# dot3svc-07.dll-dot3svc-08.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState](#wildetailsfeatureimpl__wilfeaturetraits_feature_2872289593getcachedfeatureenabledstate) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCurrentFeatureEnabledState](#wildetailsfeatureimpl__wilfeaturetraits_feature_2872289593getcurrentfeatureenabledstate) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::ReportUsage](#wildetailsfeatureimpl__wilfeaturetraits_feature_2872289593reportusage) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled](#wildetailsfeatureimpl__wilfeaturetraits_feature_2872289593__private_isenabled) * [WPP_SF_DDDD](#wpp_sf_dddd) * [Modified](#modified) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCurrentFeatureEnabledState](#wildetailsfeatureimpl__wilfeaturetraits_feature_networkux_bugfix_61011739getcurrentfeatureenabledstate) * [wil::details::ReportUsageToServiceDirect](#wildetailsreportusagetoservicedirect) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::ReportUsage](#wildetailsfeatureimpl__wilfeaturetraits_feature_networkux_bugfix_61011739reportusage) * [wil::details::WilApi_GetFeatureEnabledState](#wildetailswilapi_getfeatureenabledstate) * [wil::details::ReportUsageToService](#wildetailsreportusagetoservice) * [wil::details::EnabledStateManager::QueueBackgroundUsageReporting](#wildetailsenabledstatemanagerqueuebackgroundusagereporting) * [RpcUIResponse](#rpcuiresponse) * [Modified (No Code Changes)](#modified-no-code-changes) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive](#api-ms-win-core-synch-l1-1-0dllacquiresrwlockexclusive) * [NTDLL.DLL::EtwTraceMessage](#ntdlldlletwtracemessage) * [~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>](#unique_storagewildetailsresource_policy_rtl_srwlock___ptr64void___cdecl_rtl_srwlock___ptr64void___cdecl_releasesrwlockexclusivestruct__rtl_srwlock___ptr64wistdintegral_constantunsigned___int641_rtl_srwlock___ptr64_rtl_srwlock___ptr640stdnullptr_t_) * [push_back](#push_back) * [API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount](#api-ms-win-core-sysinfo-l1-1-0dllgettickcount) * [EnsureSubscribedToFeatureConfigurationChanges](#ensuresubscribedtofeatureconfigurationchanges) # Visual Chart Diff ```mermaid flowchart LR wildetailsFeatureImpl__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739GetCurrentFeatureEnabledState-2-old<--Match 99%-->wildetailsFeatureImpl__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739GetCurrentFeatureEnabledState-2-new wildetailsReportUsageToServiceDirect-8-old<--Match 97%-->wildetailsReportUsageToServiceDirect-8-new wildetailsFeatureImpl__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739ReportUsage-4-old<--Match 98%-->wildetailsFeatureImpl__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739ReportUsage-4-new wildetailsWilApi_GetFeatureEnabledState-3-old<--Match 95%-->wildetailsWilApi_GetFeatureEnabledState-3-new wildetailsReportUsageToService-8-old<--Match 92%-->wildetailsReportUsageToService-8-new wildetailsEnabledStateManagerQueueBackgroundUsageReporting-3-old<--Match 94%-->wildetailsEnabledStateManagerQueueBackgroundUsageReporting-3-new RpcUIResponse-4-old<--Match 71%-->RpcUIResponse-4-new subgraph dot3svc-08.dll wildetailsFeatureImpl__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739GetCurrentFeatureEnabledState-2-new wildetailsReportUsageToServiceDirect-8-new wildetailsFeatureImpl__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739ReportUsage-4-new wildetailsWilApi_GetFeatureEnabledState-3-new wildetailsReportUsageToService-8-new wildetailsEnabledStateManagerQueueBackgroundUsageReporting-3-new RpcUIResponse-4-new subgraph Added direction LR wil-details-FeatureImpl__WilFeatureTraits_Feature_2872289593-GetCachedFeatureEnabledState wil-details-FeatureImpl__WilFeatureTraits_Feature_2872289593-GetCurrentFeatureEnabledState wil-details-FeatureImpl__WilFeatureTraits_Feature_2872289593-ReportUsage wil-details-FeatureImpl__WilFeatureTraits_Feature_2872289593-__private_IsEnabled WPP_SF_DDDD end end subgraph dot3svc-07.dll wildetailsFeatureImpl__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739GetCurrentFeatureEnabledState-2-old wildetailsReportUsageToServiceDirect-8-old wildetailsFeatureImpl__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739ReportUsage-4-old wildetailsWilApi_GetFeatureEnabledState-3-old wildetailsReportUsageToService-8-old wildetailsEnabledStateManagerQueueBackgroundUsageReporting-3-old RpcUIResponse-4-old end ``` ```mermaid pie showData title Function Matches - 99.8642% "unmatched_funcs_len" : 5 "matched_funcs_len" : 3676 ``` ```mermaid pie showData title Matched Function Similarity - 99.6192% "matched_funcs_with_code_changes_len" : 7 "matched_funcs_with_non_code_changes_len" : 7 "matched_funcs_no_changes_len" : 3662 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 dot3svc-07.dll dot3svc-08.dll ``` #### Verbose Args
``` --old ['dot3svc-07.dll'] --new [['dot3svc-08.dll']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/dot3svc.dll/832A140465000/dot3svc.dll -O dot3svc.dll.x64.10.0.26100.8972 wget https://msdl.microsoft.com/download/symbols/dot3svc.dll/81089B4066000/dot3svc.dll -O dot3svc.dll.x64.10.0.26100.9168 ``` ## Binary Metadata Diff ```diff --- dot3svc-07.dll Meta +++ dot3svc-08.dll Meta @@ -1,44 +1,44 @@ -Program Name: dot3svc-07.dll +Program Name: dot3svc-08.dll Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 418352 +# of Bytes: 422480 # of Memory Blocks: 10 -# of Instructions: 65898 -# of Defined Data: 5390 -# of Functions: 1838 -# of Symbols: 13915 -# of Data Types: 1486 +# of Instructions: 66191 +# of Defined Data: 5404 +# of Functions: 1843 +# of Symbols: 13968 +# of Data Types: 1488 # of Data Type Categories: 112 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Tue Aug 25 23:10:32 SGT 2026 +Date Created: Tue Aug 25 23:10:40 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/dot3svc-07.dll -Executable MD5: 3ede18afbe33c1fc20be502548651c93 -Executable SHA256: 1e3b6fe6c82dfcdc0d969e66ac53e58be5aa44eb4144ad1a339f24c856eb4274 -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/dot3svc-07.dll?MD5=3ede18afbe33c1fc20be502548651c93 +Executable Location: /C:/Users/Jacob/Downloads/pdbs/dot3svc-08.dll +Executable MD5: 1cae5be446cdb206f9c1772362a0c462 +Executable SHA256: 27c2fdc9f8fadc8d9f08f9524393421f1c2eb776082f769a3d9e363f80552afa +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/dot3svc-08.dll?MD5=1cae5be446cdb206f9c1772362a0c462 PDB Age: 1 PDB File: dot3svc.pdb -PDB GUID: 14d8588d-2a1d-7d37-ec8d-a98b72e504c3 +PDB GUID: f5c84403-a714-3290-8857-48b27dbc54ba PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Wired AutoConfig Service -PE Property[FileVersion]: 10.0.26100.8972 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.9168 (WinBuild.160101.0800) PE Property[InternalName]: dot3svc.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: dot3svc.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8972 +PE Property[ProductVersion]: 10.0.26100.9168 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra dot3svc-07.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra dot3svc-07.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra dot3svc-07.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra dot3svc-08.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra dot3svc-08.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra dot3svc-08.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|5| |deleted_funcs_len|0| |modified_funcs_len|14| |added_symbols_len|4| |deleted_symbols_len|1| |diff_time|15.525940179824829| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1825, 'ExternalsName': 351, 'SigCallingCalledHasher': 2, 'ExactInstructionsFunctionHasher': 1})| |items_to_process|24| |diff_types|Counter({'address': 10, 'refcount': 9, 'calling': 9, 'code': 7, 'length': 7, 'sig': 1, 'called': 1})| |unmatched_funcs_len|5| |total_funcs_len|3681| |matched_funcs_len|3676| |matched_funcs_with_code_changes_len|7| |matched_funcs_with_non_code_changes_len|7| |matched_funcs_no_changes_len|3662| |match_func_similarity_percent|99.6192%| |func_match_overall_percent|99.8642%| |first_matches|Counter({'SymbolsHash': 1825, 'SigCallingCalledHasher': 2, 'ExactInstructionsFunctionHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1825 "ExternalsName" : 351 "ExactInstructionsFunctionHasher" : 1 "SigCallingCalledHasher" : 2 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1825 "ExactInstructionsFunctionHasher" : 1 "SigCallingCalledHasher" : 2 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 5 "deleted_funcs_len" : 0 "modified_funcs_len" : 14 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 4 "deleted_symbols_len" : 1 ``` ## Strings *No string differences found* # Deleted # Added ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState ### Function Meta |Key|dot3svc-08.dll| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState| |refcount|3| |length|302| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCurrentFeatureEnabledState
wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::heap_buffer::push_back| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::ReportUsage
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled| |paramcount|1| |address|180015144| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl<__WilFeatureTraits_Feature_2872289593> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState @@ -0,0 +1,81 @@ + +/* WARNING: Removing unreachable block (ram,0x00018001519f) */ +/* WARNING: Removing unreachable block (ram,0x0001800151a4) */ +/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCachedFeatureEnabledState(void) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState + (FeatureImpl<__WilFeatureTraits_Feature_2872289593> *this) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint *in_RDX; + bool bVar5; + uint local_res18 [2]; + undefined *local_res20; + undefined4 local_38; + undefined4 local_34; + undefined4 *local_30; + + in_RDX[0] = 0; + uVar3 = Feature_2872289593__private_cppFeatureState; + in_RDX[1] = 0; + *in_RDX = Feature_2872289593__private_cppFeatureState; + if (((byte)uVar3 & 6) == 6) { + return; + } + uVar2 = EnsureSubscribedToFeatureConfigurationChanges(); + GetCurrentFeatureEnabledState(this,(int *)local_res18); + uVar3 = *in_RDX; + do { + uVar1 = uVar3; + uVar4 = uVar1 | 0x40000; + *in_RDX = uVar4; + if ((uVar1 & 4) == 0) { + uVar4 = uVar1 & 0xfffffbff | 0x40000 | local_res18[0] & 0x400 | 4; + *in_RDX = uVar4; + } + LOCK(); + bVar5 = uVar1 != Feature_2872289593__private_cppFeatureState; + uVar3 = uVar1; + if (bVar5) { + uVar3 = Feature_2872289593__private_cppFeatureState; + uVar4 = Feature_2872289593__private_cppFeatureState; + } + Feature_2872289593__private_cppFeatureState = uVar4; + UNLOCK(); + } while (bVar5); + if (((uVar1 & 4) != 0) || (_g_enabledStateManager == 0)) goto LAB_18001524b; + AcquireSRWLockExclusive((PSRWLOCK)&DAT_180057730); + local_res20 = &DAT_180057730; + if ((uVar2 == 0) || (uVar2 != DAT_180057744)) { +LAB_18001523e: + LOCK(); + Feature_2872289593__private_cppFeatureState = + Feature_2872289593__private_cppFeatureState & 0xfffffffb; + UNLOCK(); + } + else { + local_34 = 0; + local_38 = 3; + local_30 = &Feature_2872289593__private_cppFeatureState; + bVar5 = details_abi::heap_buffer::push_back((heap_buffer *)&DAT_180057768,&local_38,0x10); + if (!bVar5) goto LAB_18001523e; + } + unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res20); +LAB_18001524b: + if ((*in_RDX & 2) == 0) { + *in_RDX = *in_RDX & 0xfffff63e | local_res18[0] & 0x9c1; + } + return; +} + ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCurrentFeatureEnabledState ### Function Meta |Key|dot3svc-08.dll| | :---: | :---: | |name|GetCurrentFeatureEnabledState| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCurrentFeatureEnabledState| |refcount|2| |length|174| |called|wil::details::WilApi_GetFeatureEnabledState| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState| |paramcount|2| |address|18001527c| |sig|wil_details_FeatureStateCache __thiscall GetCurrentFeatureEnabledState(FeatureImpl<__WilFeatureTraits_Feature_2872289593> * this, int * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCurrentFeatureEnabledState +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCurrentFeatureEnabledState @@ -0,0 +1,44 @@ + +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCurrentFeatureEnabledState(int * __ptr64) __ptr64 */ + +int * __thiscall +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCurrentFeatureEnabledState + (FeatureImpl<__WilFeatureTraits_Feature_2872289593> *this,int *param_1) + +{ + bool bVar1; + FEATURE_ENABLED_STATE FVar2; + uint uVar3; + uint uVar4; + uint uVar5; + uint uVar6; + int *in_R8; + + FVar2 = WilApi_GetFeatureEnabledState(0x3b69234,(FEATURE_CHANGE_TIME)param_1,in_R8); + param_1[0] = 0; + param_1[1] = 0; + uVar5 = -(uint)((FVar2 & 0x40) != 0) & 0x800 | -(uint)((FVar2 & 0x80) != 0) & 0x400; + uVar6 = uVar5 | (FVar2 & 3) << 7; + *param_1 = uVar6; + if ((FVar2 & 0xffffff3f) == 0) { + uVar3 = 0x40; + } + else { + uVar3 = 0; + if ((FVar2 & 0xffffff3f) == 2) { + uVar3 = 0x40; + } + } + bVar1 = false; + uVar4 = 1; + if ((uVar5 == 0xc00) || (uVar3 != 0)) { + bVar1 = true; + } + if ((uVar3 == 0) || (!bVar1)) { + uVar4 = 0; + } + *param_1 = uVar6 | uVar3 | uVar4; + return param_1; +} + ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::ReportUsage ### Function Meta |Key|dot3svc-08.dll| | :---: | :---: | |name|ReportUsage| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::ReportUsage| |refcount|2| |length|126| |called|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled| |paramcount|4| |address|18001640c| |sig|void __thiscall ReportUsage(FeatureImpl<__WilFeatureTraits_Feature_2872289593> * this, bool param_1, ReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::ReportUsage +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::ReportUsage @@ -0,0 +1,32 @@ + +/* public: void __cdecl wil::details::FeatureImpl::ReportUsage(bool,enum wil::ReportingKind,unsigned + __int64) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::ReportUsage + (FeatureImpl<__WilFeatureTraits_Feature_2872289593> *this,bool param_1, + ReportingKind param_2,__uint64 param_3) + +{ + ulonglong *puVar1; + ulonglong uVar2; + undefined4 local_res8; + undefined2 local_resc; + wil_ReportingKind in_stack_ffffffffffffffd8; + __uint64 in_stack_ffffffffffffffe0; + + uVar2 = (ulonglong)Feature_2872289593__private_cppFeatureState; + if ((Feature_2872289593__private_cppFeatureState & 4) == 0) { + puVar1 = (ulonglong *)GetCachedFeatureEnabledState(this); + uVar2 = *puVar1; + } + local_res8 = 0; + local_resc = 2; + ReportUsageToService + ((wil_details_FeatureReportingCache *)(this + 8),0x3b69234,(uint)uVar2 >> 10 & 1, + (uint)(uVar2 >> 0xb) & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)param_1, + in_stack_ffffffffffffffd8,in_stack_ffffffffffffffe0); + return; +} + ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled ### Function Meta |Key|dot3svc-08.dll| | :---: | :---: | |name|__private_IsEnabled| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled| |refcount|2| |length|78| |called|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::ReportUsage| |calling|RpcUIResponse| |paramcount|1| |address|1800166a8| |sig|bool __thiscall __private_IsEnabled(FeatureImpl<__WilFeatureTraits_Feature_2872289593> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled @@ -0,0 +1,19 @@ + +/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ + +bool __thiscall +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled + (FeatureImpl<__WilFeatureTraits_Feature_2872289593> *this) + +{ + ReportingKind in_R8D; + __uint64 in_R9; + undefined1 local_res10; + + GetCachedFeatureEnabledState(this); + ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); + Feature_2872289593__private_lastUsedTickCount = GetTickCount(); + return (bool)(local_res10 & 1); +} + ``` ## WPP_SF_DDDD ### Function Meta |Key|dot3svc-08.dll| | :---: | :---: | |name|WPP_SF_DDDD| |fullname|WPP_SF_DDDD| |refcount|2| |length|102| |called|NTDLL.DLL::EtwTraceMessage| |calling|RpcUIResponse| |paramcount|4| |address|1800186dc| |sig|undefined __fastcall WPP_SF_DDDD(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined4 param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- WPP_SF_DDDD +++ WPP_SF_DDDD @@ -0,0 +1,12 @@ + +void WPP_SF_DDDD(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined4 param_4) + +{ + undefined4 local_res20 [2]; + + local_res20[0] = param_4; + EtwTraceMessage(param_1,0x2b,&WPP_be59dbe1f0883ef4545a0d1325ede64a_Traceguids,0x45,local_res20,4, + &stack0x00000028,4,&stack0x00000030,4,&stack0x00000038,4,0); + return; +} + ``` # Modified *Modified functions contain code changes* ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCurrentFeatureEnabledState ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.97| |i_ratio|0.85| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|GetCurrentFeatureEnabledState|GetCurrentFeatureEnabledState| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCurrentFeatureEnabledState|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCurrentFeatureEnabledState| |refcount|2|2| |`length`|157|162| |called|wil::details::WilApi_GetFeatureEnabledState|wil::details::WilApi_GetFeatureEnabledState| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState| |paramcount|2|2| |`address`|1800376a8|1800381f8| |sig|wil_details_FeatureStateCache __thiscall GetCurrentFeatureEnabledState(FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739> * this, int * param_1)|wil_details_FeatureStateCache __thiscall GetCurrentFeatureEnabledState(FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739> * this, int * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCurrentFeatureEnabledState Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCurrentFeatureEnabledState +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCurrentFeatureEnabledState @@ -1,44 +1,44 @@ /* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCurrentFeatureEnabledState(int * __ptr64) __ptr64 */ int * __thiscall wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>:: GetCurrentFeatureEnabledState (FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739> *this,int *param_1) { bool bVar1; FEATURE_ENABLED_STATE FVar2; uint uVar3; uint uVar4; int *in_R8; uint uVar5; - FVar2 = WilApi_GetFeatureEnabledState((uint)this,(FEATURE_CHANGE_TIME)param_1,in_R8); + FVar2 = WilApi_GetFeatureEnabledState(0x3a2f71b,(FEATURE_CHANGE_TIME)param_1,in_R8); uVar5 = 0; param_1[0] = 0; param_1[1] = 0; uVar4 = -(uint)((FVar2 & 0x40) != 0) & 0x800 | -(uint)((FVar2 & 0x80) != 0) & 0x400 | (FVar2 & 3) << 7; if ((FVar2 & 0xffffff3f) != 0) { uVar3 = 0; if ((FVar2 & 0xffffff3f) == 2) { uVar3 = 0x40; } uVar4 = uVar4 | uVar3; } bVar1 = false; if ((uVar4 & 0xc00) == 0xc00) { bVar1 = true; LAB_0: if (((uVar4 & 0x40) == 0) || (!bVar1)) goto LAB_1; } else if ((uVar4 & 0x40) == 0) goto LAB_0; uVar5 = 1; LAB_1: *param_1 = uVar4 | uVar5; return param_1; } ``` ## wil::details::ReportUsageToServiceDirect ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.47| |i_ratio|0.45| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|ReportUsageToServiceDirect|ReportUsageToServiceDirect| |fullname|wil::details::ReportUsageToServiceDirect|wil::details::ReportUsageToServiceDirect| |refcount|2|2| |`length`|315|306| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::WilApi_RecordFeatureUsage
wil_details_FeatureReporting_RecordUsageInCache|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::WilApi_RecordFeatureUsage
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil::details::ReportUsageToService|wil::details::ReportUsageToService| |paramcount|8|8| |`address`|1800384b0|180016540| |sig|int __cdecl ReportUsageToServiceDirect(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, wil_details_ServiceReportingKind param_5, uint param_6, __uint64 param_7, uchar param_8)|int __cdecl ReportUsageToServiceDirect(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, wil_details_ServiceReportingKind param_5, uint param_6, __uint64 param_7, uchar param_8)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::ReportUsageToServiceDirect Diff ```diff --- wil::details::ReportUsageToServiceDirect +++ wil::details::ReportUsageToServiceDirect @@ -1,72 +1,68 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* int __cdecl wil::details::ReportUsageToServiceDirect(struct wil_details_FeatureReportingCache * __ptr64,unsigned int,int,int,enum wil_details_ServiceReportingKind,unsigned int,unsigned __int64,unsigned char) */ int __cdecl wil::details::ReportUsageToServiceDirect (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4, wil_details_ServiceReportingKind param_5,uint param_6,__uint64 param_7,uchar param_8) { undefined8 uVar1; - uint uVar2; + wil_details_ServiceReportingKind wVar2; uint uVar3; uint uVar4; - uint *puVar5; - wil_details_ServiceReportingKind wVar6; + uint uVar5; + uint *puVar6; + int iVar7; int iVar8; - int iVar9; undefined4 in_register_0000008c; - int local_28; - uint local_20 [6]; - wil_details_FeatureReportingCache *pwVar7; + int local_38; + uint local_30 [6]; - pwVar7 = param_1; - iVar9 = param_4; - puVar5 = wil_details_FeatureReporting_RecordUsageInCache - (local_20,(uint *)param_1,(ulonglong)param_5); - wVar6 = (wil_details_ServiceReportingKind)pwVar7; - iVar8 = 1; - uVar2 = *puVar5; - uVar3 = puVar5[1]; - uVar4 = puVar5[2]; - uVar1 = *(undefined8 *)(puVar5 + 4); + iVar8 = param_4; + puVar6 = wil_details_FeatureReporting_RecordUsageInCache + (local_30,(uint *)param_1,(ulonglong)param_5); + iVar7 = 1; + uVar3 = *puVar6; + uVar4 = puVar6[1]; + uVar5 = puVar6[2]; + uVar1 = *(undefined8 *)(puVar6 + 4); if ((g_wil_details_RecordSRUMFeatureUsage != (code *)0x0) && ((param_5 == 0 || (param_5 - 100 < 0x32)))) { - wVar6 = param_5; - (*g_wil_details_RecordSRUMFeatureUsage)(0x3a2f71b,param_5,1); - } - if (uVar2 != 0) { - EnabledStateManager::QueueBackgroundUsageReporting - ((EnabledStateManager *)&g_enabledStateManager,wVar6,param_1); + (*g_wil_details_RecordSRUMFeatureUsage)(param_2,param_5,1); } if (uVar3 != 0) { - WilApi_RecordFeatureUsage(0x3a2f71b,uVar4,uVar3,(char *)CONCAT44(in_register_0000008c,iVar9)); + EnabledStateManager::QueueBackgroundUsageReporting + ((EnabledStateManager *)&g_enabledStateManager,param_2,param_1); } - local_28 = (int)uVar1; - if (local_28 == 0) { + if (uVar4 != 0) { + WilApi_RecordFeatureUsage(param_2,uVar5,uVar4,(char *)CONCAT44(in_register_0000008c,iVar8)); + } + local_38 = (int)uVar1; + if (local_38 == 0) { EnabledStateManager::EnsureSubscribedToUsageFlush ((EnabledStateManager *)&g_enabledStateManager, ::); } if (param_3 != 0) { - wVar6 = param_5 | 0x80000000; + wVar2 = param_5 | 0x80000000; if (param_4 == 0) { - wVar6 = param_5; + wVar2 = param_5; } - WilApi_RecordFeatureUsage(0x3a2f71b,wVar6,0,(char *)CONCAT44(in_register_0000008c,iVar9)); + WilApi_RecordFeatureUsage(param_2,wVar2,0,(char *)CONCAT44(in_register_0000008c,iVar8)); } - if (local_28 == 0) { + if (local_38 == 0) { if (g_wil_details_realtimeFeatureUsageHook != (code *)0x0) { - (*g_wil_details_realtimeFeatureUsageHook)(0x3a2f71b,param_5,param_8); + (*g_wil_details_realtimeFeatureUsageHook)(param_2,param_5,param_8); } } else { - iVar8 = 0; + iVar7 = 0; } - return iVar8; + return iVar7; } ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::ReportUsage ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.69| |i_ratio|0.86| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|ReportUsage|ReportUsage| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::ReportUsage|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::ReportUsage| |refcount|2|2| |`length`|121|126| |called|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState
wil::details::ReportUsageToService|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::__private_IsEnabled|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::__private_IsEnabled| |paramcount|4|4| |`address`|180038398|180038d9c| |sig|void __thiscall ReportUsage(FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739> * this, bool param_1, ReportingKind param_2, __uint64 param_3)|void __thiscall ReportUsage(FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739> * this, bool param_1, ReportingKind param_2, __uint64 param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::ReportUsage Diff ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::ReportUsage +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::ReportUsage @@ -1,37 +1,32 @@ /* public: void __cdecl wil::details::FeatureImpl::ReportUsage(bool,enum wil::ReportingKind,unsigned __int64) __ptr64 */ void __thiscall wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::ReportUsage (FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739> *this,bool param_1, ReportingKind param_2,__uint64 param_3) { ulonglong *puVar1; - uint uVar2; - undefined7 in_register_00000011; - ulonglong uVar3; + ulonglong uVar2; undefined4 local_res8; undefined2 local_resc; wil_ReportingKind in_stack_ffffffffffffffd8; __uint64 in_stack_ffffffffffffffe0; - undefined1 local_18 [16]; - uVar2 = (uint)CONCAT71(in_register_00000011,param_1); - uVar3 = (ulonglong)Feature_NetworkUX_BugFix_61011739__private_cppFeatureState; + uVar2 = (ulonglong)Feature_NetworkUX_BugFix_61011739__private_cppFeatureState; if ((Feature_NetworkUX_BugFix_61011739__private_cppFeatureState & 4) == 0) { - uVar2 = (uint)local_18; puVar1 = (ulonglong *)GetCachedFeatureEnabledState(this); - uVar3 = *puVar1; + uVar2 = *puVar1; } local_res8 = 0; local_resc = 1; ReportUsageToService - ((wil_details_FeatureReportingCache *)(this + 8),uVar2,(uint)uVar3 >> 10 & 1, - (uint)(uVar3 >> 0xb) & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)param_1, + ((wil_details_FeatureReportingCache *)(this + 8),0x3a2f71b,(uint)uVar2 >> 10 & 1, + (uint)(uVar2 >> 0xb) & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)param_1, in_stack_ffffffffffffffd8,in_stack_ffffffffffffffe0); return; } ``` ## wil::details::WilApi_GetFeatureEnabledState ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|code,refcount,length,address,calling| |ratio|0.93| |i_ratio|0.42| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|WilApi_GetFeatureEnabledState|WilApi_GetFeatureEnabledState| |fullname|wil::details::WilApi_GetFeatureEnabledState|wil::details::WilApi_GetFeatureEnabledState| |`refcount`|1|2| |`length`|40|35| |called|_guard_dispatch_icall$thunk$10345483385596137414|_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCurrentFeatureEnabledState|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCurrentFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCurrentFeatureEnabledState| |paramcount|3|3| |`address`|180038908|18001667c| |sig|FEATURE_ENABLED_STATE __cdecl WilApi_GetFeatureEnabledState(uint param_1, FEATURE_CHANGE_TIME param_2, int * param_3)|FEATURE_ENABLED_STATE __cdecl WilApi_GetFeatureEnabledState(uint param_1, FEATURE_CHANGE_TIME param_2, int * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::WilApi_GetFeatureEnabledState Calling Diff ```diff --- wil::details::WilApi_GetFeatureEnabledState calling +++ wil::details::WilApi_GetFeatureEnabledState calling @@ -0,0 +1 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCurrentFeatureEnabledState ``` ### wil::details::WilApi_GetFeatureEnabledState Diff ```diff --- wil::details::WilApi_GetFeatureEnabledState +++ wil::details::WilApi_GetFeatureEnabledState @@ -1,23 +1,23 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* enum FEATURE_ENABLED_STATE __cdecl wil::details::WilApi_GetFeatureEnabledState(unsigned int,enum FEATURE_CHANGE_TIME,int * __ptr64) */ FEATURE_ENABLED_STATE __cdecl wil::details::WilApi_GetFeatureEnabledState(uint param_1,FEATURE_CHANGE_TIME param_2,int *param_3) { FEATURE_ENABLED_STATE FVar1; code *pcVar2; pcVar2 = g_wil_details_internalGetFeatureEnabledState; if ((g_wil_details_internalGetFeatureEnabledState == (code *)0x0) && (pcVar2 = g_wil_details_apiGetFeatureEnabledState, g_wil_details_apiGetFeatureEnabledState == (code *)0x0)) { return 0; } - FVar1 = (*pcVar2)(0x3a2f71b,3); + FVar1 = (*pcVar2)(param_1,3); return FVar1; } ``` ## wil::details::ReportUsageToService ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|code,refcount,length,address,calling| |ratio|0.76| |i_ratio|0.43| |m_ratio|0.92| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|ReportUsageToService|ReportUsageToService| |fullname|wil::details::ReportUsageToService|wil::details::ReportUsageToService| |`refcount`|2|3| |`length`|142|164| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind| |`calling`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::ReportUsage|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::ReportUsage
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::ReportUsage| |paramcount|8|8| |`address`|180038418|180016494| |sig|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::ReportUsageToService Calling Diff ```diff --- wil::details::ReportUsageToService calling +++ wil::details::ReportUsageToService calling @@ -0,0 +1 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::ReportUsage ``` ### wil::details::ReportUsageToService Diff ```diff --- wil::details::ReportUsageToService +++ wil::details::ReportUsageToService @@ -1,35 +1,31 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* void __cdecl wil::details::ReportUsageToService(struct wil_details_FeatureReportingCache * __ptr64,unsigned int,int,int,struct FEATURE_LOGGED_TRAITS const * __ptr64,int,enum wil_ReportingKind,unsigned __int64) */ void __cdecl wil::details::ReportUsageToService (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4, FEATURE_LOGGED_TRAITS *param_5,int param_6,wil_ReportingKind param_7,__uint64 param_8) { wil_details_ServiceReportingKind wVar1; int iVar2; - ulonglong uVar3; - undefined4 local_res10 [6]; uint in_stack_ffffffffffffffd0; undefined1 in_stack_ffffffffffffffd8; undefined7 in_stack_ffffffffffffffd9; - uVar3 = (ulonglong)(uint)param_6; - local_res10[0] = 3; + param_7 = 3; wVar1 = wil_details_MapReportingKind(3,param_6); iVar2 = ReportUsageToServiceDirect - (param_1,(uint)CONCAT71((int7)(uVar3 >> 8),param_5[4]),param_3,param_4,wVar1, - in_stack_ffffffffffffffd0, + (param_1,param_2,param_3,param_4,wVar1,in_stack_ffffffffffffffd0, CONCAT71(in_stack_ffffffffffffffd9,in_stack_ffffffffffffffd8),(uchar)param_5[4] ); if ((iVar2 != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { - (*g_wil_details_pfnFeatureLoggingHook)(0x3a2f71b,param_5,0,param_6,local_res10,0,0,1); + (*g_wil_details_pfnFeatureLoggingHook)(param_2,param_5,0,param_6,¶m_7,0,0,1); } return; } ``` ## wil::details::EnabledStateManager::QueueBackgroundUsageReporting ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.89| |i_ratio|0.66| |m_ratio|0.96| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|QueueBackgroundUsageReporting|QueueBackgroundUsageReporting| |fullname|wil::details::EnabledStateManager::QueueBackgroundUsageReporting|wil::details::EnabledStateManager::QueueBackgroundUsageReporting| |refcount|2|2| |`length`|238|233| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer
wil::ProcessShutdownInProgress
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::heap_buffer::push_back
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer
wil::ProcessShutdownInProgress
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::heap_buffer::push_back
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::ReportUsageToServiceDirect|wil::details::ReportUsageToServiceDirect| |paramcount|3|3| |`address`|180038270|180016284| |sig|void __thiscall QueueBackgroundUsageReporting(EnabledStateManager * this, uint param_1, wil_details_FeatureReportingCache * param_2)|void __thiscall QueueBackgroundUsageReporting(EnabledStateManager * this, uint param_1, wil_details_FeatureReportingCache * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::EnabledStateManager::QueueBackgroundUsageReporting Diff ```diff --- wil::details::EnabledStateManager::QueueBackgroundUsageReporting +++ wil::details::EnabledStateManager::QueueBackgroundUsageReporting @@ -1,59 +1,60 @@ /* public: void __cdecl wil::details::EnabledStateManager::QueueBackgroundUsageReporting(unsigned int,struct wil_details_FeatureReportingCache * __ptr64) __ptr64 */ void __thiscall wil::details::EnabledStateManager::QueueBackgroundUsageReporting (EnabledStateManager *this,uint param_1,wil_details_FeatureReportingCache *param_2) { EnabledStateManager *SRWLock; unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> *this_00; bool bVar1; PTP_TIMER p_Var2; last_error_context local_res8 [8]; EnabledStateManager *local_res20; - undefined8 local_18; - wil_details_FeatureReportingCache *local_10; + uint local_28 [2]; + wil_details_FeatureReportingCache *local_20; if (*(int *)this != 0) { bVar1 = ProcessShutdownInProgress(); if (!bVar1) { SRWLock = this + 8; AcquireSRWLockExclusive((PSRWLOCK)SRWLock); local_res20 = SRWLock; if (*(int *)this != 0) { bVar1 = ProcessShutdownInProgress(); if (!bVar1) { - local_18 = 0x3a2f71b; - local_10 = param_2; - details_abi::heap_buffer::push_back((heap_buffer *)(this + 0x20),&local_18,0x10); + local_28[1] = 0; + local_28[0] = param_1; + local_20 = param_2; + details_abi::heap_buffer::push_back((heap_buffer *)(this + 0x20),local_28,0x10); this_00 = (unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> *)(this + 0x10); if (this[0x18] == (EnabledStateManager)0x0) { if (*(longlong *)this_00 == 0) { last_error_context::last_error_context(local_res8); p_Var2 = CreateThreadpoolTimer (::, this,(PTP_CALLBACK_ENVIRON)0x0); unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> ::reset(this_00,p_Var2); last_error_context::~last_error_context(local_res8); } EnsureCoalescedTimer_SetTimer ((unique_any_t::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>_> *)this_00,(bool *)(this + 0x18),300000); } } } unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ((unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> *)&local_res20); } } return; } ``` ## RpcUIResponse ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.39| |i_ratio|0.28| |m_ratio|0.71| |b_ratio|0.71| |match_types|SymbolsHash| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|RpcUIResponse|RpcUIResponse| |fullname|RpcUIResponse|RpcUIResponse| |refcount|3|3| |`length`|238|428| |`called`|Dot3AcmIsAPIAllowed
Dot3AcmUIResponse
WPP_SF_D
WPP_SF_q|Dot3AcmIsAPIAllowed
Dot3AcmUIResponse
WPP_SF_D
WPP_SF_DDDD
WPP_SF_q
WPP_SF_qD
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled| |calling||| |paramcount|4|4| |`address`|180017e30|180018510| |`sig`|ulong __fastcall RpcUIResponse(longlong param_1, _GUID * param_2, longlong param_3, _DOT3_UI_RESPONSE * param_4)|ulong __fastcall RpcUIResponse(longlong param_1, _GUID * param_2, uint * param_3, _DOT3_UI_RESPONSE * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RpcUIResponse Called Diff ```diff --- RpcUIResponse called +++ RpcUIResponse called @@ -3,0 +4 @@ +WPP_SF_DDDD @@ -4,0 +6,2 @@ +WPP_SF_qD +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled ``` ### RpcUIResponse Diff ```diff --- RpcUIResponse +++ RpcUIResponse @@ -1,35 +1,74 @@ -ulong RpcUIResponse(longlong param_1,_GUID *param_2,longlong param_3,_DOT3_UI_RESPONSE *param_4) +ulong RpcUIResponse(longlong param_1,_GUID *param_2,uint *param_3,_DOT3_UI_RESPONSE *param_4) { - int iVar1; - ulong uVar2; + uint uVar1; + longlong lVar2; + bool bVar3; + int iVar4; + ulong uVar5; + uint *puVar6; + puVar6 = param_3; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < (byte)WPP_GLOBAL_Control[0x19])) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + puVar6 = (uint *)&WPP_be59dbe1f0883ef4545a0d1325ede64a_Traceguids; WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x43, - &WPP_ae93a2d1720c3fffcf84942d269f86a2_Traceguids,param_1); + &WPP_be59dbe1f0883ef4545a0d1325ede64a_Traceguids,param_1); } if (param_1 == 0) { - uVar2 = 0x57; + uVar5 = 0x57; } else if (g_bRpcServerStarted == '\0') { - uVar2 = 0x6ba; + uVar5 = 0x6ba; } else { - iVar1 = Dot3AcmIsAPIAllowed(param_2); - if (iVar1 == 0) { - uVar2 = 0x32; + iVar4 = Dot3AcmIsAPIAllowed(param_2); + if (iVar4 == 0) { + uVar5 = 0x32; } else { - uVar2 = Dot3AcmUIResponse(param_2,*(_DOT3_UI_REQUEST **)(param_3 + 8),param_4); + bVar3 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled + ((FeatureImpl<__WilFeatureTraits_Feature_2872289593> *) + &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_2872289593>::GetImpl(void)' + ::__l2::impl); + if (bVar3) { + lVar2 = *(longlong *)(param_3 + 2); + if ((lVar2 == 0) || (*param_3 < 0x28)) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return 0x57; + } + uVar5 = 0x57; + if ((WPP_GLOBAL_Control[0x19] != '\0') && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_qD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x44,puVar6,lVar2); + uVar5 = 0x57; + } + goto LAB_0; + } + if ((((*(uint *)(lVar2 + 0x10) != *param_3) || + (uVar1 = *(uint *)(lVar2 + 0x20), uVar1 < 0x28)) || (*param_3 < uVar1)) || + (*param_3 - uVar1 < *(uint *)(lVar2 + 0x1c))) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return 0x57; + } + uVar5 = 0x57; + if ((WPP_GLOBAL_Control[0x19] != '\0') && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_DDDD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10), + (ulonglong)*(uint *)(lVar2 + 0x10),puVar6,*param_3); + uVar5 = 0x57; + } + goto LAB_0; + } + } + uVar5 = Dot3AcmUIResponse(param_2,*(_DOT3_UI_REQUEST **)(param_3 + 2),param_4); } } +LAB_0: if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < (byte)WPP_GLOBAL_Control[0x19])) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x44, - &WPP_ae93a2d1720c3fffcf84942d269f86a2_Traceguids,uVar2); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x46, + &WPP_be59dbe1f0883ef4545a0d1325ede64a_Traceguids,uVar5); } - return uVar2; + return uVar5; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|AcquireSRWLockExclusive|AcquireSRWLockExclusive| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive| |`refcount`|21|22| |length|0|0| |called||| |`calling`|
Expand for full list:
::
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::OnTimerwil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateDatawil::details::FeatureStateManager::OnTimer
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |`address`|EXTERNAL:000000c2|EXTERNAL:000000ba| |sig|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling @@ -8,0 +9 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState ``` ## NTDLL.DLL::EtwTraceMessage ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|EtwTraceMessage|EtwTraceMessage| |fullname|NTDLL.DLL::EtwTraceMessage|NTDLL.DLL::EtwTraceMessage| |`refcount`|27|28| |length|0|0| |called||| |`calling`|
Expand for full list:
WPP_SF_
WPP_SF_D
WPP_SF_DDDDD
WPP_SF_DD_guid_
WPP_SF_LL
WPP_SF_PD
WPP_SF_S
WPP_SF_SD
WPP_SF_SS
WPP_SF__guid_
WPP_SF__guid_DWPP_SF__guid_DD
WPP_SF_dD
WPP_SF_dL
WPP_SF_ddD
WPP_SF_dsD
WPP_SF_dsDS
WPP_SF_i
WPP_SF_iD
WPP_SF_i_guid_
WPP_SF_id
WPP_SF_l
WPP_SF_lD
WPP_SF_q
WPP_SF_qD
WPP_SF_sd
|
Expand for full list:
WPP_SF_
WPP_SF_D
WPP_SF_DDDD
WPP_SF_DDDDD
WPP_SF_DD_guid_
WPP_SF_LL
WPP_SF_PD
WPP_SF_S
WPP_SF_SD
WPP_SF_SS
WPP_SF__guid_WPP_SF__guid_D
WPP_SF__guid_DD
WPP_SF_dD
WPP_SF_dL
WPP_SF_ddD
WPP_SF_dsD
WPP_SF_dsDS
WPP_SF_i
WPP_SF_iD
WPP_SF_i_guid_
WPP_SF_id
WPP_SF_l
WPP_SF_lD
WPP_SF_q
WPP_SF_qD
WPP_SF_sd
| |paramcount|0|0| |address|EXTERNAL:0000005a|EXTERNAL:0000005a| |sig|undefined EtwTraceMessage(void)|undefined EtwTraceMessage(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTDLL.DLL::EtwTraceMessage Calling Diff ```diff --- NTDLL.DLL::EtwTraceMessage calling +++ NTDLL.DLL::EtwTraceMessage calling @@ -2,0 +3 @@ +WPP_SF_DDDD ``` ## ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |`refcount`|21|22| |length|29|29| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive| |`calling`|
Expand for full list:
::
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::OnTimerwil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateDatawil::details::FeatureStateManager::OnTimer
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |address|1800051f0|1800051f0| |sig|void __thiscall ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling @@ -8,0 +9 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState ``` ## push_back ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|push_back|push_back| |fullname|wil::details_abi::heap_buffer::push_back|wil::details_abi::heap_buffer::push_back| |`refcount`|6|7| |length|90|90| |called|memcpy_s
wil::details_abi::heap_buffer::ensure|memcpy_s
wil::details_abi::heap_buffer::ensure| |`calling`|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details_abi::SubscriptionList::SubscribeUnderLock|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details_abi::SubscriptionList::SubscribeUnderLock| |paramcount|3|3| |address|18000a4e4|18000a4e4| |sig|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### push_back Calling Diff ```diff --- wil::details_abi::heap_buffer::push_back calling +++ wil::details_abi::heap_buffer::push_back calling @@ -2,0 +3 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState ``` ## API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|GetTickCount|GetTickCount| |fullname|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount| |`refcount`|7|8| |length|0|0| |called||| |`calling`|LanNotifyOnLogonWorker
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::__private_IsEnabled|LanNotifyOnLogonWorker
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::__private_IsEnabled| |paramcount|0|0| |`address`|EXTERNAL:000000fa|EXTERNAL:000000ec| |sig|DWORD __stdcall GetTickCount(void)|DWORD __stdcall GetTickCount(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount Calling Diff ```diff --- API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount calling +++ API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount calling @@ -1,0 +2 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::__private_IsEnabled ``` ## EnsureSubscribedToFeatureConfigurationChanges ### Match Info |Key|dot3svc-07.dll - dot3svc-08.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.78| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|dot3svc-07.dll|dot3svc-08.dll| | :---: | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChanges|EnsureSubscribedToFeatureConfigurationChanges| |fullname|wil::details::EnsureSubscribedToFeatureConfigurationChanges|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |`refcount`|3|4| |length|32|32| |called|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |`calling`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_NetworkUX_BugFix_61011739>::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|0|0| |address|180005e18|180005e18| |sig|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### EnsureSubscribedToFeatureConfigurationChanges Calling Diff ```diff --- wil::details::EnsureSubscribedToFeatureConfigurationChanges calling +++ wil::details::EnsureSubscribedToFeatureConfigurationChanges calling @@ -0,0 +1 @@ +wil::details::FeatureImpl<__WilFeatureTraits_Feature_2872289593>::GetCachedFeatureEnabledState ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-25T23:11:36