# mk-7019.sys-mk-7171.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_3602159931__private_IsEnabledDeviceUsageNoInline](#feature_3602159931__private_isenableddeviceusagenoinline) * [Feature_3602159931__private_IsEnabledFallback](#feature_3602159931__private_isenabledfallback) * [UpdateMediumCachePassive](#updatemediumcachepassive) * [UpdateMediumCachePassive_Do](#updatemediumcachepassive_do) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [NTOSKRNL.EXE::RtlNotifyFeatureUsage](#ntoskrnlexertlnotifyfeatureusage) * [NTOSKRNL.EXE::IoQueueWorkItemEx](#ntoskrnlexeioqueueworkitemex) * [NTOSKRNL.EXE::KeInitializeEvent](#ntoskrnlexekeinitializeevent) * [NTOSKRNL.EXE::IoGetRelatedDeviceObject](#ntoskrnlexeiogetrelateddeviceobject) * [Modified](#modified) * [UpdateMediumCache](#updatemediumcache) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [NTOSKRNL.EXE::ExFreePool](#ntoskrnlexeexfreepool) * [NTOSKRNL.EXE::IoFreeWorkItem](#ntoskrnlexeiofreeworkitem) * [NTOSKRNL.EXE::KeSetEvent](#ntoskrnlexekesetevent) * [NTOSKRNL.EXE::RtlQueryFeatureConfiguration](#ntoskrnlexertlqueryfeatureconfiguration) * [__security_check_cookie](#__security_check_cookie) * [NTOSKRNL.EXE::IoAllocateWorkItem](#ntoskrnlexeioallocateworkitem) * [NTOSKRNL.EXE::ExAllocatePoolWithTag](#ntoskrnlexeexallocatepoolwithtag) * [NTOSKRNL.EXE::KeWaitForSingleObject](#ntoskrnlexekewaitforsingleobject) * [KS.SYS::KsCacheMedium](#kssyskscachemedium) # Visual Chart Diff ```mermaid flowchart LR UpdateMediumCache-2-old<--Match 87%-->UpdateMediumCache-2-new subgraph mk-7171.sys UpdateMediumCache-2-new subgraph Added direction LR Feature_3602159931__private_IsEnabledDeviceUsageNoInline Feature_3602159931__private_IsEnabledFallback UpdateMediumCachePassive UpdateMediumCachePassive_Do wil_details_FeatureReporting_RecordUsageInCache wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath wil_details_IsEnabledFallback NTOSKRNLEXE-RtlNotifyFeatureUsage NTOSKRNLEXE-IoQueueWorkItemEx NTOSKRNLEXE-KeInitializeEvent NTOSKRNLEXE-IoGetRelatedDeviceObject end end subgraph mk-7019.sys UpdateMediumCache-2-old end ``` ```mermaid pie showData title Function Matches - 96.4286% "unmatched_funcs_len" : 14 "matched_funcs_len" : 378 ``` ```mermaid pie showData title Matched Function Similarity - 97.0899% "matched_funcs_with_code_changes_len" : 1 "matched_funcs_with_non_code_changes_len" : 10 "matched_funcs_no_changes_len" : 367 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ./proj --project-name mskssrv-59514 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 mk-7019.sys mk-7171.sys ``` #### Verbose Args

``` --old ['mk-7019.sys'] --new [['mk-7171.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name mskssrv-59514 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/mskssrv.sys/FA0A7F1A12000/mskssrv.sys -O mskssrv.sys.x64.10.0.26100.7019 wget https://msdl.microsoft.com/download/symbols/mskssrv.sys/D4B2C21D13000/mskssrv.sys -O mskssrv.sys.x64.10.0.26100.7171 ``` ## Binary Metadata Diff ```diff --- mk-7019.sys Meta +++ mk-7171.sys Meta @@ -1,44 +1,44 @@ -Program Name: mk-7019.sys +Program Name: mk-7171.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 79952 +# of Bytes: 84048 # of Memory Blocks: 14 -# of Instructions: 6315 -# of Defined Data: 637 -# of Functions: 189 -# of Symbols: 1029 +# of Instructions: 7109 +# of Defined Data: 668 +# of Functions: 203 +# of Symbols: 1120 # of Data Types: 160 # of Data Type Categories: 12 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 16:58:23 SGT 2026 +Date Created: Sun Aug 16 16:58:27 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/mskssrv-59514/mk-7019.sys -Executable MD5: ca3c8afd16c715bd6dcc1742b6330f3f -Executable SHA256: 7763ca15ee9b4480f4abff6dc44d17932b8b0dc59757d1bb434614e6355b8d1f -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/mskssrv-59514/mk-7019.sys?MD5=ca3c8afd16c715bd6dcc1742b6330f3f +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/mskssrv-59514/mk-7171.sys +Executable MD5: bfdfc7fe4270cbda0162f5b6d20f7163 +Executable SHA256: 85b6bc83bd4090877b886bd64fe6dbc1fc2a8fc6c71c299439dfc4f079b8b2a8 +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/mskssrv-59514/mk-7171.sys?MD5=bfdfc7fe4270cbda0162f5b6d20f7163 PDB Age: 1 PDB File: mskssrv.pdb -PDB GUID: d6f57a1e-2b87-1daa-a29a-f80254c50675 +PDB GUID: 35545a08-b1ee-92e1-40f8-8fd7383749d4 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: MS KS Server -PE Property[FileVersion]: 10.0.26100.7019 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.7171 (WinBuild.160101.0800) PE Property[InternalName]: mskssrv.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: mskssrv.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7019 +PE Property[ProductVersion]: 10.0.26100.7171 PE Property[Translation]: 4b00000 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra mk-7019.sys Decompiler Options

Ghidra mk-7019.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra mk-7019.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra mk-7171.sys Decompiler Options

Ghidra mk-7171.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra mk-7171.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|14| |deleted_funcs_len|0| |modified_funcs_len|11| |added_symbols_len|11| |deleted_symbols_len|0| |diff_time|2.808173179626465| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 188, 'ExternalsName': 66})| |items_to_process|36| |diff_types|Counter({'refcount': 10, 'address': 10, 'calling': 9, 'code': 1, 'length': 1, 'sig': 1, 'called': 1})| |unmatched_funcs_len|14| |total_funcs_len|392| |matched_funcs_len|378| |matched_funcs_with_code_changes_len|1| |matched_funcs_with_non_code_changes_len|10| |matched_funcs_no_changes_len|367| |match_func_similarity_percent|97.0899%| |func_match_overall_percent|96.4286%| |first_matches|Counter({'SymbolsHash': 188})| ```mermaid pie showData title All Matches "SymbolsHash" : 188 "ExternalsName" : 66 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 188 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 14 "deleted_funcs_len" : 0 "modified_funcs_len" : 11 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 11 "deleted_symbols_len" : 0 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_3602159931__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|Feature_3602159931__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_3602159931__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|49| |called|Feature_3602159931__private_IsEnabledFallback| |calling|UpdateMediumCache| |paramcount|0| |address|140001598| |sig|ulonglong __fastcall Feature_3602159931__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3602159931__private_IsEnabledDeviceUsageNoInline +++ Feature_3602159931__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,17 @@ + +ulonglong Feature_3602159931__private_IsEnabledDeviceUsageNoInline(void) + +{ + ulonglong uVar1; + undefined8 local_res8; + + local_res8 = (ulonglong)Feature_3602159931__private_featureState; + if ((Feature_3602159931__private_featureState & 0x10) == 0) { + uVar1 = Feature_3602159931__private_IsEnabledFallback(local_res8,3); + } + else { + uVar1 = (ulonglong)(Feature_3602159931__private_featureState & 1); + } + return uVar1; +} + ``` ## Feature_3602159931__private_IsEnabledFallback ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|Feature_3602159931__private_IsEnabledFallback| |fullname|Feature_3602159931__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3602159931__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|1400015d0| |sig|undefined __fastcall Feature_3602159931__private_IsEnabledFallback(ulonglong param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3602159931__private_IsEnabledFallback +++ Feature_3602159931__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3602159931__private_IsEnabledFallback(ulonglong param_1,int param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3602159931__private_descriptor); + return; +} + ``` ## UpdateMediumCachePassive ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|UpdateMediumCachePassive| |fullname|UpdateMediumCachePassive| |refcount|2| |length|328| |called|NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePool
NTOSKRNL.EXE::IoAllocateWorkItem
NTOSKRNL.EXE::IoFreeWorkItem
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IoQueueWorkItemEx
NTOSKRNL.EXE::KeInitializeEvent
NTOSKRNL.EXE::KeWaitForSingleObject| |calling|UpdateMediumCache| |paramcount|4| |address|1400020f0| |sig|int __fastcall UpdateMediumCachePassive(undefined8 param_1, longlong param_2, longlong param_3, undefined4 param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- UpdateMediumCachePassive +++ UpdateMediumCachePassive @@ -0,0 +1,42 @@ + +int UpdateMediumCachePassive + (undefined8 param_1,longlong param_2,longlong param_3,undefined4 param_4) + +{ + int iVar1; + longlong lVar2; + longlong *plVar3; + + lVar2 = IoGetRelatedDeviceObject(); + if ((((lVar2 == 0) || (param_3 == 0)) || (*(int *)(param_3 + 4) == 0)) || (param_2 == 0)) { + iVar1 = -0x3fffffff; + } + else { + lVar2 = IoAllocateWorkItem(lVar2); + if (lVar2 == 0) { + iVar1 = -0x3fffff66; + } + else { + plVar3 = (longlong *)ExAllocatePoolWithTag(0x600,0x38,0x70636d55); + if (plVar3 == (longlong *)0x0) { + iVar1 = -0x3fffff66; + } + else { + KeInitializeEvent(plVar3 + 3,0,0); + *(undefined4 *)(plVar3 + 6) = 0; + *plVar3 = param_2; + plVar3[1] = param_3; + *(undefined4 *)(plVar3 + 2) = param_4; + IoQueueWorkItemEx(lVar2,UpdateMediumCachePassive_Do,1,plVar3); + iVar1 = KeWaitForSingleObject(plVar3 + 3,0,0,0,0); + if (-1 < iVar1) { + iVar1 = (int)plVar3[6]; + } + ExFreePool(plVar3); + } + IoFreeWorkItem(lVar2); + } + } + return iVar1; +} + ``` ## UpdateMediumCachePassive_Do ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|UpdateMediumCachePassive_Do| |fullname|UpdateMediumCachePassive_Do| |refcount|3| |length|150| |called|KS.SYS::KsCacheMedium
NTOSKRNL.EXE::KeSetEvent| |calling|| |paramcount|2| |address|140002240| |sig|undefined __fastcall UpdateMediumCachePassive_Do(undefined8 param_1, undefined8 * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- UpdateMediumCachePassive_Do +++ UpdateMediumCachePassive_Do @@ -0,0 +1,26 @@ + +void UpdateMediumCachePassive_Do(undefined8 param_1,undefined8 *param_2) + +{ + int iVar1; + uint uVar2; + longlong *plVar3; + + uVar2 = 0; + iVar1 = 0; + plVar3 = (longlong *)(param_2[1] + 8); + if (*(int *)(param_2[1] + 4) != 0) { + do { + if ((*plVar3 != 0x11cf62ce4747b320) || (plVar3[1] != 0xc104db28d6a5)) { + iVar1 = KsCacheMedium(*param_2,plVar3,*(int *)(param_2 + 2) == 2); + if (iVar1 < 0) break; + } + plVar3 = plVar3 + 3; + uVar2 = uVar2 + 1; + } while (uVar2 < *(uint *)(param_2[1] + 4)); + } + *(int *)(param_2 + 6) = iVar1; + KeSetEvent(param_2 + 3,0,0); + return; +} + ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2| |length|748| |called|| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|4| |address|1400022e0| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, uint param_3, uint param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -0,0 +1,175 @@ + +uint * wil_details_FeatureReporting_RecordUsageInCache + (uint *param_1,uint *param_2,uint param_3,uint param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint uVar5; + bool bVar6; + + param_1[0] = 0; + param_1[1] = 0; + param_1[2] = 0; + param_1[3] = 0; + param_1[4] = 0; + param_1[5] = 0; + if (param_3 == 0) { +LAB_1400024e9: + uVar4 = *param_2; + do { + uVar3 = uVar4; + param_1[1] = 0; + uVar2 = uVar3 | 1; + if ((uVar3 >> 0xe & 1) != (uint)(param_3 == 4)) { + uVar4 = uVar3 >> 5 & 0x1ff; + if (uVar4 != 0) { + param_1[1] = uVar4; + param_1[2] = ~-(uint)(param_3 != 0) & 4; + uVar2 = uVar3 & 0xffffc01f | 1; + } + uVar4 = 0; + if (param_3 == 4) { + uVar4 = 0x4000; + } + uVar2 = uVar4 | uVar2 & 0xffffbfff; + } + uVar4 = uVar2 >> 5 & 0x1ff; + uVar5 = uVar4 + 1; + if ((0x1ff < uVar5) || (uVar5 < uVar4)) { + param_1[2] = param_3; + param_1[1] = uVar4; + uVar5 = 1; + } + LOCK(); + uVar4 = *param_2; + bVar6 = uVar3 == uVar4; + if (bVar6) { + *param_2 = (uVar5 << 5 ^ uVar2) & 0x3fe0 ^ uVar2; + uVar4 = uVar3; + } + UNLOCK(); + } while (!bVar6); + *param_1 = ~uVar3 & 1; + } + else { + if (param_3 != 1) { + if ((param_3 == 2) || (param_3 == 3)) { +LAB_1400023bb: + uVar4 = 0; + if (param_3 == 2) { + uVar4 = 2; + } + else if (param_3 == 3) { + uVar4 = 8; + } + else if (param_3 == 6) { + uVar4 = 4; + } + else if (param_3 == 7) { + uVar4 = 0x10; + } + uVar3 = 1; + uVar2 = *param_2; + do { + uVar1 = uVar2; + uVar2 = uVar4 | uVar1; + param_1[4] = (uint)(uVar2 == uVar1); + uVar5 = uVar2 | 1; + if (uVar2 == uVar1) { + uVar5 = uVar2; + } + LOCK(); + uVar2 = *param_2; + bVar6 = uVar1 == uVar2; + if (bVar6) { + *param_2 = uVar5; + uVar2 = uVar1; + } + UNLOCK(); + } while (!bVar6); + if (((uVar5 & 1) == 0) || ((uVar1 & 1) != 0)) { + uVar3 = 0; + } + *param_1 = uVar3; + return param_1; + } + if (param_3 == 4) goto LAB_1400024e9; + if (param_3 != 5) { + if ((param_3 != 6) && (param_3 != 7)) { + uVar4 = param_3 - 0x140; + if ((int)uVar4 < 0x40) { + uVar2 = param_2[1]; + do { + if (((uVar2 & 0x10) == 0) || (uVar3 = 1, (uVar2 >> 5 & 0x3f) != uVar4)) { + uVar3 = 0; + } + param_1[4] = uVar3; + LOCK(); + uVar3 = param_2[1]; + bVar6 = uVar2 == uVar3; + if (bVar6) { + param_2[1] = (uVar4 * 0x20 ^ uVar2) & 0x7e0 ^ uVar2 | 0x10; + uVar3 = uVar2; + } + uVar2 = uVar3; + UNLOCK(); + } while (!bVar6); + if (param_1[4] != 0) { + return param_1; + } + } + param_1[2] = param_3; + param_1[1] = 1; + param_1[3] = param_4; + return param_1; + } + goto LAB_1400023bb; + } + } + uVar4 = *param_2; + do { + uVar3 = uVar4; + param_1[1] = 0; + uVar2 = uVar3 | 1; + if ((uVar3 & 0x400000) >> 0x16 != (uint)(param_3 == 5)) { + uVar4 = (uVar3 & 0x3f8000) >> 0xf; + if (uVar4 != 0) { + param_1[1] = uVar4; + uVar4 = 5; + if (param_3 != 1) { + uVar4 = 1; + } + uVar2 = uVar3 & 0xffc07fff | 1; + param_1[2] = uVar4; + } + uVar4 = 0; + if (param_3 == 5) { + uVar4 = 0x400000; + } + uVar2 = uVar4 | uVar2 & 0xffbfffff; + } + uVar4 = uVar2 >> 0xf & 0x7f; + uVar5 = uVar4 + 1; + if ((0x7f < uVar5) || (uVar5 < uVar4)) { + uVar5 = 1; + param_1[2] = param_3; + param_1[1] = uVar4; + } + LOCK(); + uVar4 = *param_2; + bVar6 = uVar3 == uVar4; + if (bVar6) { + *param_2 = (uVar5 << 0xf ^ uVar2) & 0x3f8000 ^ uVar2; + uVar4 = uVar3; + } + UNLOCK(); + } while (!bVar6); + *param_1 = ~uVar3 & 1; + } + param_1[4] = 0; + return param_1; +} + ``` ## wil_details_FeatureReporting_ReportUsageToService ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService| |refcount|2| |length|289| |called|_guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect| |calling|wil_details_IsEnabledFallback| |paramcount|3| |address|1400025d4| |sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(longlong param_1, ulonglong param_2, int param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -0,0 +1,59 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +void wil_details_FeatureReporting_ReportUsageToService + (longlong param_1,ulonglong param_2,int param_3) + +{ + bool bVar1; + undefined7 extraout_var; + uint uVar2; + uint uVar3; + byte bVar4; + int local_res18 [4]; + + uVar2 = (uint)param_2 & 1; + if (param_3 != 0) { + if (param_3 == 1) { + uVar3 = (uVar2 ^ 1) << 2; + goto LAB_1400026a5; + } + if (param_3 == 2) { + uVar3 = (uVar2 ^ 1) * 4 + 1; + goto LAB_1400026a5; + } + if (param_3 == 3) { + uVar3 = (uVar2 ^ 1) * 4 + 2; + goto LAB_1400026a5; + } + if (param_3 == 4) { + uVar3 = (uVar2 ^ 1) * 4 + 3; + goto LAB_1400026a5; + } + if (param_3 == 5) { + uVar3 = (uVar2 ^ 1) * 2 + 8; + goto LAB_1400026a5; + } + if (param_3 == 6) { + uVar3 = (uVar2 ^ 1) * 2 + 9; + goto LAB_1400026a5; + } + bVar4 = (char)param_3 + 0x9c; + if (bVar4 < 0x32) { + uVar3 = (-(uint)((param_2 & 1) != 0) & 0xffffffce) + 0x96 + (uint)bVar4; + goto LAB_1400026a5; + } + } + uVar3 = 0xff; +LAB_1400026a5: + local_res18[0] = param_3; + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(param_1,param_2,uVar3); + if (((int)CONCAT71(extraout_var,bVar1) != 0) && + (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { + (*g_wil_details_pfnFeatureLoggingHook) + (*(undefined4 *)(param_1 + 0x18),*(undefined8 *)(param_1 + 0x10),0,uVar2,local_res18,0 + ,0,1); + } + return; +} + ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2| |length|232| |called|NTOSKRNL.EXE::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3| |address|1400026fc| |sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(longlong param_1, undefined8 param_2, uint param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -0,0 +1,46 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +bool wil_details_FeatureReporting_ReportUsageToServiceDirect + (longlong param_1,undefined8 param_2,uint param_3) + +{ + uint6 uVar1; + uint *puVar2; + undefined1 auStack_98 [32]; + uint *local_78; + undefined8 local_68; + uint local_60 [6]; + uint local_48; + uint uStack_44; + uint uStack_40; + uint uStack_3c; + undefined8 local_38; + ulonglong local_30; + + local_30 = __security_cookie ^ (ulonglong)auStack_98; + puVar2 = wil_details_FeatureReporting_RecordUsageInCache + (local_60,*(uint **)(param_1 + 8),param_3,(uint)((ulonglong)param_2 >> 0x20)); + local_48 = *puVar2; + uStack_44 = puVar2[1]; + uStack_40 = puVar2[2]; + uStack_3c = puVar2[3]; + local_38 = *(undefined8 *)(puVar2 + 4); + if (g_wil_details_recordFeatureUsage != (code *)0x0) { + local_78 = &local_48; + (*g_wil_details_recordFeatureUsage) + (*(undefined4 *)(param_1 + 0x18),param_3,1,*(undefined8 *)(param_1 + 8)); + } + if ((((uint)param_2 >> 10 & 1) != 0) && (param_3 != 0xfe)) { + local_68._0_6_ = CONCAT24((short)param_3,*(undefined4 *)(param_1 + 0x18)); + uVar1 = (uint6)local_68; + local_68 = (ulonglong)(uint6)local_68; + if (((uint)param_2 >> 0xb & 1) != 0) { + local_68 = CONCAT26(1,uVar1); + } + RtlNotifyFeatureUsage(&local_68); + } + return (int)local_38 == 0; +} + ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3| |length|612| |called|NTOSKRNL.EXE::RtlQueryFeatureConfiguration
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_IsEnabledFallback| |paramcount|3| |address|1400027ec| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -0,0 +1,151 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (uint *param_1,ulonglong param_2,longlong param_3) + +{ + undefined8 *puVar1; + int iVar2; + int iVar3; + uint uVar4; + uint uVar5; + uint uVar6; + ulonglong uVar7; + uint uVar8; + uint uVar9; + ulonglong uVar10; + longlong *plVar11; + uint uVar12; + bool bVar13; + undefined1 auStack_a8 [32]; + undefined8 local_88; + ulonglong local_80; + undefined8 local_78; + undefined8 local_70; + undefined8 uStack_68; + undefined8 local_60; + undefined8 local_58; + undefined4 local_50; + ulonglong local_48; + + local_48 = __security_cookie ^ (ulonglong)auStack_a8; + iVar2 = 0; + local_88 = param_2; + if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) { + iVar2 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); + } + local_70 = 0; + uStack_68 = 0; + uVar12 = 1; + local_78 = 0; + uVar5 = 0; + local_60 = 0; + local_58 = 0; + local_50 = 0; + iVar3 = RtlQueryFeatureConfiguration + (*(undefined4 *)(param_3 + 0x18),1 < (byte)(*(char *)(param_3 + 0x1c) - 2U), + &local_78,&local_58); + if (iVar3 == 0) { + uVar8 = local_58._4_4_ >> 7 & 1; + local_70 = CONCAT44(local_70._4_4_,local_58._4_4_ >> 4) & 0xffffffff00000003; + uVar4 = local_58._4_4_ >> 6 & 1; + uVar5 = uVar12; + uVar6 = local_58._4_4_ >> 4 & 3; +LAB_14000289f: + uVar8 = uVar8 << 10; + if (uVar4 != 0) { + uVar4 = 0x800; + goto LAB_1400028cd; + } + } + else { + uVar8 = 0; + uVar4 = 0; + uVar6 = (uint)local_70; + if (iVar3 != 0x117) goto LAB_14000289f; + uVar8 = (local_58._4_4_ >> 7 & 1) << 10; + uVar5 = uVar12; + } + uVar4 = 0; +LAB_1400028cd: + uVar5 = -(uint)(uVar5 != 0) & uVar6 & 3; + if (uVar5 == 0) { + uVar9 = -(uint)(*(char *)(param_3 + 0x1f) != '\0') & 0x40; + } + else { + uVar9 = 0; + if (uVar6 == 2) { + uVar9 = 0x40; + } + } + uVar5 = uVar9 >> 6 ^ (uVar9 | uVar5 << 7 | uVar8 | uVar4); + if ((uVar9 != 0) && (plVar11 = *(longlong **)(param_3 + 0x20), plVar11 != (longlong *)0x0)) { + do { + puVar1 = (undefined8 *)*plVar11; + if (puVar1 == (undefined8 *)0x0) break; + if ((*(char *)((longlong)puVar1 + 0x1e) == '\0') && + (*(char *)((longlong)puVar1 + 0x1d) == '\0')) { + uVar4 = *(uint *)*puVar1; + local_80 = (ulonglong)uVar4; + if ((uVar4 & 2) == 0) { + uVar7 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*puVar1,local_80,(longlong)puVar1); + uVar4 = (uint)uVar7; + } + uVar6 = uVar5 & 0xfffffffe; + uVar5 = (uint)(((byte)uVar4 & (byte)uVar5 & 1) != 0); + } + else { + if (((uVar5 & 1) == 0) || (uVar6 = uVar12, *(char *)((longlong)puVar1 + 0x1f) == '\0')) { + uVar6 = 0; + } + uVar5 = uVar5 & 0xfffffffe; + } + uVar5 = uVar5 | uVar6; + plVar11 = plVar11 + 1; + } while ((uVar5 & 1) != 0); + } + if (*(char *)(param_3 + 0x1c) == '\0') { + uVar12 = -(uint)(iVar2 != 0) & 1; + } + uVar7 = param_2 & 0xffffffff; + do { + uVar10 = param_2; + uVar6 = (uint)uVar7; + local_88 = CONCAT44(local_88._4_4_,uVar6); + if ((uVar12 != 0) && (local_88 = CONCAT44(local_88._4_4_,uVar6), (uVar7 & 2) == 0)) { + uVar4 = (uVar5 ^ uVar6) & 0x9c1 ^ uVar6; + uVar6 = uVar4 | 2; + local_88 = CONCAT44(local_88._4_4_,uVar4) | 2; + } + if ((uVar10 & 4) == 0) { + uVar4 = (uVar6 ^ uVar5) & 0x400 ^ uVar6; + uVar6 = uVar4 | 4; + local_88 = CONCAT44(local_88._4_4_,uVar4) | 4; + } + uVar7 = uVar10 & 0xffffffff; + LOCK(); + uVar4 = *param_1; + bVar13 = (uint)uVar10 == uVar4; + if (bVar13) { + *param_1 = uVar6; + } + else { + uVar7 = (ulonglong)uVar4; + } + UNLOCK(); + param_2 = uVar7; + } while (!bVar13); + if (((uVar10 & 4) == 0) && + (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) { + (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) + (param_1,*(undefined1 *)(param_3 + 0x1c),iVar2); + } + if (uVar12 == 0) { + local_88 = CONCAT44(local_88._4_4_,(uVar5 ^ uVar6) & 0x9c1 ^ uVar6); + } + return local_88; +} + ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|2| |length|91| |called|| |calling|wil_details_IsEnabledFallback| |paramcount|3| |address|140002a58| |sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2, undefined8 * param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -0,0 +1,52 @@ + +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath + (uint param_1,int param_2,undefined8 *param_3) + +{ + uint *puVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + puVar1 = (uint *)*param_3; + if (param_2 == 3) { + uVar4 = 0x10; + } + else { + if (param_2 != 4) { + return; + } + uVar4 = 0x20; + } + if ((*(char *)((longlong)param_3 + 0x1e) == '\0') && (*(char *)((longlong)param_3 + 0x1d) == '\0') + ) { + if ((*puVar1 & 2) != 0) { + uVar3 = *puVar1; + while ((uVar3 & 1) == (param_1 & 1)) { + LOCK(); + uVar2 = *puVar1; + bVar5 = uVar3 == uVar2; + if (bVar5) { + *puVar1 = uVar4 | uVar3; + uVar2 = uVar3; + } + UNLOCK(); + if (bVar5) { + return; + } + uVar3 = uVar2; + if ((uVar2 & 2) == 0) { + return; + } + } + } + } + else { + LOCK(); + *puVar1 = *puVar1 | uVar4; + UNLOCK(); + } + return; +} + ``` ## wil_details_IsEnabledFallback ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback| |refcount|2| |length|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |calling|Feature_3602159931__private_IsEnabledFallback| |paramcount|3| |address|140002abc| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -0,0 +1,22 @@ + +uint wil_details_IsEnabledFallback(ulonglong param_1,int param_2,undefined8 *param_3) + +{ + uint uVar1; + ulonglong local_res8; + + uVar1 = (uint)param_1; + local_res8 = param_1 & 0xffffffff; + if ((param_1 & 2) == 0) { + local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*param_3,param_1,(longlong)param_3); + uVar1 = (uint)local_res8; + } + if ((param_2 != 0) && + (wil_details_FeatureReporting_ReportUsageToService((longlong)param_3,local_res8,param_2), + param_2 - 3U < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res8,param_2,param_3); + } + return uVar1 & 1; +} + ``` ## NTOSKRNL.EXE::RtlNotifyFeatureUsage ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|RtlNotifyFeatureUsage| |fullname|NTOSKRNL.EXE::RtlNotifyFeatureUsage| |refcount|2| |length|0| |called|| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|0| |address|EXTERNAL:0000001b| |sig|undefined RtlNotifyFeatureUsage(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::RtlNotifyFeatureUsage* ## NTOSKRNL.EXE::IoQueueWorkItemEx ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|IoQueueWorkItemEx| |fullname|NTOSKRNL.EXE::IoQueueWorkItemEx| |refcount|2| |length|0| |called|| |calling|UpdateMediumCachePassive| |paramcount|0| |address|EXTERNAL:0000001a| |sig|undefined IoQueueWorkItemEx(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::IoQueueWorkItemEx* ## NTOSKRNL.EXE::KeInitializeEvent ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|KeInitializeEvent| |fullname|NTOSKRNL.EXE::KeInitializeEvent| |refcount|2| |length|0| |called|| |calling|UpdateMediumCachePassive| |paramcount|0| |address|EXTERNAL:00000005| |sig|undefined KeInitializeEvent(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::KeInitializeEvent* ## NTOSKRNL.EXE::IoGetRelatedDeviceObject ### Function Meta |Key|mk-7171.sys| | :---: | :---: | |name|IoGetRelatedDeviceObject| |fullname|NTOSKRNL.EXE::IoGetRelatedDeviceObject| |refcount|2| |length|0| |called|| |calling|UpdateMediumCachePassive| |paramcount|0| |address|EXTERNAL:00000038| |sig|undefined IoGetRelatedDeviceObject(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTOSKRNL.EXE::IoGetRelatedDeviceObject* # Modified *Modified functions contain code changes* ## UpdateMediumCache ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.52| |i_ratio|0.49| |m_ratio|0.96| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|UpdateMediumCache|UpdateMediumCache| |fullname|UpdateMediumCache|UpdateMediumCache| |refcount|2|2| |`length`|364|391| |`called`|GetFilterPinCount
GetPinTypeList
KS.SYS::KsCacheMedium
KS.SYS::KsSynchronousIoControlDevice
NTOSKRNL.EXE::ExFreePool|Feature_3602159931__private_IsEnabledDeviceUsageNoInline
GetFilterPinCount
GetPinTypeList
KS.SYS::KsCacheMedium
KS.SYS::KsSynchronousIoControlDevice
NTOSKRNL.EXE::ExFreePool
UpdateMediumCachePassive| |calling|PropertySrv|PropertySrv| |paramcount|2|2| |`address`|140001f10|140001f60| |`sig`|ulonglong __fastcall UpdateMediumCache(undefined8 param_1, undefined8 param_2)|ulonglong __fastcall UpdateMediumCache(undefined8 param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UpdateMediumCache Called Diff ```diff --- UpdateMediumCache called +++ UpdateMediumCache called @@ -0,0 +1 @@ +Feature_3602159931__private_IsEnabledDeviceUsageNoInline @@ -5,0 +7 @@ +UpdateMediumCachePassive ``` ### UpdateMediumCache Diff ```diff --- UpdateMediumCache +++ UpdateMediumCache @@ -1,75 +1,81 @@ -ulonglong UpdateMediumCache(undefined8 param_1,undefined8 param_2) +ulonglong UpdateMediumCache(undefined8 param_1,longlong param_2) { longlong lVar1; uint uVar2; - ulonglong uVar3; + uint uVar3; ulonglong uVar4; - longlong *plVar5; + ulonglong uVar5; uint uVar6; - uint uVar7; - uint local_res18 [2]; - int local_res20 [2]; + longlong *plVar7; + int local_res18 [2]; + uint local_res20 [2]; undefined4 local_68 [2]; longlong local_60; undefined4 local_58; undefined4 uStack_54; undefined4 uStack_50; undefined4 uStack_4c; undefined4 local_48; undefined4 local_44; uint local_40; undefined4 local_3c; - uVar6 = 0; - local_res18[0] = 0; - uVar3 = GetFilterPinCount(param_1,local_res18); - uVar4 = uVar3; - if ((-1 < (int)uVar3) && (uVar4 = uVar3 & 0xffffffff, local_res18[0] != 0)) { + local_res20[0] = 0; + uVar4 = GetFilterPinCount(param_1,local_res20); + uVar5 = uVar4; + if ((-1 < (int)uVar4) && (uVar6 = 0, uVar5 = uVar4 & 0xffffffff, local_res20[0] != 0)) { do { - uVar7 = 0; - if ((int)uVar4 < 0) { - return uVar4; + if ((int)uVar5 < 0) { + return uVar5; } local_60 = 0; - local_res20[0] = 0; + local_res18[0] = 0; local_68[0] = 0; + local_3c = 0; local_58 = 0x8c134960; uStack_54 = 0x11cf51ad; uStack_50 = 0xf8948a87; uStack_4c = 0xc101; local_48 = 2; local_44 = 1; - local_3c = 0; local_40 = uVar6; - uVar2 = KsSynchronousIoControlDevice(param_1,0,0x2f0003,&local_58,0x20,local_res20,4,local_68) + uVar2 = KsSynchronousIoControlDevice(param_1,0,0x2f0003,&local_58,0x20,local_res18,4,local_68) ; if ((int)uVar2 < 0) { return (ulonglong)uVar2; } - uVar3 = GetPinTypeList(param_1,uVar6,6,&local_60); + uVar4 = GetPinTypeList(param_1,uVar6,6,&local_60); + uVar5 = uVar4 & 0xffffffff; + if ((int)uVar4 < 0) { + return uVar5; + } + uVar4 = Feature_3602159931__private_IsEnabledDeviceUsageNoInline(); lVar1 = local_60; - uVar4 = uVar3 & 0xffffffff; - if ((int)uVar3 < 0) { - return uVar4; + if ((int)uVar4 == 0) { + uVar2 = 0; + plVar7 = (longlong *)(local_60 + 8); + if (*(int *)(local_60 + 4) != 0) { + do { + if ((*plVar7 != 0x11cf62ce4747b320) || (plVar7[1] != 0xc104db28d6a5)) { + uVar3 = KsCacheMedium(param_2,plVar7,local_res18[0] == 2); + uVar5 = (ulonglong)uVar3; + if ((int)uVar3 < 0) break; + } + plVar7 = plVar7 + 3; + uVar2 = uVar2 + 1; + } while (uVar2 < *(uint *)(lVar1 + 4)); + } } - plVar5 = (longlong *)(local_60 + 8); - if (*(int *)(local_60 + 4) != 0) { - do { - if ((*plVar5 != 0x11cf62ce4747b320) || (plVar5[1] != 0xc104db28d6a5)) { - uVar2 = KsCacheMedium(param_2,plVar5,local_res20[0] == 2); - uVar4 = (ulonglong)uVar2; - if ((int)uVar2 < 0) break; - } - plVar5 = plVar5 + 3; - uVar7 = uVar7 + 1; - } while (uVar7 < *(uint *)(lVar1 + 4)); + else { + uVar2 = UpdateMediumCachePassive(param_1,param_2,local_60,local_res18[0]); + uVar5 = (ulonglong)uVar2; } ExFreePool(lVar1); uVar6 = uVar6 + 1; - } while (uVar6 < local_res18[0]); + } while (uVar6 < local_res20[0]); } - return uVar4; + return uVar5; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|7|9| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|140002478|140002f48| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::ExFreePool ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|ExFreePool|ExFreePool| |fullname|NTOSKRNL.EXE::ExFreePool|NTOSKRNL.EXE::ExFreePool| |`refcount`|15|16| |length|0|0| |called||| |`calling`|BuildFilterData
FSRendezvousServer::Release
GetPinTypeList
PropertySrv
SrvDispatchClose
SrvDispatchCreate
UpdateMediumCache
operator_delete|BuildFilterData
FSRendezvousServer::Release
GetPinTypeList
PropertySrv
SrvDispatchClose
SrvDispatchCreate
UpdateMediumCache
UpdateMediumCachePassive
operator_delete| |paramcount|0|0| |`address`|EXTERNAL:0000002c|EXTERNAL:0000002e| |sig|undefined ExFreePool(void)|undefined ExFreePool(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExFreePool Calling Diff ```diff --- NTOSKRNL.EXE::ExFreePool calling +++ NTOSKRNL.EXE::ExFreePool calling @@ -7,0 +8 @@ +UpdateMediumCachePassive ``` ## NTOSKRNL.EXE::IoFreeWorkItem ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|IoFreeWorkItem|IoFreeWorkItem| |fullname|NTOSKRNL.EXE::IoFreeWorkItem|NTOSKRNL.EXE::IoFreeWorkItem| |`refcount`|2|3| |length|0|0| |called||| |`calling`|FSStreamReg::~FSStreamReg|FSStreamReg::~FSStreamReg
UpdateMediumCachePassive| |paramcount|0|0| |`address`|EXTERNAL:00000012|EXTERNAL:00000001| |sig|undefined IoFreeWorkItem(void)|undefined IoFreeWorkItem(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::IoFreeWorkItem Calling Diff ```diff --- NTOSKRNL.EXE::IoFreeWorkItem calling +++ NTOSKRNL.EXE::IoFreeWorkItem calling @@ -1,0 +2 @@ +UpdateMediumCachePassive ``` ## NTOSKRNL.EXE::KeSetEvent ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|KeSetEvent|KeSetEvent| |fullname|NTOSKRNL.EXE::KeSetEvent|NTOSKRNL.EXE::KeSetEvent| |`refcount`|5|6| |length|0|0| |called||| |`calling`|FSRendezvousServer::NotifyContext
FSStreamReg::CheckRecycle
FSStreamReg::PublishRx
FSStreamReg::PublishTx|FSRendezvousServer::NotifyContext
FSStreamReg::CheckRecycle
FSStreamReg::PublishRx
FSStreamReg::PublishTx
UpdateMediumCachePassive_Do| |paramcount|0|0| |`address`|EXTERNAL:0000000c|EXTERNAL:00000030| |sig|undefined KeSetEvent(void)|undefined KeSetEvent(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeSetEvent Calling Diff ```diff --- NTOSKRNL.EXE::KeSetEvent calling +++ NTOSKRNL.EXE::KeSetEvent calling @@ -4,0 +5 @@ +UpdateMediumCachePassive_Do ``` ## NTOSKRNL.EXE::RtlQueryFeatureConfiguration ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|RtlQueryFeatureConfiguration|RtlQueryFeatureConfiguration| |fullname|NTOSKRNL.EXE::RtlQueryFeatureConfiguration|NTOSKRNL.EXE::RtlQueryFeatureConfiguration| |`refcount`|3|4| |length|0|0| |called||| |`calling`|wil_details_PopulateInitialConfiguredFeatureStates
wil_details_ReevaluateOnFeatureConfigurationChange|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_ReevaluateOnFeatureConfigurationChange| |paramcount|0|0| |`address`|EXTERNAL:00000015|EXTERNAL:00000017| |sig|undefined RtlQueryFeatureConfiguration(void)|undefined RtlQueryFeatureConfiguration(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::RtlQueryFeatureConfiguration Calling Diff ```diff --- NTOSKRNL.EXE::RtlQueryFeatureConfiguration calling +++ NTOSKRNL.EXE::RtlQueryFeatureConfiguration calling @@ -0,0 +1 @@ +wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ``` ## __security_check_cookie ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|10|12| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|BuildFilterData
FSStreamReg::CloseInitProcessInternal
FSStreamReg::CloseRegObject
FSStreamReg::CloseRegProcess
PropertySrv
__GSHandlerCheckCommon
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_ReevaluateOnFeatureConfigurationChange|

Expand for full list:
BuildFilterData
FSStreamReg::CloseInitProcessInternal
FSStreamReg::CloseRegObject
FSStreamReg::CloseRegProcess
PropertySrv
__GSHandlerCheckCommon
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_ReevaluateOnFeatureConfigurationChange

| |paramcount|1|1| |`address`|1400025e0|1400030b0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -6,0 +7,2 @@ +wil_details_FeatureReporting_ReportUsageToServiceDirect +wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ``` ## NTOSKRNL.EXE::IoAllocateWorkItem ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|IoAllocateWorkItem|IoAllocateWorkItem| |fullname|NTOSKRNL.EXE::IoAllocateWorkItem|NTOSKRNL.EXE::IoAllocateWorkItem| |`refcount`|2|3| |length|0|0| |called||| |`calling`|FSStreamReg::Initialize|FSStreamReg::Initialize
UpdateMediumCachePassive| |paramcount|0|0| |`address`|EXTERNAL:00000010|EXTERNAL:0000003a| |sig|undefined IoAllocateWorkItem(void)|undefined IoAllocateWorkItem(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::IoAllocateWorkItem Calling Diff ```diff --- NTOSKRNL.EXE::IoAllocateWorkItem calling +++ NTOSKRNL.EXE::IoAllocateWorkItem calling @@ -1,0 +2 @@ +UpdateMediumCachePassive ``` ## NTOSKRNL.EXE::ExAllocatePoolWithTag ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|ExAllocatePoolWithTag|ExAllocatePoolWithTag| |fullname|NTOSKRNL.EXE::ExAllocatePoolWithTag|NTOSKRNL.EXE::ExAllocatePoolWithTag| |`refcount`|10|11| |length|0|0| |called||| |`calling`|BuildFilterData
FSInitializeContextRendezvous
FSRendezvousServer::InitializeContext
FSRendezvousServer::InitializeStream
FSStreamReg::PublishTx
GetPinTypeList
PropertySrv
SrvDispatchCreate|BuildFilterData
FSInitializeContextRendezvous
FSRendezvousServer::InitializeContext
FSRendezvousServer::InitializeStream
FSStreamReg::PublishTx
GetPinTypeList
PropertySrv
SrvDispatchCreate
UpdateMediumCachePassive| |paramcount|0|0| |`address`|EXTERNAL:00000029|EXTERNAL:00000002| |sig|undefined ExAllocatePoolWithTag(void)|undefined ExAllocatePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAllocatePoolWithTag Calling Diff ```diff --- NTOSKRNL.EXE::ExAllocatePoolWithTag calling +++ NTOSKRNL.EXE::ExAllocatePoolWithTag calling @@ -8,0 +9 @@ +UpdateMediumCachePassive ``` ## NTOSKRNL.EXE::KeWaitForSingleObject ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|KeWaitForSingleObject|KeWaitForSingleObject| |fullname|NTOSKRNL.EXE::KeWaitForSingleObject|NTOSKRNL.EXE::KeWaitForSingleObject| |`refcount`|7|8| |length|0|0| |called||| |`calling`|FSGetRendezvousServer
FSInitializeContextRendezvous
FSRendezvousClose
FSRendezvousServer::Lock
FSStreamReg::Lock
FsDriverUnload|FSGetRendezvousServer
FSInitializeContextRendezvous
FSRendezvousClose
FSRendezvousServer::Lock
FSStreamReg::Lock
FsDriverUnload
UpdateMediumCachePassive| |paramcount|0|0| |address|EXTERNAL:00000008|EXTERNAL:00000008| |sig|undefined KeWaitForSingleObject(void)|undefined KeWaitForSingleObject(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::KeWaitForSingleObject Calling Diff ```diff --- NTOSKRNL.EXE::KeWaitForSingleObject calling +++ NTOSKRNL.EXE::KeWaitForSingleObject calling @@ -6,0 +7 @@ +UpdateMediumCachePassive ``` ## KS.SYS::KsCacheMedium ### Match Info |Key|mk-7019.sys - mk-7171.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|mk-7019.sys|mk-7171.sys| | :---: | :---: | :---: | |name|KsCacheMedium|KsCacheMedium| |fullname|KS.SYS::KsCacheMedium|KS.SYS::KsCacheMedium| |`refcount`|2|3| |length|0|0| |called||| |`calling`|UpdateMediumCache|UpdateMediumCache
UpdateMediumCachePassive_Do| |paramcount|0|0| |`address`|EXTERNAL:00000041|EXTERNAL:00000046| |sig|undefined KsCacheMedium(void)|undefined KsCacheMedium(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KS.SYS::KsCacheMedium Calling Diff ```diff --- KS.SYS::KsCacheMedium calling +++ KS.SYS::KsCacheMedium calling @@ -1,0 +2 @@ +UpdateMediumCachePassive_Do ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-16T16:58:46}