# fastfat-2026-08.sys-fastfat-2026-09.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_3174802747__private_IsEnabledDeviceUsageNoInline](#feature_3174802747__private_isenableddeviceusagenoinline) * [Feature_3174802747__private_IsEnabledFallback](#feature_3174802747__private_isenabledfallback) * [Feature_4205292859__private_IsEnabledDeviceUsageNoInline](#feature_4205292859__private_isenableddeviceusagenoinline) * [Feature_4205292859__private_IsEnabledFallback](#feature_4205292859__private_isenabledfallback) * [Feature_709593401__private_IsEnabledDeviceUsageNoInline](#feature_709593401__private_isenableddeviceusagenoinline) * [Feature_709593401__private_IsEnabledFallback](#feature_709593401__private_isenabledfallback) * [Feature_591104313__private_IsEnabledDeviceUsageNoInline](#feature_591104313__private_isenableddeviceusagenoinline) * [Feature_591104313__private_IsEnabledFallback](#feature_591104313__private_isenabledfallback) * [NTOSKRNL.EXE::RtlLogUnexpectedCodepath](#ntoskrnlexertllogunexpectedcodepath) * [Modified](#modified) * [Feature_EfsLibMemoryLeaks__private_IsEnabledFallback](#feature_efslibmemoryleaks__private_isenabledfallback) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [FatSetFatRun](#fatsetfatrun) * [EfspValidateAndParseFsctl](#efspvalidateandparsefsctl) * [EfsDecryptFek](#efsdecryptfek) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [FatSetupAllocationSupport](#fatsetupallocationsupport) * [EfspValidateStreamTransitionMetadata](#efspvalidatestreamtransitionmetadata) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [EfspClipSpFree](#efspclipspfree) * [__security_check_cookie](#__security_check_cookie) * [NTOSKRNL.EXE::ExRaiseStatus](#ntoskrnlexeexraisestatus) * [FreeKRpcMemory](#freekrpcmemory) # Visual Chart Diff ```mermaid flowchart LR Feature_EfsLibMemoryLeaks__private_IsEnabledFallback-2-old<--Match 89%-->Feature_EfsLibMemoryLeaks__private_IsEnabledFallback-2-new wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old<--Match 95%-->wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new FatSetFatRun-5-old<--Match 93%-->FatSetFatRun-5-new EfspValidateAndParseFsctl-4-old<--Match 63%-->EfspValidateAndParseFsctl-4-new EfsDecryptFek-10-old<--Match 71%-->EfsDecryptFek-10-new wil_details_FeatureReporting_ReportUsageToService-3-old<--Match 94%-->wil_details_FeatureReporting_ReportUsageToService-3-new wil_details_IsEnabledFallback-2-old<--Match 94%-->wil_details_IsEnabledFallback-2-new FatSetupAllocationSupport-2-old<--Match 70%-->FatSetupAllocationSupport-2-new EfspValidateStreamTransitionMetadata-3-old<--Match 84%-->EfspValidateStreamTransitionMetadata-3-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-old<--Match 90%-->wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-new subgraph fastfat-2026-09.sys Feature_EfsLibMemoryLeaks__private_IsEnabledFallback-2-new wil_details_FeatureReporting_ReportUsageToServiceDirect-3-new FatSetFatRun-5-new EfspValidateAndParseFsctl-4-new EfsDecryptFek-10-new wil_details_FeatureReporting_ReportUsageToService-3-new wil_details_IsEnabledFallback-2-new FatSetupAllocationSupport-2-new EfspValidateStreamTransitionMetadata-3-new wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-new subgraph Added direction LR Feature_3174802747__private_IsEnabledDeviceUsageNoInline Feature_3174802747__private_IsEnabledFallback Feature_4205292859__private_IsEnabledDeviceUsageNoInline Feature_4205292859__private_IsEnabledFallback Feature_709593401__private_IsEnabledDeviceUsageNoInline Feature_709593401__private_IsEnabledFallback Feature_591104313__private_IsEnabledDeviceUsageNoInline Feature_591104313__private_IsEnabledFallback NTOSKRNLEXE-RtlLogUnexpectedCodepath end end subgraph fastfat-2026-08.sys Feature_EfsLibMemoryLeaks__private_IsEnabledFallback-2-old wil_details_FeatureReporting_ReportUsageToServiceDirect-3-old FatSetFatRun-5-old EfspValidateAndParseFsctl-4-old EfsDecryptFek-10-old wil_details_FeatureReporting_ReportUsageToService-3-old wil_details_IsEnabledFallback-2-old FatSetupAllocationSupport-2-old EfspValidateStreamTransitionMetadata-3-old wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath-2-old end ``` ```mermaid pie showData title Function Matches - 99.6438% "unmatched_funcs_len" : 9 "matched_funcs_len" : 2518 ``` ```mermaid pie showData title Matched Function Similarity - 99.4043% "matched_funcs_with_code_changes_len" : 10 "matched_funcs_with_non_code_changes_len" : 5 "matched_funcs_no_changes_len" : 2503 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 fastfat-2026-08.sys fastfat-2026-09.sys ``` #### Verbose Args
``` --old ['fastfat-2026-08.sys'] --new [['fastfat-2026-09.sys']] --engine VersionTrackingDiff --output-path ghidriffs --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/FastFAT.Sys/80FF16646A000/FastFAT.Sys -O fastfat.sys.x64.10.0.26100.9278 wget https://msdl.microsoft.com/download/symbols/FastFAT.Sys/F89D469D6B000/FastFAT.Sys -O fastfat.sys.x64.10.0.26100.9444 ``` ## Binary Metadata Diff ```diff --- fastfat-2026-08.sys Meta +++ fastfat-2026-09.sys Meta @@ -1,44 +1,44 @@ -Program Name: fastfat-2026-08.sys +Program Name: fastfat-2026-09.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 436640 +# of Bytes: 440800 # of Memory Blocks: 13 -# of Instructions: 75354 -# of Defined Data: 7135 -# of Functions: 1259 -# of Symbols: 10064 +# of Instructions: 75622 +# of Defined Data: 7182 +# of Functions: 1268 +# of Symbols: 10112 # of Data Types: 394 # of Data Type Categories: 23 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Wed Sep 09 18:31:58 SGT 2026 +Date Created: Wed Sep 09 18:32:04 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/fastfat-2026-08.sys -Executable MD5: bac8a676b5163a8b5c0869a43988b3f8 -Executable SHA256: 0da9ccf1c8eb4f04df19fde152aae75a255aa1aa09b055d70bcc32010c563d13 -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/fastfat-2026-08.sys?MD5=bac8a676b5163a8b5c0869a43988b3f8 +Executable Location: /C:/Users/Jacob/Downloads/pdbs/fastfat-2026-09.sys +Executable MD5: fe7a6b961bed91c2f0d3a4b211ae20ad +Executable SHA256: 5605ccbefd5c7d3e04853c174db27b368b40228f85d2481f8bf3f0b499a91527 +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/fastfat-2026-09.sys?MD5=fe7a6b961bed91c2f0d3a4b211ae20ad PDB Age: 1 PDB File: fastfat.pdb -PDB GUID: a1949c41-cd66-85be-503d-a414f8ab0f5d +PDB GUID: 1a39b295-9a36-40f0-faff-75249c9ed924 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Fast FAT File System Driver -PE Property[FileVersion]: 10.0.26100.9278 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.9444 (WinBuild.160101.0800) PE Property[InternalName]: fastfat.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: FastFAT.Sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.9278 +PE Property[ProductVersion]: 10.0.26100.9444 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra fastfat-2026-08.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra fastfat-2026-08.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra fastfat-2026-08.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra fastfat-2026-09.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra fastfat-2026-09.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra fastfat-2026-09.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|9| |deleted_funcs_len|0| |modified_funcs_len|15| |added_symbols_len|14| |deleted_symbols_len|1| |diff_time|14.822782278060913| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1258, 'ExternalsName': 357})| |items_to_process|39| |diff_types|Counter({'address': 15, 'code': 10, 'length': 10, 'sig': 8, 'refcount': 6, 'called': 5, 'calling': 4})| |unmatched_funcs_len|9| |total_funcs_len|2527| |matched_funcs_len|2518| |matched_funcs_with_code_changes_len|10| |matched_funcs_with_non_code_changes_len|5| |matched_funcs_no_changes_len|2503| |match_func_similarity_percent|99.4043%| |func_match_overall_percent|99.6438%| |first_matches|Counter({'SymbolsHash': 1258})| ```mermaid pie showData title All Matches "SymbolsHash" : 1258 "ExternalsName" : 357 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1258 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 9 "deleted_funcs_len" : 0 "modified_funcs_len" : 15 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 14 "deleted_symbols_len" : 1 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_3174802747__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|fastfat-2026-09.sys| | :---: | :---: | |name|Feature_3174802747__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3174802747__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_3174802747__private_IsEnabledFallback| |calling|FatSetFatRun| |paramcount|0| |address|140001668| |sig|ulonglong __fastcall Feature_3174802747__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3174802747__private_IsEnabledDeviceUsageNoInline +++ Feature_3174802747__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3174802747__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3174802747__private_featureState; + if ((Feature_3174802747__private_featureState & 0x10) == 0) { + uVar1 = Feature_3174802747__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3174802747__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3174802747__private_IsEnabledFallback ### Function Meta |Key|fastfat-2026-09.sys| | :---: | :---: | |name|Feature_3174802747__private_IsEnabledFallback| |fullname|Feature_3174802747__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3174802747__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400016a0| |sig|undefined __fastcall Feature_3174802747__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3174802747__private_IsEnabledFallback +++ Feature_3174802747__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3174802747__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3174802747__private_descriptor); + return; +} + ``` ## Feature_4205292859__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|fastfat-2026-09.sys| | :---: | :---: | |name|Feature_4205292859__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_4205292859__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|49| |called|Feature_4205292859__private_IsEnabledFallback| |calling|FatSetupAllocationSupport| |paramcount|0| |address|1400016bc| |sig|ulonglong __fastcall Feature_4205292859__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_4205292859__private_IsEnabledDeviceUsageNoInline +++ Feature_4205292859__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_4205292859__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_4205292859__private_featureState; + if ((Feature_4205292859__private_featureState & 0x10) == 0) { + uVar1 = Feature_4205292859__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_4205292859__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_4205292859__private_IsEnabledFallback ### Function Meta |Key|fastfat-2026-09.sys| | :---: | :---: | |name|Feature_4205292859__private_IsEnabledFallback| |fullname|Feature_4205292859__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_4205292859__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400016f4| |sig|undefined __fastcall Feature_4205292859__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_4205292859__private_IsEnabledFallback +++ Feature_4205292859__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_4205292859__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_4205292859__private_descriptor); + return; +} + ``` ## Feature_709593401__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|fastfat-2026-09.sys| | :---: | :---: | |name|Feature_709593401__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_709593401__private_IsEnabledDeviceUsageNoInline| |refcount|4| |length|49| |called|Feature_709593401__private_IsEnabledFallback| |calling|EfsDecryptFek
EfspValidateAndParseFsctl| |paramcount|0| |address|140008d78| |sig|ulonglong __fastcall Feature_709593401__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_709593401__private_IsEnabledDeviceUsageNoInline +++ Feature_709593401__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_709593401__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_709593401__private_featureState; + if ((Feature_709593401__private_featureState & 0x10) == 0) { + uVar1 = Feature_709593401__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_709593401__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_709593401__private_IsEnabledFallback ### Function Meta |Key|fastfat-2026-09.sys| | :---: | :---: | |name|Feature_709593401__private_IsEnabledFallback| |fullname|Feature_709593401__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_709593401__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140008db0| |sig|undefined __fastcall Feature_709593401__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_709593401__private_IsEnabledFallback +++ Feature_709593401__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_709593401__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_709593401__private_descriptor); + return; +} + ``` ## Feature_591104313__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|fastfat-2026-09.sys| | :---: | :---: | |name|Feature_591104313__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_591104313__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_591104313__private_IsEnabledFallback| |calling|EfspValidateStreamTransitionMetadata| |paramcount|0| |address|14000b42c| |sig|ulonglong __fastcall Feature_591104313__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_591104313__private_IsEnabledDeviceUsageNoInline +++ Feature_591104313__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_591104313__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_591104313__private_featureState; + if ((Feature_591104313__private_featureState & 0x10) == 0) { + uVar1 = Feature_591104313__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_591104313__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_591104313__private_IsEnabledFallback ### Function Meta |Key|fastfat-2026-09.sys| | :---: | :---: | |name|Feature_591104313__private_IsEnabledFallback| |fullname|Feature_591104313__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_591104313__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|14000b464| |sig|undefined __fastcall Feature_591104313__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_591104313__private_IsEnabledFallback +++ Feature_591104313__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_591104313__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_591104313__private_descriptor); + return; +} + ``` ## NTOSKRNL.EXE::RtlLogUnexpectedCodepath ### Function Meta |Key|fastfat-2026-09.sys| | :---: | :---: | |name|RtlLogUnexpectedCodepath| |fullname|NTOSKRNL.EXE::RtlLogUnexpectedCodepath| |refcount|2| |length|0| |called|| |calling|EfspValidateStreamTransitionMetadata| |paramcount|0| |address|EXTERNAL:00000140| |sig|undefined RtlLogUnexpectedCodepath(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlLogUnexpectedCodepath* # Modified *Modified functions contain code changes* ## Feature_EfsLibMemoryLeaks__private_IsEnabledFallback ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.8| |i_ratio|0.67| |m_ratio|0.89| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|Feature_EfsLibMemoryLeaks__private_IsEnabledFallback|Feature_EfsLibMemoryLeaks__private_IsEnabledFallback| |fullname|Feature_EfsLibMemoryLeaks__private_IsEnabledFallback|Feature_EfsLibMemoryLeaks__private_IsEnabledFallback| |refcount|2|2| |`length`|14|21| |called|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |calling|Feature_EfsLibMemoryLeaks__private_IsEnabledDeviceUsageNoInline|Feature_EfsLibMemoryLeaks__private_IsEnabledDeviceUsageNoInline| |paramcount|2|2| |`address`|1400083f0|140008e04| |`sig`|undefined __fastcall Feature_EfsLibMemoryLeaks__private_IsEnabledFallback(undefined4 * param_1, uint param_2)|undefined __fastcall Feature_EfsLibMemoryLeaks__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### Feature_EfsLibMemoryLeaks__private_IsEnabledFallback Diff ```diff --- Feature_EfsLibMemoryLeaks__private_IsEnabledFallback +++ Feature_EfsLibMemoryLeaks__private_IsEnabledFallback @@ -1,8 +1,8 @@ -void Feature_EfsLibMemoryLeaks__private_IsEnabledFallback(undefined4 *param_1,uint param_2) +void Feature_EfsLibMemoryLeaks__private_IsEnabledFallback(ulonglong param_1,int param_2) { - wil_details_IsEnabledFallback(param_1,param_2); + wil_details_IsEnabledFallback(param_1,param_2,&Feature_EfsLibMemoryLeaks__private_descriptor); return; } ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.35| |i_ratio|0.53| |m_ratio|0.95| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2|2| |`length`|226|232| |called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3|3| |`address`|140008860|140001b70| |`sig`|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, ulonglong param_3)|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(longlong param_1, undefined8 param_2, ulonglong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToServiceDirect Diff ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -1,47 +1,46 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ bool wil_details_FeatureReporting_ReportUsageToServiceDirect - (undefined8 param_1,undefined8 param_2,ulonglong param_3) + (longlong param_1,undefined8 param_2,ulonglong param_3) { uint6 uVar1; uint *puVar2; - undefined1 auStack_88 [32]; - uint *local_68; - undefined8 local_58; - uint local_50 [6]; - uint local_38; - uint uStack_34; - uint uStack_30; - uint uStack_2c; - undefined8 local_28; - ulonglong local_20; + undefined1 auStack_98 [32]; + uint *local_78; + undefined8 local_68; + uint local_60 [6]; + uint local_48; + uint uStack_44; + uint uStack_40; + uint uStack_3c; + undefined8 local_38; + ulonglong local_30; - local_20 = __security_cookie ^ (ulonglong)auStack_88; + local_30 = __security_cookie ^ (ulonglong)auStack_98; puVar2 = wil_details_FeatureReporting_RecordUsageInCache - (local_50,(uint *)&Feature_EfsLibMemoryLeaks__private_reporting,param_3, - (uint)((ulonglong)param_2 >> 0x20)); - local_38 = *puVar2; - uStack_34 = puVar2[1]; - uStack_30 = puVar2[2]; - uStack_2c = puVar2[3]; - local_28 = *(undefined8 *)(puVar2 + 4); + (local_60,*(uint **)(param_1 + 8),param_3,(uint)((ulonglong)param_2 >> 0x20)); + local_48 = *puVar2; + uStack_44 = puVar2[1]; + uStack_40 = puVar2[2]; + uStack_3c = puVar2[3]; + local_38 = *(undefined8 *)(puVar2 + 4); if (g_wil_details_recordFeatureUsage != (code *)0x0) { - local_68 = &local_38; + local_78 = &local_48; (*g_wil_details_recordFeatureUsage) - (0x35d79cc,param_3 & 0xffffffff,1,&Feature_EfsLibMemoryLeaks__private_reporting); + (*(undefined4 *)(param_1 + 0x18),param_3 & 0xffffffff,1,*(undefined8 *)(param_1 + 8)); } if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) { - local_58._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),0x35d79cc); - uVar1 = (uint6)local_58; - local_58 = (ulonglong)(uint6)local_58; + local_68._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),*(undefined4 *)(param_1 + 0x18)); + uVar1 = (uint6)local_68; + local_68 = (ulonglong)(uint6)local_68; if (((uint)param_2 >> 0xb & 1) != 0) { - local_58 = CONCAT26(1,uVar1); + local_68 = CONCAT26(1,uVar1); } - RtlNotifyFeatureUsage(&local_58); + RtlNotifyFeatureUsage(&local_68); } - return (int)local_28 == 0; + return (int)local_38 == 0; } ``` ## FatSetFatRun ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.87| |i_ratio|0.58| |m_ratio|0.99| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|FatSetFatRun|FatSetFatRun| |fullname|FatSetFatRun|FatSetFatRun| |refcount|5|5| |`length`|1874|1922| |`called`|FatAddMcbEntry
FatPrepareWriteVolumeFile
NTOSKRNL.EXE::CcUnpinData
NTOSKRNL.EXE::ExAcquireFastMutexUnsafe
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::ExReleaseFastMutexUnsafe
__security_check_cookie
memset|FatAddMcbEntry
FatPrepareWriteVolumeFile
Feature_3174802747__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::CcUnpinData
NTOSKRNL.EXE::ExAcquireFastMutexUnsafe
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::ExReleaseFastMutexUnsafe
__security_check_cookie
memset| |calling|FatAllocateDiskSpace
FatDeallocateDiskSpace
FatDeallocateDiskSpace$fin$2|FatAllocateDiskSpace
FatDeallocateDiskSpace
FatDeallocateDiskSpace$fin$2| |paramcount|5|5| |`address`|140023aac|140024aac| |sig|undefined __fastcall FatSetFatRun(longlong param_1, longlong param_2, uint param_3, uint param_4, char param_5)|undefined __fastcall FatSetFatRun(longlong param_1, longlong param_2, uint param_3, uint param_4, char param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### FatSetFatRun Called Diff ```diff --- FatSetFatRun called +++ FatSetFatRun called @@ -2,0 +3 @@ +Feature_3174802747__private_IsEnabledDeviceUsageNoInline ``` ### FatSetFatRun Diff ```diff --- FatSetFatRun +++ FatSetFatRun @@ -1,202 +1,208 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Removing unreachable block (ram,0x00014002417d) */ +/* WARNING: Removing unreachable block (ram,0x0001400251ae) */ void FatSetFatRun(longlong param_1,longlong param_2,uint param_3,uint param_4,char param_5) { ushort uVar1; uint uVar2; uint uVar3; int iVar4; uint uVar5; uint uVar6; longlong *plVar7; uint *puVar8; ulonglong uVar9; ushort *puVar10; ulonglong uVar11; uint uVar12; uint uVar13; + uint uVar14; undefined1 auStackY_528 [32]; ushort local_4e4; ushort local_4e0; - longlong local_4a8; - uint *local_4a0; - longlong local_498; + longlong local_4a0; + uint *local_498; ushort *local_490; longlong local_488; uint local_480; longlong local_478; longlong local_468 [132]; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_528; - local_498 = param_1; local_488 = param_2; local_478 = param_1; memset(local_468,0,0x420); puVar10 = (ushort *)0x0; - local_4a8 = 0; + local_4a0 = 0; if ((1 < param_3) && (uVar2 = *(int *)(param_2 + 0x16c) + 1, param_3 <= uVar2)) { uVar12 = (param_4 + param_3) - 1; if ((1 < uVar12) && (uVar12 <= uVar2)) { if (param_4 != 0) { uVar2 = 1 << (*(byte *)(param_2 + 0x179) & 0x1f); if (*(char *)(param_2 + 0x178) == '\f') { uVar6 = (uint)*(ushort *)(param_2 + 0x12e); if (*(ushort *)(param_2 + 0x12e) == 0) { uVar6 = *(uint *)(param_2 + 0x13c); } FatPrepareWriteVolumeFile - (local_498,param_2, + (param_1,param_2, (uint)*(ushort *)(param_2 + 0x124) * (uint)*(ushort *)(param_2 + 0x120), - *(ushort *)(param_2 + 0x120) * uVar6,local_468,&local_4a8,'\x01'); + *(ushort *)(param_2 + 0x120) * uVar6,local_468,&local_4a0,1); iVar4 = (uint)*(ushort *)(param_2 + 0x124) * (uint)*(ushort *)(param_2 + 0x120); for (uVar11 = (ulonglong)((param_3 * 3 >> 1) + iVar4 & -uVar2); (longlong)uVar11 <= (longlong)(ulonglong)(((param_4 + param_3) * 3 + 2 >> 1) + iVar4 & -uVar2); uVar11 = uVar2 + uVar11) { FatAddMcbEntry(param_2,param_2 + 0x180,uVar11,uVar11,uVar2); } ExAcquireFastMutexUnsafe(param_2 + 0x1d0); while( true ) { uVar11 = (ulonglong)(param_3 * 3 >> 1); if (uVar12 <= param_3) break; - uVar1 = *(ushort *)(uVar11 + local_4a8); + uVar1 = *(ushort *)(uVar11 + local_4a0); if ((param_3 & 1) == 0) { local_4e0 = -(ushort)(param_5 != '\0') & (ushort)(param_3 + 1); uVar1 = uVar1 & 0xf000; } else { local_4e0 = (ushort)((-(uint)(param_5 != '\0') & param_3 + 1) << 4); uVar1 = uVar1 & 0xf; } local_4e0 = local_4e0 | uVar1; - *(ushort *)((ulonglong)(param_3 * 3 >> 1) + local_4a8) = local_4e0; + *(ushort *)((ulonglong)(param_3 * 3 >> 1) + local_4a0) = local_4e0; param_3 = param_3 + 1; } - uVar1 = *(ushort *)(uVar11 + local_4a8); + uVar1 = *(ushort *)(uVar11 + local_4a0); if ((param_3 & 1) == 0) { local_4e4 = -(ushort)(param_5 != '\0') & 0xfff; uVar1 = uVar1 & 0xf000; } else { local_4e4 = -(ushort)(param_5 != '\0') & 0xfff0; uVar1 = uVar1 & 0xf; } local_4e4 = local_4e4 | uVar1; - *(ushort *)((ulonglong)(param_3 * 3 >> 1) + local_4a8) = local_4e4; + *(ushort *)((ulonglong)(param_3 * 3 >> 1) + local_4a0) = local_4e4; ExReleaseFastMutexUnsafe(param_2 + 0x1d0); } else if (*(char *)(param_2 + 0x178) == ' ') { while( true ) { puVar8 = (uint *)0x0; - local_4a0 = (uint *)0x0; + local_498 = (uint *)0x0; uVar12 = (uint)*(ushort *)(param_2 + 0x124) * (uint)*(ushort *)(param_2 + 0x120) + param_3 * 4; uVar6 = param_4; if (0x10000 < param_4) { uVar6 = 0x10000; } uVar3 = uVar12 + (uVar6 - 1) * 4; iVar4 = (uVar3 >> 0xc) - (uVar12 >> 0xc); memset(local_468,0,(ulonglong)(iVar4 + 2) << 4); uVar5 = uVar12 & 0xfffff000; for (uVar13 = 0; uVar13 < iVar4 + 1U; uVar13 = uVar13 + 1) { FatPrepareWriteVolumeFile - (local_498,param_2,uVar5,0x1000,local_468 + (ulonglong)uVar13 * 2, - local_468 + (ulonglong)uVar13 * 2 + 1,'\x01'); + (param_1,param_2,uVar5,0x1000,local_468 + (ulonglong)uVar13 * 2, + local_468 + (ulonglong)uVar13 * 2 + 1,1); if (uVar13 == 0) { puVar8 = (uint *)((ulonglong)(uVar12 & 0xfff) + local_468[1]); - local_4a0 = puVar8; + local_498 = puVar8; } uVar5 = uVar5 + 0x1000; } for (uVar11 = (ulonglong)(-uVar2 & uVar12); (longlong)uVar11 <= (longlong)(ulonglong)(-uVar2 & uVar3); uVar11 = uVar11 + uVar2) { FatAddMcbEntry(param_2,param_2 + 0x180,uVar11 & 0xffffffff,uVar11,uVar2); } uVar9 = 0; uVar11 = uVar9; for (uVar12 = param_3; uVar12 <= (uVar6 - 1) + param_3; uVar12 = uVar12 + 1) { if ((((ulonglong)puVar8 & 0xfff) == 0) && (uVar12 != param_3)) { uVar3 = (int)uVar11 + 1; uVar11 = (ulonglong)uVar3; puVar8 = (uint *)local_468[(ulonglong)uVar3 * 2 + 1]; } *puVar8 = -(uint)(param_5 != '\0') & uVar12 + 1; puVar8 = puVar8 + 1; - local_4a0 = puVar8; + local_498 = puVar8; } if ((param_4 < 0x10001) && (param_5 != '\0')) { puVar8[-1] = 0xfffffff; } for (; ((uint)uVar9 < 0x42 && (local_468[uVar9 * 2] != 0)); uVar9 = (ulonglong)((uint)uVar9 + 1)) { CcUnpinData(); local_468[uVar9 * 2] = 0; } if (param_4 < 0x10001) break; param_3 = param_3 + 0x10000; param_4 = param_4 - 0x10000; local_480 = param_4; } } else { local_490 = (ushort *)0x0; uVar6 = (uint)*(ushort *)(param_2 + 0x124) * (uint)*(ushort *)(param_2 + 0x120) + param_3 * 2; - uVar3 = param_4 * 2 + -2 + uVar6; + uVar3 = uVar6 + (param_4 - 1) * 2; iVar4 = (uVar3 >> 0xc) - (uVar6 >> 0xc); + uVar5 = iVar4 + 1; + uVar11 = Feature_3174802747__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar11 != 0) && (0x41 < uVar5)) { + *(undefined4 *)(param_1 + 0x48) = 0xc0000102; + /* WARNING: Subroutine does not return */ + ExRaiseStatus(); + } memset(local_468,0,(ulonglong)(iVar4 + 2) << 4); - uVar5 = uVar6 & 0xfffff000; - for (uVar13 = 0; uVar13 < iVar4 + 1U; uVar13 = uVar13 + 1) { + uVar13 = uVar6 & 0xfffff000; + for (uVar14 = 0; uVar14 < uVar5; uVar14 = uVar14 + 1) { FatPrepareWriteVolumeFile - (local_498,param_2,uVar5,0x1000,local_468 + (ulonglong)uVar13 * 2, - local_468 + (ulonglong)uVar13 * 2 + 1,'\x01'); - if (uVar13 == 0) { + (param_1,param_2,uVar13,0x1000,local_468 + (ulonglong)uVar14 * 2, + local_468 + (ulonglong)uVar14 * 2 + 1,1); + if (uVar14 == 0) { puVar10 = (ushort *)((ulonglong)(uVar6 & 0xfff) + local_468[1]); local_490 = puVar10; } - uVar5 = uVar5 + 0x1000; + uVar13 = uVar13 + 0x1000; } for (uVar11 = (ulonglong)(uVar6 & -uVar2); (longlong)uVar11 <= (longlong)(ulonglong)(uVar3 & -uVar2); uVar11 = uVar2 + uVar11) { FatAddMcbEntry(param_2,param_2 + 0x180,uVar11 & 0xffffffff,uVar11,uVar2); } uVar6 = 0; for (uVar2 = param_3; uVar2 <= uVar12; uVar2 = uVar2 + 1) { if ((((ulonglong)puVar10 & 0xfff) == 0) && (uVar2 != param_3)) { uVar6 = uVar6 + 1; puVar10 = (ushort *)local_468[(ulonglong)uVar6 * 2 + 1]; } *puVar10 = -(ushort)(param_5 != '\0') & (short)uVar2 + 1U; puVar10 = puVar10 + 1; local_490 = puVar10; } if (param_5 != '\0') { puVar10[-1] = 0xffff; } } uVar2 = 0; plVar7 = local_468; do { if (*plVar7 == 0) { return; } CcUnpinData(); *plVar7 = 0; uVar2 = uVar2 + 1; plVar7 = plVar7 + 2; } while (uVar2 < 0x42); } return; } } *(undefined4 *)(param_1 + 0x48) = 0xc0000102; /* WARNING: Subroutine does not return */ ExRaiseStatus(); } ``` ## EfspValidateAndParseFsctl ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.42| |i_ratio|0.33| |m_ratio|0.92| |b_ratio|0.63| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|EfspValidateAndParseFsctl|EfspValidateAndParseFsctl| |fullname|EfspValidateAndParseFsctl|EfspValidateAndParseFsctl| |refcount|3|3| |`length`|944|1104| |`called`|EfspTraceLogAssert
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
__security_check_cookie
memcmp
memmove|EfspTraceLogAssert
Feature_709593401__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
__security_check_cookie
memcmp
memmove| |calling|EfsDeleteContextOnError
EfsFileControl|EfsDeleteContextOnError
EfsFileControl| |paramcount|4|4| |`address`|140052618|1400537c8| |sig|int __fastcall EfspValidateAndParseFsctl(uint * param_1, uint param_2, undefined1 * param_3, uint * param_4)|int __fastcall EfspValidateAndParseFsctl(uint * param_1, uint param_2, undefined1 * param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### EfspValidateAndParseFsctl Called Diff ```diff --- EfspValidateAndParseFsctl called +++ EfspValidateAndParseFsctl called @@ -1,0 +2 @@ +Feature_709593401__private_IsEnabledDeviceUsageNoInline ``` ### EfspValidateAndParseFsctl Diff ```diff --- EfspValidateAndParseFsctl +++ EfspValidateAndParseFsctl @@ -1,257 +1,294 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ int EfspValidateAndParseFsctl(uint *param_1,uint param_2,undefined1 *param_3,uint *param_4) { bool bVar1; int iVar2; uint *puVar3; - uint uVar4; + ulonglong uVar4; uint uVar5; + uint uVar6; uint *_Buf1; + uint uVar7; uint *_Src; - uint uVar6; - int iVar7; - undefined8 uVar8; - uint uVar9; + void *_Buf2; + int iVar8; + undefined8 uVar9; uint uVar10; uint uVar11; undefined1 auStack_b8 [32]; undefined1 local_98; + uint local_94; uint local_90; undefined4 local_88; undefined4 local_84; uint *local_78; uint *local_70; uint *local_68; uint *local_60; - uint *local_58; - uint local_50 [4]; - ulonglong local_40; + uint local_58 [4]; + ulonglong local_48; - local_40 = __security_cookie ^ (ulonglong)auStack_b8; - uVar9 = 0; + local_48 = __security_cookie ^ (ulonglong)auStack_b8; + local_94 = 0; local_84 = 0; puVar3 = (uint *)0x0; local_78 = (uint *)0x0; - uVar11 = 0; - iVar7 = 0; - local_50[0] = 0; - local_50[1] = 0; - local_50[2] = 0; - local_50[3] = 0; + uVar7 = 0; + iVar8 = 0; + local_58[0] = 0; + local_58[1] = 0; + local_58[2] = 0; + local_58[3] = 0; bVar1 = false; local_98 = 0; param_4[0] = 0; param_4[1] = 0; param_4[2] = 0; param_4[3] = 0; param_4[4] = 0; param_4[5] = 0; param_4[6] = 0; param_4[7] = 0; param_4[8] = 0; param_4[9] = 0; param_4[10] = 0; param_4[0xb] = 0; _Buf1 = param_1; if ((0x1f < param_2) && (_Buf1 = (uint *)0x534f, (short)param_1[1] == 0x534f)) { bVar1 = true; local_98 = 1; *param_3 = 1; } - local_70 = param_1; - local_68 = param_4; + local_70 = param_4; + local_68 = param_1; local_60 = param_1; - local_58 = param_1; if (bVar1) { if (param_2 < 0x20) { - uVar8 = 0xe90; + uVar9 = 0xe92; local_90 = param_2; } else { - uVar6 = param_2 - 0x20; + uVar11 = param_2 - 0x20; LAB_0: - local_90 = uVar6; - if (uVar6 != 0) { - if ((uVar6 & 0xf) != 0) { - uVar8 = 0xeb1; + local_90 = uVar11; + if (uVar11 != 0) { + if ((uVar11 & 0xf) != 0) { + uVar9 = 0xeb3; goto LAB_1; } - puVar3 = (uint *)ExAllocatePool2(0x41,uVar6,0x63736645); + puVar3 = (uint *)ExAllocatePool2(0x41,uVar11,0x63736645); local_78 = puVar3; if (puVar3 == (uint *)0x0) { - iVar7 = -0x3fffff66; + iVar8 = -0x3fffff66; goto LAB_2; } } puVar3 = local_78; - _Src = local_58 + 4; - _Buf1 = local_70; + _Src = local_60 + 4; + _Buf1 = param_1; if (bVar1) { _Buf1 = _Src; } *param_4 = *_Buf1; param_4[1] = _Buf1[1]; param_4[2] = _Buf1[2]; - if (_Buf1[3] == uVar6) { + if (_Buf1[3] == uVar11) { + if (uVar11 != 0) { + if (bVar1) { + _Src = param_1 + 8; + } + _Buf1 = local_78; + memmove(local_78,_Src,(ulonglong)uVar11); + } + } + else { + iVar8 = -0x3ffffff0; + local_88 = 0xc0000010; + EfspTraceLogAssert(_Buf1,5,0xeeb,0xc0000010); + } + if (iVar8 < 0) goto LAB_2; + uVar6 = param_4[1]; + uVar10 = uVar7; + if (uVar6 < 6) { + uVar10 = 0; + if (uVar6 == 5) goto LAB_3; if (uVar6 != 0) { - if (bVar1) { - _Src = local_70 + 8; - } - _Buf1 = local_78; - memmove(local_78,_Src,(ulonglong)uVar6); - } - } - else { - iVar7 = -0x3ffffff0; - local_88 = 0xc0000010; - EfspTraceLogAssert(_Buf1,5,0xee9,0xc0000010); - } - if (iVar7 < 0) goto LAB_2; - uVar5 = param_4[1]; - uVar10 = uVar11; - if (uVar5 < 6) { - uVar10 = 0; - if (uVar5 == 5) goto LAB_3; - if (uVar5 != 0) { - if (uVar5 == 1) { + if (uVar6 == 1) { LAB_4: - uVar11 = param_4[2]; - _Buf1 = (uint *)(ulonglong)uVar11; - if ((uVar11 & 1) == 0) { + uVar7 = param_4[2]; + _Buf1 = (uint *)(ulonglong)uVar7; + if ((uVar7 & 1) == 0) { uVar10 = 1; } - else if ((uVar5 == 1) || (uVar10 = 2, (uVar11 & 2) != 0)) goto LAB_5; - } - else { - _Buf1 = (uint *)(ulonglong)(uVar5 - 2); - uVar10 = uVar11; - if (uVar5 - 2 != 0) { - uVar4 = uVar5 - 3; - _Buf1 = (uint *)(ulonglong)uVar4; - if (uVar4 != 0) { - if (uVar4 != 1) goto LAB_6; + else if ((uVar6 == 1) || (uVar10 = 2, (uVar7 & 2) != 0)) goto LAB_5; + } + else { + _Buf1 = (uint *)(ulonglong)(uVar6 - 2); + uVar10 = uVar7; + if (uVar6 - 2 != 0) { + uVar5 = uVar6 - 3; + _Buf1 = (uint *)(ulonglong)uVar5; + if (uVar5 != 0) { + if (uVar5 != 1) goto LAB_6; goto LAB_4; } } } goto LAB_3; } - uVar5 = param_4[2]; - _Buf1 = (uint *)(ulonglong)uVar5; - uVar4 = uVar5 & 0xf77fffff; - if (uVar4 == 1) { + uVar6 = param_4[2]; + _Buf1 = (uint *)(ulonglong)uVar6; + uVar5 = uVar6 & 0xf77fffff; + if (uVar5 == 1) { LAB_5: uVar10 = 3; goto LAB_3; } - uVar10 = uVar11; - if (uVar4 == 2) goto LAB_3; - if (uVar4 == 3) { - uVar5 = uVar5 & 0x800000; - uVar11 = ~-(uint)(uVar5 != 0); + uVar10 = uVar7; + if (uVar5 == 2) goto LAB_3; + if (uVar5 == 3) { + uVar6 = uVar6 & 0x800000; + uVar7 = ~-(uint)(uVar6 != 0); LAB_7: - _Buf1 = (uint *)(ulonglong)-uVar5; - uVar10 = uVar11 & 3; - goto LAB_3; - } - if (uVar4 == 4) { - uVar5 = uVar5 & 0x8000000; - uVar11 = -(uint)(uVar5 != 0); + _Buf1 = (uint *)(ulonglong)-uVar6; + uVar10 = uVar7 & 3; + goto LAB_3; + } + if (uVar5 == 4) { + uVar6 = uVar6 & 0x8000000; + uVar7 = -(uint)(uVar6 != 0); goto LAB_7; } - if (uVar4 == 0x80000002) goto LAB_3; - if (uVar4 != 0x80000003) { - if (uVar4 != 0x80000004) { - uVar8 = 0xf57; + if (uVar5 == 0x80000002) goto LAB_3; + if (uVar5 != 0x80000003) { + if (uVar5 != 0x80000004) { + uVar9 = 0xf59; goto LAB_1; } goto LAB_3; } uVar10 = 2; LAB_8: - if (0xb < uVar6) { - uVar9 = *puVar3; + if (uVar11 < 0xc) { + uVar9 = 0xfcf; + } + else { + _Buf1 = (uint *)(ulonglong)*puVar3; *(uint **)(param_4 + 4) = puVar3; - goto LAB_9; - } - uVar8 = 0xfab; - } - else { - if ((((uVar5 != 6) && (uVar5 != 7)) && (uVar5 != 8)) && ((uVar5 != 9 && (uVar5 != 10)))) { -LAB_6: - uVar8 = 0xf72; - goto LAB_1; - } -LAB_3: - if (uVar10 == 3) { - if (uVar6 < 0x38) { - uVar8 = 0xf84; - } - else { - uVar9 = *puVar3; - _Buf1 = (uint *)((ulonglong)uVar9 + 0x44); - if (_Buf1 <= (uint *)(ulonglong)uVar6) { - _Buf1 = (uint *)((longlong)puVar3 + (ulonglong)uVar9 + 0x38); - uVar9 = *_Buf1 + 0x38 + uVar9; - *(uint **)(param_4 + 6) = puVar3; - *(uint **)(param_4 + 4) = _Buf1; - goto LAB_9; - } - uVar8 = 0xf8b; - } - } - else { - if (uVar10 == 1) { - if (uVar6 < 0x38) { - uVar8 = 0xf9d; - goto LAB_1; - } - uVar9 = *puVar3 + 0x38; - *(uint **)(param_4 + 6) = puVar3; - } - else if (uVar10 == 2) goto LAB_8; LAB_9: - if (uVar9 == 0) { + uVar7 = (uint)_Buf1; + if (uVar7 == 0) { LAB_10: *(uint **)(param_4 + 8) = puVar3; puVar3 = (uint *)0x0; - param_4[10] = uVar6; + param_4[10] = uVar11; param_4[3] = uVar10; goto LAB_2; } - if (((uVar6 < uVar9) || ((uVar9 + 0xf & 0xfffffff0) != uVar6)) || (0x10 < uVar6 - uVar9)) - { - uVar8 = 0xfc8; - } - else { - _Buf1 = local_50; - iVar2 = memcmp(_Buf1,(void *)((ulonglong)uVar9 + (longlong)puVar3), - (ulonglong)(uVar6 - uVar9)); + if (((uVar11 < uVar7) || ((uVar7 + 0xf & 0xfffffff0) != uVar11)) || + (0x10 < uVar11 - uVar7)) { + uVar9 = 0xfec; + } + else { + _Buf2 = (void *)((longlong)_Buf1 + (longlong)puVar3); + _Buf1 = local_58; + iVar2 = memcmp(_Buf1,_Buf2,(ulonglong)(uVar11 - uVar7)); if (iVar2 == 0) goto LAB_10; - uVar8 = 0xfd0; + uVar9 = 0xff4; + } + } + } + else { + if ((((uVar6 != 6) && (uVar6 != 7)) && (uVar6 != 8)) && ((uVar6 != 9 && (uVar6 != 10)))) { +LAB_6: + uVar9 = 0xf74; + goto LAB_1; + } +LAB_3: + if (uVar10 == 3) { + if (uVar11 < 0x38) { + uVar9 = 0xf86; + } + else { + uVar4 = Feature_709593401__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { + uVar7 = *puVar3; + _Buf1 = (uint *)((ulonglong)uVar7 + 0x44); + if (_Buf1 <= (uint *)(ulonglong)uVar11) { + _Buf1 = (uint *)((longlong)puVar3 + (ulonglong)uVar7 + 0x38); + local_94 = *_Buf1 + 0x38 + uVar7; +LAB_11: + *(uint **)(param_4 + 6) = puVar3; + *(uint **)(param_4 + 4) = _Buf1; + goto LAB_12; + } + uVar9 = 0xfa3; + } + else { + if (0x43 < uVar11) { + uVar7 = *puVar3; + if ((uVar7 < 0x409) && + (_Buf1 = (uint *)((ulonglong)uVar11 - 0x44), (uint *)(ulonglong)uVar7 <= _Buf1)) + { + uVar7 = uVar7 + 0x38; + _Buf1 = (uint *)((ulonglong)uVar7 + (longlong)puVar3); + uVar6 = *_Buf1; + if ((7 < uVar6) && (uVar6 <= uVar11 - uVar7)) { + local_94 = uVar6 + uVar7; + goto LAB_11; + } + uVar9 = 0xf9c; + goto LAB_1; + } + } + uVar9 = 0xf92; + } + } + } + else { + if (uVar10 != 1) { + if (uVar10 == 2) goto LAB_8; +LAB_12: + _Buf1 = (uint *)(ulonglong)local_94; + goto LAB_9; + } + if (uVar11 < 0x38) { + uVar9 = 0xfb7; + } + else { + uVar4 = Feature_709593401__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar4 == 0) || + ((*puVar3 < 0x409 && + (_Buf1 = (uint *)((ulonglong)uVar11 - 0x38), (uint *)(ulonglong)*puVar3 <= _Buf1)))) + { + _Buf1 = (uint *)(ulonglong)(*puVar3 + 0x38); + *(uint **)(param_4 + 6) = puVar3; + goto LAB_9; + } + uVar9 = 0xfc1; } } } } } else { if (0xf < param_2) { - uVar6 = param_2 - 0x10; + uVar11 = param_2 - 0x10; goto LAB_0; } - uVar8 = 0xe9e; + uVar9 = 0xea0; local_90 = param_2; } LAB_1: - iVar7 = -0x3ffffff0; - EfspTraceLogAssert(_Buf1,5,uVar8,0xc0000010); + iVar8 = -0x3ffffff0; + EfspTraceLogAssert(_Buf1,5,uVar9,0xc0000010); LAB_2: if (puVar3 != (uint *)0x0) { ExFreePoolWithTag(puVar3,0); } - return iVar7; + return iVar8; } ``` ## EfsDecryptFek ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.37| |i_ratio|0.1| |m_ratio|0.72| |b_ratio|0.71| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|EfsDecryptFek|EfsDecryptFek| |fullname|EfsDecryptFek|EfsDecryptFek| |refcount|2|2| |`length`|261|346| |`called`|EfsDecryptFekClient
EfsGetEfsStreamInfo
EfsWaitForServiceReady
EfspClipSpDecryptFek|EfsDecryptFekClient
EfsGetEfsStreamInfo
EfsWaitForServiceReady
EfspClipSpDecryptFek
EfspClipSpFree
Feature_709593401__private_IsEnabledDeviceUsageNoInline
FreeKRpcMemory| |calling|EfspPostCreateImpersonateAndGetData|EfspPostCreateImpersonateAndGetData| |paramcount|10|10| |`address`|1400584d8|1400596f0| |`sig`|undefined __fastcall EfsDecryptFek(undefined8 param_1, uint * param_2, uint param_3, int param_4, undefined8 param_5, undefined8 param_6, longlong param_7, longlong param_8, longlong param_9, undefined8 * param_10)|int __fastcall EfsDecryptFek(undefined8 * param_1, uint * param_2, uint param_3, int param_4, undefined8 param_5, undefined8 param_6, longlong param_7, longlong param_8, longlong param_9, undefined8 * param_10)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### EfsDecryptFek Called Diff ```diff --- EfsDecryptFek called +++ EfsDecryptFek called @@ -4,0 +5,3 @@ +EfspClipSpFree +Feature_709593401__private_IsEnabledDeviceUsageNoInline +FreeKRpcMemory ``` ### EfsDecryptFek Diff ```diff --- EfsDecryptFek +++ EfsDecryptFek @@ -1,34 +1,57 @@ -void EfsDecryptFek(undefined8 param_1,uint *param_2,uint param_3,int param_4,undefined8 param_5, - undefined8 param_6,longlong param_7,longlong param_8,longlong param_9, - undefined8 *param_10) +int EfsDecryptFek(undefined8 *param_1,uint *param_2,uint param_3,int param_4,undefined8 param_5, + undefined8 param_6,longlong param_7,longlong param_8,longlong param_9, + undefined8 *param_10) { int iVar1; - undefined4 local_res20 [2]; - undefined4 local_28 [2]; - undefined8 local_20; - undefined8 uStack_18; + ulonglong uVar2; + uint *puVar3; + uint local_res20 [2]; + undefined4 local_48 [2]; + undefined8 local_40; + undefined8 uStack_38; + local_48[0] = 0; local_res20[0] = 0; - local_28[0] = 0; - local_20 = 0; - uStack_18 = 0; + local_40 = 0; + uStack_38 = 0; if (param_4 == 3) { - iVar1 = EfsGetEfsStreamInfo(param_2,param_3,8,(uint *)&local_20,0x10); + iVar1 = EfsGetEfsStreamInfo(param_2,param_3,8,(uint *)&local_40,0x10); if (-1 < iVar1) { - EfspClipSpDecryptFek - ((undefined4)uStack_18,local_20,param_5,param_6,param_7,local_28,param_1,local_res20 - ,param_10); + iVar1 = EfspClipSpDecryptFek + ((undefined4)uStack_38,local_40,param_5,param_6,param_7,local_res20,param_1, + local_48,param_10); } } else { iVar1 = EfsWaitForServiceReady(); if (-1 < iVar1) { - EfsDecryptFekClient(param_3,(longlong)param_2,param_8,param_9,local_28,param_1,local_res20, - param_10); + iVar1 = EfsDecryptFekClient(param_3,(longlong)param_2,param_8,param_9,local_res20,param_1, + local_48,param_10); } } - return; + uVar2 = Feature_709593401__private_IsEnabledDeviceUsageNoInline(); + if (((((int)uVar2 != 0) && (-1 < iVar1)) && (puVar3 = (uint *)*param_1, puVar3 != (uint *)0x0)) && + ((uVar2 = (ulonglong)local_res20[0], 0x408 < local_res20[0] - 0x38 || + (uVar2 - 0x38 < (ulonglong)*puVar3)))) { + for (; uVar2 != 0; uVar2 = uVar2 - 1) { + *(undefined1 *)puVar3 = 0; + puVar3 = (uint *)((longlong)puVar3 + 1); + } + if (param_4 == 3) { + EfspClipSpFree((longlong)*param_1); + } + else { + FreeKRpcMemory((void *)*param_1); + } + *param_1 = 0; + if ((void *)*param_10 != (void *)0x0) { + FreeKRpcMemory((void *)*param_10); + *param_10 = 0; + } + iVar1 = -0x3ffffdfa; + } + return iVar1; } ``` ## wil_details_FeatureReporting_ReportUsageToService ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.63| |i_ratio|0.5| |m_ratio|0.94| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService|wil_details_FeatureReporting_ReportUsageToService| |refcount|2|2| |`length`|114|125| |called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|3|3| |`address`|1400087e4|140001aec| |`sig`|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, uint param_3)|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(longlong param_1, undefined8 param_2, int param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_ReportUsageToService Diff ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -1,27 +1,26 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ void wil_details_FeatureReporting_ReportUsageToService - (undefined8 param_1,undefined8 param_2,uint param_3) + (longlong param_1,undefined8 param_2,int param_3) { bool bVar1; uint uVar2; undefined7 extraout_var; - ulonglong uVar3; - uint uVar4; - uint local_res18 [4]; + uint uVar3; + int local_res18 [4]; - uVar4 = (uint)param_2 & 1; - uVar3 = (ulonglong)param_3; + uVar3 = (uint)param_2 & 1; local_res18[0] = param_3; - uVar2 = wil_details_MapReportingKind(param_3,uVar4); - bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,(ulonglong)uVar2); + uVar2 = wil_details_MapReportingKind(param_3,uVar3); + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(param_1,param_2,(ulonglong)uVar2); if (((int)CONCAT71(extraout_var,bVar1) != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { (*g_wil_details_pfnFeatureLoggingHook) - (0x35d79cc,&Feature_SFS_CD_BugFixes_2406_logged_traits,0,uVar4,local_res18,0,0,1); + (*(undefined4 *)(param_1 + 0x18),*(undefined8 *)(param_1 + 0x10),0,uVar3,local_res18,0 + ,0,1); } return; } ``` ## wil_details_IsEnabledFallback ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.48| |i_ratio|0.43| |m_ratio|0.96| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|2|6| |`length`|135|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_EfsLibMemoryLeaks__private_IsEnabledFallback|Feature_3174802747__private_IsEnabledFallback
Feature_4205292859__private_IsEnabledFallback
Feature_591104313__private_IsEnabledFallback
Feature_709593401__private_IsEnabledFallback
Feature_EfsLibMemoryLeaks__private_IsEnabledFallback| |paramcount|2|3| |`address`|140008bc8|140001eec| |`sig`|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1,4 @@ +Feature_3174802747__private_IsEnabledFallback +Feature_4205292859__private_IsEnabledFallback +Feature_591104313__private_IsEnabledFallback +Feature_709593401__private_IsEnabledFallback ``` ### wil_details_IsEnabledFallback Diff ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -1,26 +1,22 @@ -uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) +uint wil_details_IsEnabledFallback(ulonglong param_1,int param_2,undefined8 *param_3) { uint uVar1; - undefined4 *puVar2; - ulonglong local_res18; + ulonglong local_res8; uVar1 = (uint)param_1; - local_res18 = (ulonglong)param_1 & 0xffffffff; - if (((ulonglong)param_1 & 2) == 0) { - puVar2 = &Feature_EfsLibMemoryLeaks__private_featureState; - local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - (&Feature_EfsLibMemoryLeaks__private_featureState,(ulonglong)param_1, - 0x140017d90); - param_1 = puVar2; - uVar1 = (uint)local_res18; + local_res8 = param_1 & 0xffffffff; + if ((param_1 & 2) == 0) { + local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*param_3,param_1,(longlong)param_3); + uVar1 = (uint)local_res8; } if ((param_2 != 0) && - (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), - param_2 - 3 < 2)) { - wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); + (wil_details_FeatureReporting_ReportUsageToService((longlong)param_3,local_res8,param_2), + param_2 - 3U < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res8,param_2,param_3); } return uVar1 & 1; } ``` ## FatSetupAllocationSupport ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.4| |i_ratio|0.56| |m_ratio|0.94| |b_ratio|0.7| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|FatSetupAllocationSupport|FatSetupAllocationSupport| |fullname|FatSetupAllocationSupport|FatSetupAllocationSupport| |refcount|4|4| |`length`|1431|1621| |`called`|FatExamineFatEntries
FatInitializeCacheMap
FatLogOf
FatSelectBestWindow
NTOSKRNL.EXE::CcSetFileSizes
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::RtlFindClearBits
NTOSKRNL.EXE::RtlInitializeBitMap
__security_check_cookie|
Expand for full list:
FatExamineFatEntries
FatInitializeCacheMap
FatLogOf
FatSelectBestWindow
Feature_4205292859__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::CcSetFileSizes
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::RtlFindClearBits
NTOSKRNL.EXE::RtlInitializeBitMap
__security_check_cookie
| |calling|FatMountVolume
FatVerifyVolume|FatMountVolume
FatVerifyVolume| |paramcount|2|2| |`address`|140024204|140025234| |`sig`|undefined __fastcall FatSetupAllocationSupport(longlong param_1, ulonglong param_2)|undefined __fastcall FatSetupAllocationSupport(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### FatSetupAllocationSupport Called Diff ```diff --- FatSetupAllocationSupport called +++ FatSetupAllocationSupport called @@ -4,0 +5 @@ +Feature_4205292859__private_IsEnabledDeviceUsageNoInline ``` ### FatSetupAllocationSupport Diff ```diff --- FatSetupAllocationSupport +++ FatSetupAllocationSupport @@ -1,216 +1,226 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -void FatSetupAllocationSupport(longlong param_1,ulonglong param_2) +void FatSetupAllocationSupport(longlong param_1,longlong param_2) { - byte bVar1; - ushort uVar2; + uint uVar1; + byte bVar2; ushort uVar3; ushort uVar4; ushort uVar5; ushort uVar6; - uint uVar7; - char cVar8; - undefined1 uVar9; - uint uVar10; - uint uVar11; + ushort uVar7; + undefined1 auVar8 [12]; + undefined1 auVar9 [16]; + char cVar10; + undefined1 uVar11; uint uVar12; ulonglong uVar13; undefined8 uVar14; - int iVar15; - ulonglong uVar16; - int iVar17; - bool bVar18; + uint uVar15; + int iVar16; + ulonglong uVar17; + int iVar18; + bool bVar19; undefined1 auStackY_98 [32]; - ulonglong local_50; ulonglong local_48; - undefined8 local_40; - ulonglong local_38; + ulonglong local_40; + undefined8 local_38; + ulonglong local_30; - local_38 = __security_cookie ^ (ulonglong)auStackY_98; + local_30 = __security_cookie ^ (ulonglong)auStackY_98; uVar12 = (uint)*(ushort *)(param_2 + 0x12a); if (*(ushort *)(param_2 + 0x12a) == 0) { uVar12 = *(uint *)(param_2 + 0x138); } - uVar2 = *(ushort *)(param_2 + 0x12e); - uVar11 = (uint)uVar2; - if (uVar2 == 0) { - uVar16 = param_2; - if (0xffffffff < (ulonglong)*(ushort *)(param_2 + 0x120) * (ulonglong)*(uint *)(param_2 + 0x13c) - ) goto LAB_0; - uVar13 = (ulonglong)*(byte *)(param_2 + 0x126) * (ulonglong)*(uint *)(param_2 + 0x13c); - uVar16 = 0xffffffff; - if (0xffffffff < uVar13) goto LAB_0; - uVar10 = (uint)*(ushort *)(param_2 + 0x124) + (int)uVar13; - bVar18 = uVar10 < *(ushort *)(param_2 + 0x124); - uVar7 = 0xffffffff; - if (!bVar18) { - uVar7 = uVar10; - } - uVar16 = (ulonglong)uVar7; - if (bVar18) goto LAB_0; + if (*(ushort *)(param_2 + 0x12e) == 0) { + uVar17 = (ulonglong)*(ushort *)(param_2 + 0x120) * (ulonglong)*(uint *)(param_2 + 0x13c); + if (0xffffffff < uVar17) goto LAB_0; + uVar13 = Feature_4205292859__private_IsEnabledDeviceUsageNoInline(); + if (((((int)uVar13 != 0) && + ((uVar17 = (ulonglong)*(byte *)(param_2 + 0x126) * (uVar17 & 0xffffffff), + 0xffffffff < uVar17 || + (uVar15 = (uint)*(ushort *)(param_2 + 0x124) * (uint)*(ushort *)(param_2 + 0x120), + uVar15 + (int)uVar17 < uVar15)))) || + (uVar17 = (ulonglong)*(byte *)(param_2 + 0x126) * (ulonglong)*(uint *)(param_2 + 0x13c), + 0xffffffff < uVar17)) || + (uVar15 = (int)uVar17 + (uint)*(ushort *)(param_2 + 0x124), + uVar15 < *(ushort *)(param_2 + 0x124))) goto LAB_0; + bVar19 = uVar12 < uVar15; } else { - uVar3 = *(ushort *)(param_2 + 0x124); - uVar16 = (ulonglong)uVar3; - uVar10 = uVar11 * *(byte *)(param_2 + 0x126) + (uint)uVar3; - if (uVar10 < uVar3) goto LAB_0; - uVar13 = (ulonglong)*(ushort *)(param_2 + 0x128) << 5; - uVar16 = uVar13 % (ulonglong)*(ushort *)(param_2 + 0x120); - uVar7 = (int)(uVar13 / *(ushort *)(param_2 + 0x120)) + uVar10; - if (uVar7 < uVar10) goto LAB_0; - } - if (uVar7 <= uVar12) { - uVar3 = *(ushort *)(param_2 + 0x120); - uVar12 = uVar11; - if (uVar2 == 0) { + uVar15 = (uint)*(ushort *)(param_2 + 0x12e) * (uint)*(byte *)(param_2 + 0x126) + + (uint)*(ushort *)(param_2 + 0x124); + if (uVar15 < *(ushort *)(param_2 + 0x124)) goto LAB_0; + uVar17 = (ulonglong)*(ushort *)(param_2 + 0x128) << 5; + uVar1 = (int)(uVar17 / *(ushort *)(param_2 + 0x120)) + uVar15; + if ((uVar1 < uVar15) || (uVar12 < uVar1)) goto LAB_0; + uVar13 = Feature_4205292859__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar13 == 0) goto LAB_1; + uVar13 = (ulonglong)*(byte *)(param_2 + 0x126) * + (ulonglong)*(ushort *)(param_2 + 0x12e) * (ulonglong)*(ushort *)(param_2 + 0x120); + if ((0xffffffff < uVar13) || + (uVar15 = (uint)*(ushort *)(param_2 + 0x124) * (uint)*(ushort *)(param_2 + 0x120), + uVar12 = (int)uVar13 + uVar15, uVar12 < uVar15)) goto LAB_0; + bVar19 = uVar12 + (int)uVar17 < uVar12; + } + if (!bVar19) { +LAB_1: + uVar3 = *(ushort *)(param_2 + 0x12e); + uVar4 = *(ushort *)(param_2 + 0x120); + uVar12 = (uint)uVar3; + if (uVar3 == 0) { uVar12 = *(uint *)(param_2 + 0x13c); } - uVar4 = *(ushort *)(param_2 + 0x124); - iVar17 = (uint)uVar3 * (uint)uVar4; - bVar1 = *(byte *)(param_2 + 0x126); - *(ulonglong *)(param_2 + 0x158) = (ulonglong)((uint)bVar1 * uVar3 * uVar12 + iVar17); - uVar5 = *(ushort *)(param_2 + 0x128); - *(uint *)(param_2 + 0x168) = (uint)uVar5 * 0x20; - uVar12 = uVar11; - if (uVar2 == 0) { + uVar5 = *(ushort *)(param_2 + 0x124); + iVar18 = (uint)uVar4 * (uint)uVar5; + bVar2 = *(byte *)(param_2 + 0x126); + *(ulonglong *)(param_2 + 0x158) = (ulonglong)((uint)bVar2 * uVar4 * uVar12 + iVar18); + uVar6 = *(ushort *)(param_2 + 0x128); + *(uint *)(param_2 + 0x168) = (uint)uVar6 * 0x20; + uVar12 = (uint)uVar3; + if (uVar3 == 0) { uVar12 = *(uint *)(param_2 + 0x13c); } *(ulonglong *)(param_2 + 0x160) = - (ulonglong)((uint)bVar1 * uVar3 * uVar12 + iVar17 + (uint)uVar5 * 0x20); - uVar6 = *(ushort *)(param_2 + 0x12a); - uVar12 = (uint)uVar6; - if (uVar2 == 0) { - uVar11 = uVar12; - if (uVar6 == 0) { - uVar11 = *(uint *)(param_2 + 0x138); - } - uVar16 = (ulonglong)*(byte *)(param_2 + 0x122); - uVar11 = ((uVar11 - (uint)bVar1 * *(int *)(param_2 + 0x13c)) - (uint)uVar4) / + (ulonglong)((uint)bVar2 * uVar4 * uVar12 + iVar18 + (uint)uVar6 * 0x20); + uVar7 = *(ushort *)(param_2 + 0x12a); + uVar12 = (uint)uVar7; + if (uVar3 == 0) { + uVar15 = uVar12; + if (uVar7 == 0) { + uVar15 = *(uint *)(param_2 + 0x138); + } + uVar17 = (ulonglong)*(byte *)(param_2 + 0x122); + uVar15 = ((uVar15 - (uint)bVar2 * *(int *)(param_2 + 0x13c)) - (uint)uVar5) / (uint)*(byte *)(param_2 + 0x122); } else { - uVar10 = uVar12; - if (uVar6 == 0) { - uVar10 = *(uint *)(param_2 + 0x138); - } - uVar16 = (ulonglong)*(byte *)(param_2 + 0x122); - uVar11 = (uint)((((ulonglong)uVar10 - (ulonglong)(uVar11 * bVar1 + (uint)uVar4)) - - SUB168((ZEXT216(uVar5) << 5) / ZEXT216(uVar3),0)) / uVar16); - } - *(uint *)(param_2 + 0x16c) = uVar11; - if (uVar2 == 0) { - cVar8 = ' '; - } - else { - if (uVar6 == 0) { + uVar15 = uVar12; + if (uVar7 == 0) { + uVar15 = *(uint *)(param_2 + 0x138); + } + uVar17 = (ulonglong)*(byte *)(param_2 + 0x122); + auVar8._8_4_ = 0; + auVar8._0_8_ = CONCAT62(0,uVar4); + uVar15 = (uint)((((ulonglong)uVar15 - SUB128((ZEXT212(uVar6) << 5) / auVar8,0)) - + (ulonglong)((uint)bVar2 * (uint)uVar3 + (uint)uVar5)) / uVar17); + } + *(uint *)(param_2 + 0x16c) = uVar15; + if (uVar3 == 0) { + cVar10 = ' '; + } + else { + if (uVar7 == 0) { uVar12 = *(uint *)(param_2 + 0x138); } - cVar8 = (-(((((ulonglong)uVar12 - SUB168((ZEXT216(uVar5) << 5) / ZEXT216(uVar3),0)) - - (ulonglong)bVar1 * (ulonglong)uVar2) - (ulonglong)uVar4) / uVar16 < 0xff7) & 0xfcU - ) + 0x10; - } - *(char *)(param_2 + 0x178) = cVar8; - uVar9 = FatLogOf((uint)uVar3); - *(undefined1 *)(param_2 + 0x179) = uVar9; - uVar9 = FatLogOf((uint)*(ushort *)(param_2 + 0x120) * (uint)*(byte *)(param_2 + 0x122)); - *(undefined1 *)(param_2 + 0x17a) = uVar9; + auVar9._8_8_ = 0; + auVar9._0_8_ = CONCAT62(0,uVar4); + cVar10 = (-(((((ulonglong)uVar12 - SUB168((ZEXT216(uVar6) << 5) / auVar9,0)) - + (ulonglong)bVar2 * (ulonglong)uVar3) - (ulonglong)uVar5) / uVar17 < 0xff7) & + 0xfcU) + 0x10; + } + *(char *)(param_2 + 0x178) = cVar10; + uVar11 = FatLogOf((uint)uVar4); + *(undefined1 *)(param_2 + 0x179) = uVar11; + uVar11 = FatLogOf((uint)*(ushort *)(param_2 + 0x120) * (uint)*(byte *)(param_2 + 0x122)); + *(undefined1 *)(param_2 + 0x17a) = uVar11; *(undefined4 *)(param_2 + 0x170) = 0; *(undefined4 *)(param_2 + 0x174) = 0x1000; if (*(char *)(param_2 + 0x178) == ' ') { uVar12 = *(uint *)(param_2 + 0x13c); } else { uVar12 = (uint)*(ushort *)(param_2 + 0x12e); } - uVar2 = *(ushort *)(param_2 + 0x12e); - if (uVar2 == 0) { - uVar16 = 0x20; + uVar3 = *(ushort *)(param_2 + 0x12e); + if (uVar3 == 0) { + uVar17 = 0x20; } else { if (*(ushort *)(param_2 + 0x12a) == 0) { - uVar16 = (ulonglong)*(uint *)(param_2 + 0x138); - } - else { - uVar16 = (ulonglong)*(ushort *)(param_2 + 0x12a); - } - uVar16 = (-(ulonglong) - ((((uVar16 - SUB168((ZEXT216(*(ushort *)(param_2 + 0x128)) << 5) / + uVar17 = (ulonglong)*(uint *)(param_2 + 0x138); + } + else { + uVar17 = (ulonglong)*(ushort *)(param_2 + 0x12a); + } + uVar17 = (-(ulonglong) + ((((uVar17 - SUB168((ZEXT216(*(ushort *)(param_2 + 0x128)) << 5) / ZEXT216(*(ushort *)(param_2 + 0x120)),0)) - - (ulonglong)*(byte *)(param_2 + 0x126) * (ulonglong)uVar2) - + (ulonglong)*(byte *)(param_2 + 0x126) * (ulonglong)uVar3) - (ulonglong)*(ushort *)(param_2 + 0x124)) / (ulonglong)*(byte *)(param_2 + 0x122) < 0xff7) & 0xfffffffffffffffc) + 0x10; } - uVar3 = *(ushort *)(param_2 + 0x120); - uVar16 = ((ulonglong)uVar12 * (ulonglong)uVar3 * 8) / uVar16 - 2; - if (uVar16 < *(uint *)(param_2 + 0x16c)) { - *(int *)(param_2 + 0x16c) = (int)uVar16; - } - local_48 = 0; - if (uVar2 == 0) { - iVar17 = (uint)uVar3 * *(int *)(param_2 + 0x13c); - } - else { - iVar17 = (uint)uVar2 * (uint)uVar3; - } - uVar11 = (uint)*(ushort *)(param_2 + 0x124) * (uint)uVar3; - uVar12 = iVar17 + uVar11; - if (uVar11 <= uVar12) { - local_50 = (ulonglong)uVar12; - local_40 = 0x7fffffffffffffff; - local_48 = local_50; + uVar4 = *(ushort *)(param_2 + 0x120); + uVar17 = ((ulonglong)uVar12 * (ulonglong)uVar4 * 8) / uVar17 - 2; + if (uVar17 < *(uint *)(param_2 + 0x16c)) { + *(int *)(param_2 + 0x16c) = (int)uVar17; + } + local_40 = 0; + if (uVar3 == 0) { + iVar18 = (uint)uVar4 * *(int *)(param_2 + 0x13c); + } + else { + iVar18 = (uint)uVar3 * (uint)uVar4; + } + uVar15 = (uint)*(ushort *)(param_2 + 0x124) * (uint)uVar4; + uVar12 = iVar18 + uVar15; + if (uVar15 <= uVar12) { + local_48 = (ulonglong)uVar12; + local_38 = 0x7fffffffffffffff; + local_40 = local_48; if (*(longlong *)(*(longlong *)(param_2 + 0x2d8) + 0x30) == 0) { FatInitializeCacheMap - (*(longlong *)(param_2 + 0x2d8),&local_50, - (ulonglong)CONCAT11((char)(uVar3 >> 8),1),&DAT_1,param_2); + (*(longlong *)(param_2 + 0x2d8),&local_48, + (ulonglong)CONCAT11((char)(uVar4 >> 8),1),&DAT_2,param_2); } else { CcSetFileSizes(); } if ((*(char *)(param_2 + 0x178) == ' ') && (uVar12 = *(uint *)(param_2 + 0x16c), 0x10000 < uVar12)) { if (uVar12 + 0xffff < uVar12) { *(undefined4 *)(param_1 + 0x48) = 0xc0000102; /* WARNING: Subroutine does not return */ ExRaiseStatus(); } uVar12 = uVar12 + 0xffff >> 0x10; *(uint *)(param_2 + 0xd8) = uVar12; } else { *(undefined4 *)(param_2 + 0xd8) = 1; uVar12 = 1; } uVar14 = ExAllocatePoolWithTag(0x411,uVar12 * 0xc,0x57746146); *(undefined8 *)(param_2 + 0xe0) = uVar14; RtlInitializeBitMap(param_2 + 0x1c0,0,0); if (*(uint *)(param_2 + 0xd8) < 2) { *(undefined4 **)(param_2 + 0xe8) = *(undefined4 **)(param_2 + 0xe0); **(undefined4 **)(param_2 + 0xe0) = 2; *(int *)(*(longlong *)(param_2 + 0xe8) + 4) = *(int *)(param_2 + 0x16c) + 1; } else { FatExamineFatEntries(param_1,param_2,2,*(int *)(param_2 + 0x16c) + 1,'\x01',(uint *)0x0,0); uVar12 = FatSelectBestWindow(param_2); *(ulonglong *)(param_2 + 0xe8) = *(longlong *)(param_2 + 0xe0) + (ulonglong)uVar12 * 0xc; } FatExamineFatEntries(param_1,param_2,0,0,'\0',*(uint **)(param_2 + 0xe8),0); - iVar17 = RtlFindClearBits(param_2 + 0x1c0,1,0); - iVar15 = iVar17 + 2; - if (iVar17 == -1) { - iVar15 = 2; - } - *(int *)(param_2 + 0x2f8) = iVar15; + iVar18 = RtlFindClearBits(param_2 + 0x1c0,1,0); + iVar16 = iVar18 + 2; + if (iVar18 == -1) { + iVar16 = 2; + } + *(int *)(param_2 + 0x2f8) = iVar16; return; } *(undefined4 *)(param_1 + 0x48) = 0xc0000102; /* WARNING: Subroutine does not return */ ExRaiseStatus(); } LAB_0: *(undefined4 *)(param_1 + 0x48) = 0xc0000102; /* WARNING: Subroutine does not return */ - ExRaiseStatus(0xc0000102,uVar16); + ExRaiseStatus(); } ``` ## EfspValidateStreamTransitionMetadata ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.29| |i_ratio|0.31| |m_ratio|0.85| |b_ratio|0.84| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|EfspValidateStreamTransitionMetadata|EfspValidateStreamTransitionMetadata| |fullname|EfspValidateStreamTransitionMetadata|EfspValidateStreamTransitionMetadata| |refcount|2|2| |`length`|319|456| |`called`|EfspTraceLogAssert
NTOSKRNL.EXE::RtlCompareMemory|EfspTraceLogAssert
Feature_591104313__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::RtlCompareMemory
NTOSKRNL.EXE::RtlLogUnexpectedCodepath
__security_check_cookie| |calling|EfspLocateStreamTransitionMetadata|EfspLocateStreamTransitionMetadata| |paramcount|3|3| |`address`|140057a6c|140058bfc| |`sig`|undefined8 __fastcall EfspValidateStreamTransitionMetadata(ulonglong param_1, ulonglong param_2, ulonglong param_3)|undefined8 __fastcall EfspValidateStreamTransitionMetadata(undefined4 * param_1, undefined4 * param_2, ulonglong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### EfspValidateStreamTransitionMetadata Called Diff ```diff --- EfspValidateStreamTransitionMetadata called +++ EfspValidateStreamTransitionMetadata called @@ -1,0 +2 @@ +Feature_591104313__private_IsEnabledDeviceUsageNoInline @@ -2,0 +4,2 @@ +NTOSKRNL.EXE::RtlLogUnexpectedCodepath +__security_check_cookie ``` ### EfspValidateStreamTransitionMetadata Diff ```diff --- EfspValidateStreamTransitionMetadata +++ EfspValidateStreamTransitionMetadata @@ -1,55 +1,86 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined8 -EfspValidateStreamTransitionMetadata(ulonglong param_1,ulonglong param_2,ulonglong param_3) +EfspValidateStreamTransitionMetadata(undefined4 *param_1,undefined4 *param_2,ulonglong param_3) { ushort uVar1; - uint uVar2; - ushort uVar3; - longlong lVar4; + ushort uVar2; + longlong lVar3; + ulonglong uVar4; ushort uVar5; - ulonglong uVar7; + undefined4 *puVar6; + undefined4 *puVar7; undefined8 uVar8; - ulonglong uVar6; + undefined1 auStack_58 [32]; + undefined4 local_38; + undefined4 local_34; + undefined4 local_30; + ulonglong local_28; - uVar1 = *(ushort *)(param_1 + 0x1c); - uVar6 = param_1; - lVar4 = RtlCompareMemory(param_1,"EFSSTRAN",8); - if ((((lVar4 == 8) && (*(int *)(param_1 + 8) == 1)) && (*(short *)(param_1 + 0x1e) == 0)) && - (((*(int *)(param_1 + 0x20) == 0 && (*(int *)(param_1 + 0x24) == 0)) && - ((uVar2 = *(uint *)(param_1 + 0x18), 0x2f < uVar2 && - ((ulonglong)uVar2 == (param_3 & 0xffffffff) - 0x18)))))) { + local_28 = __security_cookie ^ (ulonglong)auStack_58; + uVar1 = *(ushort *)(param_1 + 7); + puVar6 = param_1; + lVar3 = RtlCompareMemory(param_1,"EFSSTRAN",8); + if ((((lVar3 == 8) && (param_1[2] == 1)) && (*(short *)((longlong)param_1 + 0x1e) == 0)) && + (((param_1[8] == 0 && (param_1[9] == 0)) && + ((0x2f < (uint)param_1[6] && + (puVar6 = (undefined4 *)((param_3 & 0xffffffff) - 0x18), + (undefined4 *)(ulonglong)(uint)param_1[6] == puVar6)))))) { uVar5 = uVar1 - 8; - uVar6 = (ulonglong)uVar5; - uVar3 = 0; + puVar6 = (undefined4 *)(ulonglong)uVar5; + uVar2 = 0; if (7 < uVar1) { - uVar3 = uVar5; + uVar2 = uVar5; } - if ((ulonglong)uVar3 + 0x48 <= (param_3 & 0xffffffff)) { - if (((*(byte *)(param_1 + 0xc) & 1) == 0) && (*(short *)(param_1 + 0x1c) != 0)) { - uVar8 = 0x21d4; + if ((ulonglong)uVar2 + 0x48 <= (param_3 & 0xffffffff)) { + uVar4 = Feature_591104313__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar4 == 0) { +LAB_0: + if ((*(byte *)(param_1 + 3) & 1) == 0) goto LAB_1; } else { - uVar7 = param_1 + uVar2; - if (uVar7 == param_2) { - uVar6 = uVar7; - lVar4 = RtlCompareMemory(uVar7,"EFSSTRFT",8); - if ((((lVar4 == 8) && (*(int *)(uVar7 + 8) == 1)) && (*(int *)(uVar7 + 0x10) == 0)) && - (*(int *)(uVar7 + 0x14) == 0)) { - return 0; + if ((*(byte *)(param_1 + 3) & 1) != 0) { + lVar3 = *(longlong *)(param_1 + 4); + if ((lVar3 != -1) && + ((lVar3 < 0 || + (puVar6 = (undefined4 *)0x1ff, uVar4 = lVar3 >> 0x3f & 0x1ff, + (lVar3 + uVar4 & 0x1ff) != uVar4)))) { + puVar6 = &local_38; + local_38 = 0x3be900c; + local_34 = 1; + local_30 = 0xc000090b; + RtlLogUnexpectedCodepath(); + uVar8 = 0x21d7; + goto LAB_2; } - uVar8 = 0x21ec; + goto LAB_0; } - else { - uVar8 = 0x21df; +LAB_1: + if (*(short *)(param_1 + 7) != 0) { + uVar8 = 0x21e3; + goto LAB_2; } } - goto LAB_0; + puVar7 = (undefined4 *)((ulonglong)(uint)param_1[6] + (longlong)param_1); + if (puVar7 == param_2) { + puVar6 = puVar7; + lVar3 = RtlCompareMemory(puVar7,"EFSSTRFT",8); + if ((((lVar3 == 8) && (puVar7[2] == 1)) && (puVar7[4] == 0)) && (puVar7[5] == 0)) { + return 0; + } + uVar8 = 0x21fb; + } + else { + uVar8 = 0x21ee; + } + goto LAB_2; } } - uVar8 = 0x21c9; -LAB_0: - EfspTraceLogAssert(uVar6,6,uVar8,0xc000090b); + uVar8 = 0x21ca; +LAB_2: + EfspTraceLogAssert(puVar6,6,uVar8,0xc000090b); return 0xc000090b; } ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.4| |i_ratio|0.37| |m_ratio|0.9| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|2|2| |`length`|76|91| |called||| |calling|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |paramcount|2|3| |`address`|140008a5c|140001d70| |`sig`|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath Diff ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -1,41 +1,52 @@ -void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath + (uint param_1,int param_2,undefined8 *param_3) { - uint uVar1; + uint *puVar1; uint uVar2; uint uVar3; - bool bVar4; + uint uVar4; + bool bVar5; + puVar1 = (uint *)*param_3; if (param_2 == 3) { - uVar3 = 0x10; + uVar4 = 0x10; } else { if (param_2 != 4) { return; } - uVar3 = 0x20; + uVar4 = 0x20; } - if ((Feature_EfsLibMemoryLeaks__private_featureState & 2) != 0) { - uVar2 = Feature_EfsLibMemoryLeaks__private_featureState; - while ((uVar2 & 1) == (param_1 & 1)) { - LOCK(); - bVar4 = uVar2 == Feature_EfsLibMemoryLeaks__private_featureState; - uVar1 = uVar3 | uVar2; - if (!bVar4) { - uVar2 = Feature_EfsLibMemoryLeaks__private_featureState; - uVar1 = Feature_EfsLibMemoryLeaks__private_featureState; - } - Feature_EfsLibMemoryLeaks__private_featureState = uVar1; - UNLOCK(); - if (bVar4) { - return; - } - if ((uVar2 & 2) == 0) { - return; + if ((*(char *)((longlong)param_3 + 0x1e) == '\0') && (*(char *)((longlong)param_3 + 0x1d) == '\0') + ) { + if ((*puVar1 & 2) != 0) { + uVar3 = *puVar1; + while ((uVar3 & 1) == (param_1 & 1)) { + LOCK(); + uVar2 = *puVar1; + bVar5 = uVar3 == uVar2; + if (bVar5) { + *puVar1 = uVar4 | uVar3; + uVar2 = uVar3; + } + UNLOCK(); + if (bVar5) { + return; + } + uVar3 = uVar2; + if ((uVar2 & 2) == 0) { + return; + } } } + } + else { + LOCK(); + *puVar1 = *puVar1 | uVar4; + UNLOCK(); } return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|45|46| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|14000d658|14000d7c8| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## EfspClipSpFree ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.66| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|EfspClipSpFree|EfspClipSpFree| |fullname|EfspClipSpFree|EfspClipSpFree| |`refcount`|4|5| |length|98|98| |called|EXT-MS-WIN-CRYPTO-XBOX-L1-1-0.DLL::XboxCryptoFree
EfspEnsureClipSpFunctionTableLoaded
_guard_dispatch_icall|EXT-MS-WIN-CRYPTO-XBOX-L1-1-0.DLL::XboxCryptoFree
EfspEnsureClipSpFunctionTableLoaded
_guard_dispatch_icall| |`calling`|EfspConstructNewPfileHeader
EfspPostCreateImpersonateAndGetData|EfsDecryptFek
EfspConstructNewPfileHeader
EfspPostCreateImpersonateAndGetData| |paramcount|1|1| |`address`|14005895c|140059bcc| |sig|int __fastcall EfspClipSpFree(longlong param_1)|int __fastcall EfspClipSpFree(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### EfspClipSpFree Calling Diff ```diff --- EfspClipSpFree calling +++ EfspClipSpFree calling @@ -0,0 +1 @@ +EfsDecryptFek ``` ## __security_check_cookie ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|81|82| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
ComputeFlushPeriod
DplWrapDeriveKey
DplWrapProtect
EEL_DplStateChange_WriteEvent
EEL_EtwEventHandler
EEL_GetUserSidStringForToken
EEL_LogInternalError
EEL_PolicyUpdate_WriteEvent
EdpEnforcementLog_AutomaticEncryption
EdpEnforcementLog_FileAccessDenied
EdpEnforcementLog_FileRequiresEncryptionEfsCngDesExpand128To192
EfsDecryptFekClient
EfsGenerateKeyClient
EfsInitFekProtection
EfsOpenFile
EfsReadEfsData
EfsRpcInit
EfspClipSpDecryptFek
EfspConstructNewPfileHeader
EfspFileRequiresEncryption
EfspIsCryptoOffloadTurnedOffByOverride
EfspPostCreate
EfspPostCreatePrepareAndSendFsctl
EfspTraceLogAssert
EfspValidateAndParseFsctl
EnableFlushTimer
FatCheckManageVolumeAccess
FatCommonCreate
FatConstructDirent
FatConvertQueryStringTo8dot3
FatCreateEncryptOnCloseProcessing
FatCreateNewDirectory
FatCreateNewFile
FatDeleteEfsAttributeOnDirectory
FatDetermineAndMarkFcbCondition
FatExplicitDeviceAccessGranted
FatFatDateToNtTime
FatFatTimeToNtTime
FatGetCompatibilityModeValue
FatGetCurrentFatTime
FatGetEaLength
FatGetNeedEaCount
FatGetUnicodeNameFromFcb
FatInitializeVcb
FatIsDirectoryEmpty
FatIsFujitsuFMR
FatLocateDirent
FatMountVolume
FatNonCachedIo
FatNtTimeToFatTime
FatPrefetchPages
FatQueryDirectory
FatQueryNameInfo
FatQueryShortNameInfo
FatSearchBufferForLabel
FatSearchRemainderOfDirectoryForCollisions
FatSelectNames
FatSetFatRun
FatSetFsLabelInfo
FatSetPfileExtensionOnDisk
FatSetRenameInfo
FatSetupAllocationSupport
FatSqmAddToStreamEx
FatSqmVolumeInfo
FatTelemetryMount
FatTelemetryPeriodicVolume
FatTunnelFcbOrDcb
FatVerifyVolume
LookUpTableFlushComplete
QueryAttributes
SetKeyTable
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
_tlgWriteTemplate::Write<_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>,_tlgWrapperByRef<16>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>_>
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates
|
Expand for full list:
ComputeFlushPeriod
DplWrapDeriveKey
DplWrapProtect
EEL_DplStateChange_WriteEvent
EEL_EtwEventHandler
EEL_GetUserSidStringForToken
EEL_LogInternalError
EEL_PolicyUpdate_WriteEvent
EdpEnforcementLog_AutomaticEncryption
EdpEnforcementLog_FileAccessDenied
EdpEnforcementLog_FileRequiresEncryptionEfsCngDesExpand128To192
EfsDecryptFekClient
EfsGenerateKeyClient
EfsInitFekProtection
EfsOpenFile
EfsReadEfsData
EfsRpcInit
EfspClipSpDecryptFek
EfspConstructNewPfileHeader
EfspFileRequiresEncryption
EfspIsCryptoOffloadTurnedOffByOverride
EfspPostCreate
EfspPostCreatePrepareAndSendFsctl
EfspTraceLogAssert
EfspValidateAndParseFsctl
EfspValidateStreamTransitionMetadata
EnableFlushTimer
FatCheckManageVolumeAccess
FatCommonCreate
FatConstructDirent
FatConvertQueryStringTo8dot3
FatCreateEncryptOnCloseProcessing
FatCreateNewDirectory
FatCreateNewFile
FatDeleteEfsAttributeOnDirectory
FatDetermineAndMarkFcbCondition
FatExplicitDeviceAccessGranted
FatFatDateToNtTime
FatFatTimeToNtTime
FatGetCompatibilityModeValue
FatGetCurrentFatTime
FatGetEaLength
FatGetNeedEaCount
FatGetUnicodeNameFromFcb
FatInitializeVcb
FatIsDirectoryEmpty
FatIsFujitsuFMR
FatLocateDirent
FatMountVolume
FatNonCachedIo
FatNtTimeToFatTime
FatPrefetchPages
FatQueryDirectory
FatQueryNameInfo
FatQueryShortNameInfo
FatSearchBufferForLabel
FatSearchRemainderOfDirectoryForCollisions
FatSelectNames
FatSetFatRun
FatSetFsLabelInfo
FatSetPfileExtensionOnDisk
FatSetRenameInfo
FatSetupAllocationSupport
FatSqmAddToStreamEx
FatSqmVolumeInfo
FatTelemetryMount
FatTelemetryPeriodicVolume
FatTunnelFcbOrDcb
FatVerifyVolume
LookUpTableFlushComplete
QueryAttributes
SetKeyTable
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
_tlgWriteTemplate::Write<_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>,_tlgWrapperByRef<16>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>_>
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates
| |paramcount|1|1| |`address`|14000d860|14000d9d0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -26,0 +27 @@ +EfspValidateStreamTransitionMetadata ``` ## NTOSKRNL.EXE::ExRaiseStatus ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|ExRaiseStatus|ExRaiseStatus| |fullname|NTOSKRNL.EXE::ExRaiseStatus|NTOSKRNL.EXE::ExRaiseStatus| |`refcount`|155|156| |length|0|0| |called||| |calling|
Expand for full list:
EfsXtsAesDec
EfsXtsAesEnc
FatAddEaSet
FatAllocateDiskSpace
FatCommonCleanup
FatCommonCreate
FatCommonCreateOnNewStack
FatCommonRead
FatCommonWrite
FatComputeMoveFileSplicePoints
FatCreateEaFatCreateIrpContext
FatCreateNewDirectory
FatCreateNewDirent
FatCreateNewFile
FatDeleteEa
FatDeleteEaSet
FatExamineFatEntries
FatFlushDirentForFile
FatFlushFat
FatFlushFatEntries
FatForceCacheMiss
FatGetDirentFromFcbOrDcb
FatGetEaFile
FatGetEaLength
FatGetEfsInfoFromHeaderOnDisk
FatGetNeedEaCount
FatGetRetrievalPointers
FatGetUnicodeNameFromFcb
FatLocateDirent
FatLockUserBuffer
FatLookupFatEntry
FatLookupFileAllocation
FatLookupFileAllocationSize
FatMapUserBuffer
FatMarkVolume
FatMountVolume
FatMoveFile
FatMultipleAsync
FatNonCachedIo
FatNonCachedNonAlignedRead
FatNotifyChangeDirectory
FatOpenExistingDcb
FatOpenExistingDirectory
FatOpenExistingFcb
FatOpenExistingFile
FatPerformVerify
FatPerformVerifyDiskRead
FatPinEaRange
FatPinMappedData
FatPrepareWriteDirectoryFile
FatPrepareWriteVolumeFile
FatQuickVerifyVcb
FatReadDirectoryFile
FatReadEaSet
FatReadVolumeFile
FatSetDispositionInfo
FatSetEndOfFileInfo
FatSetFatEntry
FatSetFatRun
FatSetFullNameInFcb
FatSetPfileExtensionOnDisk
FatSetupAllocationSupport
FatSingleNonAlignedSync
FatSupersedeOrOverwriteFile
FatUnicodeToUpcaseOem
FatUnpinRepinnedBcbs
FatVerifyFcb
FatVerifyLookupFatEntry
FatVerifyOperationIsLegal
FatVerifyVcb
FatVerifyVolume
NtOfsSetLength
|
Expand for full list:
EfsXtsAesDec
EfsXtsAesEnc
FatAddEaSet
FatAllocateDiskSpace
FatCommonCleanup
FatCommonCreate
FatCommonCreateOnNewStack
FatCommonRead
FatCommonWrite
FatComputeMoveFileSplicePoints
FatCreateEaFatCreateIrpContext
FatCreateNewDirectory
FatCreateNewDirent
FatCreateNewFile
FatDeleteEa
FatDeleteEaSet
FatExamineFatEntries
FatFlushDirentForFile
FatFlushFat
FatFlushFatEntries
FatForceCacheMiss
FatGetDirentFromFcbOrDcb
FatGetEaFile
FatGetEaLength
FatGetEfsInfoFromHeaderOnDisk
FatGetNeedEaCount
FatGetRetrievalPointers
FatGetUnicodeNameFromFcb
FatLocateDirent
FatLockUserBuffer
FatLookupFatEntry
FatLookupFileAllocation
FatLookupFileAllocationSize
FatMapUserBuffer
FatMarkVolume
FatMountVolume
FatMoveFile
FatMultipleAsync
FatNonCachedIo
FatNonCachedNonAlignedRead
FatNotifyChangeDirectory
FatOpenExistingDcb
FatOpenExistingDirectory
FatOpenExistingFcb
FatOpenExistingFile
FatPerformVerify
FatPerformVerifyDiskRead
FatPinEaRange
FatPinMappedData
FatPrepareWriteDirectoryFile
FatPrepareWriteVolumeFile
FatQuickVerifyVcb
FatReadDirectoryFile
FatReadEaSet
FatReadVolumeFile
FatSetDispositionInfo
FatSetEndOfFileInfo
FatSetFatEntry
FatSetFatRun
FatSetFullNameInFcb
FatSetPfileExtensionOnDisk
FatSetupAllocationSupport
FatSingleNonAlignedSync
FatSupersedeOrOverwriteFile
FatUnicodeToUpcaseOem
FatUnpinRepinnedBcbs
FatVerifyFcb
FatVerifyLookupFatEntry
FatVerifyOperationIsLegal
FatVerifyVcb
FatVerifyVolume
NtOfsSetLength
| |paramcount|0|0| |`address`|EXTERNAL:00000110|EXTERNAL:0000010e| |sig|noreturn undefined ExRaiseStatus(void)|noreturn undefined ExRaiseStatus(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## FreeKRpcMemory ### Match Info |Key|fastfat-2026-08.sys - fastfat-2026-09.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.67| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-2026-08.sys|fastfat-2026-09.sys| | :---: | :---: | :---: | |name|FreeKRpcMemory|FreeKRpcMemory| |fullname|FreeKRpcMemory|FreeKRpcMemory| |`refcount`|5|7| |length|19|19| |called|MIDL_user_free|MIDL_user_free| |`calling`|EfspPostCreate
EfspPostCreateImpersonateAndGetData|EfsDecryptFek
EfspPostCreate
EfspPostCreateImpersonateAndGetData| |paramcount|1|1| |`address`|14005869c|14005990c| |sig|undefined __fastcall FreeKRpcMemory(void * param_1)|undefined __fastcall FreeKRpcMemory(void * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### FreeKRpcMemory Calling Diff ```diff --- FreeKRpcMemory calling +++ FreeKRpcMemory calling @@ -0,0 +1 @@ +EfsDecryptFek ``` Generated with `ghidriff` version: 1.0.0 on 2026-09-09T18:33:02