# exfat-02.sys-exfat-03.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_930095419__private_IsEnabledDeviceUsageNoInline](#feature_930095419__private_isenableddeviceusagenoinline) * [Feature_930095419__private_IsEnabledFallback](#feature_930095419__private_isenabledfallback) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_RecordCachedUsage](#wil_details_recordcachedusage) * [wil_details_RecordFeatureUsageReporting](#wil_details_recordfeatureusagereporting) * [wil_details_EvaluateFeatureDependencies](#wil_details_evaluatefeaturedependencies) * [wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_getcachedfeatureenabledstate) * [wil_details_OnFeatureUsageProviderFlushNotification](#wil_details_onfeatureusageproviderflushnotification) * [wil_details_ReevaluateOnFeatureConfigurationChange](#wil_details_reevaluateonfeatureconfigurationchange) * [wil_InitializeFeatureStaging](#wil_initializefeaturestaging) * [wil_details_PopulateInitialConfiguredFeatureStates](#wil_details_populateinitialconfiguredfeaturestates) * [NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider](#ntoskrnlexertlregisterfeatureusageprovider) * [NTOSKRNL.EXE::RtlRecordFeatureUsage](#ntoskrnlexertlrecordfeatureusage) * [NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification](#ntoskrnlexertlunregisterfeatureconfigurationchangenotification) * [NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification](#ntoskrnlexertlregisterfeatureconfigurationchangenotification) * [NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider](#ntoskrnlexertlunregisterfeatureusageprovider) * [NTOSKRNL.EXE::RtlQueryFeatureConfiguration](#ntoskrnlexertlqueryfeatureconfiguration) * [NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp](#ntoskrnlexertlqueryfeatureconfigurationchangestamp) * [NTOSKRNL.EXE::RtlNotifyFeatureUsage](#ntoskrnlexertlnotifyfeatureusage) * [NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification](#ntoskrnlexertlarmfeatureusageproviderflushnotification) * [Modified](#modified) * [DriverEntry](#driverentry) * [FppSetupAllocationSupport](#fppsetupallocationsupport) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [NTOSKRNL.EXE::IoDeleteDevice](#ntoskrnlexeiodeletedevice) * [__security_check_cookie](#__security_check_cookie) * [NTOSKRNL.EXE::ExRaiseStatus](#ntoskrnlexeexraisestatus) # Visual Chart Diff ```mermaid flowchart LR DriverEntry-2-old<--Match 66%-->DriverEntry-2-new FppSetupAllocationSupport-2-old<--Match 95%-->FppSetupAllocationSupport-2-new subgraph exfat-03.sys DriverEntry-2-new FppSetupAllocationSupport-2-new subgraph Added direction LR Feature_930095419__private_IsEnabledDeviceUsageNoInline Feature_930095419__private_IsEnabledFallback wil_details_FeatureReporting_RecordUsageInCache wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath wil_details_IsEnabledFallback wil_details_RecordCachedUsage wil_details_RecordFeatureUsageReporting wil_details_EvaluateFeatureDependencies wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState wil_details_OnFeatureUsageProviderFlushNotification wil_details_ReevaluateOnFeatureConfigurationChange wil_InitializeFeatureStaging wil_details_PopulateInitialConfiguredFeatureStates NTOSKRNLEXE-RtlRegisterFeatureUsageProvider NTOSKRNLEXE-RtlRecordFeatureUsage NTOSKRNLEXE-RtlUnregisterFeatureConfigurationChangeNotification NTOSKRNLEXE-RtlRegisterFeatureConfigurationChangeNotification NTOSKRNLEXE-RtlUnregisterFeatureUsageProvider NTOSKRNLEXE-RtlQueryFeatureConfiguration NTOSKRNLEXE-RtlQueryFeatureConfigurationChangeStamp NTOSKRNLEXE-RtlNotifyFeatureUsage NTOSKRNLEXE-RtlArmFeatureUsageProviderFlushNotification end end subgraph exfat-02.sys DriverEntry-2-old FppSetupAllocationSupport-2-old end ``` ```mermaid pie showData title Function Matches - 98.9173% "unmatched_funcs_len" : 25 "matched_funcs_len" : 2284 ``` ```mermaid pie showData title Matched Function Similarity - 99.7373% "matched_funcs_with_code_changes_len" : 2 "matched_funcs_with_non_code_changes_len" : 4 "matched_funcs_no_changes_len" : 2278 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 exfat-02.sys exfat-03.sys ``` #### Verbose Args
``` --old ['exfat-02.sys'] --new [['exfat-03.sys']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/exFAT.Sys/0177ADB96D000/exFAT.Sys -O exfat.sys.x64.10.0.26100.2454 wget https://msdl.microsoft.com/download/symbols/exFAT.Sys/5CF719C96D000/exFAT.Sys -O exfat.sys.x64.10.0.26100.3470 ``` ## Binary Metadata Diff ```diff --- exfat-02.sys Meta +++ exfat-03.sys Meta @@ -1,44 +1,44 @@ -Program Name: exfat-02.sys +Program Name: exfat-03.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f -# of Bytes: 449360 +# of Bytes: 449444 # of Memory Blocks: 13 -# of Instructions: 73370 -# of Defined Data: 6843 -# of Functions: 1142 -# of Symbols: 9220 +# of Instructions: 74608 +# of Defined Data: 6953 +# of Functions: 1167 +# of Symbols: 9359 # of Data Types: 387 # of Data Type Categories: 23 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Thu Aug 27 20:54:25 SGT 2026 +Date Created: Thu Aug 27 20:54:31 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/exfat-02.sys -Executable MD5: c5591e815be1d60783a82a08c7e1a85e -Executable SHA256: 8a6a3fe8720003c9489a5baacb6d2a64e2a1bbbbbfe7187face4a44d80a6c786 -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/exfat-02.sys?MD5=c5591e815be1d60783a82a08c7e1a85e +Executable Location: /C:/Users/Jacob/Downloads/pdbs/exfat-03.sys +Executable MD5: 443d1940f41e582337a817a2c67bf883 +Executable SHA256: 841c4900a603398f6dcf6f6dd394a3183182a394c2fc00f1a241e2b70140df09 +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/exfat-03.sys?MD5=443d1940f41e582337a817a2c67bf883 PDB Age: 1 PDB File: exfat.pdb -PDB GUID: 2c028df1-d8d8-934f-cc4b-ffece114c73e +PDB GUID: 66031351-69f7-af7e-eebb-6ce5ddbb0c02 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Microsoft Extended FAT File System -PE Property[FileVersion]: 10.0.26100.2454 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.3470 (WinBuild.160101.0800) PE Property[InternalName]: exFAT.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: exFAT.Sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.2454 +PE Property[ProductVersion]: 10.0.26100.3470 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra exfat-02.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra exfat-02.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra exfat-02.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra exfat-03.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra exfat-03.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra exfat-03.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|25| |deleted_funcs_len|0| |modified_funcs_len|6| |added_symbols_len|22| |deleted_symbols_len|0| |diff_time|15.36593770980835| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1141, 'ExternalsName': 331})| |items_to_process|53| |diff_types|Counter({'refcount': 4, 'address': 4, 'code': 2, 'length': 2, 'called': 2, 'calling': 2, 'sig': 1})| |unmatched_funcs_len|25| |total_funcs_len|2309| |matched_funcs_len|2284| |matched_funcs_with_code_changes_len|2| |matched_funcs_with_non_code_changes_len|4| |matched_funcs_no_changes_len|2278| |match_func_similarity_percent|99.7373%| |func_match_overall_percent|98.9173%| |first_matches|Counter({'SymbolsHash': 1141})| ```mermaid pie showData title All Matches "SymbolsHash" : 1141 "ExternalsName" : 331 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1141 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 25 "deleted_funcs_len" : 0 "modified_funcs_len" : 6 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 22 "deleted_symbols_len" : 0 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_930095419__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|Feature_930095419__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_930095419__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_930095419__private_IsEnabledFallback| |calling|FppSetupAllocationSupport| |paramcount|0| |address|1c000154c| |sig|ulonglong __fastcall Feature_930095419__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_930095419__private_IsEnabledDeviceUsageNoInline +++ Feature_930095419__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_930095419__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (undefined4 *)(ulonglong)Feature_930095419__private_featureState; + if ((Feature_930095419__private_featureState & 0x10) == 0) { + uVar1 = Feature_930095419__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_930095419__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_930095419__private_IsEnabledFallback ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|Feature_930095419__private_IsEnabledFallback| |fullname|Feature_930095419__private_IsEnabledFallback| |refcount|2| |length|14| |called|wil_details_IsEnabledFallback| |calling|Feature_930095419__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1c0001584| |sig|undefined __fastcall Feature_930095419__private_IsEnabledFallback(undefined4 * param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_930095419__private_IsEnabledFallback +++ Feature_930095419__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_930095419__private_IsEnabledFallback(undefined4 *param_1,uint param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2); + return; +} + ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2| |length|733| |called|| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|4| |address|1c0001784| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, uint param_3, uint param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -0,0 +1,172 @@ + +uint * wil_details_FeatureReporting_RecordUsageInCache + (uint *param_1,uint *param_2,uint param_3,uint param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint uVar5; + bool bVar6; + + param_1[0] = 0; + param_1[1] = 0; + param_1[2] = 0; + param_1[3] = 0; + param_1[4] = 0; + param_1[5] = 0; + if (param_3 == 0) { +LAB_1c000197e: + uVar4 = *param_2; + do { + uVar3 = uVar4; + param_1[1] = 0; + uVar2 = uVar3 | 1; + if ((uVar3 >> 0xe & 1) != (uint)(param_3 == 4)) { + uVar4 = uVar3 >> 5 & 0x1ff; + if (uVar4 != 0) { + param_1[1] = uVar4; + param_1[2] = ~-(uint)(param_3 != 0) & 4; + uVar2 = uVar3 & 0xffffc01f | 1; + } + uVar4 = 0; + if (param_3 == 4) { + uVar4 = 0x4000; + } + uVar2 = uVar4 | uVar2 & 0xffffbfff; + } + uVar4 = uVar2 >> 5 & 0x1ff; + uVar5 = uVar4 + 1; + if ((0x1ff < uVar5) || (uVar5 < uVar4)) { + param_1[2] = param_3; + param_1[1] = uVar4; + uVar5 = 1; + } + LOCK(); + uVar4 = *param_2; + bVar6 = uVar3 == uVar4; + if (bVar6) { + *param_2 = (uVar5 << 5 ^ uVar2) & 0x3fe0 ^ uVar2; + uVar4 = uVar3; + } + UNLOCK(); + } while (!bVar6); + *param_1 = ~uVar3 & 1; + } + else { + if (param_3 != 1) { + if ((param_3 == 2) || (param_3 == 3)) { +LAB_1c0001850: + uVar4 = 0; + if (param_3 == 2) { + uVar4 = 2; + } + else if (param_3 == 3) { + uVar4 = 8; + } + else if (param_3 == 6) { + uVar4 = 4; + } + else if (param_3 == 7) { + uVar4 = 0x10; + } + uVar3 = 1; + uVar2 = *param_2; + do { + uVar1 = uVar2; + uVar2 = uVar4 | uVar1; + param_1[4] = (uint)(uVar2 == uVar1); + uVar5 = uVar2 | 1; + if (uVar2 == uVar1) { + uVar5 = uVar2; + } + LOCK(); + uVar2 = *param_2; + bVar6 = uVar1 == uVar2; + if (bVar6) { + *param_2 = uVar5; + uVar2 = uVar1; + } + UNLOCK(); + } while (!bVar6); + if (((uVar5 & 1) == 0) || ((uVar1 & 1) != 0)) { + uVar3 = 0; + } + *param_1 = uVar3; + return param_1; + } + if (param_3 == 4) goto LAB_1c000197e; + if (param_3 != 5) { + if ((param_3 != 6) && (param_3 != 7)) { + uVar4 = param_3 - 0x140; + if ((int)uVar4 < 0x40) { + uVar2 = param_2[1]; + do { + if (((uVar2 & 0x10) == 0) || (uVar3 = 1, (uVar2 >> 5 & 0x3f) != uVar4)) { + uVar3 = 0; + } + param_1[4] = uVar3; + LOCK(); + uVar3 = param_2[1]; + bVar6 = uVar2 == uVar3; + if (bVar6) { + param_2[1] = (uVar4 * 0x20 ^ uVar2) & 0x7e0 ^ uVar2 | 0x10; + uVar3 = uVar2; + } + uVar2 = uVar3; + UNLOCK(); + } while (!bVar6); + } + param_1[2] = param_3; + param_1[1] = 1; + param_1[3] = param_4; + return param_1; + } + goto LAB_1c0001850; + } + } + uVar4 = *param_2; + do { + uVar3 = uVar4; + param_1[1] = 0; + uVar2 = uVar3 | 1; + if ((uVar3 & 0x400000) >> 0x16 != (uint)(param_3 == 5)) { + uVar4 = (uVar3 & 0x3f8000) >> 0xf; + if (uVar4 != 0) { + param_1[1] = uVar4; + uVar4 = 5; + if (param_3 != 1) { + uVar4 = 1; + } + uVar2 = uVar3 & 0xffc07fff | 1; + param_1[2] = uVar4; + } + uVar4 = 0; + if (param_3 == 5) { + uVar4 = 0x400000; + } + uVar2 = uVar4 | uVar2 & 0xffbfffff; + } + uVar4 = uVar2 >> 0xf & 0x7f; + uVar5 = uVar4 + 1; + if ((0x7f < uVar5) || (uVar5 < uVar4)) { + uVar5 = 1; + param_1[2] = param_3; + param_1[1] = uVar4; + } + LOCK(); + uVar4 = *param_2; + bVar6 = uVar3 == uVar4; + if (bVar6) { + *param_2 = (uVar5 << 0xf ^ uVar2) & 0x3f8000 ^ uVar2; + uVar4 = uVar3; + } + UNLOCK(); + } while (!bVar6); + *param_1 = ~uVar3 & 1; + } + param_1[4] = 0; + return param_1; +} + ``` ## wil_details_FeatureReporting_ReportUsageToService ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService| |refcount|2| |length|275| |called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect| |calling|wil_details_IsEnabledFallback| |paramcount|3| |address|1c0001a68| |sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, ulonglong param_2, uint param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -0,0 +1,66 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +void wil_details_FeatureReporting_ReportUsageToService + (undefined8 param_1,ulonglong param_2,uint param_3) + +{ + bool bVar1; + undefined7 extraout_var; + uint uVar2; + uint uVar4; + byte bVar5; + uint local_res18 [4]; + ulonglong uVar3; + + uVar4 = (uint)param_2 & 1; + uVar3 = (ulonglong)param_3; + if (param_3 != 0) { + if (param_3 == 1) { + uVar2 = (uVar4 ^ 1) << 2; + uVar3 = 0; + goto LAB_1c0001b2b; + } + if (param_3 == 2) { + uVar2 = (uVar4 ^ 1) * 4 + 1; + uVar3 = 0; + goto LAB_1c0001b2b; + } + if (param_3 == 3) { + uVar2 = (uVar4 ^ 1) * 4 + 2; + uVar3 = 0; + goto LAB_1c0001b2b; + } + if (param_3 == 4) { + uVar2 = (uVar4 ^ 1) * 4 + 3; + uVar3 = 0; + goto LAB_1c0001b2b; + } + uVar2 = param_3 - 5; + uVar3 = (ulonglong)uVar2; + if (uVar2 == 0) { + uVar2 = (uVar4 ^ 1) * 2 + 8; + goto LAB_1c0001b2b; + } + if (uVar2 == 1) { + uVar2 = (uVar4 ^ 1) * 2 + 9; + goto LAB_1c0001b2b; + } + bVar5 = (char)param_3 + 0x9c; + if (bVar5 < 0x32) { + uVar2 = (-(uint)((param_2 & 1) != 0) & 0xffffffce) + 0x96 + (uint)bVar5; + goto LAB_1c0001b2b; + } + } + uVar2 = 0xff; +LAB_1c0001b2b: + local_res18[0] = param_3; + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,uVar2); + if (((int)CONCAT71(extraout_var,bVar1) != 0) && + (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { + (*g_wil_details_pfnFeatureLoggingHook) + (0x3548293,&Feature_930095419_logged_traits,0,uVar4,local_res18,0,0,1); + } + return; +} + ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2| |length|226| |called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3| |address|1c0001b84| |sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, uint param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -0,0 +1,46 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +bool wil_details_FeatureReporting_ReportUsageToServiceDirect + (undefined8 param_1,undefined8 param_2,uint param_3) + +{ + uint6 uVar1; + uint *puVar2; + undefined1 auStack_88 [32]; + uint *local_68; + undefined8 local_58; + uint local_50 [6]; + uint local_38; + uint uStack_34; + uint uStack_30; + uint uStack_2c; + undefined8 local_28; + ulonglong local_20; + + local_20 = __security_cookie ^ (ulonglong)auStack_88; + puVar2 = wil_details_FeatureReporting_RecordUsageInCache + (local_50,&Feature_930095419__private_reporting,param_3, + (uint)((ulonglong)param_2 >> 0x20)); + local_38 = *puVar2; + uStack_34 = puVar2[1]; + uStack_30 = puVar2[2]; + uStack_2c = puVar2[3]; + local_28 = *(undefined8 *)(puVar2 + 4); + if (g_wil_details_recordFeatureUsage != (code *)0x0) { + local_68 = &local_38; + (*g_wil_details_recordFeatureUsage)(0x3548293,param_3,1,&Feature_930095419__private_reporting); + } + if ((((uint)param_2 >> 10 & 1) != 0) && (param_3 != 0xfe)) { + local_58._0_6_ = CONCAT24((short)param_3,0x3548293); + uVar1 = (uint6)local_58; + local_58 = (ulonglong)(uint6)local_58; + if (((uint)param_2 >> 0xb & 1) != 0) { + local_58 = CONCAT26(1,uVar1); + } + RtlNotifyFeatureUsage(&local_58); + } + return (int)local_28 == 0; +} + ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3| |length|612| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_IsEnabledFallback| |paramcount|3| |address|1c0001c70| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -0,0 +1,151 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (uint *param_1,ulonglong param_2,longlong param_3) + +{ + undefined8 *puVar1; + int iVar2; + int iVar3; + uint uVar4; + uint uVar5; + uint uVar6; + ulonglong uVar7; + uint uVar8; + uint uVar9; + ulonglong uVar10; + longlong *plVar11; + uint uVar12; + bool bVar13; + undefined1 auStack_a8 [32]; + undefined8 local_88; + ulonglong local_80; + undefined8 local_78; + undefined8 local_70; + undefined8 uStack_68; + undefined8 local_60; + undefined8 local_58; + undefined4 local_50; + ulonglong local_48; + + local_48 = __security_cookie ^ (ulonglong)auStack_a8; + iVar2 = 0; + local_88 = param_2; + if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) { + iVar2 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); + } + local_70 = 0; + uStack_68 = 0; + uVar12 = 1; + local_78 = 0; + uVar5 = 0; + local_60 = 0; + local_58 = 0; + local_50 = 0; + iVar3 = RtlQueryFeatureConfiguration + (*(undefined4 *)(param_3 + 0x18),1 < (byte)(*(char *)(param_3 + 0x1c) - 2U), + &local_78,&local_58); + if (iVar3 == 0) { + uVar8 = local_58._4_4_ >> 7 & 1; + local_70 = CONCAT44(local_70._4_4_,local_58._4_4_ >> 4) & 0xffffffff00000003; + uVar4 = local_58._4_4_ >> 6 & 1; + uVar5 = uVar12; + uVar6 = local_58._4_4_ >> 4 & 3; +LAB_1c0001d23: + uVar8 = uVar8 << 10; + if (uVar4 != 0) { + uVar4 = 0x800; + goto LAB_1c0001d51; + } + } + else { + uVar8 = 0; + uVar4 = 0; + uVar6 = (uint)local_70; + if (iVar3 != 0x117) goto LAB_1c0001d23; + uVar8 = (local_58._4_4_ >> 7 & 1) << 10; + uVar5 = uVar12; + } + uVar4 = 0; +LAB_1c0001d51: + uVar5 = -(uint)(uVar5 != 0) & uVar6 & 3; + if (uVar5 == 0) { + uVar9 = -(uint)(*(char *)(param_3 + 0x1f) != '\0') & 0x40; + } + else { + uVar9 = 0; + if (uVar6 == 2) { + uVar9 = 0x40; + } + } + uVar5 = uVar9 >> 6 ^ (uVar9 | uVar5 << 7 | uVar8 | uVar4); + if ((uVar9 != 0) && (plVar11 = *(longlong **)(param_3 + 0x20), plVar11 != (longlong *)0x0)) { + do { + puVar1 = (undefined8 *)*plVar11; + if (puVar1 == (undefined8 *)0x0) break; + if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') && + (*(char *)((longlong)puVar1 + 0x1d) == '\0')) { + uVar4 = *(uint *)*puVar1; + local_80 = (ulonglong)uVar4; + if ((uVar4 & 2) == 0) { + uVar7 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*puVar1,local_80,(longlong)puVar1); + uVar4 = (uint)uVar7; + } + uVar6 = uVar5 & 0xfffffffe; + uVar5 = (uint)(((byte)uVar4 & (byte)uVar5 & 1) != 0); + } + else { + if (((uVar5 & 1) == 0) || (uVar6 = uVar12, *(char *)((longlong)puVar1 + 0x1f) == '\0')) { + uVar6 = 0; + } + uVar5 = uVar5 & 0xfffffffe; + } + uVar5 = uVar5 | uVar6; + plVar11 = plVar11 + 1; + } while ((uVar5 & 1) != 0); + } + if (*(char *)(param_3 + 0x1c) == '\0') { + uVar12 = -(uint)(iVar2 != 0) & 1; + } + uVar7 = param_2 & 0xffffffff; + do { + uVar10 = param_2; + uVar6 = (uint)uVar7; + local_88 = CONCAT44(local_88._4_4_,uVar6); + if ((uVar12 != 0) && (local_88 = CONCAT44(local_88._4_4_,uVar6), (uVar7 & 2) == 0)) { + uVar4 = (uVar5 ^ uVar6) & 0x9c1 ^ uVar6; + uVar6 = uVar4 | 2; + local_88 = CONCAT44(local_88._4_4_,uVar4) | 2; + } + if ((uVar10 & 4) == 0) { + uVar4 = (uVar6 ^ uVar5) & 0x400 ^ uVar6; + uVar6 = uVar4 | 4; + local_88 = CONCAT44(local_88._4_4_,uVar4) | 4; + } + uVar7 = uVar10 & 0xffffffff; + LOCK(); + uVar4 = *param_1; + bVar13 = (uint)uVar10 == uVar4; + if (bVar13) { + *param_1 = uVar6; + } + else { + uVar7 = (ulonglong)uVar4; + } + UNLOCK(); + param_2 = uVar7; + } while (!bVar13); + if (((uVar10 & 4) == 0) && + (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) { + (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) + (param_1,*(undefined1 *)(param_3 + 0x1c),iVar2); + } + if (uVar12 == 0) { + local_88 = CONCAT44(local_88._4_4_,(uVar5 ^ uVar6) & 0x9c1 ^ uVar6); + } + return local_88; +} + ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|2| |length|76| |called|| |calling|wil_details_IsEnabledFallback| |paramcount|2| |address|1c0001edc| |sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -0,0 +1,41 @@ + +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + bool bVar4; + + if (param_2 == 3) { + uVar3 = 0x10; + } + else { + if (param_2 != 4) { + return; + } + uVar3 = 0x20; + } + if ((Feature_930095419__private_featureState & 2) != 0) { + uVar2 = Feature_930095419__private_featureState; + while ((uVar2 & 1) == (param_1 & 1)) { + LOCK(); + bVar4 = uVar2 == Feature_930095419__private_featureState; + uVar1 = uVar3 | uVar2; + if (!bVar4) { + uVar2 = Feature_930095419__private_featureState; + uVar1 = Feature_930095419__private_featureState; + } + Feature_930095419__private_featureState = uVar1; + UNLOCK(); + if (bVar4) { + return; + } + if ((uVar2 & 2) == 0) { + return; + } + } + } + return; +} + ``` ## wil_details_IsEnabledFallback ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback| |refcount|2| |length|135| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |calling|Feature_930095419__private_IsEnabledFallback| |paramcount|2| |address|1c0001f30| |sig|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -0,0 +1,26 @@ + +uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) + +{ + uint uVar1; + undefined4 *puVar2; + ulonglong local_res18; + + uVar1 = (uint)param_1; + local_res18 = (ulonglong)param_1 & 0xffffffff; + if (((ulonglong)param_1 & 2) == 0) { + puVar2 = &Feature_930095419__private_featureState; + local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (&Feature_930095419__private_featureState,(ulonglong)param_1,0x1c0023cc8 + ); + param_1 = puVar2; + uVar1 = (uint)local_res18; + } + if ((param_2 != 0) && + (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), + param_2 - 3 < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); + } + return uVar1 & 1; +} + ``` ## wil_details_RecordCachedUsage ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_RecordCachedUsage| |fullname|wil_details_RecordCachedUsage| |refcount|2| |length|331| |called|NTOSKRNL.EXE::RtlRecordFeatureUsage
__security_check_cookie| |calling|wil_details_OnFeatureUsageProviderFlushNotification| |paramcount|2| |address|1c000a644| |sig|undefined __fastcall wil_details_RecordCachedUsage(undefined4 param_1, uint * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RecordCachedUsage +++ wil_details_RecordCachedUsage @@ -0,0 +1,90 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void wil_details_RecordCachedUsage(undefined4 param_1,uint *param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + undefined4 *puVar5; + longlong lVar6; + bool bVar7; + undefined1 auStack_68 [32]; + undefined4 local_48; + short local_44 [2]; + undefined4 local_40 [10]; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_68; + uVar2 = *param_2; + do { + LOCK(); + uVar4 = *param_2; + bVar7 = uVar2 == uVar4; + if (bVar7) { + *param_2 = uVar2 & 0xffc0401e; + uVar4 = uVar2; + } + uVar2 = uVar4; + UNLOCK(); + } while (!bVar7); + uVar3 = uVar2 >> 1 & 0xf; + uVar4 = 0; + if (uVar3 != 0) { + uVar4 = param_2[1]; + do { + LOCK(); + uVar1 = param_2[1]; + bVar7 = uVar4 == uVar1; + if (bVar7) { + param_2[1] = uVar4 | uVar3; + uVar1 = uVar4; + } + uVar4 = uVar1; + UNLOCK(); + } while (!bVar7); + uVar4 = uVar3 & ~uVar4; + } + puVar5 = &local_48; + if ((uVar4 & 1) != 0) { + puVar5 = local_40; + local_44[0] = 2; + local_44[1] = 1; + local_48 = param_1; + } + if ((uVar4 & 2) != 0) { + *puVar5 = param_1; + puVar5[1] = 0x10006; + puVar5 = puVar5 + 2; + } + if ((uVar4 & 4) != 0) { + *puVar5 = param_1; + puVar5[1] = 0x10003; + puVar5 = puVar5 + 2; + } + if (7 < uVar4) { + *puVar5 = param_1; + puVar5[1] = 0x10007; + puVar5 = puVar5 + 2; + } + if ((uVar2 >> 5 & 0x1ff) != 0) { + *puVar5 = param_1; + *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 5) & 0x1ff; + *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0xe) & 1) << 2; + puVar5 = puVar5 + 2; + } + if ((uVar2 >> 0xf & 0x7f) != 0) { + *puVar5 = param_1; + *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 0xf) & 0x7f; + *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0x16) & 1) * 4 + 1; + puVar5 = puVar5 + 2; + } + lVar6 = (longlong)puVar5 - (longlong)&local_48 >> 3; + if (0 < lVar6) { + RtlRecordFeatureUsage(&local_48,lVar6); + } + return; +} + ``` ## wil_details_RecordFeatureUsageReporting ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_RecordFeatureUsageReporting| |fullname|wil_details_RecordFeatureUsageReporting| |refcount|3| |length|125| |called|NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification
NTOSKRNL.EXE::RtlRecordFeatureUsage| |calling|| |paramcount|1| |address|1c000a7a0| |sig|undefined __fastcall wil_details_RecordFeatureUsageReporting(undefined4 param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RecordFeatureUsageReporting +++ wil_details_RecordFeatureUsageReporting @@ -0,0 +1,29 @@ + +void wil_details_RecordFeatureUsageReporting(undefined4 param_1) + +{ + int *piVar1; + int iVar2; + undefined4 in_stack_00000028; + undefined2 in_stack_0000002c; + undefined2 in_stack_0000002e; + + iVar2 = g_wil_details_featureUsageCached; + piVar1 = (int *)CONCAT26(in_stack_0000002e,CONCAT24(in_stack_0000002c,in_stack_00000028)); + if (*piVar1 != 0) { + LOCK(); + g_wil_details_featureUsageCached = 1; + UNLOCK(); + if ((iVar2 == 0) && (g_wil_details_featureUsageProvider != 0)) { + RtlArmFeatureUsageProviderFlushNotification(g_wil_details_featureUsageProvider,1); + } + } + if (piVar1[1] != 0) { + in_stack_0000002c = (undefined2)piVar1[2]; + in_stack_0000002e = (undefined2)piVar1[1]; + in_stack_00000028 = param_1; + RtlRecordFeatureUsage(&stack0x00000028,1); + } + return; +} + ``` ## wil_details_EvaluateFeatureDependencies ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies| |fullname|wil_details_EvaluateFeatureDependencies| |refcount|3| |length|232| |called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |calling|wil_InitializeFeatureStaging
wil_details_ReevaluateOnFeatureConfigurationChange| |paramcount|0| |address|1c003f118| |sig|undefined __fastcall wil_details_EvaluateFeatureDependencies(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_EvaluateFeatureDependencies +++ wil_details_EvaluateFeatureDependencies @@ -0,0 +1,64 @@ + +void wil_details_EvaluateFeatureDependencies(void) + +{ + uint uVar1; + undefined **ppuVar2; + undefined **ppuVar3; + undefined *puVar4; + bool bVar5; + + puVar4 = (undefined *)0x0; + ppuVar3 = &wil_details_featureDescriptors_a; + ppuVar2 = &wil_details_featureDescriptors_a; + do { + if (*ppuVar2 != (undefined *)0x0) goto joined_r0x0001c003f153; + ppuVar2 = ppuVar2 + 1; + } while (ppuVar2 < &wil_details_featureDescriptors_z); +LAB_1c003f1cd: + while( true ) { + if (&UNK_1c0023cff < ppuVar3) { + return; + } + if (*ppuVar3 != (undefined *)0x0) break; + ppuVar3 = ppuVar3 + 1; + } + do { + if (ppuVar3 == (undefined **)0x0) { + return; + } + wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + ((uint *)*ppuVar3,(longlong)ppuVar3); + ppuVar3 = ppuVar3 + 7; + while( true ) { + if (&UNK_1c0023cff < ppuVar3) { + return; + } + if (*ppuVar3 != puVar4) break; + ppuVar3 = ppuVar3 + 1; + } + } while( true ); +joined_r0x0001c003f153: + while (ppuVar2 != (undefined **)0x0) { + uVar1 = *(uint *)*ppuVar2; + if ((uVar1 >> 9 & 1) != 0) { + if ((uVar1 & 0x180) == 0) { + bVar5 = *(char *)((longlong)ppuVar2 + 0x1f) != '\0'; + } + else { + bVar5 = (uVar1 & 0x180) == 0x100; + } + LOCK(); + *(uint *)*ppuVar2 = *(uint *)*ppuVar2 ^ uVar1 & 0x40 ^ (uint)bVar5 << 6; + UNLOCK(); + } + ppuVar2 = ppuVar2 + 7; + while( true ) { + if (&UNK_1c0023cff < ppuVar2) goto LAB_1c003f1cd; + if (*ppuVar2 != (undefined *)0x0) break; + ppuVar2 = ppuVar2 + 1; + } + } + goto LAB_1c003f1cd; +} + ``` ## wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |fullname|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |refcount|3| |length|215| |called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |calling|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |paramcount|2| |address|1c003f208| |sig|uint __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState @@ -0,0 +1,63 @@ + +uint wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + (uint *param_1,longlong param_2) + +{ + uint uVar1; + undefined8 *puVar2; + uint uVar3; + uint uVar4; + longlong *plVar5; + uint uVar6; + bool bVar7; + + uVar6 = *param_1; + uVar3 = uVar6; + if ((uVar6 >> 9 & 1) != 0) { + uVar4 = uVar6 >> 6 & 1; + if ((uVar4 != 0) && (plVar5 = *(longlong **)(param_2 + 0x20), plVar5 != (longlong *)0x0)) { + do { + while( true ) { + puVar2 = (undefined8 *)*plVar5; + if (puVar2 == (undefined8 *)0x0) goto LAB_1c003f2a0; + if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && + (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; + if ((uVar4 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { + uVar4 = 0; + goto LAB_1c003f2a0; + } + uVar4 = 1; + plVar5 = plVar5 + 1; + } + uVar3 = wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + ((uint *)*puVar2,(longlong)puVar2); + if ((uVar4 == 0) || ((uVar3 & 1) == 0)) { + uVar4 = 0; + } + else { + uVar4 = 1; + } + plVar5 = plVar5 + 1; + } while (uVar4 != 0); + } +LAB_1c003f2a0: + do { + uVar3 = uVar6 & 0xffffffce; + if ((uVar6 & 1) == uVar4) { + uVar3 = uVar6 & 0xfffffffe; + } + uVar3 = uVar3 & 0xfffffdff | uVar4; + LOCK(); + uVar1 = *param_1; + bVar7 = uVar6 == uVar1; + if (bVar7) { + *param_1 = uVar3; + uVar1 = uVar6; + } + uVar6 = uVar1; + UNLOCK(); + } while (!bVar7); + } + return uVar3; +} + ``` ## wil_details_OnFeatureUsageProviderFlushNotification ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_OnFeatureUsageProviderFlushNotification| |fullname|wil_details_OnFeatureUsageProviderFlushNotification| |refcount|3| |length|121| |called|wil_details_RecordCachedUsage| |calling|| |paramcount|1| |address|1c003f2f0| |sig|undefined __fastcall wil_details_OnFeatureUsageProviderFlushNotification(int param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_OnFeatureUsageProviderFlushNotification +++ wil_details_OnFeatureUsageProviderFlushNotification @@ -0,0 +1,39 @@ + +void wil_details_OnFeatureUsageProviderFlushNotification(int param_1) + +{ + int iVar1; + undefined **ppuVar2; + + iVar1 = g_wil_details_featureUsageCached; + if (param_1 == 1) { + LOCK(); + g_wil_details_featureUsageCached = 0; + UNLOCK(); + if (iVar1 != 0) { + for (ppuVar2 = &wil_details_featureDescriptors_a; ppuVar2 < &wil_details_featureDescriptors_z; + ppuVar2 = ppuVar2 + 1) { + if (*ppuVar2 != (undefined *)0x0) { + do { + if (ppuVar2 == (undefined **)0x0) { + return; + } + if ((*(uint *)ppuVar2[1] & 1) != 0) { + wil_details_RecordCachedUsage(*(undefined4 *)(ppuVar2 + 3),(uint *)ppuVar2[1]); + } + ppuVar2 = ppuVar2 + 7; + while( true ) { + if (&UNK_1c0023cff < ppuVar2) { + return; + } + if (*ppuVar2 != (undefined *)0x0) break; + ppuVar2 = ppuVar2 + 1; + } + } while( true ); + } + } + } + } + return; +} + ``` ## wil_details_ReevaluateOnFeatureConfigurationChange ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_ReevaluateOnFeatureConfigurationChange| |fullname|wil_details_ReevaluateOnFeatureConfigurationChange| |refcount|3| |length|291| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
wil_details_EvaluateFeatureDependencies| |calling|| |paramcount|0| |address|1c003f370| |sig|undefined __fastcall wil_details_ReevaluateOnFeatureConfigurationChange(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_ReevaluateOnFeatureConfigurationChange +++ wil_details_ReevaluateOnFeatureConfigurationChange @@ -0,0 +1,59 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void wil_details_ReevaluateOnFeatureConfigurationChange(void) + +{ + int iVar1; + uint uVar2; + undefined **ppuVar3; + undefined1 auStack_48 [32]; + undefined8 local_28; + undefined8 local_20; + undefined4 local_18; + ulonglong local_10; + + local_10 = __security_cookie ^ (ulonglong)auStack_48; + for (ppuVar3 = &wil_details_featureDescriptors_a; ppuVar3 < &wil_details_featureDescriptors_z; + ppuVar3 = ppuVar3 + 1) { + if (*ppuVar3 != (undefined *)0x0) goto LAB_1c003f46d; + } +LAB_1c003f476: + wil_details_EvaluateFeatureDependencies(); + return; +LAB_1c003f46d: + if (ppuVar3 == (undefined **)0x0) goto LAB_1c003f476; + if (((*(char *)((longlong)ppuVar3 + 0x1d) == '\0') && + (*(char *)((longlong)ppuVar3 + 0x1e) == '\0')) && + (*(char *)((longlong)ppuVar3 + 0x1c) == '\0')) { + local_28 = 0; + local_20 = 0; + local_18 = 0; + iVar1 = RtlQueryFeatureConfiguration(*(undefined4 *)(ppuVar3 + 3),1,&local_28,&local_20); + if ((iVar1 == -0x7fffffde) || (iVar1 == -0x3ffffddb)) { +LAB_1c003f43e: + uVar2 = 0x206; + } + else { + if (iVar1 == 0) { + uVar2 = (local_20._4_4_ & 0x40) << 2 | local_20._4_4_ & 0xb0; + } + else { + if (iVar1 != 0x117) goto LAB_1c003f43e; + uVar2 = local_20._4_4_ & 0x80; + } + uVar2 = uVar2 << 3 | 0x206; + } + LOCK(); + *(uint *)*ppuVar3 = *(uint *)*ppuVar3 ^ (*(uint *)*ppuVar3 ^ uVar2) & 0xf80; + UNLOCK(); + } + ppuVar3 = ppuVar3 + 7; + while( true ) { + if (&UNK_1c0023cff < ppuVar3) goto LAB_1c003f476; + if (*ppuVar3 != (undefined *)0x0) break; + ppuVar3 = ppuVar3 + 1; + } + goto LAB_1c003f46d; +} + ``` ## wil_InitializeFeatureStaging ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_InitializeFeatureStaging| |fullname|wil_InitializeFeatureStaging| |refcount|2| |length|266| |called|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider
wil_details_EvaluateFeatureDependencies
wil_details_PopulateInitialConfiguredFeatureStates| |calling|DriverEntry| |paramcount|0| |address|1c0065d24| |sig|int __fastcall wil_InitializeFeatureStaging(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_InitializeFeatureStaging +++ wil_InitializeFeatureStaging @@ -0,0 +1,59 @@ + +int wil_InitializeFeatureStaging(void) + +{ + bool bVar1; + int iVar2; + undefined **ppuVar3; + undefined8 local_res8; + + bVar1 = false; + if (g_wil_details_isFeatureStagingInitialized == 0) { + g_wil_details_isFeatureStagingInitialized = 1; + local_res8 = RtlQueryFeatureConfigurationChangeStamp(); + wil_details_PopulateInitialConfiguredFeatureStates(); + wil_details_EvaluateFeatureDependencies(); + for (ppuVar3 = &wil_details_featureDescriptors_a; ppuVar3 < &wil_details_featureDescriptors_z; + ppuVar3 = ppuVar3 + 1) { + if (*ppuVar3 != (undefined *)0x0) goto LAB_1c0065dab; + } +LAB_1c0065de5: + g_wil_details_recordFeatureUsage = wil_details_RecordFeatureUsageReporting; + iVar2 = RtlRegisterFeatureUsageProvider + (wil_details_OnFeatureUsageProviderFlushNotification,0, + &g_wil_details_featureUsageProvider); + if (iVar2 != 0) { + if (!bVar1) { + g_wil_details_featureUsageProvider = 0; + return iVar2; + } + g_wil_details_featureUsageProvider = 0; + return 0; + } + } + return 0; +LAB_1c0065dab: + if (ppuVar3 == (undefined **)0x0) goto LAB_1c0065de5; + if (((*(char *)((longlong)ppuVar3 + 0x1d) == '\0') && + (*(char *)((longlong)ppuVar3 + 0x1e) == '\0')) && + (*(char *)((longlong)ppuVar3 + 0x1c) == '\0')) { + iVar2 = RtlRegisterFeatureConfigurationChangeNotification + (wil_details_ReevaluateOnFeatureConfigurationChange,0,&local_res8, + &g_wil_details_featureChangeNotification); + if (iVar2 == 0) { + bVar1 = true; + } + else { + g_wil_details_featureChangeNotification = 0; + } + goto LAB_1c0065de5; + } + ppuVar3 = ppuVar3 + 7; + while( true ) { + if (&UNK_1c0023cff < ppuVar3) goto LAB_1c0065de5; + if (*ppuVar3 != (undefined *)0x0) break; + ppuVar3 = ppuVar3 + 1; + } + goto LAB_1c0065dab; +} + ``` ## wil_details_PopulateInitialConfiguredFeatureStates ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|wil_details_PopulateInitialConfiguredFeatureStates| |fullname|wil_details_PopulateInitialConfiguredFeatureStates| |refcount|2| |length|370| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|1c0065e38| |sig|undefined __fastcall wil_details_PopulateInitialConfiguredFeatureStates(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_PopulateInitialConfiguredFeatureStates +++ wil_details_PopulateInitialConfiguredFeatureStates @@ -0,0 +1,80 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void wil_details_PopulateInitialConfiguredFeatureStates(void) + +{ + ulonglong *puVar1; + undefined8 *puVar2; + int iVar3; + undefined **ppuVar4; + undefined1 auStack_48 [32]; + ulonglong local_28; + undefined8 local_20; + uint uStack_1c; + undefined4 local_18; + ulonglong local_10; + + local_10 = __security_cookie ^ (ulonglong)auStack_48; + ppuVar4 = &wil_details_featureDescriptors_a; + while( true ) { + if (&wil_details_featureDescriptors_z <= ppuVar4) { + return; + } + if (*ppuVar4 != (undefined *)0x0) break; + ppuVar4 = ppuVar4 + 1; + } + do { + if (ppuVar4 == (undefined **)0x0) { + return; + } + local_28 = 0; + local_20 = 0; + local_18 = 0; + if ((*(char *)((longlong)ppuVar4 + 0x1d) == '\0') && + (*(char *)((longlong)ppuVar4 + 0x1e) == '\0')) { + iVar3 = RtlQueryFeatureConfiguration + (*(undefined4 *)(ppuVar4 + 3), + 1 < (byte)(*(char *)((longlong)ppuVar4 + 0x1c) - 2U),&local_28, + &stack0xffffffffffffffe0); + if (iVar3 == -0x7fffffde) { + do { + puVar2 = (undefined8 *)*ppuVar4; + ppuVar4 = ppuVar4 + 7; + *puVar2 = 0x206; + while( true ) { + if (&UNK_1c0023cff < ppuVar4) { + return; + } + if (*ppuVar4 != (undefined *)0x0) break; + ppuVar4 = ppuVar4 + 1; + } + } while (ppuVar4 != (undefined **)0x0); + return; + } + if (iVar3 == -0x3ffffddb) goto LAB_1c0065f22; + if (iVar3 == 0) { + local_28 = (ulonglong)(((uStack_1c & 0x40) << 2 | uStack_1c & 0xb0) << 3) | 0x206; + } + else { + if (iVar3 != 0x117) goto LAB_1c0065f22; + local_28 = (ulonglong)((uStack_1c & 0x80) << 3) | 0x206; + } + } + else { +LAB_1c0065f22: + local_28 = 0x206; + } + puVar1 = (ulonglong *)*ppuVar4; + ppuVar4 = ppuVar4 + 7; + *puVar1 = local_28; + while( true ) { + if (&UNK_1c0023cff < ppuVar4) { + return; + } + if (*ppuVar4 != (undefined *)0x0) break; + ppuVar4 = ppuVar4 + 1; + } + } while( true ); +} + ``` ## NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|RtlRegisterFeatureUsageProvider| |fullname|NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider| |refcount|2| |length|0| |called|| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:00000080| |sig|undefined RtlRegisterFeatureUsageProvider(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider* ## NTOSKRNL.EXE::RtlRecordFeatureUsage ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|RtlRecordFeatureUsage| |fullname|NTOSKRNL.EXE::RtlRecordFeatureUsage| |refcount|3| |length|0| |called|| |calling|wil_details_RecordCachedUsage
wil_details_RecordFeatureUsageReporting| |paramcount|0| |address|EXTERNAL:0000007b| |sig|undefined RtlRecordFeatureUsage(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlRecordFeatureUsage* ## NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|RtlUnregisterFeatureConfigurationChangeNotification| |fullname|NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification| |refcount|3| |length|0| |called|| |calling|DriverEntry| |paramcount|0| |address|EXTERNAL:0000007f| |sig|undefined RtlUnregisterFeatureConfigurationChangeNotification(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification* ## NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|RtlRegisterFeatureConfigurationChangeNotification| |fullname|NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification| |refcount|2| |length|0| |called|| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:0000007e| |sig|undefined RtlRegisterFeatureConfigurationChangeNotification(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification* ## NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|RtlUnregisterFeatureUsageProvider| |fullname|NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider| |refcount|3| |length|0| |called|| |calling|DriverEntry| |paramcount|0| |address|EXTERNAL:00000081| |sig|undefined RtlUnregisterFeatureUsageProvider(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider* ## NTOSKRNL.EXE::RtlQueryFeatureConfiguration ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|RtlQueryFeatureConfiguration| |fullname|NTOSKRNL.EXE::RtlQueryFeatureConfiguration| |refcount|4| |length|0| |called|| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_ReevaluateOnFeatureConfigurationChange| |paramcount|0| |address|EXTERNAL:000000fe| |sig|undefined RtlQueryFeatureConfiguration(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlQueryFeatureConfiguration* ## NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|RtlQueryFeatureConfigurationChangeStamp| |fullname|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp| |refcount|2| |length|0| |called|| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:0000007d| |sig|undefined RtlQueryFeatureConfigurationChangeStamp(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp* ## NTOSKRNL.EXE::RtlNotifyFeatureUsage ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|RtlNotifyFeatureUsage| |fullname|NTOSKRNL.EXE::RtlNotifyFeatureUsage| |refcount|2| |length|0| |called|| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|0| |address|EXTERNAL:000000fc| |sig|undefined RtlNotifyFeatureUsage(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlNotifyFeatureUsage* ## NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification ### Function Meta |Key|exfat-03.sys| | :---: | :---: | |name|RtlArmFeatureUsageProviderFlushNotification| |fullname|NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification| |refcount|2| |length|0| |called|| |calling|wil_details_RecordFeatureUsageReporting| |paramcount|0| |address|EXTERNAL:0000007c| |sig|undefined RtlArmFeatureUsageProviderFlushNotification(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification* # Modified *Modified functions contain code changes* ## DriverEntry ### Match Info |Key|exfat-02.sys - exfat-03.sys| | :---: | :---: | |diff_type|code,length,sig,called| |ratio|0.76| |i_ratio|0.25| |m_ratio|0.95| |b_ratio|0.66| |match_types|SymbolsHash| ### Function Meta Diff |Key|exfat-02.sys|exfat-03.sys| | :---: | :---: | :---: | |name|DriverEntry|DriverEntry| |fullname|DriverEntry|DriverEntry| |refcount|2|2| |`length`|2062|2246| |`called`|
Expand for full list:
FppGetCompatibilityModeValue
FppGetFileSystemName
NTOSKRNL.EXE::EtwRegister
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializeNPagedLookasideList
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::FsRtlRegisterFileSystemFilterCallbacks
NTOSKRNL.EXE::InitializeSListHead
NTOSKRNL.EXE::IoAllocateWorkItem
NTOSKRNL.EXE::IoCreateDeviceNTOSKRNL.EXE::IoDeleteDevice
NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::IoRegisterDriverReinitialization
NTOSKRNL.EXE::IoRegisterFileSystem
NTOSKRNL.EXE::KeAllocateCalloutStackEx
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeInitializeSpinLock
NTOSKRNL.EXE::MmGetSystemRoutineAddress
NTOSKRNL.EXE::MmQuerySystemSize
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::PoRegisterCoalescingCallback
NTOSKRNL.EXE::PsIsDiskCountersEnabled
NTOSKRNL.EXE::RtlInitUnicodeString
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
_guard_dispatch_icall
memset
|
Expand for full list:
FppGetCompatibilityModeValue
FppGetFileSystemName
NTOSKRNL.EXE::EtwRegister
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializeNPagedLookasideList
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::FsRtlRegisterFileSystemFilterCallbacks
NTOSKRNL.EXE::InitializeSListHead
NTOSKRNL.EXE::IoAllocateWorkItem
NTOSKRNL.EXE::IoCreateDeviceNTOSKRNL.EXE::IoDeleteDevice
NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::IoRegisterDriverReinitialization
NTOSKRNL.EXE::IoRegisterFileSystem
NTOSKRNL.EXE::KeAllocateCalloutStackEx
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeInitializeSpinLock
NTOSKRNL.EXE::MmGetSystemRoutineAddress
NTOSKRNL.EXE::MmQuerySystemSize
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::PoRegisterCoalescingCallback
NTOSKRNL.EXE::PsIsDiskCountersEnabled
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
_guard_dispatch_icall
memset
wil_InitializeFeatureStaging
| |calling|entry|entry| |paramcount|2|2| |address|1c0065078|1c0065078| |`sig`|ulonglong __fastcall DriverEntry(longlong param_1, ushort * param_2)|int __fastcall DriverEntry(longlong param_1, ushort * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DriverEntry Called Diff ```diff --- DriverEntry called +++ DriverEntry called @@ -25,0 +26,2 @@ +NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification +NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider @@ -28,0 +31 @@ +wil_InitializeFeatureStaging ``` ### DriverEntry Diff ```diff --- DriverEntry +++ DriverEntry @@ -1,201 +1,220 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -ulonglong DriverEntry(longlong param_1,ushort *param_2) +int DriverEntry(longlong param_1,ushort *param_2) { byte bVar1; - uint uVar2; - int iVar3; - ulonglong uVar4; - undefined2 uVar5; + int iVar2; + ulonglong uVar3; + undefined2 uVar4; uint local_res18 [4]; undefined8 in_stack_fffffffffffffed8; + uint uVar5; uint in_stack_fffffffffffffee0; undefined8 local_108; wchar_t *local_100; undefined8 local_f8; wchar_t *local_f0; undefined8 local_e8; wchar_t *local_e0; undefined8 local_d8; wchar_t *local_d0; undefined4 local_c8; undefined4 local_c4; wchar_t *local_c0; undefined8 local_b8; undefined8 uStack_b0; undefined4 local_a8 [2]; code *local_a0; - uVar2 = (uint)((ulonglong)in_stack_fffffffffffffed8 >> 0x20); + uVar5 = (uint)((ulonglong)in_stack_fffffffffffffed8 >> 0x20); local_108 = 0x2a0028; local_f8 = 0x380036; local_100 = L"KeAreAllApcsDisabled"; local_e8 = 0x4a0048; local_f0 = L"KeQueryActiveProcessorCount"; local_d8 = 0x540052; local_e0 = L"MmDoesFileHaveUserWritableReferences"; local_c4 = 0; local_d0 = L"FsRtlAreVolumeStartupApplicationsComplete"; - local_res18[0] = 0; local_b8 = 0; uStack_b0 = 0; + local_res18[0] = 0; + wil_InitializeFeatureStaging(); RtlInitUnicodeString(&local_b8); - uVar4 = IoCreateDevice(param_1,0,&local_b8,8,(ulonglong)uVar2 << 0x20, + iVar2 = IoCreateDevice(param_1,0,&local_b8,8,(ulonglong)uVar5 << 0x20, in_stack_fffffffffffffee0 & 0xffffff00,&FppDiskFileSystemDeviceObject); - if (-1 < (int)uVar4) { + if (-1 < iVar2) { *(code **)(param_1 + 0x70) = FppFsdCreate; *(undefined **)(param_1 + 0x50) = &FppFastIoDispatch; *(code **)(param_1 + 0x80) = FppFsdClose; *(code **)(param_1 + 0x88) = FppFsdRead; *(code **)(param_1 + 0x90) = FppFsdWrite; *(code **)(param_1 + 0x98) = FppFsdQueryInformation; *(code **)(param_1 + 0xa0) = FppFsdSetInformation; *(code **)(param_1 + 0xb8) = FppFsdFlushBuffers; *(code **)(param_1 + 0xc0) = FppFsdQueryVolumeInformation; *(code **)(param_1 + 200) = FppFsdSetVolumeInformation; *(code **)(param_1 + 0x100) = FppFsdCleanup; *(code **)(param_1 + 0xd0) = FppFsdDirectoryControl; *(code **)(param_1 + 0xd8) = FppFsdFileSystemControl; *(code **)(param_1 + 0xf8) = FppFsdLockControl; *(code **)(param_1 + 0xe0) = FppFsdDeviceControl; *(code **)(param_1 + 0xf0) = FppFsdShutdown; *(code **)(param_1 + 0x148) = FppFsdPnp; memset(&FppFastIoDispatch,0,0xe0); _FppFastIoDispatch = 0xe0; _DAT_0 = FppFastIoCheckIfPossible; _DAT_1 = FsRtlCopyRead_exref; _DAT_2 = FsRtlCopyWrite_exref; _DAT_3 = FppFastQueryBasicInfo; _DAT_4 = FppFastQueryStdInfo; _DAT_5 = FppFastLock; _DAT_6 = FppFastUnlockSingle; _DAT_7 = FppFastUnlockAll; _DAT_8 = FppFastUnlockAllByKey; _DAT_9 = FppFastQueryNetworkOpenInfo; _DAT_10 = FppAcquireForCcFlush; _DAT_11 = FppReleaseForCcFlush; _DAT_12 = FsRtlMdlReadDev_exref; _DAT_13 = FsRtlMdlReadCompleteDev_exref; _DAT_14 = FsRtlPrepareMdlWriteDev_exref; _DAT_15 = FsRtlMdlWriteCompleteDev_exref; _DAT_16 = FppAcquireForMappedWrite; _DAT_17 = FppReleaseForForMappedWrite; memset(local_a8,0,0x78); local_a8[0] = 0x78; local_a0 = FppFilterCallbackAcquireForCreateSection; - uVar2 = FsRtlRegisterFileSystemFilterCallbacks(param_1); - uVar4 = (ulonglong)uVar2; - if (-1 < (int)uVar2) { + iVar2 = FsRtlRegisterFileSystemFilterCallbacks(param_1); + if (-1 < iVar2) { memset(&FppData,0,0x228); _FppData = 0x2280d00; - DAT_18 = &DAT_1c0025050; + DAT_18 = &DAT_1c0025090; DAT_19 = &DAT_19; DAT_20 = FppDiskFileSystemDeviceObject; DAT_21 = param_1; DAT_22 = (code *)MmGetSystemRoutineAddress(&local_108); if (DAT_22 == (code *)0x0) { DAT_22 = FppAtApcLevel; } DAT_23 = (code *)MmGetSystemRoutineAddress(&local_f8); DAT_24 = MmGetSystemRoutineAddress(&local_e8); DAT_25 = MmGetSystemRoutineAddress(&local_d8); if (DAT_23 == (code *)0x0) { DAT_26 = (int)(char)*KeNumberProcessors_exref; } else { - DAT_26 = (*DAT_1c0025178)(0); + DAT_26 = (*DAT_1c00251b8)(0); } DAT_27 = DAT_27 | 0x20; local_c0 = L"ExFatEnableEfs"; local_c8 = 0x1e001c; - uVar4 = FppGetCompatibilityModeValue(&local_c8,local_res18); - if (-1 < (int)uVar4) { + uVar3 = FppGetCompatibilityModeValue(&local_c8,local_res18); + if (-1 < (int)uVar3) { if ((local_res18[0] & 1) == 0) { DAT_27 = DAT_27 & 0xdf; } else { DAT_27 = DAT_27 | 0x20; } } - DAT_28 = &DAT_1c00250f0; + DAT_28 = &DAT_1c0025130; DAT_29 = &DAT_29; - DAT_30 = &DAT_1c0025108; + DAT_30 = &DAT_1c0025148; DAT_31 = &DAT_31; DAT_32 = IoAllocateWorkItem(FppDiskFileSystemDeviceObject); if (DAT_32 != 0) { DAT_33 = ExAllocatePoolWithTag(0x600,0x1000); - if (DAT_33 == 0) { - IoFreeWorkItem(DAT_32); - } - else { - uVar5 = 4; - iVar3 = KeAllocateCalloutStackEx(0,4,0,&DAT_34); - if (-1 < iVar3) { + if (DAT_33 != 0) { + uVar4 = 4; + iVar2 = KeAllocateCalloutStackEx(0,4,0,&DAT_34); + if (-1 < iVar2) { KeInitializeEvent(&DAT_35,0,1); KeInitializeSpinLock(&DAT_36); - iVar3 = MmQuerySystemSize(); - if (iVar3 == 0) { + iVar2 = MmQuerySystemSize(); + if (iVar2 == 0) { FppMaxDelayedCloseCount = 0x10; } - else if (iVar3 == 1) { - uVar5 = 8; + else if (iVar2 == 1) { + uVar4 = 8; FppMaxDelayedCloseCount = 0x40; } else { - uVar5 = 0; - if (iVar3 == 2) { - uVar5 = 0x10; + uVar4 = 0; + if (iVar2 == 2) { + uVar4 = 0x10; FppMaxDelayedCloseCount = 0x100; } } _DAT_37 = FppNoOpAcquire; _DAT_38 = FppAcquireFcbForLazyWrite; _DAT_39 = FppReleaseFcbFromLazyWrite; _DAT_40 = FppAcquireFcbForReadAhead; _DAT_41 = FppReleaseFcbFromReadAhead; _DAT_42 = FppNoOpRelease; _DAT_43 = FppNoOpRelease; _DAT_44 = FppNoOpAcquire; DAT_45 = IoGetCurrentProcess(); ExInitializeResourceLite(&DAT_46); ExInitializeNPagedLookasideList - (&FppIrpContextLookasideList,0,0,0x210,0xb0,0x49707046,uVar5); + (&FppIrpContextLookasideList,0,0,0x210,0xb0,0x49707046,uVar4); ExInitializeNPagedLookasideList - (&FppNonPagedFcbLookasideList,0,0,0x210,0x78,0x4e707046,uVar5); + (&FppNonPagedFcbLookasideList,0,0,0x210,0x78,0x4e707046,uVar4); ExInitializeNPagedLookasideList - (&FppEResourceLookasideList,0,0,0x210,0x68,0x45707046,uVar5); + (&FppEResourceLookasideList,0,0,0x210,0x68,0x45707046,uVar4); InitializeSListHead((PSLIST_HEADER)&FppCloseContextSList); _FppCloseQueueMutex = 1; _DAT_47 = 0; _DAT_48 = 0; KeInitializeEvent(&DAT_49,1); KeInitializeEvent(&FppReserveEvent,1,1); IoRegisterFileSystem(FppDiskFileSystemDeviceObject); ObfReferenceObject(FppDiskFileSystemDeviceObject); FppGetFileSystemName(param_2,&DAT_50); bVar1 = PsIsDiskCountersEnabled(); FppDiskAccountingEnabled = (uint)bVar1; PoRegisterCoalescingCallback(FppCoalescingCallback,1,&FppCoalescingRegistration,0); - iVar3 = EtwRegister(&exFATSqmEventProvider,0,0,&DAT_51); - if (iVar3 < 0) { + iVar2 = EtwRegister(&exFATSqmEventProvider,0,0,&DAT_51); + if (iVar2 < 0) { DAT_51 = 0; } memset(&ExfatTelemetryData,0,0x88); TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(0x1c00240c0,0,0); IoRegisterDriverReinitialization(param_1,FppLoadAddOns,0); return 0; } IoFreeWorkItem(DAT_32); ExFreePoolWithTag(DAT_33,0); + IoDeleteDevice(FppDiskFileSystemDeviceObject); + return -0x3fffff66; } - } - uVar4 = 0xc000009a; + IoFreeWorkItem(DAT_32); + } + IoDeleteDevice(FppDiskFileSystemDeviceObject); + if (g_wil_details_featureChangeNotification != 0) { + RtlUnregisterFeatureConfigurationChangeNotification(); + g_wil_details_featureChangeNotification = 0; + } + if (g_wil_details_featureUsageProvider != 0) { + RtlUnregisterFeatureUsageProvider(); + g_wil_details_featureUsageProvider = 0; + } + g_wil_details_isFeatureStagingInitialized = 0; + return -0x3fffff66; } IoDeleteDevice(FppDiskFileSystemDeviceObject); } - return uVar4; + if (g_wil_details_featureChangeNotification != 0) { + RtlUnregisterFeatureConfigurationChangeNotification(); + g_wil_details_featureChangeNotification = 0; + } + if (g_wil_details_featureUsageProvider != 0) { + RtlUnregisterFeatureUsageProvider(); + g_wil_details_featureUsageProvider = 0; + } + g_wil_details_isFeatureStagingInitialized = 0; + return iVar2; } ``` ## FppSetupAllocationSupport ### Match Info |Key|exfat-02.sys - exfat-03.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.55| |i_ratio|0.77| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|exfat-02.sys|exfat-03.sys| | :---: | :---: | :---: | |name|FppSetupAllocationSupport|FppSetupAllocationSupport| |fullname|FppSetupAllocationSupport|FppSetupAllocationSupport| |refcount|5|5| |`length`|591|644| |`called`|FppEvaluateBitmap
FppSelectBestWindow
FppSwitchWindow
NTOSKRNL.EXE::CcInitializeCacheMap
NTOSKRNL.EXE::CcSetAdditionalCacheAttributesEx
NTOSKRNL.EXE::CcSetFileSizes
NTOSKRNL.EXE::CcUnpinData
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::RtlFindClearBits
__security_check_cookie|
Expand for full list:
Feature_930095419__private_IsEnabledDeviceUsageNoInline
FppEvaluateBitmap
FppSelectBestWindow
FppSwitchWindow
NTOSKRNL.EXE::CcInitializeCacheMap
NTOSKRNL.EXE::CcSetAdditionalCacheAttributesEx
NTOSKRNL.EXE::CcSetFileSizes
NTOSKRNL.EXE::CcUnpinData
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::RtlFindClearBits__security_check_cookie
| |calling|FppMountVolume
FppPnpCancelRemove
FppVerifyVolume|FppMountVolume
FppPnpCancelRemove
FppVerifyVolume| |paramcount|2|2| |address|1c002f89c|1c002f89c| |sig|undefined __fastcall FppSetupAllocationSupport(longlong param_1, longlong param_2)|undefined __fastcall FppSetupAllocationSupport(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### FppSetupAllocationSupport Called Diff ```diff --- FppSetupAllocationSupport called +++ FppSetupAllocationSupport called @@ -0,0 +1 @@ +Feature_930095419__private_IsEnabledDeviceUsageNoInline @@ -8,0 +10 @@ +NTOSKRNL.EXE::ExRaiseStatus ``` ### FppSetupAllocationSupport Diff ```diff --- FppSetupAllocationSupport +++ FppSetupAllocationSupport @@ -1,89 +1,97 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void FppSetupAllocationSupport(longlong param_1,longlong param_2) { byte bVar1; - undefined8 uVar2; - int iVar3; - longlong lVar4; + ulonglong uVar2; + undefined8 uVar3; + int iVar4; longlong lVar5; - uint uVar6; - int iVar7; - byte bVar8; + longlong lVar6; + uint uVar7; + int iVar8; + byte bVar9; undefined1 auStackY_88 [32]; longlong local_58; longlong local_50; undefined8 local_48; undefined8 uStack_40; longlong local_38; longlong lStack_30; undefined8 local_28; ulonglong local_20; local_20 = __security_cookie ^ (ulonglong)auStackY_88; local_48 = 0; uStack_40 = 0; local_58 = 0; - lVar4 = *(longlong *)(param_2 + 0x120); - bVar1 = *(byte *)(lVar4 + 0x6c); + lVar5 = *(longlong *)(param_2 + 0x120); + bVar1 = *(byte *)(lVar5 + 0x6c); *(byte *)(param_2 + 0x144) = bVar1; - bVar8 = *(char *)(lVar4 + 0x6c) + *(char *)(lVar4 + 0x6d); - *(byte *)(param_2 + 0x145) = bVar8; - uVar6 = 1 << (*(byte *)(lVar4 + 0x6d) & 0x1f); - iVar7 = uVar6 - *(uint *)(lVar4 + 0x58) % uVar6 << (*(byte *)(lVar4 + 0x6c) & 0x1f); - *(int *)(param_2 + 0x148) = iVar7; - lVar5 = (ulonglong)*(uint *)(lVar4 + 0x58) << (bVar1 & 0x3f); - *(longlong *)(param_2 + 0x130) = lVar5; + bVar9 = *(char *)(lVar5 + 0x6d) + *(char *)(lVar5 + 0x6c); + *(byte *)(param_2 + 0x145) = bVar9; + uVar7 = 1 << (*(byte *)(lVar5 + 0x6d) & 0x1f); + iVar8 = uVar7 - *(uint *)(lVar5 + 0x58) % uVar7 << (*(byte *)(lVar5 + 0x6c) & 0x1f); + *(int *)(param_2 + 0x148) = iVar8; + lVar6 = (ulonglong)*(uint *)(lVar5 + 0x58) << (bVar1 & 0x3f); + *(longlong *)(param_2 + 0x130) = lVar6; *(ulonglong *)(param_2 + 0x128) = - ((ulonglong)*(uint *)(lVar4 + 0x60) - 2 << (bVar8 & 0x3f)) + lVar5; - *(undefined4 *)(param_2 + 0x138) = *(undefined4 *)(lVar4 + 0x5c); + ((ulonglong)*(uint *)(lVar5 + 0x60) - 2 << (bVar9 & 0x3f)) + lVar6; + *(undefined4 *)(param_2 + 0x138) = *(undefined4 *)(lVar5 + 0x5c); *(undefined4 *)(param_2 + 0x13c) = 0; *(undefined4 *)(param_2 + 0x140) = 0x1000; local_38 = (ulonglong) - ((uint)*(byte *)(lVar4 + 0x6e) * *(int *)(lVar4 + 0x54) + *(int *)(lVar4 + 0x50)) << + ((uint)*(byte *)(lVar5 + 0x6e) * *(int *)(lVar5 + 0x54) + *(int *)(lVar5 + 0x50)) << (bVar1 & 0x3f); *(longlong *)(param_2 + 0x150) = local_38; local_28 = 0x7fffffffffffffff; - lVar4 = *(longlong *)(param_2 + 0x2a0); + lVar5 = *(longlong *)(param_2 + 0x2a0); local_50 = param_2; lStack_30 = local_38; - if (*(longlong *)(lVar4 + 0x30) == 0) { + if (*(longlong *)(lVar5 + 0x30) == 0) { CcInitializeCacheMap - (lVar4,&local_38,CONCAT71((uint7)(uint3)((uint)iVar7 >> 8),1),&DAT_0); + (lVar5,&local_38,CONCAT71((uint7)(uint3)((uint)iVar8 >> 8),1),&DAT_0); if (FppDiskAccountingEnabled != 0) { - CcSetAdditionalCacheAttributesEx(lVar4,0x10); + CcSetAdditionalCacheAttributesEx(lVar5,0x10); } } else { - CcSetFileSizes(lVar4,&local_38); + CcSetFileSizes(lVar5,&local_38); } if (*(uint *)(param_2 + 0x138) < 0x10001) { *(undefined4 *)(param_2 + 0xd8) = 1; - uVar6 = 1; + uVar7 = 1; } else { - uVar6 = *(uint *)(param_2 + 0x138) + 0xffff >> 0x10; - *(uint *)(param_2 + 0xd8) = uVar6; + uVar2 = Feature_930095419__private_IsEnabledDeviceUsageNoInline(); + uVar7 = *(uint *)(param_2 + 0x138); + if (((int)uVar2 != 0) && (uVar7 + 0xffff < uVar7)) { + *(undefined4 *)(param_1 + 0x48) = 0xc0000102; + /* WARNING: Subroutine does not return */ + ExRaiseStatus(); + } + uVar7 = uVar7 + 0xffff >> 0x10; + *(uint *)(param_2 + 0xd8) = uVar7; } - uVar2 = ExAllocatePoolWithTag(0x411,uVar6 * 0xc,0x57707046); - *(undefined8 *)(param_2 + 0xe0) = uVar2; + uVar3 = ExAllocatePoolWithTag(0x411,uVar7 * 0xc,0x57707046); + *(undefined8 *)(param_2 + 0xe0) = uVar3; if ((*(longlong *)(param_2 + 0x2c8) != 0) && (*(longlong *)(param_2 + 0x2c0) != 0)) { - lVar4 = param_1; + lVar5 = param_1; FppEvaluateBitmap(param_1,param_2); - uVar6 = FppSelectBestWindow(lVar4,param_2); - FppSwitchWindow(param_1,param_2,uVar6,&local_48,&local_58); - iVar7 = RtlFindClearBits(&local_48,1); - iVar3 = iVar7 + 2; - if (iVar7 == -1) { - iVar3 = 2; + uVar7 = FppSelectBestWindow(lVar5,param_2); + FppSwitchWindow(param_1,param_2,uVar7,&local_48,&local_58); + iVar8 = RtlFindClearBits(&local_48,1); + iVar4 = iVar8 + 2; + if (iVar8 == -1) { + iVar4 = 2; } - *(int *)(param_2 + 0x2d0) = iVar3; + *(int *)(param_2 + 0x2d0) = iVar4; } if (local_58 != 0) { CcUnpinData(); } return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|exfat-02.sys - exfat-03.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|exfat-02.sys|exfat-03.sys| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|33|37| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|1c0013df8|1c0014868| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::IoDeleteDevice ### Match Info |Key|exfat-02.sys - exfat-03.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|exfat-02.sys|exfat-03.sys| | :---: | :---: | :---: | |name|IoDeleteDevice|IoDeleteDevice| |fullname|NTOSKRNL.EXE::IoDeleteDevice|NTOSKRNL.EXE::IoDeleteDevice| |`refcount`|7|9| |length|0|0| |called||| |calling|DriverEntry
FppCheckForDismount
FppCommonShutdown
FppCommonShutdown$fin$0
FppMountVolume
FppMountVolume$fin$1|DriverEntry
FppCheckForDismount
FppCommonShutdown
FppCommonShutdown$fin$0
FppMountVolume
FppMountVolume$fin$1| |paramcount|0|0| |`address`|EXTERNAL:00000081|EXTERNAL:0000008a| |sig|undefined IoDeleteDevice(void)|undefined IoDeleteDevice(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## __security_check_cookie ### Match Info |Key|exfat-02.sys - exfat-03.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|exfat-02.sys|exfat-03.sys| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|59|64| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
DplWrapDeriveKey
DplWrapProtect
EEL_DplStateChange_WriteEvent
EEL_EtwEventHandler
EEL_GetUserSidStringForToken
EEL_PolicyUpdate_WriteEvent
EdpEnforcementLog_AutomaticEncryption
EdpEnforcementLog_FileAccessDenied
EdpEnforcementLog_FileRequiresEncryption
EfsDecryptFekClient
EfsGenerateKeyClientEfsInitFekProtection
EfsOpenFile
EfsReadEfsData
EfsRpcInit
EfspClipSpDecryptFek
EfspConstructNewPfileHeader
EfspFileRequiresEncryption
EfspIsCryptoOffloadTurnedOffByOverride
EfspPostCreate
EfspPostCreatePrepareAndSendFsctl
EfspTraceLogAssert
EfspValidateAndParseFsctl
EnableFlushTimer
FppCheckManageVolumeAccess
FppCommonCreate
FppDeleteEfsAttributeOnDirectory
FppExplicitDeviceAccessGranted
FppFatTimeToNtTime
FppGetCompatibilityModeValue
FppGetFileSystemName
FppInitializeVcb
FppIsBootSectorFatPlusPlus
FppLocateDirent
FppMountVolume
FppNonCachedIo
FppNtTimeToFatTime
FppQueryDirectory
FppScanBadClusters
FppSearchRemainderOfDirectoryForCollisions
FppSetFatRun
FppSetPfileExtensionOnDisk
FppSetRenameInfo
FppSetupAllocationSupport
FppSqmAddToStreamEx
FppSqmVolumeInfo
FppTelemetryMount
FppVerifyVolume
LookUpTableFlushComplete
MD5Final
NtOfsCreateAttributeEx
QueryAttributes
TlgRegisterAggregateProviderEx
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
_tlgWriteTemplate::Write<_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>,_tlgWrapperByRef<16>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>_>
desexpand128to192
rijndaelKeySched
|
Expand for full list:
DplWrapDeriveKey
DplWrapProtect
EEL_DplStateChange_WriteEvent
EEL_EtwEventHandler
EEL_GetUserSidStringForToken
EEL_PolicyUpdate_WriteEvent
EdpEnforcementLog_AutomaticEncryption
EdpEnforcementLog_FileAccessDenied
EdpEnforcementLog_FileRequiresEncryption
EfsDecryptFekClient
EfsGenerateKeyClientEfsInitFekProtection
EfsOpenFile
EfsReadEfsData
EfsRpcInit
EfspClipSpDecryptFek
EfspConstructNewPfileHeader
EfspFileRequiresEncryption
EfspIsCryptoOffloadTurnedOffByOverride
EfspPostCreate
EfspPostCreatePrepareAndSendFsctl
EfspTraceLogAssert
EfspValidateAndParseFsctl
EnableFlushTimer
FppCheckManageVolumeAccess
FppCommonCreate
FppDeleteEfsAttributeOnDirectory
FppExplicitDeviceAccessGranted
FppFatTimeToNtTime
FppGetCompatibilityModeValue
FppGetFileSystemName
FppInitializeVcb
FppIsBootSectorFatPlusPlus
FppLocateDirent
FppMountVolume
FppNonCachedIo
FppNtTimeToFatTime
FppQueryDirectory
FppScanBadClusters
FppSearchRemainderOfDirectoryForCollisions
FppSetFatRun
FppSetPfileExtensionOnDisk
FppSetRenameInfo
FppSetupAllocationSupport
FppSqmAddToStreamEx
FppSqmVolumeInfo
FppTelemetryMount
FppVerifyVolume
LookUpTableFlushComplete
MD5Final
NtOfsCreateAttributeEx
QueryAttributes
TlgRegisterAggregateProviderEx
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
_tlgWriteTemplate::Write<_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>,_tlgWrapperByRef<16>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>_>
desexpand128to192
rijndaelKeySched
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_ReevaluateOnFeatureConfigurationChange
| |paramcount|1|1| |`address`|1c0014000|1c0014a70| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -58,0 +59,5 @@ +wil_details_FeatureReporting_ReportUsageToServiceDirect +wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +wil_details_PopulateInitialConfiguredFeatureStates +wil_details_RecordCachedUsage +wil_details_ReevaluateOnFeatureConfigurationChange ``` ## NTOSKRNL.EXE::ExRaiseStatus ### Match Info |Key|exfat-02.sys - exfat-03.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|exfat-02.sys|exfat-03.sys| | :---: | :---: | :---: | |name|ExRaiseStatus|ExRaiseStatus| |fullname|NTOSKRNL.EXE::ExRaiseStatus|NTOSKRNL.EXE::ExRaiseStatus| |`refcount`|132|133| |length|0|0| |called||| |`calling`|
Expand for full list:
EfsXtsAesDec
EfsXtsAesEnc
FppAllocateDiskSpace
FppCheckFreeDirentBitmap
FppCommonCleanup
FppCommonCreate
FppCommonRead
FppCommonWrite
FppComputeMoveFileSplicePoints
FppCreateBitmapFcb
FppCreateDcbFppCreateFcb
FppCreateIrpContext
FppCreateNewDirectory
FppCreateNewFile
FppCreateNewFileRecord
FppFixFcbChecksum
FppFlushFatEntries
FppForceCacheMiss
FppFreeSecondaryAllocation
FppFsdCreate
FppGetDirtyFileRecordBuffer
FppGetFileRecordFromFcbOrDcb
FppGetStreamRecordFromFcbOrDcb
FppIsDirectoryEmpty
FppLocateDirent
FppLockUserBuffer
FppLookupFileAllocation
FppLookupFileAllocationSize
FppMapUserBuffer
FppMountVolume
FppMoveFile
FppMultipleAsync
FppNonCachedIo
FppNonCachedNonAlignedRead
FppNotifyChangeDirectory
FppOpenExistingDcb
FppOpenExistingDirectory
FppOpenExistingFcb
FppOpenExistingFile
FppPerformVerify
FppPerformVerifyDiskRead
FppPinMappedData
FppPrepareWriteDirectoryFile
FppPrepareWriteVolumeFile
FppQuickVerifyVcb
FppReadBitmapFile
FppReadDirectoryFile
FppReadVolumeFile
FppScanBadClusters
FppSetEndOfFileInfo
FppSetFullNameInFcb
FppSetPfileExtensionOnDisk
FppSetRenameInfo
FppSingleNonAlignedSync
FppSupersedeOrOverwriteFile
FppUnpinRepinnedBcbs
FppVerifyFcb
FppVerifyIndexIsValid
FppVerifyOperationIsLegal
FppVerifyVcb
FppVerifyVolume
NtOfsSetLength
|
Expand for full list:
EfsXtsAesDec
EfsXtsAesEnc
FppAllocateDiskSpace
FppCheckFreeDirentBitmap
FppCommonCleanup
FppCommonCreate
FppCommonRead
FppCommonWrite
FppComputeMoveFileSplicePoints
FppCreateBitmapFcb
FppCreateDcbFppCreateFcb
FppCreateIrpContext
FppCreateNewDirectory
FppCreateNewFile
FppCreateNewFileRecord
FppFixFcbChecksum
FppFlushFatEntries
FppForceCacheMiss
FppFreeSecondaryAllocation
FppFsdCreate
FppGetDirtyFileRecordBuffer
FppGetFileRecordFromFcbOrDcb
FppGetStreamRecordFromFcbOrDcb
FppIsDirectoryEmpty
FppLocateDirent
FppLockUserBuffer
FppLookupFileAllocation
FppLookupFileAllocationSize
FppMapUserBuffer
FppMountVolume
FppMoveFile
FppMultipleAsync
FppNonCachedIo
FppNonCachedNonAlignedRead
FppNotifyChangeDirectory
FppOpenExistingDcb
FppOpenExistingDirectory
FppOpenExistingFcb
FppOpenExistingFile
FppPerformVerify
FppPerformVerifyDiskRead
FppPinMappedData
FppPrepareWriteDirectoryFile
FppPrepareWriteVolumeFile
FppQuickVerifyVcb
FppReadBitmapFile
FppReadDirectoryFile
FppReadVolumeFile
FppScanBadClusters
FppSetEndOfFileInfo
FppSetFullNameInFcb
FppSetPfileExtensionOnDisk
FppSetRenameInfo
FppSetupAllocationSupport
FppSingleNonAlignedSync
FppSupersedeOrOverwriteFile
FppUnpinRepinnedBcbs
FppVerifyFcb
FppVerifyIndexIsValid
FppVerifyOperationIsLegal
FppVerifyVcb
FppVerifyVolume
NtOfsSetLength
| |paramcount|0|0| |`address`|EXTERNAL:000000ef|EXTERNAL:000000fa| |sig|noreturn undefined ExRaiseStatus(void)|noreturn undefined ExRaiseStatus(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExRaiseStatus Calling Diff ```diff --- NTOSKRNL.EXE::ExRaiseStatus calling +++ NTOSKRNL.EXE::ExRaiseStatus calling @@ -54,0 +55 @@ +FppSetupAllocationSupport ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-27T20:55:33