollection::FindManagedLog
CClfsManagedLogCollection::FindOrCreateManagedLog
CClfsRequest::AddRefReadIo
CClfsRequest::AdvanceLogBase
CClfsRequest::AdvanceLogBase
CClfsRequest::AllocContainer
CClfsRequest::AsyncReadIoCompletion
CClfsRequest::CClfsRequest
CClfsRequest::Cancel
CClfsRequest::Close
CClfsRequest::CloseLog
CClfsRequest::CompleteAsyncFlush
CClfsRequest::CompleteAsyncWriteRestart
CClfsRequest::Create
CClfsRequest::CreateReadCompletionElement
CClfsRequest::DeleteContainer
CClfsRequest::FinalizeAsyncRead
CClfsRequest::FinalizeReadRequest
CClfsRequest::Flush
CClfsRequest::Flush
CClfsRequest::FlushDone
CClfsRequest::GetContainerName
CClfsRequest::GetIoStatistics
CClfsRequest::GetMdlReference
CClfsRequest::GetMdlReferenceFromState
CClfsRequest::LogFileInfo
CClfsRequest::QueryWaitLsn
CClfsRequest::ReadDone
CClfsRequest::ReadLogBlock
CClfsRequest::ReadLogBlock
CClfsRequest::ReadLogPagingIo
CClfsRequest::ReadMgmtNotificationInProgress
CClfsRequest::ReadRestart
CClfsRequest::ReadRestart
CClfsRequest::Release
CClfsRequest::ReleaseReadIo
CClfsRequest::ReserveAdjustment
CClfsRequest::ReserveAndAppendLog
CClfsRequest::ReserveAndAppendLog
CClfsRequest::RetryAdvanceLogBase
CClfsRequest::RetryWriteRestart
CClfsRequest::ScanContainers
CClfsRequest::SetArchiveTail
CClfsRequest::SetEndOfLog
CClfsRequest::WriteRestart
CClfsRequest::WriteRestart
CClfsRequest::WriteRestartDone
CClfsRequest::WriteRestartInProgress
CClfsRequest::~CClfsRequest
CClfsRequest_State::Change_State_AdvanceLogBasePending
CClfsRequest_State::Change_State_AppendPendingFlush
CClfsRequest_State::Change_State_Done
CClfsRequest_State::Change_State_FlushPending
CClfsRequest_State::Change_State_ReadPending
CClfsRequest_State::Change_State_WriteRestartPending
CClfsRequest_State_AdvanceLogBasePending::FlushDone
CClfsRequest_State_AdvanceLogBasePending::WriteRestartInProgress
CClfsRequest_State_AppendPendingFlush::GetMdlReference
CClfsRequest_State_ReadPending::ReadDone
CClfsRequest_State_WriteRestartPending::WriteRestartInProgress
ClfsAddLogContainerSet
ClfsAddLogContainerSet$fin$0
ClfsAdvanceLogBaseInternal
ClfsAdvanceLogBaseInternal$fin$0
ClfsCloseAndResetLogFile
ClfsCloseAndResetLogFile$fin$0
ClfsDeleteLogByPointer
ClfsDeleteLogByPointer$fin$0
ClfsDispatchIoRequest
ClfsDispatchIoRequest$fin$0
ClfsFlushToLsnInternal
ClfsFlushToLsnInternal$fin$0
ClfsFreeReservedLogInternal
ClfsFreeReservedLogInternal$fin$0
ClfsGetContainerName
ClfsGetContainerName$fin$0
ClfsGetIoStatistics
ClfsGetIoStatistics$fin$0
ClfsGetLogFileInformation
ClfsGetLogFileInformation$fin$0
ClfsGetManagementSupportInterface
ClfsGetManagementSupportInterface$fin$0
ClfsGetObservableInterface
ClfsGetObservableInterface$fin$0
ClfsGetPendingRequestQueueInterface
ClfsGetPendingRequestQueueInterface$fin$0
ClfsMgmtDeregisterManagedClient
ClfsMgmtDispatchIo
ClfsMgmtInstallPolicy
ClfsMgmtInstallPolicy$fin$0
ClfsMgmtQueryPolicy
ClfsMgmtQueryPolicy$fin$0
ClfsMgmtRemovePolicy
ClfsMgmtRemovePolicy$fin$0
ClfsMgmtSetLogFileSizeAsClient
ClfsMgmtSetLogFileSizeAsClient$fin$0
ClfsMgmtUserModeDeregister
ClfsMgmtUserModeRegister
ClfsMgmtUserModeSetSizeCompletion
ClfsMgmtpAutoGrowWorker
ClfsMgmtpAutoShrinkWorker
ClfsMgmtpLogFullCompleteWorker
ClfsMgmtpLogPinnedArchiveTailWorker
ClfsMgmtpRegisterManagedClient
ClfsPrivQueryErrorState
ClfsPrivQueryErrorState$fin$0
ClfsQueryLogFileInformation
ClfsQueryLogFileInformation$fin$0
ClfsReadLogRecordInternal
ClfsReadLogRecordInternal$fin$0
ClfsReadRestartAreaInternal
ClfsReadRestartAreaInternal$fin$0
ClfsRemoveContainersInternal
ClfsRemoveContainersInternal$fin$0
ClfsRemoveLogContainerSet
ClfsRemoveLogContainerSet$fin$0
ClfsReserveAndAppendLogInternal
ClfsReserveAndAppendLogInternal$fin$0
ClfsScanLogContainersInternal
ClfsScanLogContainersInternal$fin$0
ClfsSetArchiveTail
ClfsSetArchiveTail$fin$0
ClfsSetLogFileInformation
ClfsSetLogFileInformation$fin$0
ClfsWriteRestartAreaInternal
ClfsWriteRestartAreaInternal$fin$0
ExAllocateFromPagedLookasideList
ExFreeToPagedLookasideList
FUN_1c000f0c0
FUN_1c004746d
FUN_1c004749e
WPP_SF_sdD
WPP_SF_sdSD
WPP_SF_sdiD
WPP_SF_sdiSD
WPP_SF_sdiSdd
WPP_SF_sdiSi
WPP_SF_sdid
WPP_SF_sdidd
WPP_SF_sdii
WPP_SF_sl
WPP_SF_slDD
WPP_SF_slDDDD
WPP_SF_slDDDDDD
WPP_SF_slS
WPP_SF_slSD
WPP_SF_slSiDDDiDD
WPP_SF_sld
WPP_SF_slidD
WPP_SF_sliiDDDDDD
WPP_SF_slq
WPP_SF_slqD
WPP_SF_slqdi
WPP_SF_slqqDddd
WppInitKm
WppLoadTracingSupport
WppTraceCallback
`CClfsBaseFilePersisted::AddContainer'::__l1::fin$0
`CClfsBaseFilePersisted::CheckSecureAccess'::__l1::fin$0
`CClfsBaseFilePersisted::CreateContainer'::__l1::fin$0
`CClfsBaseFilePersisted::MarkContainerQ'::__l1::fin$0
`CClfsBaseFilePersisted::UnmarkContainerQ'::__l1::fin$0
`CClfsContainer::ReadSector'::__l1::fin$0
`CClfsLogCcb::AddArchiveRef'::__l1::fin$0
`CClfsLogCcb::GetArchiveDescriptors'::__l1::fin$0
`CClfsLogCcb::ReleaseArchiveRef'::__l1::fin$0
`CClfsLogFcbPhysical::AcquireClientSharedSecurityContext'::__l1::fin$0
`CClfsLogFcbPhysical::AddArchiveRef'::__l1::fin$0
`CClfsLogFcbPhysical::AddClient'::__l1::fin$0
`CClfsLogFcbPhysical::AdjustReservation'::__l1::fin$0
`CClfsLogFcbPhysical::AdvanceLogBase'::__l1::fin$0
`CClfsLogFcbPhysical::AppendLog'::__l1::fin$0
`CClfsLogFcbPhysical::CloseLog'::__l1::fin$0
`CClfsLogFcbPhysical::CompleteAsyncAdvanceLogBase'::__l1::fin$0
`CClfsLogFcbPhysical::CompleteAsyncWriteRestart'::__l1::fin$0
`CClfsLogFcbPhysical::DeleteContainer'::__l1::fin$0
`CClfsLogFcbPhysical::EraseClientBlocks'::__l1::fin$0
`CClfsLogFcbPhysical::GetArchiveDescriptors'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$1
`CClfsLogFcbPhysical::OpenClient'::__l1::fin$0
`CClfsLogFcbPhysical::ReadClientBlock'::__l1::fin$0
`CClfsLogFcbPhysical::ReadLog'::__l1::fin$0
`CClfsLogFcbPhysical::ReadLogBlock'::__l1::fin$1
`CClfsLogFcbPhysical::ReadLogPagingIo'::__l1::fin$0
`CClfsLogFcbPhysical::SetArchiveTail'::__l1::fin$0
`CClfsLogFcbPhysical::SetLogFileInfo'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogDiscardBlocks'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogModifyStreams'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogRewriteOwnerPages'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogStart'::__l1::fin$0
`CClfsLogFcbPhysical::WriteRestart'::__l1::fin$0
`CClfsLogFcbVirtual::AdvanceLogBase'::__l1::fin$0
`CClfsLogFcbVirtual::Cleanup'::__l1::fin$0
`CClfsLogFcbVirtual::CloseLog'::__l1::fin$0
`CClfsLogFcbVirtual::CompleteAsyncAdvanceLogBase'::__l1::fin$0
`CClfsLogFcbVirtual::CompleteAsyncWriteRestart'::__l1::fin$0
`CClfsLogFcbVirtual::Create'::__l1::fin$0
`CClfsLogFcbVirtual::Open'::__l1::fin$0
`CClfsLogFcbVirtual::WriteRestart'::__l1::fin$0
`CClfsManagedLog::AddNewClient'::__l1::fin$0
`CClfsManagedLog::AutoGrow'::__l1::fin$0
`CClfsManagedLog::InvokeGrowWorker'::__l1::fin$0
`CClfsManagedLogClientUser::Initialize'::__l1::fin$0
`CClfsManagedLogClientUser::ReadNotification'::__l1::fin$0
`CClfsRequest::Close'::__l1::fin$0
`CClfsRequest::Create'::__l1::fin$0
`CClfsRequest::ReadLogPagingIo'::__l1::fin$0
`CClfsRequest::ReleaseReadIo'::__l1::fin$0
`ClfsMgmtpRegisterManagedClient'::__l1::fin$0
| |paramcount|0|0| |address|1c000cc10|1c000cc10| |sig|undefined __fastcall _guard_dispatch_icall(void)|undefined __fastcall _guard_dispatch_icall(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### _guard_dispatch_icall Calling Diff ```diff --- _guard_dispatch_icall calling +++ _guard_dispatch_icall calling @@ -352,2 +352,2 @@ -FUN_1c004734b -FUN_1c004737c +FUN_1c004746d +FUN_1c004749e ``` ## GetBaseLogRecord ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|GetBaseLogRecord|GetBaseLogRecord| |fullname|CClfsBaseFile::GetBaseLogRecord|CClfsBaseFile::GetBaseLogRecord| |`refcount`|37|35| |length|55|55| |called||| |`calling`|
Expand for full list:
CClfsBaseFile::AcquireClientContext
CClfsBaseFile::ClientCount
CClfsBaseFile::ContainerCount
CClfsBaseFile::FindSymbol
CClfsBaseFile::GetContainerName
CClfsBaseFile::GetUsn
CClfsBaseFile::HighWaterMarkClientId
CClfsBaseFile::LoadClientBaseLsn
CClfsBaseFile::OffsetToAddr
CClfsBaseFile::ReleaseClientContext
CClfsBaseFile::ScanContainerInfoCClfsBaseFilePersisted::AddClient
CClfsBaseFilePersisted::AddContainer
CClfsBaseFilePersisted::AddMetaClient
CClfsBaseFilePersisted::AddSymbol
CClfsBaseFilePersisted::AllocSymbol
CClfsBaseFilePersisted::AreClientIdsAvailable
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::IncrementUsn
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::RemoveClient
CClfsBaseFilePersisted::RemoveContainer
CClfsBaseFilePersisted::ResetContainerQ
CClfsBaseFilePersisted::UnloadContainerQ
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsBaseFileSnapshot::ReadContainerQ
|
Expand for full list:
CClfsBaseFile::AcquireClientContext
CClfsBaseFile::AddrToOffset
CClfsBaseFile::ClientCount
CClfsBaseFile::ContainerCount
CClfsBaseFile::FindSymbol
CClfsBaseFile::GetContainerName
CClfsBaseFile::GetUsn
CClfsBaseFile::HighWaterMarkClientId
CClfsBaseFile::LoadClientBaseLsn
CClfsBaseFile::OffsetToAddr
CClfsBaseFile::ReleaseClientContextCClfsBaseFile::ScanContainerInfo
CClfsBaseFilePersisted::AddClient
CClfsBaseFilePersisted::AddContainer
CClfsBaseFilePersisted::AddMetaClient
CClfsBaseFilePersisted::AddSymbol
CClfsBaseFilePersisted::AllocSymbol
CClfsBaseFilePersisted::AreClientIdsAvailable
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::IncrementUsn
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::RemoveClient
CClfsBaseFilePersisted::RemoveContainer
CClfsBaseFilePersisted::ResetContainerQ
CClfsBaseFilePersisted::UnloadContainerQ
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsBaseFileSnapshot::ReadContainerQ
| |paramcount|1|1| |`address`|1c002c980|1c002ca68| |sig|_CLFS_BASE_RECORD_HEADER * __thiscall GetBaseLogRecord(CClfsBaseFile * this)|_CLFS_BASE_RECORD_HEADER * __thiscall GetBaseLogRecord(CClfsBaseFile * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### GetBaseLogRecord Calling Diff ```diff --- CClfsBaseFile::GetBaseLogRecord calling +++ CClfsBaseFile::GetBaseLogRecord calling @@ -1,0 +2 @@ +CClfsBaseFile::AddrToOffset ``` ## memcpy ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|memcpy|memcpy| |fullname|memcpy|memcpy| |`refcount`|63|65| |length|537|537| |called||| |calling|
Expand for full list:
CClfsBaseFile::FindSharedSecurityDescriptor
CClfsBaseFile::FindSymbol
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::FlushControlRecord
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptorCClfsBaseFileSnapshot::CopyImage
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsKernelMarshallingContext::AppendRecord
CClfsKernelMarshallingContext::ReadMarshalledLogRecord
CClfsLogFcbPhysical::BinarySearchLsn
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FindLsnBlock
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryLogFileInfo
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::ReadLastOwnerPage
CClfsLogFcbPhysical::ReadQueuedOwnerPage
CClfsLogFcbPhysical::TruncateLogRewriteOwnerPages
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateRegionBlocks
CClfsLogFcbPhysical::VirtualToPhysicalLsn
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsManagedLog::Initialize
CClfsManagedLog::InstallDefaultNewContainerNamePolicies
CClfsManagedLog::InstallPolicy
CClfsManagedLog::QueryPolicy
CClfsManagedLogClientUser::Initialize
CClfsManagedLogClientUser::QueryRegistration
CClfsManagedLogCollection::AllocateAndQueryPhysicalLogName
CClfsRequest::GetIoStatistics
ClfsAddLogContainerSet
ClfsGetIoStatistics
WppTraceCallback
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
|
Expand for full list:
CClfsBaseFile::FindSharedSecurityDescriptor
CClfsBaseFile::FindSymbol
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::FlushControlRecord
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptorCClfsBaseFileSnapshot::CopyImage
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsKernelMarshallingContext::AppendRecord
CClfsKernelMarshallingContext::ReadMarshalledLogRecord
CClfsLogFcbPhysical::BinarySearchLsn
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FindLsnBlock
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryLogFileInfo
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::ReadLastOwnerPage
CClfsLogFcbPhysical::ReadQueuedOwnerPage
CClfsLogFcbPhysical::TruncateLogRewriteOwnerPages
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateRegionBlocks
CClfsLogFcbPhysical::VirtualToPhysicalLsn
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsManagedLog::Initialize
CClfsManagedLog::InstallDefaultNewContainerNamePolicies
CClfsManagedLog::InstallPolicy
CClfsManagedLog::QueryPolicy
CClfsManagedLogClientUser::Initialize
CClfsManagedLogClientUser::QueryRegistration
CClfsManagedLogCollection::AllocateAndQueryPhysicalLogName
CClfsRequest::GetIoStatistics
ClfsAddLogContainerSet
ClfsGetIoStatistics
WppTraceCallback
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
| |paramcount|3|3| |address|1c000cc40|1c000cc40| |sig|void * __cdecl memcpy(void * _Dst, void * _Src, size_t _Size)|void * __cdecl memcpy(void * _Dst, void * _Src, size_t _Size)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## memset ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|memset|memset| |fullname|memset|memset| |`refcount`|71|72| |length|236|236| |called||| |`calling`|
Expand for full list:
CClfsBaseFilePersisted::AddClient
CClfsBaseFilePersisted::AllocSymbol
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsContainer::CreateCClfsContainer::InitializeGlobals
CClfsContainer::Open
CClfsContainer::WriteSector
CClfsDriver::ReadRegistry
CClfsKernelMarshallingContext::AllocateIocb
CClfsKernelMarshallingContext::AppendRecord
CClfsKernelMarshallingContext::FormatWriteBlock
CClfsKernelMarshallingContext::Initialize
CClfsKernelMarshallingContext::ReserveAndAppendLog
CClfsLogFcbCommon::CClfsLogFcbCommon
CClfsLogFcbPhysical::CClfsLogFcbPhysical
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CreateBaseFileName
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryLogFileInfo
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::TruncateLogDiscardBlocks
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::Initialize
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::QueryLogBoundaryLsns
CClfsManagedLog::QueryLogContainerSize
CClfsManagedLog::QueryLogEphemeral
CClfsManagedLog::QueryLogSize
CClfsRequest::CreateReadCompletionElement
CClfsRequest::GetContainerName
CClfsRequest::GetIoStatistics
CClfsRequest::ReserveAndAppendLog
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsGetContainerName
ClfsInitializeEventLog
ClfsInitializeOwnerPage
WppTraceCallback
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
|
Expand for full list:
CClfsBaseFilePersisted::AddClient
CClfsBaseFilePersisted::AllocSymbol
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsContainer::CreateCClfsContainer::InitializeGlobals
CClfsContainer::Open
CClfsContainer::WriteSector
CClfsDriver::ReadRegistry
CClfsKernelMarshallingContext::AllocateIocb
CClfsKernelMarshallingContext::AppendRecord
CClfsKernelMarshallingContext::FormatWriteBlock
CClfsKernelMarshallingContext::Initialize
CClfsKernelMarshallingContext::ReserveAndAppendLog
CClfsLogFcbCommon::CClfsLogFcbCommon
CClfsLogFcbPhysical::CClfsLogFcbPhysical
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CreateBaseFileName
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryLogFileInfo
CClfsLogFcbPhysical::ReadLogBlock
CClfsLogFcbPhysical::ReadLogPagingIo
CClfsLogFcbPhysical::TruncateLogDiscardBlocks
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbVirtual::QueryLogFileInfo
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::Initialize
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::QueryLogBoundaryLsns
CClfsManagedLog::QueryLogContainerSize
CClfsManagedLog::QueryLogEphemeral
CClfsManagedLog::QueryLogSize
CClfsRequest::CreateReadCompletionElement
CClfsRequest::GetContainerName
CClfsRequest::GetIoStatistics
CClfsRequest::ReserveAndAppendLog
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsGetContainerName
ClfsInitializeEventLog
ClfsInitializeOwnerPage
WppTraceCallback
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
| |paramcount|3|3| |address|1c000cf00|1c000cf00| |sig|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)|void * __cdecl memset(void * _Dst, int _Val, size_t _Size)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### memset Calling Diff ```diff ``` ## NTOSKRNL.EXE::ExAllocatePoolWithTag ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|ExAllocatePoolWithTag|ExAllocatePoolWithTag| |fullname|NTOSKRNL.EXE::ExAllocatePoolWithTag|NTOSKRNL.EXE::ExAllocatePoolWithTag| |`refcount`|115|114| |length|0|0| |called||| |calling|
Expand for full list:
CClfsBaseFile::InitializeGlobals
CClfsBaseFile::InitializeImageResource
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::QueryContainerSecurityCClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptor
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsContainer::InitializeGlobals
CClfsContainer::WriteSector
CClfsDriver::Initialize
CClfsDriver::SetIrpFunctions
CClfsKernelMarshallingContext::Initialize
CClfsLogFcbCommon::InstallObserver
CClfsLogFcbPhysical::AddArchiveRef
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CreateBaseFileName
CClfsLogFcbPhysical::EraseClientBlocks
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateRegionBlocks
CClfsManagedLog::AddNewClient
CClfsManagedLog::AllocateAndBuildContainerNameTemplate
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::Initialize
CClfsManagedLog::InstallDefaultNewContainerNamePolicies
CClfsManagedLog::InstallPolicy
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::QueueAutoGrowWorker
CClfsManagedLogClientUser::CreateNotification
CClfsManagedLogClientUser::DeliverNotification
CClfsManagedLogCollection::AddNewManagedLog
CClfsManagedLogCollection::AllocateAndQueryPhysicalLogName
CClfsRequest::InitializeGlobals
CClfsRequest::ReserveAndAppendLog
CClfsRequest::WriteRestart
CDynamicLsnQ::Initialize
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsCreateMarshallingAreaInternal
ClfsCreateScanContext
ClfsEnableThreadPrivilege
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
|
Expand for full list:
CClfsBaseFile::InitializeGlobals
CClfsBaseFile::InitializeImageResource
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::QueryContainerSecurity
CClfsBaseFilePersisted::ReadImageCClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptor
CClfsBaseFileSnapshot::InitializeSnapshot
CClfsContainer::InitializeGlobals
CClfsContainer::WriteSector
CClfsDriver::Initialize
CClfsDriver::SetIrpFunctions
CClfsKernelMarshallingContext::Initialize
CClfsLogFcbCommon::InstallObserver
CClfsLogFcbPhysical::AddArchiveRef
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::CreateBaseFileName
CClfsLogFcbPhysical::EraseClientBlocks
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateRegionBlocks
CClfsManagedLog::AddNewClient
CClfsManagedLog::AllocateAndBuildContainerNameTemplate
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::Initialize
CClfsManagedLog::InstallDefaultNewContainerNamePolicies
CClfsManagedLog::InstallPolicy
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::QueueAutoGrowWorker
CClfsManagedLogClientUser::CreateNotification
CClfsManagedLogClientUser::DeliverNotification
CClfsManagedLogCollection::AddNewManagedLog
CClfsManagedLogCollection::AllocateAndQueryPhysicalLogName
CClfsRequest::InitializeGlobals
CClfsRequest::ReserveAndAppendLog
CClfsRequest::WriteRestart
CDynamicLsnQ::Initialize
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsCreateMarshallingAreaInternal
ClfsCreateScanContext
ClfsEnableThreadPrivilege
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
operator_new
| |paramcount|0|0| |address|EXTERNAL:00000001|EXTERNAL:00000001| |sig|undefined ExAllocatePoolWithTag(void)|undefined ExAllocatePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## NTOSKRNL.EXE::ExFreePoolWithTag ### Match Info |Key|clfs-10.0.22000.258.sys - clfs-10.0.22000.376.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|clfs-10.0.22000.258.sys|clfs-10.0.22000.376.sys| | :---: | :---: | :---: | |name|ExFreePoolWithTag|ExFreePoolWithTag| |fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag| |`refcount`|197|195| |length|0|0| |called||| |`calling`|
Expand for full list:
CClfsBaseFile::InitializeGlobals
CClfsBaseFile::`scalar_deleting_destructor'
CClfsBaseFile::~CClfsBaseFile
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::DestroyAbsoluteContainerPath
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptorCClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::QueryContainerSecurity
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptor
CClfsBaseFilePersisted::~CClfsBaseFilePersisted
CClfsBaseFileSnapshot::FreeMetadataBlock
CClfsBaseFileSnapshot::`vector_deleting_destructor'
CClfsContainer::WriteSector
CClfsDriver::Finalize
CClfsKernelMarshallingContext::DeallocateIocb
CClfsKernelMarshallingContext::Release
CClfsKernelMarshallingContext::~CClfsKernelMarshallingContext
CClfsLogFcbCommon::UninstallObserver
CClfsLogFcbPhysical::AddArchiveRef
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::DestroyBaseFileName
CClfsLogFcbPhysical::EraseClientBlocks
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::ReleaseLsnMap
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateRegionBlocks
CClfsLogFcbPhysical::~CClfsLogFcbPhysical
CClfsManagedLog::AddContainersForGrowth
CClfsManagedLog::DeleteContainersForShrink
CClfsManagedLog::Finalize
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::GetNextSuffixFromExistingContainers
CClfsManagedLog::InstallDefaultNewContainerNamePolicies
CClfsManagedLog::InstallPolicy
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::UninstallPolicy
CClfsManagedLog::`scalar_deleting_destructor'
CClfsManagedLogClientKernel::`vector_deleting_destructor'
CClfsManagedLogClientUser::DestroyNotification
CClfsManagedLogClientUser::DestroyNotificationQueue
CClfsManagedLogClientUser::Finalize
CClfsManagedLogCollection::AllocateAndQueryPhysicalLogName
CClfsManagedLogCollection::FindManagedLog
CClfsManagedLogCollection::FindOrCreateManagedLog
CClfsMdlReference::Release
CClfsRequest::FinalizeGlobals
CDynamicLsnQ::Initialize
CDynamicLsnQ::~CDynamicLsnQ
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsCreateLogFile$fin$0
ClfsCreateScanContext
ClfsCreateScanContext$fin$0
ClfsEnableThreadPrivilege
ClfsFinalize
ClfsMgmtpApcRundown
ClfsMgmtpAutoGrowWorker
ClfsScanLogContainers
`CClfsBaseFile::InitializeGlobals'::__l1::fin$0
`CClfsBaseFilePersisted::CheckSecureAccess'::__l1::fin$0
`CClfsBaseFilePersisted::CreateAbsoluteContainerPath'::__l1::fin$0
`CClfsBaseFilePersisted::CreateContainer'::__l1::fin$0
`CClfsBaseFilePersisted::CreateContainerSecurityDescriptor'::__l1::fin$0
`CClfsBaseFilePersisted::CreateMetadataBlock'::__l1::fin$0
`CClfsBaseFilePersisted::ExtendMetadataBlock'::__l1::fin$0
`CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor'::__l1::fin$0
`CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0
`CClfsBaseFilePersisted::OpenImage'::__l1::fin$0
`CClfsBaseFilePersisted::QueryContainerSecurity'::__l1::fin$0
`CClfsBaseFilePersisted::ReadImage'::__l1::fin$0
`CClfsBaseFilePersisted::ReadMetadataBlock'::__l1::fin$0
`CClfsContainer::WriteSector'::__l1::fin$0
`CClfsLogFcbPhysical::AddArchiveRef'::__l1::fin$0
`CClfsLogFcbPhysical::EraseClientBlocks'::__l1::fin$0
`CClfsLogFcbPhysical::FindEndOfLog'::__l1::fin$0
`CClfsLogFcbPhysical::GetArchiveDescriptors'::__l1::fin$0
`CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$1
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
`CClfsLogFcbPhysical::QueryPhysicalLsn'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogModifyStreams'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogStart'::__l1::fin$0
`CClfsLogFcbPhysical::UpdateCachedOwnerPage'::__l1::fin$0
`CClfsLogFcbPhysical::ValidateRegionBlocks'::__l1::fin$0
`CClfsManagedLog::DeleteContainersForShrink'::__l1::fin$0
`CClfsManagedLog::GetNextSuffixFromExistingContainers'::__l1::fin$0
`CClfsManagedLog::InvokeGrowWorker'::__l1::fin$0
`ClfsEnableThreadPrivilege'::__l1::fin$0
|
Expand for full list:
CClfsBaseFile::InitializeGlobals
CClfsBaseFile::`scalar_deleting_destructor'
CClfsBaseFile::~CClfsBaseFile
CClfsBaseFilePersisted::CheckSecureAccess
CClfsBaseFilePersisted::CreateAbsoluteContainerPath
CClfsBaseFilePersisted::CreateContainer
CClfsBaseFilePersisted::CreateContainerSecurityDescriptor
CClfsBaseFilePersisted::CreateImage
CClfsBaseFilePersisted::CreateMetadataBlock
CClfsBaseFilePersisted::DestroyAbsoluteContainerPath
CClfsBaseFilePersisted::ExtendMetadataBlockDescriptorCClfsBaseFilePersisted::LoadContainerQ
CClfsBaseFilePersisted::OpenImage
CClfsBaseFilePersisted::QueryContainerSecurity
CClfsBaseFilePersisted::ReadImage
CClfsBaseFilePersisted::ReadMetadataBlock
CClfsBaseFilePersisted::SetDefaultSaclSecurityDescriptor
CClfsBaseFilePersisted::~CClfsBaseFilePersisted
CClfsBaseFileSnapshot::FreeMetadataBlock
CClfsBaseFileSnapshot::`vector_deleting_destructor'
CClfsContainer::WriteSector
CClfsDriver::Finalize
CClfsKernelMarshallingContext::DeallocateIocb
CClfsKernelMarshallingContext::Release
CClfsKernelMarshallingContext::~CClfsKernelMarshallingContext
CClfsLogFcbCommon::UninstallObserver
CClfsLogFcbPhysical::AddArchiveRef
CClfsLogFcbPhysical::CompleteFlush
CClfsLogFcbPhysical::DeleteContainer
CClfsLogFcbPhysical::DestroyBaseFileName
CClfsLogFcbPhysical::EraseClientBlocks
CClfsLogFcbPhysical::Finalize
CClfsLogFcbPhysical::FindEndOfLog
CClfsLogFcbPhysical::FlushMetadata
CClfsLogFcbPhysical::GetArchiveDescriptors
CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::Initialize
CClfsLogFcbPhysical::MarkLogFileContainers
CClfsLogFcbPhysical::QueryPhysicalLsn
CClfsLogFcbPhysical::ReleaseLsnMap
CClfsLogFcbPhysical::TruncateLogModifyStreams
CClfsLogFcbPhysical::TruncateLogStart
CClfsLogFcbPhysical::UpdateCachedOwnerPage
CClfsLogFcbPhysical::ValidateContainerSize
CClfsLogFcbPhysical::ValidateRegionBlocks
CClfsLogFcbPhysical::~CClfsLogFcbPhysical
CClfsManagedLog::AddContainersForGrowth
CClfsManagedLog::DeleteContainersForShrink
CClfsManagedLog::Finalize
CClfsManagedLog::GetContainerNameFromScanContext
CClfsManagedLog::GetNextSuffixFromExistingContainers
CClfsManagedLog::InstallDefaultNewContainerNamePolicies
CClfsManagedLog::InstallPolicy
CClfsManagedLog::InvokeGrowWorker
CClfsManagedLog::UninstallPolicy
CClfsManagedLog::`scalar_deleting_destructor'
CClfsManagedLogClientKernel::`vector_deleting_destructor'
CClfsManagedLogClientUser::DestroyNotification
CClfsManagedLogClientUser::DestroyNotificationQueue
CClfsManagedLogClientUser::Finalize
CClfsManagedLogCollection::AllocateAndQueryPhysicalLogName
CClfsManagedLogCollection::FindManagedLog
CClfsManagedLogCollection::FindOrCreateManagedLog
CClfsMdlReference::Release
CClfsRequest::FinalizeGlobals
CDynamicLsnQ::Initialize
CDynamicLsnQ::~CDynamicLsnQ
ClfsAddLogContainerSet
ClfsCreateLogFile
ClfsCreateLogFile$fin$0
ClfsCreateScanContext
ClfsCreateScanContext$fin$0
ClfsEnableThreadPrivilege
ClfsFinalize
ClfsMgmtpApcRundown
ClfsMgmtpAutoGrowWorker
ClfsScanLogContainers
`CClfsBaseFile::InitializeGlobals'::__l1::fin$0
`CClfsBaseFilePersisted::CheckSecureAccess'::__l1::fin$0
`CClfsBaseFilePersisted::CreateAbsoluteContainerPath'::__l1::fin$0
`CClfsBaseFilePersisted::CreateContainer'::__l1::fin$0
`CClfsBaseFilePersisted::CreateContainerSecurityDescriptor'::__l1::fin$0
`CClfsBaseFilePersisted::CreateMetadataBlock'::__l1::fin$0
`CClfsBaseFilePersisted::ExtendMetadataBlock'::__l1::fin$0
`CClfsBaseFilePersisted::ExtendMetadataBlockDescriptor'::__l1::fin$0
`CClfsBaseFilePersisted::LoadContainerQ'::__l1::fin$0
`CClfsBaseFilePersisted::OpenImage'::__l1::fin$0
`CClfsBaseFilePersisted::QueryContainerSecurity'::__l1::fin$0
`CClfsBaseFilePersisted::ReadImage'::__l1::fin$0
`CClfsBaseFilePersisted::ReadMetadataBlock'::__l1::fin$0
`CClfsContainer::WriteSector'::__l1::fin$0
`CClfsLogFcbPhysical::AddArchiveRef'::__l1::fin$0
`CClfsLogFcbPhysical::EraseClientBlocks'::__l1::fin$0
`CClfsLogFcbPhysical::FindEndOfLog'::__l1::fin$0
`CClfsLogFcbPhysical::GetArchiveDescriptors'::__l1::fin$0
`CClfsLogFcbPhysical::GetPhysicalToVirtualLsnMappings'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$0
`CClfsLogFcbPhysical::Initialize'::__l1::fin$1
`CClfsLogFcbPhysical::MarkLogFileContainers'::__l1::fin$0
`CClfsLogFcbPhysical::QueryPhysicalLsn'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogModifyStreams'::__l1::fin$0
`CClfsLogFcbPhysical::TruncateLogStart'::__l1::fin$0
`CClfsLogFcbPhysical::UpdateCachedOwnerPage'::__l1::fin$0
`CClfsLogFcbPhysical::ValidateRegionBlocks'::__l1::fin$0
`CClfsManagedLog::DeleteContainersForShrink'::__l1::fin$0
`CClfsManagedLog::GetNextSuffixFromExistingContainers'::__l1::fin$0
`CClfsManagedLog::InvokeGrowWorker'::__l1::fin$0
`ClfsEnableThreadPrivilege'::__l1::fin$0
operator_delete
| |paramcount|0|0| |address|EXTERNAL:00000002|EXTERNAL:00000002| |sig|undefined ExFreePoolWithTag(void)|undefined ExFreePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExFreePoolWithTag Calling Diff ```diff --- NTOSKRNL.EXE::ExFreePoolWithTag calling +++ NTOSKRNL.EXE::ExFreePoolWithTag calling @@ -109,0 +110 @@ +operator_delete ``` Generated with `ghidriff` version: 1.0.0 on 2026-07-28T08:31:46