# fastfat.sys 26100.1150 vs 26100.3470 (CVE-2025-24985, manual pair) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_371473723__private_IsEnabledDeviceUsageNoInline](#feature_371473723__private_isenableddeviceusagenoinline) * [Feature_371473723__private_IsEnabledFallback](#feature_371473723__private_isenabledfallback) * [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache) * [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_MapReportingKind](#wil_details_mapreportingkind) * [wil_details_FeatureDescriptors_SkipPadding](#wil_details_featuredescriptors_skippadding) * [wil_details_RecordCachedUsage](#wil_details_recordcachedusage) * [wil_details_RecordFeatureUsageReporting](#wil_details_recordfeatureusagereporting) * [wil_RtlStagingConfig_QueryFeatureState](#wil_rtlstagingconfig_queryfeaturestate) * [wil_UninitializeFeatureStaging](#wil_uninitializefeaturestaging) * [wil_details_BuildFeatureStateCacheFromQueryResults](#wil_details_buildfeaturestatecachefromqueryresults) * [wil_details_EvaluateFeatureDependencies](#wil_details_evaluatefeaturedependencies) * [wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_getcachedfeatureenabledstate) * [wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_reevaluatecachedfeatureenabledstate) * [wil_details_OnFeatureUsageProviderFlushNotification](#wil_details_onfeatureusageproviderflushnotification) * [wil_details_ReevaluateOnFeatureConfigurationChange](#wil_details_reevaluateonfeatureconfigurationchange) * [wil_details_UpdateFeatureConfiguredStates](#wil_details_updatefeatureconfiguredstates) * [wil_InitializeFeatureStaging](#wil_initializefeaturestaging) * [wil_details_PopulateInitialConfiguredFeatureStates](#wil_details_populateinitialconfiguredfeaturestates) * [NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification](#ntoskrnlexertlregisterfeatureconfigurationchangenotification) * [NTOSKRNL.EXE::RtlNotifyFeatureUsage](#ntoskrnlexertlnotifyfeatureusage) * [NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp](#ntoskrnlexertlqueryfeatureconfigurationchangestamp) * [NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider](#ntoskrnlexertlunregisterfeatureusageprovider) * [NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider](#ntoskrnlexertlregisterfeatureusageprovider) * [NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification](#ntoskrnlexertlunregisterfeatureconfigurationchangenotification) * [NTOSKRNL.EXE::RtlRecordFeatureUsage](#ntoskrnlexertlrecordfeatureusage) * [NTOSKRNL.EXE::RtlQueryFeatureConfiguration](#ntoskrnlexertlqueryfeatureconfiguration) * [NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification](#ntoskrnlexertlarmfeatureusageproviderflushnotification) * [Modified](#modified) * [DriverEntry](#driverentry) * [FatExamineFatEntries](#fatexaminefatentries) * [FatSetupAllocationSupport](#fatsetupallocationsupport) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [NTOSKRNL.EXE::IoDeleteDevice](#ntoskrnlexeiodeletedevice) * [__security_check_cookie](#__security_check_cookie) * [NTOSKRNL.EXE::ExRaiseStatus](#ntoskrnlexeexraisestatus) # Visual Chart Diff ```mermaid flowchart LR DriverEntry-1-old<--Match 93%-->DriverEntry-1-new FatExamineFatEntries-7-old<--Match 82%-->FatExamineFatEntries-7-new FatSetupAllocationSupport-2-old<--Match 51%-->FatSetupAllocationSupport-2-new subgraph fastfat-10.0.26100.3470.sys DriverEntry-1-new FatExamineFatEntries-7-new FatSetupAllocationSupport-2-new subgraph Added direction LR Feature_371473723__private_IsEnabledDeviceUsageNoInline Feature_371473723__private_IsEnabledFallback wil_details_FeatureReporting_IncrementOpportunityInCache wil_details_FeatureReporting_IncrementUsageInCache wil_details_FeatureReporting_RecordUsageInCache wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath wil_details_GetCurrentFeatureEnabledState wil_details_IsEnabledFallback wil_details_MapReportingKind wil_details_FeatureDescriptors_SkipPadding wil_details_RecordCachedUsage wil_details_RecordFeatureUsageReporting wil_RtlStagingConfig_QueryFeatureState wil_UninitializeFeatureStaging wil_details_BuildFeatureStateCacheFromQueryResults wil_details_EvaluateFeatureDependencies wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState wil_details_OnFeatureUsageProviderFlushNotification wil_details_ReevaluateOnFeatureConfigurationChange wil_details_UpdateFeatureConfiguredStates wil_InitializeFeatureStaging wil_details_PopulateInitialConfiguredFeatureStates NTOSKRNLEXE-RtlRegisterFeatureConfigurationChangeNotification 10_more_added_funcs_omitted end end subgraph fastfat-10.0.26100.1150.sys DriverEntry-1-old FatExamineFatEntries-7-old FatSetupAllocationSupport-2-old end ``` ```mermaid pie showData title Function Matches - 98.5859% "unmatched_funcs_len" : 35 "matched_funcs_len" : 2440 ``` ```mermaid pie showData title Matched Function Similarity - 99.7131% "matched_funcs_with_code_changes_len" : 3 "matched_funcs_with_non_code_changes_len" : 4 "matched_funcs_no_changes_len" : 2433 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2025-24985\ghidra_projects --project-name CVE-2025-24985 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2025-24985\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title fastfat.sys 26100.1150 vs 26100.3470 (CVE-2025-24985, manual pair) fastfat-10.0.26100.1150.sys fastfat-10.0.26100.3470.sys ``` #### Verbose Args
``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2025-24985\\fastfat-10.0.26100.1150.sys'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2025-24985\\fastfat-10.0.26100.3470.sys']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2025-24985\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2025-24985\ghidra_projects --project-name CVE-2025-24985 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2025-24985\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title fastfat.sys 26100.1150 vs 26100.3470 (CVE-2025-24985, manual pair) ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/FastFAT.Sys/89AB363C6E000/FastFAT.Sys -O fastfat.sys.x64.10.0.26100.1150 wget https://msdl.microsoft.com/download/symbols/FastFAT.Sys/550FB5F16F000/FastFAT.Sys -O fastfat.sys.x64.10.0.26100.3470 ``` ## Binary Metadata Diff ```diff --- fastfat-10.0.26100.1150.sys Meta +++ fastfat-10.0.26100.3470.sys Meta @@ -1,44 +1,44 @@ -Program Name: fastfat-10.0.26100.1150.sys +Program Name: fastfat-10.0.26100.3470.sys Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f -# of Bytes: 452784 +# of Bytes: 456964 # of Memory Blocks: 13 -# of Instructions: 74856 -# of Defined Data: 6904 -# of Functions: 1220 -# of Symbols: 9870 +# of Instructions: 76249 +# of Defined Data: 6988 +# of Functions: 1255 +# of Symbols: 10046 # of Data Types: 393 # of Data Type Categories: 23 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Tue Jul 28 09:18:15 SGT 2026 +Date Created: Tue Jul 28 09:18:20 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2025-24985/fastfat-10.0.26100.1150.sys -Executable MD5: d9e8274572d16d403c4770c60026df2b -Executable SHA256: dd0692b21a0447137a3012d637f2f8efe0ef6441f9aed033f58e40c01d395a1c -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2025-24985/fastfat-10.0.26100.1150.sys?MD5=d9e8274572d16d403c4770c60026df2b +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2025-24985/fastfat-10.0.26100.3470.sys +Executable MD5: 40e07ace2425eb026c3723d03a18d66c +Executable SHA256: 18e4cd134fb3e6d01187183bd63a980f2edf97f84a5766558a7aa373ece6a3e0 +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2025-24985/fastfat-10.0.26100.3470.sys?MD5=40e07ace2425eb026c3723d03a18d66c PDB Age: 1 PDB File: fastfat.pdb -PDB GUID: 7995405f-3cfe-3a75-577e-92c9c3e01563 +PDB GUID: 17e5f80e-ab89-ca20-1587-ab67806befc7 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Fast FAT File System Driver -PE Property[FileVersion]: 10.0.26100.1150 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.3470 (WinBuild.160101.0800) PE Property[InternalName]: fastfat.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: FastFAT.Sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.1150 +PE Property[ProductVersion]: 10.0.26100.3470 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra fastfat-10.0.26100.1150.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra fastfat-10.0.26100.1150.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra fastfat-10.0.26100.1150.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra fastfat-10.0.26100.3470.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra fastfat-10.0.26100.3470.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra fastfat-10.0.26100.3470.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|35| |deleted_funcs_len|0| |modified_funcs_len|7| |added_symbols_len|22| |deleted_symbols_len|0| |diff_time|17.340964555740356| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1219, 'ExternalsName': 348})| |items_to_process|64| |diff_types|Counter({'address': 7, 'refcount': 4, 'code': 3, 'length': 3, 'called': 3, 'calling': 2, 'sig': 1})| |unmatched_funcs_len|35| |total_funcs_len|2475| |matched_funcs_len|2440| |matched_funcs_with_code_changes_len|3| |matched_funcs_with_non_code_changes_len|4| |matched_funcs_no_changes_len|2433| |match_func_similarity_percent|99.7131%| |func_match_overall_percent|98.5859%| |first_matches|Counter({'SymbolsHash': 1219})| ```mermaid pie showData title All Matches "SymbolsHash" : 1219 "ExternalsName" : 348 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1219 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 35 "deleted_funcs_len" : 0 "modified_funcs_len" : 7 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 22 "deleted_symbols_len" : 0 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_371473723__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|Feature_371473723__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_371473723__private_IsEnabledDeviceUsageNoInline| |refcount|5| |length|49| |called|Feature_371473723__private_IsEnabledFallback| |calling|FatExamineFatEntries
FatSetupAllocationSupport| |paramcount|0| |address|1c0001644| |sig|ulonglong __fastcall Feature_371473723__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_371473723__private_IsEnabledDeviceUsageNoInline +++ Feature_371473723__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_371473723__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (undefined4 *)(ulonglong)Feature_371473723__private_featureState; + if ((Feature_371473723__private_featureState & 0x10) == 0) { + uVar1 = Feature_371473723__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_371473723__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_371473723__private_IsEnabledFallback ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|Feature_371473723__private_IsEnabledFallback| |fullname|Feature_371473723__private_IsEnabledFallback| |refcount|2| |length|14| |called|wil_details_IsEnabledFallback| |calling|Feature_371473723__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1c000167c| |sig|undefined __fastcall Feature_371473723__private_IsEnabledFallback(undefined4 * param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_371473723__private_IsEnabledFallback +++ Feature_371473723__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_371473723__private_IsEnabledFallback(undefined4 *param_1,uint param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2); + return; +} + ``` ## wil_details_FeatureReporting_IncrementOpportunityInCache ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementOpportunityInCache| |fullname|wil_details_FeatureReporting_IncrementOpportunityInCache| |refcount|2| |length|208| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|1c0001694| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementOpportunityInCache +++ wil_details_FeatureReporting_IncrementOpportunityInCache @@ -0,0 +1,54 @@ + +void wil_details_FeatureReporting_IncrementOpportunityInCache + (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar2 = *param_1; + do { + uVar4 = uVar2; + param_4[1] = 0; + uVar1 = uVar4 | 1; + if ((uVar4 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) { + uVar2 = (uVar4 & 0x3f8000) >> 0xf; + if (uVar2 != 0) { + param_4[1] = uVar2; + uVar2 = 5; + if (param_2 != 1) { + uVar2 = 1; + } + uVar1 = uVar4 & 0xffc07fff | 1; + param_4[2] = uVar2; + } + uVar2 = 0; + if (param_2 == 5) { + uVar2 = 0x400000; + } + uVar1 = uVar2 | uVar1 & 0xffbfffff; + } + uVar2 = uVar1 >> 0xf & 0x7f; + uVar3 = uVar2 + 1; + if ((0x7f < uVar3) || (uVar3 < uVar2)) { + uVar3 = 1; + param_4[2] = param_2; + param_4[1] = uVar2; + } + LOCK(); + uVar2 = *param_1; + bVar5 = uVar4 == uVar2; + if (bVar5) { + *param_1 = (uVar3 << 0xf ^ uVar1) & 0x3f8000 ^ uVar1; + uVar2 = uVar4; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar4 & 1; + return; +} + ``` ## wil_details_FeatureReporting_IncrementUsageInCache ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementUsageInCache| |fullname|wil_details_FeatureReporting_IncrementUsageInCache| |refcount|2| |length|220| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|1c000176c| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementUsageInCache +++ wil_details_FeatureReporting_IncrementUsageInCache @@ -0,0 +1,50 @@ + +void wil_details_FeatureReporting_IncrementUsageInCache + (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar4 = *param_1; + do { + uVar3 = uVar4; + param_4[1] = 0; + uVar1 = uVar3 | 1; + if ((uVar3 & 0x4000) >> 0xe != (uint)(param_2 == 4)) { + uVar4 = (uVar3 & 0x3fe0) >> 5; + if (uVar4 != 0) { + param_4[1] = uVar4; + param_4[2] = ~-(uint)(param_2 != 0) & 4; + uVar1 = uVar3 & 0xffffc01f | 1; + } + uVar4 = 0; + if (param_2 == 4) { + uVar4 = 0x4000; + } + uVar1 = uVar4 | uVar1 & 0xffffbfff; + } + uVar4 = uVar1 >> 5 & 0x1ff; + uVar2 = uVar4 + 1; + if ((0x1ff < uVar2) || (uVar2 < uVar4)) { + uVar2 = 1; + param_4[2] = param_2; + param_4[1] = uVar4; + } + LOCK(); + uVar4 = *param_1; + bVar5 = uVar3 == uVar4; + if (bVar5) { + *param_1 = (uVar2 << 5 ^ uVar1) & 0x3fe0 ^ uVar1; + uVar4 = uVar3; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar3 & 1; + return; +} + ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2| |length|359| |called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|4| |address|1c0001850| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -0,0 +1,98 @@ + +uint * wil_details_FeatureReporting_RecordUsageInCache + (uint *param_1,uint *param_2,undefined8 param_3,uint param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint uVar5; + bool bVar6; + + uVar3 = (uint)param_3; + param_1[0] = 0; + param_1[1] = 0; + param_1[2] = 0; + param_1[3] = 0; + param_1[4] = 0; + param_1[5] = 0; + if (uVar3 == 0) { +LAB_1c0001999: + wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar3,param_3,param_1); + } + else { + if (uVar3 == 1) { +LAB_1c000198c: + wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar3,param_3,param_1); + return param_1; + } + if ((uVar3 != 2) && (uVar3 != 3)) { + if (uVar3 == 4) goto LAB_1c0001999; + if (uVar3 == 5) goto LAB_1c000198c; + if ((uVar3 != 6) && (uVar3 != 7)) { + uVar4 = uVar3 - 0x140; + if ((int)uVar4 < 0x40) { + uVar5 = param_2[1]; + do { + if (((uVar5 & 0x10) == 0) || (uVar2 = 1, (uVar5 >> 5 & 0x3f) != uVar4)) { + uVar2 = 0; + } + param_1[4] = uVar2; + LOCK(); + uVar2 = param_2[1]; + bVar6 = uVar5 == uVar2; + if (bVar6) { + param_2[1] = (uVar4 * 0x20 ^ uVar5) & 0x7e0 ^ uVar5 | 0x10; + uVar2 = uVar5; + } + uVar5 = uVar2; + UNLOCK(); + } while (!bVar6); + } + param_1[2] = uVar3; + param_1[1] = 1; + param_1[3] = param_4; + return param_1; + } + } + uVar4 = 0; + if (uVar3 == 2) { + uVar4 = 2; + } + else if (uVar3 == 3) { + uVar4 = 8; + } + else if (uVar3 == 6) { + uVar4 = 4; + } + else if (uVar3 == 7) { + uVar4 = 0x10; + } + uVar5 = 1; + uVar3 = *param_2; + do { + uVar1 = uVar3; + uVar3 = uVar4 | uVar1; + param_1[4] = (uint)(uVar3 == uVar1); + uVar2 = uVar3 | 1; + if (uVar3 == uVar1) { + uVar2 = uVar3; + } + LOCK(); + uVar3 = *param_2; + bVar6 = uVar1 == uVar3; + if (bVar6) { + *param_2 = uVar2; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar6); + if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) { + uVar5 = 0; + } + *param_1 = uVar5; + } + return param_1; +} + ``` ## wil_details_FeatureReporting_ReportUsageToService ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService| |refcount|2| |length|114| |called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil_details_IsEnabledFallback| |paramcount|3| |address|1c00019c0| |sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, uint param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -0,0 +1,27 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +void wil_details_FeatureReporting_ReportUsageToService + (undefined8 param_1,undefined8 param_2,uint param_3) + +{ + bool bVar1; + uint uVar2; + undefined7 extraout_var; + ulonglong uVar3; + uint uVar4; + uint local_res18 [4]; + + uVar4 = (uint)param_2 & 1; + uVar3 = (ulonglong)param_3; + local_res18[0] = param_3; + uVar2 = wil_details_MapReportingKind(param_3,uVar4); + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,(ulonglong)uVar2); + if (((int)CONCAT71(extraout_var,bVar1) != 0) && + (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { + (*g_wil_details_pfnFeatureLoggingHook) + (0x353d79b,&Feature_371473723_logged_traits,0,uVar4,local_res18,0,0,1); + } + return; +} + ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2| |length|226| |called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3| |address|1c0001a3c| |sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, ulonglong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -0,0 +1,47 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +bool wil_details_FeatureReporting_ReportUsageToServiceDirect + (undefined8 param_1,undefined8 param_2,ulonglong param_3) + +{ + uint6 uVar1; + uint *puVar2; + undefined1 auStack_88 [32]; + uint *local_68; + undefined8 local_58; + uint local_50 [6]; + uint local_38; + uint uStack_34; + uint uStack_30; + uint uStack_2c; + undefined8 local_28; + ulonglong local_20; + + local_20 = __security_cookie ^ (ulonglong)auStack_88; + puVar2 = wil_details_FeatureReporting_RecordUsageInCache + (local_50,(uint *)&Feature_371473723__private_reporting,param_3, + (uint)((ulonglong)param_2 >> 0x20)); + local_38 = *puVar2; + uStack_34 = puVar2[1]; + uStack_30 = puVar2[2]; + uStack_2c = puVar2[3]; + local_28 = *(undefined8 *)(puVar2 + 4); + if (g_wil_details_recordFeatureUsage != (code *)0x0) { + local_68 = &local_38; + (*g_wil_details_recordFeatureUsage) + (0x353d79b,param_3 & 0xffffffff,1,&Feature_371473723__private_reporting); + } + if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) { + local_58._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),0x353d79b); + uVar1 = (uint6)local_58; + local_58 = (ulonglong)(uint6)local_58; + if (((uint)param_2 >> 0xb & 1) != 0) { + local_58 = CONCAT26(1,uVar1); + } + RtlNotifyFeatureUsage(&local_58); + } + return (int)local_28 == 0; +} + ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3| |length|263| |called|_guard_dispatch_icall
wil_details_GetCurrentFeatureEnabledState| |calling|wil_details_GetCurrentFeatureEnabledState
wil_details_IsEnabledFallback| |paramcount|3| |address|1c0001b28| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -0,0 +1,67 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (uint *param_1,ulonglong param_2,longlong param_3) + +{ + int iVar1; + uint uVar2; + ulonglong uVar3; + uint uVar4; + uint uVar5; + ulonglong uVar6; + bool bVar7; + uint local_res8 [2]; + undefined8 local_res10; + + iVar1 = 0; + local_res8[0] = 0; + local_res10 = param_2; + if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) { + iVar1 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); + } + uVar2 = wil_details_GetCurrentFeatureEnabledState(param_3,local_res8); + if (*(char *)(param_3 + 0x1c) == '\0') { + local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0); + } + uVar3 = param_2 & 0xffffffff; + do { + uVar6 = param_2; + uVar5 = (uint)uVar3; + local_res10 = CONCAT44(local_res10._4_4_,uVar5); + if ((local_res8[0] != 0) && (local_res10 = CONCAT44(local_res10._4_4_,uVar5), (uVar3 & 2) == 0)) + { + uVar4 = uVar5 & 0xfffff63e | uVar2 & 0x9c1; + uVar5 = uVar4 | 2; + local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 2; + } + if ((uVar6 & 4) == 0) { + uVar4 = uVar2 & 0x400 | uVar5 & 0xfffffbff; + uVar5 = uVar4 | 4; + local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 4; + } + uVar3 = uVar6 & 0xffffffff; + LOCK(); + uVar4 = *param_1; + bVar7 = (uint)uVar6 == uVar4; + if (bVar7) { + *param_1 = uVar5; + } + else { + uVar3 = (ulonglong)uVar4; + } + UNLOCK(); + param_2 = uVar3; + } while (!bVar7); + if (((uVar6 & 4) == 0) && + (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) { + (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) + (param_1,*(undefined1 *)(param_3 + 0x1c),iVar1); + } + if (local_res8[0] == 0) { + local_res10 = CONCAT44(local_res10._4_4_,uVar2 & 0x9c1 | uVar5 & 0xfffff63e); + } + return local_res10; +} + ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|2| |length|76| |called|| |calling|wil_details_IsEnabledFallback| |paramcount|2| |address|1c0001c38| |sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -0,0 +1,41 @@ + +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + bool bVar4; + + if (param_2 == 3) { + uVar3 = 0x10; + } + else { + if (param_2 != 4) { + return; + } + uVar3 = 0x20; + } + if ((Feature_371473723__private_featureState & 2) != 0) { + uVar2 = Feature_371473723__private_featureState; + while ((uVar2 & 1) == (param_1 & 1)) { + LOCK(); + bVar4 = uVar2 == Feature_371473723__private_featureState; + uVar1 = uVar3 | uVar2; + if (!bVar4) { + uVar2 = Feature_371473723__private_featureState; + uVar1 = Feature_371473723__private_featureState; + } + Feature_371473723__private_featureState = uVar1; + UNLOCK(); + if (bVar4) { + return; + } + if ((uVar2 & 2) == 0) { + return; + } + } + } + return; +} + ``` ## wil_details_GetCurrentFeatureEnabledState ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_GetCurrentFeatureEnabledState| |fullname|wil_details_GetCurrentFeatureEnabledState| |refcount|2| |length|344| |called|wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |paramcount|2| |address|1c0001c8c| |sig|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_GetCurrentFeatureEnabledState +++ wil_details_GetCurrentFeatureEnabledState @@ -0,0 +1,73 @@ + +uint wil_details_GetCurrentFeatureEnabledState(longlong param_1,undefined4 *param_2) + +{ + char cVar1; + undefined4 uVar2; + undefined8 *puVar3; + uint uVar4; + undefined8 uVar5; + ulonglong uVar6; + uint uVar7; + longlong *plVar8; + uint local_res8; + ulonglong local_res10; + uint local_28 [8]; + + cVar1 = *(char *)(param_1 + 0x1c); + uVar2 = *(undefined4 *)(param_1 + 0x18); + *param_2 = 1; + local_28[4] = 0; + local_28[5] = 0; + local_28[0] = 0; + local_28[1] = 0; + local_28[2] = 0; + local_28[3] = 0; + uVar5 = wil_RtlStagingConfig_QueryFeatureState(local_28,uVar2,(uint)((byte)(cVar1 - 2U) < 2)); + uVar4 = -(uint)((int)uVar5 != 0) & local_28[0] & 3; + if (uVar4 == 0) { + uVar7 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40; + } + else { + uVar7 = 0; + if (local_28[0] == 2) { + uVar7 = 0x40; + } + } + local_res8 = uVar7 >> 6 ^ + (uVar4 << 7 | -(uint)(local_28[5] != 0) & 0x800 | -(uint)(local_28[4] != 0) & 0x400 | + uVar7); + if ((uVar7 != 0) && (plVar8 = *(longlong **)(param_1 + 0x20), plVar8 != (longlong *)0x0)) { + do { + puVar3 = (undefined8 *)*plVar8; + if (puVar3 == (undefined8 *)0x0) { + return local_res8; + } + if ((*(char *)((longlong)puVar3 + 0x1e) == '\0') && + (*(char *)((longlong)puVar3 + 0x1d) == '\0')) { + uVar7 = *(uint *)*puVar3; + local_res10 = (ulonglong)uVar7; + if ((uVar7 & 2) == 0) { + uVar6 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*puVar3,local_res10,(longlong)puVar3); + uVar7 = (uint)uVar6; + } + uVar4 = local_res8 & 0xfffffffe; + local_res8 = (uint)((uVar7 & local_res8 & 1) != 0); + } + else { + if (((local_res8 & 1) == 0) || (*(char *)((longlong)puVar3 + 0x1f) == '\0')) { + uVar4 = 0; + } + else { + uVar4 = 1; + } + local_res8 = local_res8 & 0xfffffffe; + } + local_res8 = local_res8 | uVar4; + plVar8 = plVar8 + 1; + } while ((local_res8 & 1) != 0); + } + return local_res8; +} + ``` ## wil_details_IsEnabledFallback ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback| |refcount|2| |length|135| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |calling|Feature_371473723__private_IsEnabledFallback| |paramcount|2| |address|1c0001dec| |sig|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -0,0 +1,26 @@ + +uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) + +{ + uint uVar1; + undefined4 *puVar2; + ulonglong local_res18; + + uVar1 = (uint)param_1; + local_res18 = (ulonglong)param_1 & 0xffffffff; + if (((ulonglong)param_1 & 2) == 0) { + puVar2 = &Feature_371473723__private_featureState; + local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (&Feature_371473723__private_featureState,(ulonglong)param_1,0x1c001dcc0 + ); + param_1 = puVar2; + uVar1 = (uint)local_res18; + } + if ((param_2 != 0) && + (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), + param_2 - 3 < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); + } + return uVar1 & 1; +} + ``` ## wil_details_MapReportingKind ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_MapReportingKind| |fullname|wil_details_MapReportingKind| |refcount|2| |length|144| |called|| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|2| |address|1c0001e7c| |sig|uint __fastcall wil_details_MapReportingKind(int param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_MapReportingKind +++ wil_details_MapReportingKind @@ -0,0 +1,33 @@ + +uint wil_details_MapReportingKind(int param_1,int param_2) + +{ + byte bVar1; + + if (param_1 != 0) { + if (param_1 == 1) { + return ~-(uint)(param_2 != 0) & 4; + } + if (param_1 == 2) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 5; + } + if (param_1 == 3) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 6; + } + if (param_1 == 4) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 7; + } + if (param_1 == 5) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 10; + } + if (param_1 == 6) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 0xb; + } + bVar1 = (char)param_1 + 0x9c; + if (bVar1 < 0x32) { + return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1; + } + } + return 0xff; +} + ``` ## wil_details_FeatureDescriptors_SkipPadding ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_FeatureDescriptors_SkipPadding| |fullname|wil_details_FeatureDescriptors_SkipPadding| |refcount|9| |length|31| |called|| |calling|wil_InitializeFeatureStaging
wil_details_EvaluateFeatureDependencies
wil_details_OnFeatureUsageProviderFlushNotification
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates| |paramcount|1| |address|1c0005ad0| |sig|longlong * __fastcall wil_details_FeatureDescriptors_SkipPadding(longlong * param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureDescriptors_SkipPadding +++ wil_details_FeatureDescriptors_SkipPadding @@ -0,0 +1,14 @@ + +longlong * wil_details_FeatureDescriptors_SkipPadding(longlong *param_1) + +{ + while( true ) { + if (&UNK_1c001dcf7 < param_1) { + return (longlong *)0x0; + } + if (*param_1 != 0) break; + param_1 = param_1 + 1; + } + return param_1; +} + ``` ## wil_details_RecordCachedUsage ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_RecordCachedUsage| |fullname|wil_details_RecordCachedUsage| |refcount|2| |length|331| |called|NTOSKRNL.EXE::RtlRecordFeatureUsage
__security_check_cookie| |calling|wil_details_OnFeatureUsageProviderFlushNotification| |paramcount|2| |address|1c0005af8| |sig|undefined __fastcall wil_details_RecordCachedUsage(undefined4 param_1, uint * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RecordCachedUsage +++ wil_details_RecordCachedUsage @@ -0,0 +1,90 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void wil_details_RecordCachedUsage(undefined4 param_1,uint *param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + undefined4 *puVar5; + longlong lVar6; + bool bVar7; + undefined1 auStack_68 [32]; + undefined4 local_48; + short local_44 [2]; + undefined4 local_40 [10]; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_68; + uVar2 = *param_2; + do { + LOCK(); + uVar4 = *param_2; + bVar7 = uVar2 == uVar4; + if (bVar7) { + *param_2 = uVar2 & 0xffc0401e; + uVar4 = uVar2; + } + uVar2 = uVar4; + UNLOCK(); + } while (!bVar7); + uVar3 = uVar2 >> 1 & 0xf; + uVar4 = 0; + if (uVar3 != 0) { + uVar4 = param_2[1]; + do { + LOCK(); + uVar1 = param_2[1]; + bVar7 = uVar4 == uVar1; + if (bVar7) { + param_2[1] = uVar4 | uVar3; + uVar1 = uVar4; + } + uVar4 = uVar1; + UNLOCK(); + } while (!bVar7); + uVar4 = uVar3 & ~uVar4; + } + puVar5 = &local_48; + if ((uVar4 & 1) != 0) { + puVar5 = local_40; + local_44[0] = 2; + local_44[1] = 1; + local_48 = param_1; + } + if ((uVar4 & 2) != 0) { + *puVar5 = param_1; + puVar5[1] = 0x10006; + puVar5 = puVar5 + 2; + } + if ((uVar4 & 4) != 0) { + *puVar5 = param_1; + puVar5[1] = 0x10003; + puVar5 = puVar5 + 2; + } + if (7 < uVar4) { + *puVar5 = param_1; + puVar5[1] = 0x10007; + puVar5 = puVar5 + 2; + } + if ((uVar2 >> 5 & 0x1ff) != 0) { + *puVar5 = param_1; + *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 5) & 0x1ff; + *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0xe) & 1) << 2; + puVar5 = puVar5 + 2; + } + if ((uVar2 >> 0xf & 0x7f) != 0) { + *puVar5 = param_1; + *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 0xf) & 0x7f; + *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0x16) & 1) * 4 + 1; + puVar5 = puVar5 + 2; + } + lVar6 = (longlong)puVar5 - (longlong)&local_48 >> 3; + if (0 < lVar6) { + RtlRecordFeatureUsage(&local_48,lVar6); + } + return; +} + ``` ## wil_details_RecordFeatureUsageReporting ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_RecordFeatureUsageReporting| |fullname|wil_details_RecordFeatureUsageReporting| |refcount|3| |length|125| |called|NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification
NTOSKRNL.EXE::RtlRecordFeatureUsage| |calling|| |paramcount|1| |address|1c0005c50| |sig|undefined __fastcall wil_details_RecordFeatureUsageReporting(undefined4 param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RecordFeatureUsageReporting +++ wil_details_RecordFeatureUsageReporting @@ -0,0 +1,29 @@ + +void wil_details_RecordFeatureUsageReporting(undefined4 param_1) + +{ + int *piVar1; + int iVar2; + undefined4 in_stack_00000028; + undefined2 in_stack_0000002c; + undefined2 in_stack_0000002e; + + iVar2 = g_wil_details_featureUsageCached; + piVar1 = (int *)CONCAT26(in_stack_0000002e,CONCAT24(in_stack_0000002c,in_stack_00000028)); + if (*piVar1 != 0) { + LOCK(); + g_wil_details_featureUsageCached = 1; + UNLOCK(); + if ((iVar2 == 0) && (g_wil_details_featureUsageProvider != 0)) { + RtlArmFeatureUsageProviderFlushNotification(g_wil_details_featureUsageProvider,1); + } + } + if (piVar1[1] != 0) { + in_stack_0000002c = (undefined2)piVar1[2]; + in_stack_0000002e = (undefined2)piVar1[1]; + in_stack_00000028 = param_1; + RtlRecordFeatureUsage(&stack0x00000028,1); + } + return; +} + ``` ## wil_RtlStagingConfig_QueryFeatureState ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_RtlStagingConfig_QueryFeatureState| |fullname|wil_RtlStagingConfig_QueryFeatureState| |refcount|2| |length|197| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|3| |address|1c002ac00| |sig|undefined8 __fastcall wil_RtlStagingConfig_QueryFeatureState(uint * param_1, undefined4 param_2, int param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_RtlStagingConfig_QueryFeatureState +++ wil_RtlStagingConfig_QueryFeatureState @@ -0,0 +1,35 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +undefined8 wil_RtlStagingConfig_QueryFeatureState(uint *param_1,undefined4 param_2,int param_3) + +{ + int iVar1; + undefined1 auStack_48 [32]; + undefined8 local_28; + undefined8 local_20; + uint local_18; + ulonglong local_10; + + local_10 = __security_cookie ^ (ulonglong)auStack_48; + local_28 = 0; + local_20 = 0; + local_18 = 0; + iVar1 = RtlQueryFeatureConfiguration(param_2,param_3 == 0,&local_28,&local_20); + if (iVar1 == 0) { + *param_1 = local_20._4_4_ >> 4 & 3; + *(byte *)(param_1 + 1) = (byte)((ulonglong)local_20 >> 0x28) & 0x3f; + param_1[3] = local_18; + param_1[2] = local_20._4_4_ >> 0xe & 3; + param_1[5] = local_20._4_4_ >> 6 & 1; + param_1[4] = local_20._4_4_ >> 7 & 1; + } + else { + if (iVar1 != 0x117) { + return 0; + } + param_1[4] = local_20._4_4_ >> 7 & 1; + } + return 1; +} + ``` ## wil_UninitializeFeatureStaging ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_UninitializeFeatureStaging| |fullname|wil_UninitializeFeatureStaging| |refcount|3| |length|80| |called|NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider| |calling|DriverEntry| |paramcount|0| |address|1c004071c| |sig|undefined __fastcall wil_UninitializeFeatureStaging(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_UninitializeFeatureStaging +++ wil_UninitializeFeatureStaging @@ -0,0 +1,16 @@ + +void wil_UninitializeFeatureStaging(void) + +{ + if (g_wil_details_featureChangeNotification != 0) { + RtlUnregisterFeatureConfigurationChangeNotification(); + g_wil_details_featureChangeNotification = 0; + } + if (g_wil_details_featureUsageProvider != 0) { + RtlUnregisterFeatureUsageProvider(); + g_wil_details_featureUsageProvider = 0; + } + g_wil_details_isFeatureStagingInitialized = 0; + return; +} + ``` ## wil_details_BuildFeatureStateCacheFromQueryResults ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_BuildFeatureStateCacheFromQueryResults| |fullname|wil_details_BuildFeatureStateCacheFromQueryResults| |refcount|3| |length|97| |called|| |calling|wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates| |paramcount|3| |address|1c0040774| |sig|undefined __fastcall wil_details_BuildFeatureStateCacheFromQueryResults(int param_1, longlong param_2, uint * param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_BuildFeatureStateCacheFromQueryResults +++ wil_details_BuildFeatureStateCacheFromQueryResults @@ -0,0 +1,28 @@ + +void wil_details_BuildFeatureStateCacheFromQueryResults(int param_1,longlong param_2,uint *param_3) + +{ + uint uVar1; + + if ((param_1 == -0x7fffffde) || (param_1 == -0x3ffffddb)) { + param_3[0] = 0; + param_3[1] = 0; + } + else { + param_3[0] = 0; + param_3[1] = 0; + if (param_1 == 0) { + uVar1 = ((*(uint *)(param_2 + 4) & 0x40) << 2 | *(uint *)(param_2 + 4) & 0xb0) << 3 | 0x206; + goto LAB_1c00407d1; + } + if (param_1 == 0x117) { + uVar1 = (*(uint *)(param_2 + 4) & 0x80) << 3 | 0x206; + goto LAB_1c00407d1; + } + } + uVar1 = 0x206; +LAB_1c00407d1: + *param_3 = uVar1; + return; +} + ``` ## wil_details_EvaluateFeatureDependencies ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies| |fullname|wil_details_EvaluateFeatureDependencies| |refcount|3| |length|174| |called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
wil_details_FeatureDescriptors_SkipPadding| |calling|wil_InitializeFeatureStaging
wil_details_ReevaluateOnFeatureConfigurationChange| |paramcount|0| |address|1c00407dc| |sig|undefined __fastcall wil_details_EvaluateFeatureDependencies(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_EvaluateFeatureDependencies +++ wil_details_EvaluateFeatureDependencies @@ -0,0 +1,45 @@ + +void wil_details_EvaluateFeatureDependencies(void) + +{ + longlong *plVar1; + undefined **ppuVar2; + uint uVar3; + ulonglong uVar4; + undefined8 uVar5; + bool bVar6; + + plVar1 = wil_details_FeatureDescriptors_SkipPadding + ((longlong *)&Feature_371473723__private_descriptor); + if (plVar1 != (longlong *)0x0) { + uVar4 = 0; + uVar5 = 0x180; + do { + uVar3 = *(uint *)*plVar1; + if ((uVar3 >> 9 & 1) != 0) { + if (((uint)uVar5 & uVar3) == 0) { + bVar6 = *(char *)((longlong)plVar1 + 0x1f) != '\0'; + } + else { + bVar6 = (uVar3 & (uint)uVar5) == 0x100; + } + uVar3 = uVar3 & 0x40 ^ (uint)bVar6 << 6 | (uint)uVar4 & 0xffffffbf; + uVar4 = (ulonglong)uVar3; + LOCK(); + *(uint *)*plVar1 = *(uint *)*plVar1 ^ uVar3; + UNLOCK(); + } + plVar1 = wil_details_FeatureDescriptors_SkipPadding(plVar1 + 7); + } while (plVar1 != (longlong *)0x0); + } + ppuVar2 = &Feature_371473723__private_descriptor; + while( true ) { + plVar1 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar2); + if (plVar1 == (longlong *)0x0) break; + wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + ((uint *)*plVar1,(longlong)plVar1); + ppuVar2 = (undefined **)(plVar1 + 7); + } + return; +} + ``` ## wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |fullname|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |refcount|3| |length|47| |called|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |calling|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |paramcount|2| |address|1c0040894| |sig|uint __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState +++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState @@ -0,0 +1,15 @@ + +uint wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + (uint *param_1,longlong param_2) + +{ + uint uVar1; + + uVar1 = *param_1; + if ((uVar1 >> 9 & 1) != 0) { + uVar1 = wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState + (param_1,uVar1,param_2); + } + return uVar1; +} + ``` ## wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState| |refcount|2| |length|196| |called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |calling|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState| |paramcount|3| |address|1c00408cc| |sig|uint __fastcall wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState(uint * param_1, uint param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState +++ wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState @@ -0,0 +1,58 @@ + +uint wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState + (uint *param_1,uint param_2,longlong param_3) + +{ + undefined8 *puVar1; + uint uVar2; + uint uVar3; + longlong *plVar4; + uint uVar5; + bool bVar6; + + uVar5 = param_2 >> 6 & 1; + if ((uVar5 != 0) && (plVar4 = *(longlong **)(param_3 + 0x20), plVar4 != (longlong *)0x0)) { + do { + while( true ) { + puVar1 = (undefined8 *)*plVar4; + if (puVar1 == (undefined8 *)0x0) goto LAB_1c004094e; + if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') && + (*(char *)((longlong)puVar1 + 0x1d) == '\0')) break; + if ((uVar5 == 0) || (*(char *)((longlong)puVar1 + 0x1f) == '\0')) { + uVar5 = 0; + goto LAB_1c004094e; + } + uVar5 = 1; + plVar4 = plVar4 + 1; + } + uVar2 = wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState + ((uint *)*puVar1,(longlong)puVar1); + if ((uVar5 == 0) || ((uVar2 & 1) == 0)) { + uVar5 = 0; + } + else { + uVar5 = 1; + } + plVar4 = plVar4 + 1; + } while (uVar5 != 0); + } +LAB_1c004094e: + do { + uVar2 = param_2 & 0xffffffce; + if ((param_2 & 1) == uVar5) { + uVar2 = param_2 & 0xfffffffe; + } + uVar3 = uVar2 & 0xfffffdff | uVar5; + LOCK(); + uVar2 = *param_1; + bVar6 = param_2 == uVar2; + if (bVar6) { + *param_1 = uVar3; + uVar2 = param_2; + } + param_2 = uVar2; + UNLOCK(); + } while (!bVar6); + return uVar3; +} + ``` ## wil_details_OnFeatureUsageProviderFlushNotification ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_OnFeatureUsageProviderFlushNotification| |fullname|wil_details_OnFeatureUsageProviderFlushNotification| |refcount|3| |length|77| |called|wil_details_FeatureDescriptors_SkipPadding
wil_details_RecordCachedUsage| |calling|| |paramcount|1| |address|1c00409a0| |sig|undefined __fastcall wil_details_OnFeatureUsageProviderFlushNotification(int param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_OnFeatureUsageProviderFlushNotification +++ wil_details_OnFeatureUsageProviderFlushNotification @@ -0,0 +1,27 @@ + +void wil_details_OnFeatureUsageProviderFlushNotification(int param_1) + +{ + int iVar1; + longlong *plVar2; + undefined **ppuVar3; + + iVar1 = g_wil_details_featureUsageCached; + if (param_1 == 1) { + LOCK(); + g_wil_details_featureUsageCached = 0; + UNLOCK(); + if (iVar1 != 0) { + ppuVar3 = &Feature_371473723__private_descriptor; + while (plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3), + plVar2 != (longlong *)0x0) { + if ((*(uint *)plVar2[1] & 1) != 0) { + wil_details_RecordCachedUsage((int)plVar2[3],(uint *)plVar2[1]); + } + ppuVar3 = (undefined **)(plVar2 + 7); + } + } + } + return; +} + ``` ## wil_details_ReevaluateOnFeatureConfigurationChange ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_ReevaluateOnFeatureConfigurationChange| |fullname|wil_details_ReevaluateOnFeatureConfigurationChange| |refcount|3| |length|19| |called|wil_details_EvaluateFeatureDependencies
wil_details_UpdateFeatureConfiguredStates| |calling|| |paramcount|0| |address|1c0040a00| |sig|undefined __fastcall wil_details_ReevaluateOnFeatureConfigurationChange(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_ReevaluateOnFeatureConfigurationChange +++ wil_details_ReevaluateOnFeatureConfigurationChange @@ -0,0 +1,9 @@ + +void wil_details_ReevaluateOnFeatureConfigurationChange(void) + +{ + wil_details_UpdateFeatureConfiguredStates(); + wil_details_EvaluateFeatureDependencies(); + return; +} + ``` ## wil_details_UpdateFeatureConfiguredStates ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_UpdateFeatureConfiguredStates| |fullname|wil_details_UpdateFeatureConfiguredStates| |refcount|2| |length|173| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
wil_details_BuildFeatureStateCacheFromQueryResults
wil_details_FeatureDescriptors_SkipPadding| |calling|wil_details_ReevaluateOnFeatureConfigurationChange| |paramcount|0| |address|1c0040a1c| |sig|undefined __fastcall wil_details_UpdateFeatureConfiguredStates(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_UpdateFeatureConfiguredStates +++ wil_details_UpdateFeatureConfiguredStates @@ -0,0 +1,40 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void wil_details_UpdateFeatureConfiguredStates(void) + +{ + int iVar1; + longlong *plVar2; + undefined **ppuVar3; + undefined1 auStack_58 [32]; + uint local_38 [2]; + undefined8 local_30; + undefined8 local_28; + undefined4 local_20; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_58; + ppuVar3 = &Feature_371473723__private_descriptor; + while( true ) { + plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3); + if (plVar2 == (longlong *)0x0) break; + if (((*(char *)((longlong)plVar2 + 0x1d) == '\0') && + (*(char *)((longlong)plVar2 + 0x1e) == '\0')) && + (*(char *)((longlong)plVar2 + 0x1c) == '\0')) { + local_30 = 0; + local_28 = 0; + local_20 = 0; + iVar1 = RtlQueryFeatureConfiguration((int)plVar2[3],1,&local_30,&local_28); + local_38[0] = 0; + local_38[1] = 0; + wil_details_BuildFeatureStateCacheFromQueryResults(iVar1,(longlong)&local_28,local_38); + LOCK(); + *(uint *)*plVar2 = *(uint *)*plVar2 ^ (*(uint *)*plVar2 ^ local_38[0]) & 0xf80; + UNLOCK(); + } + ppuVar3 = (undefined **)(plVar2 + 7); + } + return; +} + ``` ## wil_InitializeFeatureStaging ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_InitializeFeatureStaging| |fullname|wil_InitializeFeatureStaging| |refcount|2| |length|230| |called|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider
wil_details_EvaluateFeatureDependencies
wil_details_FeatureDescriptors_SkipPadding
wil_details_PopulateInitialConfiguredFeatureStates| |calling|DriverEntry| |paramcount|0| |address|1c0067cb0| |sig|int __fastcall wil_InitializeFeatureStaging(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_InitializeFeatureStaging +++ wil_InitializeFeatureStaging @@ -0,0 +1,51 @@ + +int wil_InitializeFeatureStaging(void) + +{ + bool bVar1; + int iVar2; + longlong *plVar3; + undefined **ppuVar4; + undefined8 local_res8; + + bVar1 = false; + if (g_wil_details_isFeatureStagingInitialized == 0) { + g_wil_details_isFeatureStagingInitialized = 1; + local_res8 = RtlQueryFeatureConfigurationChangeStamp(); + wil_details_PopulateInitialConfiguredFeatureStates(); + wil_details_EvaluateFeatureDependencies(); + ppuVar4 = &Feature_371473723__private_descriptor; + while (plVar3 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar4), + plVar3 != (longlong *)0x0) { + if (((*(char *)((longlong)plVar3 + 0x1d) == '\0') && + (*(char *)((longlong)plVar3 + 0x1e) == '\0')) && + (*(char *)((longlong)plVar3 + 0x1c) == '\0')) { + iVar2 = RtlRegisterFeatureConfigurationChangeNotification + (wil_details_ReevaluateOnFeatureConfigurationChange,0,&local_res8, + &g_wil_details_featureChangeNotification); + if (iVar2 == 0) { + bVar1 = true; + } + else { + g_wil_details_featureChangeNotification = 0; + } + break; + } + ppuVar4 = (undefined **)(plVar3 + 7); + } + g_wil_details_recordFeatureUsage = wil_details_RecordFeatureUsageReporting; + iVar2 = RtlRegisterFeatureUsageProvider + (wil_details_OnFeatureUsageProviderFlushNotification,0, + &g_wil_details_featureUsageProvider); + if (iVar2 != 0) { + if (!bVar1) { + g_wil_details_featureUsageProvider = 0; + return iVar2; + } + g_wil_details_featureUsageProvider = 0; + return 0; + } + } + return 0; +} + ``` ## wil_details_PopulateInitialConfiguredFeatureStates ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|wil_details_PopulateInitialConfiguredFeatureStates| |fullname|wil_details_PopulateInitialConfiguredFeatureStates| |refcount|2| |length|225| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
wil_details_BuildFeatureStateCacheFromQueryResults
wil_details_FeatureDescriptors_SkipPadding| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|1c0067da0| |sig|undefined __fastcall wil_details_PopulateInitialConfiguredFeatureStates(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_PopulateInitialConfiguredFeatureStates +++ wil_details_PopulateInitialConfiguredFeatureStates @@ -0,0 +1,52 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void wil_details_PopulateInitialConfiguredFeatureStates(void) + +{ + int iVar1; + longlong *plVar2; + undefined **ppuVar3; + undefined8 uVar4; + undefined1 auStack_58 [32]; + undefined8 local_38; + undefined8 local_30; + undefined8 local_28; + undefined4 local_20; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_58; + ppuVar3 = &Feature_371473723__private_descriptor; + do { + plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3); + if (plVar2 == (longlong *)0x0) { + return; + } + local_30 = 0; + local_38 = 0; + local_28 = 0; + local_20 = 0; + if ((*(char *)((longlong)plVar2 + 0x1d) == '\0') && (*(char *)((longlong)plVar2 + 0x1e) == '\0') + ) { + iVar1 = RtlQueryFeatureConfiguration + ((int)plVar2[3],1 < (byte)(*(char *)((longlong)plVar2 + 0x1c) - 2U), + &local_30,&local_28); + if (iVar1 == -0x7fffffde) { + local_38 = 0x206; + uVar4 = local_38; + do { + *(undefined8 *)*plVar2 = uVar4; + plVar2 = wil_details_FeatureDescriptors_SkipPadding(plVar2 + 7); + } while (plVar2 != (longlong *)0x0); + return; + } + } + else { + iVar1 = -0x3ffffddb; + } + wil_details_BuildFeatureStateCacheFromQueryResults(iVar1,(longlong)&local_28,(uint *)&local_38); + ppuVar3 = (undefined **)(plVar2 + 7); + *(undefined8 *)*plVar2 = local_38; + } while( true ); +} + ``` ## NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|RtlRegisterFeatureConfigurationChangeNotification| |fullname|NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification| |refcount|2| |length|0| |called|| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:00000092| |sig|undefined RtlRegisterFeatureConfigurationChangeNotification(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification* ## NTOSKRNL.EXE::RtlNotifyFeatureUsage ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|RtlNotifyFeatureUsage| |fullname|NTOSKRNL.EXE::RtlNotifyFeatureUsage| |refcount|2| |length|0| |called|| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|0| |address|EXTERNAL:0000010f| |sig|undefined RtlNotifyFeatureUsage(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlNotifyFeatureUsage* ## NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|RtlQueryFeatureConfigurationChangeStamp| |fullname|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp| |refcount|2| |length|0| |called|| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:00000091| |sig|undefined RtlQueryFeatureConfigurationChangeStamp(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp* ## NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|RtlUnregisterFeatureUsageProvider| |fullname|NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider| |refcount|2| |length|0| |called|| |calling|wil_UninitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:00000095| |sig|undefined RtlUnregisterFeatureUsageProvider(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider* ## NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|RtlRegisterFeatureUsageProvider| |fullname|NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider| |refcount|2| |length|0| |called|| |calling|wil_InitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:00000094| |sig|undefined RtlRegisterFeatureUsageProvider(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider* ## NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|RtlUnregisterFeatureConfigurationChangeNotification| |fullname|NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification| |refcount|2| |length|0| |called|| |calling|wil_UninitializeFeatureStaging| |paramcount|0| |address|EXTERNAL:00000093| |sig|undefined RtlUnregisterFeatureConfigurationChangeNotification(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification* ## NTOSKRNL.EXE::RtlRecordFeatureUsage ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|RtlRecordFeatureUsage| |fullname|NTOSKRNL.EXE::RtlRecordFeatureUsage| |refcount|3| |length|0| |called|| |calling|wil_details_RecordCachedUsage
wil_details_RecordFeatureUsageReporting| |paramcount|0| |address|EXTERNAL:0000008f| |sig|undefined RtlRecordFeatureUsage(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlRecordFeatureUsage* ## NTOSKRNL.EXE::RtlQueryFeatureConfiguration ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|RtlQueryFeatureConfiguration| |fullname|NTOSKRNL.EXE::RtlQueryFeatureConfiguration| |refcount|4| |length|0| |called|| |calling|wil_RtlStagingConfig_QueryFeatureState
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates| |paramcount|0| |address|EXTERNAL:00000111| |sig|undefined RtlQueryFeatureConfiguration(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlQueryFeatureConfiguration* ## NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification ### Function Meta |Key|fastfat-10.0.26100.3470.sys| | :---: | :---: | |name|RtlArmFeatureUsageProviderFlushNotification| |fullname|NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification| |refcount|2| |length|0| |called|| |calling|wil_details_RecordFeatureUsageReporting| |paramcount|0| |address|EXTERNAL:00000090| |sig|undefined RtlArmFeatureUsageProviderFlushNotification(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification* # Modified *Modified functions contain code changes* ## DriverEntry ### Match Info |Key|fastfat-10.0.26100.1150.sys - fastfat-10.0.26100.3470.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.15| |i_ratio|0.36| |m_ratio|0.98| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-10.0.26100.1150.sys|fastfat-10.0.26100.3470.sys| | :---: | :---: | :---: | |name|DriverEntry|DriverEntry| |fullname|DriverEntry|DriverEntry| |refcount|2|2| |`length`|2152|2227| |`called`|
Expand for full list:
FatGetCompatibilityModeValue
FatIsFujitsuFMR
NTOSKRNL.EXE::EtwRegister
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializeNPagedLookasideList
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::FsRtlRegisterFileSystemFilterCallbacks
NTOSKRNL.EXE::InitializeSListHead
NTOSKRNL.EXE::IoAllocateWorkItem
NTOSKRNL.EXE::IoCreateDeviceNTOSKRNL.EXE::IoDeleteDevice
NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::IoRegisterDriverReinitialization
NTOSKRNL.EXE::IoRegisterFileSystem
NTOSKRNL.EXE::KeAllocateCalloutStackEx
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeInitializeSpinLock
NTOSKRNL.EXE::KeQueryActiveProcessorCount
NTOSKRNL.EXE::MmQuerySystemSize
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::PoRegisterCoalescingCallback
NTOSKRNL.EXE::PsIsDiskCountersEnabled
NTOSKRNL.EXE::RtlInitUnicodeString
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
memset
|
Expand for full list:
FatGetCompatibilityModeValue
FatIsFujitsuFMR
NTOSKRNL.EXE::EtwRegister
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializeNPagedLookasideList
NTOSKRNL.EXE::ExInitializeResourceLite
NTOSKRNL.EXE::FsRtlRegisterFileSystemFilterCallbacks
NTOSKRNL.EXE::InitializeSListHead
NTOSKRNL.EXE::IoAllocateWorkItem
NTOSKRNL.EXE::IoCreateDeviceNTOSKRNL.EXE::IoDeleteDevice
NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::IoRegisterDriverReinitialization
NTOSKRNL.EXE::IoRegisterFileSystem
NTOSKRNL.EXE::KeAllocateCalloutStackEx
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeInitializeSpinLock
NTOSKRNL.EXE::KeQueryActiveProcessorCount
NTOSKRNL.EXE::MmQuerySystemSize
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::PoRegisterCoalescingCallback
NTOSKRNL.EXE::PsIsDiskCountersEnabled
NTOSKRNL.EXE::RtlInitUnicodeString
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
memset
wil_InitializeFeatureStaging
wil_UninitializeFeatureStaging
| |calling|entry|entry| |paramcount|1|1| |`address`|1c0066078|1c0067078| |`sig`|ulonglong __fastcall DriverEntry(longlong param_1)|int __fastcall DriverEntry(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DriverEntry Called Diff ```diff --- DriverEntry called +++ DriverEntry called @@ -27,0 +28,2 @@ +wil_InitializeFeatureStaging +wil_UninitializeFeatureStaging ``` ### DriverEntry Diff ```diff --- DriverEntry +++ DriverEntry @@ -1,215 +1,215 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -ulonglong DriverEntry(longlong param_1) +int DriverEntry(longlong param_1) { byte bVar1; - uint uVar2; - int iVar3; - ulonglong uVar4; - undefined8 uVar5; - undefined2 uVar6; + int iVar2; + ulonglong uVar3; + undefined2 uVar4; uint local_res18 [2]; undefined8 in_stack_ffffffffffffff28; - ulonglong uVar7; + uint uVar5; uint in_stack_ffffffffffffff30; undefined4 local_b8; undefined4 local_b4; wchar_t *local_b0; undefined8 local_a8; undefined8 uStack_a0; undefined4 local_98 [2]; code *local_90; - uVar2 = (uint)((ulonglong)in_stack_ffffffffffffff28 >> 0x20); + uVar5 = (uint)((ulonglong)in_stack_ffffffffffffff28 >> 0x20); local_b4 = 0; local_res18[0] = 0; local_a8 = 0; uStack_a0 = 0; + wil_InitializeFeatureStaging(); RtlInitUnicodeString(&local_a8,L"\\Fat"); - uVar6 = 8; + uVar4 = 8; in_stack_ffffffffffffff30 = in_stack_ffffffffffffff30 & 0xffffff00; - uVar7 = (ulonglong)uVar2 << 0x20; - uVar4 = IoCreateDevice(param_1,0,&local_a8,8,uVar7,in_stack_ffffffffffffff30, + uVar3 = (ulonglong)uVar5 << 0x20; + iVar2 = IoCreateDevice(param_1,0,&local_a8,8,uVar3,in_stack_ffffffffffffff30, &FatDiskFileSystemDeviceObject); - if (-1 < (int)uVar4) { + if (-1 < iVar2) { RtlInitUnicodeString(&local_a8); - uVar2 = IoCreateDevice(param_1,0,&local_a8,3,uVar7 & 0xffffffff00000000, + iVar2 = IoCreateDevice(param_1,0,&local_a8,3,uVar3 & 0xffffffff00000000, in_stack_ffffffffffffff30 & 0xffffff00,&FatCdromFileSystemDeviceObject); - uVar4 = (ulonglong)uVar2; - uVar5 = FatDiskFileSystemDeviceObject; - if (-1 < (int)uVar2) { - *(code **)(param_1 + 0x70) = FatFsdCreate; - *(undefined **)(param_1 + 0x50) = &FatFastIoDispatch; - *(code **)(param_1 + 0x80) = FatFsdClose; - *(code **)(param_1 + 0x88) = FatFsdRead; - *(code **)(param_1 + 0x90) = FatFsdWrite; - *(code **)(param_1 + 0x98) = FatFsdQueryInformation; - *(code **)(param_1 + 0xa0) = FatFsdSetInformation; - *(code **)(param_1 + 0xa8) = FatFsdSetEa; - *(code **)(param_1 + 0xb0) = FatFsdSetEa; - *(code **)(param_1 + 0xb8) = FatFsdFlushBuffers; - *(code **)(param_1 + 0xc0) = FatFsdQueryVolumeInformation; - *(code **)(param_1 + 200) = FatFsdSetVolumeInformation; - *(code **)(param_1 + 0x100) = FatFsdCleanup; - *(code **)(param_1 + 0xd0) = FatFsdDirectoryControl; - *(code **)(param_1 + 0xd8) = FatFsdFileSystemControl; - *(code **)(param_1 + 0xf8) = FatFsdLockControl; - *(code **)(param_1 + 0xe0) = FatFsdDeviceControl; - *(code **)(param_1 + 0xf0) = FatFsdShutdown; - *(code **)(param_1 + 0x148) = FatFsdPnp; - memset(&FatFastIoDispatch,0,0xe0); - _FatFastIoDispatch = 0xe0; - _DAT_0 = FatFastIoCheckIfPossible; - _DAT_1 = FsRtlCopyRead_exref; - _DAT_2 = FsRtlCopyWrite_exref; - _DAT_3 = FatFastQueryBasicInfo; - _DAT_4 = FatFastQueryStdInfo; - _DAT_5 = FatFastLock; - _DAT_6 = FatFastUnlockSingle; - _DAT_7 = FatFastUnlockAll; - _DAT_8 = FatFastUnlockAllByKey; - _DAT_9 = FatFastQueryNetworkOpenInfo; - _DAT_10 = FatAcquireForCcFlush; - _DAT_11 = FatReleaseForCcFlush; - _DAT_12 = FsRtlMdlReadDev_exref; - _DAT_13 = FsRtlMdlReadCompleteDev_exref; - _DAT_14 = FsRtlPrepareMdlWriteDev_exref; - _DAT_15 = FsRtlMdlWriteCompleteDev_exref; - memset(local_98,0,0x78); - local_98[0] = 0x78; - local_90 = FatFilterCallbackAcquireForCreateSection; - uVar2 = FsRtlRegisterFileSystemFilterCallbacks(param_1); - uVar4 = (ulonglong)uVar2; - if (-1 < (int)uVar2) { - memset(&FatData,0,0x200); - DAT_16 = &DAT_1c001ddd0; - DAT_17 = &DAT_17; - DAT_18 = FatCdromFileSystemDeviceObject; - DAT_19 = &DAT_1c001de78; - DAT_20 = &DAT_20; - DAT_21 = &DAT_1c001de90; - DAT_22 = &DAT_22; - _FatData = 0x2000500; - DAT_23 = FatDiskFileSystemDeviceObject; - DAT_24 = param_1; - DAT_25 = IoAllocateWorkItem(); - if (DAT_25 != 0) { - DAT_26 = ExAllocatePoolWithTag(0x600,0x1000); - if (DAT_26 == 0) { - IoFreeWorkItem(DAT_25); + if (iVar2 < 0) { + wil_UninitializeFeatureStaging(); + IoDeleteDevice(FatDiskFileSystemDeviceObject); + return iVar2; + } + *(code **)(param_1 + 0x70) = FatFsdCreate; + *(undefined **)(param_1 + 0x50) = &FatFastIoDispatch; + *(code **)(param_1 + 0x80) = FatFsdClose; + *(code **)(param_1 + 0x88) = FatFsdRead; + *(code **)(param_1 + 0x90) = FatFsdWrite; + *(code **)(param_1 + 0x98) = FatFsdQueryInformation; + *(code **)(param_1 + 0xa0) = FatFsdSetInformation; + *(code **)(param_1 + 0xa8) = FatFsdSetEa; + *(code **)(param_1 + 0xb0) = FatFsdSetEa; + *(code **)(param_1 + 0xb8) = FatFsdFlushBuffers; + *(code **)(param_1 + 0xc0) = FatFsdQueryVolumeInformation; + *(code **)(param_1 + 200) = FatFsdSetVolumeInformation; + *(code **)(param_1 + 0x100) = FatFsdCleanup; + *(code **)(param_1 + 0xd0) = FatFsdDirectoryControl; + *(code **)(param_1 + 0xd8) = FatFsdFileSystemControl; + *(code **)(param_1 + 0xf8) = FatFsdLockControl; + *(code **)(param_1 + 0xe0) = FatFsdDeviceControl; + *(code **)(param_1 + 0xf0) = FatFsdShutdown; + *(code **)(param_1 + 0x148) = FatFsdPnp; + memset(&FatFastIoDispatch,0,0xe0); + _FatFastIoDispatch = 0xe0; + _DAT_0 = FatFastIoCheckIfPossible; + _DAT_1 = FsRtlCopyRead_exref; + _DAT_2 = FsRtlCopyWrite_exref; + _DAT_3 = FatFastQueryBasicInfo; + _DAT_4 = FatFastQueryStdInfo; + _DAT_5 = FatFastLock; + _DAT_6 = FatFastUnlockSingle; + _DAT_7 = FatFastUnlockAll; + _DAT_8 = FatFastUnlockAllByKey; + _DAT_9 = FatFastQueryNetworkOpenInfo; + _DAT_10 = FatAcquireForCcFlush; + _DAT_11 = FatReleaseForCcFlush; + _DAT_12 = FsRtlMdlReadDev_exref; + _DAT_13 = FsRtlMdlReadCompleteDev_exref; + _DAT_14 = FsRtlPrepareMdlWriteDev_exref; + _DAT_15 = FsRtlMdlWriteCompleteDev_exref; + memset(local_98,0,0x78); + local_98[0] = 0x78; + local_90 = FatFilterCallbackAcquireForCreateSection; + iVar2 = FsRtlRegisterFileSystemFilterCallbacks(param_1); + if (-1 < iVar2) { + memset(&FatData,0,0x200); + DAT_16 = &DAT_1c001ee10; + DAT_17 = &DAT_17; + DAT_18 = FatCdromFileSystemDeviceObject; + DAT_19 = &DAT_1c001eeb8; + DAT_20 = &DAT_20; + DAT_21 = &DAT_1c001eed0; + DAT_22 = &DAT_22; + _FatData = 0x2000500; + DAT_23 = FatDiskFileSystemDeviceObject; + DAT_24 = param_1; + DAT_25 = IoAllocateWorkItem(); + if (DAT_25 != 0) { + DAT_26 = ExAllocatePoolWithTag(0x600,0x1000); + if (DAT_26 == 0) { + IoFreeWorkItem(DAT_25); + IoDeleteDevice(FatDiskFileSystemDeviceObject); + IoDeleteDevice(FatCdromFileSystemDeviceObject); + return -0x3fffff66; + } + iVar2 = KeAllocateCalloutStackEx(0,4,0,&DAT_27); + if (-1 < iVar2) { + KeInitializeEvent(&DAT_28,0,1); + KeInitializeSpinLock(&DAT_29); + iVar2 = MmQuerySystemSize(); + if (iVar2 == 0) { + uVar4 = 4; + FatMaxDelayedCloseCount = 0x10; + } + else if (iVar2 == 1) { + FatMaxDelayedCloseCount = 0x40; } else { - iVar3 = KeAllocateCalloutStackEx(0,4,0,&DAT_27); - if (-1 < iVar3) { - KeInitializeEvent(&DAT_28,0,1); - KeInitializeSpinLock(&DAT_29); - iVar3 = MmQuerySystemSize(); - if (iVar3 == 0) { - uVar6 = 4; - FatMaxDelayedCloseCount = 0x10; - } - else if (iVar3 == 1) { - FatMaxDelayedCloseCount = 0x40; - } - else { - FatMaxDelayedCloseCount = 0x100; - uVar6 = 0x10; - } - _DAT_30 = FatNoOpAcquire; - _DAT_31 = FatAcquireFcbForLazyWrite; - _DAT_32 = FatReleaseFcbFromLazyWrite; - _DAT_33 = FatAcquireFcbForReadAhead; - _DAT_34 = FatReleaseFcbFromReadAhead; - _DAT_35 = FatNoOpRelease; - _DAT_36 = FatNoOpRelease; - _DAT_37 = FatNoOpAcquire; - DAT_38 = IoGetCurrentProcess(); - DAT_39 = KeQueryActiveProcessorCount(0); + FatMaxDelayedCloseCount = 0x100; + uVar4 = 0x10; + } + _DAT_30 = FatNoOpAcquire; + _DAT_31 = FatAcquireFcbForLazyWrite; + _DAT_32 = FatReleaseFcbFromLazyWrite; + _DAT_33 = FatAcquireFcbForReadAhead; + _DAT_34 = FatReleaseFcbFromReadAhead; + _DAT_35 = FatNoOpRelease; + _DAT_36 = FatNoOpRelease; + _DAT_37 = FatNoOpAcquire; + DAT_38 = IoGetCurrentProcess(); + DAT_39 = KeQueryActiveProcessorCount(0); + DAT_40 = DAT_40 | 2; + local_b8 = 0x1a0018; + local_b0 = L"FatEnableEfs"; + uVar3 = FatGetCompatibilityModeValue(&local_b8,local_res18); + if (-1 < (int)uVar3) { + if ((local_res18[0] & 1) == 0) { + DAT_40 = DAT_40 & 0xfd; + } + else { DAT_40 = DAT_40 | 2; - local_b8 = 0x1a0018; - local_b0 = L"FatEnableEfs"; - uVar4 = FatGetCompatibilityModeValue(&local_b8,local_res18); - if (-1 < (int)uVar4) { - if ((local_res18[0] & 1) == 0) { - DAT_40 = DAT_40 & 0xfd; - } - else { - DAT_40 = DAT_40 | 2; - } - } + } + } + DAT_41 = DAT_41 & 0x7f; + local_b0 = L"Fat12DisableFlushOnCleanup"; + local_b8 = 0x360034; + uVar3 = FatGetCompatibilityModeValue(&local_b8,local_res18); + if (-1 < (int)uVar3) { + if ((local_res18[0] & 1) == 0) { DAT_41 = DAT_41 & 0x7f; - local_b0 = L"Fat12DisableFlushOnCleanup"; - local_b8 = 0x360034; - uVar4 = FatGetCompatibilityModeValue(&local_b8,local_res18); - if (-1 < (int)uVar4) { - if ((local_res18[0] & 1) == 0) { - DAT_41 = DAT_41 & 0x7f; - } - else { - DAT_41 = DAT_41 | 0x80; - } - } - local_b8 = 0x20001e; - local_b0 = L"Win31FileSystem"; - uVar4 = FatGetCompatibilityModeValue(&local_b8,local_res18); - if (((int)uVar4 < 0) || ((local_res18[0] & 1) == 0)) { - DAT_41 = DAT_41 | 1; - } - else { - DAT_41 = DAT_41 & 0xfe; - } - local_b8 = 0x3a0038; - local_b0 = L"FatDisableCodePageInvariance"; - uVar4 = FatGetCompatibilityModeValue(&local_b8,local_res18); - if (((int)uVar4 < 0) || ((local_res18[0] & 1) == 0)) { - DAT_41 = DAT_41 | 0x10; - } - else { - DAT_41 = DAT_41 & 0xef; - } - ExInitializeResourceLite(&DAT_42); - ExInitializeNPagedLookasideList - (&FatIrpContextLookasideList,0,0,0x210,0x90,0x49746146,uVar6); - ExInitializeNPagedLookasideList - (&FatNonPagedFcbLookasideList,0,0,0x210,0x78,0x4e746146,uVar6); - ExInitializeNPagedLookasideList - (&FatEResourceLookasideList,0,0,0x210,0x68,0x45746146,uVar6); - InitializeSListHead((PSLIST_HEADER)&FatCloseContextSList); - _DAT_43 = 0; - _DAT_44 = 0; - _FatCloseQueueMutex = 1; - KeInitializeEvent(&DAT_45,1,0); - KeInitializeEvent(&FatReserveEvent,1,1); - IoRegisterFileSystem(FatDiskFileSystemDeviceObject); - ObfReferenceObject(FatDiskFileSystemDeviceObject); - IoRegisterFileSystem(FatCdromFileSystemDeviceObject); - ObfReferenceObject(FatCdromFileSystemDeviceObject); - bVar1 = FatIsFujitsuFMR(); - DAT_41 = (bVar1 & 1) * '\x02' | DAT_41 & 0xfd; - bVar1 = PsIsDiskCountersEnabled(); - FatDiskAccountingEnabled = (uint)bVar1; - PoRegisterCoalescingCallback(FatCoalescingCallback,1,&FatCoalescingRegistration,0); - iVar3 = EtwRegister(&FatSqmEventProvider,0,0,&DAT_46); - if (iVar3 < 0) { - DAT_46 = 0; - } - TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(0x1c001d0c0,0,0); - IoRegisterDriverReinitialization(param_1,FatLoadAddOns,0); - return 0; - } - IoFreeWorkItem(DAT_25); - ExFreePoolWithTag(DAT_26,0); - } + } + else { + DAT_41 = DAT_41 | 0x80; + } + } + local_b8 = 0x20001e; + local_b0 = L"Win31FileSystem"; + uVar3 = FatGetCompatibilityModeValue(&local_b8,local_res18); + if (((int)uVar3 < 0) || ((local_res18[0] & 1) == 0)) { + DAT_41 = DAT_41 | 1; + } + else { + DAT_41 = DAT_41 & 0xfe; + } + local_b8 = 0x3a0038; + local_b0 = L"FatDisableCodePageInvariance"; + uVar3 = FatGetCompatibilityModeValue(&local_b8,local_res18); + if (((int)uVar3 < 0) || ((local_res18[0] & 1) == 0)) { + DAT_41 = DAT_41 | 0x10; + } + else { + DAT_41 = DAT_41 & 0xef; + } + ExInitializeResourceLite(&DAT_42); + ExInitializeNPagedLookasideList + (&FatIrpContextLookasideList,0,0,0x210,0x90,0x49746146,uVar4); + ExInitializeNPagedLookasideList + (&FatNonPagedFcbLookasideList,0,0,0x210,0x78,0x4e746146,uVar4); + ExInitializeNPagedLookasideList + (&FatEResourceLookasideList,0,0,0x210,0x68,0x45746146,uVar4); + InitializeSListHead((PSLIST_HEADER)&FatCloseContextSList); + _DAT_43 = 0; + _DAT_44 = 0; + _FatCloseQueueMutex = 1; + KeInitializeEvent(&DAT_45,1,0); + KeInitializeEvent(&FatReserveEvent,1,1); + IoRegisterFileSystem(FatDiskFileSystemDeviceObject); + ObfReferenceObject(FatDiskFileSystemDeviceObject); + IoRegisterFileSystem(FatCdromFileSystemDeviceObject); + ObfReferenceObject(FatCdromFileSystemDeviceObject); + bVar1 = FatIsFujitsuFMR(); + DAT_41 = (bVar1 & 1) * '\x02' | DAT_41 & 0xfd; + bVar1 = PsIsDiskCountersEnabled(); + FatDiskAccountingEnabled = (uint)bVar1; + PoRegisterCoalescingCallback(FatCoalescingCallback,1,&FatCoalescingRegistration,0); + iVar2 = EtwRegister(&FatSqmEventProvider,0,0,&DAT_46); + if (iVar2 < 0) { + DAT_46 = 0; + } + TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(0x1c001e0c0,0,0); + IoRegisterDriverReinitialization(param_1,FatLoadAddOns,0); + return 0; } - uVar4 = 0xc000009a; + IoFreeWorkItem(DAT_25); + ExFreePoolWithTag(DAT_26,0); } - IoDeleteDevice(FatDiskFileSystemDeviceObject); - uVar5 = FatCdromFileSystemDeviceObject; + iVar2 = -0x3fffff66; } - IoDeleteDevice(uVar5); + IoDeleteDevice(FatDiskFileSystemDeviceObject); + IoDeleteDevice(FatCdromFileSystemDeviceObject); } - return uVar4; + wil_UninitializeFeatureStaging(); + return iVar2; } ``` ## FatExamineFatEntries ### Match Info |Key|fastfat-10.0.26100.1150.sys - fastfat-10.0.26100.3470.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.36| |i_ratio|0.55| |m_ratio|0.98| |b_ratio|0.82| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-10.0.26100.1150.sys|fastfat-10.0.26100.3470.sys| | :---: | :---: | :---: | |name|FatExamineFatEntries|FatExamineFatEntries| |fullname|FatExamineFatEntries|FatExamineFatEntries| |refcount|6|6| |`length`|2060|2149| |`called`|FatAddMcbEntry
FatInterpretClusterType
FatPrefetchPages
FatReadVolumeFile
NTOSKRNL.EXE::CcUnpinData
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlClearBits
NTOSKRNL.EXE::RtlInitializeBitMap
NTOSKRNL.EXE::RtlSetBits|
Expand for full list:
FatAddMcbEntry
FatInterpretClusterType
FatPrefetchPages
FatReadVolumeFile
Feature_371473723__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::CcUnpinData
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::RtlClearBits
NTOSKRNL.EXE::RtlInitializeBitMapNTOSKRNL.EXE::RtlSetBits
| |calling|FatAllocateDiskSpace
FatGetVolumeBitmap
FatSetupAllocationSupport|FatAllocateDiskSpace
FatGetVolumeBitmap
FatSetupAllocationSupport| |paramcount|7|7| |`address`|1c0027538|1c0028538| |sig|undefined __fastcall FatExamineFatEntries(longlong param_1, longlong param_2, uint param_3, uint param_4, char param_5, uint * param_6, longlong param_7)|undefined __fastcall FatExamineFatEntries(longlong param_1, longlong param_2, uint param_3, uint param_4, char param_5, uint * param_6, longlong param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### FatExamineFatEntries Called Diff ```diff --- FatExamineFatEntries called +++ FatExamineFatEntries called @@ -4,0 +5 @@ +Feature_371473723__private_IsEnabledDeviceUsageNoInline @@ -7,0 +9 @@ +NTOSKRNL.EXE::ExRaiseStatus ``` ### FatExamineFatEntries Diff ```diff --- FatExamineFatEntries +++ FatExamineFatEntries @@ -1,303 +1,311 @@ void FatExamineFatEntries (longlong param_1,longlong param_2,uint param_3,uint param_4,char param_5, uint *param_6,longlong param_7) { byte bVar1; ushort uVar2; ulonglong uVar3; longlong lVar4; char cVar5; + ulonglong uVar6; undefined7 extraout_var; - uint uVar6; - int iVar7; - uint uVar8; - uint *puVar9; + uint uVar7; + int iVar8; + uint uVar9; uint *puVar10; uint *puVar11; - int iVar12; - ulonglong uVar13; + uint *puVar12; + int iVar13; uint *puVar14; uint *puVar15; - uint uVar16; - ulonglong uVar17; + ulonglong uVar16; + uint uVar17; uint local_res18; uint local_res20; uint local_c8; uint *local_c0; uint local_b8; uint local_b4; uint local_b0; uint local_ac; - longlong local_a8; - uint local_a0; - uint local_9c; + uint local_a8; + longlong local_a0; uint local_98; - undefined4 *local_90; - uint local_88; - uint local_84; - uint *local_80; - longlong local_78; - uint local_70; - uint local_6c; + uint local_94; + uint local_90; + undefined4 *local_88; + uint local_80; + uint *local_78; + longlong local_70; uint local_68; - undefined4 local_60; - undefined4 local_5c; - undefined4 uStack_58; - uint local_50; - uint local_4c; - uint *local_48; + uint local_64; + uint local_60; + undefined4 local_58; + undefined4 local_54; + undefined4 uStack_50; + uint local_48; + uint local_44; + uint *local_40; - puVar9 = (uint *)0x0; + puVar10 = (uint *)0x0; + local_98 = 0; + local_ac = 0; + local_c0 = (uint *)0x0; + local_78 = (uint *)0x0; local_a0 = 0; - local_b0 = 0; - local_c0 = (uint *)0x0; - local_80 = (uint *)0x0; - local_a8 = 0; - local_78 = 0; - uStack_58 = 0; - local_60 = 0; - local_5c = 0; + local_70 = 0; + uStack_50 = 0; + local_58 = 0; + local_54 = 0; local_b8 = 0; - local_84 = 0; - local_98 = 0; + local_80 = 0; + local_90 = 0; bVar1 = *(byte *)(param_2 + 0x178); - local_88 = 0x10000; if (*(uint *)(param_2 + 0xd8) < 2) { - local_88 = *(uint *)(param_2 + 0x16c); + local_b4 = *(uint *)(param_2 + 0x16c); + } + else { + local_b4 = 0x10000; } puVar15 = (uint *)(param_2 + 0x170); local_res18 = param_3; local_res20 = param_4; if (param_5 == '\0') { if (param_7 == 0) { local_res18 = *param_6; local_res20 = param_6[1]; - local_90 = &local_60; - uVar8 = (local_88 - (local_88 - 1 & 7)) + 7 >> 3; - local_78 = ExAllocatePoolWithTag(0x411,(uVar8 - (uVar8 - 1 & 3)) + 3,0x42746146); - RtlInitializeBitMap(&local_60,local_78); - puVar10 = param_6; + local_88 = &local_58; + uVar6 = Feature_371473723__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar6 != 0) && ((local_b4 - (local_b4 - 1 & 7)) + 7 < local_b4)) { + *(undefined4 *)(param_1 + 0x48) = 0xc0000102; + /* WARNING: Subroutine does not return */ + ExRaiseStatus(0xc0000102); + } + uVar9 = (local_b4 - (local_b4 - 1 & 7)) + 7 >> 3; + local_70 = ExAllocatePoolWithTag(0x411,(uVar9 - (uVar9 - 1 & 3)) + 3,0x42746146); + RtlInitializeBitMap(&local_58,local_70); + puVar11 = param_6; if ((bVar1 == 0x20) && (1 < *(uint *)(param_2 + 0xd8))) { puVar15 = (uint *)0x0; } } else { - local_90 = &local_60; - RtlInitializeBitMap(&local_60); + local_88 = &local_58; + RtlInitializeBitMap(&local_58); puVar15 = (uint *)0x0; - puVar10 = puVar9; + puVar11 = puVar10; } } else { - local_90 = (undefined4 *)0x0; - puVar10 = *(uint **)(param_2 + 0xe0); - *puVar10 = param_3; - puVar10[2] = 0; + local_88 = (undefined4 *)0x0; + puVar11 = *(uint **)(param_2 + 0xe0); + *puVar11 = param_3; + puVar11[2] = 0; } uVar2 = *(ushort *)(param_2 + 0x12e); - uVar8 = (uint)uVar2; - uVar6 = (uint)*(ushort *)(param_2 + 0x120); + uVar9 = (uint)uVar2; + uVar7 = (uint)*(ushort *)(param_2 + 0x120); if (bVar1 == 0xc) { if (uVar2 == 0) { - uVar8 = *(uint *)(param_2 + 0x13c); - } - FatReadVolumeFile(param_1,param_2,(ulonglong)(*(ushort *)(param_2 + 0x124) * uVar6), - uVar6 * uVar8,&local_a8,&local_c0); + uVar9 = *(uint *)(param_2 + 0x13c); + } + FatReadVolumeFile(param_1,param_2,(ulonglong)(*(ushort *)(param_2 + 0x124) * uVar7), + uVar7 * uVar9,&local_a0,&local_c0); local_c8 = (uint)(ushort)*local_c0; local_c8 = local_c8 & 0xfff; } else { if (uVar2 == 0) { - uVar8 = *(uint *)(param_2 + 0x13c); - } - iVar12 = *(ushort *)(param_2 + 0x124) * uVar6; - local_84 = uVar6 * uVar8 + 0xfff + iVar12 >> 0xc; - iVar7 = (bVar1 >> 3) * local_res18; - local_a0 = (uint)(iVar7 + iVar12) >> 0xc; - uVar8 = local_a0 << 0xc; - local_b8 = local_84 - local_a0; + uVar9 = *(uint *)(param_2 + 0x13c); + } + iVar13 = *(ushort *)(param_2 + 0x124) * uVar7; + local_80 = iVar13 + 0xfff + uVar7 * uVar9 >> 0xc; + iVar8 = (bVar1 >> 3) * local_res18; + local_98 = (uint)(iVar8 + iVar13) >> 0xc; + uVar9 = local_98 << 0xc; + local_b8 = local_80 - local_98; if (0x100 < local_b8) { - local_b8 = (local_a0 + 0xff & 0xffffff00) - local_a0; - } - puVar9 = (uint *)(ulonglong)local_b8; - local_b4 = local_b8; - local_b0 = uVar8; - local_70 = local_a0; - local_6c = uVar8; - local_50 = local_84; - FatPrefetchPages(param_1,*(undefined8 *)(param_2 + 0x2d8),local_a0,local_b8); - FatReadVolumeFile(param_1,param_2,(ulonglong)uVar8,0x1000,&local_a8,&local_80); + local_b8 = (local_98 + 0xff & 0xffffff00) - local_98; + } + puVar10 = (uint *)(ulonglong)local_b8; + local_b0 = local_b8; + local_ac = uVar9; + local_68 = local_98; + local_64 = uVar9; + local_48 = local_80; + FatPrefetchPages(param_1,*(undefined8 *)(param_2 + 0x2d8),local_98,local_b8); + FatReadVolumeFile(param_1,param_2,(ulonglong)uVar9,0x1000,&local_a0,&local_78); if (bVar1 == 0x20) { local_c0 = (uint *)((ulonglong) - (iVar7 + (uint)*(ushort *)(param_2 + 0x124) * - (uint)*(ushort *)(param_2 + 0x120) & 0xfff) + (longlong)local_80) + (iVar8 + (uint)*(ushort *)(param_2 + 0x124) * + (uint)*(ushort *)(param_2 + 0x120) & 0xfff) + (longlong)local_78) ; local_c8 = *local_c0 & 0xfffffff; } else { - local_c0 = (uint *)((longlong)local_80 + + local_c0 = (uint *)((longlong)local_78 + (ulonglong) ((uint)*(ushort *)(param_2 + 0x124) * (uint)*(ushort *)(param_2 + 0x120) & 0xfff) + 4); local_c8 = (uint)(ushort)*local_c0; } } - iVar12 = 1 << (*(byte *)(param_2 + 0x17a) & 0x1f); - uVar13 = 0; - local_ac = (uint)(local_c8 != 0); - uVar17 = (ulonglong)local_ac; - puVar11 = local_c0; - local_9c = local_res18; - uVar6 = local_res18; - for (uVar8 = local_res18; local_68 = uVar8, uVar8 <= local_res20; uVar8 = uVar8 + 1) { - puVar14 = puVar10; + iVar13 = 1 << (*(byte *)(param_2 + 0x17a) & 0x1f); + uVar6 = 0; + local_a8 = (uint)(local_c8 != 0); + uVar16 = (ulonglong)local_a8; + puVar12 = local_c0; + local_94 = local_res18; + uVar7 = local_res18; + for (uVar9 = local_res18; local_60 = uVar9, uVar9 <= local_res20; uVar9 = uVar9 + 1) { + puVar14 = puVar11; if (bVar1 == 0xc) { - uVar2 = *(ushort *)((ulonglong)(uVar8 * 3 >> 1) + (longlong)puVar11); - if ((uVar8 & 1) != 0) { + uVar2 = *(ushort *)((ulonglong)(uVar9 * 3 >> 1) + (longlong)puVar12); + if ((uVar9 & 1) != 0) { uVar2 = uVar2 >> 4; } - uVar16 = uVar2 & 0xfff; + uVar17 = uVar2 & 0xfff; } else { - if (((param_5 != (char)uVar13) && (local_res18 < uVar8)) && ((uVar8 - 2) % local_88 == 0)) { - puVar10[1] = uVar8 - 1; - if ((int)uVar17 == 0) { - puVar10[2] = puVar10[2] + (uVar8 - uVar6); + if (((param_5 != (char)uVar6) && (local_res18 < uVar9)) && ((uVar9 - 2) % local_b4 == 0)) { + puVar11[1] = uVar9 - 1; + if ((int)uVar16 == 0) { + puVar11[2] = puVar11[2] + (uVar9 - uVar7); if (puVar15 != (uint *)0x0) { - *puVar15 = *puVar15 + (uVar8 - uVar6); + *puVar15 = *puVar15 + (uVar9 - uVar7); } } - uVar17 = 2; - local_ac = 2; - puVar14 = puVar10 + 3; - puVar10[5] = (uint)uVar13; - *puVar14 = uVar8; - puVar11 = local_c0; - local_9c = uVar8; - local_48 = puVar14; - uVar6 = uVar8; - } - puVar10 = puVar11; - if (((ulonglong)puVar11 & 0xfff) == 0) { - if (local_a8 != 0) { + uVar16 = 2; + local_a8 = 2; + puVar14 = puVar11 + 3; + puVar11[5] = (uint)uVar6; + *puVar14 = uVar9; + puVar12 = local_c0; + local_94 = uVar9; + local_40 = puVar14; + uVar7 = uVar9; + } + puVar11 = puVar12; + if (((ulonglong)puVar12 & 0xfff) == 0) { + if (local_a0 != 0) { CcUnpinData(); - local_a8 = 0; + local_a0 = 0; } - local_a0 = local_a0 + 1; - local_b0 = local_b0 + 0x1000; - local_b8 = (int)puVar9 - 1; - local_b4 = local_b8; - local_70 = local_a0; - local_6c = local_b0; + local_98 = local_98 + 1; + local_ac = local_ac + 0x1000; + local_b8 = (int)puVar10 - 1; + local_b0 = local_b8; + local_68 = local_98; + local_64 = local_ac; if (local_b8 == 0) { - local_b8 = local_84 - local_a0; + local_b8 = local_80 - local_98; if (0x100 < local_b8) { local_b8 = 0x100; } - local_b4 = local_b8; - FatPrefetchPages(param_1,*(undefined8 *)(param_2 + 0x2d8),local_a0,local_b8); + local_b0 = local_b8; + FatPrefetchPages(param_1,*(undefined8 *)(param_2 + 0x2d8),local_98,local_b8); } - FatReadVolumeFile(param_1,param_2,(ulonglong)local_b0,0x1000,&local_a8,&local_80); - uVar13 = 0; - puVar10 = local_80; + FatReadVolumeFile(param_1,param_2,(ulonglong)local_ac,0x1000,&local_a0,&local_78); + uVar6 = 0; + puVar11 = local_78; } if (bVar1 == 0x20) { - puVar11 = puVar10 + 1; - uVar16 = *puVar10 & 0xfffffff; - local_c0 = puVar11; + puVar12 = puVar11 + 1; + uVar17 = *puVar11 & 0xfffffff; + local_c0 = puVar12; } else { - uVar16 = (uint)(ushort)*puVar10; - puVar11 = (uint *)((longlong)puVar10 + 2); - local_c0 = puVar11; - } - } - if ((int)uVar17 == 2) { - uVar3 = CONCAT71((int7)(uVar13 >> 8),uVar16 != 0); - uVar17 = uVar3 & 0xffffffff; - local_ac = (uint)uVar3; - } - if (((int)uVar17 == 0) && (uVar16 != 0)) { - iVar7 = uVar8 - uVar6; + uVar17 = (uint)(ushort)*puVar11; + puVar12 = (uint *)((longlong)puVar11 + 2); + local_c0 = puVar12; + } + } + if ((int)uVar16 == 2) { + uVar3 = CONCAT71((int7)(uVar6 >> 8),uVar17 != 0); + uVar16 = uVar3 & 0xffffffff; + local_a8 = (uint)uVar3; + } + if (((int)uVar16 == 0) && (uVar17 != 0)) { + iVar8 = uVar9 - uVar7; if (puVar15 != (uint *)0x0) { - *puVar15 = *puVar15 + iVar7; - puVar14[2] = puVar14[2] + iVar7; - puVar11 = local_c0; - } - if (local_90 != (undefined4 *)0x0) { - RtlClearBits(local_90,uVar6 - local_res18,iVar7); - uVar13 = 0; - puVar11 = local_c0; - } - uVar17 = 1; - local_ac = 1; - local_9c = uVar8; - uVar6 = uVar8; - } - if (((int)uVar17 == 1) && (uVar16 == 0)) { - if (local_90 != (undefined4 *)0x0) { - RtlSetBits(local_90,uVar6 - local_res18,uVar8 - uVar6); - uVar13 = 0; - puVar11 = local_c0; - } - local_ac = (uint)uVar13; - uVar17 = uVar13 & 0xffffffff; - local_9c = uVar8; - uVar6 = uVar8; - } - if (((param_5 != (char)uVar13) || (*(int *)(param_2 + 0xd8) == 1)) && - (cVar5 = FatInterpretClusterType(param_2,uVar16), (int)CONCAT71(extraout_var,cVar5) == 2)) { - FatAddMcbEntry(param_2,param_2 + 0x1a0,(ulonglong)local_98, - ((ulonglong)(uVar8 - 2) << (*(byte *)(param_2 + 0x17a) & 0x3f)) + - *(longlong *)(param_2 + 0x160),iVar12); - local_98 = local_98 + iVar12; - uVar13 = 0; - puVar11 = local_c0; - local_4c = local_98; - } - puVar9 = (uint *)(ulonglong)local_b8; - puVar10 = puVar14; + *puVar15 = *puVar15 + iVar8; + puVar14[2] = puVar14[2] + iVar8; + puVar12 = local_c0; + } + if (local_88 != (undefined4 *)0x0) { + RtlClearBits(local_88,uVar7 - local_res18,iVar8); + uVar6 = 0; + puVar12 = local_c0; + } + uVar16 = 1; + local_a8 = 1; + local_94 = uVar9; + uVar7 = uVar9; + } + if (((int)uVar16 == 1) && (uVar17 == 0)) { + if (local_88 != (undefined4 *)0x0) { + RtlSetBits(local_88,uVar7 - local_res18,uVar9 - uVar7); + uVar6 = 0; + puVar12 = local_c0; + } + local_a8 = (uint)uVar6; + uVar16 = uVar6 & 0xffffffff; + local_94 = uVar9; + uVar7 = uVar9; + } + if (((param_5 != (char)uVar6) || (*(int *)(param_2 + 0xd8) == 1)) && + (cVar5 = FatInterpretClusterType(param_2,uVar17), (int)CONCAT71(extraout_var,cVar5) == 2)) { + FatAddMcbEntry(param_2,param_2 + 0x1a0,(ulonglong)local_90, + ((ulonglong)(uVar9 - 2) << (*(byte *)(param_2 + 0x17a) & 0x3f)) + + *(longlong *)(param_2 + 0x160),iVar13); + local_90 = local_90 + iVar13; + uVar6 = 0; + puVar12 = local_c0; + local_44 = local_90; + } + puVar10 = (uint *)(ulonglong)local_b8; + puVar11 = puVar14; } *(uint *)(param_2 + 200) = *(uint *)(param_2 + 200) | 0x100000; - if ((int)uVar17 == 0) { + if ((int)uVar16 == 0) { if (puVar15 != (uint *)0x0) { - *puVar15 = *puVar15 + (uVar8 - uVar6); - puVar10[2] = puVar10[2] + (uVar8 - uVar6); - } - if (local_90 == (undefined4 *)0x0) goto LAB_0; - RtlClearBits(local_90,uVar6 - local_res18); + *puVar15 = *puVar15 + (uVar9 - uVar7); + puVar11[2] = puVar11[2] + (uVar9 - uVar7); + } + if (local_88 == (undefined4 *)0x0) goto LAB_0; + RtlClearBits(local_88,uVar7 - local_res18); } else { - if (local_90 == (undefined4 *)0x0) goto LAB_0; - RtlSetBits(local_90,uVar6 - local_res18); - } - uVar13 = 0; + if (local_88 == (undefined4 *)0x0) goto LAB_0; + RtlSetBits(local_88,uVar7 - local_res18); + } + uVar6 = 0; LAB_0: - if (param_5 != (char)uVar13) { - puVar10[1] = uVar8 - 1; + if (param_5 != (char)uVar6) { + puVar11[1] = uVar9 - 1; } if (param_6 != (uint *)0x0) { if (*(longlong *)(param_2 + 0x1c8) != 0) { ExFreePoolWithTag(*(longlong *)(param_2 + 0x1c8),0); } - RtlInitializeBitMap(param_2 + 0x1c0,local_78,(local_res20 - local_res18) + 1); - local_78 = 0; + RtlInitializeBitMap(param_2 + 0x1c0,local_70,(local_res20 - local_res18) + 1); + local_70 = 0; *(uint **)(param_2 + 0xe8) = param_6; *(undefined4 *)(param_2 + 0x2f8) = 0xffffffff; if (puVar15 != (uint *)0x0) { param_6[2] = *puVar15; } } - lVar4 = local_78; - if (local_a8 != 0) { + lVar4 = local_70; + if (local_a0 != 0) { CcUnpinData(); - local_a8 = 0; + local_a0 = 0; } if (lVar4 != 0) { ExFreePoolWithTag(lVar4,0); } return; } ``` ## FatSetupAllocationSupport ### Match Info |Key|fastfat-10.0.26100.1150.sys - fastfat-10.0.26100.3470.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.22| |i_ratio|0.38| |m_ratio|0.8| |b_ratio|0.51| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-10.0.26100.1150.sys|fastfat-10.0.26100.3470.sys| | :---: | :---: | :---: | |name|FatSetupAllocationSupport|FatSetupAllocationSupport| |fullname|FatSetupAllocationSupport|FatSetupAllocationSupport| |refcount|4|4| |`length`|1114|1690| |`called`|FatExamineFatEntries
FatInitializeCacheMap
FatLogOf
FatSelectBestWindow
NTOSKRNL.EXE::CcSetFileSizes
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::RtlFindClearBits
NTOSKRNL.EXE::RtlInitializeBitMap
__security_check_cookie|
Expand for full list:
FatExamineFatEntries
FatInitializeCacheMap
FatLogOf
FatSelectBestWindow
Feature_371473723__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::CcSetFileSizes
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::RtlFindClearBits
NTOSKRNL.EXE::RtlInitializeBitMap
__security_check_cookie
| |calling|FatMountVolume
FatVerifyVolume|FatMountVolume
FatVerifyVolume| |paramcount|2|2| |`address`|1c00291a0|1c002a1f8| |sig|undefined __fastcall FatSetupAllocationSupport(longlong param_1, longlong param_2)|undefined __fastcall FatSetupAllocationSupport(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### FatSetupAllocationSupport Called Diff ```diff --- FatSetupAllocationSupport called +++ FatSetupAllocationSupport called @@ -4,0 +5 @@ +Feature_371473723__private_IsEnabledDeviceUsageNoInline @@ -6,0 +8 @@ +NTOSKRNL.EXE::ExRaiseStatus ``` ### FatSetupAllocationSupport Diff ```diff --- FatSetupAllocationSupport +++ FatSetupAllocationSupport @@ -1,170 +1,249 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void FatSetupAllocationSupport(longlong param_1,longlong param_2) { uint *puVar1; - ushort uVar2; - ushort uVar3; + byte bVar2; + byte bVar3; ushort uVar4; ushort uVar5; - undefined1 auVar6 [12]; - undefined1 auVar7 [16]; - char cVar8; - undefined1 uVar9; - uint uVar10; - uint uVar11; + ushort uVar6; + char cVar7; + undefined1 uVar8; + uint uVar9; + int iVar10; + ulonglong uVar11; undefined8 uVar12; uint uVar13; - int iVar14; + uint uVar14; int iVar15; - uint uVar16; - ulonglong uVar17; - uint uVar18; + ulonglong uVar16; + ushort uVar17; + bool bVar18; + bool bVar19; undefined1 auStackY_98 [32]; ulonglong local_48; ulonglong local_40; undefined8 local_38; ulonglong local_30; local_30 = __security_cookie ^ (ulonglong)auStackY_98; - uVar2 = *(ushort *)(param_2 + 0x12e); - uVar3 = *(ushort *)(param_2 + 0x120); + uVar17 = *(ushort *)(param_2 + 0x12e); + uVar14 = (uint)uVar17; + uVar4 = *(ushort *)(param_2 + 0x120); puVar1 = (uint *)(param_2 + 0x13c); - uVar13 = (uint)uVar2; - uVar11 = uVar13; - if (uVar2 == 0) { - uVar11 = *puVar1; - } - uVar18 = (uint)*(ushort *)(param_2 + 0x124); - iVar15 = uVar18 * uVar3; - uVar16 = (uint)*(byte *)(param_2 + 0x126); - *(ulonglong *)(param_2 + 0x158) = (ulonglong)(uVar16 * uVar3 * uVar11 + iVar15); - uVar4 = *(ushort *)(param_2 + 0x128); - *(uint *)(param_2 + 0x168) = (uint)uVar4 * 0x20; - uVar11 = uVar13; - if (uVar2 == 0) { - uVar11 = *puVar1; + if (uVar17 == 0) { + uVar9 = *puVar1; + } + else { + uVar9 = (uint)uVar17; + } + iVar15 = (uint)*(ushort *)(param_2 + 0x124) * (uint)uVar4; + *(ulonglong *)(param_2 + 0x158) = + (ulonglong)(uVar9 * *(byte *)(param_2 + 0x126) * (uint)uVar4 + iVar15); + iVar10 = (uint)*(ushort *)(param_2 + 0x128) * 0x20; + *(int *)(param_2 + 0x168) = iVar10; + if (uVar17 == 0) { + uVar14 = *puVar1; } *(ulonglong *)(param_2 + 0x160) = - (ulonglong) - ((uint)*(byte *)(param_2 + 0x126) * (uint)uVar3 * uVar11 + (uint)uVar4 * 0x20 + iVar15); - uVar5 = *(ushort *)(param_2 + 0x12a); - uVar11 = (uint)uVar5; - if (uVar2 == 0) { - uVar10 = uVar11; - if (uVar5 == 0) { - uVar10 = *(uint *)(param_2 + 0x138); - } - uVar17 = (ulonglong)*(byte *)(param_2 + 0x122); - uVar10 = ((uVar10 - uVar16 * *puVar1) - (uint)*(ushort *)(param_2 + 0x124)) / - (uint)*(byte *)(param_2 + 0x122); - } - else { - uVar10 = uVar11; - if (uVar5 == 0) { - uVar10 = *(uint *)(param_2 + 0x138); - } - uVar17 = (ulonglong)*(byte *)(param_2 + 0x122); - auVar6._8_4_ = 0; - auVar6._0_8_ = CONCAT62(0,uVar3); - uVar10 = (uint)((((ulonglong)uVar10 - SUB128((ZEXT212(uVar4) << 5) / auVar6,0)) - - (ulonglong)(uVar18 + uVar16 * uVar13)) / uVar17); - } - *(uint *)(param_2 + 0x16c) = uVar10; - if (uVar2 == 0) { - cVar8 = ' '; - } - else { - if (uVar5 == 0) { - uVar11 = *(uint *)(param_2 + 0x138); - } - auVar7._8_8_ = 0; - auVar7._0_8_ = CONCAT62(0,uVar3); - cVar8 = (-((((ulonglong)uVar11 - SUB168((ZEXT216(uVar4) << 5) / auVar7,0)) - - (ulonglong)(uVar18 + uVar16 * uVar13)) / uVar17 < 0xff7) & 0xfcU) + 0x10; - } - *(char *)(param_2 + 0x178) = cVar8; - uVar9 = FatLogOf((uint)uVar3); - *(undefined1 *)(param_2 + 0x179) = uVar9; - uVar9 = FatLogOf((uint)*(ushort *)(param_2 + 0x120) * (uint)*(byte *)(param_2 + 0x122)); - *(undefined1 *)(param_2 + 0x17a) = uVar9; + (ulonglong)(iVar10 + uVar14 * *(byte *)(param_2 + 0x126) * (uint)uVar4 + iVar15); + uVar11 = Feature_371473723__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar11 != 0) { + uVar17 = *(ushort *)(param_2 + 0x12a); + uVar14 = (uint)uVar17; + if (*(ushort *)(param_2 + 0x12e) == 0) { + if (uVar17 == 0) { + uVar14 = *(uint *)(param_2 + 0x138); + } + uVar11 = (ulonglong)*(byte *)(param_2 + 0x126) * (ulonglong)*puVar1; + if (((0xffffffff < uVar11) || + (uVar9 = (int)uVar11 + (uint)*(ushort *)(param_2 + 0x124), + uVar9 < *(ushort *)(param_2 + 0x124))) || (uVar14 < uVar9)) { +LAB_0: + *(undefined4 *)(param_1 + 0x48) = 0xc0000102; + /* WARNING: Subroutine does not return */ + ExRaiseStatus(); + } + } + else { + uVar14 = (uint)uVar17; + if (uVar17 == 0) { + uVar14 = *(uint *)(param_2 + 0x138); + } + uVar9 = (uint)*(ushort *)(param_2 + 0x12e) * (uint)*(byte *)(param_2 + 0x126) + + (uint)*(ushort *)(param_2 + 0x124); + if (((uVar9 < *(ushort *)(param_2 + 0x124)) || + (uVar13 = (int)(((ulonglong)*(ushort *)(param_2 + 0x128) << 5) / + (ulonglong)*(ushort *)(param_2 + 0x120)) + uVar9, uVar13 < uVar9)) || + (uVar14 < uVar13)) goto LAB_0; + } + } + uVar17 = *(ushort *)(param_2 + 0x12e); + uVar4 = *(ushort *)(param_2 + 0x12a); + uVar14 = (uint)uVar4; + if (uVar17 == 0) { + uVar9 = uVar14; + if (uVar4 == 0) { + uVar9 = *(uint *)(param_2 + 0x138); + } + bVar2 = *(byte *)(param_2 + 0x126); + uVar5 = *(ushort *)(param_2 + 0x124); + bVar3 = *(byte *)(param_2 + 0x122); + uVar9 = ((uVar9 - (uint)bVar2 * *puVar1) - (uint)uVar5) / (uint)bVar3; + uVar6 = *(ushort *)(param_2 + 0x120); + } + else { + uVar9 = uVar14; + if (uVar4 == 0) { + uVar9 = *(uint *)(param_2 + 0x138); + } + bVar2 = *(byte *)(param_2 + 0x126); + uVar5 = *(ushort *)(param_2 + 0x124); + uVar6 = *(ushort *)(param_2 + 0x120); + bVar3 = *(byte *)(param_2 + 0x122); + uVar9 = (uint)((((ulonglong)uVar9 - (ulonglong)((uint)bVar2 * (uint)uVar17 + (uint)uVar5)) - + SUB168((ZEXT216(*(ushort *)(param_2 + 0x128)) << 5) / ZEXT216(uVar6),0)) / + (ulonglong)bVar3); + } + *(uint *)(param_2 + 0x16c) = uVar9; + if (uVar17 == 0) { + cVar7 = ' '; + } + else { + if (uVar4 == 0) { + uVar14 = *(uint *)(param_2 + 0x138); + } + uVar6 = *(ushort *)(param_2 + 0x120); + cVar7 = (-((((ulonglong)uVar14 - (ulonglong)((uint)bVar2 * (uint)uVar17 + (uint)uVar5)) - + SUB168((ZEXT216(*(ushort *)(param_2 + 0x128)) << 5) / ZEXT216(uVar6),0)) / + (ulonglong)bVar3 < 0xff7) & 0xfcU) + 0x10; + } + *(char *)(param_2 + 0x178) = cVar7; + uVar8 = FatLogOf((uint)uVar6); + *(undefined1 *)(param_2 + 0x179) = uVar8; + uVar8 = FatLogOf((uint)*(byte *)(param_2 + 0x122) * (uint)*(ushort *)(param_2 + 0x120)); + *(undefined1 *)(param_2 + 0x17a) = uVar8; *(undefined4 *)(param_2 + 0x170) = 0; *(undefined4 *)(param_2 + 0x174) = 0x1000; - if (*(char *)(param_2 + 0x178) == ' ') { - uVar11 = *puVar1; - } - else { - uVar11 = (uint)*(ushort *)(param_2 + 0x12e); - } - uVar2 = *(ushort *)(param_2 + 0x12e); - if (uVar2 == 0) { - uVar13 = 0x20; - } - else { - if (*(ushort *)(param_2 + 0x12a) == 0) { - uVar17 = (ulonglong)*(uint *)(param_2 + 0x138); - } - else { - uVar17 = (ulonglong)*(ushort *)(param_2 + 0x12a); - } - uVar13 = (-(uint)((((uVar17 - SUB168((ZEXT216(*(ushort *)(param_2 + 0x128)) << 5) / - ZEXT216(*(ushort *)(param_2 + 0x120)),0)) - - (ulonglong)uVar2 * (ulonglong)*(byte *)(param_2 + 0x126)) - - (ulonglong)*(ushort *)(param_2 + 0x124)) / - (ulonglong)*(byte *)(param_2 + 0x122) < 0xff7) & 0xfffffffc) + 0x10; - } - uVar3 = *(ushort *)(param_2 + 0x120); - uVar11 = (uVar3 * uVar11 * 8) / uVar13 - 2; - if (uVar11 < *(uint *)(param_2 + 0x16c)) { - *(uint *)(param_2 + 0x16c) = uVar11; - } - if (uVar2 == 0) { - uVar11 = *puVar1; - } - else { - uVar11 = (uint)uVar2; - } - local_48 = (ulonglong)((*(ushort *)(param_2 + 0x124) + uVar11) * (uint)uVar3); + uVar11 = Feature_371473723__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar11 == 0) { + if (*(char *)(param_2 + 0x178) == ' ') { + uVar14 = *puVar1; + } + else { + uVar14 = (uint)*(ushort *)(param_2 + 0x12e); + } + uVar17 = *(ushort *)(param_2 + 0x12e); + if (uVar17 == 0) { + uVar9 = 0x20; + } + else { + if (*(ushort *)(param_2 + 0x12a) == 0) { + uVar11 = (ulonglong)*(uint *)(param_2 + 0x138); + } + else { + uVar11 = (ulonglong)*(ushort *)(param_2 + 0x12a); + } + uVar9 = (-(uint)((((uVar11 - SUB168((ZEXT216(*(ushort *)(param_2 + 0x128)) << 5) / + ZEXT216(*(ushort *)(param_2 + 0x120)),0)) - + (ulonglong)*(byte *)(param_2 + 0x126) * (ulonglong)uVar17) - + (ulonglong)*(ushort *)(param_2 + 0x124)) / + (ulonglong)*(byte *)(param_2 + 0x122) < 0xff7) & 0xfffffffc) + 0x10; + } + uVar14 = (*(ushort *)(param_2 + 0x120) * uVar14 * 8) / uVar9 - 2; + uVar11 = (ulonglong)uVar14; + uVar16 = (ulonglong)(uint)*(ushort *)(param_2 + 0x120); + bVar18 = *(uint *)(param_2 + 0x16c) < uVar14; + bVar19 = *(uint *)(param_2 + 0x16c) == uVar14; + } + else { + if (*(char *)(param_2 + 0x178) == ' ') { + uVar14 = *puVar1; + } + else { + uVar14 = (uint)*(ushort *)(param_2 + 0x12e); + } + uVar17 = *(ushort *)(param_2 + 0x12e); + if (uVar17 == 0) { + uVar11 = 0x20; + } + else { + if (*(ushort *)(param_2 + 0x12a) == 0) { + uVar11 = (ulonglong)*(uint *)(param_2 + 0x138); + } + else { + uVar11 = (ulonglong)*(ushort *)(param_2 + 0x12a); + } + uVar11 = (-(ulonglong) + ((((uVar11 - SUB168((ZEXT216(*(ushort *)(param_2 + 0x128)) << 5) / + ZEXT216(*(ushort *)(param_2 + 0x120)),0)) - + (ulonglong)*(byte *)(param_2 + 0x126) * (ulonglong)uVar17) - + (ulonglong)*(ushort *)(param_2 + 0x124)) / (ulonglong)*(byte *)(param_2 + 0x122) < + 0xff7) & 0xfffffffffffffffc) + 0x10; + } + uVar16 = (ulonglong)*(ushort *)(param_2 + 0x120); + uVar11 = (uVar16 * uVar14 * 8) / uVar11 - 2; + bVar18 = *(uint *)(param_2 + 0x16c) < uVar11; + bVar19 = *(uint *)(param_2 + 0x16c) == uVar11; + } + if (!bVar18 && !bVar19) { + *(int *)(param_2 + 0x16c) = (int)uVar11; + } + if (uVar17 == 0) { + uVar14 = *puVar1; + } + else { + uVar14 = (uint)uVar17; + } + local_48 = (ulonglong)((*(ushort *)(param_2 + 0x124) + uVar14) * (int)uVar16); local_38 = 0x7fffffffffffffff; local_40 = local_48; if (*(longlong *)(*(longlong *)(param_2 + 0x2d8) + 0x30) == 0) { FatInitializeCacheMap - (*(longlong *)(param_2 + 0x2d8),&local_48,(ulonglong)CONCAT11((char)(uVar3 >> 8),1), - &DAT_0,param_2); + (*(longlong *)(param_2 + 0x2d8),&local_48,CONCAT71((int7)(uVar16 >> 8),1), + &DAT_1,param_2); } else { CcSetFileSizes(); } if ((*(char *)(param_2 + 0x178) == ' ') && (0x10000 < *(uint *)(param_2 + 0x16c))) { - uVar11 = *(uint *)(param_2 + 0x16c) + 0xffff >> 0x10; - *(uint *)(param_2 + 0xd8) = uVar11; + uVar11 = Feature_371473723__private_IsEnabledDeviceUsageNoInline(); + uVar14 = *(uint *)(param_2 + 0x16c); + if (((int)uVar11 != 0) && (uVar14 + 0xffff < uVar14)) { + *(undefined4 *)(param_1 + 0x48) = 0xc0000102; + /* WARNING: Subroutine does not return */ + ExRaiseStatus(); + } + uVar14 = uVar14 + 0xffff >> 0x10; + *(uint *)(param_2 + 0xd8) = uVar14; } else { *(undefined4 *)(param_2 + 0xd8) = 1; - uVar11 = 1; - } - uVar12 = ExAllocatePoolWithTag(0x411,uVar11 * 0xc,0x57746146); + uVar14 = 1; + } + uVar12 = ExAllocatePoolWithTag(0x411,uVar14 * 0xc,0x57746146); *(undefined8 *)(param_2 + 0xe0) = uVar12; RtlInitializeBitMap(param_2 + 0x1c0,0,0); if (*(uint *)(param_2 + 0xd8) < 2) { *(undefined4 **)(param_2 + 0xe8) = *(undefined4 **)(param_2 + 0xe0); **(undefined4 **)(param_2 + 0xe0) = 2; *(int *)(*(longlong *)(param_2 + 0xe8) + 4) = *(int *)(param_2 + 0x16c) + 1; } else { FatExamineFatEntries(param_1,param_2,2,*(int *)(param_2 + 0x16c) + 1,'\x01',(uint *)0x0,0); - uVar11 = FatSelectBestWindow(param_2); - *(ulonglong *)(param_2 + 0xe8) = *(longlong *)(param_2 + 0xe0) + (ulonglong)uVar11 * 0xc; + uVar14 = FatSelectBestWindow(param_2); + *(ulonglong *)(param_2 + 0xe8) = *(longlong *)(param_2 + 0xe0) + (ulonglong)uVar14 * 0xc; } FatExamineFatEntries(param_1,param_2,0,0,'\0',*(uint **)(param_2 + 0xe8),0); - iVar15 = RtlFindClearBits(param_2 + 0x1c0,1,0); - iVar14 = iVar15 + 2; - if (iVar15 == -1) { - iVar14 = 2; - } - *(int *)(param_2 + 0x2f8) = iVar14; + iVar10 = RtlFindClearBits(param_2 + 0x1c0,1,0); + iVar15 = iVar10 + 2; + if (iVar10 == -1) { + iVar15 = 2; + } + *(int *)(param_2 + 0x2f8) = iVar15; return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|fastfat-10.0.26100.1150.sys - fastfat-10.0.26100.3470.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-10.0.26100.1150.sys|fastfat-10.0.26100.3470.sys| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|42|47| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|1c000df18|1c000ea08| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::IoDeleteDevice ### Match Info |Key|fastfat-10.0.26100.1150.sys - fastfat-10.0.26100.3470.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|fastfat-10.0.26100.1150.sys|fastfat-10.0.26100.3470.sys| | :---: | :---: | :---: | |name|IoDeleteDevice|IoDeleteDevice| |fullname|NTOSKRNL.EXE::IoDeleteDevice|NTOSKRNL.EXE::IoDeleteDevice| |`refcount`|10|13| |length|0|0| |called||| |calling|DriverEntry
FatCheckForDismount
FatCommonShutdown
FatCommonShutdown$fin$0
FatMountVolume
FatMountVolume$fin$1|DriverEntry
FatCheckForDismount
FatCommonShutdown
FatCommonShutdown$fin$0
FatMountVolume
FatMountVolume$fin$1| |paramcount|0|0| |`address`|EXTERNAL:0000008e|EXTERNAL:00000097| |sig|undefined IoDeleteDevice(void)|undefined IoDeleteDevice(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## __security_check_cookie ### Match Info |Key|fastfat-10.0.26100.1150.sys - fastfat-10.0.26100.3470.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|fastfat-10.0.26100.1150.sys|fastfat-10.0.26100.3470.sys| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|79|84| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
ComputeFlushPeriod
DplWrapDeriveKey
DplWrapProtect
EEL_DplStateChange_WriteEvent
EEL_EtwEventHandler
EEL_GetUserSidStringForToken
EEL_LogInternalError
EEL_PolicyUpdate_WriteEvent
EdpEnforcementLog_AutomaticEncryption
EdpEnforcementLog_FileAccessDenied
EdpEnforcementLog_FileRequiresEncryptionEfsDecryptFekClient
EfsGenerateKeyClient
EfsInitFekProtection
EfsOpenFile
EfsReadEfsData
EfsRpcInit
EfspClipSpDecryptFek
EfspConstructNewPfileHeader
EfspFileRequiresEncryption
EfspIsCryptoOffloadTurnedOffByOverride
EfspPostCreate
EfspPostCreatePrepareAndSendFsctl
EfspTraceLogAssert
EfspValidateAndParseFsctl
EnableFlushTimer
FatCheckManageVolumeAccess
FatCommonCreate
FatConstructDirent
FatConvertQueryStringTo8dot3
FatCreateEncryptOnCloseProcessing
FatCreateNewDirectory
FatCreateNewFile
FatDeleteEfsAttributeOnDirectory
FatDetermineAndMarkFcbCondition
FatExplicitDeviceAccessGranted
FatFatDateToNtTime
FatFatTimeToNtTime
FatGetCompatibilityModeValue
FatGetCurrentFatTime
FatGetEaLength
FatGetNeedEaCount
FatGetUnicodeNameFromFcb
FatInitializeVcb
FatIsDirectoryEmpty
FatIsFujitsuFMR
FatLocateDirent
FatMountVolume
FatNonCachedIo
FatNtTimeToFatTime
FatPrefetchPages
FatQueryDirectory
FatQueryNameInfo
FatQueryShortNameInfo
FatSearchBufferForLabel
FatSearchRemainderOfDirectoryForCollisions
FatSelectNames
FatSetFatRun
FatSetFsLabelInfo
FatSetPfileExtensionOnDisk
FatSetRenameInfo
FatSetupAllocationSupport
FatSqmAddToStreamEx
FatSqmVolumeInfo
FatTelemetryMount
FatTelemetryPeriodicVolume
FatTunnelFcbOrDcb
FatVerifyVolume
LookUpTableFlushComplete
MD5Final
QueryAttributes
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
_tlgWriteTemplate::Write<_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>,_tlgWrapperByRef<16>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>_>
desexpand128to192
rijndaelDecrypt256
rijndaelEncrypt256
rijndaelKeySched
|
Expand for full list:
ComputeFlushPeriod
DplWrapDeriveKey
DplWrapProtect
EEL_DplStateChange_WriteEvent
EEL_EtwEventHandler
EEL_GetUserSidStringForToken
EEL_LogInternalError
EEL_PolicyUpdate_WriteEvent
EdpEnforcementLog_AutomaticEncryption
EdpEnforcementLog_FileAccessDenied
EdpEnforcementLog_FileRequiresEncryptionEfsDecryptFekClient
EfsGenerateKeyClient
EfsInitFekProtection
EfsOpenFile
EfsReadEfsData
EfsRpcInit
EfspClipSpDecryptFek
EfspConstructNewPfileHeader
EfspFileRequiresEncryption
EfspIsCryptoOffloadTurnedOffByOverride
EfspPostCreate
EfspPostCreatePrepareAndSendFsctl
EfspTraceLogAssert
EfspValidateAndParseFsctl
EnableFlushTimer
FatCheckManageVolumeAccess
FatCommonCreate
FatConstructDirent
FatConvertQueryStringTo8dot3
FatCreateEncryptOnCloseProcessing
FatCreateNewDirectory
FatCreateNewFile
FatDeleteEfsAttributeOnDirectory
FatDetermineAndMarkFcbCondition
FatExplicitDeviceAccessGranted
FatFatDateToNtTime
FatFatTimeToNtTime
FatGetCompatibilityModeValue
FatGetCurrentFatTime
FatGetEaLength
FatGetNeedEaCount
FatGetUnicodeNameFromFcb
FatInitializeVcb
FatIsDirectoryEmpty
FatIsFujitsuFMR
FatLocateDirent
FatMountVolume
FatNonCachedIo
FatNtTimeToFatTime
FatPrefetchPages
FatQueryDirectory
FatQueryNameInfo
FatQueryShortNameInfo
FatSearchBufferForLabel
FatSearchRemainderOfDirectoryForCollisions
FatSelectNames
FatSetFatRun
FatSetFsLabelInfo
FatSetPfileExtensionOnDisk
FatSetRenameInfo
FatSetupAllocationSupport
FatSqmAddToStreamEx
FatSqmVolumeInfo
FatTelemetryMount
FatTelemetryPeriodicVolume
FatTunnelFcbOrDcb
FatVerifyVolume
LookUpTableFlushComplete
MD5Final
QueryAttributes
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
__GSHandlerCheckCommon
_tlgWriteTemplate::Write<_tlgWrapperByVal<8>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>,_tlgWrapperByRef<16>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<8>,_tlgWrapperByVal<1>,_tlgWrapperBinary,_tlgWrapperByVal<4>,_tlgWrapperByVal<1>_>
desexpand128to192
rijndaelDecrypt256
rijndaelEncrypt256
rijndaelKeySched
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates
| |paramcount|1|1| |`address`|1c000e120|1c000ec10| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -78,0 +79,5 @@ +wil_RtlStagingConfig_QueryFeatureState +wil_details_FeatureReporting_ReportUsageToServiceDirect +wil_details_PopulateInitialConfiguredFeatureStates +wil_details_RecordCachedUsage +wil_details_UpdateFeatureConfiguredStates ``` ## NTOSKRNL.EXE::ExRaiseStatus ### Match Info |Key|fastfat-10.0.26100.1150.sys - fastfat-10.0.26100.3470.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|fastfat-10.0.26100.1150.sys|fastfat-10.0.26100.3470.sys| | :---: | :---: | :---: | |name|ExRaiseStatus|ExRaiseStatus| |fullname|NTOSKRNL.EXE::ExRaiseStatus|NTOSKRNL.EXE::ExRaiseStatus| |`refcount`|146|149| |length|0|0| |called||| |`calling`|
Expand for full list:
EfsXtsAesDec
EfsXtsAesEnc
FatAddEaSet
FatAllocateDiskSpace
FatCommonCleanup
FatCommonCreate
FatCommonCreateOnNewStack
FatCommonRead
FatCommonWrite
FatComputeMoveFileSplicePoints
FatCreateEaFatCreateIrpContext
FatCreateNewDirectory
FatCreateNewDirent
FatCreateNewFile
FatDeleteEa
FatDeleteEaSet
FatFlushDirentForFile
FatFlushFatEntries
FatForceCacheMiss
FatGetDirentFromFcbOrDcb
FatGetEaFile
FatGetEaLength
FatGetEfsInfoFromHeaderOnDisk
FatGetNeedEaCount
FatGetRetrievalPointers
FatGetUnicodeNameFromFcb
FatLocateDirent
FatLockUserBuffer
FatLookupFatEntry
FatLookupFileAllocation
FatLookupFileAllocationSize
FatMapUserBuffer
FatMountVolume
FatMoveFile
FatMultipleAsync
FatNonCachedIo
FatNonCachedNonAlignedRead
FatNotifyChangeDirectory
FatOpenExistingDcb
FatOpenExistingDirectory
FatOpenExistingFcb
FatOpenExistingFile
FatPerformVerify
FatPerformVerifyDiskRead
FatPinEaRange
FatPinMappedData
FatPrepareWriteDirectoryFile
FatPrepareWriteVolumeFile
FatQuickVerifyVcb
FatReadDirectoryFile
FatReadEaSet
FatReadVolumeFile
FatSetDispositionInfo
FatSetEndOfFileInfo
FatSetFatEntry
FatSetFatRun
FatSetFullNameInFcb
FatSetPfileExtensionOnDisk
FatSingleNonAlignedSync
FatSupersedeOrOverwriteFile
FatUnicodeToUpcaseOem
FatUnpinRepinnedBcbs
FatVerifyFcb
FatVerifyLookupFatEntry
FatVerifyOperationIsLegal
FatVerifyVcb
FatVerifyVolume
NtOfsSetLength
|
Expand for full list:
EfsXtsAesDec
EfsXtsAesEnc
FatAddEaSet
FatAllocateDiskSpace
FatCommonCleanup
FatCommonCreate
FatCommonCreateOnNewStack
FatCommonRead
FatCommonWrite
FatComputeMoveFileSplicePoints
FatCreateEaFatCreateIrpContext
FatCreateNewDirectory
FatCreateNewDirent
FatCreateNewFile
FatDeleteEa
FatDeleteEaSet
FatExamineFatEntries
FatFlushDirentForFile
FatFlushFatEntries
FatForceCacheMiss
FatGetDirentFromFcbOrDcb
FatGetEaFile
FatGetEaLength
FatGetEfsInfoFromHeaderOnDisk
FatGetNeedEaCount
FatGetRetrievalPointers
FatGetUnicodeNameFromFcb
FatLocateDirent
FatLockUserBuffer
FatLookupFatEntry
FatLookupFileAllocation
FatLookupFileAllocationSize
FatMapUserBuffer
FatMountVolume
FatMoveFile
FatMultipleAsync
FatNonCachedIo
FatNonCachedNonAlignedRead
FatNotifyChangeDirectory
FatOpenExistingDcb
FatOpenExistingDirectory
FatOpenExistingFcb
FatOpenExistingFile
FatPerformVerify
FatPerformVerifyDiskRead
FatPinEaRange
FatPinMappedData
FatPrepareWriteDirectoryFile
FatPrepareWriteVolumeFile
FatQuickVerifyVcb
FatReadDirectoryFile
FatReadEaSet
FatReadVolumeFile
FatSetDispositionInfo
FatSetEndOfFileInfo
FatSetFatEntry
FatSetFatRun
FatSetFullNameInFcb
FatSetPfileExtensionOnDisk
FatSetupAllocationSupport
FatSingleNonAlignedSync
FatSupersedeOrOverwriteFile
FatUnicodeToUpcaseOem
FatUnpinRepinnedBcbs
FatVerifyFcb
FatVerifyLookupFatEntry
FatVerifyOperationIsLegal
FatVerifyVcb
FatVerifyVolume
NtOfsSetLength
| |paramcount|0|0| |`address`|EXTERNAL:00000102|EXTERNAL:0000010e| |sig|noreturn undefined ExRaiseStatus(void)|noreturn undefined ExRaiseStatus(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExRaiseStatus Calling Diff ```diff --- NTOSKRNL.EXE::ExRaiseStatus calling +++ NTOSKRNL.EXE::ExRaiseStatus calling @@ -17,0 +18 @@ +FatExamineFatEntries @@ -59,0 +61 @@ +FatSetupAllocationSupport ``` Generated with `ghidriff` version: 1.0.0 on 2026-07-28T09:19:17