# msfs_4202.sys-msfs_7824.sys Diff
# TOC
* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
* [Ghidra Diff Engine](#ghidra-diff-engine)
* [Command Line](#command-line)
* [Binary Metadata Diff](#binary-metadata-diff)
* [Program Options](#program-options)
* [Diff Stats](#diff-stats)
* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
* [Feature_1829438777__private_IsEnabledDeviceUsageNoInline](#feature_1829438777__private_isenableddeviceusagenoinline)
* [Feature_1829438777__private_IsEnabledFallback](#feature_1829438777__private_isenabledfallback)
* [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache)
* [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache)
* [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache)
* [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice)
* [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect)
* [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate)
* [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath)
* [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate)
* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)
* [wil_details_MapReportingKind](#wil_details_mapreportingkind)
* [wil_details_FeatureDescriptors_SkipPadding](#wil_details_featuredescriptors_skippadding)
* [wil_details_RecordCachedUsage](#wil_details_recordcachedusage)
* [wil_details_RecordFeatureUsageReporting](#wil_details_recordfeatureusagereporting)
* [wil_RtlStagingConfig_QueryFeatureState](#wil_rtlstagingconfig_queryfeaturestate)
* [wil_details_BuildFeatureStateCacheFromQueryResults](#wil_details_buildfeaturestatecachefromqueryresults)
* [wil_details_EvaluateFeatureDependencies](#wil_details_evaluatefeaturedependencies)
* [wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_getcachedfeatureenabledstate)
* [wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState](#wil_details_evaluatefeaturedependencies_reevaluatecachedfeatureenabledstate)
* [wil_details_OnFeatureUsageProviderFlushNotification](#wil_details_onfeatureusageproviderflushnotification)
* [wil_details_ReevaluateOnFeatureConfigurationChange](#wil_details_reevaluateonfeatureconfigurationchange)
* [wil_details_UpdateFeatureConfiguredStates](#wil_details_updatefeatureconfiguredstates)
* [wil_InitializeFeatureStaging](#wil_initializefeaturestaging)
* [wil_details_PopulateInitialConfiguredFeatureStates](#wil_details_populateinitialconfiguredfeaturestates)
* [NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider](#ntoskrnlexertlunregisterfeatureusageprovider)
* [NTOSKRNL.EXE::RtlQueryFeatureConfiguration](#ntoskrnlexertlqueryfeatureconfiguration)
* [NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification](#ntoskrnlexertlunregisterfeatureconfigurationchangenotification)
* [NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp](#ntoskrnlexertlqueryfeatureconfigurationchangestamp)
* [NTOSKRNL.EXE::RtlNotifyFeatureUsage](#ntoskrnlexertlnotifyfeatureusage)
* [NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification](#ntoskrnlexertlregisterfeatureconfigurationchangenotification)
* [NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider](#ntoskrnlexertlregisterfeatureusageprovider)
* [NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification](#ntoskrnlexertlarmfeatureusageproviderflushnotification)
* [NTOSKRNL.EXE::RtlRecordFeatureUsage](#ntoskrnlexertlrecordfeatureusage)
* [Modified](#modified)
* [DriverEntry](#driverentry)
* [MsAddDataQueueEntry](#msadddataqueueentry)
* [Modified (No Code Changes)](#modified-no-code-changes)
* [__GSHandlerCheck](#__gshandlercheck)
* [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag)
* [__security_check_cookie](#__security_check_cookie)
* [MsRemoveDataQueueIrp](#msremovedataqueueirp)
# Visual Chart Diff
```mermaid
flowchart LR
DriverEntry-1-old<--Match 88%-->DriverEntry-1-new
MsAddDataQueueEntry-6-old<--Match 17%-->MsAddDataQueueEntry-6-new
subgraph msfs_7824.sys
DriverEntry-1-new
MsAddDataQueueEntry-6-new
subgraph Added
direction LR
Feature_1829438777__private_IsEnabledDeviceUsageNoInline
Feature_1829438777__private_IsEnabledFallback
wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache
wil_details_FeatureReporting_RecordUsageInCache
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
wil_details_GetCurrentFeatureEnabledState
wil_details_IsEnabledFallback
wil_details_MapReportingKind
wil_details_FeatureDescriptors_SkipPadding
wil_details_RecordCachedUsage
wil_details_RecordFeatureUsageReporting
wil_RtlStagingConfig_QueryFeatureState
wil_details_BuildFeatureStateCacheFromQueryResults
wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
wil_details_OnFeatureUsageProviderFlushNotification
wil_details_ReevaluateOnFeatureConfigurationChange
wil_details_UpdateFeatureConfiguredStates
wil_InitializeFeatureStaging
wil_details_PopulateInitialConfiguredFeatureStates
NTOSKRNLEXE-RtlUnregisterFeatureUsageProvider
NTOSKRNLEXE-RtlQueryFeatureConfiguration
9_more_added_funcs_omitted
end
end
subgraph msfs_4202.sys
DriverEntry-1-old
MsAddDataQueueEntry-6-old
end
```
```mermaid
pie showData
title Function Matches - 89.9705%
"unmatched_funcs_len" : 34
"matched_funcs_len" : 305
```
```mermaid
pie showData
title Matched Function Similarity - 97.7049%
"matched_funcs_with_code_changes_len" : 2
"matched_funcs_with_non_code_changes_len" : 5
"matched_funcs_no_changes_len" : 298
```
# Metadata
## Ghidra Diff Engine
### Command Line
#### Captured Command Line
```
ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 msfs_4202.sys msfs_7824.sys
```
#### Verbose Args
```
--old ['msfs_4202.sys'] --new [['msfs_7824.sys']] --engine VersionTrackingDiff --output-path msfs2_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```
#### Download Original PEs
```
wget https://msdl.microsoft.com/download/symbols/MSFS.SYS/5E0BEA8112000/MSFS.SYS -O msfs.sys.x64.10.0.26100.4202
wget https://msdl.microsoft.com/download/symbols/MSFS.SYS/4965F6C214000/MSFS.SYS -O msfs.sys.x64.10.0.26100.7824
```
## Binary Metadata Diff
```diff
--- msfs_4202.sys Meta
+++ msfs_7824.sys Meta
@@ -1,44 +1,44 @@
-Program Name: msfs_4202.sys
+Program Name: msfs_7824.sys
Language ID: x86:LE:64:default (4.6)
Compiler ID: windows
Processor: x86
Endian: Little
Address Size: 64
-Minimum Address: 1c0000000
+Minimum Address: 140000000
Maximum Address: ff0000184f
-# of Bytes: 75872
+# of Bytes: 84064
# of Memory Blocks: 15
-# of Instructions: 4935
-# of Defined Data: 636
-# of Functions: 152
-# of Symbols: 786
-# of Data Types: 128
+# of Instructions: 6192
+# of Defined Data: 705
+# of Functions: 187
+# of Symbols: 963
+# of Data Types: 129
# of Data Type Categories: 11
Analyzed: true
Compiler: visualstudio:unknown
Created With Ghidra Version: 12.0.4
-Date Created: Tue Aug 18 21:55:46 SGT 2026
+Date Created: Tue Aug 18 21:55:50 SGT 2026
Executable Format: Portable Executable (PE)
-Executable Location: /tmp/msfs/msfs_4202.sys
-Executable MD5: 13cf53e1ac6a50903440df4d80c9d7b9
-Executable SHA256: c1be2b6c4e126baa3a060cadd925309e8665739c5bff4df88e13ff805466bb8e
-FSRL: file:///tmp/msfs/msfs_4202.sys?MD5=13cf53e1ac6a50903440df4d80c9d7b9
+Executable Location: /tmp/msfs/msfs_7824.sys
+Executable MD5: de89dda770bac416148eb2a4b99c555d
+Executable SHA256: c3212720c70241ce1d9aa9fbceba2820ebefa368bea6b36101a7b24768bb33d0
+FSRL: file:///tmp/msfs/msfs_7824.sys?MD5=de89dda770bac416148eb2a4b99c555d
PDB Age: 1
PDB File: msfs.pdb
-PDB GUID: 9fabae7c-6c93-5698-994d-842f89a5b15c
+PDB GUID: 9d6647cb-f4ac-02e4-9afe-4108fa6b2543
PDB Loaded: true
PDB Version: RSDS
PE Property[CompanyName]: Microsoft Corporation
PE Property[FileDescription]: Mailslot driver
-PE Property[FileVersion]: 10.0.26100.4202 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.26100.7824 (WinBuild.160101.0800)
PE Property[InternalName]: MSFS.SYS
PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
PE Property[OriginalFilename]: MSFS.SYS
PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.26100.4202
+PE Property[ProductVersion]: 10.0.26100.7824
PE Property[Translation]: 4b00409
Preferred Root Namespace Category:
RTTI Found: false
Relocatable: true
SectionAlignment: 4096
Should Ask To Analyze: false
```
## Program Options
Ghidra msfs_4202.sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra msfs_4202.sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra msfs_4202.sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra msfs_7824.sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra msfs_7824.sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra msfs_7824.sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats
|Stat|Value|
| :---: | :---: |
|added_funcs_len|34|
|deleted_funcs_len|0|
|modified_funcs_len|7|
|added_symbols_len|22|
|deleted_symbols_len|0|
|diff_time|2.6327555179595947|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 152, 'ExternalsName': 72})|
|items_to_process|63|
|diff_types|Counter({'address': 6, 'refcount': 5, 'calling': 3, 'code': 2, 'length': 2, 'sig': 2, 'called': 2})|
|unmatched_funcs_len|34|
|total_funcs_len|339|
|matched_funcs_len|305|
|matched_funcs_with_code_changes_len|2|
|matched_funcs_with_non_code_changes_len|5|
|matched_funcs_no_changes_len|298|
|match_func_similarity_percent|97.7049%|
|func_match_overall_percent|89.9705%|
|first_matches|Counter({'SymbolsHash': 152})|
```mermaid
pie showData
title All Matches
"SymbolsHash" : 152
"ExternalsName" : 72
```
```mermaid
pie showData
title First Matches
"SymbolsHash" : 152
```
```mermaid
pie showData
title Diff Stats
"added_funcs_len" : 34
"deleted_funcs_len" : 0
"modified_funcs_len" : 7
```
```mermaid
pie showData
title Symbols
"added_symbols_len" : 22
"deleted_symbols_len" : 0
```
## Strings
*No string differences found*
# Deleted
# Added
## Feature_1829438777__private_IsEnabledDeviceUsageNoInline
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|Feature_1829438777__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_1829438777__private_IsEnabledDeviceUsageNoInline|
|refcount|2|
|length|49|
|called|Feature_1829438777__private_IsEnabledFallback|
|calling|MsAddDataQueueEntry|
|paramcount|0|
|address|140001310|
|sig|ulonglong __fastcall Feature_1829438777__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_1829438777__private_IsEnabledDeviceUsageNoInline
+++ Feature_1829438777__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_1829438777__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+ ulonglong uVar1;
+ undefined8 local_res8;
+
+ local_res8 = (undefined4 *)(ulonglong)Feature_1829438777__private_featureState;
+ if ((Feature_1829438777__private_featureState & 0x10) == 0) {
+ uVar1 = Feature_1829438777__private_IsEnabledFallback(local_res8,3);
+ }
+ else {
+ uVar1 = (ulonglong)(Feature_1829438777__private_featureState & 1);
+ }
+ return uVar1;
+}
+
```
## Feature_1829438777__private_IsEnabledFallback
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|Feature_1829438777__private_IsEnabledFallback|
|fullname|Feature_1829438777__private_IsEnabledFallback|
|refcount|2|
|length|14|
|called|wil_details_IsEnabledFallback|
|calling|Feature_1829438777__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|140001348|
|sig|undefined __fastcall Feature_1829438777__private_IsEnabledFallback(undefined4 * param_1, uint param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- Feature_1829438777__private_IsEnabledFallback
+++ Feature_1829438777__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_1829438777__private_IsEnabledFallback(undefined4 *param_1,uint param_2)
+
+{
+ wil_details_IsEnabledFallback(param_1,param_2);
+ return;
+}
+
```
## wil_details_FeatureReporting_IncrementOpportunityInCache
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_IncrementOpportunityInCache|
|fullname|wil_details_FeatureReporting_IncrementOpportunityInCache|
|refcount|2|
|length|208|
|called||
|calling|wil_details_FeatureReporting_RecordUsageInCache|
|paramcount|4|
|address|140001360|
|sig|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureReporting_IncrementOpportunityInCache
+++ wil_details_FeatureReporting_IncrementOpportunityInCache
@@ -0,0 +1,54 @@
+
+void wil_details_FeatureReporting_IncrementOpportunityInCache
+ (uint *param_1,uint param_2,undefined8 param_3,uint *param_4)
+
+{
+ uint uVar1;
+ uint uVar2;
+ uint uVar3;
+ uint uVar4;
+ bool bVar5;
+
+ uVar2 = *param_1;
+ do {
+ uVar4 = uVar2;
+ param_4[1] = 0;
+ uVar1 = uVar4 | 1;
+ if ((uVar4 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) {
+ uVar2 = (uVar4 & 0x3f8000) >> 0xf;
+ if (uVar2 != 0) {
+ param_4[1] = uVar2;
+ uVar2 = 5;
+ if (param_2 != 1) {
+ uVar2 = 1;
+ }
+ uVar1 = uVar4 & 0xffc07fff | 1;
+ param_4[2] = uVar2;
+ }
+ uVar2 = 0;
+ if (param_2 == 5) {
+ uVar2 = 0x400000;
+ }
+ uVar1 = uVar2 | uVar1 & 0xffbfffff;
+ }
+ uVar2 = uVar1 >> 0xf & 0x7f;
+ uVar3 = uVar2 + 1;
+ if ((0x7f < uVar3) || (uVar3 < uVar2)) {
+ uVar3 = 1;
+ param_4[2] = param_2;
+ param_4[1] = uVar2;
+ }
+ LOCK();
+ uVar2 = *param_1;
+ bVar5 = uVar4 == uVar2;
+ if (bVar5) {
+ *param_1 = (uVar3 << 0xf ^ uVar1) & 0x3f8000 ^ uVar1;
+ uVar2 = uVar4;
+ }
+ UNLOCK();
+ } while (!bVar5);
+ param_4[4] = 0;
+ *param_4 = ~uVar4 & 1;
+ return;
+}
+
```
## wil_details_FeatureReporting_IncrementUsageInCache
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_IncrementUsageInCache|
|fullname|wil_details_FeatureReporting_IncrementUsageInCache|
|refcount|2|
|length|220|
|called||
|calling|wil_details_FeatureReporting_RecordUsageInCache|
|paramcount|4|
|address|140001438|
|sig|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureReporting_IncrementUsageInCache
+++ wil_details_FeatureReporting_IncrementUsageInCache
@@ -0,0 +1,50 @@
+
+void wil_details_FeatureReporting_IncrementUsageInCache
+ (uint *param_1,uint param_2,undefined8 param_3,uint *param_4)
+
+{
+ uint uVar1;
+ uint uVar2;
+ uint uVar3;
+ uint uVar4;
+ bool bVar5;
+
+ uVar4 = *param_1;
+ do {
+ uVar3 = uVar4;
+ param_4[1] = 0;
+ uVar1 = uVar3 | 1;
+ if ((uVar3 & 0x4000) >> 0xe != (uint)(param_2 == 4)) {
+ uVar4 = (uVar3 & 0x3fe0) >> 5;
+ if (uVar4 != 0) {
+ param_4[1] = uVar4;
+ param_4[2] = ~-(uint)(param_2 != 0) & 4;
+ uVar1 = uVar3 & 0xffffc01f | 1;
+ }
+ uVar4 = 0;
+ if (param_2 == 4) {
+ uVar4 = 0x4000;
+ }
+ uVar1 = uVar4 | uVar1 & 0xffffbfff;
+ }
+ uVar4 = uVar1 >> 5 & 0x1ff;
+ uVar2 = uVar4 + 1;
+ if ((0x1ff < uVar2) || (uVar2 < uVar4)) {
+ uVar2 = 1;
+ param_4[2] = param_2;
+ param_4[1] = uVar4;
+ }
+ LOCK();
+ uVar4 = *param_1;
+ bVar5 = uVar3 == uVar4;
+ if (bVar5) {
+ *param_1 = (uVar2 << 5 ^ uVar1) & 0x3fe0 ^ uVar1;
+ uVar4 = uVar3;
+ }
+ UNLOCK();
+ } while (!bVar5);
+ param_4[4] = 0;
+ *param_4 = ~uVar3 & 1;
+ return;
+}
+
```
## wil_details_FeatureReporting_RecordUsageInCache
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_RecordUsageInCache|
|fullname|wil_details_FeatureReporting_RecordUsageInCache|
|refcount|2|
|length|374|
|called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache|
|calling|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|paramcount|4|
|address|14000151c|
|sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureReporting_RecordUsageInCache
+++ wil_details_FeatureReporting_RecordUsageInCache
@@ -0,0 +1,101 @@
+
+uint * wil_details_FeatureReporting_RecordUsageInCache
+ (uint *param_1,uint *param_2,undefined8 param_3,uint param_4)
+
+{
+ uint uVar1;
+ uint uVar2;
+ uint uVar3;
+ uint uVar4;
+ uint uVar5;
+ bool bVar6;
+
+ uVar3 = (uint)param_3;
+ param_1[0] = 0;
+ param_1[1] = 0;
+ param_1[2] = 0;
+ param_1[3] = 0;
+ param_1[4] = 0;
+ param_1[5] = 0;
+ if (uVar3 == 0) {
+LAB_140001674:
+ wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar3,param_3,param_1);
+ }
+ else {
+ if (uVar3 == 1) {
+LAB_140001667:
+ wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar3,param_3,param_1);
+ return param_1;
+ }
+ if ((uVar3 != 2) && (uVar3 != 3)) {
+ if (uVar3 == 4) goto LAB_140001674;
+ if (uVar3 == 5) goto LAB_140001667;
+ if ((uVar3 != 6) && (uVar3 != 7)) {
+ uVar4 = uVar3 - 0x140;
+ if ((int)uVar4 < 0x40) {
+ uVar5 = param_2[1];
+ do {
+ if (((uVar5 & 0x10) == 0) || (uVar2 = 1, (uVar5 >> 5 & 0x3f) != uVar4)) {
+ uVar2 = 0;
+ }
+ param_1[4] = uVar2;
+ LOCK();
+ uVar2 = param_2[1];
+ bVar6 = uVar5 == uVar2;
+ if (bVar6) {
+ param_2[1] = (uVar4 * 0x20 ^ uVar5) & 0x7e0 ^ uVar5 | 0x10;
+ uVar2 = uVar5;
+ }
+ uVar5 = uVar2;
+ UNLOCK();
+ } while (!bVar6);
+ if (param_1[4] != 0) {
+ return param_1;
+ }
+ }
+ param_1[2] = uVar3;
+ param_1[1] = 1;
+ param_1[3] = param_4;
+ return param_1;
+ }
+ }
+ uVar4 = 0;
+ if (uVar3 == 2) {
+ uVar4 = 2;
+ }
+ else if (uVar3 == 3) {
+ uVar4 = 8;
+ }
+ else if (uVar3 == 6) {
+ uVar4 = 4;
+ }
+ else if (uVar3 == 7) {
+ uVar4 = 0x10;
+ }
+ uVar5 = 1;
+ uVar3 = *param_2;
+ do {
+ uVar1 = uVar3;
+ uVar3 = uVar4 | uVar1;
+ param_1[4] = (uint)(uVar3 == uVar1);
+ uVar2 = uVar3 | 1;
+ if (uVar3 == uVar1) {
+ uVar2 = uVar3;
+ }
+ LOCK();
+ uVar3 = *param_2;
+ bVar6 = uVar1 == uVar3;
+ if (bVar6) {
+ *param_2 = uVar2;
+ uVar3 = uVar1;
+ }
+ UNLOCK();
+ } while (!bVar6);
+ if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) {
+ uVar5 = 0;
+ }
+ *param_1 = uVar5;
+ }
+ return param_1;
+}
+
```
## wil_details_FeatureReporting_ReportUsageToService
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_ReportUsageToService|
|fullname|wil_details_FeatureReporting_ReportUsageToService|
|refcount|2|
|length|114|
|called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind|
|calling|wil_details_IsEnabledFallback|
|paramcount|3|
|address|14000169c|
|sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, uint param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureReporting_ReportUsageToService
+++ wil_details_FeatureReporting_ReportUsageToService
@@ -0,0 +1,27 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+
+void wil_details_FeatureReporting_ReportUsageToService
+ (undefined8 param_1,undefined8 param_2,uint param_3)
+
+{
+ bool bVar1;
+ uint uVar2;
+ undefined7 extraout_var;
+ ulonglong uVar3;
+ uint uVar4;
+ uint local_res18 [4];
+
+ uVar4 = (uint)param_2 & 1;
+ uVar3 = (ulonglong)param_3;
+ local_res18[0] = param_3;
+ uVar2 = wil_details_MapReportingKind(param_3,uVar4);
+ bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,(ulonglong)uVar2);
+ if (((int)CONCAT71(extraout_var,bVar1) != 0) &&
+ (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) {
+ (*g_wil_details_pfnFeatureLoggingHook)
+ (0x39d1c05,&Feature_1829438777_logged_traits,0,uVar4,local_res18,0,0,1);
+ }
+ return;
+}
+
```
## wil_details_FeatureReporting_ReportUsageToServiceDirect
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|refcount|2|
|length|226|
|called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache|
|calling|wil_details_FeatureReporting_ReportUsageToService|
|paramcount|3|
|address|140001718|
|sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, ulonglong param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureReporting_ReportUsageToServiceDirect
+++ wil_details_FeatureReporting_ReportUsageToServiceDirect
@@ -0,0 +1,47 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+bool wil_details_FeatureReporting_ReportUsageToServiceDirect
+ (undefined8 param_1,undefined8 param_2,ulonglong param_3)
+
+{
+ uint6 uVar1;
+ uint *puVar2;
+ undefined1 auStack_88 [32];
+ uint *local_68;
+ undefined8 local_58;
+ uint local_50 [6];
+ uint local_38;
+ uint uStack_34;
+ uint uStack_30;
+ uint uStack_2c;
+ undefined8 local_28;
+ ulonglong local_20;
+
+ local_20 = __security_cookie ^ (ulonglong)auStack_88;
+ puVar2 = wil_details_FeatureReporting_RecordUsageInCache
+ (local_50,(uint *)&Feature_1829438777__private_reporting,param_3,
+ (uint)((ulonglong)param_2 >> 0x20));
+ local_38 = *puVar2;
+ uStack_34 = puVar2[1];
+ uStack_30 = puVar2[2];
+ uStack_2c = puVar2[3];
+ local_28 = *(undefined8 *)(puVar2 + 4);
+ if (g_wil_details_recordFeatureUsage != (code *)0x0) {
+ local_68 = &local_38;
+ (*g_wil_details_recordFeatureUsage)
+ (0x39d1c05,param_3 & 0xffffffff,1,&Feature_1829438777__private_reporting);
+ }
+ if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) {
+ local_58._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),0x39d1c05);
+ uVar1 = (uint6)local_58;
+ local_58 = (ulonglong)(uint6)local_58;
+ if (((uint)param_2 >> 0xb & 1) != 0) {
+ local_58 = CONCAT26(1,uVar1);
+ }
+ RtlNotifyFeatureUsage(&local_58);
+ }
+ return (int)local_28 == 0;
+}
+
```
## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|refcount|3|
|length|263|
|called|_guard_dispatch_icall
wil_details_GetCurrentFeatureEnabledState|
|calling|wil_details_GetCurrentFeatureEnabledState
wil_details_IsEnabledFallback|
|paramcount|3|
|address|140001804|
|sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
@@ -0,0 +1,67 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+
+ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ (uint *param_1,ulonglong param_2,longlong param_3)
+
+{
+ int iVar1;
+ uint uVar2;
+ ulonglong uVar3;
+ uint uVar4;
+ uint uVar5;
+ ulonglong uVar6;
+ bool bVar7;
+ uint local_res8 [2];
+ undefined8 local_res10;
+
+ iVar1 = 0;
+ local_res8[0] = 0;
+ local_res10 = param_2;
+ if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) {
+ iVar1 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)();
+ }
+ uVar2 = wil_details_GetCurrentFeatureEnabledState(param_3,local_res8);
+ if (*(char *)(param_3 + 0x1c) == '\0') {
+ local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0);
+ }
+ uVar3 = param_2 & 0xffffffff;
+ do {
+ uVar6 = param_2;
+ uVar5 = (uint)uVar3;
+ local_res10 = CONCAT44(local_res10._4_4_,uVar5);
+ if ((local_res8[0] != 0) && (local_res10 = CONCAT44(local_res10._4_4_,uVar5), (uVar3 & 2) == 0))
+ {
+ uVar4 = uVar5 & 0xfffff63e | uVar2 & 0x9c1;
+ uVar5 = uVar4 | 2;
+ local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 2;
+ }
+ if ((uVar6 & 4) == 0) {
+ uVar4 = uVar2 & 0x400 | uVar5 & 0xfffffbff;
+ uVar5 = uVar4 | 4;
+ local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 4;
+ }
+ uVar3 = uVar6 & 0xffffffff;
+ LOCK();
+ uVar4 = *param_1;
+ bVar7 = (uint)uVar6 == uVar4;
+ if (bVar7) {
+ *param_1 = uVar5;
+ }
+ else {
+ uVar3 = (ulonglong)uVar4;
+ }
+ UNLOCK();
+ param_2 = uVar3;
+ } while (!bVar7);
+ if (((uVar6 & 4) == 0) &&
+ (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) {
+ (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges)
+ (param_1,*(undefined1 *)(param_3 + 0x1c),iVar1);
+ }
+ if (local_res8[0] == 0) {
+ local_res10 = CONCAT44(local_res10._4_4_,uVar2 & 0x9c1 | uVar5 & 0xfffff63e);
+ }
+ return local_res10;
+}
+
```
## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|refcount|2|
|length|76|
|called||
|calling|wil_details_IsEnabledFallback|
|paramcount|2|
|address|140001914|
|sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
+++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath
@@ -0,0 +1,41 @@
+
+void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2)
+
+{
+ uint uVar1;
+ uint uVar2;
+ uint uVar3;
+ bool bVar4;
+
+ if (param_2 == 3) {
+ uVar3 = 0x10;
+ }
+ else {
+ if (param_2 != 4) {
+ return;
+ }
+ uVar3 = 0x20;
+ }
+ if ((Feature_1829438777__private_featureState & 2) != 0) {
+ uVar2 = Feature_1829438777__private_featureState;
+ while ((uVar2 & 1) == (param_1 & 1)) {
+ LOCK();
+ bVar4 = uVar2 == Feature_1829438777__private_featureState;
+ uVar1 = uVar3 | uVar2;
+ if (!bVar4) {
+ uVar2 = Feature_1829438777__private_featureState;
+ uVar1 = Feature_1829438777__private_featureState;
+ }
+ Feature_1829438777__private_featureState = uVar1;
+ UNLOCK();
+ if (bVar4) {
+ return;
+ }
+ if ((uVar2 & 2) == 0) {
+ return;
+ }
+ }
+ }
+ return;
+}
+
```
## wil_details_GetCurrentFeatureEnabledState
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_GetCurrentFeatureEnabledState|
|fullname|wil_details_GetCurrentFeatureEnabledState|
|refcount|2|
|length|344|
|called|wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|
|paramcount|2|
|address|140001968|
|sig|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_GetCurrentFeatureEnabledState
+++ wil_details_GetCurrentFeatureEnabledState
@@ -0,0 +1,73 @@
+
+uint wil_details_GetCurrentFeatureEnabledState(longlong param_1,undefined4 *param_2)
+
+{
+ char cVar1;
+ undefined4 uVar2;
+ undefined8 *puVar3;
+ uint uVar4;
+ undefined8 uVar5;
+ ulonglong uVar6;
+ uint uVar7;
+ longlong *plVar8;
+ uint local_res8;
+ ulonglong local_res10;
+ uint local_28 [8];
+
+ cVar1 = *(char *)(param_1 + 0x1c);
+ uVar2 = *(undefined4 *)(param_1 + 0x18);
+ *param_2 = 1;
+ local_28[4] = 0;
+ local_28[5] = 0;
+ local_28[0] = 0;
+ local_28[1] = 0;
+ local_28[2] = 0;
+ local_28[3] = 0;
+ uVar5 = wil_RtlStagingConfig_QueryFeatureState(local_28,uVar2,(uint)((byte)(cVar1 - 2U) < 2));
+ uVar4 = -(uint)((int)uVar5 != 0) & local_28[0] & 3;
+ if (uVar4 == 0) {
+ uVar7 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40;
+ }
+ else {
+ uVar7 = 0;
+ if (local_28[0] == 2) {
+ uVar7 = 0x40;
+ }
+ }
+ local_res8 = uVar7 >> 6 ^
+ (uVar4 << 7 | -(uint)(local_28[5] != 0) & 0x800 | -(uint)(local_28[4] != 0) & 0x400 |
+ uVar7);
+ if ((uVar7 != 0) && (plVar8 = *(longlong **)(param_1 + 0x20), plVar8 != (longlong *)0x0)) {
+ do {
+ puVar3 = (undefined8 *)*plVar8;
+ if (puVar3 == (undefined8 *)0x0) {
+ return local_res8;
+ }
+ if ((*(char *)((longlong)puVar3 + 0x1e) == '\0') &&
+ (*(char *)((longlong)puVar3 + 0x1d) == '\0')) {
+ uVar7 = *(uint *)*puVar3;
+ local_res10 = (ulonglong)uVar7;
+ if ((uVar7 & 2) == 0) {
+ uVar6 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ ((uint *)*puVar3,local_res10,(longlong)puVar3);
+ uVar7 = (uint)uVar6;
+ }
+ uVar4 = local_res8 & 0xfffffffe;
+ local_res8 = (uint)((uVar7 & local_res8 & 1) != 0);
+ }
+ else {
+ if (((local_res8 & 1) == 0) || (*(char *)((longlong)puVar3 + 0x1f) == '\0')) {
+ uVar4 = 0;
+ }
+ else {
+ uVar4 = 1;
+ }
+ local_res8 = local_res8 & 0xfffffffe;
+ }
+ local_res8 = local_res8 | uVar4;
+ plVar8 = plVar8 + 1;
+ } while ((local_res8 & 1) != 0);
+ }
+ return local_res8;
+}
+
```
## wil_details_IsEnabledFallback
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_IsEnabledFallback|
|fullname|wil_details_IsEnabledFallback|
|refcount|2|
|length|135|
|called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|calling|Feature_1829438777__private_IsEnabledFallback|
|paramcount|2|
|address|140001ac8|
|sig|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_IsEnabledFallback
+++ wil_details_IsEnabledFallback
@@ -0,0 +1,26 @@
+
+uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2)
+
+{
+ uint uVar1;
+ undefined4 *puVar2;
+ ulonglong local_res18;
+
+ uVar1 = (uint)param_1;
+ local_res18 = (ulonglong)param_1 & 0xffffffff;
+ if (((ulonglong)param_1 & 2) == 0) {
+ puVar2 = &Feature_1829438777__private_featureState;
+ local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ (&Feature_1829438777__private_featureState,(ulonglong)param_1,
+ 0x140005010);
+ param_1 = puVar2;
+ uVar1 = (uint)local_res18;
+ }
+ if ((param_2 != 0) &&
+ (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2),
+ param_2 - 3 < 2)) {
+ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2);
+ }
+ return uVar1 & 1;
+}
+
```
## wil_details_MapReportingKind
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_MapReportingKind|
|fullname|wil_details_MapReportingKind|
|refcount|2|
|length|144|
|called||
|calling|wil_details_FeatureReporting_ReportUsageToService|
|paramcount|2|
|address|140001b58|
|sig|uint __fastcall wil_details_MapReportingKind(int param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_MapReportingKind
+++ wil_details_MapReportingKind
@@ -0,0 +1,33 @@
+
+uint wil_details_MapReportingKind(int param_1,int param_2)
+
+{
+ byte bVar1;
+
+ if (param_1 != 0) {
+ if (param_1 == 1) {
+ return ~-(uint)(param_2 != 0) & 4;
+ }
+ if (param_1 == 2) {
+ return (-(uint)(param_2 != 0) & 0xfffffffc) + 5;
+ }
+ if (param_1 == 3) {
+ return (-(uint)(param_2 != 0) & 0xfffffffc) + 6;
+ }
+ if (param_1 == 4) {
+ return (-(uint)(param_2 != 0) & 0xfffffffc) + 7;
+ }
+ if (param_1 == 5) {
+ return (-(uint)(param_2 != 0) & 0xfffffffe) + 10;
+ }
+ if (param_1 == 6) {
+ return (-(uint)(param_2 != 0) & 0xfffffffe) + 0xb;
+ }
+ bVar1 = (char)param_1 + 0x9c;
+ if (bVar1 < 0x32) {
+ return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1;
+ }
+ }
+ return 0xff;
+}
+
```
## wil_details_FeatureDescriptors_SkipPadding
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_FeatureDescriptors_SkipPadding|
|fullname|wil_details_FeatureDescriptors_SkipPadding|
|refcount|9|
|length|31|
|called||
|calling|wil_InitializeFeatureStaging
wil_details_EvaluateFeatureDependencies
wil_details_OnFeatureUsageProviderFlushNotification
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates|
|paramcount|1|
|address|140001d74|
|sig|longlong * __fastcall wil_details_FeatureDescriptors_SkipPadding(longlong * param_1)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_FeatureDescriptors_SkipPadding
+++ wil_details_FeatureDescriptors_SkipPadding
@@ -0,0 +1,14 @@
+
+longlong * wil_details_FeatureDescriptors_SkipPadding(longlong *param_1)
+
+{
+ while( true ) {
+ if (&UNK_140005047 < param_1) {
+ return (longlong *)0x0;
+ }
+ if (*param_1 != 0) break;
+ param_1 = param_1 + 1;
+ }
+ return param_1;
+}
+
```
## wil_details_RecordCachedUsage
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_RecordCachedUsage|
|fullname|wil_details_RecordCachedUsage|
|refcount|2|
|length|331|
|called|NTOSKRNL.EXE::RtlRecordFeatureUsage
__security_check_cookie|
|calling|wil_details_OnFeatureUsageProviderFlushNotification|
|paramcount|2|
|address|140001d9c|
|sig|undefined __fastcall wil_details_RecordCachedUsage(undefined4 param_1, uint * param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_RecordCachedUsage
+++ wil_details_RecordCachedUsage
@@ -0,0 +1,90 @@
+
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+void wil_details_RecordCachedUsage(undefined4 param_1,uint *param_2)
+
+{
+ uint uVar1;
+ uint uVar2;
+ uint uVar3;
+ uint uVar4;
+ undefined4 *puVar5;
+ longlong lVar6;
+ bool bVar7;
+ undefined1 auStack_68 [32];
+ undefined4 local_48;
+ short local_44 [2];
+ undefined4 local_40 [10];
+ ulonglong local_18;
+
+ local_18 = __security_cookie ^ (ulonglong)auStack_68;
+ uVar2 = *param_2;
+ do {
+ LOCK();
+ uVar4 = *param_2;
+ bVar7 = uVar2 == uVar4;
+ if (bVar7) {
+ *param_2 = uVar2 & 0xffc0401e;
+ uVar4 = uVar2;
+ }
+ uVar2 = uVar4;
+ UNLOCK();
+ } while (!bVar7);
+ uVar3 = uVar2 >> 1 & 0xf;
+ uVar4 = 0;
+ if (uVar3 != 0) {
+ uVar4 = param_2[1];
+ do {
+ LOCK();
+ uVar1 = param_2[1];
+ bVar7 = uVar4 == uVar1;
+ if (bVar7) {
+ param_2[1] = uVar4 | uVar3;
+ uVar1 = uVar4;
+ }
+ uVar4 = uVar1;
+ UNLOCK();
+ } while (!bVar7);
+ uVar4 = uVar3 & ~uVar4;
+ }
+ puVar5 = &local_48;
+ if ((uVar4 & 1) != 0) {
+ puVar5 = local_40;
+ local_44[0] = 2;
+ local_44[1] = 1;
+ local_48 = param_1;
+ }
+ if ((uVar4 & 2) != 0) {
+ *puVar5 = param_1;
+ puVar5[1] = 0x10006;
+ puVar5 = puVar5 + 2;
+ }
+ if ((uVar4 & 4) != 0) {
+ *puVar5 = param_1;
+ puVar5[1] = 0x10003;
+ puVar5 = puVar5 + 2;
+ }
+ if (7 < uVar4) {
+ *puVar5 = param_1;
+ puVar5[1] = 0x10007;
+ puVar5 = puVar5 + 2;
+ }
+ if ((uVar2 >> 5 & 0x1ff) != 0) {
+ *puVar5 = param_1;
+ *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 5) & 0x1ff;
+ *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0xe) & 1) << 2;
+ puVar5 = puVar5 + 2;
+ }
+ if ((uVar2 >> 0xf & 0x7f) != 0) {
+ *puVar5 = param_1;
+ *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 0xf) & 0x7f;
+ *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0x16) & 1) * 4 + 1;
+ puVar5 = puVar5 + 2;
+ }
+ lVar6 = (longlong)puVar5 - (longlong)&local_48 >> 3;
+ if (0 < lVar6) {
+ RtlRecordFeatureUsage(&local_48,lVar6);
+ }
+ return;
+}
+
```
## wil_details_RecordFeatureUsageReporting
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_RecordFeatureUsageReporting|
|fullname|wil_details_RecordFeatureUsageReporting|
|refcount|3|
|length|125|
|called|NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification
NTOSKRNL.EXE::RtlRecordFeatureUsage|
|calling||
|paramcount|1|
|address|140001ef0|
|sig|undefined __fastcall wil_details_RecordFeatureUsageReporting(undefined4 param_1)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_RecordFeatureUsageReporting
+++ wil_details_RecordFeatureUsageReporting
@@ -0,0 +1,29 @@
+
+void wil_details_RecordFeatureUsageReporting(undefined4 param_1)
+
+{
+ int *piVar1;
+ int iVar2;
+ undefined4 in_stack_00000028;
+ undefined2 in_stack_0000002c;
+ undefined2 in_stack_0000002e;
+
+ iVar2 = g_wil_details_featureUsageCached;
+ piVar1 = (int *)CONCAT26(in_stack_0000002e,CONCAT24(in_stack_0000002c,in_stack_00000028));
+ if (*piVar1 != 0) {
+ LOCK();
+ g_wil_details_featureUsageCached = 1;
+ UNLOCK();
+ if ((iVar2 == 0) && (g_wil_details_featureUsageProvider != 0)) {
+ RtlArmFeatureUsageProviderFlushNotification(g_wil_details_featureUsageProvider,1);
+ }
+ }
+ if (piVar1[1] != 0) {
+ in_stack_0000002c = (undefined2)piVar1[2];
+ in_stack_0000002e = (undefined2)piVar1[1];
+ in_stack_00000028 = param_1;
+ RtlRecordFeatureUsage(&stack0x00000028,1);
+ }
+ return;
+}
+
```
## wil_RtlStagingConfig_QueryFeatureState
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_RtlStagingConfig_QueryFeatureState|
|fullname|wil_RtlStagingConfig_QueryFeatureState|
|refcount|2|
|length|197|
|called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie|
|calling|wil_details_GetCurrentFeatureEnabledState|
|paramcount|3|
|address|1400092c4|
|sig|undefined8 __fastcall wil_RtlStagingConfig_QueryFeatureState(uint * param_1, undefined4 param_2, int param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_RtlStagingConfig_QueryFeatureState
+++ wil_RtlStagingConfig_QueryFeatureState
@@ -0,0 +1,35 @@
+
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+undefined8 wil_RtlStagingConfig_QueryFeatureState(uint *param_1,undefined4 param_2,int param_3)
+
+{
+ int iVar1;
+ undefined1 auStack_48 [32];
+ undefined8 local_28;
+ undefined8 local_20;
+ uint local_18;
+ ulonglong local_10;
+
+ local_10 = __security_cookie ^ (ulonglong)auStack_48;
+ local_28 = 0;
+ local_20 = 0;
+ local_18 = 0;
+ iVar1 = RtlQueryFeatureConfiguration(param_2,param_3 == 0,&local_28,&local_20);
+ if (iVar1 == 0) {
+ *param_1 = local_20._4_4_ >> 4 & 3;
+ *(byte *)(param_1 + 1) = (byte)((ulonglong)local_20 >> 0x28) & 0x3f;
+ param_1[3] = local_18;
+ param_1[2] = local_20._4_4_ >> 0xe & 3;
+ param_1[5] = local_20._4_4_ >> 6 & 1;
+ param_1[4] = local_20._4_4_ >> 7 & 1;
+ }
+ else {
+ if (iVar1 != 0x117) {
+ return 0;
+ }
+ param_1[4] = local_20._4_4_ >> 7 & 1;
+ }
+ return 1;
+}
+
```
## wil_details_BuildFeatureStateCacheFromQueryResults
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_BuildFeatureStateCacheFromQueryResults|
|fullname|wil_details_BuildFeatureStateCacheFromQueryResults|
|refcount|3|
|length|97|
|called||
|calling|wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates|
|paramcount|3|
|address|140009b20|
|sig|undefined __fastcall wil_details_BuildFeatureStateCacheFromQueryResults(int param_1, longlong param_2, uint * param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_BuildFeatureStateCacheFromQueryResults
+++ wil_details_BuildFeatureStateCacheFromQueryResults
@@ -0,0 +1,28 @@
+
+void wil_details_BuildFeatureStateCacheFromQueryResults(int param_1,longlong param_2,uint *param_3)
+
+{
+ uint uVar1;
+
+ if ((param_1 == -0x7fffffde) || (param_1 == -0x3ffffddb)) {
+ param_3[0] = 0;
+ param_3[1] = 0;
+ }
+ else {
+ param_3[0] = 0;
+ param_3[1] = 0;
+ if (param_1 == 0) {
+ uVar1 = ((*(uint *)(param_2 + 4) & 0x40) << 2 | *(uint *)(param_2 + 4) & 0xb0) << 3 | 0x206;
+ goto LAB_140009b7d;
+ }
+ if (param_1 == 0x117) {
+ uVar1 = (*(uint *)(param_2 + 4) & 0x80) << 3 | 0x206;
+ goto LAB_140009b7d;
+ }
+ }
+ uVar1 = 0x206;
+LAB_140009b7d:
+ *param_3 = uVar1;
+ return;
+}
+
```
## wil_details_EvaluateFeatureDependencies
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_EvaluateFeatureDependencies|
|fullname|wil_details_EvaluateFeatureDependencies|
|refcount|3|
|length|174|
|called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
wil_details_FeatureDescriptors_SkipPadding|
|calling|wil_InitializeFeatureStaging
wil_details_ReevaluateOnFeatureConfigurationChange|
|paramcount|0|
|address|140009b88|
|sig|undefined __fastcall wil_details_EvaluateFeatureDependencies(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_EvaluateFeatureDependencies
+++ wil_details_EvaluateFeatureDependencies
@@ -0,0 +1,45 @@
+
+void wil_details_EvaluateFeatureDependencies(void)
+
+{
+ longlong *plVar1;
+ undefined **ppuVar2;
+ uint uVar3;
+ ulonglong uVar4;
+ undefined8 uVar5;
+ bool bVar6;
+
+ plVar1 = wil_details_FeatureDescriptors_SkipPadding
+ ((longlong *)&Feature_1829438777__private_descriptor);
+ if (plVar1 != (longlong *)0x0) {
+ uVar4 = 0;
+ uVar5 = 0x180;
+ do {
+ uVar3 = *(uint *)*plVar1;
+ if ((uVar3 >> 9 & 1) != 0) {
+ if (((uint)uVar5 & uVar3) == 0) {
+ bVar6 = *(char *)((longlong)plVar1 + 0x1f) != '\0';
+ }
+ else {
+ bVar6 = (uVar3 & (uint)uVar5) == 0x100;
+ }
+ uVar3 = uVar3 & 0x40 ^ (uint)bVar6 << 6 | (uint)uVar4 & 0xffffffbf;
+ uVar4 = (ulonglong)uVar3;
+ LOCK();
+ *(uint *)*plVar1 = *(uint *)*plVar1 ^ uVar3;
+ UNLOCK();
+ }
+ plVar1 = wil_details_FeatureDescriptors_SkipPadding(plVar1 + 7);
+ } while (plVar1 != (longlong *)0x0);
+ }
+ ppuVar2 = &Feature_1829438777__private_descriptor;
+ while( true ) {
+ plVar1 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar2);
+ if (plVar1 == (longlong *)0x0) break;
+ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
+ ((uint *)*plVar1,(longlong)plVar1);
+ ppuVar2 = (undefined **)(plVar1 + 7);
+ }
+ return;
+}
+
```
## wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|
|fullname|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|
|refcount|3|
|length|47|
|called|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|
|calling|wil_details_EvaluateFeatureDependencies
wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|
|paramcount|2|
|address|140009c40|
|sig|uint __fastcall wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState(uint * param_1, longlong param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
+++ wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
@@ -0,0 +1,15 @@
+
+uint wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
+ (uint *param_1,longlong param_2)
+
+{
+ uint uVar1;
+
+ uVar1 = *param_1;
+ if ((uVar1 >> 9 & 1) != 0) {
+ uVar1 = wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
+ (param_1,uVar1,param_2);
+ }
+ return uVar1;
+}
+
```
## wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|
|fullname|wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState|
|refcount|2|
|length|196|
|called|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|
|calling|wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState|
|paramcount|3|
|address|140009c78|
|sig|uint __fastcall wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState(uint * param_1, uint param_2, longlong param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
+++ wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
@@ -0,0 +1,58 @@
+
+uint wil_details_EvaluateFeatureDependencies_ReevaluateCachedFeatureEnabledState
+ (uint *param_1,uint param_2,longlong param_3)
+
+{
+ undefined8 *puVar1;
+ uint uVar2;
+ uint uVar3;
+ longlong *plVar4;
+ uint uVar5;
+ bool bVar6;
+
+ uVar5 = param_2 >> 6 & 1;
+ if ((uVar5 != 0) && (plVar4 = *(longlong **)(param_3 + 0x20), plVar4 != (longlong *)0x0)) {
+ do {
+ while( true ) {
+ puVar1 = (undefined8 *)*plVar4;
+ if (puVar1 == (undefined8 *)0x0) goto LAB_140009cfa;
+ if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') &&
+ (*(char *)((longlong)puVar1 + 0x1d) == '\0')) break;
+ if ((uVar5 == 0) || (*(char *)((longlong)puVar1 + 0x1f) == '\0')) {
+ uVar5 = 0;
+ goto LAB_140009cfa;
+ }
+ uVar5 = 1;
+ plVar4 = plVar4 + 1;
+ }
+ uVar2 = wil_details_EvaluateFeatureDependencies_GetCachedFeatureEnabledState
+ ((uint *)*puVar1,(longlong)puVar1);
+ if ((uVar5 == 0) || ((uVar2 & 1) == 0)) {
+ uVar5 = 0;
+ }
+ else {
+ uVar5 = 1;
+ }
+ plVar4 = plVar4 + 1;
+ } while (uVar5 != 0);
+ }
+LAB_140009cfa:
+ do {
+ uVar2 = param_2 & 0xffffffce;
+ if ((param_2 & 1) == uVar5) {
+ uVar2 = param_2 & 0xfffffffe;
+ }
+ uVar3 = uVar2 & 0xfffffdff | uVar5;
+ LOCK();
+ uVar2 = *param_1;
+ bVar6 = param_2 == uVar2;
+ if (bVar6) {
+ *param_1 = uVar3;
+ uVar2 = param_2;
+ }
+ param_2 = uVar2;
+ UNLOCK();
+ } while (!bVar6);
+ return uVar3;
+}
+
```
## wil_details_OnFeatureUsageProviderFlushNotification
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_OnFeatureUsageProviderFlushNotification|
|fullname|wil_details_OnFeatureUsageProviderFlushNotification|
|refcount|3|
|length|77|
|called|wil_details_FeatureDescriptors_SkipPadding
wil_details_RecordCachedUsage|
|calling||
|paramcount|1|
|address|140009d50|
|sig|undefined __fastcall wil_details_OnFeatureUsageProviderFlushNotification(int param_1)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_OnFeatureUsageProviderFlushNotification
+++ wil_details_OnFeatureUsageProviderFlushNotification
@@ -0,0 +1,27 @@
+
+void wil_details_OnFeatureUsageProviderFlushNotification(int param_1)
+
+{
+ int iVar1;
+ longlong *plVar2;
+ undefined **ppuVar3;
+
+ iVar1 = g_wil_details_featureUsageCached;
+ if (param_1 == 1) {
+ LOCK();
+ g_wil_details_featureUsageCached = 0;
+ UNLOCK();
+ if (iVar1 != 0) {
+ ppuVar3 = &Feature_1829438777__private_descriptor;
+ while (plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3),
+ plVar2 != (longlong *)0x0) {
+ if ((*(uint *)plVar2[1] & 1) != 0) {
+ wil_details_RecordCachedUsage((int)plVar2[3],(uint *)plVar2[1]);
+ }
+ ppuVar3 = (undefined **)(plVar2 + 7);
+ }
+ }
+ }
+ return;
+}
+
```
## wil_details_ReevaluateOnFeatureConfigurationChange
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_ReevaluateOnFeatureConfigurationChange|
|fullname|wil_details_ReevaluateOnFeatureConfigurationChange|
|refcount|3|
|length|19|
|called|wil_details_EvaluateFeatureDependencies
wil_details_UpdateFeatureConfiguredStates|
|calling||
|paramcount|0|
|address|140009db0|
|sig|undefined __fastcall wil_details_ReevaluateOnFeatureConfigurationChange(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_ReevaluateOnFeatureConfigurationChange
+++ wil_details_ReevaluateOnFeatureConfigurationChange
@@ -0,0 +1,9 @@
+
+void wil_details_ReevaluateOnFeatureConfigurationChange(void)
+
+{
+ wil_details_UpdateFeatureConfiguredStates();
+ wil_details_EvaluateFeatureDependencies();
+ return;
+}
+
```
## wil_details_UpdateFeatureConfiguredStates
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_UpdateFeatureConfiguredStates|
|fullname|wil_details_UpdateFeatureConfiguredStates|
|refcount|2|
|length|173|
|called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
wil_details_BuildFeatureStateCacheFromQueryResults
wil_details_FeatureDescriptors_SkipPadding|
|calling|wil_details_ReevaluateOnFeatureConfigurationChange|
|paramcount|0|
|address|140009dcc|
|sig|undefined __fastcall wil_details_UpdateFeatureConfiguredStates(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_UpdateFeatureConfiguredStates
+++ wil_details_UpdateFeatureConfiguredStates
@@ -0,0 +1,40 @@
+
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+void wil_details_UpdateFeatureConfiguredStates(void)
+
+{
+ int iVar1;
+ longlong *plVar2;
+ undefined **ppuVar3;
+ undefined1 auStack_58 [32];
+ uint local_38 [2];
+ undefined8 local_30;
+ undefined8 local_28;
+ undefined4 local_20;
+ ulonglong local_18;
+
+ local_18 = __security_cookie ^ (ulonglong)auStack_58;
+ ppuVar3 = &Feature_1829438777__private_descriptor;
+ while( true ) {
+ plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3);
+ if (plVar2 == (longlong *)0x0) break;
+ if (((*(char *)((longlong)plVar2 + 0x1d) == '\0') &&
+ (*(char *)((longlong)plVar2 + 0x1e) == '\0')) &&
+ (*(char *)((longlong)plVar2 + 0x1c) == '\0')) {
+ local_30 = 0;
+ local_28 = 0;
+ local_20 = 0;
+ iVar1 = RtlQueryFeatureConfiguration((int)plVar2[3],1,&local_30,&local_28);
+ local_38[0] = 0;
+ local_38[1] = 0;
+ wil_details_BuildFeatureStateCacheFromQueryResults(iVar1,(longlong)&local_28,local_38);
+ LOCK();
+ *(uint *)*plVar2 = *(uint *)*plVar2 ^ (*(uint *)*plVar2 ^ local_38[0]) & 0xf80;
+ UNLOCK();
+ }
+ ppuVar3 = (undefined **)(plVar2 + 7);
+ }
+ return;
+}
+
```
## wil_InitializeFeatureStaging
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_InitializeFeatureStaging|
|fullname|wil_InitializeFeatureStaging|
|refcount|2|
|length|230|
|called|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider
wil_details_EvaluateFeatureDependencies
wil_details_FeatureDescriptors_SkipPadding
wil_details_PopulateInitialConfiguredFeatureStates|
|calling|DriverEntry|
|paramcount|0|
|address|140010078|
|sig|int __fastcall wil_InitializeFeatureStaging(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_InitializeFeatureStaging
+++ wil_InitializeFeatureStaging
@@ -0,0 +1,51 @@
+
+int wil_InitializeFeatureStaging(void)
+
+{
+ bool bVar1;
+ int iVar2;
+ longlong *plVar3;
+ undefined **ppuVar4;
+ undefined8 local_res8;
+
+ bVar1 = false;
+ if (g_wil_details_isFeatureStagingInitialized == 0) {
+ g_wil_details_isFeatureStagingInitialized = 1;
+ local_res8 = RtlQueryFeatureConfigurationChangeStamp();
+ wil_details_PopulateInitialConfiguredFeatureStates();
+ wil_details_EvaluateFeatureDependencies();
+ ppuVar4 = &Feature_1829438777__private_descriptor;
+ while (plVar3 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar4),
+ plVar3 != (longlong *)0x0) {
+ if (((*(char *)((longlong)plVar3 + 0x1d) == '\0') &&
+ (*(char *)((longlong)plVar3 + 0x1e) == '\0')) &&
+ (*(char *)((longlong)plVar3 + 0x1c) == '\0')) {
+ iVar2 = RtlRegisterFeatureConfigurationChangeNotification
+ (wil_details_ReevaluateOnFeatureConfigurationChange,0,&local_res8,
+ &g_wil_details_featureChangeNotification);
+ if (iVar2 == 0) {
+ bVar1 = true;
+ }
+ else {
+ g_wil_details_featureChangeNotification = 0;
+ }
+ break;
+ }
+ ppuVar4 = (undefined **)(plVar3 + 7);
+ }
+ g_wil_details_recordFeatureUsage = wil_details_RecordFeatureUsageReporting;
+ iVar2 = RtlRegisterFeatureUsageProvider
+ (wil_details_OnFeatureUsageProviderFlushNotification,0,
+ &g_wil_details_featureUsageProvider);
+ if (iVar2 != 0) {
+ if (!bVar1) {
+ g_wil_details_featureUsageProvider = 0;
+ return iVar2;
+ }
+ g_wil_details_featureUsageProvider = 0;
+ return 0;
+ }
+ }
+ return 0;
+}
+
```
## wil_details_PopulateInitialConfiguredFeatureStates
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|wil_details_PopulateInitialConfiguredFeatureStates|
|fullname|wil_details_PopulateInitialConfiguredFeatureStates|
|refcount|2|
|length|225|
|called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
wil_details_BuildFeatureStateCacheFromQueryResults
wil_details_FeatureDescriptors_SkipPadding|
|calling|wil_InitializeFeatureStaging|
|paramcount|0|
|address|140010168|
|sig|undefined __fastcall wil_details_PopulateInitialConfiguredFeatureStates(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- wil_details_PopulateInitialConfiguredFeatureStates
+++ wil_details_PopulateInitialConfiguredFeatureStates
@@ -0,0 +1,52 @@
+
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+void wil_details_PopulateInitialConfiguredFeatureStates(void)
+
+{
+ int iVar1;
+ longlong *plVar2;
+ undefined **ppuVar3;
+ undefined8 uVar4;
+ undefined1 auStack_58 [32];
+ undefined8 local_38;
+ undefined8 local_30;
+ undefined8 local_28;
+ undefined4 local_20;
+ ulonglong local_18;
+
+ local_18 = __security_cookie ^ (ulonglong)auStack_58;
+ ppuVar3 = &Feature_1829438777__private_descriptor;
+ do {
+ plVar2 = wil_details_FeatureDescriptors_SkipPadding((longlong *)ppuVar3);
+ if (plVar2 == (longlong *)0x0) {
+ return;
+ }
+ local_30 = 0;
+ local_38 = 0;
+ local_28 = 0;
+ local_20 = 0;
+ if ((*(char *)((longlong)plVar2 + 0x1d) == '\0') && (*(char *)((longlong)plVar2 + 0x1e) == '\0')
+ ) {
+ iVar1 = RtlQueryFeatureConfiguration
+ ((int)plVar2[3],1 < (byte)(*(char *)((longlong)plVar2 + 0x1c) - 2U),
+ &local_30,&local_28);
+ if (iVar1 == -0x7fffffde) {
+ local_38 = 0x206;
+ uVar4 = local_38;
+ do {
+ *(undefined8 *)*plVar2 = uVar4;
+ plVar2 = wil_details_FeatureDescriptors_SkipPadding(plVar2 + 7);
+ } while (plVar2 != (longlong *)0x0);
+ return;
+ }
+ }
+ else {
+ iVar1 = -0x3ffffddb;
+ }
+ wil_details_BuildFeatureStateCacheFromQueryResults(iVar1,(longlong)&local_28,(uint *)&local_38);
+ ppuVar3 = (undefined **)(plVar2 + 7);
+ *(undefined8 *)*plVar2 = local_38;
+ } while( true );
+}
+
```
## NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|RtlUnregisterFeatureUsageProvider|
|fullname|NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider|
|refcount|2|
|length|0|
|called||
|calling|DriverEntry|
|paramcount|0|
|address|EXTERNAL:00000035|
|sig|undefined RtlUnregisterFeatureUsageProvider(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider*
## NTOSKRNL.EXE::RtlQueryFeatureConfiguration
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|RtlQueryFeatureConfiguration|
|fullname|NTOSKRNL.EXE::RtlQueryFeatureConfiguration|
|refcount|4|
|length|0|
|called||
|calling|wil_RtlStagingConfig_QueryFeatureState
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_UpdateFeatureConfiguredStates|
|paramcount|0|
|address|EXTERNAL:0000001e|
|sig|undefined RtlQueryFeatureConfiguration(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlQueryFeatureConfiguration*
## NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|RtlUnregisterFeatureConfigurationChangeNotification|
|fullname|NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification|
|refcount|2|
|length|0|
|called||
|calling|DriverEntry|
|paramcount|0|
|address|EXTERNAL:00000036|
|sig|undefined RtlUnregisterFeatureConfigurationChangeNotification(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification*
## NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|RtlQueryFeatureConfigurationChangeStamp|
|fullname|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp|
|refcount|2|
|length|0|
|called||
|calling|wil_InitializeFeatureStaging|
|paramcount|0|
|address|EXTERNAL:00000034|
|sig|undefined RtlQueryFeatureConfigurationChangeStamp(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp*
## NTOSKRNL.EXE::RtlNotifyFeatureUsage
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|RtlNotifyFeatureUsage|
|fullname|NTOSKRNL.EXE::RtlNotifyFeatureUsage|
|refcount|2|
|length|0|
|called||
|calling|wil_details_FeatureReporting_ReportUsageToServiceDirect|
|paramcount|0|
|address|EXTERNAL:00000024|
|sig|undefined RtlNotifyFeatureUsage(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlNotifyFeatureUsage*
## NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|RtlRegisterFeatureConfigurationChangeNotification|
|fullname|NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification|
|refcount|2|
|length|0|
|called||
|calling|wil_InitializeFeatureStaging|
|paramcount|0|
|address|EXTERNAL:0000002f|
|sig|undefined RtlRegisterFeatureConfigurationChangeNotification(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification*
## NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|RtlRegisterFeatureUsageProvider|
|fullname|NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider|
|refcount|2|
|length|0|
|called||
|calling|wil_InitializeFeatureStaging|
|paramcount|0|
|address|EXTERNAL:0000002e|
|sig|undefined RtlRegisterFeatureUsageProvider(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider*
## NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|RtlArmFeatureUsageProviderFlushNotification|
|fullname|NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification|
|refcount|2|
|length|0|
|called||
|calling|wil_details_RecordFeatureUsageReporting|
|paramcount|0|
|address|EXTERNAL:00000031|
|sig|undefined RtlArmFeatureUsageProviderFlushNotification(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlArmFeatureUsageProviderFlushNotification*
## NTOSKRNL.EXE::RtlRecordFeatureUsage
### Function Meta
|Key|msfs_7824.sys|
| :---: | :---: |
|name|RtlRecordFeatureUsage|
|fullname|NTOSKRNL.EXE::RtlRecordFeatureUsage|
|refcount|3|
|length|0|
|called||
|calling|wil_details_RecordCachedUsage
wil_details_RecordFeatureUsageReporting|
|paramcount|0|
|address|EXTERNAL:00000039|
|sig|undefined RtlRecordFeatureUsage(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlRecordFeatureUsage*
# Modified
*Modified functions contain code changes*
## DriverEntry
### Match Info
|Key|msfs_4202.sys - msfs_7824.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.77|
|i_ratio|0.55|
|m_ratio|0.88|
|b_ratio|0.88|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|msfs_4202.sys|msfs_7824.sys|
| :---: | :---: | :---: |
|name|DriverEntry|DriverEntry|
|fullname|DriverEntry|DriverEntry|
|refcount|4|4|
|`length`|396|479|
|`called`|MsCreateDevice
NTOSKRNL.EXE::MmPageEntireDriver
NTOSKRNL.EXE::PsRegisterSiloMonitor
NTOSKRNL.EXE::PsStartSiloMonitor
__security_check_cookie|MsCreateDevice
NTOSKRNL.EXE::MmPageEntireDriver
NTOSKRNL.EXE::PsRegisterSiloMonitor
NTOSKRNL.EXE::PsStartSiloMonitor
NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider
__security_check_cookie
wil_InitializeFeatureStaging|
|calling|entry|entry|
|paramcount|1|1|
|`address`|1c000e080|140010250|
|`sig`|undefined __fastcall DriverEntry(longlong param_1)|ulonglong __fastcall DriverEntry(longlong param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### DriverEntry Called Diff
```diff
--- DriverEntry called
+++ DriverEntry called
@@ -4,0 +5,2 @@
+NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
+NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider
@@ -5,0 +8 @@
+wil_InitializeFeatureStaging
```
### DriverEntry Diff
```diff
--- DriverEntry
+++ DriverEntry
@@ -1,55 +1,72 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
-void DriverEntry(longlong param_1)
+ulonglong DriverEntry(longlong param_1)
{
- int iVar1;
+ uint uVar1;
+ ulonglong uVar2;
+ ulonglong uVar3;
undefined1 auStack_58 [32];
longlong local_38;
undefined1 local_30;
undefined4 local_2f;
undefined2 local_2b;
undefined1 local_29;
longlong local_28;
code *local_20;
code *local_18;
ulonglong local_10;
local_10 = __security_cookie ^ (ulonglong)auStack_58;
local_38 = 0;
local_2f = 0;
local_2b = 0;
local_29 = 0;
+ wil_InitializeFeatureStaging();
MmPageEntireDriver(DriverEntry);
_MsPagingPushLock = 0;
*(code **)(param_1 + 0x70) = MsFsdCreate;
MsDriverObject = param_1;
*(code **)(param_1 + 0x108) = MsFsdCreateMailslot;
*(code **)(param_1 + 0x80) = MsFsdClose;
*(code **)(param_1 + 0x88) = MsFsdRead;
*(code **)(param_1 + 0x90) = MsFsdWrite;
*(code **)(param_1 + 0x98) = MsFsdQueryInformation;
*(code **)(param_1 + 0xa0) = MsFsdSetInformation;
*(code **)(param_1 + 0xc0) = MsFsdQueryVolumeInformation;
*(code **)(param_1 + 0x100) = MsFsdCleanup;
*(code **)(param_1 + 0xd0) = MsFsdDirectoryControl;
*(code **)(param_1 + 0xd8) = MsFsdFsControl;
*(code **)(param_1 + 0x110) = MsFsdQuerySecurityInfo;
*(code **)(param_1 + 0x118) = MsFsdSetSecurityInfo;
MsCreateDevice(&local_38,'\x01');
local_28 = param_1 + 0x38;
local_2f = 0;
local_2b = 0;
local_20 = MsSiloCreateNotify;
local_29 = 0;
local_18 = MsSiloTerminateNotify;
local_30 = 1;
- iVar1 = PsRegisterSiloMonitor(&local_30,&MsSiloMonitor);
- if (-1 < iVar1) {
- PsStartSiloMonitor(MsSiloMonitor);
+ uVar1 = PsRegisterSiloMonitor(&local_30,&MsSiloMonitor);
+ uVar3 = (ulonglong)uVar1;
+ if (-1 < (int)uVar1) {
+ uVar2 = PsStartSiloMonitor(MsSiloMonitor);
+ uVar3 = uVar2 & 0xffffffff;
+ if (-1 < (int)uVar2) {
+ return uVar2;
+ }
}
- return;
+ if (g_wil_details_featureChangeNotification != 0) {
+ RtlUnregisterFeatureConfigurationChangeNotification();
+ g_wil_details_featureChangeNotification = 0;
+ }
+ if (g_wil_details_featureUsageProvider != 0) {
+ RtlUnregisterFeatureUsageProvider();
+ g_wil_details_featureUsageProvider = 0;
+ }
+ g_wil_details_isFeatureStagingInitialized = 0;
+ return uVar3;
}
```
## MsAddDataQueueEntry
### Match Info
|Key|msfs_4202.sys - msfs_7824.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.18|
|i_ratio|0.26|
|m_ratio|0.92|
|b_ratio|0.17|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|msfs_4202.sys|msfs_7824.sys|
| :---: | :---: | :---: |
|name|MsAddDataQueueEntry|MsAddDataQueueEntry|
|fullname|MsAddDataQueueEntry|MsAddDataQueueEntry|
|refcount|3|3|
|`length`|673|763|
|`called`|NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::KeSetTimer
memcpy|Feature_1829438777__private_IsEnabledDeviceUsageNoInline
MsRemoveDataQueueIrp
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeSetTimer
memcpy|
|calling|MsCommonWrite
MsFsdRead|MsCommonWrite
MsFsdRead|
|paramcount|6|6|
|`address`|1c000a1a0|14000c5d0|
|`sig`|undefined8 __fastcall MsAddDataQueueEntry(int * param_1, int param_2, uint param_3, longlong param_4, undefined8 param_5, longlong param_6)|undefined4 __fastcall MsAddDataQueueEntry(int * param_1, int param_2, uint param_3, longlong param_4, undefined8 param_5, longlong param_6)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### MsAddDataQueueEntry Called Diff
```diff
--- MsAddDataQueueEntry called
+++ MsAddDataQueueEntry called
@@ -0,0 +1,2 @@
+Feature_1829438777__private_IsEnabledDeviceUsageNoInline
+MsRemoveDataQueueIrp
@@ -1,0 +4 @@
+NTOSKRNL.EXE::ExFreePoolWithTag
```
### MsAddDataQueueEntry Diff
```diff
--- MsAddDataQueueEntry
+++ MsAddDataQueueEntry
@@ -1,141 +1,169 @@
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
-undefined8
+undefined4
MsAddDataQueueEntry(int *param_1,int param_2,uint param_3,longlong param_4,undefined8 param_5,
longlong param_6)
{
- undefined8 *puVar1;
- byte *pbVar2;
- longlong lVar3;
- longlong *plVar4;
- code *pcVar5;
- undefined1 uVar6;
- longlong lVar7;
+ longlong *plVar1;
+ longlong lVar2;
+ code *pcVar3;
+ undefined1 uVar4;
+ undefined4 uVar5;
+ longlong lVar6;
+ ulonglong uVar7;
longlong *plVar8;
- uint uVar9;
- undefined1 *puVar10;
- ulonglong _Size;
- undefined8 uVar11;
+ int unaff_ESI;
+ undefined1 *puVar9;
+ uint uVar10;
- _Size = (ulonglong)param_3;
- uVar11 = 0;
+ uVar7 = (ulonglong)param_3;
+ uVar5 = 0;
*(undefined8 *)(param_4 + 0x38) = 0;
if (param_2 == 0) {
- lVar3 = *(longlong *)(param_4 + 0xb8);
- puVar10 = (undefined1 *)(lVar3 + -0x48);
- *(undefined8 *)(lVar3 + -0x20) = 0;
- *(longlong *)(lVar3 + -0x30) = param_4;
- *(uint *)(lVar3 + -0x28) = param_3;
- *(undefined8 *)(lVar3 + -0x18) = param_5;
+ lVar2 = *(longlong *)(param_4 + 0xb8);
+ puVar9 = (undefined1 *)(lVar2 + -0x48);
+ *(undefined8 *)(lVar2 + -0x20) = 0;
+ *(longlong *)(lVar2 + -0x30) = param_4;
+ *(uint *)(lVar2 + -0x28) = param_3;
+ *(undefined8 *)(lVar2 + -0x18) = param_5;
if ((uint)(param_1[3] - param_1[4]) < param_3) {
if (param_3 != 0) {
- lVar7 = ExAllocatePool2(0x101,param_3,0x7246734d);
- *(longlong *)(lVar3 + -0x20) = lVar7;
- if (lVar7 == 0) goto LAB_0;
+ lVar6 = ExAllocatePool2(0x101,uVar7,0x7246734d);
+ *(longlong *)(lVar2 + -0x20) = lVar6;
+ if (lVar6 == 0) {
+ return 0xc000009a;
+ }
}
- uVar6 = 1;
+ uVar4 = 1;
}
else {
if (param_3 != 0) {
- lVar7 = ExAllocatePool2(0x100,_Size,0x7246734d);
- *(longlong *)(lVar3 + -0x20) = lVar7;
- if (lVar7 == 0) goto LAB_0;
+ lVar6 = ExAllocatePool2(0x100,param_3,0x7246734d);
+ *(longlong *)(lVar2 + -0x20) = lVar6;
+ if (lVar6 == 0) {
+ return 0xc000009a;
+ }
}
param_1[4] = param_1[4] + param_3;
- uVar6 = 0;
+ uVar4 = 0;
}
- *puVar10 = uVar6;
- uVar9 = *(uint *)(param_4 + 0x10);
- *(uint *)(param_4 + 0x10) = uVar9 | 0x50;
- lVar3 = *(longlong *)(lVar3 + -0x20);
- *(longlong *)(param_4 + 0x18) = lVar3;
- if (lVar3 != 0) {
- *(uint *)(param_4 + 0x10) = uVar9 | 0x70;
+ *puVar9 = uVar4;
+ uVar10 = *(uint *)(param_4 + 0x10);
+ *(uint *)(param_4 + 0x10) = uVar10 | 0x50;
+ lVar2 = *(longlong *)(lVar2 + -0x20);
+ *(longlong *)(param_4 + 0x18) = lVar2;
+ if (lVar2 != 0) {
+ *(uint *)(param_4 + 0x10) = uVar10 | 0x70;
}
*(int **)(param_4 + 0x30) = param_1;
- uVar11 = 0x103;
-LAB_1:
- *param_1 = param_2;
- if (param_2 == 1) {
- param_1[1] = param_1[1] + *(int *)(puVar10 + 0x20);
- param_1[2] = param_1[2] + 1;
+ uVar5 = 0x103;
+ }
+ else {
+ uVar10 = param_3 + 0x38;
+ if (uVar10 < 0x38) {
+ return 0xc000000d;
}
- puVar1 = (undefined8 *)(puVar10 + 8);
- plVar4 = *(longlong **)(param_1 + 8);
- if ((int *)*plVar4 != param_1 + 6) {
-LAB_2:
- pcVar5 = (code *)swi(0x29);
- (*pcVar5)(3);
- pcVar5 = (code *)swi(3);
- uVar11 = (*pcVar5)();
- return uVar11;
+ if ((uint)(param_1[3] - param_1[4]) < uVar10) {
+ puVar9 = (undefined1 *)ExAllocatePool2(0x101,uVar10,0x6446734d);
+ if (puVar9 == (undefined1 *)0x0) {
+ return 0xc000009a;
+ }
+ *(undefined1 **)(puVar9 + 0x28) = puVar9 + 0x38;
+ *puVar9 = 1;
}
- *puVar1 = param_1 + 6;
- *(longlong **)(puVar10 + 0x10) = plVar4;
- *plVar4 = (longlong)puVar1;
- *(undefined8 **)(param_1 + 8) = puVar1;
- lVar3 = *(longlong *)(puVar10 + 0x30);
- if (lVar3 != 0) {
- KeSetTimer(lVar3 + 0x18,*(undefined8 *)(*(longlong *)(lVar3 + 0x10) + 0xe8),lVar3 + 0x58);
+ else {
+ puVar9 = (undefined1 *)ExAllocatePool2(0x100);
+ if (puVar9 == (undefined1 *)0x0) {
+ return 0xc000009a;
+ }
+ *(undefined1 **)(puVar9 + 0x28) = puVar9 + 0x38;
+ param_1[4] = param_1[4] + uVar10;
+ *puVar9 = 0;
}
- if (param_2 == 0) {
- pbVar2 = (byte *)(*(longlong *)(param_4 + 0xb8) + 3);
- *pbVar2 = *pbVar2 | 1;
+ *(undefined8 *)(puVar9 + 0x18) = 0;
+ *(uint *)(puVar9 + 0x20) = param_3;
+ *(undefined8 *)(puVar9 + 0x30) = 0;
+ memcpy(*(void **)(puVar9 + 0x28),*(void **)(param_4 + 0x70),uVar7);
+ *(undefined8 *)(param_1 + -8) = _DAT_0;
+ *(ulonglong *)(param_4 + 0x38) = uVar7;
+ }
+ *param_1 = param_2;
+ if (param_2 == 1) {
+ param_1[1] = param_1[1] + *(int *)(puVar9 + 0x20);
+ param_1[2] = param_1[2] + 1;
+ }
+ plVar1 = (longlong *)(puVar9 + 8);
+ plVar8 = *(longlong **)(param_1 + 8);
+ if ((int *)*plVar8 == param_1 + 6) {
+ *plVar1 = (longlong)(param_1 + 6);
+ *(longlong **)(puVar9 + 0x10) = plVar8;
+ *plVar8 = (longlong)plVar1;
+ *(longlong **)(param_1 + 8) = plVar1;
+ lVar2 = *(longlong *)(puVar9 + 0x30);
+ if (lVar2 != 0) {
+ KeSetTimer(lVar2 + 0x18,*(undefined8 *)(*(longlong *)(lVar2 + 0x10) + 0xe8),lVar2 + 0x58);
+ }
+ if (param_2 != 0) {
+ return uVar5;
+ }
+ uVar7 = Feature_1829438777__private_IsEnabledDeviceUsageNoInline();
+ *(byte *)(*(longlong *)(param_4 + 0xb8) + 3) = *(byte *)(*(longlong *)(param_4 + 0xb8) + 3) | 1;
+ LOCK();
+ *(code **)(param_4 + 0x68) = MsCancelDataQueueIrp;
+ UNLOCK();
+ if ((int)uVar7 == 0) {
+ if (*(char *)(param_4 + 0x44) == '\0') {
+ return uVar5;
+ }
LOCK();
- *(code **)(param_4 + 0x68) = MsCancelDataQueueIrp;
+ lVar2 = *(longlong *)(param_4 + 0x68);
+ *(longlong *)(param_4 + 0x68) = 0;
UNLOCK();
- if (*(char *)(param_4 + 0x44) != '\0') {
- LOCK();
- lVar3 = *(longlong *)(param_4 + 0x68);
- *(longlong *)(param_4 + 0x68) = 0;
- UNLOCK();
- if (lVar3 != 0) {
- *(undefined4 *)(param_4 + 0x30) = 0xc0000120;
- plVar8 = (longlong *)(param_4 + 0xa8);
- plVar4 = *(longlong **)(param_6 + 8);
- if (*plVar4 != param_6) goto LAB_2;
- *plVar8 = param_6;
- *(longlong **)(param_4 + 0xb0) = plVar4;
- *plVar4 = (longlong)plVar8;
- *(longlong **)(param_6 + 8) = plVar8;
- }
+ if (lVar2 == 0) {
+ return uVar5;
+ }
+ *(undefined4 *)(param_4 + 0x30) = 0xc0000120;
+ plVar8 = (longlong *)(param_4 + 0xa8);
+ plVar1 = *(longlong **)(param_6 + 8);
+ if (*plVar1 == param_6) {
+ *plVar8 = param_6;
+ *(longlong **)(param_4 + 0xb0) = plVar1;
+ *plVar1 = (longlong)plVar8;
+ *(longlong **)(param_6 + 8) = plVar8;
+ return uVar5;
+ }
+ }
+ else {
+ if (*(char *)(param_4 + 0x44) == '\0') {
+ return uVar5;
+ }
+ LOCK();
+ lVar2 = *(longlong *)(param_4 + 0x68);
+ *(longlong *)(param_4 + 0x68) = 0;
+ UNLOCK();
+ if (lVar2 == 0) {
+ return uVar5;
+ }
+ MsRemoveDataQueueIrp(param_4,param_1);
+ *(undefined4 *)(param_4 + 0x30) = 0xc0000120;
+ plVar8 = (longlong *)(param_4 + 0xa8);
+ plVar1 = *(longlong **)(param_6 + 8);
+ if (*plVar1 == param_6) {
+ *plVar8 = param_6;
+ *(longlong **)(param_4 + 0xb0) = plVar1;
+ *plVar1 = (longlong)plVar8;
+ *(longlong **)(param_6 + 8) = plVar8;
+ return uVar5;
}
}
}
- else {
- uVar9 = param_3 + 0x38;
- if (uVar9 < 0x38) {
- return 0xc000000d;
- }
- if ((uint)(param_1[3] - param_1[4]) < uVar9) {
- puVar10 = (undefined1 *)ExAllocatePool2(0x101);
- if (puVar10 != (undefined1 *)0x0) {
- *(undefined1 **)(puVar10 + 0x28) = puVar10 + 0x38;
- *puVar10 = 1;
-LAB_3:
- *(undefined8 *)(puVar10 + 0x18) = 0;
- *(uint *)(puVar10 + 0x20) = param_3;
- *(undefined8 *)(puVar10 + 0x30) = 0;
- memcpy(*(void **)(puVar10 + 0x28),*(void **)(param_4 + 0x70),_Size);
- *(undefined8 *)(param_1 + -8) = _DAT_4;
- *(ulonglong *)(param_4 + 0x38) = _Size;
- goto LAB_1;
- }
- }
- else {
- puVar10 = (undefined1 *)ExAllocatePool2(0x100,uVar9,0x6446734d);
- if (puVar10 != (undefined1 *)0x0) {
- *(undefined1 **)(puVar10 + 0x28) = puVar10 + 0x38;
- param_1[4] = param_1[4] + uVar9;
- *puVar10 = 0;
- goto LAB_3;
- }
- }
-LAB_0:
- uVar11 = 0xc000009a;
+ pcVar3 = (code *)swi(0x29);
+ uVar5 = (*pcVar3)(3);
+ if (unaff_ESI == 1) {
+ ExFreePoolWithTag(param_5,0);
}
- return uVar11;
+ return uVar5;
}
```
# Modified (No Code Changes)
*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname
## __GSHandlerCheck
### Match Info
|Key|msfs_4202.sys - msfs_7824.sys|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|0.88|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|msfs_4202.sys|msfs_7824.sys|
| :---: | :---: | :---: |
|name|__GSHandlerCheck|__GSHandlerCheck|
|fullname|__GSHandlerCheck|__GSHandlerCheck|
|`refcount`|3|8|
|length|29|29|
|called|__GSHandlerCheckCommon|__GSHandlerCheckCommon|
|calling|||
|paramcount|4|4|
|`address`|1c0001494|140001f98|
|sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
## NTOSKRNL.EXE::ExFreePoolWithTag
### Match Info
|Key|msfs_4202.sys - msfs_7824.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|
### Function Meta Diff
|Key|msfs_4202.sys|msfs_7824.sys|
| :---: | :---: | :---: |
|name|ExFreePoolWithTag|ExFreePoolWithTag|
|fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag|
|`refcount`|25|26|
|length|0|0|
|called|||
|`calling`|Expand for full list:
MsCancelTimer
MsCommonCreateMailslot
MsCommonSetSecurityInfo
MsCreateDefaultRootSecurity
MsCreateFcb
MsCreateMailslotPrefix
MsDeleteFcb
MsDeleteProtectedPrefix
MsFsdClose
MsFsdRead
MsRemoveDataQueueEntry
MsTimeoutRead
MsWriteDataQueueExpand for full list:
MsAddDataQueueEntry
MsCancelTimer
MsCommonCreateMailslot
MsCommonSetSecurityInfo
MsCreateDefaultRootSecurity
MsCreateFcb
MsCreateMailslotPrefix
MsDeleteFcb
MsDeleteProtectedPrefix
MsFsdClose
MsFsdRead
MsRemoveDataQueueEntry
MsTimeoutRead
MsWriteDataQueue
MsCreateMailslotPrefix
__GSHandlerCheckCommon|DriverEntry
MsCreateMailslotPrefix
__GSHandlerCheckCommon
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates|
|paramcount|1|1|
|`address`|1c0001620|140002100|
|sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### __security_check_cookie Calling Diff
```diff
--- __security_check_cookie calling
+++ __security_check_cookie calling
@@ -3,0 +4,5 @@
+wil_RtlStagingConfig_QueryFeatureState
+wil_details_FeatureReporting_ReportUsageToServiceDirect
+wil_details_PopulateInitialConfiguredFeatureStates
+wil_details_RecordCachedUsage
+wil_details_UpdateFeatureConfiguredStates
```
## MsRemoveDataQueueIrp
### Match Info
|Key|msfs_4202.sys - msfs_7824.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.82|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|msfs_4202.sys|msfs_7824.sys|
| :---: | :---: | :---: |
|name|MsRemoveDataQueueIrp|MsRemoveDataQueueIrp|
|fullname|MsRemoveDataQueueIrp|MsRemoveDataQueueIrp|
|`refcount`|2|3|
|length|110|110|
|called|MsCancelTimer|MsCancelTimer|
|`calling`|MsCancelDataQueueIrp|MsAddDataQueueEntry
MsCancelDataQueueIrp|
|paramcount|2|2|
|`address`|1c0007250|140009250|
|sig|undefined __fastcall MsRemoveDataQueueIrp(longlong param_1, undefined4 * param_2)|undefined __fastcall MsRemoveDataQueueIrp(longlong param_1, undefined4 * param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### MsRemoveDataQueueIrp Calling Diff
```diff
--- MsRemoveDataQueueIrp calling
+++ MsRemoveDataQueueIrp calling
@@ -0,0 +1 @@
+MsAddDataQueueEntry
```
Generated with `ghidriff` version: 1.0.0 on 2026-08-18T21:56:09