# lf_7920.sys-lf_8246.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_3287483706__private_IsEnabledDeviceUsageNoInline](#feature_3287483706__private_isenableddeviceusagenoinline) * [Feature_3287483706__private_IsEnabledFallback](#feature_3287483706__private_isenabledfallback) * [Modified](#modified) * [LuafvQueryStoreDirectory](#luafvquerystoredirectory) * [Modified (No Code Changes)](#modified-no-code-changes) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [FLTMGR.SYS::FltReleasePushLockEx](#fltmgrsysfltreleasepushlockex) * [FLTMGR.SYS::FltAcquirePushLockExclusiveEx](#fltmgrsysfltacquirepushlockexclusiveex) # Visual Chart Diff ```mermaid flowchart LR LuafvQueryStoreDirectory-3-old<--Match 85%-->LuafvQueryStoreDirectory-3-new subgraph lf_8246.sys LuafvQueryStoreDirectory-3-new subgraph Added direction LR Feature_3287483706__private_IsEnabledDeviceUsageNoInline Feature_3287483706__private_IsEnabledFallback end end subgraph lf_7920.sys LuafvQueryStoreDirectory-3-old end ``` ```mermaid pie showData title Function Matches - 99.7691% "unmatched_funcs_len" : 2 "matched_funcs_len" : 864 ``` ```mermaid pie showData title Matched Function Similarity - 99.5370% "matched_funcs_with_code_changes_len" : 1 "matched_funcs_with_non_code_changes_len" : 3 "matched_funcs_no_changes_len" : 860 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 lf_7920.sys lf_8246.sys ``` #### Verbose Args
``` --old ['lf_7920.sys'] --new [['lf_8246.sys']] --engine VersionTrackingDiff --output-path lf2_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/luafv.sys/A47E7B522E000/luafv.sys -O luafv.sys.x64.10.0.26100.7920 wget https://msdl.microsoft.com/download/symbols/luafv.sys/8220A3AD2E000/luafv.sys -O luafv.sys.x64.10.0.26100.8246 ``` ## Binary Metadata Diff ```diff --- lf_7920.sys Meta +++ lf_8246.sys Meta @@ -1,44 +1,44 @@ -Program Name: lf_7920.sys +Program Name: lf_8246.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 191480 +# of Bytes: 191488 # of Memory Blocks: 15 -# of Instructions: 22028 -# of Defined Data: 2129 -# of Functions: 432 -# of Symbols: 3569 +# of Instructions: 22076 +# of Defined Data: 2135 +# of Functions: 434 +# of Symbols: 3578 # of Data Types: 136 # of Data Type Categories: 11 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 22 11:54:54 SGT 2026 +Date Created: Sat Aug 22 11:54:58 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/lf29/lf_7920.sys -Executable MD5: cac626aae30a0bd003bcefc8a042aa3e -Executable SHA256: 25d774136cd40c401ca568332f36c4a65a33f72312959b3b221189bd0c555cc9 -FSRL: file:///tmp/lf29/lf_7920.sys?MD5=cac626aae30a0bd003bcefc8a042aa3e +Executable Location: /tmp/lf29/lf_8246.sys +Executable MD5: 038879b462c46f32635cb41b10dfc79d +Executable SHA256: 274756a992f21a006882fbfd4e0730276bf639fedabd431ea8b82787cf187378 +FSRL: file:///tmp/lf29/lf_8246.sys?MD5=038879b462c46f32635cb41b10dfc79d PDB Age: 1 PDB File: luafv.pdb -PDB GUID: 6c84c537-eac4-9034-d6fd-77dd2ad963d9 +PDB GUID: 73312040-b733-40a3-d880-34e6ab61fb6a PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: LUA File Virtualization Filter Driver -PE Property[FileVersion]: 10.0.26100.7920 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8246 (WinBuild.160101.0800) PE Property[InternalName]: luafv.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: luafv.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7920 +PE Property[ProductVersion]: 10.0.26100.8246 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra lf_7920.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra lf_7920.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra lf_7920.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra lf_8246.sys Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra lf_8246.sys Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra lf_8246.sys Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|0| |modified_funcs_len|4| |added_symbols_len|6| |deleted_symbols_len|2| |diff_time|1.6558659076690674| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 429, 'ExternalsName': 174, 'ExactBytesFunctionHasher': 1})| |items_to_process|14| |diff_types|Counter({'refcount': 3, 'calling': 3, 'address': 2, 'code': 1, 'length': 1, 'called': 1})| |unmatched_funcs_len|2| |total_funcs_len|866| |matched_funcs_len|864| |matched_funcs_with_code_changes_len|1| |matched_funcs_with_non_code_changes_len|3| |matched_funcs_no_changes_len|860| |match_func_similarity_percent|99.5370%| |func_match_overall_percent|99.7691%| |first_matches|Counter({'SymbolsHash': 429, 'ExactBytesFunctionHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 429 "ExternalsName" : 174 "ExactBytesFunctionHasher" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 429 "ExactBytesFunctionHasher" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 0 "modified_funcs_len" : 4 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 6 "deleted_symbols_len" : 2 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_3287483706__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|lf_8246.sys| | :---: | :---: | |name|Feature_3287483706__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3287483706__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|49| |called|Feature_3287483706__private_IsEnabledFallback| |calling|LuafvQueryStoreDirectory| |paramcount|0| |address|140001f4c| |sig|ulonglong __fastcall Feature_3287483706__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3287483706__private_IsEnabledDeviceUsageNoInline +++ Feature_3287483706__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3287483706__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3287483706__private_featureState; + if ((Feature_3287483706__private_featureState & 0x10) == 0) { + uVar1 = Feature_3287483706__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3287483706__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3287483706__private_IsEnabledFallback ### Function Meta |Key|lf_8246.sys| | :---: | :---: | |name|Feature_3287483706__private_IsEnabledFallback| |fullname|Feature_3287483706__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3287483706__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|140001f84| |sig|undefined __fastcall Feature_3287483706__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3287483706__private_IsEnabledFallback +++ Feature_3287483706__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3287483706__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&wil_details_featureDescriptors_a); + return; +} + ``` # Modified *Modified functions contain code changes* ## LuafvQueryStoreDirectory ### Match Info |Key|lf_7920.sys - lf_8246.sys| | :---: | :---: | |diff_type|code,length,called| |ratio|0.19| |i_ratio|0.4| |m_ratio|0.89| |b_ratio|0.85| |match_types|SymbolsHash| ### Function Meta Diff |Key|lf_7920.sys|lf_8246.sys| | :---: | :---: | :---: | |name|LuafvQueryStoreDirectory|LuafvQueryStoreDirectory| |fullname|LuafvQueryStoreDirectory|LuafvQueryStoreDirectory| |refcount|2|2| |`length`|419|549| |`called`|Feature_Bugfix_LuafvUMA__private_IsEnabledDeviceUsageNoInline
LuafvAllocatePool
LuafvMergeStoreDirectory
LuafvOpenDirectory
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
memset|FLTMGR.SYS::FltAcquirePushLockExclusiveEx
FLTMGR.SYS::FltReleasePushLockEx
Feature_3287483706__private_IsEnabledDeviceUsageNoInline
Feature_Bugfix_LuafvUMA__private_IsEnabledDeviceUsageNoInline
LuafvAllocatePool
LuafvMergeStoreDirectory
LuafvOpenDirectory
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
memset| |calling|LuafvPreDirectoryControl|LuafvPreDirectoryControl| |paramcount|3|3| |address|140020004|140020004| |sig|uint __fastcall LuafvQueryStoreDirectory(undefined8 param_1, uint * param_2, longlong param_3)|uint __fastcall LuafvQueryStoreDirectory(undefined8 param_1, uint * param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### LuafvQueryStoreDirectory Called Diff ```diff --- LuafvQueryStoreDirectory called +++ LuafvQueryStoreDirectory called @@ -0,0 +1,3 @@ +FLTMGR.SYS::FltAcquirePushLockExclusiveEx +FLTMGR.SYS::FltReleasePushLockEx +Feature_3287483706__private_IsEnabledDeviceUsageNoInline ``` ### LuafvQueryStoreDirectory Diff ```diff --- LuafvQueryStoreDirectory +++ LuafvQueryStoreDirectory @@ -1,69 +1,96 @@ uint LuafvQueryStoreDirectory(undefined8 param_1,uint *param_2,longlong param_3) { - byte bVar1; - uint uVar2; - int iVar3; - longlong lVar4; - undefined8 uVar5; + int *piVar1; + byte bVar2; + uint uVar3; + int iVar4; + longlong lVar5; longlong lVar6; - uint uVar7; - uint *puVar8; + undefined8 uVar7; + uint uVar8; ulonglong uVar9; - char cVar10; + uint *puVar10; + char cVar11; - lVar4 = *(longlong *)(param_2 + 4); - cVar10 = '\0'; - uVar2 = *(uint *)(lVar4 + 0x18); + lVar5 = *(longlong *)(param_2 + 4); + cVar11 = '\0'; + uVar3 = *(uint *)(lVar5 + 0x18); + uVar9 = Feature_3287483706__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 != 0) { + lVar6 = *(longlong *)(param_3 + 0x20); + if (*(void **)(lVar6 + 8) == SystemReserved1[0xf]) { + *(int *)(lVar6 + 0x10) = *(int *)(lVar6 + 0x10) + 1; + } + else { + FltAcquirePushLockExclusiveEx(lVar6,0); + *(void **)(lVar6 + 8) = SystemReserved1[0xf]; + *(undefined4 *)(lVar6 + 0x10) = 1; + } + } if (*(longlong *)(param_3 + 0x60) == 0) { - puVar8 = LuafvAllocatePool(1,0x40,'\x16'); - *(uint **)(param_3 + 0x60) = puVar8; - if (puVar8 == (uint *)0x0) { - uVar7 = 0xc000009a; + puVar10 = LuafvAllocatePool(1,0x40,'\x16'); + *(uint **)(param_3 + 0x60) = puVar10; + if (puVar10 != (uint *)0x0) { + memset(puVar10,0,0x40); goto LAB_0; } - memset(puVar8,0,0x40); + uVar8 = 0xc000009a; } - uVar7 = LuafvOpenDirectory(param_1,param_3,*(longlong **)(param_3 + 0x60),uVar2); - if ((-1 < (int)uVar7) && - (uVar7 = LuafvOpenDirectory(param_1,param_3 + 0x30, - (longlong *)(*(longlong *)(param_3 + 0x60) + 0x20),uVar2), - -1 < (int)uVar7)) { - iVar3 = *(int *)(lVar4 + 0x28); - uVar5 = *(undefined8 *)(lVar4 + 0x20); - lVar6 = *(longlong *)(lVar4 + 0x40); - bVar1 = *(byte *)(*(longlong *)(param_2 + 4) + 6); - if (lVar6 == 0) { - puVar8 = *(uint **)(lVar4 + 0x38); - uVar9 = Feature_Bugfix_LuafvUMA__private_IsEnabledDeviceUsageNoInline(); - if (((int)uVar9 != 0) && ((*param_2 & 8) == 0)) { - cVar10 = (char)param_2[0x14]; - } - } - else { - if ((*(byte *)(lVar6 + 10) & 5) == 0) { - puVar8 = (uint *)MmMapLockedPagesSpecifyCache(lVar6,0,1,0,0,0x40000010); + else { +LAB_0: + uVar8 = LuafvOpenDirectory(param_1,param_3,*(longlong **)(param_3 + 0x60),uVar3); + if ((-1 < (int)uVar8) && + (uVar8 = LuafvOpenDirectory(param_1,param_3 + 0x30, + (longlong *)(*(longlong *)(param_3 + 0x60) + 0x20),uVar3), + -1 < (int)uVar8)) { + iVar4 = *(int *)(lVar5 + 0x28); + lVar6 = *(longlong *)(lVar5 + 0x40); + bVar2 = *(byte *)(*(longlong *)(param_2 + 4) + 6); + uVar7 = *(undefined8 *)(lVar5 + 0x20); + if (lVar6 == 0) { + puVar10 = *(uint **)(lVar5 + 0x38); + uVar9 = Feature_Bugfix_LuafvUMA__private_IsEnabledDeviceUsageNoInline(); + if (((int)uVar9 != 0) && ((*param_2 & 8) == 0)) { + cVar11 = (char)param_2[0x14]; + } } else { - puVar8 = *(uint **)(lVar6 + 0x18); + if ((*(byte *)(lVar6 + 10) & 5) == 0) { + puVar10 = (uint *)MmMapLockedPagesSpecifyCache(lVar6,0,1,0,0,0x40000010); + } + else { + puVar10 = *(uint **)(lVar6 + 0x18); + } + if (puVar10 == (uint *)0x0) { + uVar8 = 0xc000009a; + } + if ((int)uVar8 < 0) goto LAB_1; } - if (puVar8 == (uint *)0x0) { - uVar7 = 0xc000009a; - } - if ((int)uVar7 < 0) goto LAB_0; - } - uVar7 = LuafvMergeStoreDirectory - (param_1,param_3,uVar2,cVar10,iVar3,bVar1 >> 1 & 1,uVar5,bVar1 & 1,param_2 + 6 - ,puVar8); - if (-1 < (int)uVar7) { - return uVar7; + uVar8 = LuafvMergeStoreDirectory + (param_1,param_3,uVar3,cVar11,iVar4,bVar2 >> 1 & 1,uVar7,bVar2 & 1, + param_2 + 6,puVar10); } } -LAB_0: - param_2[8] = 0; - param_2[9] = 0; - param_2[6] = uVar7; - return uVar7; +LAB_1: + uVar9 = Feature_3287483706__private_IsEnabledDeviceUsageNoInline(); + if ((int)uVar9 != 0) { + lVar5 = *(longlong *)(param_3 + 0x20); + if (*(void **)(lVar5 + 8) == SystemReserved1[0xf]) { + piVar1 = (int *)(lVar5 + 0x10); + *piVar1 = *piVar1 + -1; + if (*piVar1 != 0) goto LAB_2; + *(undefined8 *)(lVar5 + 8) = 0; + } + FltReleasePushLockEx(lVar5,0); + } +LAB_2: + if ((int)uVar8 < 0) { + param_2[8] = 0; + param_2[9] = 0; + param_2[6] = uVar8; + } + return uVar8; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## wil_details_IsEnabledFallback ### Match Info |Key|lf_7920.sys - lf_8246.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lf_7920.sys|lf_8246.sys| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|4|5| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_Bugfix_LuafvStreamRename__private_IsEnabledFallback
Feature_Bugfix_LuafvTableNode__private_IsEnabledFallback
Feature_Bugfix_LuafvUMA__private_IsEnabledFallback|Feature_3287483706__private_IsEnabledFallback
Feature_Bugfix_LuafvStreamRename__private_IsEnabledFallback
Feature_Bugfix_LuafvTableNode__private_IsEnabledFallback
Feature_Bugfix_LuafvUMA__private_IsEnabledFallback| |paramcount|3|3| |`address`|140002778|1400027cc| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_3287483706__private_IsEnabledFallback ``` ## FLTMGR.SYS::FltReleasePushLockEx ### Match Info |Key|lf_7920.sys - lf_8246.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lf_7920.sys|lf_8246.sys| | :---: | :---: | :---: | |name|FltReleasePushLockEx|FltReleasePushLockEx| |fullname|FLTMGR.SYS::FltReleasePushLockEx|FLTMGR.SYS::FltReleasePushLockEx| |`refcount`|86|87| |length|0|0| |called||| |`calling`|
Expand for full list:
AcknowledgePauseRequest
ClearFileTablePostWorker
CreateChildTable
CreateTableNode
DereferenceDvfcb
FindOrCreateDvfcb
FindUser
GetLocalAppDataStorePath
InsertFileIdTableNode
LuafvAllocatePool
LuafvBuildAdminInformationLuafvBuildTableNodeName
LuafvBuildTableNodeName2
LuafvCopyShortName
LuafvCreateVirtualFile
LuafvDereferenceCachedSecurityDescriptor
LuafvDereferenceTableNodeEx
LuafvEnumerateFileTable
LuafvFindTableNode
LuafvFindUserStore
LuafvFreePool
LuafvGetVolumeProperties
LuafvInitializeFileTableForVolume
LuafvInitializeUsn
LuafvIsTargetWRP
LuafvOpenDirectory
LuafvPauseUsn
LuafvPerformDelayedVirtualization
LuafvPerformRename
LuafvPreAcquireForSectionSynchronization
LuafvPreCleanup
LuafvPrepareDelayedVirtualization
LuafvReadAndCacheSecurityDescriptor
LuafvResumeUsn
LuafvScavengeFileTable
LuafvScavengeUserList
LuafvTerminateFileTableForVolume
LuafvTerminatePool
LuafvTerminateUserStoresForVolume
LuafvTerminateUsn
LuafvUnlinkFsContextFromDvfcb
LuafvUpdateFileTableForChangeRecord
LuafvUpdateFileTableForFileChange
RemoveTableNode
UpdateTableNode
UserLogoffCallback
UsnThread
|
Expand for full list:
AcknowledgePauseRequest
ClearFileTablePostWorker
CreateChildTable
CreateTableNode
DereferenceDvfcb
FindOrCreateDvfcb
FindUser
GetLocalAppDataStorePath
InsertFileIdTableNode
LuafvAllocatePool
LuafvBuildAdminInformationLuafvBuildTableNodeName
LuafvBuildTableNodeName2
LuafvCopyShortName
LuafvCreateVirtualFile
LuafvDereferenceCachedSecurityDescriptor
LuafvDereferenceTableNodeEx
LuafvEnumerateFileTable
LuafvFindTableNode
LuafvFindUserStore
LuafvFreePool
LuafvGetVolumeProperties
LuafvInitializeFileTableForVolume
LuafvInitializeUsn
LuafvIsTargetWRP
LuafvOpenDirectory
LuafvPauseUsn
LuafvPerformDelayedVirtualization
LuafvPerformRename
LuafvPreAcquireForSectionSynchronization
LuafvPreCleanup
LuafvPrepareDelayedVirtualization
LuafvQueryStoreDirectory
LuafvReadAndCacheSecurityDescriptor
LuafvResumeUsn
LuafvScavengeFileTable
LuafvScavengeUserList
LuafvTerminateFileTableForVolume
LuafvTerminatePool
LuafvTerminateUserStoresForVolume
LuafvTerminateUsn
LuafvUnlinkFsContextFromDvfcb
LuafvUpdateFileTableForChangeRecord
LuafvUpdateFileTableForFileChange
RemoveTableNode
UpdateTableNode
UserLogoffCallback
UsnThread
| |paramcount|0|0| |address|EXTERNAL:000000a8|EXTERNAL:000000a8| |sig|undefined FltReleasePushLockEx(void)|undefined FltReleasePushLockEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### FLTMGR.SYS::FltReleasePushLockEx Calling Diff ```diff --- FLTMGR.SYS::FltReleasePushLockEx calling +++ FLTMGR.SYS::FltReleasePushLockEx calling @@ -32,0 +33 @@ +LuafvQueryStoreDirectory ``` ## FLTMGR.SYS::FltAcquirePushLockExclusiveEx ### Match Info |Key|lf_7920.sys - lf_8246.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lf_7920.sys|lf_8246.sys| | :---: | :---: | :---: | |name|FltAcquirePushLockExclusiveEx|FltAcquirePushLockExclusiveEx| |fullname|FLTMGR.SYS::FltAcquirePushLockExclusiveEx|FLTMGR.SYS::FltAcquirePushLockExclusiveEx| |`refcount`|73|74| |length|0|0| |called||| |`calling`|
Expand for full list:
AcknowledgePauseRequest
CreateChildTable
CreateTableNode
DereferenceDvfcb
FindOrCreateDvfcb
FindUser
GetLocalAppDataStorePath
InsertFileIdTableNode
LuafvAllocatePool
LuafvBuildAdminInformation
LuafvBuildTableNodeNameLuafvBuildTableNodeName2
LuafvCreateVirtualFile
LuafvDereferenceCachedSecurityDescriptor
LuafvDereferenceTableNodeEx
LuafvEnumerateFileTable
LuafvFindTableNode
LuafvFindUserStore
LuafvFreePool
LuafvGetVolumeProperties
LuafvInitializeFileTableForVolume
LuafvInitializeUsn
LuafvIsTargetWRP
LuafvOpenDirectory
LuafvPauseUsn
LuafvPerformDelayedVirtualization
LuafvPerformRename
LuafvPreAcquireForSectionSynchronization
LuafvPreCleanup
LuafvPrepareDelayedVirtualization
LuafvReadAndCacheSecurityDescriptor
LuafvResumeUsn
LuafvScavengeFileTable
LuafvScavengeUserList
LuafvTerminateFileTableForVolume
LuafvTerminatePool
LuafvTerminateUserStoresForVolume
LuafvTerminateUsn
LuafvUnlinkFsContextFromDvfcb
LuafvUpdateFileTableForChangeRecord
LuafvUpdateFileTableForFileChange
RemoveTableNode
UpdateTableNode
UserLogoffCallback
UsnThread
|
Expand for full list:
AcknowledgePauseRequest
CreateChildTable
CreateTableNode
DereferenceDvfcb
FindOrCreateDvfcb
FindUser
GetLocalAppDataStorePath
InsertFileIdTableNode
LuafvAllocatePool
LuafvBuildAdminInformation
LuafvBuildTableNodeNameLuafvBuildTableNodeName2
LuafvCreateVirtualFile
LuafvDereferenceCachedSecurityDescriptor
LuafvDereferenceTableNodeEx
LuafvEnumerateFileTable
LuafvFindTableNode
LuafvFindUserStore
LuafvFreePool
LuafvGetVolumeProperties
LuafvInitializeFileTableForVolume
LuafvInitializeUsn
LuafvIsTargetWRP
LuafvOpenDirectory
LuafvPauseUsn
LuafvPerformDelayedVirtualization
LuafvPerformRename
LuafvPreAcquireForSectionSynchronization
LuafvPreCleanup
LuafvPrepareDelayedVirtualization
LuafvQueryStoreDirectory
LuafvReadAndCacheSecurityDescriptor
LuafvResumeUsn
LuafvScavengeFileTable
LuafvScavengeUserList
LuafvTerminateFileTableForVolume
LuafvTerminatePool
LuafvTerminateUserStoresForVolume
LuafvTerminateUsn
LuafvUnlinkFsContextFromDvfcb
LuafvUpdateFileTableForChangeRecord
LuafvUpdateFileTableForFileChange
RemoveTableNode
UpdateTableNode
UserLogoffCallback
UsnThread
| |paramcount|0|0| |`address`|EXTERNAL:000000a4|EXTERNAL:000000a5| |sig|undefined FltAcquirePushLockExclusiveEx(void)|undefined FltAcquirePushLockExclusiveEx(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### FLTMGR.SYS::FltAcquirePushLockExclusiveEx Calling Diff ```diff --- FLTMGR.SYS::FltAcquirePushLockExclusiveEx calling +++ FLTMGR.SYS::FltAcquirePushLockExclusiveEx calling @@ -30,0 +31 @@ +LuafvQueryStoreDirectory ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-22T11:55:22