# kst-4768.sys-kst-4946.sys Diff

# TOC

* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
	* [Ghidra Diff Engine](#ghidra-diff-engine)
		* [Command Line](#command-line)
	* [Binary Metadata Diff](#binary-metadata-diff)
	* [Program Options](#program-options)
	* [Diff Stats](#diff-stats)
	* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
	* [Feature_4034713912__private_IsEnabledDeviceUsageNoInline](#feature_4034713912__private_isenableddeviceusagenoinline)
	* [Feature_4034713912__private_IsEnabledFallback](#feature_4034713912__private_isenabledfallback)
* [Modified](#modified)
	* [CKSAutomationThunk::HandleArrayProperty](#cksautomationthunkhandlearrayproperty)
* [Modified (No Code Changes)](#modified-no-code-changes)
	* [__GSHandlerCheck](#__gshandlercheck)
	* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)
	* [__security_check_cookie](#__security_check_cookie)
	* [NTOSKRNL.EXE::RtlLogUnexpectedCodepath](#ntoskrnlexertllogunexpectedcodepath)

# Visual Chart Diff



```mermaid

flowchart LR

CKSAutomationThunkHandleArrayProperty-3-old<--Match 64%-->CKSAutomationThunkHandleArrayProperty-3-new

subgraph kst-4946.sys
    CKSAutomationThunkHandleArrayProperty-3-new
    subgraph Added
direction LR
Feature_4034713912__private_IsEnabledDeviceUsageNoInline
    Feature_4034713912__private_IsEnabledFallback
end
end

subgraph kst-4768.sys
    CKSAutomationThunkHandleArrayProperty-3-old
    
end

```


```mermaid
pie showData
    title Function Matches - 99.4792%
"unmatched_funcs_len" : 2
"matched_funcs_len" : 382
```



```mermaid
pie showData
    title Matched Function Similarity - 98.6911%
"matched_funcs_with_code_changes_len" : 1
"matched_funcs_with_non_code_changes_len" : 4
"matched_funcs_no_changes_len" : 377
```

# Metadata

## Ghidra Diff Engine

### Command Line

#### Captured Command Line


```
ghidriff --project-location ./proj --project-name kst-53149 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 kst-4768.sys kst-4946.sys
```


#### Verbose Args


<details>

```
--old ['kst-4768.sys'] --new [['kst-4946.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name kst-53149 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```


</details>

#### Download Original PEs


```
wget https://msdl.microsoft.com/download/symbols/ksthunk.sys/24B889A912000/ksthunk.sys -O ksthunk.sys.x64.10.0.26100.4768
wget https://msdl.microsoft.com/download/symbols/ksthunk.sys/533CC3B812000/ksthunk.sys -O ksthunk.sys.x64.10.0.26100.4946
```


## Binary Metadata Diff


```diff
--- kst-4768.sys Meta
+++ kst-4946.sys Meta
@@ -1,44 +1,44 @@
-Program Name: kst-4768.sys
+Program Name: kst-4946.sys
 Language ID: x86:LE:64:default (4.6)
 Compiler ID: windows
 Processor: x86
 Endian: Little
 Address Size: 64
 Minimum Address: 1c0000000
 Maximum Address: ff0000184f
 # of Bytes: 79952
 # of Memory Blocks: 14
-# of Instructions: 5545
-# of Defined Data: 760
-# of Functions: 191
-# of Symbols: 1118
+# of Instructions: 5616
+# of Defined Data: 767
+# of Functions: 193
+# of Symbols: 1132
 # of Data Types: 178
 # of Data Type Categories: 12
 Analyzed: true
 Compiler: visualstudio:unknown
 Created With Ghidra Version: 12.0.4
-Date Created: Sun Aug 16 15:04:33 SGT 2026
+Date Created: Sun Aug 16 15:04:36 SGT 2026
 Executable Format: Portable Executable (PE)
-Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/ksthunk-53149/kst-4768.sys
-Executable MD5: 05f742dc8fe0196a37700bf1e6121be5
-Executable SHA256: 31248ae43f53ffb1446ec95a078f9e56e14ccc556654fcb72c93dc3cb7406088
-FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/ksthunk-53149/kst-4768.sys?MD5=05f742dc8fe0196a37700bf1e6121be5
+Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/ksthunk-53149/kst-4946.sys
+Executable MD5: 4df07c04ce347ee6ed2be41a7bd119f5
+Executable SHA256: d7eba221b250de0c08bb829212261ddc3126588e931ea2e226d97d13f37f930e
+FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/ksthunk-53149/kst-4946.sys?MD5=4df07c04ce347ee6ed2be41a7bd119f5
 PDB Age: 1
 PDB File: ksthunk.pdb
-PDB GUID: e55e2053-1f03-7458-1a0d-bf388644f518
+PDB GUID: 0f38fc3f-3648-02c9-a694-0743473bda0d
 PDB Loaded: true
 PDB Version: RSDS
 PE Property[CompanyName]: Microsoft Corporation
 PE Property[FileDescription]: Kernel Streaming WOW Thunk Service
-PE Property[FileVersion]: 10.0.26100.4768 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.26100.4946 (WinBuild.160101.0800)
 PE Property[InternalName]: ksthunk.sys
 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
 PE Property[OriginalFilename]: ksthunk.sys
 PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.26100.4768
+PE Property[ProductVersion]: 10.0.26100.4946
 PE Property[Translation]: 4b00409
 Preferred Root Namespace Category: 
 RTTI Found: false
 Relocatable: true
 SectionAlignment: 4096
 Should Ask To Analyze: false

```


## Program Options


<details>
<summary>Ghidra kst-4768.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra kst-4768.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra kst-4768.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>


<details>
<summary>Ghidra kst-4946.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra kst-4946.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra kst-4946.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>

## Diff Stats



|Stat|Value|
| :---: | :---: |
|added_funcs_len|2|
|deleted_funcs_len|0|
|modified_funcs_len|5|
|added_symbols_len|3|
|deleted_symbols_len|1|
|diff_time|2.440084218978882|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 185, 'ExternalsName': 62})|
|items_to_process|11|
|diff_types|Counter({'refcount': 4, 'calling': 3, 'address': 2, 'code': 1, 'length': 1, 'called': 1})|
|unmatched_funcs_len|2|
|total_funcs_len|384|
|matched_funcs_len|382|
|matched_funcs_with_code_changes_len|1|
|matched_funcs_with_non_code_changes_len|4|
|matched_funcs_no_changes_len|377|
|match_func_similarity_percent|98.6911%|
|func_match_overall_percent|99.4792%|
|first_matches|Counter({'SymbolsHash': 185})|



```mermaid
pie showData
    title All Matches
"SymbolsHash" : 185
"ExternalsName" : 62
```



```mermaid
pie showData
    title First Matches
"SymbolsHash" : 185
```



```mermaid
pie showData
    title Diff Stats
"added_funcs_len" : 2
"deleted_funcs_len" : 0
"modified_funcs_len" : 5
```



```mermaid
pie showData
    title Symbols
"added_symbols_len" : 3
"deleted_symbols_len" : 1
```

## Strings


*No string differences found*

# Deleted

# Added

## Feature_4034713912__private_IsEnabledDeviceUsageNoInline

### Function Meta



|Key|kst-4946.sys|
| :---: | :---: |
|name|Feature_4034713912__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_4034713912__private_IsEnabledDeviceUsageNoInline|
|refcount|3|
|length|49|
|called|Feature_4034713912__private_IsEnabledFallback|
|calling|CKSAutomationThunk::HandleArrayProperty|
|paramcount|0|
|address|1c0003fa0|
|sig|ulonglong __fastcall Feature_4034713912__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_4034713912__private_IsEnabledDeviceUsageNoInline
+++ Feature_4034713912__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_4034713912__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+  ulonglong uVar1;
+  undefined8 local_res8;
+  
+  local_res8 = (ulonglong)Feature_4034713912__private_featureState;
+  if ((Feature_4034713912__private_featureState & 0x10) == 0) {
+    uVar1 = Feature_4034713912__private_IsEnabledFallback(local_res8,3);
+  }
+  else {
+    uVar1 = (ulonglong)(Feature_4034713912__private_featureState & 1);
+  }
+  return uVar1;
+}
+

```


## Feature_4034713912__private_IsEnabledFallback

### Function Meta



|Key|kst-4946.sys|
| :---: | :---: |
|name|Feature_4034713912__private_IsEnabledFallback|
|fullname|Feature_4034713912__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_4034713912__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|1c0003fd8|
|sig|undefined __fastcall Feature_4034713912__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_4034713912__private_IsEnabledFallback
+++ Feature_4034713912__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_4034713912__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+  wil_details_IsEnabledFallback(param_1,param_2,&Feature_4034713912__private_descriptor);
+  return;
+}
+

```


# Modified


*Modified functions contain code changes*
## CKSAutomationThunk::HandleArrayProperty

### Match Info



|Key|kst-4768.sys - kst-4946.sys|
| :---: | :---: |
|diff_type|code,length,called|
|ratio|0.24|
|i_ratio|0.55|
|m_ratio|0.85|
|b_ratio|0.64|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|kst-4768.sys|kst-4946.sys|
| :---: | :---: | :---: |
|name|HandleArrayProperty|HandleArrayProperty|
|fullname|CKSAutomationThunk::HandleArrayProperty|CKSAutomationThunk::HandleArrayProperty|
|refcount|2|2|
|`length`|594|761|
|`called`|KS.SYS::KsSynchronousIoControlDevice<br>NTOSKRNL.EXE::ExAllocatePoolWithTag<br>NTOSKRNL.EXE::ExFreePool|Feature_4034713912__private_IsEnabledDeviceUsageNoInline<br>KS.SYS::KsSynchronousIoControlDevice<br>NTOSKRNL.EXE::ExAllocatePoolWithTag<br>NTOSKRNL.EXE::ExFreePool<br>NTOSKRNL.EXE::RtlLogUnexpectedCodepath<br>__security_check_cookie|
|calling|||
|paramcount|3|3|
|address|1c0003110|1c0003110|
|sig|long __cdecl HandleArrayProperty(_IRP * param_1, KSIDENTIFIER * param_2, uint * param_3)|long __cdecl HandleArrayProperty(_IRP * param_1, KSIDENTIFIER * param_2, uint * param_3)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### CKSAutomationThunk::HandleArrayProperty Called Diff


```diff
--- CKSAutomationThunk::HandleArrayProperty called
+++ CKSAutomationThunk::HandleArrayProperty called
@@ -0,0 +1 @@
+Feature_4034713912__private_IsEnabledDeviceUsageNoInline
@@ -3,0 +5,2 @@
+NTOSKRNL.EXE::RtlLogUnexpectedCodepath
+__security_check_cookie
```


### CKSAutomationThunk::HandleArrayProperty Diff


```diff
--- CKSAutomationThunk::HandleArrayProperty
+++ CKSAutomationThunk::HandleArrayProperty
@@ -1,95 +1,150 @@
 
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
 /* public: static long __cdecl CKSAutomationThunk::HandleArrayProperty(struct _IRP * __ptr64,struct
    KSIDENTIFIER * __ptr64,unsigned int * __ptr64) */
 
 long __cdecl
 CKSAutomationThunk::HandleArrayProperty(_IRP *param_1,KSIDENTIFIER *param_2,uint *param_3)
 
 {
-  longlong lVar1;
+  long lVar1;
   int iVar2;
   ulonglong *puVar3;
-  ulonglong *puVar4;
-  long lVar5;
+  ulonglong uVar4;
+  longlong lVar5;
   ulonglong uVar6;
   uint uVar7;
   ulonglong uVar8;
-  uint *puVar9;
-  uint local_res8 [2];
-  KSIDENTIFIER *local_res10;
+  uint uVar9;
+  uint *puVar10;
+  ulonglong *puVar11;
+  undefined1 auStack_a8 [32];
+  undefined4 local_88;
+  ulonglong *local_80;
+  uint local_78;
+  uint *local_70;
+  uint local_68 [2];
+  _IRP *local_60;
+  undefined4 local_50;
+  undefined4 local_4c;
+  undefined4 local_48;
+  ulonglong local_40;
   
-  lVar1 = *(longlong *)(param_1 + 0xb8);
-  puVar9 = param_3 + 1;
-  uVar8 = 0;
-  local_res8[0] = 0;
-  local_res10 = param_2;
+  local_40 = __security_cookie ^ (ulonglong)auStack_a8;
+  uVar6 = 0;
+  lVar5 = *(longlong *)(param_1 + 0xb8);
+  puVar10 = param_3 + 1;
+  local_68[0] = 0;
+  local_60 = param_1;
   if ((*(uint *)(param_2 + 0x14) & 2) == 0) {
-    iVar2 = KsSynchronousIoControlDevice
-                      (*(undefined8 *)(lVar1 + 0x30),0,0x2f0003,param_2,
-                       *(undefined4 *)(lVar1 + 0x10),0,0,local_res8);
+    local_70 = local_68;
+    local_88 = *(undefined4 *)(lVar5 + 0x10);
+    local_78 = 0;
+    local_80 = (ulonglong *)0x0;
+    iVar2 = KsSynchronousIoControlDevice(*(undefined8 *)(lVar5 + 0x30),0,0x2f0003,param_2);
     if (iVar2 < 0) {
       return iVar2;
     }
-    if (*(int *)(lVar1 + 8) == 0) {
-      *(ulonglong *)(param_1 + 0x38) = (ulonglong)(local_res8[0] >> 1);
+    if (*(int *)(lVar5 + 8) == 0) {
+      *(ulonglong *)(param_1 + 0x38) = (ulonglong)(local_68[0] >> 1);
       return iVar2;
     }
-    puVar3 = (ulonglong *)ExAllocatePoolWithTag(0x600,local_res8[0],0x6268534b);
-    if (puVar3 != (ulonglong *)0x0) {
-      iVar2 = KsSynchronousIoControlDevice
-                        (*(undefined8 *)(lVar1 + 0x30),0,0x2f0003,local_res10,
-                         *(undefined4 *)(lVar1 + 0x10),puVar3,local_res8[0],local_res8);
-      if (-1 < iVar2) {
-        *param_3 = (uint)*puVar3;
-        puVar4 = puVar3;
-        if (*puVar3 != 0) {
-          do {
-            puVar4 = puVar4 + 1;
-            uVar8 = (ulonglong)((int)uVar8 + 1);
-            *puVar9 = (uint)*puVar4;
-            puVar9 = puVar9 + 1;
-          } while (uVar8 < *puVar3);
+    puVar3 = (ulonglong *)ExAllocatePoolWithTag(0x600,local_68[0],0x6268534b);
+    puVar11 = puVar3 + 1;
+    if (puVar3 == (ulonglong *)0x0) {
+      lVar1 = -0x3fffff66;
+    }
+    else {
+      local_70 = local_68;
+      local_78 = local_68[0];
+      local_88 = *(undefined4 *)(lVar5 + 0x10);
+      local_80 = puVar3;
+      lVar1 = KsSynchronousIoControlDevice(*(undefined8 *)(lVar5 + 0x30),0,0x2f0003,param_2);
+    }
+    uVar8 = Feature_4034713912__private_IsEnabledDeviceUsageNoInline();
+    if ((int)uVar8 == 0) {
+      if (-1 < lVar1) {
+LAB_0:
+        uVar4 = Feature_4034713912__private_IsEnabledDeviceUsageNoInline();
+        uVar8 = *puVar3;
+        *param_3 = (uint)uVar8;
+        if ((int)uVar4 == 0) {
+          if (*puVar3 != 0) {
+            do {
+              uVar6 = (ulonglong)((int)uVar6 + 1);
+              *puVar10 = (uint)*puVar11;
+              puVar11 = puVar11 + 1;
+              puVar10 = puVar10 + 1;
+            } while (uVar6 < *puVar3);
+          }
+          lVar5 = (ulonglong)(*param_3 + 1) << 3;
         }
-        *(ulonglong *)(param_1 + 0x38) = (ulonglong)(*param_3 + 1) << 3;
+        else {
+          uVar9 = 0;
+          if ((uint)uVar8 != 0) {
+            do {
+              uVar7 = (int)uVar6 + 1;
+              uVar6 = (ulonglong)uVar7;
+              *puVar10 = (uint)*puVar11;
+              puVar11 = puVar11 + 1;
+              uVar9 = *param_3;
+              puVar10 = puVar10 + 1;
+            } while (uVar7 < uVar9);
+          }
+          lVar5 = (ulonglong)(uVar9 + 1) << 2;
+        }
+        *(longlong *)(local_60 + 0x38) = lVar5;
       }
-LAB_0:
-      ExFreePool(puVar3);
-      return iVar2;
+    }
+    else if (-1 < lVar1) {
+      uVar9 = (uint)*puVar3 + 1;
+      if ((((uint)*puVar3 <= uVar9) && (uVar8 = (ulonglong)uVar9 << 2, uVar8 < 0x100000000)) &&
+         ((uint)uVar8 <= *(uint *)(lVar5 + 8))) goto LAB_0;
+      local_50 = 0x36a412d;
+      local_4c = 1;
+      local_48 = 0xc000000d;
+      RtlLogUnexpectedCodepath(&local_50);
+      lVar1 = -0x3ffffff3;
+    }
+    if (puVar3 == (ulonglong *)0x0) {
+      return lVar1;
     }
 LAB_1:
-    lVar5 = -0x3fffff66;
+    ExFreePool(puVar3);
   }
   else {
-    uVar7 = *param_3 + 1;
-    if (*param_3 <= uVar7) {
-      if (((ulonglong)uVar7 * 4 < 0x100000000) &&
-         (uVar6 = (ulonglong)uVar7 << 3, uVar6 < 0x100000000)) {
-        if ((*(uint *)(lVar1 + 8) < 4) || (*(uint *)(lVar1 + 8) < (uint)((ulonglong)uVar7 * 4))) {
+    uVar9 = *param_3 + 1;
+    if (*param_3 <= uVar9) {
+      if (((ulonglong)uVar9 * 4 < 0x100000000) &&
+         (uVar8 = (ulonglong)uVar9 << 3, uVar8 < 0x100000000)) {
+        if ((*(uint *)(lVar5 + 8) < 4) || (*(uint *)(lVar5 + 8) < (uint)((ulonglong)uVar9 * 4))) {
           return -0x3ffffff3;
         }
-        puVar3 = (ulonglong *)ExAllocatePoolWithTag(0x600,uVar6 & 0xffffffff,0x6268534b);
-        if (puVar3 != (ulonglong *)0x0) {
-          *puVar3 = (ulonglong)*param_3;
-          puVar4 = puVar3;
-          if (*param_3 != 0) {
-            do {
-              puVar4 = puVar4 + 1;
-              uVar7 = (int)uVar8 + 1;
-              uVar8 = (ulonglong)uVar7;
-              *puVar4 = (ulonglong)*puVar9;
-              puVar9 = puVar9 + 1;
-            } while (uVar7 < *param_3);
-          }
-          iVar2 = KsSynchronousIoControlDevice
-                            (*(undefined8 *)(lVar1 + 0x30),0,0x2f0003,param_2,
-                             *(undefined4 *)(lVar1 + 0x10),puVar3,(int)uVar6,local_res8);
-          goto LAB_0;
+        puVar3 = (ulonglong *)ExAllocatePoolWithTag(0x600,uVar8 & 0xffffffff,0x6268534b);
+        if (puVar3 == (ulonglong *)0x0) {
+          return -0x3fffff66;
         }
+        *puVar3 = (ulonglong)*param_3;
+        puVar11 = puVar3;
+        if (*param_3 != 0) {
+          do {
+            puVar11 = puVar11 + 1;
+            uVar9 = (int)uVar6 + 1;
+            uVar6 = (ulonglong)uVar9;
+            *puVar11 = (ulonglong)*puVar10;
+            puVar10 = puVar10 + 1;
+          } while (uVar9 < *param_3);
+        }
+        local_70 = local_68;
+        local_88 = *(undefined4 *)(lVar5 + 0x10);
+        local_80 = puVar3;
+        local_78 = (uint)uVar8;
+        lVar1 = KsSynchronousIoControlDevice(*(undefined8 *)(lVar5 + 0x30),0,0x2f0003,param_2);
         goto LAB_1;
       }
     }
-    lVar5 = -0x3fffff6b;
+    lVar1 = -0x3fffff6b;
   }
-  return lVar5;
+  return lVar1;
 }
 

```


# Modified (No Code Changes)


*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname

## __GSHandlerCheck

### Match Info



|Key|kst-4768.sys - kst-4946.sys|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|0.88|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|kst-4768.sys|kst-4946.sys|
| :---: | :---: | :---: |
|name|__GSHandlerCheck|__GSHandlerCheck|
|fullname|__GSHandlerCheck|__GSHandlerCheck|
|`refcount`|6|7|
|length|29|29|
|called|__GSHandlerCheckCommon|__GSHandlerCheckCommon|
|calling|||
|paramcount|4|4|
|`address`|1c0004118|1c0004218|
|sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

## wil_details_IsEnabledFallback

### Match Info



|Key|kst-4768.sys - kst-4946.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|kst-4768.sys|kst-4946.sys|
| :---: | :---: | :---: |
|name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|`refcount`|4|5|
|length|140|140|
|called|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|`calling`|Feature_2192109883__private_IsEnabledFallback<br>Feature_Servicing_KSTHUNK_UMA__private_IsEnabledFallback<br>Feature_Servicing_KS_UMA__private_IsEnabledFallback|Feature_2192109883__private_IsEnabledFallback<br>Feature_4034713912__private_IsEnabledFallback<br>Feature_Servicing_KSTHUNK_UMA__private_IsEnabledFallback<br>Feature_Servicing_KS_UMA__private_IsEnabledFallback|
|paramcount|3|3|
|address|1c0002b74|1c0002b74|
|sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### wil_details_IsEnabledFallback Calling Diff


```diff
--- wil_details_IsEnabledFallback calling
+++ wil_details_IsEnabledFallback calling
@@ -1,0 +2 @@
+Feature_4034713912__private_IsEnabledFallback
```


## __security_check_cookie

### Match Info



|Key|kst-4768.sys - kst-4946.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.75|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|kst-4768.sys|kst-4946.sys|
| :---: | :---: | :---: |
|name|__security_check_cookie|__security_check_cookie|
|fullname|__security_check_cookie|__security_check_cookie|
|`refcount`|9|10|
|length|30|30|
|called|__report_gsfailure|__report_gsfailure|
|`calling`|CKSThunkPin::LocateFormatHandler<br>CKSThunkPin::ThunkStreamingIrp<br>__GSHandlerCheckCommon<br>wil_details_FeatureReporting_ReportUsageToServiceDirect<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_PopulateInitialConfiguredFeatureStates<br>wil_details_RecordCachedUsage<br>wil_details_ReevaluateOnFeatureConfigurationChange|CKSAutomationThunk::HandleArrayProperty<br>CKSThunkPin::LocateFormatHandler<br>CKSThunkPin::ThunkStreamingIrp<br>__GSHandlerCheckCommon<br>wil_details_FeatureReporting_ReportUsageToServiceDirect<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_PopulateInitialConfiguredFeatureStates<br>wil_details_RecordCachedUsage<br>wil_details_ReevaluateOnFeatureConfigurationChange|
|paramcount|1|1|
|`address`|1c0004240|1c0004340|
|sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### __security_check_cookie Calling Diff


```diff
--- __security_check_cookie calling
+++ __security_check_cookie calling
@@ -0,0 +1 @@
+CKSAutomationThunk::HandleArrayProperty
```


## NTOSKRNL.EXE::RtlLogUnexpectedCodepath

### Match Info



|Key|kst-4768.sys - kst-4946.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|kst-4768.sys|kst-4946.sys|
| :---: | :---: | :---: |
|name|RtlLogUnexpectedCodepath|RtlLogUnexpectedCodepath|
|fullname|NTOSKRNL.EXE::RtlLogUnexpectedCodepath|NTOSKRNL.EXE::RtlLogUnexpectedCodepath|
|`refcount`|3|4|
|length|0|0|
|called|||
|`calling`|CKSThunkPin::LocateFormatHandler<br>CKSThunkPin::ThunkStreamingIrp|CKSAutomationThunk::HandleArrayProperty<br>CKSThunkPin::LocateFormatHandler<br>CKSThunkPin::ThunkStreamingIrp|
|paramcount|0|0|
|address|EXTERNAL:00000035|EXTERNAL:00000035|
|sig|undefined RtlLogUnexpectedCodepath(void)|undefined RtlLogUnexpectedCodepath(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### NTOSKRNL.EXE::RtlLogUnexpectedCodepath Calling Diff


```diff
--- NTOSKRNL.EXE::RtlLogUnexpectedCodepath calling
+++ NTOSKRNL.EXE::RtlLogUnexpectedCodepath calling
@@ -0,0 +1 @@
+CKSAutomationThunk::HandleArrayProperty
```




<sub>Generated with `ghidriff` version: 1.0.0 on 2026-08-16T15:04:55</sub>